32
Financial institutions and companies engaged in data processing have
increasingly reported breaches in the security of their
websites or other systems, some of which have involved sophisticated and
targeted attacks intended to obtain unauthorized access
to confidential information, destroy data, disrupt or degrade service, sabotage
systems, or cause other damage. Our technologies,
systems, networks, and software have been and continue to be subject to cybersecurity
threats and attacks, which range from
uncoordinated individual attempts to sophisticated and targeted
measures directed at us. Our customers, associates, and third
parties that we do business with have been, and will likely continue to be,
targeted in cybersecurity-related incidents by parties
using fraudulent e-mails, artificial intelligence, and other communications
in attempts to misappropriate passwords, bank account
information, or other personal information or to introduce viruses or other
malware programs to our information systems, the
information systems of our third-party service providers and our customers’
personal devices, which are beyond our security
control systems. Though we endeavor to mitigate these threats through product
improvements, use of encryption and
authentication technology and customer and employee education, such cyber-attacks
against us, our third-party service providers
and our customers remain a serious issue and have been successful in the past.
We may be required
to spend significant capital and other resources to protect against the threat of
cybersecurity-related incidents
or to alleviate problems caused by such incidents. Any failures related to
upgrades and maintenance of our technology and
information systems could increase our information and system security
risk. Our increased use of cloud and other technologies,
such as remote work technologies, and the increased connectivity of third parties
and electronic devices to our systems also
increases our risk of being subject to a cyber-related incident. The risk of a cybersecurity
-related incident has increased as the
number, intensity,
and sophistication of attempted attacks and intrusions from around the world have increased.
A cybersecurity-
related incident or other significant disruption of our information systems or
those of our customers or third-party vendors could
(i) disrupt the proper functioning of our networks and systems and therefore
our operations and those of our customers; (ii) result
in the unauthorized access to, and destruction, loss, theft, misappropriation,
or release of confidential, sensitive, or otherwise
valuable information of ours or our customers; (iii) result in a violation
of applicable privacy, data
protection, and other laws,
subjecting us to additional regulatory scrutiny and exposing us to civil litigation,
enforcement actions, governmental fines, and
possible financial liability; (iv) require significant management attention
and resources to remedy the damages that result; or (v)
harm our reputation or cause a decrease in the number of customers that choose
to do business with us, damaging our ability to
generate deposits. The occurrence of any of the foregoing could have a material adverse
effect on our business, financial
condition, and results of operations. Furthermore, in the event of a cyber-related
incident, we may be delayed in identifying or
responding to the incident, which could increase the negative impact of the incident on our
business, financial condition, and
results of operations. While we maintain “cyber” insurance coverage, which
would apply in the event of certain cyber-related
incidents, the amount of coverage may not be adequate depending on
the magnitude of the incident. Furthermore, because cyber-
related incidents are inherently difficult to predict and can take many forms,
some incidents may not be covered under our cyber
insurance coverage.
Increased fraudulent activity may cause losses to us or our clients, damage
to our brand, and increases in our costs, in
turn, materially and adversely affecting our business, financial condition,
and results of operations.
Additionally, fraud
losses have risen in recent years due in large part to growing and evolving schemes.
Fraudulent activity has
taken many forms, ranging from wire fraud, debit card fraud, credit card fraud,
check fraud, mechanical devices attached to
ATMs,
social engineering, and phishing attacks to obtain personal information, business
email compromise, or impersonation of
clients through the use of falsified or stolen credentials. Many financial
institutions have suffered significant losses in recent years
due to the theft of cardholder data that has been illegally exploited for personal gain.
The potential for debit and credit card fraud,
as well as check fraud, against us or our clients and our third-party
service providers is a serious issue. Debit and credit card fraud
and check fraud are pervasive, and the risks of cybercrime are complex
and continue to evolve. While we have policies and
procedures, as well as fraud detection tools, designed to prevent fraud losses, such
policies, procedures, and tools may be
insufficient to accurately detect and prevent fraud. A significant increase
in fraudulent activities could lead us to take additional
steps to reduce fraud risk, which could increase our costs. Fraud losses
could cause losses to us or our clients, damage to our
brand, and an increase in our costs, in turn, materially and adversely affecting
our business, financial condition, and results of
operations.
We may not be able to attract and
retain skilled people, which may have a negative impact on
our business and
operations.
Our success depends, in large part, on our ability to attract and retain
key people. Competition for the best people in many
activities engaged in by us is intense, including with respect to compensation
and emerging workplace practices and
accommodations, and, as a result, we may not be able to sufficiently
hire or to retain key people. We
do not currently have
employment agreements or non-competition agreements with any of our senior officers.
The unexpected loss of service of key
personnel could have a material adverse impact on our business, financial
condition, and results of operations because of their
customer relationships, skills, knowledge of our market, years of industry
experience, and the difficulty of promptly finding
qualified replacement personnel. In addition, the scope and content of U.S. banking
regulators’ policies on incentive
compensation, as well as changes to these policies, could adversely affect
our ability to hire, retain, and motivate our key
associates.