STATE STREET CORPORATION
Q3 2023 Form 13-F

State Street Corporation manages its potential resolution through a Single Point of Entry (SPOE) strategy. Under this framework, the parent company has pre-funded a direct subsidiary, State Street Institutional Investment Trust (SSIF), with most of its non-subsidiary assets. In the event of material financial distress, SSIF is obligated to provide capital and liquidity to State Street Bank and other "Beneficiary Entities" to prevent them from entering resolution proceedings, while the parent company would commence Chapter 11 bankruptcy. The firm submits biennial resolution plans to the Federal Reserve and FDIC, with a full 165(d) plan due by July 1, 2027. Additionally, State Street Bank must submit an insured depository institution (IDI) resolution plan to the FDIC by July 1, 2026. The firm is also subject to the Orderly Liquidation Authority under Title II of the Dodd-Frank Act, which grants the FDIC broad powers to resolve the firm if it poses a risk to U.S. financial stability.

The firm’s operations are further constrained by the Volcker Rule, which prohibits proprietary trading and restricts ownership in covered funds, and the Bank Secrecy Act, which requires comprehensive anti-money laundering (AML) and sanctions compliance. State Street Corporation maintains an enterprise-wide program to comply with regulations from the U.S. Treasury’s OFAC and the Department of State, as well as foreign multilateral bodies. State Street Bank is a registered swap dealer with the CFTC, though it maintains a limited-purpose designation for certain interest rate swap activities conducted by its Global Treasury group. Internal operations are subject to strict affiliate transaction limits under Sections 23A and 23B of the Federal Reserve Act, which generally restrict extensions of credit or asset purchases between State Street Bank and its affiliates to 10% of the bank's capital for any single affiliate and 20% in the aggregate.

State Street Bank is a "custody bank" for FDIC purposes, allowing it to exclude certain liquid assets from its deposit insurance assessment base, which reduces its premiums. Following the 2023 failures of Silicon Valley Bank and Signature Bank, the firm was subject to special assessments to recover losses to the Deposit Insurance Fund. It recognized pre-tax expenses of approximately $387 million in 2023 and $99 million in 2024, followed by a $60 million pre-tax reduction in expense in 2025. Under the Dodd-Frank Act, State Street Corporation is required to act as a source of financial and managerial strength for its banking subsidiaries, creating a statutory obligation to commit resources during periods of distress. In the event of insolvency, the FDIC as receiver has the authority to transfer assets or repudiate contracts, with U.S. deposit liabilities afforded priority over general unsecured claims and deposits in non-U.S. branches.

The firm is subject to extensive cybersecurity and data privacy regulations, including the EU’s General Data Protection Regulation (GDPR) and the U.K. General Data Protection Regulation, as amended by the Data Use and Access Act 2025. It must comply with the Digital Operational Resilience Act (DORA) in the EU and U.S. requirements to notify federal regulators within 36 hours of a material "computer-security incident." Under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), the firm will be required to report covered incidents within 72 hours and ransom payments within 24 hours. Additionally, SEC rules require public disclosure of material cybersecurity incidents on Form 8-K within four business days of a materiality determination. The firm’s operating environment is also influenced by the monetary policies of the Federal Reserve, the Bank of England, and the European Central Bank, which affect interest rates and overall credit conditions.