102 added · 107 removed between the two most recent 10-Ks. The risks a company starts — or stops — disclosing are often the story.
Newly disclosed
Although CRE markets have shown signs of stabilization since 2024, the federal banking agencies have issued guidance on the sound risk management practices regarding CRE lending and regulatory scrutiny may increase depending on the concentration in CRE lending and changing economic conditions for the CRE markets.
In 2024, the FDIC, the OCC and the DOJ announced changes to their bank merger review processes but, in May 2025, both the OCC and FDIC rescinded their 2024 policy statements, reinstating the guidance that was in effect prior to 2024.
The DOJ withdrew from the 1995 Bank Merger Guidelines and announced that it would consider bank mergers under its 2023 Merger Guidelines, which includes a brief bank merger addendum.
For example, certain federal and state laws and regulations relating to climate or other ESG issues may include provisions that conflict with other laws and regulations, which may increase our costs or limit our ability to conduct business in certain jurisdictions In particular, there is an increasing number of state-level anti-ESG initiatives in the United States that may conflict with other regulatory requirements or our various stakeholders' expectations.
Despite the security measures we have in place, our facilities, systems and networks may be vulnerable to cyber-attacks, security breaches, acts of vandalism, theft, computer viruses, malware, ransomware, denial of service attacks, phishing or other social engineering attacks, credential stuffing, account takeovers, misplaced or lost data, programming and/or human errors, software or hardware failures, or other similar events.
If any of our employees or service providers use any third-party AI-powered software in connection with our business or the services they provide to us, it may lead to the inadvertent disclosure or incorporation of our confidential information into publicly available training sets, which may impact our ability to realize the benefit of, or adequately maintain, protect and enforce our intellectual property or confidential information, harming our competitive position and business.
Any output created by us using AI tools may not be subject to copyright protection, which may adversely affect our intellectual property rights in, or ability to commercialize or use, any such content. 22 If we do not have sufficient rights to use the data or other material or content on which our AI solutions rely, or if we experience cybersecurity incidents in connection with our use of AI, we may incur liability through the violation of applicable laws and regulations, such as fair lending laws and regulations, third-party intellectual property, privacy or other rights, or contracts to which we are a party.
We may not be able to sufficiently mitigate or detect any of the foregoing limitations or risks given our and other market participants' lack of experience with using AI, the pace of technological change, and rapid adoption of AI by our business partners and competitors.
Any actual or perceived failure to comply with evolving regulatory frameworks around the development and use of AI, machine learning and automated decision making or to address any ethical, reputational, technical, operational, legal, competitive or regulatory issues could adversely affect our business, results of operations, and financial condition.
In assessing whether the impairment of investment securities is related to a deterioration in credit factors, management considers the length of time and extent to which the fair value has been less than cost, the financial condition and near-term prospects of the issuer, and the intent and ability to retain our investment in the security for a period of time sufficient to allow for any anticipated recovery in fair value in the near term.
Under current accounting standards, goodwill is not amortized but, instead, is subject to impairment tests on at least an annual basis or more frequently if an event occurs or circumstances change that reduce the fair value of a reporting unit below its carrying amount.
Acquisitions involve operational risks and uncertainties, and acquired companies may have unknown or contingent liabilities, exposure to unexpected asset quality problems that require write-downs or write-offs (as well as restructuring and impairment or other charges), difficulty retaining key employees and customers and other issues that could negatively affect our business.
No longer disclosed
For example, in July 2024, the federal banking agencies, including the OCC and the FDIC, issued a final rule that requires, among other things, financial institutions to ensure that their automated valuation models for property valuation follow certain quality control standards, including a requirement that such valuation models comply with nondiscrimination laws.
In addition to the potential for broader "anti-ESG/DEI" policies and laws, on January 21, 2025, President Trump issued an Executive Order requiring all federal agencies to terminate any policies, programs, mandates, guidance, regulations, and other actions and orders establishing DEI-based preferences, and to enforce federal civil rights laws to combat such preferences, mandates, policies, programs and activities of entities operating in the private sector.
During his election campaign, President Trump indicated that he would impose a 25% tariff against all goods imported from Canada and Mexico, a 60% tariff on goods from China and a blanket tariff of 10% to 20% on other imports to the U.S.
For example, California has adopted laws requiring in-scope companies to provide certain climate-related information, including GHG emissions and climate-related financial risks and related management strategies, and similar laws are being considered in other states.
For example, in the last several years, certain state attorneys general, treasurers, and legislators have taken various actions to impact the extent to which ESG principles are considered by financial institutions, including to require or prohibit the consideration of various ESG matters in certain contexts.
For example, in October 2023, California Governor Gavin Newsom signed two climate-related disclosure bills into law.
For example, weather disasters, shifts in local climates and other disruptions related to climate change may adversely affect the value of real properties securing our loans, which could diminish the value of our loan portfolio.
For example, states may enact laws requiring enhanced ESG/DEI disclosures, and there may be a rise in pro-ESG/DEI shareholder activism or public relations campaigns aimed at influencing corporations to adopt ESG/DEI initiatives.
Despite the security measures we have in place, our facilities and systems may be vulnerable to cyber-attacks, security breaches, acts of vandalism, computer viruses, malware, misplaced or lost data, programming and/or human errors, or other similar events. 23 Information security risks for financial institutions like us continue to increase in part because of new technologies, the increased use of the internet and telecommunications technologies (including mobile devices and cloud computing) to conduct financial and other business transactions, political activism, and the increased sophistication and activities of organized crime, perpetrators of fraud, hackers, terrorists and others.
Any actual or perceived failure to comply with evolving regulatory frameworks around the development and use of AI, machine learning and automated decision making could adversely affect our business, results of operations, and financial condition. 26 We are dependent upon third parties for certain information system, data management and processing services, and to provide key components of our business infrastructure .
In assessing whether the impairment of investment securities is related to a deterioration in credit factors, management considers the length of time and extent to which the fair value has been less than cost, the financial condition and near-term prospects of the issuer, and the intent and ability to retain our investment in the security for a period of time sufficient to allow for any anticipated recovery in fair value in the near term. 27 Under current accounting standards, goodwill is not amortized but, instead, is subject to impairment tests on at least an annual basis or more frequently if an event occurs or circumstances change that reduce the fair value of a reporting unit below its carrying amount.
To this end, federal agencies are required to submit recommendations to the Trump Administration identifying, among other things, (i) proposed plans or measures to deter DEI-based programs in the private sector, (ii) publicly-traded corporations and other private sector entities that could be considered for civil compliance investigations, (iii) appropriate sources of litigation, and (iv) potential regulatory action or guidance.