Icici Bank (IBN) Risk Factors

The loan portfolio of our international branches and banking subsidiaries includes foreign currency loans to Indian companies for their Indian operations (where permitted by regulation) as well as for their overseas ventures, including cross-border acquisitions. This exposes us to specific additional risks including the failure of the acquired entities to perform as expected, and our inexperience in various aspects of the economic and legal framework in overseas markets. We are, through our international branches and banking subsidiaries, also exposed to a variety of local market credit risks, where our expertise and experience may be limited. Our international profile has also increased the complexity of our risks in a number of areas including price risks, currency risks, interest rate risks, compliance risk, regulatory and reputational risk and operational risk. We also face risks arising from our ability to manage inconsistent legal and regulatory requirements in the multiple jurisdictions in which we operate. Our businesses are subject to changes in legal and regulatory requirements and it may not be possible to predict the timing or nature of such changes. See also “—Risks that arise as a result of our presence in a highly regulated sector—The opportunities for growth in our international operations and our ability to repatriate capital from these operations may be limited by the local regulatory environments.” Business opportunities in these jurisdictions will also determine the growth in our operations. Global developments including geopolitical tensions could impact economic growth in Canada and the United Kingdom, which in turn could impact the business of our banking subsidiaries in these countries. Our international branches and banking subsidiaries undertake select local banking businesses, including lending to multinational and local corporations, small businesses, property backed lending and insured and other mortgages, and in the event of these corporations being impacted by global and local economic conditions it could have an adverse impact on our business. For instance, during the three months ended March 31, 2020, two non-India linked loan accounts at our international branches had to be classified as non-performing as the borrowers misrepresented their financial position to lenders. Our international branches and banking subsidiaries have also made investments in bonds, certificates of deposit, mortgage backed securities, treasury bills and asset-backed commercial paper. We are repositioning our international business strategy to sharpen our focus on the non-resident Indian community and on India-linked trade. We aim to progressively exit exposures that are not linked to India in a planned manner at our international branches. Our overseas banking subsidiaries will continue to serve local markets selectively with a focus on risk mitigation and granularity of business. There can be no assurance of our successful execution of this strategy. The global financial and economic crisis resulted in mark-to-market and realized losses on our overseas and other subsidiaries’ investment and derivative portfolios, increased the regulatory scrutiny of our international operations, constrained our international debt capital market borrowings and increased our cost of funding. The Covid-19 pandemic also increased challenges for our international branches and banking subsidiaries. If we are unable to manage these risks, our business would be adversely affected.The classification of the loan portfolio of our international branches and banking subsidiaries is also subject to the regulations of respective local regulators. Such loans that are identified as impaired as per host country regulations for reasons other than record of recovery, but which are standard as per the current Reserve Bank of India guidelines, are classified as non-performing to the extent of the amount of outstanding loan in the host country. Overseas regulators may also require higher provisions against loans held in their jurisdictions.

Our businesses rely on our secure processing, transmission, storage and retrieval of confidential, proprietary and other information in our computer and data management systems and networks and in the computer and data management systems and networks of third parties. To access our products and services, our customers may use personal smartphones, tablets, laptops, PCs, and other mobile devices that are beyond our control systems and subject to their own cybersecurity risks. Given our reliance and focus on technology and presence in diverse geographies, our technologies, systems, networks, and our customers’ devices are subject to security risks and are susceptible to cyber-attacks (such as, denial of service attacks, hacking, terrorist activities or identity theft) that could negatively impact the confidentiality, integrity or availability of data pertaining to us or our customers, which in turn may cause direct loss of money to our customers or to us, damage to our reputation and adversely impact our business and financial results. Third parties with which we do business or that facilitate our business activities could also be sources of operational and information security risk to us, including from breakdowns or failures of their own systems or capacity constraints. We, our customers, regulators and other third parties, including other financial services institutions and companies engaged in data processing, have been subject to, and are likely to continue to be the target of, cyber-attacks. These cyber-attacks include computer viruses, malicious or destructive code, phishing attacks, denial of service or information, ransomware, improper access by employees or vendors, attacks on personal email of employees, ransom demands to not expose security vulnerabilities in our systems or the systems of third parties or other security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary and other information of ours, our employees, our customers or of third parties, damage our systems or otherwise materially disrupt our or our customers’ or other third parties’ network access or business operations. Like many other large global financial institutions, we have also experienced a distributed denial of services attack which was intended to disrupt customer access to our main portal. While our monitoring and mitigating controls were able to detect and effectively respond to this incident, there can be no assurance that these security measures will be successful in the future. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. We have a governance framework in place for security and have implemented information security policies, procedures and technologies. However, considering that technology is currently in a phase of rapid evolution and that the methods used for cyber-attacks are also changing frequently or, in some cases, are not recognized until an actual attack, we may not be able to anticipate or to implement effective preventive measures against all security breaches. Further, circumstances such as the Covid-19 pandemic requiring a large number of our employees to work from home may increase our vulnerability to cyber attacks. Cyber threats are rapidly evolving and we may not be able to anticipate or prevent all such attacks and could be held liable for any security breach or loss. Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, and the use of the internet and telecommunications technologies to conduct financial transactions. For example, cybersecurity risks may increase in the future as we continue to increase our mobile-payment and other internet-based product offerings and expand our internal usage of web-based products and applications. In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of organized crime affiliates, terrorist organizations, hostile foreign governments, disgruntled employees or vendors, activists and other external parties, including those involved in corporate espionage. Even the most advanced internal control environment may be vulnerable to compromise. Targeted social engineering attacks and “spear phishing” attacks are becoming more sophisticated and are extremely difficult to prevent. In such an attack, an attacker will attempt to fraudulently induce colleagues, customers or other users of our systems to disclose sensitive information in order to gain access to its data or that of its clients. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cyber criminals change frequently, may not be recognized until launched and may not be recognized until well after a breach has occurred. The risk of a security breach caused by a cyber-attack at a vendor or by unauthorized vendor access has also increased in recent years. Additionally, the existence of cyber-attacks or security breaches at third-party vendors with access to our data may not be disclosed to us in a timely manner. We could also face cybersecurity risks which result in direct loss of money, as has happened with certain other banks in the past where their high value payment systems were compromised resulting in direct monetary loss for the bank. We also face risks where our customers could lose money because of cyber attacks, and these could result in monetary as well as reputational risks for the Bank. We also face indirect technology, cybersecurity and operational risks relating to clients and other third parties with whom we do business or upon whom we rely to facilitate or enable our business activities, including, for example, financial counterparties, regulators and providers of critical infrastructure such as internet access and electrical power. As a result of increasing consolidation, interdependence and complexity of financial entities and technology systems, a technology failure, cyber-attack or other information or security breach that significantly degrades, deletes or compromises the systems or data of one or more financial entities could have a material impact on counterparties or other market participants, including us. This consolidation, interconnectivity and complexity increases the risk of operational failure, on both individual and industry-wide bases, as disparate systems need to be integrated, often on an accelerated basis. Any third-party technology failure, cyber-attack or other information or security breach, termination or constraint could, among other things, adversely affect our ability to effect transactions, service our clients, manage our exposure to risk or expand our business. Cyber-attacks or other information or security breaches, whether directed at us or third parties, may result in a material loss or have material consequences. Furthermore, the public perception that a cyber-attack on our systems has been successful, whether or not this perception is correct, may damage our reputation with customers and third parties with whom we do business. Hacking of personal information and identity theft risks, in particular, could cause serious reputational harm. A successful penetration or circumvention of system security could cause us serious negative consequences, including our loss of customers and business opportunities, costs associated with maintaining business relationships after an attack or breach; significant business disruption to our operations and business, misappropriation, exposure, or destruction of our confidential information, intellectual property, funds, and/or those of our customers; or damage to our computers or systems, and could result in a violation of applicable privacy laws and other laws, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in our security measures, reputational damage, reimbursement or other compensatory costs, additional compliance costs, and could adversely impact our results of operations, liquidity and financial condition. In view of the Covid-19 pandemic, work-from-home has been enabled for our employees, other than at the branches, which continue to function as banking is classified as an essential service. This may expose us to risks arising on account of remote work environment, data security issues, increased cyber-attacks and availability of critical functions and IT systems. Our customers could also be exposed to increased phishing and vishing attacks that could result in a financial loss to them, and in turn lead to claims for compensation from the Bank or reputation loss for the Bank.

Our continued success depends in part on the continued service of key members of our management team and our ability to continue to attract, train, motivate and retain highly qualified professionals. This is a key element of our strategy and we believe it to be a significant source of competitive advantage. The successful implementation of our strategy depends on the availability of skilled management, both at our head office and at each of our business units and international locations, continuity in the service of our directors, executives and senior managers, and our ability to attract and train young professionals. The appointment of individuals in certain positions is subject to regulatory and shareholder approvals. Any stringent requirements by our regulator for appointing key members in the management may require us to reorganize our management structure and may affect our ability to identify, hire and appoint suitable professionals for various roles. The loss of any member from our senior management, including directors and key personnel, can have a material impact on our business, our financial performance, our stockholders’ equity, our ability to implement our strategy and the prices of our equity shares and ADSs. If we or one of our business units or other functions fail to staff operations appropriately, or lose one or more key senior executives or qualified young professionals and fail to replace them in a satisfactory and timely manner, our business, financial condition and results of operations, including our control and operational risks, may be adversely affected. Likewise, if we fail to attract and appropriately train, motivate and retain young professionals or other talent, our business may likewise be affected. We have recently made several changes to our human resource management practices, including key performance indicators, unit-level operating flexibility and accountability and a shift from grades to functional designations at senior levels, aimed at greater agility and synergy across the organization. There can be no assurance that these measures will be successful in meeting the desired objectives. A substantial portion of our compensation structure for middle and senior management is in the form of employee stock options, and dependent on the market price of our equity shares. Depending on market and business conditions, we may decide to reduce our employee strength in certain of our businesses. We recently introduced an employee stock option scheme for up to the middle-level management employees pursuant to which, options will be issued at a face value of Rs. 2.0 per unit, with the vesting of units based upon the continuation of the employee. However, increased competition, including the entry of new banks into an already competitive sector, may affect our ability to hire and retain qualified employees. See also “Business—Employees”. Several of our employees were impacted by the Covid-19 pandemic. Such health epidemics or natural disasters in the future could impact our employees, including the senior management. There can be no assurance that this would not impact our ability to manage or conduct our business or the price of our equity shares and ADSs.

Reputation risk, or the risk to our business, earnings and capital from negative publicity, is inherent in our business. The reputation of the financial services industry in general has been closely monitored as a result of the financial crisis and other matters affecting the financial services industry. Negative public opinion about the financial services industry generally or us specifically could adversely affect our ability to keep and attract customers, and expose us to litigation and regulatory action. Negative publicity can result from our actual or alleged conduct in any number of activities, including lending practices and specific credit exposures, the level of non-performing loans, corporate governance, regulatory compliance, mergers and acquisitions, and related disclosure, sharing or inadequate protection of customer information, and actions taken by government, regulators, investigative agencies, judiciary and community organizations in response to that conduct. The media coverage and public scrutiny of our business practices, our board of directors, key management personnel, policies and actions has increased significantly over the past few months. Although we take steps to minimize reputation risk in dealing with such events, we, as a large financial services organization are inherently exposed to this risk. We have experienced negative publicity with respect to the allegations levelled against Ms. Kochhar and her spouse and the whistleblower complaints regarding alleged incorrect asset classification and other allegations. See also “—Risks that arise as a result of our presence in a highly regulated sector—The board of directors of the Bank has, pursuant to an independent enquiry, taken action against the former Managing Director and CEO. In the event the Bank is found by any of the enquiries in the matter by government and regulatory agencies to have violated applicable laws or regulations, the Bank could become subject to legal and regulatory sanctions that may materially and adversely affect our results of operations, financial condition and reputation.” We cannot be certain how the investigations by the government and regulatory and other agencies will conclude with regard to the issue of the former CEO and it is possible that the conclusions of these investigations could lead to more negative publicity. Any continued unfavorable publicity may adversely impact investor confidence and affect the prices of our equity shares and ADSs. Our subsidiaries’ businesses include mutual fund, portfolio and private equity fund management, which are exposed to various risks including diminution in value of investments and inadequate liquidity of the investments. We also distribute products of our insurance, asset management and private equity subsidiaries and affiliate. Investors in these funds and schemes may allege mismanagement or weak fund management as well as mis-selling and conflicts of interest, which may impact our overall reputation as a financial services group and may require us to support these businesses with liquidity and may result in a reduction in business volumes and revenues from these businesses. We are also exposed to the risk of litigation, claims or disputes by customers, counterparties or other constituents across our businesses.