KeyBank 2015 Annual Report Download - page 34

including persons who are involved with organized crime or who may be linked to terrorist organizations or
hostile foreign governments. Those same parties may also attempt to fraudulently induce employees, customers
or other users of our systems to disclose sensitive information in order to gain access to our data or that of our
customers or clients. Our security systems may not be able to protect our information systems from similar
attacks due to the rapid evolution and creation of sophisticated cyberattacks. We are also subject to the risk that
our employees may intercept and transmit unauthorized confidential or proprietary information. An interception,
misuse or mishandling of personal, confidential or proprietary information being sent to or received from a
customer or third party could result in legal liability, remediation costs, regulatory action, and reputational harm.
We rely on third parties to perform significant operational services for us.
Third parties perform significant operational services on our behalf. These third parties are subject to similar
risks as Key relating to cybersecurity, breakdowns or failures of their own systems or employees. One or more of
these third parties may experience a cybersecurity event or operational disruption and, if any such event does
occur, it may not be adequately addressed, either operationally or financially, by such third party. Certain of
these third parties may have limited indemnification obligations or may not have the financial capacity to satisfy
their indemnification obligations. Financial or operational difficulties of a third party could also impair our
operations if those difficulties interfere with such third party’s ability to serve us. Additionally, some of our
outsourcing arrangements are located overseas and, therefore, are subject to risks unique to the regions in which
they operate. If a critical third party is unable to meet our needs in a timely manner or if the services or products
provided by such third party are terminated or otherwise delayed and if we are not able to develop alternative
sources for these services and products quickly and cost-effectively, it could have a material adverse effect on
our business. Additionally, regulatory guidance adopted by federal banking regulators related to how banks
select, engage and manage their third parties affects the circumstances and conditions under which we work with
third parties and the cost of managing such relationships.
We are subject to claims and litigation.
From time to time, customers, vendors or other parties may make claims and take legal action against us. We
maintain reserves for certain claims when deemed appropriate based upon our assessment that a loss is probable,
estimable, and consistent with applicable accounting guidance. At any given time we have a variety of legal
actions asserted against us in various stages of litigation. Resolution of a legal action can often take years.
Whether any particular claims and legal actions are founded or unfounded, if such claims and legal actions are
not resolved in our favor, they may result in significant financial liability and adversely affect how the market
perceives us and our products and services as well as impact customer demand for those products and services.
We are also involved, from time to time, in other reviews, investigations and proceedings (both formal and
informal) by governmental and self-regulatory agencies regarding our business, including, among other things,
accounting and operational matters, certain of which may result in adverse judgments, settlements, fines,
penalties, injunctions or other relief. The number and risk of these investigations and proceedings has increased
in recent years with regard to many firms in the financial services industry due to legal changes to the consumer
protection laws provided for by the Dodd-Frank Act and the creation of the CFPB.
There have also been a number of highly publicized legal claims against financial institutions involving fraud or
misconduct by employees, and we run the risk that employee misconduct could occur. It is not always possible to
deter or prevent employee misconduct, and the precautions we take to prevent and detect this activity may not be
effective in all cases.
Our controls and procedures may fail or be circumvented, and our methods of reducing risk exposure may
not be effective.
We regularly review and update our internal controls, disclosure controls and procedures, and corporate
governance policies and procedures. We also maintain an ERM program designed to identify, measure, monitor,
report and analyze our risks. Any system of controls and any system to reduce risk exposure, however well
22