Jefferies (JEF) Risk Factors

Many aspects of our business involve substantial risks of liability, and in the normal course of business, we have been named as a defendant or codefendant in lawsuits involving primarily claims for damages. The risks associated with potential legal liabilities often may be difficult to assess or quantify and their existence and magnitude often remain unknown for substantial periods of time. The expansion of our business, including increases in the number and size of investment banking transactions and our expansion into new areas impose greater risks of liability. Substantial legal liability could have a material adverse financial effect or cause us significant reputational harm, which in turn could seriously harm our business and our prospects.

The EU General Data Protection Regulation (the "EU GDPR" or "GDPR") applies in all EU Member States and also applies to entities established outside of the EU where such entity processes personal data in relation to: (i) the offering of goods or services to data subjects in the EEA; or (ii) monitoring the behavior of data subjects as far as that behavior takes place in the EEA. The UK has implemented the GDPR as part of its national law (the "UK GDPR"). The UK GDPR exists alongside the UK Data Protection Act 2018 and its requirements are largely aligned with those under the EU GDPR. The EU GDPR and UK GDPR impose a number of obligations on organizations to which they apply, including, without limitation: accountability and transparency requirements; compliance with the data protection rights of data subjects; and the prompt reporting of certain personal data breaches to both the relevant data supervisory authority and impacted individuals. The EU GDPR and UK GDPR also include restrictions on the transfer of personal data from the EEA to jurisdictions that are not recognized as having an adequate level of protection with regards to data protection laws. Obligations under the EU GDPR, the UK GDPR and implementing EU Member State legislation continue to evolve through legislation and regulatory guidance, for example imposing restrictions on use of the standard contractual clauses ("SCCs") to transfer personal data to countries that are not recognized as having an adequate level of data protection by requiring organizations to carry out a transfer privacy impact assessment. The EU GDPR imposes significant fines for serious non-compliance of up to the higher of 4% of an organization's annual worldwide turnover or €20 million (or approximately £17.5 million under the UK GDPR). The EU GDPR and UK GDPR identify a list of points for the relevant data supervisory authority to consider when determining the level of fines to impose (including the nature, gravity and duration of the infringement). Data subjects also have a right to receive compensation as a result of infringement of the EU GDPR and/or UK GDPR for financial or non-financial losses. Other privacy laws at both federal and state levels are in effect in the U.S. and other regions, many of which involve heightened compliance obligations similar to those under EU GDPR and UK GDPR. The privacy and cybersecurity legislative and regulatory landscape is evolving rapidly, and numerous proposals regarding privacy and cybersecurity are pending before U.S. and non-U.S. legislative and regulatory bodies. The adopted form of such developing legislation and regulation will determine the level of any resources which we will need to invest to ensure compliance. In the event of non-compliance with privacy laws and regulations, we could face significant administrative and monetary sanctions as well as reputational damage which may have a material adverse effect on our operations, financial condition and prospects.

Market risk generally represents the risk that values of assets and liabilities or revenues will be adversely affected by changes in market conditions. Market risk is inherent in the financial instruments associated with our operations and activities, including trading account assets and liabilities, loans, securities, short-term borrowings, corporate debt, and derivatives. Market conditions that change from time to time, thereby exposing us to market risk, include fluctuations in interest rates, equity prices, relative exchange rates, and price deterioration or changes in value due to changes in market perception or actual credit quality of an issuer. In addition, disruptions in the liquidity or transparency of the financial markets may result in our inability to sell, syndicate, or realize the value of security positions, thereby leading to increased concentrations. The inability to reduce our positions in specific securities may not only increase the market and credit risks associated with such positions, but also increase capital requirements, which could have an adverse effect on our business, results of operations, financial condition, and liquidity. A considerable portion of our revenues is derived from trading in which we act as principal. We may incur trading losses relating to the purchase, sale or short sale of fixed income, high yield, international, convertible, and equity securities, loans, derivative contracts and commodities for our own account. In any period, we may experience losses on our inventory positions as a result of the level and volatility of equity, fixed income and commodity prices (including oil prices), lack of trading volume and illiquidity. From time to time, we may engage in a large block trade in a single security or maintain large position concentrations in a single security, securities of a single issuer, securities of issuers engaged in a specific industry, or securities from issuers located in a particular country or region. In general, because our inventory is marked to market on a daily basis, any adverse price movement in these securities could result in a reduction of our revenues and profits. In addition, we may engage in hedging transactions that if not successful, could result in losses. Increased market volatility may also impact our revenues as transaction activity in our investment banking and capital markets sales and trading businesses can be negatively impacted in a volatile market environment. See Management's Discussion and Analysis of Financial Condition and Results of Operations-Risk Management within Part II, Item 7. of this Annual Report on Form 10-K for additional discussion.

Our businesses are highly dependent on our ability to process, on a daily basis, a large number of transactions across numerous and diverse markets in many currencies, and the transactions we process have become increasingly complex. If any of our financial, accounting or other data processing systems do not operate properly, or are disabled, or if there are other shortcomings or failures in our internal processes, people or systems, we could suffer an impairment to our liquidity, financial loss, a disruption of our businesses, liability to clients, regulatory intervention or reputational damage. These systems may fail to operate properly or become disabled as a result of events that are wholly or partially beyond our control, including a disruption of electrical or communications services or our inability to occupy one or more of our buildings. The inability of our systems to accommodate an increasing volume and complexity of transactions could also constrain our ability to expand our businesses. Certain of our financial and other data processing systems rely on access to and the functionality of operating systems maintained by third-parties. If the accounting, trading or other data processing systems on which we are dependent are unable to meet increasingly demanding standards for processing and security or, if they fail or have other significant shortcomings, we could be adversely affected. Such consequences may include our inability to effect transactions and manage our exposure to risk. In addition, despite the contingency plans we have in place, our ability to conduct business may be adversely impacted by a disruption in the infrastructure that supports our businesses and the communities in which they are located. This may include a disruption involving electrical, communications, transportation or other services used by us or third-parties with which we conduct business.

Our operations rely heavily on the secure processing, storage and transmission of financial, personal and other information in our computer systems and networks. In recent years, there have been several highly publicized incidents involving financial services companies reporting the unauthorized disclosure of client or other confidential information, as well as cyber attacks involving theft, dissemination and destruction of corporate information or other assets, which in some cases occurred as a result of failure to follow procedures by employees or contractors or as a result of actions by third-parties. Cyber attacks can originate from a variety of sources, including third-parties affiliated with foreign governments, organized crime or terrorist organizations, and malicious individuals both outside and inside a targeted company, including through use of relatively new artificial intelligence tools or methods. Retaliatory acts by Russia, Hamas or their allies in response to economic sanctions or other measures taken by the global community arising from the Russia-Ukraine and Hamas-Israel conflicts could result in an increased number and/or severity of cyber attacks. Malicious actors may also attempt to compromise or induce our employees, clients or other users of our systems to disclose sensitive information or provide access to our data, and these types of risks may be difficult to detect or prevent. Like other financial services firms, we and our third-party service providers have been the target of cyber attacks. Although we and our service providers regularly defend against, respond to and mitigate the risks of cyberattacks, cybersecurity incidents among financial services firms and industry generally are on the rise. We are not aware of any material losses we have incurred relating to cyber attacks or other information security breaches. The techniques and malware used in these cyber attacks and cybersecurity incidents are increasingly sophisticated, change frequently and are often not recognized until launched because they are novel. Although we monitor the changing cybersecurity risk environment and seek to maintain reasonable security measures, including a suite of authentication and layered information security controls, no security measures are infallible, and we cannot guarantee that our safeguards will always work or that they will detect, mitigate or remediate these risks in a timely manner. Despite our implementation of reasonable security measures and endeavoring to modify them as circumstances warrant, our computer systems, software and networks may be vulnerable to spam attacks, unauthorized access, distributed denial of service attacks, ransomware, computer viruses and other malicious code, as well as human error, natural disaster, power loss, and other events that could damage our reputation, impact the security and stability of our operations, and expose us to class action lawsuits and regulatory investigation, action, and penalties, and significant liability. We also rely on numerous third-party service providers to conduct other aspects of our business operations, and we face similar risks relating to them. While we evaluate the information security programs and defenses of third-party vendors, we cannot be certain that our reviews and oversight will identify all potential information security weaknesses, or that our vendors' information security protocols are or will be sufficient to withstand or adequately respond to a cyber attack, cybersecurity incident, or other information security breach. In addition, in order to access our products and services, or trade with us, our customers and counterparties may use networks, computers and other devices that are beyond our security control systems and processes. Notwithstanding the precautions we take, if a cyber attack, cybersecurity incident, or other information security breach were to occur, this could jeopardize the information we confidentially maintain, or otherwise cause interruptions in our operations or those of our clients and counterparties, exposing us to liability. As attempted attacks continue to evolve in scope and sophistication, we may be required to expend substantial additional resources to modify or enhance our reasonable security measures, to investigate and remediate vulnerabilities or other exposures or to communicate about cyber attacks, cybersecurity incidents, or other information security breaches to our customers, partners, third-party service providers, and counterparties. Though we have insurance against some cyber risks and attacks, we may be subject to litigation and financial losses that exceed our insurance policy limits or are not covered under any of our current insurance policies. A technological breakdown could also interfere with our ability to comply with financial reporting and other regulatory requirements, exposing us to potential disciplinary action by regulators. Successful cyber attacks, cybersecurity incidents, or other information security breaches at other large financial institutions or other market participants, whether or not we are affected, could lead to a general loss of customer confidence in financial institutions that could negatively affect us, including harming the market perception of the effectiveness of our security measures or the financial system in general, which could result in a loss of business. Further, in light of the high volume of transactions we process, the large number of our clients, partners and counterparties, and the increasing sophistication of malicious actors that may employ increasingly sophisticated methods such as new artificial intelligence tools, a cyber attack, cybersecurity incident, or other information security breach could occur and persist for an extended period of time without detection. We expect that any investigation of a cyber attack, cybersecurity incident, or other information security breach would take substantial amounts of time and resources, and that there may be extensive delays before we obtain full and reliable information. During such time we would not necessarily know the extent of the harm caused by the cyber attack, cybersecurity incident, or other information security breach or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated. All of these factors could further increase the costs and consequences of such a cyber attack or cybersecurity incident. In providing services to clients, we manage, utilize and store sensitive or confidential client or employee data, including personal data. As a result, we are subject to numerous laws and regulations designed to protect this information, such as U.S. and non-U.S. federal and state laws governing privacy and cybersecurity. If any person, including any of our associates, negligently disregards or intentionally breaches our established controls with respect to client or employee data, or otherwise mismanages or misappropriates such data, we could be subject to significant monetary damages, regulatory enforcement actions, fines and/or criminal prosecution. In addition, unauthorized disclosure of sensitive or confidential client or employee data, whether through system compromise or failure, employee negligence, fraud or misappropriation, could damage our reputation and cause us to lose clients and related revenue. Depending on the circumstances giving rise to the information security breach, this liability may not be subject to a contractual limit or an exclusion of consequential or indirect damages.

Maintaining our reputation is critical to our attracting and maintaining customers, investors and employees. If we fail to deal with, or appear to fail to deal with, various issues that may give rise to reputational risk, we could significantly harm our business prospects. These issues include, but are not limited to, any of the risks discussed in this Item 1A, appropriately dealing with potential conflicts of interest, legal and regulatory requirements, ethical issues, money-laundering, cybersecurity and privacy, record keeping, sales and trading practices, failure to sell securities we have underwritten at the anticipated price levels, and the proper identification of the legal, reputational, credit, liquidity and market risks inherent in our products. A failure to deliver appropriate standards of service and quality, or a failure or perceived failure to treat customers and clients fairly, can result in customer dissatisfaction, litigation and heightened regulatory scrutiny, all of which can lead to lost revenue, higher operating costs and harm to our reputation. Further, negative publicity regarding us, whether or not true, may also result in harm to our prospects. Our operations in the past have been impacted as some clients either ceased doing business or temporarily slowed down the level of business they do, thereby decreasing our revenue. There is no assurance that we will be able to successfully reverse the negative impact of allegations and rumors in the future and our potential failure to do so could have a material adverse effect on our business, financial condition and liquidity.