Customer financial data
Federal safeguards rules under the Gramm-Leach-Bliley Act expect financial institutions to dispose of customer information securely.
Banks, credit unions and financial institutions
ITAD for banks and credit unions. Custody you can show an examiner.
K12 Computers provides secure IT asset disposition for banks, credit unions and financial institutions. Retired branch PCs, laptops and servers are tracked by serial number from pickup, erased to NIST 800-88 guidelines and documented with data deletion certificates, and equipment with resale value earns a payout.
- R2v3 & ISO certified
- NIST 800-88 erasure
- Updated
Key facts
Banks & credit unions, at a glance.
- Relevant rules
- GLBA safeguards; FTC Disposal Rule
- Erasure standard
- NIST SP 800-88
- Proof
- Serialized chain-of-custody reports
- Certification
- R2v3, ISO 9001
- Value recovery
- Payout on resellable devices
- Districts served
- 300+
- Devices processed
- 5 million+
- Paid out
- $80 million+
R2v3 · ISO 9001 · ISO 14001 · ISO 45001 · WISE Certified · Inc. 5000
What is at stake
Why disposition matters here.
Examiner-ready records
Auditors and examiners ask how retired assets were handled. Serialized chain-of-custody reports answer that.
Branch-by-branch retirements
Equipment leaves from many branches. One vendor and one record keeps it simple.
01
Disposal requirements for financial institutions
Under the Gramm-Leach-Bliley Act, banks follow the Interagency Guidelines Establishing Information Security Standards, which include the proper disposal of customer information. Non-bank financial institutions fall under the FTC's Safeguards Rule, and the FTC Disposal Rule (16 CFR Part 682) requires reasonable measures to dispose of consumer report information.
In practice, examiners and auditors look for a documented process and evidence that each retired device was sanitized.
02
Chain of custody from branch to final disposition
K12 records each device at pickup with a receiving report matched to the branch list, erases it to NIST SP 800-88 guidelines, and closes the record with receiving reports, serialized audit reports, data deletion certifications, shipment summaries, purchase orders and impact reports.
What we take
Branch and back-office equipment, tracked from the first scan.
Teller workstations, branch laptops and servers can all hold customer information. K12 records each device at pickup, documents its erasure and reports its final disposition, so your information security and vendor management teams have the evidence they need.
- Branch PCs and laptopsTeller, office and loan officer machines
- Servers and storageBack-office and data closet equipment
- Mobile devicesTablets and phones
- Peripherals and e-wasteMonitors, printers and accessories
Step by step
How a financial institution program runs.
Every step is recorded in the K12 portal. New to the terms? See the ITAD glossary.
- 01
Scope
List devices by branch and flag any media your policy requires to be physically destroyed.
- 02
Collect
Scheduled pickups with receiving reports that match each branch's list.
- 03
Erase and audit
NIST 800-88 erasure with third-party verified software, recorded per serial number.
- 04
Document and pay
Data deletion certificates, audit reports and payout on resellable devices.
Portal & app
Follow every device in the K12 app.
Your orders, devices, documents and payouts, in a portal that works as well on your phone as on your desk.
How should banks dispose of old computers securely?
Financial institutions are expected to dispose of customer information securely under federal safeguards rules. A common approach is NIST 800-88 media sanitization with a certificate per device and a chain-of-custody record. K12 Computers provides both, with R2v3-certified handling.
Can a bank recover value from retired IT equipment?
Yes. Devices that are erased with verified software instead of shredded can be resold, and the institution receives a payout on equipment with resale value.
Can K12 collect from many branches?
Yes. K12 schedules pickups across multiple locations and matches each receiving report to the branch's asset list.
Can specific drives be physically destroyed?
Yes. Flag media your policy requires to be destroyed before pickup so K12 can plan its handling.
References
Standards and guidance cited on this page.
Primary sources from regulators, standards bodies and platform vendors. Links checked November 2026.
- Board of Governors of the Federal Reserve SystemInteragency Guidelines Establishing Information Security Standards
- Federal Trade CommissionFTC Safeguards Rule: What Your Business Needs to Know
- Electronic Code of Federal Regulations16 CFR Part 682, Disposal of Consumer Report Information and Records
- NISTSP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025)
Verify K12 Computers independently
SERI R2 DirectoryInc.Winston-Salem JournalTIPSChoice PartnersNC TECH AssociationLinkedIn
Tell us what you have.
Get an instant estimate by model, or request a pickup and our team takes it from there.