Bank of America (BAC) Risk Analysis

A number of our products expose us to credit risk, including loans, letters of credit, derivatives, debt securities, trading account assets and assets held-for-sale. Deterioration in the financial condition of our consumer and commercial borrowers, counterparties or underlying collateral could adversely affect our results of operations and financial condition. Our credit portfolios may be impacted by U.S. and global macroeconomic and market conditions, events and disruptions, including declines in GDP, consumer spending or property values, asset price corrections, increasing consumer and corporate leverage, increases in corporate bond spreads, government shutdowns or policies such as tax changes, changes in international trade policy including tariff rates, rising or elevated unemployment levels, elevated inflation or cost of living expenses, fluctuations in foreign exchange or interest rates, as well as the emergence of widespread health emergencies or pandemics, extreme weather events and the impacts of climate change, including acute and/or chronic extreme weather events and efforts to transition to a low-carbon economy. Significant economic or market stresses and disruptions typically have a negative impact on the business environment and financial markets, which could impact the underlying credit quality of our borrowers, counterparties and assets. Property value declines or asset price corrections could increase the risk of borrowers or counterparties defaulting or becoming delinquent in their obligations to us, and could decrease the value of the collateral we hold, which could increase credit losses. Credit risk could also be magnified by lending to leveraged borrowers or declining asset prices, including property or collateral values, unrelated to macroeconomic stress. Simultaneous drawdowns on lines of credit and/or an increase in a borrower’s leverage in a weakening economic environment, or otherwise, could result in deterioration in our credit portfolio, should borrowers be unable to fulfill competing financial obligations. Increased delinquency and default rates could adversely affect our credit portfolios and increase charge-offs and provisions for credit losses. A recessionary environment and/or a rise in unemployment could adversely impact the ability of our consumer and/or commercial borrowers or counterparties to meet their financial obligations and negatively impact our credit portfolio. Consumers have been and may continue to be negatively impacted by inflation and/or a higher cost of living, resulting in drawdowns of savings or increases in household debt. Elevated interest rates, which have increased debt servicing costs for some businesses and households, may adversely impact credit quality, particularly in a recessionary environment. Certain sectors also remain at risk (e.g., commercial real estate, particularly office) as a result of shifts in demand and tight financial and credit conditions. Globally, conditions of slow growth or recession could further contribute to weaker credit conditions. If the macroeconomic environment or certain sectors worsen, our credit portfolio, net charge-offs, provision and allowance for credit losses could be adversely impacted. We establish an allowance for credit losses, which includes the allowance for loan and lease losses and the reserve for unfunded lending commitments, based on management's best estimate of lifetime expected credit losses (ECL) inherent in our relevant financial assets. The process to determine the allowance for credit losses uses models and assumptions that require us to make difficult and complex judgments that are often interrelated, including forecasting how borrowers or counterparties may perform in changing economic conditions. The ability of our borrowers or counterparties to repay their obligations may be impacted by changes in future economic conditions, which in turn could impact the accuracy of our loss forecasts and allowance estimates. There is also the possibility that we have failed or will fail to accurately identify the appropriate economic indicators or accurately estimate their impacts to our borrowers or counterparties, which could impact the accuracy of our loss forecasts and allowance estimates. If the models, estimates and assumptions we use to establish reserves or the judgments we make in extending credit to our borrowers or counterparties, which are more sensitive due to the current uncertain macroeconomic and geopolitical environment, prove inaccurate in predicting future events, we may suffer losses in excess of our ECL. In addition, changes to external factors can negatively impact our recognition of credit losses in our portfolios and allowance for credit losses. The allowance for credit losses is our best estimate of ECL, but there is no guarantee that it will be sufficient to address credit losses, particularly if the economic outlook deteriorates significantly, quickly or unexpectedly. As circumstances change, we may increase our allowance, which would reduce earnings. If economic conditions worsen, impacting our consumer and commercial borrowers, counterparties or underlying collateral, and credit losses are unexpectedly worse, we may increase our provision for credit losses, which could adversely affect our results of operations and financial condition.

Our liquidity, competitive position, business, results of operations and financial condition are affected by market risks such as changes in interest and currency exchange rates, fluctuations in equity, commodity and futures prices, trading volumes and prices of securitized products, the implied volatility of interest rates and credit spreads and other economic and business factors. These market risks may adversely affect, among other things, the value of our securities, including our on- and off-balance sheet securities, trading assets and other financial instruments, the cost of debt capital and our access to credit markets, the value of assets under management (AUM), fee income relating to AUM, client allocation of capital among investment alternatives, the volume of client activity in our trading operations, investment banking, underwriting and other capital market fees and the general profitability and risk level of the transactions in which we engage and our competitiveness with respect to deposit pricing. The value of certain of our assets is sensitive to changes in market interest rates and/or spreads. If the Federal Reserve or a non-U.S. central bank changes or signals a change in monetary policy, market interest rates or credit spreads could be affected, which could adversely impact the value of such assets. Changes to fiscal policy, including expansion of U.S. federal deficit spending and resultant debt issuance, could also affect market interest rates. If interest rates decrease, our results of operations could be negatively impacted, including future revenue and earnings growth. Our models and strategies to assess and control our market risk exposures are subject to inherent limitations. In times of market stress or other unforeseen circumstances, previously uncorrelated indicators may become correlated. Such changes to the relationship between market parameters may limit the effectiveness of our hedging strategies and cause us to incur significant losses. Changes in correlation can be exacerbated where market participants use risk or trading models with assumptions or algorithms similar to ours. In these and other cases, it may be difficult to reduce our risk positions due to activity of other market participants or widespread market dislocations, including circumstances where asset values are declining significantly or no market exists. Where we own securities that do not have an established liquid trading market or are otherwise subject to restrictions on sale or hedging, or where the degree of accessible liquidity declines significantly, we may not be able to reduce our positions and risks associated with such holdings, so we may suffer larger than expected losses when adverse price movements take place. This risk can be exacerbated where we hold a position that is large relative to the available liquidity.

There are no material changes from the risk factors set forth under Part 1, Item 1A. Risk Factors of the Corporation’s 2024 Annual Report on Form 10-K.

Our business is highly dependent on the security, controls and efficacy of our information systems, and the information systems of our clients, third parties, the financial services industry and financial data aggregators with whom we interact, on whom we rely or who have access to our clients’ personal or account information. We rely on effective access management and the secure collection, processing, maintenance, use, transmission, storage, dissemination and disposition of information in our and our third parties’ information systems. Our cybersecurity risk and exposure remains heightened because of, among other things, our prominent size and scale, high-profile brand, geographic footprint and international presence and role in the financial services industry and the broader economy. The proliferation of third-party financial data aggregators and emerging technologies, including AI (such as machine learning and generative AI) and robotics, increases our cybersecurity risks and exposure, including by making fraud detection and authentication more difficult. We, our employees, customers, regulators and third parties are ongoing targets of an increasing number of cybersecurity threats and cyberattacks. The tactics, techniques and procedures used in cyberattacks are pervasive, sophisticated, evolving and designed to evade security measures, including computer viruses, malicious or destructive code (such as ransomware), social engineering (including phishing, vishing and smishing), real and virtual impersonation, denial of service or information or other security breach tactics that have and in the future are likely to result in disruptions to our businesses and operations and the loss of funds, including from attempts to defraud us and/or our customers, and impact the confidentiality, integrity or availability of our information, including intellectual property, or the personal and/or confidential information of our employees, clients and third parties. Cyberattacks are carried out on a worldwide scale and by a growing number of actors, including organized crime groups, hackers, terrorist organizations, extremist parties, hostile foreign governments and their proxies, state-sponsored actors, activists, disgruntled employees and other persons or entities, including for corporate espionage. Cybersecurity threats and the tactics, techniques and procedures used in cyberattacks change, develop and evolve rapidly and continuously, including from growth in third-party services that facilitate or carry out cyberattacks and from emerging technologies, such as AI (including machine learning and generative AI) and quantum computing, which may be used to enhance the tactics, techniques and procedures described above and facilitate new cyber threats. Despite substantial efforts to protect the integrity and resilience of our information systems and implement controls, processes, policies, employee training and other protective measures, we cannot anticipate and detect all cybersecurity threats and incidents and/or develop or implement effective preventive or defensive measures designed to prevent, respond to or mitigate all cybersecurity threats and incidents. Internal access management or other technology failures could impact the confidentiality, integrity or availability of data and information. Our vulnerability increases if employees fail to exercise sound judgment and vigilance when targeted with social engineering or other cyberattacks increases our vulnerability. Our risk from and exposure to cybersecurity threats and incidents, information and security breaches and technology failures continues to increase due to the acceptance and use of digital banking and other digital products and services, including mobile banking products, and reliance on remote access tools and other technology, which have increased our reliance on virtual or digital interactions and a growing number of access points to our information systems that must be secured, and results in greater amounts of information being available for access. Greater demand on our information systems and security tools and processes will likely continue. We also face significant third-party technology, cybersecurity and operational risks relating to the large number of clients and third parties with whom we do business, the financial services industry, upon whom we rely to facilitate or enable our business activities or upon whom our clients rely, including the secure collection, processing, maintenance, use, sharing, dissemination and disposition of client and other sensitive information, providers of products and services, financial counterparties, financial data aggregators, financial intermediaries, such as clearing agents, exchanges and clearing houses, regulators, federal and state governments, providers of outsourced software, services and infrastructure, such as internet access, cloud service providers and electrical power, and retailers for whom we process transactions. Such third-party information systems extend beyond our security and control systems, and such third parties have varying levels of security and cybersecurity resources, expertise, safeguards, controls and capabilities. Threat actors may actively seek to exploit third-party security and cybersecurity weaknesses, and the relationships of our third parties with us may increase the risk that they are targeted by the same threats we face, and such third parties may be less prepared for such threats. Also, we are at risk from critical third-party information security and open-source or proprietary software defects and vulnerabilities. We must rely on our third parties to adequately detect and promptly report cybersecurity incidents. Their failure could adversely affect our ability to report or respond to cybersecurity incidents effectively or timely. Due to increasing consolidation, interdependence and complexity of financial entities and technology and information systems, a cybersecurity threat or incident, information or security breach or technology failure that significantly exposes, degrades, destroys, renders unavailable or compromises the information systems or information of one or more financial entities or third parties could adversely impact us and increase the risk of operational failure and loss, as disparate information systems need to be integrated, often on an accelerated basis. Similarly, any cybersecurity threat or incident, information or security breach or technology failure that significantly exposes, degrades, destroys, renders unavailable or compromises our information systems or information could adversely impact third parties and the critical infrastructure of the financial services industry, thereby creating additional risk for us. Cybersecurity incidents or information or security breaches could persist for an extended period of time prior to detection, and it often takes additional time to determine the scope, extent, amount and type of impact, including the information altered, destroyed, accessed or otherwise compromised, following which the measures to recover and restore to a business-as-usual state may be difficult to assess and require notification to our clients, government officials and regulators. We have spent and expect to continue to spend significant resources to modify and enhance our protective measures and our capabilities to respond and recover, investigate and remediate software and network defects and vulnerabilities, and defend against, detect and respond to cybersecurity threats and incidents, whether to us, third parties, the industry or businesses generally. While we and our third parties have experienced cybersecurity incidents, information and security breaches and technology failures, as well as adverse impacts from such events, including as described in this risk factor, we have not experienced material losses or other material consequences relating to cybersecurity incidents, information or security breaches or technology failures, whether directed at us or our third parties. However, we expect to continue to experience such events and impacts ourself and at our third parties with increased frequency and severity due to the evolving threat environment, and there can be no assurance that future cybersecurity incidents, information and security breaches and technology failures, including as a result of cybersecurity incidents, information and security breaches and technology failures experienced by our third parties, will not have a material adverse impact on us, including our businesses, results of operations and financial condition. Future cybersecurity incidents, information or security breaches or technology failures suffered by us or our third parties could result in disruption to our day-to-day business activities and an inability to effect transactions, execute trades, service our clients, safeguard information, manage our exposure to risk, expand our businesses, detect and prevent fraudulent or unauthorized transactions, including transactions impacting our clients, maintain information systems access and business operations and client services, in the U.S. and/or globally. Also, we could experience the loss of clients and business opportunities, the withdrawal of client deposits, the misappropriation, alteration or destruction of our or our third parties’ intellectual property or confidential information, the unauthorized access to or temporary or permanent loss or theft of information, including of our employees and clients, significant lost revenue, increased risk of fraudulent transactions, losses and claims brought by third parties, violations of applicable privacy, cybersecurity and other LRRs, litigation exposure, economic sanctions, enforcement actions, government fines, penalties or intervention and other negative consequences. Although we maintain cyber insurance, there can be no assurance that liabilities or losses we may incur will be covered under such policies or that the amount of insurance will be adequate. In the case of any cybersecurity incident, information or security breach or technology failure arising from third-party systems impacting us, any third-party indemnification may not be applicable or sufficient to address the impact of such cybersecurity incidents, information or security breaches or technology failures, including monetary losses of the Corporation. The occurrence of any of the events described above could adversely impact our businesses, results of operations, liquidity and financial condition, and cause reputational harm, whether such events are actual or perceived.