BB&T 2015 Annual Report Download - page 25

TableofContents
Operational Risk
BB&T faces cybersecurity risks, including “denial of service attacks,” “hacking” and “identity theft” that could result in the disclosure of confidential
information, adversely affect BB&T’s business or reputation and create significant legal and financial exposure.
BB&T’s computer systems and network infrastructure are subject to security risks and could be susceptible to cyber attacks, such as denial of service attacks,
hacking, terrorist activities or identity theft. Financial services institutions and companies engaged in data processing have reported breaches in the security
of their websites or other systems, some of which have involved sophisticated and targeted attacks intended to obtain unauthorized access to confidential
information, destroy data, disable or degrade service, or sabotage systems, often through the introduction of computer viruses or malware, cyber attacks and
other means. Denial of service attacks have been launched against a number of large financial services institutions, including BB&T. None of these events
resulted in a breach of BB&T’s client data or account information; however, the performance of BB&T’s website, www.bbt.com, was adversely affected, and
in some instances customers were prevented from accessing BB&T’s website. BB&T expects to be subject to similar attacks in the future. While events to
date primarily resulted in inconvenience, future cyber attacks could be more disruptive and damaging. Hacking and identity theft risks, in particular, could
cause serious reputational harm. Cyber threats are rapidly evolving and BB&T may not be able to anticipate or prevent all such attacks. BB&T may incur
increasing costs in an effort to minimize these risks and could be held liable for any security breach or loss.
Despite efforts to ensure the integrity of its systems, BB&T will not be able to anticipate all security breaches of these types, and BB&T may not be able to
implement effective preventive measures against such security breaches. The techniques used by cyber criminals change frequently and can originate from a
wide variety of sources, including outside groups such as external service providers, organized crime affiliates, terrorist organizations or hostile foreign
governments. Those parties may also attempt to fraudulently induce employees, customers or other users of BB&T’s systems to disclose sensitive information
in order to gain access to its data or that of its clients. These risks may increase in the future as the Company continues to increase its mobile-payment and
other internet-based product offerings and expands its internal usage of web-based products and applications.
A successful penetration or circumvention of system security could cause serious negative consequences to BB&T, including disruption of operations,
misappropriation of confidential information of BB&T or its customers, or damage to computer systems of BB&T or its customers and counterparties. A
security breach could result in violations of applicable privacy and other laws, financial loss to BB&T or to its customers, loss of confidence in BB&T’s
security measures, significant litigation exposure, and harm to BB&T’s reputation, all of which could have a material adverse effect.
BB&T relies on its employees, systems and certain counterparties, and certain failures could materially adversely affect operations.
BB&T’s business is dependent on the ability to process, record and monitor a large number of complex transactions. The Company could be materially
adversely affected if one or more of its employees causes a significant operational breakdown or failure, either as a result of human error or intentionally.
Financial, accounting, or other data processing systems may fail or have other significant shortcomings that materially adversely affect BB&T’s business.
BB&T’s systems may not be able to handle certain scenarios, such as a negative interest rate environment. In addition, products, services and processes are
continually changing and BB&T may not fully identify new operational risks that may arise from such changes. Any of these occurrences could diminish the
ability to operate one or more BUs or result in potential liability to clients, increased operating expenses, higher litigation costs (including fines and
sanctions), reputational damage, regulatory intervention or weaker competitive standing, any of which could be material to the Company.
If personal, confidential or proprietary information of clients were to be mishandled or misused, significant regulatory consequences, reputational damage
and financial loss could occur. Such mishandling or misuse could include circumstances where, for example, such information was erroneously provided to
parties who are not permitted to have the information, either through the fault of systems, employees, or counterparties, or where such information was
intercepted or otherwise inappropriately taken by third parties.
21
Source: BB&T CORP, 10-K, February 25, 2016 Powered by Morningstar® Document Research℠
The information contained herein may not be copied, adapted or distributed and is not warranted to be accurate, complete or timely. The user assumes all risks for any damages or losses arising from any use of this information,
except to the extent such damages or losses cannot be limited or excluded by applicable law. Past financial performance is no guarantee of future results.