3 unchanged sentences
One key way that Coastal mitigates information security threats is through the Company’s information security program (the “Information Security Program”).
−Removed: Cybersecurity is an integral subset of information security and the Information Security Program is designed to protect the Company from cybersecurity attacks, breaches, incidents and resulting consequences.
+Added: Cybersecurity is an integral subset of information security and the
+Added: Information Security Program is designed to protect the Company from cybersecurity attacks, breaches, incidents and resulting consequences.
As part of the Information Security Program, the Company has implemented preventative controls to minimize data loss, exposure and misuse.
11 unchanged sentences
Under this program, we have established risk-focused controls and processes that are designed to monitor our vendors’ compliance with relevant laws, regulations, and industry standards, such as data privacy regulations and anti-corruption laws, as well as relevant contractual obligations.
−Removed: Executive Management is responsible for managing the Information Security Program’s operations for identifying and assessing external and internal risks to the security, confidentiality, and integrity of nonpublic information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information.
−Removed: Coastal’s Information Security Officer (“ISO”) is designated by the Board and is responsible for implementing and monitoring the Information Security Program.
−Removed: The ISO is a Senior Vice President and has served in such role since 2010.
−Removed: The ISO has over 38-years of combined financial institution experience, which includes compliance, BSA, operations, physical security and information security.
−Removed: The ISO provides an annual report to the Board on the overall status of the Information Security Program and information technology incidents as necessary.
−Removed: The SVP of Technology also has responsibility for cybersecurity matters and reports to the Management Risk Committee, which consists of members of senior management.
−Removed: The Technology Subcommittee of the Management Risk Committee focuses on three pillars:
−Removed: Technology Strategy, InfoSec/Cyber, and Data.
+Added: Executive Management is responsible for managing the Information Security Program’s operations for identifying, assessing and mitigating external and internal risks to the security, confidentiality and integrity of nonpublic information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information.
+Added: Coastal’s Chief Information Security Officer (“CISO”) is designated by the Board and is responsible for implementing and monitoring the Information Security Program.
+Added: The CISO is an Executive Vice President who joined Coastal in this role in May 2025 with a background in security leadership at both fintech companies and large enterprises.
+Added: Furthermore, the Technology Committee is a standing committee of the Board that has general responsibility to oversee the Bank’s strategies related to technology, innovation, data privacy, information security, cybersecurity and third-party technology.
+Added: The CISO provides Information Security Program updates and current Key Risk and Performance Indicator (KRI/KPI) metrics to both the Technology Committee and the Board throughout the year, as well as an Annual Information Security report pursuant to the requirements of the Gramm-Leach-Bliley Act (GLBA) and other related frameworks.
The Board exercises oversight over the Information Security Program and reviews and approves the Information Security Program at least annually.
2 unchanged sentences
For a discussion regarding risks from cybersecurity threats, see “Item 1A.
−Removed: Risk Factors,” including the risk factors titled “— We are subject to laws regarding the privacy, information security and protection of personal information and any violation of these laws or another incident involving personal, confidential or proprietary information of individuals could damage our reputation and otherwise adversely affect our business, financial condition and earnings” and “— We are dependent on our information technology and telecommunications systems and third-party service providers;
+Added: Risk Factors,” including the risk factors titled “— We are subject to laws regarding the privacy, information security and protection of personal information and any violation of these laws or another incident involving personal, confidential or proprietary information of individuals could damage our reputation and otherwise adversely affect our business, financial condition and results of operations” and “— We are dependent on our information technology and telecommunications systems and third-party service providers;
systems failures, interruptions, security breaches and cybersecurity threats could have an adverse effect on our business, financial condition and results of operations.” As noted above, we are a regulated financial institution and are subject to financial privacy laws and to oversight by federal banking agencies.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.