Effective Date: September 30, 2026
Last Updated: September 30, 2026
Organization: First Heritage Trust Bank
Website: firstheritagetrust.com
This Company Policy establishes the general principles, standards, responsibilities, and operating expectations applicable to First Heritage Trust Bank ("First Heritage Trust Bank," "First Heritage," "the Bank," "we," "us," or "our").
The purpose of this policy is to establish a framework for:
responsible business conduct;
customer protection;
information security;
privacy;
regulatory compliance;
ethical conduct;
employee responsibilities;
financial integrity;
risk management;
fraud prevention;
conflicts of interest;
complaint handling;
operational security; and
responsible corporate governance.
This policy should be read together with applicable laws, regulations, employment policies, product agreements, procedures, and other Bank policies.
First Heritage Trust Bank is committed to conducting business according to principles of:
We seek to conduct business honestly and responsibly.
We seek to protect customer information, accounts, funds, and legitimate interests.
We maintain processes designed to protect financial and information systems.
We respect applicable privacy and data-protection requirements.
We operate in accordance with laws, regulations, contractual obligations, and applicable regulatory requirements.
Employees and representatives are expected to take responsibility for their actions and decisions.
Employees are expected to communicate and conduct themselves professionally.
The Bank's management and governing bodies are responsible for establishing appropriate oversight and accountability structures.
Responsibilities may include:
strategic oversight;
risk oversight;
compliance oversight;
financial oversight;
cybersecurity oversight;
operational oversight;
internal controls;
audit functions;
regulatory reporting; and
customer-protection oversight.
Specific governance responsibilities may vary according to the Bank's legal and regulatory structure.
First Heritage Trust Bank expects employees, officers, contractors, and authorized representatives to comply with applicable laws and internal requirements.
No employee is authorized to knowingly:
violate applicable law;
falsify records;
conceal material information;
circumvent required controls;
facilitate fraudulent activity;
misuse customer information; or
knowingly assist unlawful activity.
Employees should raise potential compliance concerns through appropriate internal channels.
Employees and representatives are expected to:
act honestly;
protect confidential information;
avoid conflicts of interest;
maintain accurate records;
treat customers respectfully;
comply with applicable laws;
protect Bank property;
avoid unauthorized use of systems;
report suspected misconduct; and
perform their responsibilities professionally.
First Heritage Trust Bank maintains controls designed to prevent, identify, investigate, and respond to fraudulent activity.
Fraud may include:
identity theft;
unauthorized transactions;
account takeover;
document fraud;
payment fraud;
internal theft;
false applications;
manipulation of records;
phishing;
social engineering;
cybercrime; and
other deceptive activity.
Suspected fraud may be investigated and reported to appropriate parties where required or permitted by law.
The Bank maintains procedures designed to comply with applicable anti-money-laundering and counter-terrorist-financing requirements.
Depending on applicable law, procedures may include:
customer identification;
customer due diligence;
beneficial ownership verification;
transaction monitoring;
sanctions screening;
suspicious activity monitoring;
recordkeeping;
employee training; and
regulatory reporting.
Employees must not intentionally assist in circumventing these controls.
The Bank may maintain controls designed to identify and prevent transactions involving prohibited persons, organizations, jurisdictions, or activities where required by applicable law.
Transactions may be delayed, rejected, blocked, or reviewed when required or permitted.
First Heritage Trust Bank seeks to treat customers fairly and respectfully.
Employees should:
provide accurate information;
avoid misleading statements;
explain applicable requirements;
protect confidential information;
process requests appropriately;
escalate complaints;
avoid discriminatory conduct prohibited by law; and
comply with applicable consumer-protection requirements.
Employees may only access customer information when authorized and when access is necessary for legitimate business purposes.
Employees must not:
browse customer accounts without authorization;
disclose customer information improperly;
share credentials;
copy information unnecessarily;
use customer information for personal purposes; or
disclose confidential information to unauthorized persons.
Violations may result in disciplinary action and, where applicable, legal consequences.
The Bank maintains information-security controls designed to protect:
customer information;
account systems;
payment systems;
internal systems;
employee information;
business information; and
other sensitive data.
Security controls may include:
authentication;
access controls;
encryption;
monitoring;
network protection;
vulnerability management;
backups;
incident response;
security testing; and
employee security training.
Employees receive access to systems based on their job responsibilities.
Access should be limited to the information and systems reasonably necessary to perform assigned duties.
Employees must not attempt to access systems or information without authorization.
Employees must protect passwords and authentication credentials.
Passwords must not be:
shared;
written in publicly accessible locations;
transmitted through unauthorized channels; or
reused in ways that create unnecessary security risks.
Where supported, multi-factor authentication should be used for sensitive systems.
Bank-issued devices and systems must be used responsibly.
Employees should:
keep devices secured;
use approved software;
install security updates;
report lost or stolen devices;
avoid unauthorized applications;
protect screens from unauthorized viewing; and
follow Bank security procedures.
Where remote work is permitted, employees must maintain appropriate security.
Remote workers should:
use authorized devices;
use approved networks or security controls;
protect confidential documents;
avoid public disclosure of customer information;
follow authentication requirements; and
report security incidents promptly.
The Bank maintains records in accordance with applicable laws, regulatory requirements, operational requirements, and internal procedures.
Records should be:
accurate;
complete;
appropriately secured;
accessible to authorized personnel; and
retained for the applicable period.
Employees must not intentionally falsify, destroy, conceal, or alter records improperly.
Employees responsible for financial records, reporting, accounting, or transactions must maintain accurate records.
The Bank prohibits intentional:
falsification;
concealment;
manipulation;
unauthorized alteration;
misappropriation; or
improper accounting treatment.
Employees must avoid situations in which personal interests improperly interfere with their professional responsibilities.
Potential conflicts may include:
personal financial interests;
outside employment;
relationships with vendors;
gifts;
investments;
business relationships;
personal relationships involving decision-making; and
other circumstances that could create an actual or apparent conflict.
Potential conflicts should be disclosed through appropriate internal channels.
Employees must not accept or provide gifts or entertainment that could improperly influence a business decision or create an inappropriate obligation.
Reasonable business courtesies may be permitted where consistent with applicable law and internal procedures.
First Heritage Trust Bank prohibits bribery and improper payments.
Employees must not offer, promise, authorize, request, or accept improper benefits intended to influence a business or governmental decision.
This applies to dealings with:
customers;
vendors;
business partners;
government officials;
regulators;
agents;
contractors; and
other parties.
Third-party providers may be subject to appropriate due diligence before receiving access to Bank systems or information.
Depending on the service, vendor oversight may include:
security assessments;
contractual requirements;
privacy requirements;
service-level requirements;
compliance reviews;
access controls; and
ongoing monitoring.
The Bank seeks to provide customers with appropriate channels for raising complaints.
Complaints should be:
received through an authorized channel;
documented where appropriate;
reviewed;
investigated as necessary;
escalated where appropriate; and
resolved or responded to in accordance with applicable procedures and legal requirements.
Customers should not experience retaliation for raising a legitimate complaint.
Employees should have appropriate channels to report suspected:
fraud;
corruption;
misconduct;
regulatory violations;
financial manipulation;
security violations;
privacy violations; or
other serious concerns.
Reports should be handled appropriately and, where possible and legally permitted, confidentially.
Retaliation against individuals who make protected reports in good faith is prohibited to the extent required by applicable law.
Employees are expected to:
treat colleagues and customers respectfully;
follow applicable procedures;
protect Bank property;
maintain professional standards;
comply with security requirements;
avoid harassment and unlawful discrimination;
maintain confidentiality; and
perform assigned responsibilities responsibly.
The Bank does not tolerate unlawful harassment.
This includes prohibited conduct based on legally protected characteristics or other conduct prohibited by applicable law.
Complaints should be reported through appropriate internal channels.
First Heritage Trust Bank seeks to maintain employment practices consistent with applicable equal-employment and anti-discrimination laws.
Employment decisions should be based on legitimate job-related considerations and applicable requirements.
The Bank seeks to maintain a safe workplace.
Employees should report workplace hazards, accidents, security concerns, or emergencies through appropriate channels.
The Bank may maintain business-continuity and disaster-recovery procedures designed to support critical operations during:
natural disasters;
cyber incidents;
infrastructure failures;
telecommunications outages;
power failures;
emergencies;
operational disruptions; and
other significant events.
Potential security, privacy, operational, or financial incidents should be reported promptly.
Incident-response procedures may include:
identification;
containment;
investigation;
recovery;
documentation;
notification where required; and
corrective action.
Employees representing First Heritage Trust Bank must communicate accurately and professionally.
Employees must not make unauthorized public statements concerning:
confidential matters;
customers;
regulatory investigations;
internal disputes;
security incidents;
financial information; or
other restricted information.
Employees should exercise caution when discussing First Heritage Trust Bank on social media.
Employees must not:
disclose confidential information;
publish customer information;
impersonate the Bank;
make unauthorized official statements;
disclose security information; or
represent personal statements as official Bank positions without authorization.
Bank intellectual property must be used only for authorized purposes.
This includes:
trademarks;
logos;
software;
documents;
designs;
databases;
internal procedures;
marketing materials; and
proprietary information.
Bank systems are provided for authorized business purposes.
The Bank may monitor systems and network activity to the extent permitted by applicable law and internal policy.
Unauthorized use may result in disciplinary action.
Where artificial intelligence or automated systems are used, their use should be subject to appropriate:
security controls;
privacy safeguards;
human oversight where necessary;
accuracy controls;
access restrictions; and
applicable legal requirements.
Confidential customer information must not be entered into unauthorized AI systems.
The Bank seeks to maintain appropriate controls over information throughout its lifecycle.
This may include:
collection;
classification;
storage;
access;
transmission;
retention;
archival; and
secure disposal.
The Bank may assess third-party risks relating to:
cybersecurity;
privacy;
financial stability;
operational resilience;
compliance;
business continuity; and
service reliability.
The Bank expects business relationships to be conducted honestly.
Employees and representatives must not knowingly engage in:
deception;
fraudulent reporting;
unauthorized payments;
bribery;
misuse of confidential information;
market manipulation; or
other unlawful conduct.
The Bank will respond appropriately to lawful requests from regulators and government authorities.
Employees must not obstruct authorized regulatory examinations or investigations.
Employees may be required to complete training relating to:
privacy;
information security;
fraud prevention;
anti-money laundering;
sanctions;
customer protection;
workplace conduct;
compliance; and
other relevant subjects.
Violations of Bank policies may result in corrective or disciplinary action consistent with applicable law and employment arrangements.
Potential actions may include:
counseling;
additional training;
access restrictions;
formal disciplinary action;
suspension;
termination of employment or engagement; or
referral to appropriate authorities where required.
Management may establish procedures, standards, manuals, and guidelines necessary to implement this Company Policy.
Individual departments may maintain additional policies appropriate to their functions.
This Company Policy may be reviewed periodically to reflect:
changes in law;
regulatory requirements;
operational developments;
technology changes;
security risks;
business needs; and
lessons learned from incidents.
Unless expressly stated otherwise in a written agreement, this Company Policy establishes organizational principles and standards and does not itself create a contractual guarantee of any particular product, service, employment benefit, or regulatory status.
Where this Company Policy conflicts with mandatory applicable law or regulation, the mandatory legal or regulatory requirement will control.
Where another Bank policy contains more specific requirements, the more specific policy may apply to the relevant activity.
Questions concerning this Company Policy should be directed through the appropriate First Heritage Trust Bank administrative or compliance channel.
First Heritage Trust Bank
Website: firstheritagetrust.com
Administrative Location: New York, New York, United States
A specific street address should only be published after the Bank has legitimately obtained and is authorized to use that address.
First Heritage Trust Bank is committed to maintaining a professional, secure, responsible, and compliant organization.
Every employee, officer, contractor, and authorized representative has a role in protecting customers, protecting information, maintaining operational integrity, and supporting the lawful operation of the Bank.
© 2026 First Heritage Trust Bank. All rights reserved.