
When the Bank becomes aware of an incident of unauthorized access to sensitive customer information, the Bank will conduct a reasonable investigation to promptly determine the likelihood that the information has been or will be misused. If the Bank determines that misuse of its information about a customer has occurred or is reasonably possible, it should notify the affected customer as soon as possible.
Customer notice may be delayed if an appropriate law enforcement agency determines that notification will interfere with a criminal investigation and provides the Bank with a written request for the delay. However, the Bank should notify its customers as soon as notification will no longer interfere with the investigation.

