Company: TFC
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0000092230-25-000020
Chunk: 65

Company: TRUIST FINANCIAL CORP
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1
Chunk 65
---
 by OFAC and the U.S. Department of State, which prohibit financial transactions involving certain individuals, entities, countries, and territories and impose other restrictions on certain investments and dealings.

Federal law grants substantial enforcement powers to federal financial institution regulators, OFAC, and the U.S. DOJ, among other government agencies, with respect to AML and OFAC laws and regulations. This enforcement authority includes, among other things, the ability to assess significant civil or criminal monetary penalties, fines, or restitution; to issue cease and desist or prohibition orders; and to initiate injunctive actions against financial institutions and institution-affiliated parties. These enforcement actions may be initiated for violations of laws and regulations, or for unsafe and unsound practices.

Privacy, Data Protection, and Cybersecurity

Various federal and state laws and regulations contain extensive data privacy, data protection and cybersecurity provisions, and the regulatory framework for data privacy, data protection, and cybersecurity is rapidly evolving. The FRB, FDIC, and other bank regulatory agencies have adopted guidelines for safeguarding confidential, personal customer information. These guidelines require each financial institution, under the supervision and ongoing oversight of its board of directors or an appropriate committee thereof, to create, implement, and maintain a comprehensive written information security program designed to support the security and confidentiality of customer information, protect against any anticipated threats or hazards to the security or integrity of such information and protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. In addition, various U.S. regulators, including the FRB and the SEC, have increased their focus on cybersecurity through guidance, examinations, and regulations.

Truist Financial Corporation   13

At the federal level, the Gramm-Leach-Bliley Act requires financial institutions to, among other things, implement policies and procedures regarding the disclosure of nonpublic personal information about consumers to non-affiliated third parties. In general, the statute requires that financial institutions provide explanations to consumers on their policies and procedures regarding the disclosure of such nonpublic personal information and, except as otherwise required by law, prohibits disclosing such personal information except as provided in the financial institution’s policies and procedures.

A joint regulation from the FRB, OCC, and FDIC requires a banking organization to notify its primary federal regulators as soon as possible and within 36 hours after identifying a “computer-security incident” that the banking organization believes in good faith has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade its business or operations in a manner that would, among