periodic proposals to remove or exit the GSEs from conservatorship and
eliminate the perceived “implicit guarantee” associated with the GSEs, none
have been successful. We cannot predict the future prospects of the GSEs,
including the timing of any recapitalization or release from conservatorship, or
any legislative or rulemaking proposals regarding the GSEs’ status in the
housing market. If the GSEs take a reduced role in the marketplace, including by
limiting the mortgage products they offer, we could be required to seek
alternative funding sources, retain additional loans on our balance sheet, secure
funding through the Federal Home Loan Bank system, or securitize the loans
through Private Label Securitization, which could increase our cost of funds
related to the origination of new mortgage loans, increase credit risk and/or
impact our capacity to originate new mortgage loans. These developments could
adversely affect our securities portfolios, capital levels, liquidity and results of
operations.
Our risk management framework may not be effective in mitigating risk
and reducing the potential for losses.
Our risk management framework is designed to minimize our risk and loss.
We seek to effectively and consistently identify, measure, monitor, report and
control the risk types to which we are subject, including the seven key risk types
we face. Risks also may span across multiple key risk types, including
cybersecurity risk, climate risk, legal risk and concentration risk. While we
employ a broad and diversified set of controls and risk mitigation techniques,
including modeling and forecasting, hedging strategies and techniques seeking
to balance our ability to profit from trading positions with our exposure to
potential losses, we are inherently limited by our ability to identify and measure
all risks, including emerging and unknown risks, anticipate the timing and impact
of risks, apply effective hedging strategies, make correct assumptions, manage
and aggregate data correctly and efficiently, identify changes in markets or client
behaviors not historically reflected and develop risk management models and
forecasts to assess and control risk.
Our risk management depends on our ability to consistently execute all
elements of our risk management program, develop and maintain a culture of
managing risk well throughout the Corporation and manage third-party risks,
including providers of products and services, to allow for effective risk
management and help confirm that risks are appropriately considered, evaluated
and responded to timely. Uncertain economic and geopolitical conditions,
widespread health emergencies and pandemics, heightened legislative and
regulatory scrutiny of and change within the financial services industry, the pace
of technological changes, including AI (such as machine learning and generative
AI) and quantum computing, accounting, tax and market developments, the
failure of employees, representatives and third parties to comply with our policies
and Risk Framework and the overall complexity of our operations, among other
developments, have in the past and may in the future, result in a heightened
level of risk, including operational, reputational and compliance risk. Failure to
manage evolving risks or properly anticipate, escalate, manage, control or
mitigate risks could result in additional legal, regulatory and reputational risk,
losses and adversely affect our results of operations.
Regulatory, Compliance and Legal
We are highly regulated and subject to evolving government legislation
and regulations and certain settlements, orders and agreements with
government authorities from time to time.
We are highly regulated and subject to evolving and comprehensive
regulation under federal and state laws in the U.S. and the laws of the various
foreign jurisdictions in which we
operate. These laws and regulations significantly affect and have the potential to
increase our compliance costs, restrict the scope of our existing businesses,
require changes to our employment practices, business strategies and controls
and procedures, limit our ability to pursue certain business opportunities,
including the products and services we offer, reduce certain fees and rates
and/or make our products and services more expensive for our clients. We are
also required to file various financial and nonfinancial regulatory reports to
comply with LRRs in the jurisdictions in which we operate, which results in
additional compliance and operational risk.
We continue to adjust our business and operations, legal entity structure,
systems, disclosure, policies, procedures, processes, controls and governance,
including with regard to capital and liquidity management, risk management and
data management, in an effort to comply with LRRs, and evolving expectations,
guidance and interpretation by regulatory authorities, including the Department
of Treasury (including the Internal Revenue Service (IRS) and OFAC), Financial
Crimes Enforcement Network, Federal Reserve, OCC, CFPB, Financial Stability
Oversight Council, FDIC, Department of Labor, SEC and CFTC in the U.S.,
foreign regulators, other government authorities and self-regulatory
organizations. Further, we expect to become subject to future LRRs, including
beyond those currently proposed, adopted or contemplated in the U.S. or
abroad, and evolving interpretations of existing and future LRRs, which may
include policies and rulemaking related to FDIC assessments, loss allocations
between financial institutions and clients regarding the use of our products and
services, including electronic payments, emerging technologies, such as the
development and use of AI (including machine learning and generative AI),
cybersecurity and data, employment practices and further climate and
environmental risk management and sustainability reporting and disclosure,
including emissions.
The cumulative effect of all of the current and possible future legislation and
regulations, as well as related interpretations, on our litigation and regulatory
exposure, businesses, operations, including our ability to compete, and
profitability remains uncertain and necessitates that we make certain
assumptions with respect to the scope and requirements of existing, prospective
and proposed LRRs in our business planning and strategies. If these
assumptions prove incorrect, we could be subject to increased regulatory, legal
and compliance risks and costs, and potential reputational harm. Also,
regulatory initiatives in the U.S. and abroad may overlap, and non-U.S.
regulations and initiatives may be inconsistent or conflict with current or
proposed U.S. regulations or with each other, which could lead to compliance
risks and higher costs.
Our regulators’ prudential and supervisory authority gives them broad power
and discretion to direct our actions, and they have assumed an active oversight,
inspection and investigatory role across the financial services industry.
Regulatory focus is not limited to LRRs applicable to the financial services
industry, but includes other significant LRRs that apply across industries and
jurisdictions, including those related to anti-money laundering, anti-bribery, anti-
corruption know-your-customer requirements, embargo programs and economic
sanctions.
We are also subject to LRRs in the U.S. and abroad, including the GDPR and
CCPA, and a number of additional jurisdictions enacting or considering similar
laws or amendments to existing laws, regarding privacy and the disclosure,
collection, use, sharing and safeguarding of personally identifiable information,
including our employees, clients, suppliers, counterparties and other third
parties, the violation of which could result in litigation, regulatory fines,