Regions Bank 2012 Annual Report Download - page 46

can adversely affect our ability to attract and keep customers and can expose us to litigation and regulatory
action. Actual or alleged conduct by Regions can also result in negative public opinion about our other
businesses. Negative public opinion could also affect our credit ratings, which are important to our access to
unsecured wholesale borrowings.
If personal, non-public, confidential or proprietary information of customers in our possession were to be
misappropriated, mishandled or misused, we could suffer significant regulatory consequences, reputational
damage and financial loss. Such mishandling or misuse could include, for example, erroneously providing such
information to parties who are not permitted to have the information, either by fault of our systems, employees,
or counterparties, or the interception or inappropriate acquisition of such information by third parties.
Because the nature of the financial services business involves a high volume of transactions, certain errors
may be repeated or compounded before they are discovered and successfully rectified. Our necessary dependence
upon automated systems to record and process transactions and our large transaction volume may further
increase the risk that technical flaws or employee tampering or manipulation of those systems will result in losses
that are difficult to detect. We also may be subject to disruptions of our operating systems arising from events
that are wholly or partially beyond our control (for example, computer viruses or electrical or
telecommunications outages, or natural disasters, disease pandemics or other damage to property or physical
assets) which may give rise to disruption of service to customers and to financial loss or liability. We are further
exposed to the risk that our external vendors may be unable to fulfill their contractual obligations (or will be
subject to the same risk of fraud or operational errors by their respective employees as we are) and to the risk that
our (or our vendors’) business continuity and data security systems prove to be inadequate. The occurrence of
any of these risks could result in our diminished ability to operate our business (for example, by requiring us to
expend significant resources to correct the defect), as well as potential liability to clients, reputational damage
and regulatory intervention, which could adversely affect our business, financial condition or results of
operations, perhaps materially.
We are subject to a variety of systems failure and cyber-security risks that could adversely affect our business
and financial performance.
Failure in or breach of our operational or security systems or infrastructure, or those of our third party
vendors and other service providers, including as a result of cyber attacks, could disrupt our businesses or the
businesses of our customers, result in the disclosure or misuse of confidential or proprietary information, damage
our reputation, increase our costs and cause losses. As a large financial institution, we depend on our ability to
process, record and monitor a large number of customer transactions on a continuous basis. As customer, public
and regulatory expectations regarding operational and information security have increased, our operational
systems and infrastructure must continue to be safeguarded and monitored for potential failures, disruptions and
breakdowns. Our business, financial, accounting, data processing systems or other operating systems and
facilities may stop operating properly or become disabled or damaged as a result of a number of factors,
including events that are wholly or partially beyond our control. For example, there could be sudden increases in
customer transaction volume; electrical or telecommunications outages; natural disasters such as earthquakes,
tornadoes and hurricanes; disease pandemics; events arising from local or larger scale political or social matters,
including terrorist acts; and, as described below, cyber attacks. Although we have business continuity plans and
other safeguards in place, our business operations may be adversely affected by significant and widespread
disruption to our physical infrastructure or operating systems that support our businesses and customers.
Information security risks for large financial institutions such as Regions have generally increased in recent
years in part because of the proliferation of new technologies, the use of the Internet and telecommunications
technologies to conduct financial transactions, and the increased sophistication and activities of organized crime,
hackers, terrorists, activists and other external parties. As noted above, our operations rely on the secure
processing, transmission and storage of confidential information in our computer systems and networks. In
addition, to access our products and services, our customers may use personal smartphones, tablet PCs, and other
30