294 added · 234 removed between the two most recent 10-Ks. The risks a company starts — or stops — disclosing are often the story.
Newly disclosed
In October 2022, the SEC adopted a final rule directing national securities exchanges and associations, including NASDAQ, to require policies mandating the recovery or “clawback” of excess incentive-based compensation earned by a current or former executive officer during the three fiscal years preceding a required accounting restatement, including to correct an error that would result in a material misstatement if the error were corrected in the current period or left uncorrected in the current period.
For example, the California Consumer Privacy Act became effective on January 1, 2020 and the Colorado Privacy Act and Virginia Consumer Data Protection Act were enacted in 2021.
During 2016, the federal bank regulatory agencies and the SEC proposed revised rules on incentive-based payment arrangements at specified regulated entities having at least $1 billion of total assets.
FHB is also restricted under the Hawaii Code to investing in certain types of investments and is generally limited in the amount of money it can lend to a single borrower or invest in securities issued by a single issuer (in each case, 20% of FHB’s common stock and additional paid-in capital). 5 Table of Contents Acquisitions by Bank Holding Companies The BHC Act, the Bank Merger Act, the Hawaii Code and other federal and state statutes regulate acquisitions of bank holding companies, banks and other FDIC-insured depository institutions.
The Company must obtain the prior approval of the Federal Reserve before (i) acquiring direct or indirect ownership or control of any voting shares of any bank or bank holding company, if after such acquisition, it will directly or indirectly own or control 5% or more of any class of voting shares of the institution, (ii) acquiring all or substantially all of the assets of any bank (other than directly through the Bank) or (iii) merging or consolidating with any other bank holding company.
In 2023, the SEC issued a final rule that requires disclosure of material cybersecurity incidents, as well as cybersecurity risk management, strategy and governance.
In addition, as the owner of a Hawaii-chartered bank, FHI is registered as a financial institution holding company under the Hawaii Code of Financial Institutions (the “Hawaii Code”) and is subject to the registration, reporting and examination requirements of the Hawaii Code, as well as supervision and examination by the Hawaii DFI. 4 Table of Contents The Company offers certain insurance, investment and trust products through FHB and its subsidiary, Bishop Street Capital Management Corporation, a registered investment adviser with the SEC.
In reviewing applications seeking approval of merger and acquisition transactions, bank regulators consider, among other things, the competitive effect and public benefits of the transactions, the applicant’s financial condition and future prospects, including current and projected capital ratios and levels, the managerial resources of the combined organization, the risks to the stability of the U.S. banking or financial system, the applicant’s performance record under the CRA, the applicant’s compliance with applicable laws, including fair housing and other consumer protection laws, and the effectiveness of all organizations involved in combating money laundering activities.
Failure to comply with consumer protection requirements may also result in significant reputational harm as well as failure to obtain any required bank regulatory approval for merger or acquisition transactions the Company may wish to pursue or the Company’s prohibition from engaging in such transactions even if approval is not required.
Under this rule, banking organizations that are SEC registrants must generally disclose information about a material cybersecurity incident within four business days of determining it is material with periodic updates as to the status of the incident in subsequent filings as necessary.
Regulatory authorities routinely examine financial institutions for compliance with these requirements, and failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious financial, legal and reputational consequences for the institution, including the imposition of civil money penalties or causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required.
Department of the Treasury for evaluating technology and internal processes for BSA compliance; and expands enforcement- and investigation-related authority, including a significant expansion in the available sanctions for certain BSA violations and instituting BSA whistleblower incentives and protections.
No longer disclosed
For example, we could be subject to sudden withdrawals of deposits, including as a result of negative media coverage, which may be spread through social media, regarding the financial services industry generally, a subset of financial institutions, or the Company specifically.
For example, we are subject to regulatory capital requirements which may limit the Bank’s ability to pay dividends to us, and Hawaii law only permits our bank to pay dividends out of retained earnings as defined under Hawaii banking law, which differs from retained earnings calculated under GAAP.
For example, if an employee were to engage in fraudulent, illegal or suspicious activities, we could be subject to regulatory sanctions and suffer serious harm to our reputation (as a consequence of the negative perception resulting from such activities), financial position, customer relationships and ability to attract new customers.
Evolving responses from federal and state governments and other regulators, and our customers or our third-party partners or vendors, to challenges such as climate change have impacted and could continue to impact the economic and political conditions under which we operate. 19 Table of Contents In addition, federal budget deficit concerns and the potential for political conflict over legislation to fund U.S. government operations and raise the U.S. government’s debt limit may increase the possibility of a default by the U.S. government on its debt obligations, related credit-rating downgrades, or an economic recession in the United States.
A failure of a significant market participant, or even concerns about a default by such an institution, could lead to significant liquidity problems, losses or defaults by other institutions or regulatory responses, including additional special assessments under the FDIA, which in turn could adversely affect us. We are also subject to the risk that our rights against third parties may not be enforceable in all circumstances or that there is a deterioration in the credit quality of third parties whose securities or obligations we hold, including a deterioration in the value of collateral posted by third parties to secure their obligations to us under derivatives contracts and loan agreements.
Maintenance of our reputation depends not only on our success in maintaining our service-focused culture and controlling and mitigating the various risks described in this Form 10-K, but also on our success in identifying and appropriately addressing issues that may arise in areas such as potential conflicts of interest, anti-money laundering, customer personal information and privacy issues, customer and other third party fraud, record-keeping, regulatory investigations, any litigation that may arise from any failure or perceived failure on our part to comply with legal and regulatory requirements and ESG matters, including climate risk, hiring practices, the diversity of our work force, and racial and social justice issues involving our personnel, customers and third parties with whom we otherwise do business.
Defense of our reputation, trademarks and other intellectual property, including through litigation, could result in costs that could have a material adverse effect on our business, financial condition or results of operations. We may not be able to attract and retain key personnel and other skilled employees. Our success depends, in large part, on the skills of our management team and our ability to retain, recruit and motivate key officers and employees.
This could have a material adverse effect on our business, financial condition or results of operations. The occurrence of fraudulent activity, breaches or failures of our information security controls or cybersecurity-related incidents could have a material adverse effect on our business, financial condition or results of operations. As a financial institution, we are susceptible to fraudulent activity, information security breaches and cybersecurity-related incidents that may be committed against us or our clients, which may result in financial losses or increased costs to us or our clients, disclosure, loss or misuse of our information or our clients’ information, misappropriation of assets, privacy breaches against our clients, litigation or damage to our reputation.
Further, evolving cyber threats, including as a result of the increased use of artificial intelligence (“AI”) by cybercriminals may increase the frequency and severity of cybersecurity attacks against us or our service providers and others on whom we rely. 26 Table of Contents We also face risks related to cyberattacks and other security breaches in connection with credit card transactions that typically involve the transmission of sensitive information regarding our customers through various third parties, including merchant acquiring banks, payment processors, payment card networks and our processors.
In addition, increases in criminal activity levels and sophistication, advances in computer capabilities, new discoveries, vulnerabilities in third-party technologies (including browsers and operating systems) or other developments could result in a compromise or breach of the technology, processes and controls that we use to prevent fraudulent transactions and to protect data about us, our customers and underlying transactions, as well as the technology used by our customers to access our systems.
Although we have developed, and continue to invest in, systems and processes that are designed to detect and prevent security breaches and cyberattacks and periodically test our security, our inability to anticipate, or failure to adequately mitigate, breaches of security could result in: losses to us or our customers; our loss of business and/or customers; damage to our reputation; the incurrence of additional expenses; disruption to our business; our inability to grow our online services or other businesses; additional regulatory scrutiny or penalties; or our exposure to civil litigation and possible financial liability — any of which could have a material adverse effect on our business, financial condition or results of operations.
Additionally, we may not be able to ensure that our third-party vendors have appropriate controls in place to protect the confidentiality of the information they receive from us and our business, financial condition or results of operations could be adversely affected by a material breach of, or disruption to, the security of any of our or our vendors’ systems. Because the investigation of any information security breach is inherently unpredictable and would require substantial time to complete, the Company may not be able to quickly remediate the consequences of any breach, which may increase the costs, and enhance the negative consequences associated with a breach.