Regions Bank 2012 Annual Report Download - page 47

mobile devices that are beyond our control systems. Although we believe that we have robust information
security procedures and controls, our technologies, systems, networks and our customers’ devices may be the
target of cyber attacks or information security breaches that could result in the unauthorized release, gathering,
monitoring, misuse, loss or destruction of Regions’ or our customers’ confidential, proprietary and other
information. Additionally, cyber attacks, such as denial of service attacks, hacking or terrorist activities, could
disrupt Regions’ or our customers’ or other third parties’ business operations. For example, in October 2012 and
December 2012, a group launched denial of service attacks against a number of large financial services
institutions. Regions was targeted by this group in October and December. These events did not result in a breach
of Regions’ client data, and account information remained secure; however, the attacks did adversely affect the
performance of Regions Bank’s website, www.regions.com, and, in some instances, prevented customers from
accessing Regions Bank’s secure websites for consumer and commercial applications. The October event was
resolved within approximately one day. The December events occurred over multiple days, but each individual
event was of a shorter duration than the October event and was promptly resolved. In all cases, the attacks
primarily resulted in inconvenience; however, future cyber attacks could be more disruptive and damaging, and
Regions may not be able to anticipate or prevent all such attacks.
Third parties with which we do business or that facilitate our business activities could also be sources of
operational and information security risk to us, including from breakdowns or failures of their own systems or
capacity constraints.
Our risk and exposure to cyber attacks and other information security breaches remain heightened because
of, among other things, the evolving nature of these threats and the prevalence of Internet and mobile banking.
As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to
modify or enhance our protective measures or to investigate and remediate any information security
vulnerabilities. Disruptions or failures in the physical infrastructure or operating systems that support our
businesses and customers, or cyber attacks or security breaches of the networks, systems or devices that our
customers use to access our products and services, could result in customer attrition, regulatory fines, penalties or
intervention, reputational damage, reimbursement or other compensation costs and/or additional compliance
costs, any of which could materially adversely affect our business, results of operations or financial condition.
We rely on other companies to provide key components of our business infrastructure.
Third parties provide key components of our business operations such as data processing, recording and
monitoring transactions, online banking interfaces and services, Internet connections and network access. While
we have selected these third party vendors carefully, we do not control their actions. Any problems caused by
these third parties, including those resulting from disruptions in communication services provided by a vendor,
failure of a vendor to handle current or higher volumes, or failure of a vendor to provide services for any reason
or poor performance of services, could adversely affect our ability to deliver products and services to our
customers and otherwise conduct our business. Financial or operational difficulties of a third party vendor could
also hurt our operations if those difficulties interfere with the vendor’s ability to serve us. Replacing these third
party vendors could also create significant delay and expense. Accordingly, use of such third parties creates an
unavoidable inherent risk to our business operations.
We depend on the accuracy and completeness of information about clients and counterparties.
In deciding whether to extend credit or enter into other transactions with clients and counterparties, we may
rely on information furnished by or on behalf of clients and counterparties, including financial statements and
other financial information. We also may rely on representations of clients and counterparties as to the accuracy
and completeness of that information and, with respect to financial statements, on reports of independent auditors
if made available. If this information is inaccurate, we may be subject to regulatory action, reputational harm or
other adverse effects with respect to the operation of our business, our financial condition and our results of
operations.
31