AmazonScience/document-haystack

1Reporting for Critical Infrastructure Act (“CIRCIA”), which, once rulemaking is complete, will require, among other things, 2certain companies, including Capital One, to report significant cyber incidents to the Department of Homeland Security’s 3Cybersecurity and Infrastructure Security Agency (“CISA”) within 72 hours from the time the company reasonably believes the 4incident occurred.5At the state level, we are subject to a number of laws and regulations, such as the California Consumer Privacy Act and its 6implementing regulations (as amended by the California Privacy Rights Act, collectively, the “CPRA”), which creates 7obligations on covered companies to, among other things, share certain information they have collected about California 8residents with those individuals, subject to certain exceptions. Many other states also have enacted or are in the process of 9enacting state-level privacy, data protection and/or data security laws and regulations, with which we may be required to 10comply. In addition, state laws require businesses to provide notice under certain circumstances to consumers whose personal 11information has been disclosed as a result of a data breach. Significant uncertainty exists as federal and state privacy, data 12protection and data security laws may be interpreted and applied differently and may create inconsistent or conflicting 13requirements.14For more information on privacy, data protection and data security laws and regulations at the international level, please see 15“Regulation by Authorities Outside the United States.”16For further discussion of privacy, data protection and data security, and related risks for our business, see “Item 1A. Risk 17Factors” under the headings “ We face risks related to our operational, technological and organizational infrastructure ,” “A 18cyber-attack or other security incident on us or third parties (including their supply chains) with which we conduct business, 19including an incident that results in the theft, loss, manipulation or misuse of information (including personal information), or 20the disabling of systems and access to information critical to business operations, may result in increased costs, reductions in 21revenue, reputational damage, legal exposure and business disruptions.” and “ Our required compliance with applicable laws 22and regulations related to privacy, data protection and data security, in addition to compliance with our own privacy policies 23and contractual obligations to third parties,  may increase our costs, reduce our revenue, increase our legal exposure and limit 24our ability to pursue business opportunities.”25Anti-Money Laundering, Combating the Financing of Terrorism and Economic Sanctions26The Bank Secrecy Act (“BSA”), as amended by the USA PATRIOT Act of 2001 (“Patriot Act”), and its implementing 27regulations require financial institutions, among other things, to implement a risk-based program reasonably designed to 28prevent money laundering and to combat the financing of terrorism, including through suspicious activity and currency 29transaction reporting, the implementation of policies, procedures, and internal controls, record-keeping and customer due 30diligence.31The Patriot Act provides enhanced information collection tools and enforcement mechanisms to the U.S. government and 32expanded certain requirements for financial institutions, including due diligence and record-keeping requirements for private 33banking and correspondent accounts; standards for verifying customer identification at account opening; rules to produce 34certain records upon request of a regulator or law enforcement agency; and rules to promote cooperation among financial 35institutions, regulators and law enforcement agencies in identifying parties that may be involved in terrorism, money laundering 36and other crimes.37The Anti-Money Laundering Act of 2020 (“AML Act”), enacted as part of the National Defense Authorization Act, requires the 38U.S. Treasury Department’s Financial Crimes Enforcement Network (“FinCEN”) to issue a number of rules that will update 39and expand the BSA’s regulatory requirements. For example, the AML Act requires FinCEN to issue National Anti-Money 40Laundering and Countering the Financing of Terrorism Priorities (the “National Priorities”), which the agency did in June 2021, 41and to conduct studies and issue regulations that may alter some of the due diligence, record-keeping and reporting 42requirements that the BSA and Patriot Act impose on banks. FinCEN has yet to issue a final rule that establishes the compliance 43obligations of financial institutions with respect to the National Priorities, and several other mandatory rulemakings under the 44AML Act remain outstanding. The AML Act also promotes increased information-sharing and use of technology and increases 45penalties for violations of the BSA and includes whistleblower incentives, both of which could increase the prospect of 46regulatory enforcement.47We are also required to comply with sanctions laws and regulations administered and imposed by the United States 48government, including the U.S. Treasury Department's Office of Foreign Assets Control (“OFAC”) and the Department of 49State, as well as comparable sanctions programs imposed by foreign governments and multilateral bodies. Sanctions can be 5015 Capital One Financial Corporation (COF)51The secret transportation is a "train".