LPL Financial (LPLA) Risk Analysis

The business activities that we may conduct are limited by various regulatory agencies. Our membership agreement with FINRA may be amended by application to include additional business activities or a material change in business operations, as it was in 2024. This application process is time-consuming and may not be successful. As a result, we may be prevented from entering into or acquiring new potentially profitable businesses in a timely manner, or at all. In addition, as a member of FINRA, we are subject to certain regulations regarding changes in control. FINRA Rule 1017 generally provides, among other things, that FINRA approval must be obtained in connection with any transaction resulting in a 25% or more change in the ownership of a FINRA member that results in one person or entity directly or indirectly owning or controlling 25% or more of such member. Similarly, the OCC imposes advance approval requirements for a change of control, and control is presumed to exist if a person acquires 10% or more of our common stock. These regulatory approval processes can result in delay, increased costs or impose additional transaction terms in connection with a proposed change of control or material change in business operations of us or a FINRA member that we seek to acquire. As a result of these regulations, our future efforts to sell shares, raise additional capital or participate in acquisition activity may be delayed, prohibited or limited. In addition, the SEC, FINRA, CFTC, OCC and NFA have extensive rules and regulations with respect to capital requirements. Our registered broker-dealer subsidiaries, including LPL Financial, are subject to the Uniform Net Capital Rule under the Exchange Act, and related requirements of SROs. The CFTC and NFA also impose net capital requirements. The Uniform Net Capital Rule specifies minimum capital requirements that are intended to ensure the general soundness and liquidity of broker-dealers. Because our holding companies are not registered broker-dealers, they are not subject to the Uniform Net Capital Rule. However, the ability of our holding companies to withdraw capital from our broker-dealer subsidiaries, including LPL Financial, could be restricted in the event they experience a net capital shortfall, which in turn could limit our ability to repay debt, redeem or repurchase shares of our outstanding stock or pay dividends. A large operating loss or charge against net capital could also adversely affect our ability to expand or maintain our present levels of business.

Some of the financial products distributed by our advisors, such as variable annuities, enjoy favorable treatment under current U.S. federal income tax law. Changes in U.S. federal income tax law, in particular with respect to variable annuity products, or with respect to tax rates on capital gains or dividends, could make some of these products less attractive to clients and, as a result, could have a material adverse effect on our business, results of operations, cash flows or financial condition.

Compared to wirehouses and other employee model broker-dealers, we generally offer advisors wider choice in operating their businesses with regard to product offerings, outside business activities, office technology and supervisory models. Our approach may make it more challenging for us to comply with our supervisory and regulatory compliance obligations, particularly in light of our limited on-site supervision and the complexity of certain advisor business models. Misconduct and errors by our employees, advisors or Independent RIAs could be difficult for us to detect and could result in actual or alleged violations of law by us, investigations, litigation, regulatory sanctions, or serious reputational or financial harm. Although we have designed policies and procedures to comply with applicable laws, rules, regulations and interpretations, we cannot always prevent or detect misconduct and errors by our employees, advisors or Independent RIAs, and the precautions we take to prevent and detect these activities may not be effective in all cases. Prevention and detection among our advisors, who are typically not our direct employees and some of whom tend to be located in small, decentralized offices, present additional challenges, particularly in the case of complex products or supervision of outside business activities, including those conducted through Independent RIAs. In addition, although we provide our advisors with requirements and recommendations for their office technology, we cannot fully control or monitor the extent of their implementation of our requirements and recommendations. Accordingly, we cannot assure that our advisors' technology meets our standards, including with regard to information security and cybersecurity. We also cannot assure that misconduct or errors by our employees, advisors or Independent RIAs will not lead to a material adverse effect on our business, or that our insurance will be available or sufficient to cover the cost to our business of such misconduct or errors.

We cannot be certain that our systems and networks will not be subject to successful attacks, despite the measures we have taken and may take in the future to address and mitigate cybersecurity, privacy and technology risks. Additionally, in the course of operations, we rely upon the technology systems of, and share sensitive proprietary information and personal data with, vendors, third parties and other financial institutions, and our off-shore subsidiary, some of which may store and process data off-shore. Storing data off-shore can lead to increased cybersecurity risks, as international jurisdictions have varying cybersecurity laws, regulations and practices which can result in lower security standards. Additionally, data being stored off-shore can mean that we and the third parties have reduced visibility and control over the security of the data. Transfers of personal data internationally can also trigger certain data protection legal requirements, including to ensure that safeguards are in place in relation to such transfers. We also rely upon software and data feeds from various third parties. Although we have a third-party risk management program and conduct due diligence regarding cybersecurity and data protection practices before integrating our systems or sharing sensitive data with third-party vendors, this due diligence may not uncover administrative, technical or electronic gaps or flaws in their processes or systems. In the past, we and third parties on whose systems we rely have experienced Security Events that have resulted in the temporary interruption of our operations, breach notification costs and reputational harm with regulators, current and potential advisors, and advisors' clients, and we may experience similar or more significant events in the future. Future Security Events involving individual and regulatory notifications could lead to litigation involving other financial institutions, class actions, regulatory investigations or other harm, both financial and reputational. Security Events within the financial services industry are increasing, and threat actors continue to find novel ways to attack technology platforms and services, including our information systems and those of our advisors and third-party vendors. The use of AI by malicious third parties may also increase the sophistication and effectiveness of cybersecurity attacks that we experience in the future. In light of the diversity of our advisors' security environments and the increasing sophistication of malicious actors, a Security Event could occur and persist for an extended period of time without detection. We expect that any investigation of a Security Event could take substantial amounts of time, and that there may be extensive delays before we obtain full and reliable information and otherwise resume normal operations. In some cases, circumstances of a Security Event may be such that complete and reliable information about its cause, scope and nature may not be available as we attempt to respond to it. During such time we would not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, all of which would further increase the costs and consequences of such a Security Event. These Security Events could involve operational disruptions, notification costs, ransom payments and reputational harm, investigations, litigation and fines with regulators, and increases in insurance premiums as well as litigation, financial disputes and reputational harm with current and potential advisors and advisors' clients.

Our business relies extensively on electronic data processing, storage and communications systems. In addition to better serving our advisors and their clients, the effective use of technology increases efficiency and enables firms like ours to reduce costs, support our regulatory compliance and reporting functions, and better serve advisors and their clients. Our continued success will depend, in part, upon our ability to continue to invest significant resources on our technology systems in order to: - successfully maintain and upgrade the capabilities and resiliency of our systems;- address the needs of our advisors and their clients by using technology to provide products and services that satisfy their demands while ensuring the security of the data involving those products and services;- use technology effectively and securely to support our regulatory compliance and reporting functions;- comply with the changing landscape of laws and regulations that govern protection of personally identifiable information; and - retain skilled information technology employees. Extraordinary trading volumes, malware, ransomware or attempts by hackers to introduce large volumes of fraudulent transactions into our systems, beyond reasonably foreseeable spikes in volumes, could cause our computer systems to operate at an unacceptably slow speed or even fail. Failure of our systems, which could result from these or other events beyond our control, or an inability or failure to effectively upgrade those systems, implement new technology-driven products or services, or implement adequate disaster recovery capabilities, could result in financial losses, unanticipated disruptions in our service, liability to our advisors or advisors' clients, compliance failures, regulatory sanctions and damage to our reputation. We continually update our technology platform with the goal of improving its reliability, resiliency, security and functionality, including in connection with regulatory requirements, acquisitions and strategic relationships. While we seek to implement these updates with no or limited interruption to our operations or the availability of our systems, we may not be successful and resulting interruptions could be widespread, lengthy, or both. Even if no interruption occurs, these updates may not result in the benefits to our systems that we contemplate. For example, we are upgrading our technology systems in connection with our current and future business development opportunities, acquisitions, investments and strategic relationships. These efforts involve a significant investment of financial and personnel resources and we cannot guarantee that these upgrades or the investments that support them will be completed successfully, on time or at all, or that they will not result in interruptions to the availability of our technology systems or business operations. More generally, our failure to upgrade our systems successfully could have a material adverse effect on our business, financial condition and results of operations, as well as our ability to achieve our growth objectives. For more information about risks related to upgrading our technology platform, see "Failure to maintain technological capabilities, flaws in existing technology, difficulties in upgrading our technology platform or the introduction of a competitive platform could have material adverse effect on our business" below. Our operations rely on the secure processing, storage and transmission of confidential and other proprietary information in our computer systems and networks, including personally identifiable information of advisors and their clients, as well as our employees. Although we take protective measures and endeavor to strengthen the security and resiliency of these systems, our computer systems, software and networks are vulnerable to information breaches, unauthorized access, human error, computer viruses, denial-of-service attacks, malicious code, spam attacks, phishing, ransomware or other forms of social engineering and other events that could impact the security, reliability, confidentiality, integrity and availability of our systems (collectively, "Security Events"). To the extent third parties, such as product sponsors and financial institutions, also retain similarly sensitive information about our advisors, their clients or our employees, their systems may face similar vulnerabilities that could result in Security Events for us. We are not able to protect against these Security Events completely given the rapid evolution of new vulnerabilities, the complex and distributed nature of our systems, our interdependence on the systems of other companies and the increased sophistication of potential attack vectors and methods against our systems. In particular, advisors work in a wide variety of environments, and although we require our advisors to maintain certain minimum security levels and adopt certain security procedures by policy, we cannot ensure the universal or consistent compliance with these policies across all of our advisors, or that our policy will be adequate to address the evolving threat environment. If one or more of these Security Events occur, they could jeopardize our own, our advisors' or their clients', or our counterparties' confidential and other proprietary information processed, stored in and transmitted through our computer systems and networks, or otherwise cause interruptions or malfunctions in our own, our advisors' or their clients', our counterparties', or third parties' operations. As a result, we could be subject to litigation, client loss, reputational harm, regulatory sanctions and financial losses that are either not insured or are not fully covered through any insurance we maintain. If any person, including any of our employees or advisors, negligently disregards or intentionally breaches our established controls with respect to confidential client data or other confidential information or non-public personal information, or otherwise mismanages or misappropriates that data or information, we could also be subject to significant monetary damages, regulatory enforcement actions, fines and/or criminal prosecution in one or more jurisdictions. We currently, and may in the future use, develop and incorporate systems and tools that leverage artificial intelligence and other machine learning and large language models, including generative artificial intelligence (collectively, "AI"), within our technology platform and services. The use of AI could exacerbate existing risks or create new and unpredictable risks to our business, which could impact the markets in which we operate or subject us to increased competition and regulation. The development, adoption and application of AI technologies are still in their early stages, and ineffective or inadequate AI governance, development or deployment practices by us or by third-party developers or vendors could result in unintended consequences, and may not yield the benefits, insights and efficiencies that we or others anticipate. For example, AI algorithms that we use may be flawed or may be based on datasets that are biased or insufficient and could produce inaccurate, incomplete, or ineffective results, any of which could result in operational and reputational harm. While we aim to develop and use AI responsibly and attempt to identify and mitigate technological, ethical and legal issues presented by its use, we may be unsuccessful in identifying or resolving such issues before they arise. Any latency, disruption, or failure in our AI and related systems or infrastructure could result in delays or errors in our products and services that rely on AI. Developing, testing, and deploying resource-intensive AI systems may require additional investment and increase our costs. There also may be real or perceived social harm, unfairness, or other outcomes that undermine public confidence in the use and deployment of AI. Further, our external third-party service providers may fail to use AI appropriately. Although we conduct diligence on our external service providers and, when appropriate, seek contractual protections from them to mitigate AI-related risks, we are not able to control how our advisors or external service providers develop, maintain or use their AI systems, nor do we have control over their use or disclosure of data with such AI systems, which can include material non-public information or personal identifiable information. Any of the foregoing may result in harm to our business, results of operations, or reputation. The legal and regulatory landscape surrounding AI is rapidly evolving and remains uncertain, including in the areas of intellectual property, cybersecurity, privacy and data protection, as well as consumer protection, competition and equal opportunity laws. For example, there is uncertainty around the validity and enforceability of intellectual property rights related to use, development and deployment of AI. Compliance with new or changing laws, regulations or industry standards relating to AI may impose significant operational costs and may limit our ability to use, develop, or deploy AI. Failure to appropriately respond to this evolving landscape may result in legal liability, regulatory action or brand and reputational harm.