Popular (BPOP) Risk Factors

Weakness in the economy, particularly in Puerto Rico, where a significant portion of our business is concentrated, has

Under regulatory capital adequacy requirements, and other regulatory requirements, Popular and our banking subsidiaries must meet requirements that include quantitative measures of assets, liabilities and certain off-balance sheet items, subject to qualitative judgments by regulators regarding components, risk weightings and other factors. If we fail to meet these minimum capital requirements and other regulatory requirements, our business and financial condition will be materially and adversely affected. If a financial holding company fails to maintain well-capitalized status under the regulatory framework, or is deemed not well managed under regulatory exam procedures, or if it experiences certain regulatory violations, its status as a financial holding company and its related eligibility for a streamlined review process for acquisition proposals, and its ability to offer certain financial products, may be compromised and its financial condition and results of operations could be adversely affected. The failure of any depository institution subsidiary of a financial holding company to maintain well-capitalized or well-managed status could have similar consequences. In addition, federal regulators have proposed revisions to increase capital requirements for banking organizations with $100 billion or more in assets. If adopted, such standards may in the future affect us. See "Our businesses are highly regulated, and the laws and regulations that apply to us have a significant impact on our business and operations" in the Legal and Regulatory Risks section of Item 1A in this Form 10-K.

and regulations, we could be exposed to fines, sanctions and penalties, and other regulatory actions, as well as

found to have failed to comply with applicable economic and trade sanctions programs and anti-money laundering laws

Switching from one vendor of core bank processing and related technology and security services to one or more new vendors is a complex process that carries business and financial risks. The implementation cycle for such a transition can be lengthy and require significant financial and management resources from us. Such a transition can also expose us, and our clients,to increased costs (including conversion costs), business disruption, as well as operational and cybersecurity risks. Upon the transition of all or a portion of existing services provided by Evertec to a new financial services technology provider, either (i) at the end of the term of the Second Amended and Restated Master Services Agreement (the "MSA") and related agreements or (ii) earlier upon the termination of any service for convenience under the MSA, these transition risks could result in an adverse effect on our business, financial condition and results of operations. Although Evertec has agreed to provide certain transition assistance to us in connection with the termination of the MSA, we are ultimately dependent on their ability to provide those services in a responsive and competent manner. Furthermore, we may require transition assistance from Evertec beyond the term of the MSA, delaying and lengthening any transition process away from Evertec while increasing related costs. Under the MSA, we are able to terminate services for convenience with 180 days' prior notice. We expect to exercise during the term of the MSA the right to terminate certain services for convenience and to transition such services to other service providers prior to the expiration of the MSA, subject to complying with the revenue minimums contemplated in the MSA and certain other conditions. In practice, in order to switch to a new provider for a particular service, we will have to commence procuring and working on a transition process for such service significantly in advance of its termination and, in any case, much earlier than the automatic renewal notice date or the expiration date of the MSA, and such process may extend beyond the current term of the MSA. Furthermore, if we are unsuccessful or decide not to complete the transition after expending significant funds and management resources, it could also result in an adverse effect on our business, financial condition and results of operations.

Climate change could have a material adverse impact on our business operations and that of our clients and customers. Our business and the activities and operations of our clients and customers may be disrupted by global climate change. Potential physical risks from climate change include the increase in the frequency and severity of weather events, such as storms and hurricanes, and long-term shifts in climate patterns, such as sustained higher and lower temperatures, sea level rise, heat waves and droughts, among others. Our geographic concentration in localities, including Puerto Rico, the U.S.V.I., B.V.I. and Florida, particularly susceptible to risks arising from climate change, including severe hurricanes and sea level rise, heighten the threat we face from climate change. Additionally, the impact of climate change in the markets that we operate and in other global markets may have the effect of increasing the costs or reducing the availability of insurance needed for our business operations. Climate change may also create transitional risks resulting from a shift to a low-carbon economy. These transition risks may include changes in the legal and regulatory landscape, technology, consumer sentiment and preferences, and market demands that seek to mitigate the effects of climate change. Changes in the legal and regulatory landscape may additionally increase our compliance costs. These climate-driven changes could have a material adverse impact on asset values and on our business and financial performance and those of our clients and customers.

A significant portion of our business involves lending money, which exposes us to credit risk and risk of loss if borrowers do not repay their loans, leases, credit cards or other credit obligations. The performance of these credit portfolios significantly affects our financial condition and results of operations. We have in the past been adversely affected by negative changes in the financial condition of our clients due to weakness in the Puerto Rico and U.S. economy. If the current economic environment were to deteriorate, more customers may have difficulty in repaying their credit obligations, which may result in higher levels of credit losses and reserves for credit losses.

could cause substantial harm and have an adverse effect on our business and results of operations. Cybersecurity risks for large financial institutions such as Popular have increased significantly in recent years in part because of the proliferation of new technologies, such as mobile banking, artificial intelligence and the ability to conduct instant financial transactions anywhere globally, growing geo-political threats, such as the ongoing wars in Ukraine and in the Gaza Strip,and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, hacktivists and other parties. In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to transmit and store sensitive data. We employ a layered defensive approach that employs people, processes and technology to manage and maintain cybersecurity controls through a variety of preventative and detective tools that monitor, block, and provide alerts regarding suspicious activity and identify suspected advanced persistent threats. Notwithstanding our defensive measures and the significant resources we devote to protect the security of our systems, there is no assurance that all of our security measures will be effective at all times, especially as the threats from cyber-attacks are continuous and severe. The risk of a security breach due to a cyber-attack could increase in the future as we continue to expand our mobile banking and other internet-based product offerings, the use of the cloud for system development and hosting and internal use of internet-based products and applications. We continue to detect and identify attacks that are becoming more sophisticated and increasing in volume, as well as attackers that respond rapidly to changes in defensive countermeasures. The most significant cyber-attack risks that we or our critical service providers may face include, but are not limited to, e-fraud, denial-of-service (DDoS), ransomware, computer intrusion and the exploitation of software zero-day vulnerabilities that might result in disruption of services and in the exposure or loss of customer or proprietary data. Loss from e-fraud occurs when cybercriminals compromise our systems or the systems of our customers and extract funds from customer's credit cards or bank accounts, including through brute force, password spraying and credential stuffing attacks directed at gaining unauthorized access to individual accounts. Denial-of-service attacks intentionally disrupt the ability of legitimate users, including customers and employees, to access networks, websites and online resources. Computer intrusion attempts either direct or through social engineering (pretext calls), supply chain compromise, email, text or voice messages, including using brand impersonation (regularly referred to as phishing, vishing, smishing and quishing), have resulted in and may continue to result in the compromise of sensitive customer data, such as account numbers, credit cards and social security numbers, and could present significant reputational, legal and regulatory costs to Popular if successful. The emergence of new technologies such as artificial intelligence and quantum computing are further expected to exacerbate the risk of cyber-attacks. Our customer-facing platforms are also routinely attacked by threat actors aiming to gain unauthorized access to our clients' accounts. Popular has recently implemented certain defensive measures in response to brute force attacks on one of our platforms which resulted in certain of our customers log-in credentials and information being exposed. As a result, Popular notified,as required or otherwise deemed appropriate, customers identified as affected by the incident. We have to date not experienced material losses in connection with these attacks. Cyber-security risks have also been recently exacerbated by the discovery of zero-day vulnerabilities in widely distributed third party software, such as the vulnerability identified in the Apache log4j in December 2021 and in the MOVEit file transfer application in May 2023, which could affect Popular's or any of its service provider's systems. The increased use of remote access and third-party video conferencing solutions to enable work-from-home arrangements for employees and facilitate the use of digital channels by our customers, has also increased our exposure to cyber-attacks. In addition, a third party could misappropriate confidential information obtained by intercepting signals or communications from mobile devices used by Popular's customers or employees. Recent events, including the wars in Ukraine and the Gaza Strip,have also illustrated increased geo-political factors and the risks related to supply-chain compromises and de-stabilizing activities linked to nation-state sponsored activity as an increasing trend to monitor actively. Risks and exposures related to cyber security attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats,including the rise in the use of cyber-attacks as geopolitical weapons. Although we are regularly targeted by unauthorized threat-actor activity, including denial-of-service attacks, we have not, to date, experienced any material losses as a result of cyber-attacks. A material compromise or circumvention of the security of our systems could have serious negative consequences for us,including significant disruption of our operations and those of our clients, customers and counterparties, misappropriation of confidential information of us or that of our clients, customers, counterparties or employees, or damage to computers or systems used by us or by our clients, customers and counterparties, and could result in violations of applicable privacy and other laws,financial loss to us or to our customers, loss of confidence in our security measures, customer dissatisfaction, significant litigation exposure and harm to our reputation, all of which could have a material adverse effect on us. For example, if personal, non-public,confidential or proprietary information in our possession were to be mishandled, misused or stolen, we could suffer significant regulatory consequences, reputational damage and financial loss. Such mishandling, misuse or misappropriation could include, for example, if such information were provided to parties who are not permitted to have the information, either by fault of our systems,by our employees or counterparties, or where such information is intercepted or otherwise inappropriately taken by our employees or third parties. The extent of a particular cyber-attack and the steps that we may need to take to investigate the attack may not be immediately clear, and it may take a significant amount of time before such an investigation can be completed. While such an investigation is ongoing, Popular may not necessarily know the full extent of the harm caused by the cyber-attack, and that damage may continue to spread. These factors may inhibit our ability to provide rapid, full and reliable information about the cyber-attack to our clients, customers, counterparties and regulators, as well as the public. Moreover, new regulations may require us to disclose information about a cybersecurity event before it has been resolved or fully investigated. Furthermore, it may not be clear how best to contain and remediate the potential harm caused by the cyber-attack, and certain errors or actions could be repeated or compounded before they are discovered and remediated. Cyber-attacks could cause interruptions in our operations and result in the incurrence of significant costs, including those related to forensic analysis and legal counsel, each of which may be required to ascertain the extent of any potential harm to our customers, or employees, or damage to our information systems and any legal or regulatory obligations that may result therefrom. Any cyber incidents could also result in, among other things, increased regulatory scrutiny and adverse regulatory or civil litigation consequences. For a discussion of the guidance and rules that federal banking regulators have released or proposed regarding cybersecurity and cyber risk management standards, see "Regulation and Supervision" in Part I, Item 1 - Business, included in the Form 10-K for the year ended December 31, 2023. Any or all of the foregoing factors could further increase the impact of the incident and thereby the costs and consequences of a cyber-attack. We also rely on third parties for the performance of a significant portion of our information technology functions and the provision of information security, technology and business process services. As a result, a successful compromise or circumvention of the security of the systems of these third-party service providers could have serious negative consequences for us, including compromise of our systems, misappropriation of our confidential information or that of our clients, customers, counterparties or employees, or other negative implications identified above with respect to a cyber-attack on our systems, which could have a material adverse effect on us. Cyber-attacks at third-party service providers are also becoming increasingly common, and, as a result, cybersecurity risks relating to our vendors have increased. The most important of these third-party service providers for us is Evertec. Certain risks particular to Evertec and our dependence on third parties are discussed under "We rely on other companies to provide key components of our business infrastructure, including certain of our core financial transaction processing and information technology and security services, which exposes us to a number of operational risks that could have a material adverse effect on us" in the Operational Risks section of Item 1A in this Form 10-K. During 2021, we determined that, as a result of the widely reported breach of Accellion, Inc.'s File Transfer Appliance tool, which was being used at the time of such breach by a U.S.-based third-party advisory services vendor of Popular, personal information of certain Popular customers was compromised. During 2023,personal information of Popular customer data was compromised in a data breach incident that impacted MOVEit, the third-party file transfer platform used by one of our services providers. In both instances, Popular notified, as required or otherwise deemed appropriate, customers identified as affected by the incident. Although these incidents did not have a material effect on Popular or its financial condition, our networks and systems were not impacted, and our third-party service providers agreed to cover external remediation costs associated therewith, a compromise of the personal information of our customers maintained by third party vendors could result in significant regulatory consequences, reputational damage and financial loss to us.The success of our business depends in part on the continuing ability of these (and other) third parties to perform these functions and services in a timely and satisfactory manner, which performance could be disrupted or otherwise adversely affected due to failures or other information security events originating at the third parties or at the third parties' suppliers or vendors (so-called "fourth party risk"). We may not be able to effectively directly monitor or mitigate fourth-party risk, in particular as it relates to the use of common suppliers or vendors by the third parties that perform functions and services for us. As cyber threats continue to evolve, we expect to expend significant additional resources to continue to modify or enhance our layers of defense or to investigate and remediate additional information security vulnerabilities or incidents. System enhancements and updates also create risks associated with implementing new systems and integrating them with existing ones,including risks associated with supply chain compromises and the software development lifecycle of the systems used by us and our service providers. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our layers of defense can itself create a risk of systems disruptions and security issues. In addition, addressing certain information security vulnerabilities, such as hardware-based vulnerabilities, may affect the performance of our information technology systems. The ability of our hardware and software providers to deliver patches and updates to mitigate vulnerabilities in a timely manner can introduce additional risks, particularly when a vulnerability is being actively exploited by threat actors. Moreover, our efforts to timely mitigate vulnerabilities and manage such risks, given the rise in number and urgency of required patches and third-party software,including "zero-day vulnerabilities", as well as the obsolescence in some of our hardware and software, may impact our day-to-day operations, the availability of our systems and delay the deployment of technology enhancements and innovation. The obsolescence in any of our hardware or software may limit our ability to mitigate vulnerabilities. If Popular's operational systems, or those of external parties on which Popular's businesses depend, are unable to meet the requirements of our businesses and operations or bank regulatory standards, or if they fail, have other significant shortcomings or are impacted by cyber-attacks, Popular could be materially and adversely affected.

Unforeseen or catastrophic events, including extreme weather events and other natural disasters, man-made disasters,

U.S. sanctions and consumer protection laws and regulations, which may expose us to significant penalties and collateral

consequences, and could result in higher compliance costs or restrictions on our operations. We from time-to-time self-report compliance matters to, or receive requests for information from, departments and agencies of the U.S. and Puerto Rico governments, including with respect to compliance with consumer protection laws and regulations. For example, BPPR has in the past received requests for information, such as subpoenas and civil investigative demands from U.S. government regulators, including concerning add-ons on consumer products, real estate appraisals and residential and construction loans in Puerto Rico. BPPR has also self-identified and reported to applicable regulators compliance matters related to U.S. sanctions, as well as mortgage, credit reporting and other consumer lending practices. Incidents of this nature and investigations or examinations by governmental authorities have resulted in the past, and may in the future result, in judgments, settlements, fines, enforcement actions, penalties or other sanctions adverse to the Corporation,which could materially and adversely affect the Corporation's business, financial condition or results of operations, or cause serious reputational harm. Any such settlements or orders that we enter into, or that regulatory authorities impose on us could require enhancements to our procedures and controls and entail significant operational and compliance costs. Furthermore, issues or delays in satisfying the requirements of a regulatory settlement or action on a timely basis could result in additional penalties and enforcement actions, which could be significant. In connection with the resolution of regulatory proceedings, enforcement authorities may seek admissions of wrongdoing and, in some cases, criminal pleas, which could lead to increased exposure to private litigation,loss of clients or customers, and restrictions on offering certain products or services. In addition, responding to information-gathering requests, investigations and other regulatory proceedings, regardless of the ultimate outcome of the matter, could be time-consuming, expensive and divert management attention from our business. Financial services institutions such as Popular have been subject to heightened expectations and regulatory scrutiny in recent years. Our regulators' oversight is not limited to banking and financial services laws but extends to other significant laws such as those related to anti money laundering, anti-bribery and anti-corruption laws. Further, regulators in the performance of their supervisory and enforcement duties, have significant discretion and power to prevent or remedy what they deem to be unsafe and unsound practices or violations of laws by banks and bank holding companies. Therefore, the outcome of any investigative or enforcement action, which may take years and be material to Popular, may be difficult to predict or estimate.