Recent Developments in Bank-Fintech Regulations and Supervision

Presentation to Virginia Bankers Association Legal Affairs Committee September 25, 2023

1. Recent Developments in Supervision of Fintech Partnerships and Other Third- Party Relationships 2. Update on Recent and Anticipated SEC Rule Changes 2 22

1. Developments in Supervision of Fintech Partnerships March 2023 Office of Financial Technology established by the OCC June 2023 Interagency guidance on risk management for third-party relationships issued by federal bank regulators August 2023 Novel Activities Supervision Program established by the Federal Reserve 3 33

OCCs Office of Financial Technology Established in March 2023 Replaces and expands upon the OCC s Office of Innovation Continues the OCC s focus on technology and innovation Stated purposes include: o Bolster the OCC s expertise and ability to adapt to technological changes in the banking industry o Ensure the OCC s leadership and agility in providing high-quality supervision of bank-fintech partnerships 4 44

Federal Reserves Novel Activities Supervision Program Established in August 2023 Program will focus on crypto-assets, distributed ledger technology, and complex, technology-driven partnerships with nonbanks to deliver financial services to customers Stated purposes include: o Ensure that the risks associated with innovation are appropriately addressed o Enhance the monitoring and examination of novel activities Fed will notify organizations whose novel activities will be subject to examination through the Program 5 55

Interagency Guidance on Third-Party Relationships Standardizes third-party risk guidance from federal bank regulators Applies to all third-party relationships, not just fintech partnerships Emphasizes the need to tailor risk management focus based on the importance and complexity of the function 6 66

Interagency Guidance on Third-Party Relationships (cont.) Guidance on managing third-party relationships: o Planning for engaging third-party o Due diligence and selection of partner o Negotiation of contract o Ongoing monitoring of partner o Termination of relationship 7 77

Interagency Guidance on Third-Party Relationships (cont.) Guidance on structuring third-party risk management processes o Role of the board of directors in oversight of relationships Establish risk appetite Approve policies Monitor management o Role of management in oversight of relationships Develop and implement policies, procedures and practices commensurate with risk appetite Monitor third-party partners 8 88

Interagency Guidance on Third-Party Relationships (cont.) Conduct periodic independent reviews to assess effectiveness of third-party risk management processes o Assess alignment with business strategy o Assess whether processes and controls are designed and operating properly o Assess whether staffing (level and expertise) is appropriate Document and report third-party relationships o Inventory of current relationships along with risk profile o Maintain current, executed copies of all vendor contracts o Report to the board, as appropriate 9 99

Risk Management Focus Areas Compliance Risk o BSA, AML and OFAC o Consumer protection Privacy and data security Unfair, deceptive or abusive business practices 10 10 10

Risk Management Focus Areas (cont.) Operational Risk o Processes and controls o Monitoring o Staffing o Technology 11 11 11

Risk Management Focus Areas (cont.) Legal (Contractual) Risk o Rights to audit third-party o Limits on liability and indemnification o Ownership of intellectual property o Rights of regulators to supervise or prevent activity o Dispute resolution o Renewal and termination rights o Impact of mergers and acquisitions o Access to information 12 12 12

Risk Management Focus Areas (cont.) Other Risk o Interruptions in service or other failures o Ability to end relationship with partner o Replacing partner with new provider or building functionality in-house o Liquidity concerns 13 13 13

Practical Guidance The financial institution has ultimate responsibility o Regulators expect the financial institution to ensure compliance and manage risks Understand the business of the third-party before and during the relationship o Conduct appropriate due diligence before entering into relationship o Monitor and assess partners during lifecycle (set benchmarks) Provide for appropriate staffing to support function o Employ experts with direct responsibility for function; redundancy o Have systems and processes in place for potential growth 14 14 14

Practical Guidance (cont.) Communicate across departments Negotiate vendor agreements and understand their terms o Engage professionals and consultants as appropriate o Know the process and cost of extending or terminating agreement o Be wary of exclusive relationships Ensure third-party relationships are complementary to mission and expertise of financial institution Protect your brand and reputation 15 15 15

Update on SEC Rule Changes The SEC has been busy over the last year o Clawback policies (final rules October 2022) o Insider trading and Rule 10b5-1 disclosures (final rules December 2022) o Share repurchase disclosures (final rules May 2023) o Cybersecurity disclosures (final rules July 2023) What s next o Climate-related disclosures (final rules expected October 2023) o Human capital management (proposed rules expected October 2023) o Corporate board diversity (proposed rules expected April 2024) 16 16 16

Clawback Policies Companies listed on Nasdaq and NYSE are required to implement clawback policies to recover incentive compensation in the event the company is required to restate its financial statements Policies will apply to current and former executive officers, regardless of whether any misconduct occurred and regardless of a particular officer s responsibility for the erroneous financial statements, and will apply to compensation that is received on or after October 2, 2023 Companies are required to adopt a compliant policy by December 1, 2023 o Policy will be filed as exhibit to annual report on Form 10-K for FY 2023 17 17 17

Insider Trading and Rule 10b5-1 Disclosures 10b5-1 Plan requirements for directors and officers o Mandatory cooling off periods, written good faith certifications, and restrictions on multiple overlapping plans o Effective February 27, 2023 Enhanced disclosures o Quarterly disclosure of whether any director or officer adopted, modified, or terminated 10b5-1 plans or non-10b5-1 trading arrangements during the quarter and material terms (other than price) o Effective for quarterly reports on Form 10-Q beginning Q2 2023 Insider trading policies o Will be filed as exhibit to annual report on Form 10-K for FY 2024 18 18 18

Share Repurchase Disclosures Current requirement is to include quarterly repurchase data that is aggregated on a monthly basis New rules expand these quarterly disclosures to include tabular disclosure of company repurchase activity on a daily basis, including number of shares and average price, and also a breakdown of open market purchases, 10b-18 repurchases, and 10b5-1 plan repurchases Similar disclosure rules regarding adoption, modification or termination of company 10b5-1 plans as for directors and officers Effective for annual report on Form 10-K for FY 2023 (covering Q4 2023) 19 19 19

Cybersecurity Disclosures New requirement to disclose a material cybersecurity incident on a current basis (new Item 1.05 of Form 8-K) o Nature, scope, and timing of the incident o Material impact or reasonably likely material impact on financial condition and results of operations o Effective December 18, 2023 New annual disclosures o Processes for assessing, identifying, and managing material risks from cybersecurity threats o Whether risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the company o Board of directors oversight of risks from cybersecurity threats, and management s role and expertise in assessing and managing these risks o Effective for annual report on Form 10-K for FY 2023 20 20 20

Climate-Related Disclosures SEC proposed rules in March 2022 o Climate-related risks and actual or likely impact on business o Governance, oversight and management of climate-related risks and risk management processes o Emissions data, subject to third-party attestation or assurance o Financial statement metrics that would be part of footnotes to audited financial statements California legislature just passed two climate-related disclosure bills that Governor Newsom is expected to sign o Apply to U.S. companies that do business in California and have total revenues (company-wide) of $500 million (for some requirements) or $1 billion (for others) o Phase-in of disclosure requirements begins in 2026 21 21 21

Lee G. Lester Williams Mullen 200 S. 10thStreet, Suite 1600 Richmond, Virginia 23219 llester@williamsmullen.com (804) 420-6583 Benjamin A. McCall Williams Mullen 200 S. 10thStreet, Suite 1600 Richmond, Virginia 23219 bmccall@williamsmullen.com (804) 420-6218 22 22 22

THANK YOU! Please note: This presentation contains general, condensed summaries of actual legal matters, statutes and opinions for information purposes. It is not meant to be and should not be construed as legal advice. Individuals with particular needs on specific issues should retain the services of competent counsel. 23 23 23