32
We are subject to
certain operational risks, including, but not limited to
risk arising from failure or circumvention
of our
controls and procedures.
Our internal controls, including fraud detection and controls, disclosure controls
and procedures, and corporate governance
procedures are based in part on certain assumptions and can provide only reasonable,
not absolute, assurances that the objectives
of the controls and procedures are met. Notwithstanding the proliferation of
technology and technology-based risk and control
systems, we rely on the ability of our associates and systems to process a high number
of transactions, and we are subject to the
risk that our associates may make mistakes or engage in violations of applicable
policies, laws, rules, or procedures that in the
past have not, and in the future may not, always be prevented by our technological
processes or by our controls and other
procedures intended to prevent and detect such errors or violations. Any
failure or circumvention of our controls and procedures,
failure to comply with regulations related to controls and procedures, failure to comply
with our corporate governance procedures,
fraud by associates or persons outside our Company,
the execution of unauthorized transactions by associates, or errors relating to
transaction processing and technology could have a material adverse effect
on our reputation, business, financial condition and
results of operations, including subjecting us to litigation, customer attrition,
regulatory fines, penalties, or other sanctions.
Insurance coverage may not be available for losses relating to such event,
or where available, such losses may exceed insurance
limits.
In addition, evolving regulatory expectations regarding operational
resilience, business continuity,
vendor oversight, and
internal control effectiveness may require additional investment
and may heighten supervisory scrutiny if deficiencies are
We are subject to
credit and/or settlement risk arising from
the soundness of other financial institutions and
counterparties which may have a material adverse effect on our business, financial condition,
and results of operations.
Financial services institutions are interrelated as a result of trading,
clearing, counterparty, or other
relationships. We
have
exposure to many different industries and counterparties,
and routinely execute transactions with counterparties in the financial
services industry, including
commercial banks, brokers and dealers, investment banks, other institutional clients,
and certain
vendors. Many of these transactions expose us to credit or settlement risk in the
event of a default or other failure to adhere to
contractual obligations by a counterparty or client. In addition, our credit or
settlement risk may be exacerbated when any
collateral held by us cannot be realized upon or is liquidated at prices not sufficient
to recover the full amount of the credit or
derivative exposure due to us. Increased interconnectivity amongst
financial institutions also increases the risk of cyber-attacks
and information system failures for financial institutions. Any such losses could
have a material adverse effect on our business,
financial condition, and results of operations.
Cybersecurity
incidents,
including
security
breaches
and
failures
of
our
information
systems
could
significantly
disrupt
our
business,
result
in
the
unintended
disclosure
or
misuse
of
confidential
or
proprietary
information,
damage
our
reputation, increase our costs, and cause losses.
In the ordinary course of business, we rely on electronic communications
and information systems to conduct our operations and
to store sensitive data, including our proprietary business information
and that of our clients, and personal information of our
clients and associates. The secure processing, maintenance, and transmission
of this information is critical to our operations.
Our
systems, including those we maintain with our service providers, vendors,
or our clients, could be vulnerable to cybersecurity-
related incidents, which include compromises of information systems, attempts to
access information, including customer and
company information, malicious code, computer viruses or other malware,
denial of service attacks, phishing attempts, brute
force attacks, exploiting software vulnerabilities (including “zero-day
attacks”), ransomware, supply chain attacks, and other
events that could result in unauthorized access, theft, misuse, loss, release, or
destruction of data (including confidential customer
information), account takeovers, unavailability of service, or other events. These
types of threats may result from human error,
fraud, or criminal activity on the part of external or internal parties, or may result from
the failure of technology or information
systems. Further, these types of threats may
be exacerbated by recent developments in artificial intelligence and their increased
use to produce sophisticated malware, phishing schemes, and other fraudulent
activities. Any failure, interruption, or compromise
in security of these systems could result in significant disruption to our operations.
Financial institutions and companies engaged in data processing have
increasingly reported compromises in the security of their
websites or other systems, some of which have involved sophisticated and
targeted attacks intended to obtain unauthorized access
to confidential information, destroy data, disrupt or degrade service, sabotage
systems, or cause other damage. Our technologies,
systems, networks, and software have been and continue to be subject to cybersecurity
threats and attacks, which range from
uncoordinated individual attempts to sophisticated and targeted
measures by criminal organizations directed at us. Our customers,
associates, and third parties that we do business with have been, and will likely continue
to be, targeted in cybersecurity-related
incidents by parties using fraudulent e-mails, artificial intelligence,
and other communications in attempts to misappropriate
passwords, bank account information, or other personal information,
or to introduce viruses or other malware programs to our
information systems, or the information systems and devices of our third-party
(or fourth-party) service providers and our
customers that are beyond our security control systems. Although we try to mitigate
these threats through product improvements,
use of encryption and authentication technology,
and customer and employee education, among other things, cybersecurity-
attacks against us, our third-party (or fourth-party) service providers
,
and our customers are a risk to our business.