Business Description

and Note 8 - Capital and Regulatory Matters in the notes to consolidated financial statements included in Item 8. Financial Statements and Supplementary Data elsewhere in this report. Our Information Systems May Experience Failure, Interruption Or Breach In Security In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. Any failure, interruption or breach in security of these systems could result in significant disruption to our operations. Information security breaches and cybersecurity-related incidents include, but are not limited to, attempts to access information, including customer and company information, malicious code, computer viruses and denial of service attacks that could result in unauthorized access, theft, misuse, loss, release or destruction of data (including confidential customer information), account takeovers, unavailability of service or other events. These types of threats may derive from human error, fraud or malice on the part of external or internal parties or may result from accidental technological failure. Our technologies, systems, networks and software have been and continue to be subject to cybersecurity threats and attacks, which range from uncoordinated individual attempts to sophisticated and targeted measures directed at us. Any failures related to upgrades and maintenance of our technology and information systems could further increase our information and system security risk. Our increased use of cloud and other technologies, such as remote work technologies, adoption of artificial intelligence, and the increased connectivity of third parties and electronic devices to our systems also increases our risk of being subject to a cyber-attack. The risk of a security breach or disruption, particularly through cyber-attack or cyber-intrusion, has increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. 26 Table of Contents Our customers, employees and third parties that we do business with have been, and will continue to be, targeted by parties using fraudulent e-mails and other communications in attempts to misappropriate passwords, bank account information or other personal information or to introduce viruses or other malware programs to our information systems, the information systems of merchants or third-party service providers and/or our customers' personal devices, which are beyond our security control systems. Though we endeavor to mitigate these threats through product improvements, use of encryption and authentication technology and customer and employee education, such cyber-attacks against us, merchants, our third-party service providers and our customers remain a serious issue and have been successful in the past. Although we make significant efforts to maintain the security and integrity of our information systems and have implemented various measures to manage the risks of a security breach or disruption, there can be no assurance that our security efforts and measures will be effective or that attempted security breaches or disruptions would not be successful or damaging. It is possible that employees, merchants or our third-party vendors may not follow our cybersecurity policies and procedures, which may expose us to a cyber-attack. Furthermore, even well protected information, networks, systems and facilities remain potentially vulnerable to attempted security breaches or disruptions because the techniques used in such attempts are constantly evolving, including as a result of artificial intelligence, and generally are not recognized until launched against a target, and in some cases are designed not to be detected and, in fact, may not be detected. Accordingly, we may be unable to anticipate these techniques or to implement adequate security barriers or other preventative measures, and thus it is virtually impossible for us to entirely mitigate this risk. In the event of a cyber-attack, we may be delayed in identifying or responding to the attack, which could increase the negative impact of the cyber-attack on our business, financial condition and results of operations. While we maintain specific “cyber” insurance coverage, which would apply in the event of various breach scenarios, the amount of coverage may not be adequate in any particular case.…