# POPULAR, INC. (BPOP) FY 2022 MD&A

Verbatim Item 7 Management's Discussion and Analysis from POPULAR, INC.'s 10-K for fiscal year 2022.

SEC filing source: https://www.sec.gov/Archives/edgar/data/763901/000119312523056454/d408943d10k.htm
Accession: 0001193125-23-056454
Filing date: 2023-03-01
Report date: 2022-12-31
Extracted from a substantive MD&A body after the formal Item 7 span was a TOC or reference stub.
Confidence: high

Company profile: /company/BPOP/
All MD&A years: /company/BPOP/mda/
Previous year: /company/BPOP/mda/fy2021/ (FY 2021)
Next year: /company/BPOP/mda/fy2023/ (FY 2023)

results of
 
operations

and
 
capital
 
position.
 
These
 
risks
 
could
 
cause
 
our
 
actual
 
results
 
to
 
differ
 
materially
 
from
 
our
 
historical
 
results
 
or
 
the
 
results

contemplated by the forward-looking statements contained in this report.

The risks described in
 
this report are not the
 
only risks we face. Additional
 
risks and uncertainties not currently
 
known by

us
 
or
 
that
 
we
 
currently
 
deem
 
to
 
be
 
immaterial,
 
or
 
that
 
are
 
generally
 
applicable
 
to
 
all
 
financial
 
institutions,
 
may
 
also
 
materially

adversely affect our business, financial condition, liquidity, results of operations or capital position.

ECONOMIC AND MARKET RISKS

Weakness in
 
the economy,
 
particularly in
 
Puerto Rico,
 
where a
 
significant portion
 
of our
 
business is
 
concentrated, has

adversely impacted us in the past and may adversely
 
impact us in the future.

We have been, and will continue to be, impacted by global and local
 
economic and market conditions, including weakness

in
 
the
 
economy,
 
disruptions
 
and
 
volatility
 
in
 
the
 
financial
 
markets,
 
inflation,
 
changing
 
monetary
 
and
 
fiscal
 
policies,
 
geopolitical

conflicts, consumer and changes
 
in business sentiment and
 
unemployment. A significant portion of
 
our business is concentrated in

Puerto Rico, which
 
accounted for approximately 79% of
 
our assets and 84%
 
of our deposits
 
as of December 31,
 
2022 and 82%
 
of

our
 
revenues
 
for
 
the
 
year
 
ended
 
December
 
31,
 
2022.
 
As
 
a
 
result,
 
our
 
financial
 
condition
 
and
 
results
 
of
 
operations
 
are
 
highly

dependent
 
on
 
the
 
general
 
trends
 
of
 
the
 
Puerto
 
Rico
 
economy
 
and
 
other
 
conditions
 
affecting
 
Puerto
 
Rico
 
consumers
 
and

businesses. The
 
concentration of
 
our operations
 
in Puerto
 
Rico exposes
 
us to
 
greater risks
 
than other
 
banking companies
 
with a

wider geographic base.

Puerto Rico
 
has faced significant
 
economic and fiscal
 
challenges in the
 
past, including a
 
severe recession that
 
began in

2007 and
 
persisted for
 
over a
 
decade and
 
an acute
 
fiscal crisis
 
that led
 
the Puerto
 
Rico government
 
to file
 
for a
 
form
 
of federal

bankruptcy protection
 
in 2017.
 
Puerto Rico’s
 
fiscal and
 
economic challenges
 
have in
 
the past
 
adversely affected
 
our customers,

resulting
 
in
 
higher
 
delinquencies,
 
charge-offs
 
and
 
increased
 
losses
 
for
 
us.
 
While
 
Puerto
 
Rico’s
 
economy
 
has
 
been
 
gradually

recovering
 
and
 
the
 
Puerto
 
Rico
 
government
 
has
 
recently
 
emerged from
 
bankruptcy,
 
Puerto
 
Rico
 
still
 
faces
 
economic
 
and
 
fiscal

challenges and could face additional economic or fiscal challenges in the
 
future, including as a result of weakness or volatility in
 
the

global economy
 
and financial
 
markets. A
 
weakening of
 
the Puerto
 
Rico economy
 
or other
 
adverse economic
 
conditions affecting

Puerto Rico
 
consumers and
 
businesses could
 
result in
 
decreased demand
 
for our
 
products or
 
services, deterioration
 
in the
 
credit

quality
 
of
 
our
 
customers,
 
higher delinquencies,
 
charge-offs
 
or
 
increased losses,
 
all
 
of
 
which
 
could adversely
 
affect
 
our
 
financial

condition and results of operations.

We are also exposed to risks related to the state of the local economies of the other markets in which we do business, such as New

York
 
and Florida,
 
and to
 
the state
 
of the
 
global and
 
U.S. economy
 
and financial
 
markets. Global
 
financial markets
 
have recently

experienced periods of
 
extraordinary disruption and volatility,
 
exacerbated by the
 
COVID-19 pandemic, the war
 
in Ukraine, supply-

chain disruptions, high levels of, and rapid increases in, inflation,
 
and increasing and high interest rates. Inflationary pressures have

increased certain
 
of our
 
expenses (including
 
our personnel
 
expenses) and
 
adversely affected
 
consumer sentiment.
 
Central bank

responses to inflationary pressures have led to
 
higher market interest rates and, in turn,
 
lower activity levels across U.S. and global

financial markets. These circumstances have resulted in, and could continue to
 
result in, reductions in the value of
 
our investments.

If
 
these
 
conditions
 
persist
 
or
 
worsen,
 
our
 
results
 
of
 
operations, financial
 
position
 
and
 
liquidity could
 
be
 
materially
 
and
 
adversely

affected.

Changes
 
in
 
interest
 
rates
 
and
 
credit
 
spreads
 
can
 
adversely
 
impact
 
our
 
financial
 
condition,
 
including
 
our
 
investment

portfolio,
 
since
 
a
 
significant
 
portion
 
of
 
our
 
business involves
 
borrowing
 
and
 
lending
 
money,
 
and
 
investing in
 
financial

instruments.

Our business
 
and financial
 
performance are
 
impacted by
 
market interest
 
rates and
 
movements in
 
those rates.
 
Since a

high percentage of our assets and liabilities are interest bearing or otherwise sensitive in value to changes in interest rates, changes

in interest rates, in the shape of the yield curve or in spreads between different types of rates, have had and could in the future have

24

a material impact on our results
 
of operations and the values of our
 
assets and liabilities, including our investment portfolio.
 
Interest

rates are
 
highly sensitive
 
to many
 
factors over
 
which we
 
have no
 
control and
 
which we
 
may not
 
be able
 
to anticipate
 
adequately,

including general
 
economic conditions
 
and the
 
monetary and
 
tax policies
 
of various
 
governmental bodies,
 
particularly the
 
Federal

Reserve Board.

Increasing levels of inflation, driven
 
by pent-up demand and supply-chain disruptions caused
 
by the COVID-19 pandemic

and the war in Ukraine, led the Federal Reserve Board to execute a series of sharp benchmark interest rate increases over the past

year.
 
While the
 
pace at
 
which inflation
 
is increasing
 
has slowed
 
down in
 
recent months,
 
following a
 
mid-2022 peak,
 
the Federal

Reserve Board has signaled
 
that it may increase
 
interest rates further to
 
continue to control and
 
bring down inflation. If
 
the interest

rates we
 
pay on
 
our deposits and
 
other borrowings increase
 
at a
 
faster rate than
 
the interest rates
 
we receive on
 
loans and
 
other

investments, our net interest income, and, therefore, our earnings, could be adversely affected. Higher interest rates could also lead

to fewer originations of commercial and residential real
 
estate loans, loss of deposits, a misalignment in the
 
pricing of short-term and

long-term
 
borrowings,
 
less
 
liquidity
 
in
 
the
 
financial
 
markets
 
and
 
higher
 
funding
 
costs.
 
Furthermore,
 
higher
 
interest
 
rates
 
could

negatively affect
 
the payment
 
performance on
 
loans linked
 
to variable
 
interest rates
 
to the
 
extent borrowers
 
are unable
 
to afford

higher
 
interest
 
payments, which
 
could
 
result
 
in
 
higher
 
delinquencies. Additionally,
 
inflationary
 
pressure arising
 
from
 
increases in

interest rates may also affect borrowers’ financial condition and their ability to pay their debts when due. All of these outcomes could

adversely affect our earnings, liquidity and capital levels.

The
 
rapid
 
rise
 
in
 
interest
 
rates
 
in
 
2022
 
resulted
 
in
 
approximately
 
$2.5
 
billion
 
in
 
unrealized
 
mark-to-market
 
losses
 
on

available-for-sale securities held in our investment securities portfolio. In October 2022, we transferred U.S. Treasury securities with

a fair value of approximately $6.5 billion (par value of
 
$7.4 billion), and with accumulated unrealized losses of $873 million, from our

available-for-sale portfolio to our held-to-maturity portfolio to reduce the
 
impact of further increases in interest rates on
 
accumulated

other comprehensive
 
income and
 
tangible capital.
 
However,
 
if interest
 
rates continue
 
to rise
 
rapidly or
 
for a
 
prolonged period,
 
we

may accumulate significant additional mark-to-market losses
 
on other investment securities in
 
our available-for-sale portfolio, which

may adversely affect our tangible capital and impact our
 
ability to return capital to our stockholders.

We are
 
also subject
 
to risks
 
related to
 
the transition
 
away from
 
the London
 
Interbank Offered
 
Rate (“LIBOR”)
 
upon the

cessation in
 
the publication
 
of the
 
remaining principal
 
tenors of
 
U.S. dollar
 
LIBOR, which
 
is scheduled
 
for June
 
30, 2023. These

risks were significantly reduced following the enactment by the U.S.
 
Congress of the Adjustable Interest Rate (LIBOR) Act in the first

quarter
 
of
 
2022,
 
which
 
provides
 
a
 
framework
 
for
 
replacing
 
LIBOR
 
with
 
new
 
benchmark
 
rates
 
based
 
on
 
the
 
Secured
 
Overnight

Financing Rate (“SOFR”)
 
in loans that
 
do not have
 
effective alternate interest
 
rate provisions. However,
 
there is no
 
assurance that

the new SOFR-based benchmarks will be similar to,
 
or produce the economic equivalent of, LIBOR, and the
 
transition to these new

benchmark rates could result in operational, systems or
 
other practical challenges, litigation or
 
other adverse consequences.

For a discussion of the Corporation’s
 
interest rate sensitivity, please refer
 
to the “Risk Management” section of the MD&A

in this Form 10-K.

Fiscal challenges facing the U.S. government could negatively impact financial markets, which in turn could have

an adverse effect on our financial position or
 
results of operations.

In
 
January
 
2023,
 
the
 
outstanding
 
debt
 
of
 
the
 
U.S.
 
reached
 
its
 
statutory
 
limit
 
and
 
the
 
U.S.
 
Treasury
 
Department

commenced taking
 
extraordinary measures
 
to
 
prevent the
 
U.S. from
 
defaulting on
 
its obligations.
 
If Congress
 
does not
 
raise the

debt
 
ceiling,
 
the
 
U.S.
 
could
 
default
 
on
 
its
 
obligations,
 
including
 
U.S.
 
Treasury
 
securities,
 
which
 
play
 
an
 
integral
 
role
 
in
 
financial

markets. Many
 
of the
 
investment securities
 
held in
 
our portfolio
 
are issued
 
by the
 
U.S. government
 
and government
 
agencies. A

U.S.
 
government
 
debt
 
default,
 
threatened
 
debt
 
default
 
or
 
downgrade
 
of
 
the
 
sovereign
 
credit
 
ratings
 
of
 
the
 
U.S.
 
by
 
credit
 
rating

agencies
 
could
 
have
 
a
 
significant
 
adverse
 
impact
 
on
 
market
 
volatility
 
and
 
illiquidity,
 
lead
 
to
 
further
 
increases
 
in
 
interest
 
rates,

heighten
 
operational
 
risks
 
relating
 
to
 
the
 
clearance
 
and
 
settlement
 
of
 
transactions,
 
and
 
result
 
in
 
a
 
significant
 
deterioration
 
in

economic conditions in
 
the U.S. and
 
worldwide. Even if
 
the U.S. does
 
not default, continued
 
uncertainty relating to
 
the debt ceiling

could
 
result in
 
downgrades of
 
the U.S.
 
credit
 
rating, which
 
could adversely
 
affect
 
market conditions,
 
lead
 
to
 
further increases
 
in

interest rates
 
and borrowing
 
costs or
 
necessitate significant
 
operational changes
 
among market
 
participants if
 
the liquidity
 
or fair

value of U.S. Treasury and/or agency securities decreases. Further, the fair value, liquidity and credit ratings of securities issued by,

or other obligations of, agencies of the U.S.
 
government as well as municipal bonds could be
 
similarly adversely affected.

BUSINESS RISKS

Negative
 
changes
 
in
 
the
 
financial
 
condition
 
of
 
our
 
clients
 
have
 
adversely
 
impacted
 
us
 
in
 
the
 
past
 
and
 
may
 
adversely

impact us in the future.

25

A significant portion of
 
our business involves lending money,
 
which exposes us to
 
credit risk and
 
risk of loss if
 
borrowers

do
 
not
 
repay
 
their
 
loans,
 
leases, credit
 
cards
 
or
 
other
 
credit
 
obligations.
 
The
 
performance of
 
these
 
credit
 
portfolios
 
significantly

affects our
 
financial condition
 
and results
 
of operations.
 
We have
 
in the
 
past been
 
adversely affected
 
by negative
 
changes in
 
the

financial condition of our clients due to weakness in
 
the Puerto Rico and U.S. economy. If the current economic environment were to

deteriorate, more customers may have difficulty in repaying their credit obligations, which may result in higher levels
 
of credit losses

and reserves for credit losses.

We are exposed to
 
increased credit risks and credit losses
 
to the extent our clients are
 
concentrated by industry segment

or type of client.

Our credit risk and credit
 
losses can increase to the extent
 
our loans are concentrated in borrowers engaged in
 
the same

or similar
 
activities or
 
in borrowers
 
who as
 
a group
 
may be
 
uniquely or
 
disproportionately affected
 
by certain
 
economic or
 
market

conditions. We have significant
 
exposure to borrowers in certain
 
economic sectors, such as residential
 
and commercial real estate,

hospitality and healthcare. Challenging economic or market conditions that affect
 
the industries or types of clients to
 
which we have

significant exposure could result in higher credit
 
losses and adversely affect our financial condition
 
and results of operations.

We also
 
have direct
 
lending and
 
investment exposure
 
to Puerto
 
Rico government
 
entities, which
 
have faced
 
significant

fiscal challenges.
 
At December
 
31, 2022,
 
our exposure
 
to the
 
Puerto Rico
 
government consisted
 
of $374
 
million in
 
direct lending

exposure to Puerto
 
Rico municipalities and
 
$251 million in
 
loans insured or
 
securities issued by
 
Puerto Rico governmental
 
entities

but for
 
which the
 
principal source
 
of repayment
 
is non-governmental.
 
We also
 
have indirect
 
lending exposure
 
to the
 
Puerto Rico

government in the
 
form of loans
 
to private borrowers
 
who are service
 
providers, lessors, suppliers
 
or have other
 
relationships with

the Puerto Rico government. While the overall fiscal situation
 
of the Puerto Rico government has improved in recent years,
 
including

as
 
result
 
of
 
the
 
government
 
and
 
certain
 
of
 
its
 
instrumentalities
 
having
 
restructured
 
their
 
debt
 
obligations,
 
some
 
Puerto
 
Rico

government entities, including certain municipalities, still face significant
 
fiscal challenges. A deterioration in the fiscal situation of
 
the

Puerto Rico
 
government and its
 
instrumentalities, and in
 
particular in the
 
fiscal situation
 
of the
 
Puerto Rico
 
municipalities to
 
which

we have direct lending exposure, could result in
 
higher credit losses and reserves for credit losses. For
 
a discussion of risks related

to the Corporation’s credit exposure to the Puerto Rico
 
and USVI governments, see the Geographic and
 
Government Risk section in

the MD&A section of this Form 10-K.

Deterioration in the
 
values of real
 
properties securing our commercial, mortgage
 
loan and construction portfolios
 
have in

the past resulted, and may in the future result,
 
in increased credit losses and harm our results
 
of operations.

As of
 
December 31,
 
2022, approximately
 
56% of
 
our loan
 
portfolio consisted
 
of loans
 
secured by
 
real estate
 
collateral

(comprised of 29% in commercial loans, 25% in residential
 
mortgage loans and 2% in construction loans).
 
The value of the collateral

securing such loans is dependent upon economic conditions in the area in which the collateral is located. Weakness in the economy

of some of the
 
markets we serve has in
 
the past resulted in significant
 
declines in the value of
 
the real properties securing our loan

portfolio, leading to increased credit losses. If the value of
 
the real estate properties securing our loan portfolio declines again in the

future, we may be
 
required to increase our
 
provisions for loan losses
 
and allowance for loan
 
losses. Any such increase could
 
have

an adverse effect on
 
our financial condition and results of
 
operations. For more information on the credit
 
quality of our construction,

commercial and mortgage portfolio, see the Credit Risk
 
section of the MD&A included in this Form
 
10-K.

We
 
are
 
exposed
 
to
 
credit
 
risk
 
from
 
mortgage
 
loans
 
that
 
have
 
been
 
sold
 
or
 
are
 
being
 
serviced
 
subject
 
to
 
recourse

arrangements.

Popular
 
is
 
generally
 
at
 
risk
 
for
 
mortgage
 
loan
 
defaults
 
from
 
the
 
time
 
it
 
funds
 
a
 
loan
 
until
 
the
 
time
 
the
 
loan
 
is
 
sold
 
or

securitized into a
 
mortgage

-

backed security.
 
However, we
 
have retained part
 
of the credit
 
risk on sales
 
of mortgage loans
 
through

recourse
 
arrangements,
 
and
 
we
 
also
 
service
 
certain
 
mortgage
 
loan
 
portfolios
 
with
 
recourse.
 
At
 
December
 
31,
 
2022,
 
we
 
were

exposed to credit risk with respect to $0.6 billion in residential mortgage loans sold
 
or serviced subject to credit recourse provisions,

consisting principally of loans associated with the Fannie Mae and
 
Freddie Mac programs. Pursuant to such recourse provisions,
 
we

are required to repurchase the loan or reimburse the third-party investor for the incurred loss in the event of a customer default. The

maximum potential amount of future payments that
 
we would be required to make
 
under the recourse arrangements in the
 
event of

nonperformance
 
by
 
the
 
borrowers
 
is
 
equivalent
 
to
 
the
 
total
 
outstanding balance
 
of
 
the
 
residential mortgage
 
loans
 
serviced
 
with

recourse
 
and
 
interest,
 
if
 
applicable. In
 
the
 
event of
 
nonperformance by
 
the
 
borrower,
 
we
 
have rights
 
to
 
the underlying
 
collateral

securing the
 
mortgage loan.
 
During 2022,
 
we repurchased
 
approximately $7
 
million in
 
mortgage loans
 
subject to
 
credit recourse

provisions. As
 
of December
 
31, 2022,
 
our liability
 
established
 
to cover
 
the estimated
 
credit loss
 
exposure related
 
to loans
 
sold or

serviced with credit recourse amounted
 
to $7 million. We may suffer losses on these loans if the proceeds from a foreclosure sale of

26

the property underlying
 
a defaulted mortgage
 
loan are less
 
than the outstanding
 
principal balance of
 
the loan plus
 
any uncollected

interest advanced and the costs of holding and disposing of
 
the related property.

Defective and repurchased

loans may harm our business and financial
 
condition.

In
 
connection
 
with
 
the
 
sale
 
and
 
securitization
 
of
 
mortgage
 
loans,
 
we
 
are
 
required
 
to
 
make
 
a
 
variety
 
of
 
customary

representations
 
and
 
warranties regarding
 
Popular
 
and
 
the
 
loans being
 
sold
 
or securitized.
 
Our
 
obligations with
 
respect to
 
these

representations and warranties are generally outstanding for the life
 
of the loan, and they relate
 
to, among other things, compliance

with
 
laws
 
and
 
regulations,
 
underwriting
 
standards,
 
the
 
accuracy
 
of
 
information
 
in
 
the
 
loan
 
documents
 
and
 
loan
 
file
 
and
 
the

characteristics
 
and
 
enforceability of
 
the
 
loan.
 
A
 
loan
 
that
 
does
 
not
 
comply
 
with
 
the
 
secondary
 
market’s
 
requirements
 
may
 
take

longer to
 
sell, impact
 
our ability
 
to securitize
 
the loans
 
or pledge
 
the loans
 
as collateral
 
for borrowings,
 
or be
 
unsalable or
 
salable

only
 
at
 
a
 
significant
 
discount.
 
Moreover,
 
if
 
any
 
such
 
loan
 
is
 
sold
 
before
 
we
 
detect
 
non-compliance,
 
we
 
may
 
be
 
obligated
 
to

repurchase the loan and bear any associated loss directly,
 
or we may be obligated to indemnify the purchaser against any loss.
 
We

seek to
 
minimize repurchases and
 
losses from defective
 
loans by correcting
 
flaws, if possible,
 
and selling or
 
re-selling such loans.

However,
 
if
 
we
 
were
 
to
 
suffer
 
significant
 
losses
 
from
 
defective
 
and
 
repurchased
 
loans,
 
our
 
results
 
of
 
operations
 
and
 
financial

condition could be materially impacted.

If we are
 
unable to maintain
 
or grow our
 
deposits, we may
 
be subject to
 
paying higher funding costs
 
and our net
 
interest

income may decrease.

We must maintain adequate liquidity and funding sources
 
to support our operations, comply with our financial
 
obligations,

finance our transformation initiative, fund
 
planned capital distributions and meet
 
regulatory requirements. We rely
 
primarily on bank

deposits
 
as
 
a
 
low cost
 
and stable
 
source
 
of
 
funding
 
for
 
our
 
lending activities
 
and
 
the
 
operation of
 
our
 
business.
 
Therefore,
 
our

funding costs
 
are largely
 
dependent on
 
our ability
 
to maintain
 
and grow
 
our deposits.
 
As our
 
competitors have
 
raised the
 
interest

rates they pay on deposits, our
 
funding costs have increased, as we have
 
needed to increase the rates we pay
 
to our depositors to

avoid losing
 
deposits. We
 
may also
 
need to
 
rely on
 
more expensive
 
sources of
 
funding if
 
deposits decrease. Rising
 
interest rates

have
 
also
 
led
 
customers
 
to
 
move
 
their
 
funds
 
to
 
alternative
 
investments
 
that
 
pay
 
higher
 
interest
 
rates.
 
Furthermore,
 
we
 
have
 
a

significant
 
amount
 
of
 
deposits
 
from
 
the
 
Puerto
 
Rico
 
government,
 
its
 
instrumentalities
 
and
 
municipalities
 
($15.2
 
billion,
 
or

approximately 25% of our
 
total deposits, as of
 
December 31, 2022), and
 
the amount of these
 
deposits may fluctuate depending on

the financial
 
condition and
 
liquidity of
 
these entities,
 
as well
 
as
 
on our
 
ability to
 
maintain these
 
customer relationships.
 
If we
 
are

unable to
 
maintain or
 
grow our
 
deposits for
 
any
 
reason, we
 
may be
 
subject to
 
paying higher
 
funding costs
 
and
 
our
 
net interest

income may decrease.

OPERATIONAL RISKS

We
 
and our
 
third-party providers
 
have been,
 
and expect
 
in the
 
future to
 
continue to
 
be, subject
 
to cyber
 
attacks, which

could cause substantial harm and have an adverse
 
effect on our business and results of operations.

Information security risks for large financial institutions such as Popular have increased significantly in recent years in part

because
 
of
 
the
 
proliferation
 
of
 
new
 
technologies,
 
such
 
as
 
Internet
 
and
 
mobile
 
banking
 
to
 
conduct
 
instant
 
financial
 
transactions

anywhere globally,
 
growing geo-political threats,
 
such as the
 
ongoing Russian conflict
 
in Ukraine, and
 
the increased sophistication

and activities of organized crime, hackers,
 
terrorists, nation-states, hacktivists and other parties. In
 
the ordinary course of business,

we rely on
 
electronic communications and
 
information systems to
 
conduct our operations
 
and to transmit
 
and store sensitive
 
data.

We employ
 
a layered
 
defensive approach
 
that employs
 
people, processes
 
and technology
 
to manage
 
and maintain
 
cybersecurity

controls through a variety of preventative and detective tools that monitor, block, and provide alerts regarding suspicious activity
 
and

identify suspected advanced persistent threats. Notwithstanding our defensive measures and the significant resources we devote to

protect the security of our systems, there is no assurance that all of our security measures will be effective at all times, especially as

the threats from cyber-attacks
 
are continuous and severe. The
 
risk of a
 
security breach due to
 
a cyber attack could
 
increase in the

future as
 
we continue
 
to expand
 
our mobile
 
banking and
 
other internet
 
based product
 
offerings, the
 
use
 
of the
 
cloud for
 
system

development and hosting and internal use of
 
internet-based products and applications.

We
 
continue to
 
detect and
 
identify attacks
 
that are
 
becoming more
 
sophisticated and
 
increasing in
 
volume, as
 
well as

attackers that
 
respond rapidly to
 
changes in
 
defensive countermeasures. The
 
most significant cyber-attack
 
risks that we
 
may face

are e-fraud, denial-of-service (DDoS), ransomware,
 
computer intrusion and the
 
exploitation of software zero-day
 
vulnerabilities that

might result
 
in disruption
 
of services
 
and in
 
the exposure
 
or loss
 
of customer
 
or proprietary
 
data. Loss
 
from e-fraud
 
occurs when

cybercriminals compromise
 
our systems
 
or the
 
systems of
 
our customers
 
and extract
 
funds from
 
customer’s credit
 
cards or
 
bank

accounts, including through
 
brute force, password
 
spraying and credential
 
stuffing attacks directed
 
at gaining unauthorized
 
access

to
 
individual
 
accounts.
 
Denial-of-service
 
attacks
 
intentionally
 
disrupt
 
the
 
ability
 
of
 
legitimate
 
users,
 
including
 
customers
 
and

27

employees,
 
to
 
access
 
networks,
 
websites
 
and
 
online
 
resources.
 
Computer
 
intrusion
 
attempts
 
either
 
direct
 
or
 
through
 
social

engineering, supply chain compromise, email, text or voice messages, including
 
using brand impersonation (regularly referred to as

phishing, vishing and smishing), might
 
result in the compromise
 
of sensitive customer data,
 
such as account numbers,
 
credit cards

and social security numbers, and could present
 
significant reputational, legal and regulatory costs
 
to Popular if successful.

We are
 
the target of
 
phishing, smishing and vishing
 
attacks targeting both
 
our customers and
 
employees through brand,

email, text and
 
voicemail impersonation, that
 
have compromised the
 
email accounts of
 
certain of our
 
customers and employees
 
or

have
 
resulted
 
in
 
our
 
customers
 
being
 
deceived
 
into
 
revealing
 
their
 
sensitive
 
information
 
to
 
threat
 
actors.
 
There
 
can
 
be
 
no

assurances that there will not be further compromises of sensitive customer information in the future. Our customer-facing platforms

are
 
also
 
routinely
 
attacked
 
by
 
threat
 
actors
 
aiming
 
to
 
gain
 
unauthorized
 
access
 
to
 
our
 
clients’
 
accounts.
 
Popular
 
has
 
recently

implemented certain defensive measures in response to
 
brute force attacks on one
 
of our platforms which
 
resulted in certain of our

customers
 
log-in
 
credentials
 
and
 
information
 
being
 
exposed.
 
As
 
a
 
result,
 
Popular
 
notified,
 
as
 
required
 
or
 
otherwise
 
deemed

appropriate, customers
 
identified as
 
affected by
 
the incident.
 
We have
 
to date
 
not experienced
 
material losses
 
in connection
 
with

these
 
attacks.
 
Cyber-security
 
risks
 
have
 
also
 
been
 
recently
 
exacerbated
 
by
 
the
 
discovery
 
of
 
zero-day
 
vulnerabilities
 
in
 
widely

distributed
 
third
 
party
 
software,
 
such
 
as
 
the
 
vulnerability
 
identified
 
in
 
December
 
2021
 
in
 
the
 
Apache
 
log4j,
 
which
 
could
 
affect

Popular’s or any of its service provider’s
 
systems.

The
 
increased
 
use
 
of
 
remote
 
access
 
and
 
third-party
 
video
 
conferencing
 
solutions
 
to
 
enable
 
work-from-home

arrangements for
 
employees
 
and
 
facilitating the
 
use
 
of
 
digital channels
 
by
 
our
 
customers,
 
has
 
increased
 
our
 
exposure to
 
cyber

attacks. In
 
addition, a
 
third party
 
could misappropriate
 
confidential information
 
obtained by
 
intercepting signals
 
or communications

from mobile devices used by Popular’s customers or employees. Recent events, including the Russian conflict in Ukraine, have also

illustrated
 
increased geo-political
 
factors
 
and the
 
risks related
 
to
 
supply-chain compromises
 
and
 
de-stabilizing activities
 
linked to

nation-state sponsored activity as an increasing trend
 
to monitor actively.
 
Risks and exposures related to cyber security
 
attacks are

expected to
 
remain high for
 
the foreseeable future
 
due to
 
the rapidly evolving
 
nature and sophistication
 
of these
 
threats, including

the rise in the use of cyber-attacks as geopolitical weapons. Although we are
 
regularly targeted by unauthorized threat-actor activity,

we have not, to date, experienced any material
 
losses as a result of any cyber-attacks.

A material compromise or circumvention of the security of our systems could
 
have serious negative consequences for us,

including
 
significant
 
disruption
 
of
 
our
 
operations
 
and
 
those
 
of
 
our
 
clients,
 
customers
 
and
 
counterparties,
 
misappropriation
 
of

confidential information
 
of us
 
or that
 
of our
 
clients, customers,
 
counterparties or
 
employees, or
 
damage to
 
computers or
 
systems

used
 
by
 
us
 
or
 
by
 
our
 
clients,
 
customers
 
and
 
counterparties,
 
and
 
could
 
result
 
in
 
violations
 
of
 
applicable
 
privacy
 
and
 
other
 
laws,

financial loss
 
to us
 
or to
 
our customers,
 
loss of
 
confidence in
 
our security
 
measures, customer
 
dissatisfaction, significant litigation

exposure and harm to
 
our reputation, all of
 
which could have a
 
material adverse effect
 
on us. For example,
 
if personal, non-public,

confidential
 
or
 
proprietary
 
information
 
in
 
our
 
possession
 
were
 
to
 
be
 
mishandled,
 
misused
 
or
 
stolen,
 
we
 
could
 
suffer
 
significant

regulatory consequences, reputational damage
 
and financial loss.
 
Such mishandling, misuse
 
or misappropriation could include,
 
for

example, if such information
 
were provided to parties
 
who are not permitted
 
to have the
 
information, either by fault
 
of our systems,

by our employees
 
or counterparties, or
 
where such information
 
is intercepted or
 
otherwise inappropriately taken by
 
our employees

or third parties.

The
 
extent
 
of
 
a
 
particular
 
cyber
 
attack
 
and
 
the
 
steps
 
that
 
we
 
may
 
need
 
to
 
take
 
to
 
investigate the
 
attack
 
may
 
not
 
be

immediately
 
clear,
 
and
 
it
 
may
 
take
 
a
 
significant
 
amount
 
of
 
time
 
before
 
such
 
an
 
investigation
 
can
 
be
 
completed.
 
While
 
such
 
an

investigation is ongoing, Popular may not necessarily know the full
 
extent of the harm caused by the cyber
 
attack, and that damage

may continue to spread.
 
These factors may inhibit
 
our ability to provide
 
rapid, full and reliable
 
information about the cyber
 
attack to

our clients,
 
customers, counterparties and
 
regulators, as well
 
as the public.
 
Moreover, potential
 
new regulations may
 
require us to

disclose information about
 
a cybersecurity event before
 
it has been
 
resolved or fully
 
investigated. Furthermore, it may
 
not be clear

how best to contain and remediate the potential harm caused by the cyber attack, and certain errors or actions could be repeated or

compounded before they are discovered and remediated. Cyber attacks could cause interruptions in our operations and result in the

incurrence
 
of
 
significant
 
costs,
 
including those
 
related
 
to
 
forensic analysis
 
and
 
legal counsel,
 
each of
 
which may
 
be
 
required to

ascertain the extent
 
of any potential
 
harm to our
 
customers, or employees, or
 
damage to our information
 
systems and any
 
legal or

regulatory obligations that
 
may result therefrom.
 
Any cyber incidents
 
could also result
 
in, among other
 
things, increased regulatory

scrutiny
 
and adverse
 
regulatory or
 
civil
 
litigation consequences.
 
For a
 
discussion of
 
the guidance
 
and rules
 
that federal
 
banking

regulators
 
have
 
released
 
or
 
proposed
 
regarding
 
cybersecurity
 
and
 
cyber
 
risk
 
management
 
standards,
 
see
 
“Regulation
 
and

Supervision” in
 
Part
 
I,
 
Item
 
1 —
 
Business,
 
included in
 
the
 
Form 10-K
 
for the
 
year
 
ended December
 
31,
 
2022. Any
 
or
 
all
 
of
 
the

foregoing factors could further increase the impact
 
of the incident and thereby the costs and consequences
 
of a cyber attack.

We also
 
rely on
 
third parties
 
for the
 
performance of
 
a significant
 
portion of
 
our information
 
technology functions and
 
the

28

provision of information security,
 
technology and business process services. As a result, a
 
successful compromise or circumvention

of
 
the security
 
of
 
the systems
 
of these
 
third-party service
 
providers could
 
have serious
 
negative consequences
 
for us,
 
including

misappropriation of
 
confidential information
 
of us
 
or that
 
of our
 
clients, customers,
 
counterparties or
 
employees, or
 
other negative

implications identified above with respect to a cyber-attack on our systems, which could have a material adverse effect on us. Cyber

attacks at third-party service
 
providers are also becoming
 
increasingly common, and, as
 
a result, cybersecurity risks
 
relating to our

vendors have
 
increased. The most
 
important of
 
these third-party service
 
providers for us
 
is Evertec, and
 
certain risks
 
particular to

Evertec are
 
discussed under
 
“Operational Risks
 
— We
 
are subject
 
to additional
 
risks relating
 
to the
 
Evertec Business
 
Acquisition

Transaction”. During 2021, we
 
determined that, as a result
 
of the widely reported breach of
 
Accellion, Inc.’s File Transfer
 
Appliance

tool, which
 
was being
 
used at
 
the time
 
of such
 
breach by
 
a U.S.-based
 
third-party advisory
 
services vendor
 
of Popular,
 
personal

information
 
of
 
certain
 
Popular
 
customers
 
was
 
compromised.
 
As
 
a
 
result,
 
Popular
 
notified,
 
as
 
required
 
or
 
otherwise
 
deemed

appropriate, customers identified as affected by the incident. Although we are not aware of fraudulent activity
 
in connection with this

incident,
 
Popular’s
 
networks
 
and
 
systems
 
were
 
not
 
impacted,
 
and
 
our
 
third-party
 
service
 
provider
 
agreed
 
to
 
cover
 
external

remediation costs associated with the incident. A compromise of the personal information of our
 
customers maintained by third party

vendors
 
could
 
result
 
in
 
significant
 
regulatory
 
consequences,
 
reputational
 
damage
 
and
 
financial
 
loss
 
to
 
us.
 
The
 
success
 
of
 
our

business depends
 
in part
 
on the
 
continuing ability
 
of these
 
(and other)
 
third parties
 
to perform
 
these functions
 
and services
 
in a

timely
 
and
 
satisfactory
 
manner,
 
which
 
performance
 
could
 
be
 
disrupted
 
or
 
otherwise
 
adversely
 
affected
 
due
 
to
 
failures
 
or
 
other

information security
 
events originating at
 
the third
 
parties or at
 
the third parties’
 
suppliers or vendors
 
(so-called “fourth party
 
risk”).

We
 
may
 
not
 
be
 
able
 
to
 
effectively
 
directly
 
monitor
 
or
 
mitigate
 
fourth-party
 
risk,
 
in
 
particular
 
as
 
it
 
relates
 
to
 
the
 
use
 
of
 
common

suppliers
 
or
 
vendors
 
by
 
the
 
third
 
parties that
 
perform
 
functions
 
and
 
services
 
for
 
us.
 
For
 
a
 
discussion of
 
the
 
risks
 
related
 
to
 
our

dependence
 
on
 
third
 
parties,
 
including
 
Evertec,
 
see
 
“We
 
rely
 
on
 
other
 
companies
 
to
 
provide
 
key
 
components
 
of
 
our
 
business

infrastructure, including certain of our core
 
financial transaction processing and information technology and
 
security services, which

exposes us to a number of operational risks that could have a material
 
adverse effect on us” in the Operational Risks section of Item

1A in this Form 10-K.

As
 
cyber
 
threats
 
continue
 
to
 
evolve,
 
we
 
expect
 
to
 
expend
 
significant
 
additional
 
resources
 
to
 
continue
 
to
 
modify
 
or

enhance our
 
layers of
 
defense or
 
to investigate
 
and remediate
 
additional information
 
security vulnerabilities
 
or incidents.
 
System

enhancements and
 
updates also
 
create risks
 
associated with
 
implementing new
 
systems and
 
integrating them
 
with existing
 
ones,

including risks associated with supply chain compromises
 
and the software development lifecycle of the
 
systems used by us and our

service providers. Due
 
to the complexity
 
and interconnectedness of information
 
technology systems, the
 
process of enhancing
 
our

layers
 
of
 
defense can
 
itself
 
create
 
a
 
risk
 
of
 
systems
 
disruptions
 
and
 
security
 
issues.
 
In
 
addition,
 
addressing
 
certain
 
information

security vulnerabilities, such as
 
hardware-based vulnerabilities, may affect
 
the performance of our
 
information technology systems.

The ability of our
 
hardware and software providers to deliver
 
patches and updates to mitigate vulnerabilities
 
in a timely manner
 
can

introduce additional risks, particularly when a vulnerability
 
is being actively exploited by threat
 
actors. Moreover, our ability
 
to timely

mitigate
 
vulnerabilities
 
and
 
manage
 
such
 
risks,
 
given
 
the
 
rise
 
in
 
number
 
of
 
required
 
patches
 
and
 
third-party
 
software,
 
including

“zero-day
 
vulnerabilities”,
 
as
 
well
 
as
 
the
 
obsolescence
 
in
 
some
 
of
 
our
 
hardware
 
and
 
software,
 
may
 
impact
 
our
 
day-to-day

operations, the availability of our systems and
 
delay the deployment of technology enhancements
 
and innovation.

If Popular’s operational systems,
 
or those of
 
external parties on which
 
Popular’s businesses depend, are
 
unable to meet

the requirements of our
 
businesses and operations or bank
 
regulatory standards, or if they
 
fail, have other significant
 
shortcomings

or are impacted by cyber attacks, Popular could be
 
materially and adversely affected.

Unforeseen or
 
catastrophic events,
 
including
 
extreme weather
 
events and
 
other natural
 
disasters, man-made
 
disasters,

acts of violence or
 
war, or the
 
emergence of pandemics or epidemics, could
 
cause a disruption in our
 
operations or other

consequences that could have a material adverse
 
effect on our financial condition and results
 
of operations.

A
 
significant
 
portion
 
of
 
our
 
operations
 
are
 
located
 
in
 
the
 
Caribbean
 
and
 
Florida,
 
a
 
region
 
susceptible
 
to
 
hurricanes,

earthquakes and other
 
similar events. In
 
2017, Puerto Rico,
 
USVI and BVI
 
were severely impacted
 
by Hurricanes Irma
 
and María,

which resulted in significant disruption to our operations and adversely affected
 
our clients in these markets, and in 2022, Hurricane

Fiona impacted the
 
southwest area of
 
Puerto Rico,
 
adversely affecting our
 
customers in
 
that region. Other
 
types of
 
unforeseen or

catastrophic events, including
 
pandemics, epidemics, man-made
 
disasters, or acts
 
of violence or
 
war, or
 
the fear that
 
such events

could
 
occur,
 
could
 
also
 
adversely
 
impact
 
our
 
operations
 
and
 
financial
 
results.
 
For
 
example,
 
in
 
2020,
 
the
 
COVID-19
 
pandemic

severely
 
impacted
 
global
 
health,
 
financial
 
markets,
 
consumer
 
spending
 
and
 
global
 
economic
 
conditions,
 
and
 
caused
 
significant

disruption
 
to
 
businesses worldwide,
 
including
 
our
 
business
 
and
 
those
 
of
 
our
 
customers, service
 
providers
 
and
 
suppliers.
 
Future

unforeseen
 
or
 
catastrophic
 
events,
 
including
 
the
 
appearance
 
of
 
new
 
strains
 
of
 
the
 
COVID-19
 
virus,
 
and
 
actions
 
taken
 
by

governmental
 
authorities and
 
other
 
third
 
parties in
 
response to
 
such
 
events,
 
could
 
again
 
adversely affect
 
our
 
operations, cause

economic
 
and
 
market disruption,
 
adversely
 
impact the
 
ability
 
of
 
borrowers to
 
timely
 
repay their
 
loans,
 
or
 
affect
 
the value
 
of
 
any

29

collateral held by us, any of
 
which could have a material adverse effect
 
on our business, financial condition or results
 
of operations.

The frequency,
 
severity and
 
impact of
 
future unforeseen
 
or catastrophic
 
events is
 
difficult to
 
predict. While
 
we maintain
 
insurance

against
 
natural
 
disasters
 
and
 
other
 
unforeseen
 
events,
 
including
 
coverage
 
for
 
business
 
interruption,
 
the
 
insurance
 
may
 
not
 
be

sufficient to cover all
 
of the damage from any such
 
event, and there is no insurance
 
against the disruption that a catastrophic event

could produce to the markets that we serve and
 
the potential negative impact to economic
 
activity.

Climate change could have a material adverse
 
impact on our business operations and that
 
of our clients and customers.

Our business and
 
the activities and
 
operations of our
 
clients and customers
 
may be disrupted
 
by global climate
 
change.

Potential physical risks
 
from climate change
 
include the increase
 
in the
 
frequency and severity
 
of weather
 
events, such as
 
storms

and
 
hurricanes,
 
and
 
long-term
 
shifts
 
in
 
climate
 
patterns, such
 
as
 
sustained
 
higher
 
and
 
lower
 
temperatures,
 
sea
 
level
 
rise,
 
heat

waves and
 
droughts, among
 
others. Additionally,
 
the impact
 
of climate
 
change in
 
the markets
 
that we
 
operate and
 
in other
 
global

markets may
 
have the
 
effect of
 
increasing the
 
costs or
 
reducing the
 
availability of
 
insurance needed
 
for our
 
business operations.

Climate change may also create transitional risks resulting from a shift to a low-carbon economy.
 
These transition risks may include

changes in the legal and regulatory landscape, technology, consumer sentiment and preferences, and market demands that seek to

mitigate the
 
effects
 
of climate
 
change. Changes
 
in the
 
legal
 
and regulatory
 
landscape may
 
additionally increase
 
our compliance

costs.
 
These
 
climate
 
driven
 
changes
 
could
 
have
 
a
 
material
 
adverse
 
impact
 
on
 
asset
 
values
 
and
 
on
 
our
 
business
 
and
 
financial

performance and those of our clients and customers.

We
 
rely
 
on
 
other
 
companies
 
to
 
provide
 
key
 
components
 
of
 
our
 
business
 
infrastructure,
 
including
 
certain
 
of
 
our
 
core

financial
 
transaction
 
processing
 
and
 
information
 
technology
 
and
 
security
 
services,
 
which
 
exposes
 
us
 
to
 
a
 
number
 
of

operational risks that could have a material
 
adverse effect on us.

Third parties provide key components of our business operations, such
 
as data processing, information security, recording

and monitoring transactions,
 
online banking interfaces and
 
services, Internet connections and
 
network access. The most
 
important

of these third-party
 
service providers for
 
us is Evertec.
 
Although the Evertec
 
Business Acquisition Transaction
 
narrowed the scope

of
 
services
 
which
 
we
 
are
 
dependent
 
on
 
Evertec to
 
obtain
 
and
 
released
 
us
 
from
 
exclusivity
 
restrictions
 
that
 
limited
 
our
 
ability
 
to

engage other third-party
 
providers of financial
 
technology services, we
 
are still dependent
 
on Evertec for
 
the provision of
 
essential

services
 
to
 
our
 
business,
 
including
 
certain
 
of
 
our
 
core
 
financial
 
transaction
 
processing
 
and
 
information
 
technology
 
and
 
security

services. As
 
a
 
result, we
 
are
 
particularly exposed
 
to
 
the operational
 
risks
 
of Evertec,
 
including those
 
relating to
 
a
 
breakdown or

failure of Evertec’s systems or internal controls environment. Over the course of
 
our relationship with Evertec, we have experienced

interruptions
 
and
 
delays
 
in
 
key
 
services
 
provided
 
by
 
Evertec,
 
as
 
well
 
as
 
cyber
 
breaches,
 
as
 
a
 
result
 
of
 
system
 
breakdowns,

misconfigurations
 
and
 
instances
 
of
 
application
 
obsolescence,
 
which
 
have
 
in
 
certain
 
cases
 
led
 
to
 
exposure
 
of
 
BPPR
 
customer

information.
 
For
 
a
 
discussion
 
of
 
the
 
Evertec
 
Business
 
Acquisition
 
Transaction,
 
please
 
refer
 
to
 
the
 
Year
 
2022
 
Significant Events

section of the MD&A.

While we
 
select third-party vendors
 
carefully and
 
have increased our
 
oversight of these
 
relationships, we do
 
not control

the
 
actions
 
of
 
our
 
vendors.
 
Any
 
problems
 
caused
 
by
 
these
 
vendors,
 
including
 
those
 
resulting
 
from
 
disruptions
 
in
 
the
 
services

provided, vulnerabilities in or breaches
 
of the vendor’s systems, failure of
 
the vendor to handle
 
current or higher volumes,
 
failure of

the vendor
 
to provide services
 
for any
 
reason or
 
poor performance of
 
services, or
 
failure of
 
the vendor to
 
notify us of
 
a reportable

event in a timely manner,
 
could adversely affect our ability to deliver products and services to
 
our customers and otherwise conduct

our
 
business,
 
result in
 
potential liability
 
to
 
clients
 
and customers,
 
result in
 
the
 
imposition of
 
fines,
 
penalties or
 
judgments by
 
our

regulators or
 
harm to
 
our reputation,
 
any of
 
which could
 
materially and
 
adversely affect
 
us. The
 
inability of
 
our third-party
 
service

providers to timely address
 
evolving cybersecurity threats may further
 
exacerbate these risks. Financial or
 
operational difficulties of

a third-party vendor could also
 
hurt our operations if those
 
difficulties interfere with the vendor’s ability to
 
serve us. Replacing these

third-party vendors, when possible, could also create significant
 
delay and expense. Accordingly,
 
the use of third parties
 
creates an

unavoidable inherent risk to our business operations.

30

The transition to new financial services technology providers, and the replacement of services currently provided
 
to us by

Evertec, will be lengthy and complex.

Switching from
 
one vendor
 
of core
 
bank processing
 
and related
 
technology and
 
security services
 
to
 
one
 
or more
 
new

vendors
 
is
 
a
 
complex
 
process
 
that
 
carries
 
business
 
and
 
financial
 
risks.
 
The
 
implementation
 
cycle
 
for
 
such
 
a
 
transition
 
can
 
be

lengthy and require significant financial and
 
management resources from us. Such
 
a transition can also expose us,
 
and our clients,

to
 
increased
 
costs
 
(including
 
conversion
 
costs),
 
business
 
disruption,
 
as
 
well
 
as
 
operational
 
and
 
cybersecurity
 
risks.
 
Upon
 
the

transition of all or
 
a portion of existing services
 
provided by Evertec to a
 
new financial services technology provider,
 
either (i) at the

end of the term of the Second Amended and Restated
 
Master Services Agreement (the “MSA”) and related
 
agreements or (ii) earlier

upon the
 
termination of any
 
service for
 
convenience under the
 
MSA, these transition
 
risks could result
 
in an
 
adverse effect
 
on our

business, financial condition and results of operations. Although Evertec
 
has agreed to provide certain transition assistance to
 
us in

connection with
 
the termination of
 
the MSA,
 
we are
 
ultimately dependent on
 
their ability
 
to provide
 
those services
 
in a
 
responsive

and competent manner. Furthermore, we
 
may require transition assistance from Evertec beyond the term of
 
the MSA, delaying and

lengthening any transition process away from Evertec
 
while increasing related costs.

Under the
 
MSA, we
 
are able
 
to terminate
 
services for
 
convenience with
 
180 days’
 
prior notice.
 
We expect
 
to exercise

during the
 
term of
 
the MSA
 
the right
 
to terminate
 
certain services
 
for convenience
 
and to
 
transition such
 
services to
 
other service

providers prior to the expiration
 
of the MSA, subject to
 
complying with the revenue minimums contemplated in
 
the MSA and certain

other conditions. In
 
practice, in order
 
to switch
 
to a
 
new provider for
 
a particular
 
service, we will
 
have to commence
 
procuring and

working on
 
a transition
 
process for
 
such service
 
significantly in
 
advance of
 
its termination
 
and, in
 
any case,
 
much earlier
 
than the

automatic renewal notice date or the expiration date of
 
the MSA, and such process may extend beyond the current
 
term of the MSA.

Furthermore, if
 
we
 
are
 
unsuccessful or
 
decide not
 
to
 
complete
 
the transition
 
after
 
expending significant
 
funds
 
and
 
management

resources, it could also result in an adverse
 
effect on our business, financial condition and results of
 
operations.

We are subject to additional risks relating to the
 
Evertec Business Acquisition Transaction.

There are numerous additional risks and uncertainties
 
associated with the Evertec Business Acquisition
 
Transaction, including:

●

unforeseen events may materially diminish the expected
 
benefits of the Evertec Business Acquisition Transaction;

●

we have devoted, and will continue to, devote significant attention and resources to post closing implementation efforts, which

will involve a significant degree of technological complexity
 
and reliance on Evertec and other third parties;

●

we may be
 
unable to retain the
 
employees and third-party contractors hired or
 
engaged by us in connection
 
with the Evertec

Business Acquisition

Transaction and who are
 
necessary to operate and integrate the
 
assets acquired as part of
 
the Evertec

Business Acquisition

Transaction (the “Acquired Assets”);

●

we may
 
be subject
 
to incremental
 
operational and
 
security risks
 
arising from
 
the transfer
 
of the
 
Acquired Assets
 
to BPPR,

including those risks arising from, among
 
other things, the activities required to
 
execute network segmentation, the possibility

of misconfiguration of access or security services during
 
the transition period and during the implementation
 
of new processes

or
 
security
 
controls,
 
the
 
possibility
 
of
 
mismanagement
 
of
 
security
 
services
 
during
 
the
 
transition
 
phase,
 
and
 
the
 
need
 
to

develop a robust internal control framework;

●

the anticipated benefits of the Evertec Business Acquisition

Transaction could be limited if Evertec fails to
 
deliver to BPPR, in

a timely manner and in a manner that meets BPPR’s requirements, the core
 
application programming interfaces (“Core APIs”)

that Evertec has committed
 
to develop in
 
order for BPPR to
 
connect future enhancements to the
 
Acquired Assets to existing

Evertec core applications;

●

we may be exposed to heightened business risks
 
as a result of the extension until
 
2035 of BPPR’s exclusivity with Evertec in

connection with
 
its merchant
 
acquiring business, as
 
well as
 
the extension
 
until 2030
 
of BPPR’s
 
commitment with respect
 
to

the ATH Network, in light of the pace of technology changes and competition
 
in the payments industry; and

●

Evertec’s strategy and investments after the
 
closing of the Evertec Business
 
Acquisition

Transaction may be refocused away

from Popular towards other strategic initiatives.

Any of the foregoing risks and uncertainties could have a
 
material adverse effect on our earnings, cash flows, financial
 
condition,

and/or stock price.

31

LEGAL AND REGULATORY RISKS

Our
 
businesses
 
are
 
highly
 
regulated,
 
and
 
the
 
laws
 
and
 
regulations
 
that
 
apply
 
to
 
us
 
have
 
a
 
significant
 
impact
 
on
 
our

business and operations.

We are
 
subject to
 
extensive regulation
 
under U.S.
 
federal, state
 
and Puerto
 
Rico laws
 
that govern
 
almost all
 
aspects of

our operations and limit the businesses
 
in which we may be
 
engaged, including regulation, supervision and examination by federal,

state and foreign banking
 
authorities. These laws and regulations
 
have expanded significantly over an
 
extended period of time
 
and

are primarily intended
 
for the protection
 
of consumers, borrowers and
 
depositors. Compliance with
 
these laws and
 
regulations has

resulted, and will continue to result, in significant
 
costs.

Additional
 
laws
 
and
 
regulations
 
may
 
be
 
enacted
 
or
 
adopted
 
in
 
the
 
future
 
that
 
could
 
significantly
 
affect
 
our
 
powers,

authority
 
and
 
operations and
 
which could
 
have a
 
material adverse
 
effect
 
on
 
our
 
financial condition
 
and
 
results
 
of
 
operations. In

particular,
 
we
 
could
 
be
 
adversely
 
impacted
 
by
 
changes
 
in
 
laws
 
and
 
regulations,
 
or
 
changes
 
in
 
the
 
application,
 
interpretation
 
or

enforcement of
 
laws and
 
regulations, that proscribe
 
or institute more
 
stringent restrictions on
 
certain financial
 
services activities or

impose new
 
requirements relating to
 
the impact of
 
business activities on
 
ESG concerns, the
 
management of
 
risks associated with

those
 
concerns
 
and
 
the
 
offering of
 
products
 
intended to
 
achieve ESG-related
 
objectives. If
 
we
 
do not
 
appropriately comply
 
with

current or
 
future laws
 
or regulations,
 
we may
 
be subject
 
to fines,
 
penalties or
 
judgements, or to
 
material regulatory restrictions
 
on

our business, which could also materially and adversely
 
affect our financial condition and results of operations.

Our participation
 
(or lack
 
of participation)
 
in certain
 
governmental programs,
 
such as
 
the Paycheck
 
Protection Program

(“PPP”) enacted
 
in response
 
to the
 
COVID-19 pandemic,
 
also exposes
 
us to
 
increased legal
 
and regulatory
 
risks. We
 
have also

been and could continue to
 
be exposed to adverse
 
action for the violation of
 
applicable legal requirements or the improper
 
conduct

of our employees in connection with such loans. For example, on January 24, 2023, Popular Bank consented to the imposition of an

order from
 
the Federal
 
Reserve Board
 
requiring it
 
to
 
pay a
 
$2.3 million
 
civil money
 
penalty to
 
settle certain
 
findings arising
 
from

Popular Bank’s approval of six (6) Payment Protection Program loans. We may also have credit risk with respect to PPP loans if the

SBA determines that
 
there have been
 
deficiencies in the
 
way a PPP
 
loan was originated,
 
funded, or serviced
 
by us and
 
denies its

liability under the guaranty,
 
reduces the amount of the
 
guaranty or, if
 
it has already paid
 
under the guaranty,
 
seeks recovery of any

loss related to the deficiency.

We
 
are from
 
time to
 
time subject
 
to information
 
requests, investigations
 
and other
 
regulatory enforcement
 
proceedings

from departments
 
of the
 
U.S. and
 
Puerto Rico
 
governments, including
 
those that
 
investigate compliance
 
with consumer

protection
 
laws
 
and
 
regulations, which
 
may
 
expose
 
us
 
to
 
significant penalties
 
and
 
collateral consequences,
 
and
 
could

result in higher compliance costs or restrictions
 
on our operations.

We from time-to-time self-report
 
compliance matters to, or receive
 
requests for information from, departments of
 
the U.S.

and Puerto
 
Rico governments,
 
including with
 
respect to
 
compliance with
 
consumer protection
 
laws and
 
regulations. For
 
example,

BPPR has
 
in the
 
past received
 
subpoenas and
 
other requests
 
for information
 
from the
 
departments of
 
the U.S.
 
government that

investigate
 
mortgage-related conduct,
 
mainly
 
concerning
 
real
 
estate
 
appraisals
 
and
 
residential
 
and
 
construction
 
loans
 
in
 
Puerto

Rico. BPPR
 
has also
 
self-identified and
 
reported to
 
applicable regulators compliance
 
matters related
 
to mortgage,
 
credit reporting

and other consumer lending practices.

Incidents of this nature and investigations or examinations by governmental authorities have resulted in the past, and may

in the
 
future result, in
 
judgments, settlements, fines,
 
enforcement actions, penalties
 
or other sanctions
 
adverse to the
 
Corporation,

which could materially and adversely affect the
 
Corporation’s business, financial condition or results of operations, or cause
 
serious

reputational
 
harm.
 
In
 
connection with
 
the
 
resolution
 
of
 
regulatory proceedings,
 
enforcement authorities
 
may
 
seek
 
admissions of

wrongdoing
 
and,
 
in
 
some
 
cases,
 
criminal
 
pleas,
 
which
 
could
 
lead
 
to
 
increased
 
exposure
 
to
 
private
 
litigation,
 
loss
 
of
 
clients
 
or

customers,
 
and
 
restrictions
 
on
 
offering
 
certain
 
products
 
or
 
services.
 
In
 
addition,
 
responding
 
to
 
information-gathering
 
requests,

investigations and
 
other regulatory
 
proceedings, regardless
 
of the
 
ultimate
 
outcome of
 
the matter,
 
could be
 
time-consuming and

expensive. Further, regulators in the performance of their supervisory and enforcement duties, have significant discretion and power

to
 
prevent
 
or
 
remedy
 
what
 
they
 
deem
 
to
 
be
 
unsafe
 
and
 
unsound
 
practices
 
or
 
violations
 
of
 
laws
 
by
 
banks
 
and
 
bank
 
holding

companies. The exercise of this regulatory discretion
 
and power could have a negative impact
 
on Popular.

Complying with economic and trade sanctions programs
 
and anti-money laundering laws and regulations
 
can increase our

operational
 
and
 
compliance
 
costs
 
and
 
risks.
 
If
 
we,
 
and
 
our
 
subsidiaries,
 
affiliates
 
or
 
third-party
 
service
 
providers,
 
are

found to
 
have failed
 
to comply
 
with applicable
 
economic and
 
trade sanctions
 
programs and
 
anti-money laundering
 
laws

and
 
regulations,
 
we
 
could
 
be
 
exposed
 
to
 
fines,
 
sanctions
 
and
 
penalties,
 
and
 
other
 
regulatory
 
actions,
 
as
 
well
 
as

governmental investigations.

32

As
 
a
 
federally
 
regulated
 
financial
 
institution,
 
we
 
must
 
comply
 
with
 
regulations
 
and
 
economic
 
and
 
trade
 
sanctions
 
and

embargo
 
programs
 
administered by
 
the
 
Office
 
of
 
Foreign
 
Assets
 
Control
 
(“OFAC”)
 
of
 
the
 
U.S.
 
Treasury,
 
as
 
well
 
as
 
anti-money

laundering laws and regulations, including those under
 
the Bank Secrecy Act.

Economic and trade sanctions regulations and programs administered by OFAC prohibit U.S.-based entities from entering

into or facilitating
 
unlicensed transactions with, for
 
the benefit of,
 
or in some
 
cases involving the
 
property and property interests
 
of,

persons,
 
governments or
 
countries
 
designated by
 
the
 
U.S.
 
government under
 
one
 
or
 
more
 
sanctions
 
regimes,
 
and
 
also
 
prohibit

transactions
 
that
 
provide
 
a
 
benefit
 
that
 
is
 
received in
 
a
 
country
 
designated
 
under
 
one
 
or
 
more
 
sanctions
 
regimes.
 
We
 
are
 
also

subject to
 
a variety
 
of reporting
 
and other
 
requirements under
 
the Bank
 
Secrecy Act,
 
including the
 
requirement to
 
file suspicious

activity and currency
 
transaction reports, that
 
are designed to
 
assist in
 
the detection
 
and prevention of
 
money laundering, terrorist

financing
 
and
 
other
 
criminal
 
activities.
 
In
 
addition,
 
as
 
a
 
financial
 
institution
 
we
 
are
 
required
 
to,
 
among
 
other
 
things,
 
identify
 
our

customers, adopt formal
 
and comprehensive anti-money
 
laundering programs, scrutinize
 
or altogether prohibit
 
certain transactions

of special concern, and be prepared to respond to inquiries from U.S.
 
law enforcement agencies concerning our customers and
 
their

transactions. Failure
 
by the
 
Corporation, its
 
subsidiaries, affiliates
 
or
 
third-party service
 
providers to
 
comply with
 
these
 
laws
 
and

regulations
 
could
 
have
 
serious
 
legal
 
and
 
reputational
 
consequences
 
for
 
the
 
Corporation,
 
including
 
the
 
possibility
 
of
 
regulatory

enforcement
 
or
 
other
 
legal
 
action,
 
including
 
significant
 
civil
 
and
 
criminal
 
penalties.
 
We
 
also
 
incur
 
higher
 
costs
 
and
 
face
 
greater

compliance risks in
 
structuring and operating
 
our businesses to comply
 
with these requirements. The
 
markets in which
 
we operate

heighten these costs and risks.

We have established risk-based policies and procedures designed to assist us
 
and our personnel in complying with these

applicable laws and
 
regulations. With respect
 
to OFAC
 
regulations and economic
 
and trade sanction
 
programs, these policies
 
and

procedures employ software to screen transactions for
 
evidence of sanctioned-country and person’s involvement. Consistent with
 
a

risk-based approach and the
 
difficulties in identifying and
 
where applicable, blocking and rejecting
 
transactions of our customers
 
or

our customers’ customers that may involve a sanctioned
 
person, government or country, there can be no assurance that our policies

and
 
procedures
 
will
 
prevent
 
us
 
from
 
violating
 
applicable
 
laws
 
and
 
regulations
 
in
 
transactions
 
in
 
which
 
we
 
engage,
 
and
 
such

violations could adversely affect our reputation, business,
 
financial condition and results of operations.

From time
 
to time
 
we have
 
identified and
 
voluntarily self-disclosed
 
to OFAC
 
transactions that
 
were not
 
timely identified,

blocked
 
or
 
rejected
 
by
 
our
 
policies,
 
controls
 
and
 
procedures
 
for
 
screening
 
transactions
 
that
 
might
 
violate
 
the
 
regulations
 
and

economic and
 
trade sanctions
 
programs administered
 
by OFAC.
 
For example,
 
during the
 
second quarter
 
of 2022,
 
BPPR entered

into
 
a
 
settlement
 
agreement
 
with
 
OFAC
 
with
 
respect
 
to
 
certain
 
transactions
 
processed
 
on
 
behalf
 
of
 
two
 
employees
 
of
 
the

Government
 
of
 
Venezuela,
 
in
 
apparent
 
violation
 
of
 
U.S.
 
sanctions
 
against
 
Venezuela.
 
Popular
 
agreed
 
to
 
pay
 
approximately

$256,000 to settle the
 
apparent violations, which had been
 
self disclosed to OFAC.
 
There can be no
 
assurances that any failure
 
to

comply with
 
U.S. sanctions
 
and embargoes,
 
or
 
with anti-money
 
laundering laws
 
and
 
regulations, will
 
not result
 
in material
 
fines,

sanctions or other penalties being imposed on us.

Furthermore, if
 
the policies,
 
controls, and
 
procedures of
 
one of
 
the Corporation’s
 
third-party service
 
providers, together

with our
 
third-party oversight
 
of such
 
providers, do
 
not prevent
 
it from
 
violating applicable
 
laws and
 
regulations in
 
transactions in

which it engages, such violations could adversely affect its
 
ability to provide services to us.

We
 
are
 
subject
 
to
 
regulatory
 
capital
 
adequacy
 
requirements,
 
and
 
if
 
we
 
fail
 
to
 
meet
 
these
 
requirements
 
our

business and financial condition will be adversely
 
affected.

Under regulatory capital adequacy requirements, and other
 
regulatory requirements, Popular and our banking subsidiaries

must
 
meet
 
requirements
 
that
 
include
 
quantitative
 
measures
 
of
 
assets,
 
liabilities
 
and
 
certain
 
off-balance
 
sheet
 
items,
 
subject
 
to

qualitative
 
judgments
 
by
 
regulators
 
regarding
 
components,
 
risk
 
weightings
 
and
 
other
 
factors.
 
If
 
we
 
fail
 
to
 
meet
 
these
 
minimum

capital
 
requirements
 
and
 
other
 
regulatory
 
requirements,
 
our
 
business
 
and
 
financial
 
condition
 
will
 
be
 
materially
 
and
 
adversely

affected. If
 
a financial
 
holding company
 
fails to
 
maintain well-capitalized
 
status under
 
the regulatory
 
framework, or
 
is deemed
 
not

well managed
 
under regulatory
 
exam procedures, or
 
if it
 
experiences certain
 
regulatory violations, its
 
status as
 
a financial
 
holding

company and its
 
related eligibility for
 
a streamlined review
 
process for acquisition
 
proposals, and its
 
ability to offer
 
certain financial

products, may be
 
compromised and its
 
financial condition and
 
results of operations
 
could be adversely
 
affected. The failure
 
of any

depository
 
institution
 
subsidiary
 
of
 
a
 
financial
 
holding
 
company
 
to
 
maintain
 
well-capitalized
 
or
 
well-managed
 
status
 
could
 
have

similar consequences.

In addition,
 
the Basel
 
Committee on
 
Banking Supervision
 
published a
 
set of
 
standards to
 
finalize Basel
 
III in
 
December

2017. These standards significantly revise the Basel capital framework, which could heighten regulatory capital standards if adopted

in the U.S. The federal bank regulators
 
have not yet proposed rules to implement these
 
revisions,

and the impact on us will depend

33

on the way
 
the revisions are implemented
 
in the U.S.
 
See the “Supervision and
 
Regulation – Capital Adequacy”
 
discussion in Item

1. Business of this Form 10-K for additional information
 
related to the Basel III Capital Rules and
 
Basel III finalization.

Increases in FDIC insurance premiums may
 
have a material adverse effect on our earnings.

Substantially all the deposits of BPPR and PB are subject to insurance up to applicable limits by the FDIC’s DIF and, as a

result, BPPR and PB are subject to FDIC deposit insurance assessments.
 
On October 18, 2022, the FDIC finalized a rule that would

increase initial
 
base deposit insurance
 
assessment rates by
 
2 basis
 
points, beginning with
 
the first
 
quarterly assessment period
 
of

2023.
 
We
 
are
 
generally
 
unable to
 
control the
 
amount
 
of
 
premiums that
 
we
 
are
 
required to
 
pay
 
for
 
FDIC
 
insurance. If
 
there
 
are

additional bank or financial institution failures, our level of non-performing assets increases, or our risk profile changes or our capital

position is
 
impaired, we
 
may be
 
required to
 
pay even
 
higher FDIC
 
premiums. Any
 
future increases
 
or special
 
assessments may

materially adversely
 
affect our
 
results of
 
operations. See
 
the “Supervision
 
and Regulation—FDIC Insurance”
 
discussion in
 
Item 1.

Business of this Form
 
10-K for additional information related to
 
the FDIC’s deposit insurance
 
assessments applicable to BPPR and

PB.

The
 
resolution
 
of
 
pending
 
litigation
 
and
 
regulatory
 
proceedings,
 
if
 
unfavorable,
 
could
 
have
 
material
 
adverse
 
financial

effects or cause significant reputational harm to
 
us, which, in turn, could seriously harm
 
our business prospects.

We
 
face
 
legal
 
risks
 
in
 
our
 
businesses,
 
and
 
the
 
volume
 
of
 
claims
 
and
 
amount
 
of
 
damages
 
and
 
penalties
 
claimed
 
in

litigation
 
and
 
regulatory
 
proceedings against
 
financial
 
institutions
 
remains
 
high.
 
Substantial
 
legal
 
liability
 
or
 
significant
 
regulatory

action
 
against
 
us
 
could
 
have
 
material adverse
 
financial
 
effects
 
or cause
 
significant
 
reputational harm
 
to
 
us,
 
which
 
in
 
turn
 
could

seriously
 
harm
 
our
 
business
 
prospects.
 
For
 
further
 
information
 
relating
 
to
 
our
 
legal
 
risk,
 
see
 
Note
 
24
 
-
 
“Commitments
 
&

Contingencies”, to the Consolidated Financial Statements in this Form 10-K.

LIQUIDITY RISKS

We are
 
subject to risks
 
related to our
 
own credit rating
 
and capital levels.
 
Actions by the
 
rating agencies or
 
decreases in

our capital
 
levels may
 
have adverse effects
 
on our
 
business, including by
 
raising the cost
 
of our
 
obligations or affecting

our ability to borrow.

Actions by the rating agencies
 
could raise the cost of
 
our borrowings, since lower rated securities
 
are usually required by

the market
 
to pay
 
higher rates
 
than obligations
 
of higher
 
credit quality.
 
Our credit
 
ratings were
 
reduced substantially in
 
2009 and,

although one of
 
the three major rating
 
agencies upgraded our senior
 
unsecured rating back to
 
“investment grade” during 2021,
 
the

remaining two rating agencies have not
 
upgraded their current “non-investment grade” rating. The
 
market for non-investment grade

securities is much smaller and less liquid than for investment grade securities. If we were to attempt to issue preferred stock or
 
debt

securities into the capital markets, it
 
is possible that there would not
 
be sufficient demand to complete
 
a transaction or that the
 
cost

could be substantially higher than for more highly
 
rated securities.

In
 
addition,
 
changes
 
in
 
our
 
ratings
 
and
 
capital
 
levels
 
could
 
affect
 
our
 
relationships
 
with
 
some
 
creditors
 
and
 
business

counterparties. For example, having
 
negative tangible capital may
 
impact our ability to
 
access some sources of
 
wholesale funding.

The Federal Housing Finance Agency
 
restricts the Federal Home
 
Loan Bank of New
 
York
 
(“FHLBNY”) from lending to members
 
of

the FHLBNY with negative
 
tangible capital unless the
 
member’s primary banking regulator makes a
 
written request to the
 
FHLBNY

to
 
maintain access
 
to
 
borrowings. Both
 
BPPR
 
and PB
 
have secured
 
borrowing facilities
 
with the
 
FHLBNY,
 
and
 
had
 
outstanding

exposures of $1.9
 
billion and $1.4 million
 
respectively as of December 31,
 
2022. Losing access to
 
the FHLBNY borrowing facilities

could adversely impact
 
liquidity at the
 
banking subsidiaries. Additionally,
 
if BPPR or
 
PB cease to
 
be well-capitalized, the
 
FDIA and

regulations
 
adopted thereunder
 
would
 
restrict
 
their
 
ability to
 
accept
 
brokered
 
deposits
 
and
 
limits
 
the
 
rate
 
of
 
interest
 
payable
 
on

deposits.

Our banking
 
subsidiaries also have
 
recourse obligations under
 
certain agreements with
 
third parties, including

servicing and
 
custodial agreements,
 
that include
 
ratings covenants.
 
Upon failure
 
to
 
maintain the
 
required credit
 
ratings, the
 
third

parties could
 
have the
 
right to
 
require us
 
to
 
engage a
 
substitute fund
 
custodian and
 
increase collateral
 
levels securing
 
recourse

obligations. Collateral pledged by
 
us to secure
 
recourse obligations approximated $29
 
million at December
 
31, 2022. Management

expects
 
that
 
we
 
would
 
be
 
able
 
to
 
meet
 
any
 
additional
 
collateral
 
requirements
 
if
 
and
 
when
 
needed.
 
The
 
requirements
 
to
 
post

collateral under
 
certain agreements
 
or the
 
loss of
 
custodian funds,
 
however,
 
could reduce
 
our liquidity
 
resources and
 
impact our

results of operations. The termination of those agreements or the
 
inability to realize servicing income for our businesses could have

an
 
adverse
 
effect
 
on
 
those
 
businesses.
 
Other
 
counterparties
 
are
 
also
 
sensitive
 
to
 
the
 
risk
 
of
 
a
 
ratings
 
downgrade
 
and
 
the

implications
 
for
 
our
 
businesses,
 
and
 
may
 
be
 
less
 
likely
 
to
 
engage
 
in
 
transactions
 
with
 
us,
 
or
 
may
 
only
 
engage
 
in
 
them
 
at
 
a

substantially higher cost, if our ratings remain below
 
investment grade.

34

As a holding company, we depend on dividends and distributions from
 
our subsidiaries for liquidity.

As a bank holding company,
 
we depend primarily on dividends from
 
our banking and other operating subsidiaries
 
to fund

our cash needs, including to capitalize our subsidiaries. Our banking subsidiaries, BPPR and PB, are limited by law in their ability to

make dividend
 
payments and other
 
distributions to
 
us based
 
on their earnings,
 
dividend history,
 
and capital
 
position. Based
 
on its

current financial condition,
 
PB may
 
not declare or
 
pay a
 
dividend without the
 
prior approval of
 
the Federal Reserve
 
Board and
 
the

NYSDFS. A
 
failure by
 
our banking subsidiaries
 
to generate
 
sufficient income
 
and free
 
cash flow to
 
make dividend
 
payments to
 
us

may
 
affect
 
our
 
ability to
 
fund
 
our cash
 
needs, which
 
could have
 
a negative
 
impact on
 
our financial
 
condition, liquidity,
 
results
 
of

operation or capital position. Such failure could also affect
 
our ability to pay dividends to our stockholders and to
 
repurchase shares

of our common stock. We have in the past suspended dividend payments
 
on our common stock and preferred stock during times of

economic uncertainty,
 
and there
 
can be
 
no assurance
 
that we
 
will be
 
able to
 
continue to
 
declare dividends to
 
our stockholders
 
in

any future periods.

An
 
impact
 
on
 
the
 
tangible
 
capital
 
levels
 
of
 
our
 
operating
 
subsidiaries,
 
could
 
also
 
limit
 
the
 
amount
 
of
 
capital
 
we
 
may

upstream to the holding company.
 
Tangible
 
capital levels have, and may continue to
 
be, adversely affected by the impact
 
of rapidly

rising interest rates on investment securities in our available-for-sale portfolio. For a discussion
 
of risks related to changes in interest

rates,
 
see
 
“Changes
 
in
 
interest
 
rates
 
and
 
credit
 
spreads
 
can
 
adversely
 
impact
 
our
 
financial
 
condition,
 
including
 
our
 
investment

portfolio, since a significant portion of our
 
business involves borrowing and lending money,
 
and investing in financial instruments”
 
in