Company: BANC-PF
Filing Date: 2025-03-27
Form Type: DEF 14A
Source: 0001169770-25-000015
Chunk: 31

Company: BANC OF CALIFORNIA, INC.
Filing Date: 2025-03-27
Form: DEF 14A
Chunk 31
---
 Report on Form 10-K for the year ended December 31, 2024.

#### 28Banc of CaliforniaAnnual Proxy Statement2025
| Corporate Sustainability |

Enterprise Risk Management Three Lines of Defense + Risk Appetite Statement Pillars:

#### Cyber/Information Security
The Company's Chief Information Security Officer (CISO) is responsible for the management and oversight of the enterprise information security department and our information security program. The Information Security department is responsible for Incident Response, Operations, Engineering, Information Security Governance, Risk, and Compliance for the Company. Our Information Security team consists of leaders, engineers, and analysts who provide an optimum mix of skills to execute our functions. Team members are generally required to meet professional education and certification standards. Our Chief Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.

Our objective for managing cybersecurity risk is to maintain appropriate layers of safeguards to protect information systems from possible threats and to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. Our information security program is designed in accordance with industry frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework and is periodically reviewed and updated at least annually and upon significant changes to our operating environment.

Protecting our systems to ensure the safety of customer information is critical to our business. We use multiple layers of protection to control access, detect unusual activity and reduce risk. We regularly conduct a variety of audits and vulnerability and penetration tests on our platforms, systems and applications and maintain comprehensive incident response plans to minimize potential risks, including cyber-attacks. By staying ahead of emerging threats and continuously refining our security measures, we aim to ensure the resilience and integrity of our information systems and data.

#### 29Banc of CaliforniaAnnual Proxy Statement2025
| Corporate Sustainability |

Sound Corporate Governance

Our Board of Directors and management are dedicated to maintaining sound and effective corporate governance practices. We have established a comprehensive corporate governance framework that consists of policies and programs designed to meet regulatory requirements and build value for the Company’s stockholders.

The key components of our corporate governance framework are reviewed and approved by the Board on a regular basis and are set forth below:

| Corporate Governance Guidelines                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |     | Related Party Transactions Policy                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| The Company’s Corporate Governance Guidelines provide a framework for effective governance of the Company and its subsidiaries.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |     | The Company’s Related Party Transactions Policy restricts transactions with related parties. The