Our operations rely on the secure receipt, processing, storage and transmission of confidential and other information in our computer systems and networks and with our business partners, including proprietary, confidential or personal information that is subject to privacy laws, regulations or contractual obligations. Information security risks for large institutions like us have significantly increased in recent years in part because of the proliferation of new technologies and the use of the Internet, mobile, telecommunications and cloud technologies to conduct or automate financial transactions. A number of financial services companies, consumer-based companies and other organizations have reported the unauthorized disclosure of client, customer or other confidential information, as well as cyber attacks involving the dissemination, theft and destruction of corporate information, intellectual property, cash or other valuable assets. There have also been several highly publicized ransomware cyber attacks where hackers have requested “ransom” payments in exchange for not disclosing stolen customer information or for unlocking or not disabling the target company’s computer or other systems. We have been, and likely will continue to be, the target of cyber attacks, computer viruses, malicious code, social engineering attacks, including phishing attacks, denial of service attacks and other information security threats. To date, cyber attacks have not had a material impact on our financial condition, results or business. However, we could suffer material financial or other losses in the future as a result of cyber attacks, and these attacks and their impacts are hard to predict. Our risk and exposure to these matters remains heightened because of, among other things: •the evolving nature of these threats; •the current global economic and political environment; •our prominent size and scale and our role in the financial services industry; •the outsourcing of some of our business operations; •the ongoing shortage of qualified cybersecurity professionals; •our migration to cloud-based systems; •our increased use of employee-owned devices for business communication; •the large number of our employees working remotely; and •the interconnectivity and interdependence of third parties to our systems. Despite our efforts to ensure the integrity of our software, computers, systems and information, we may not be able to anticipate, detect or recognize threats to our systems and assets, or to implement effective preventive measures against all cyber threats, especially because the techniques used are increasingly sophisticated, change frequently, are complex, and are often not recognized until launched. In addition, recent large-scale cyber attacks suggest that the risk of damaging cyberattacks impacting us and/or third-parties with which we do business is increasing. We expect cyber attack and breach incidents to continue, and we are unable to predict the direct or indirect impact of future attacks or breaches on our business operations. We routinely identify cyber threats as well as vulnerabilities in our systems and work to address them. Some cyber vulnerabilities take a substantial amount of time to resolve. In addition, efforts to resolve them may be insufficient. Further, these efforts involve costs that can be significant as cyber attack methods continue to rapidly evolve. Cyber attacks can originate from a variety of sources, including external parties who are affiliated with foreign governments or are involved with organized crime or terrorist organizations. Cybersecurity risks also derive from human error, fraud or malice on the part of our employees or third parties. Third parties have, and will likely continue to, attempt to induce employees, lenders (including servicers) or other users of our systems to disclose sensitive information or provide access to our systems or network, or to our data or that of our counterparties or borrowers, and these types of risks may be difficult to detect or prevent. The occurrence of a cyber attack, breach, unauthorized access, misuse, computer virus or other malicious code or other cybersecurity event could jeopardize or result in the unauthorized disclosure, gathering, monitoring, misuse, corruption, loss or destruction of confidential and other information that belongs to us, our lenders, our counterparties, third-party service providers or borrowers that is processed and stored in, and transmitted through, our computer systems and networks. The occurrence of such an event could also result in damage to our software, computers or systems, or otherwise cause interruptions or malfunctions in our, our lenders’, our counterparties’ or third parties’ operations. This could result in significant financial losses, loss of lenders and business opportunities, reputational damage, litigation, regulatory fines, penalties or intervention, reimbursement or other compensatory costs, or otherwise adversely affect our business, financial condition or results of operations. Cyber attacks can occur and persist for an extended period of time without detection. Investigations of cyber attacks are inherently unpredictable, and it takes time to complete an investigation and have full and reliable information. While we are investigating a cyber attack, we do not necessarily know the extent of the harm or how best to remediate it, and we can repeat or compound certain errors or actions before we discover and remediate them. In addition, announcing that a cyber attack has occurred increases the risk of additional cyber attacks, and preparing for this elevated risk can delay the announcement of a cyber attack. All or any of these challenges could further increase the costs and consequences of a cyber attack. These factors may also inhibit our ability to provide rapid, complete and reliable information about a cyber attack to our lenders, counterparties and regulators, as well as the public. In addition, we may be required to expend significant additional resources to modify our protective measures and to investigate and remediate vulnerabilities or other exposures arising from operational and security risks. Although we maintain insurance coverage relating to cybersecurity risks, our insurance may not be sufficient to provide adequate loss coverage in all circumstances. Because we are interconnected with and dependent on third-party vendors, exchanges, clearing houses, fiscal and paying agents, and other financial intermediaries, including CSS, we could be materially adversely impacted if any of them is subject to a successful cyber attack or other information security event. Third parties with which we do business may also be sources of cybersecurity or other technological risks. We outsource certain functions and these relationships allow for the external storage and processing of our information, as well as lender, counterparty and borrower information, including on cloud-based systems. We also share this type of information with regulatory agencies and their vendors. While we engage in actions to mitigate our exposure resulting from our information-sharing activities, ongoing threats may result in unauthorized access, loss or destruction of data or other cybersecurity incidents with increased costs and consequences to us such as those described above. We routinely transmit and receive personal, confidential and proprietary information by electronic means. In addition, our lenders maintain personal, confidential and proprietary information on systems we provide. We have discussed and worked with lenders, vendors, service providers, counterparties and other third parties to develop secure transmission capabilities and protect against cyber attacks, but we do not have, and may be unable to put in place, secure capabilities with all of our lenders, vendors, service providers, counterparties and other third parties and we may not be able to ensure that these third parties have appropriate controls in place to protect the confidentiality of the information. An interception, misuse or mishandling of personal, confidential or proprietary information being sent to or received from a lender, vendor, service provider, counterparty or other third party could result in legal liability, substantial fines, regulatory action and reputational harm. Furthermore the legal and regulatory environment related to data privacy and cybersecurity is constantly changing. An actual or perceived failure by us, lenders, vendors, service providers, counterparties or other third parties to comply with privacy, data protection and information security laws, regulations, standards, policies and contractual obligations could result in legal liability, substantial fines, regulatory action and reputational harm.