POPULAR, INC. (BPOP) FY 2022 MD&A
This page reproduces the company's own Item 7 MD&A text from the linked SEC filing. It is filer text, not grepcent analysis, scoring, or investment advice.
results of
operations
and
capital
position.
These
risks
could
cause
our
actual
results
to
differ
materially
from
our
historical
results
or
the
results
contemplated by the forward-looking statements contained in this report.
The risks described in
this report are not the
only risks we face. Additional
risks and uncertainties not currently
known by
us
or
that
we
currently
deem
to
be
immaterial,
or
that
are
generally
applicable
to
all
financial
institutions,
may
also
materially
adversely affect our business, financial condition, liquidity, results of operations or capital position.
ECONOMIC AND MARKET RISKS
Weakness in
the economy,
particularly in
Puerto Rico,
where a
significant portion
of our
business is
concentrated, has
adversely impacted us in the past and may adversely
impact us in the future.
We have been, and will continue to be, impacted by global and local
economic and market conditions, including weakness
in
the
economy,
disruptions
and
volatility
in
the
financial
markets,
inflation,
changing
monetary
and
fiscal
policies,
geopolitical
conflicts, consumer and changes
in business sentiment and
unemployment. A significant portion of
our business is concentrated in
Puerto Rico, which
accounted for approximately 79% of
our assets and 84%
of our deposits
as of December 31,
2022 and 82%
of
our
revenues
for
the
year
ended
December
31,
2022.
As
a
result,
our
financial
condition
and
results
of
operations
are
highly
dependent
on
the
general
trends
of
the
Puerto
Rico
economy
and
other
conditions
affecting
Puerto
Rico
consumers
and
businesses. The
concentration of
our operations
in Puerto
Rico exposes
us to
greater risks
than other
banking companies
with a
wider geographic base.
Puerto Rico
has faced significant
economic and fiscal
challenges in the
past, including a
severe recession that
began in
2007 and
persisted for
over a
decade and
an acute
fiscal crisis
that led
the Puerto
Rico government
to file
for a
form
of federal
bankruptcy protection
in 2017.
Puerto Rico’s
fiscal and
economic challenges
have in
the past
adversely affected
our customers,
resulting
in
higher
delinquencies,
charge-offs
and
increased
losses
for
us.
While
Puerto
Rico’s
economy
has
been
gradually
recovering
and
the
Puerto
Rico
government
has
recently
emerged from
bankruptcy,
Puerto
Rico
still
faces
economic
and
fiscal
challenges and could face additional economic or fiscal challenges in the
future, including as a result of weakness or volatility in
the
global economy
and financial
markets. A
weakening of
the Puerto
Rico economy
or other
adverse economic
conditions affecting
Puerto Rico
consumers and
businesses could
result in
decreased demand
for our
products or
services, deterioration
in the
credit
quality
of
our
customers,
higher delinquencies,
charge-offs
or
increased losses,
all
of
which
could adversely
affect
our
financial
condition and results of operations.
We are also exposed to risks related to the state of the local economies of the other markets in which we do business, such as New
York
and Florida,
and to
the state
of the
global and
U.S. economy
and financial
markets. Global
financial markets
have recently
experienced periods of
extraordinary disruption and volatility,
exacerbated by the
COVID-19 pandemic, the war
in Ukraine, supply-
chain disruptions, high levels of, and rapid increases in, inflation,
and increasing and high interest rates. Inflationary pressures have
increased certain
of our
expenses (including
our personnel
expenses) and
adversely affected
consumer sentiment.
Central bank
responses to inflationary pressures have led to
higher market interest rates and, in turn,
lower activity levels across U.S. and global
financial markets. These circumstances have resulted in, and could continue to
result in, reductions in the value of
our investments.
If
these
conditions
persist
or
worsen,
our
results
of
operations, financial
position
and
liquidity could
be
materially
and
adversely
affected.
Changes
in
interest
rates
and
credit
spreads
can
adversely
impact
our
financial
condition,
including
our
investment
portfolio,
since
a
significant
portion
of
our
business involves
borrowing
and
lending
money,
and
investing in
financial
instruments.
Our business
and financial
performance are
impacted by
market interest
rates and
movements in
those rates.
Since a
high percentage of our assets and liabilities are interest bearing or otherwise sensitive in value to changes in interest rates, changes
in interest rates, in the shape of the yield curve or in spreads between different types of rates, have had and could in the future have
24
a material impact on our results
of operations and the values of our
assets and liabilities, including our investment portfolio.
Interest
rates are
highly sensitive
to many
factors over
which we
have no
control and
which we
may not
be able
to anticipate
adequately,
including general
economic conditions
and the
monetary and
tax policies
of various
governmental bodies,
particularly the
Federal
Reserve Board.
Increasing levels of inflation, driven
by pent-up demand and supply-chain disruptions caused
by the COVID-19 pandemic
and the war in Ukraine, led the Federal Reserve Board to execute a series of sharp benchmark interest rate increases over the past
year.
While the
pace at
which inflation
is increasing
has slowed
down in
recent months,
following a
mid-2022 peak,
the Federal
Reserve Board has signaled
that it may increase
interest rates further to
continue to control and
bring down inflation. If
the interest
rates we
pay on
our deposits and
other borrowings increase
at a
faster rate than
the interest rates
we receive on
loans and
other
investments, our net interest income, and, therefore, our earnings, could be adversely affected. Higher interest rates could also lead
to fewer originations of commercial and residential real
estate loans, loss of deposits, a misalignment in the
pricing of short-term and
long-term
borrowings,
less
liquidity
in
the
financial
markets
and
higher
funding
costs.
Furthermore,
higher
interest
rates
could
negatively affect
the payment
performance on
loans linked
to variable
interest rates
to the
extent borrowers
are unable
to afford
higher
interest
payments, which
could
result
in
higher
delinquencies. Additionally,
inflationary
pressure arising
from
increases in
interest rates may also affect borrowers’ financial condition and their ability to pay their debts when due. All of these outcomes could
adversely affect our earnings, liquidity and capital levels.
The
rapid
rise
in
interest
rates
in
2022
resulted
in
approximately
$2.5
billion
in
unrealized
mark-to-market
losses
on
available-for-sale securities held in our investment securities portfolio. In October 2022, we transferred U.S. Treasury securities with
a fair value of approximately $6.5 billion (par value of
$7.4 billion), and with accumulated unrealized losses of $873 million, from our
available-for-sale portfolio to our held-to-maturity portfolio to reduce the
impact of further increases in interest rates on
accumulated
other comprehensive
income and
tangible capital.
However,
if interest
rates continue
to rise
rapidly or
for a
prolonged period,
we
may accumulate significant additional mark-to-market losses
on other investment securities in
our available-for-sale portfolio, which
may adversely affect our tangible capital and impact our
ability to return capital to our stockholders.
We are
also subject
to risks
related to
the transition
away from
the London
Interbank Offered
Rate (“LIBOR”)
upon the
cessation in
the publication
of the
remaining principal
tenors of
U.S. dollar
LIBOR, which
is scheduled
for June
30, 2023. These
risks were significantly reduced following the enactment by the U.S.
Congress of the Adjustable Interest Rate (LIBOR) Act in the first
quarter
of
2022,
which
provides
a
framework
for
replacing
LIBOR
with
new
benchmark
rates
based
on
the
Secured
Overnight
Financing Rate (“SOFR”)
in loans that
do not have
effective alternate interest
rate provisions. However,
there is no
assurance that
the new SOFR-based benchmarks will be similar to,
or produce the economic equivalent of, LIBOR, and the
transition to these new
benchmark rates could result in operational, systems or
other practical challenges, litigation or
other adverse consequences.
For a discussion of the Corporation’s
interest rate sensitivity, please refer
to the “Risk Management” section of the MD&A
in this Form 10-K.
Fiscal challenges facing the U.S. government could negatively impact financial markets, which in turn could have
an adverse effect on our financial position or
results of operations.
In
January
2023,
the
outstanding
debt
of
the
U.S.
reached
its
statutory
limit
and
the
U.S.
Treasury
Department
commenced taking
extraordinary measures
to
prevent the
U.S. from
defaulting on
its obligations.
If Congress
does not
raise the
debt
ceiling,
the
U.S.
could
default
on
its
obligations,
including
U.S.
Treasury
securities,
which
play
an
integral
role
in
financial
markets. Many
of the
investment securities
held in
our portfolio
are issued
by the
U.S. government
and government
agencies. A
U.S.
government
debt
default,
threatened
debt
default
or
downgrade
of
the
sovereign
credit
ratings
of
the
U.S.
by
credit
rating
agencies
could
have
a
significant
adverse
impact
on
market
volatility
and
illiquidity,
lead
to
further
increases
in
interest
rates,
heighten
operational
risks
relating
to
the
clearance
and
settlement
of
transactions,
and
result
in
a
significant
deterioration
in
economic conditions in
the U.S. and
worldwide. Even if
the U.S. does
not default, continued
uncertainty relating to
the debt ceiling
could
result in
downgrades of
the U.S.
credit
rating, which
could adversely
affect
market conditions,
lead
to
further increases
in
interest rates
and borrowing
costs or
necessitate significant
operational changes
among market
participants if
the liquidity
or fair
value of U.S. Treasury and/or agency securities decreases. Further, the fair value, liquidity and credit ratings of securities issued by,
or other obligations of, agencies of the U.S.
government as well as municipal bonds could be
similarly adversely affected.
BUSINESS RISKS
Negative
changes
in
the
financial
condition
of
our
clients
have
adversely
impacted
us
in
the
past
and
may
adversely
impact us in the future.
25
A significant portion of
our business involves lending money,
which exposes us to
credit risk and
risk of loss if
borrowers
do
not
repay
their
loans,
leases, credit
cards
or
other
credit
obligations.
The
performance of
these
credit
portfolios
significantly
affects our
financial condition
and results
of operations.
We have
in the
past been
adversely affected
by negative
changes in
the
financial condition of our clients due to weakness in
the Puerto Rico and U.S. economy. If the current economic environment were to
deteriorate, more customers may have difficulty in repaying their credit obligations, which may result in higher levels
of credit losses
and reserves for credit losses.
We are exposed to
increased credit risks and credit losses
to the extent our clients are
concentrated by industry segment
or type of client.
Our credit risk and credit
losses can increase to the extent
our loans are concentrated in borrowers engaged in
the same
or similar
activities or
in borrowers
who as
a group
may be
uniquely or
disproportionately affected
by certain
economic or
market
conditions. We have significant
exposure to borrowers in certain
economic sectors, such as residential
and commercial real estate,
hospitality and healthcare. Challenging economic or market conditions that affect
the industries or types of clients to
which we have
significant exposure could result in higher credit
losses and adversely affect our financial condition
and results of operations.
We also
have direct
lending and
investment exposure
to Puerto
Rico government
entities, which
have faced
significant
fiscal challenges.
At December
31, 2022,
our exposure
to the
Puerto Rico
government consisted
of $374
million in
direct lending
exposure to Puerto
Rico municipalities and
$251 million in
loans insured or
securities issued by
Puerto Rico governmental
entities
but for
which the
principal source
of repayment
is non-governmental.
We also
have indirect
lending exposure
to the
Puerto Rico
government in the
form of loans
to private borrowers
who are service
providers, lessors, suppliers
or have other
relationships with
the Puerto Rico government. While the overall fiscal situation
of the Puerto Rico government has improved in recent years,
including
as
result
of
the
government
and
certain
of
its
instrumentalities
having
restructured
their
debt
obligations,
some
Puerto
Rico
government entities, including certain municipalities, still face significant
fiscal challenges. A deterioration in the fiscal situation of
the
Puerto Rico
government and its
instrumentalities, and in
particular in the
fiscal situation
of the
Puerto Rico
municipalities to
which
we have direct lending exposure, could result in
higher credit losses and reserves for credit losses. For
a discussion of risks related
to the Corporation’s credit exposure to the Puerto Rico
and USVI governments, see the Geographic and
Government Risk section in
the MD&A section of this Form 10-K.
Deterioration in the
values of real
properties securing our commercial, mortgage
loan and construction portfolios
have in
the past resulted, and may in the future result,
in increased credit losses and harm our results
of operations.
As of
December 31,
2022, approximately
56% of
our loan
portfolio consisted
of loans
secured by
real estate
collateral
(comprised of 29% in commercial loans, 25% in residential
mortgage loans and 2% in construction loans).
The value of the collateral
securing such loans is dependent upon economic conditions in the area in which the collateral is located. Weakness in the economy
of some of the
markets we serve has in
the past resulted in significant
declines in the value of
the real properties securing our loan
portfolio, leading to increased credit losses. If the value of
the real estate properties securing our loan portfolio declines again in the
future, we may be
required to increase our
provisions for loan losses
and allowance for loan
losses. Any such increase could
have
an adverse effect on
our financial condition and results of
operations. For more information on the credit
quality of our construction,
commercial and mortgage portfolio, see the Credit Risk
section of the MD&A included in this Form
10-K.
We
are
exposed
to
credit
risk
from
mortgage
loans
that
have
been
sold
or
are
being
serviced
subject
to
recourse
arrangements.
Popular
is
generally
at
risk
for
mortgage
loan
defaults
from
the
time
it
funds
a
loan
until
the
time
the
loan
is
sold
or
securitized into a
mortgage
-
backed security.
However, we
have retained part
of the credit
risk on sales
of mortgage loans
through
recourse
arrangements,
and
we
also
service
certain
mortgage
loan
portfolios
with
recourse.
At
December
31,
2022,
we
were
exposed to credit risk with respect to $0.6 billion in residential mortgage loans sold
or serviced subject to credit recourse provisions,
consisting principally of loans associated with the Fannie Mae and
Freddie Mac programs. Pursuant to such recourse provisions,
we
are required to repurchase the loan or reimburse the third-party investor for the incurred loss in the event of a customer default. The
maximum potential amount of future payments that
we would be required to make
under the recourse arrangements in the
event of
nonperformance
by
the
borrowers
is
equivalent
to
the
total
outstanding balance
of
the
residential mortgage
loans
serviced
with
recourse
and
interest,
if
applicable. In
the
event of
nonperformance by
the
borrower,
we
have rights
to
the underlying
collateral
securing the
mortgage loan.
During 2022,
we repurchased
approximately $7
million in
mortgage loans
subject to
credit recourse
provisions. As
of December
31, 2022,
our liability
established
to cover
the estimated
credit loss
exposure related
to loans
sold or
serviced with credit recourse amounted
to $7 million. We may suffer losses on these loans if the proceeds from a foreclosure sale of
26
the property underlying
a defaulted mortgage
loan are less
than the outstanding
principal balance of
the loan plus
any uncollected
interest advanced and the costs of holding and disposing of
the related property.
Defective and repurchased
loans may harm our business and financial
condition.
In
connection
with
the
sale
and
securitization
of
mortgage
loans,
we
are
required
to
make
a
variety
of
customary
representations
and
warranties regarding
Popular
and
the
loans being
sold
or securitized.
Our
obligations with
respect to
these
representations and warranties are generally outstanding for the life
of the loan, and they relate
to, among other things, compliance
with
laws
and
regulations,
underwriting
standards,
the
accuracy
of
information
in
the
loan
documents
and
loan
file
and
the
characteristics
and
enforceability of
the
loan.
A
loan
that
does
not
comply
with
the
secondary
market’s
requirements
may
take
longer to
sell, impact
our ability
to securitize
the loans
or pledge
the loans
as collateral
for borrowings,
or be
unsalable or
salable
only
at
a
significant
discount.
Moreover,
if
any
such
loan
is
sold
before
we
detect
non-compliance,
we
may
be
obligated
to
repurchase the loan and bear any associated loss directly,
or we may be obligated to indemnify the purchaser against any loss.
We
seek to
minimize repurchases and
losses from defective
loans by correcting
flaws, if possible,
and selling or
re-selling such loans.
However,
if
we
were
to
suffer
significant
losses
from
defective
and
repurchased
loans,
our
results
of
operations
and
financial
condition could be materially impacted.
If we are
unable to maintain
or grow our
deposits, we may
be subject to
paying higher funding costs
and our net
interest
income may decrease.
We must maintain adequate liquidity and funding sources
to support our operations, comply with our financial
obligations,
finance our transformation initiative, fund
planned capital distributions and meet
regulatory requirements. We rely
primarily on bank
deposits
as
a
low cost
and stable
source
of
funding
for
our
lending activities
and
the
operation of
our
business.
Therefore,
our
funding costs
are largely
dependent on
our ability
to maintain
and grow
our deposits.
As our
competitors have
raised the
interest
rates they pay on deposits, our
funding costs have increased, as we have
needed to increase the rates we pay
to our depositors to
avoid losing
deposits. We
may also
need to
rely on
more expensive
sources of
funding if
deposits decrease. Rising
interest rates
have
also
led
customers
to
move
their
funds
to
alternative
investments
that
pay
higher
interest
rates.
Furthermore,
we
have
a
significant
amount
of
deposits
from
the
Puerto
Rico
government,
its
instrumentalities
and
municipalities
($15.2
billion,
or
approximately 25% of our
total deposits, as of
December 31, 2022), and
the amount of these
deposits may fluctuate depending on
the financial
condition and
liquidity of
these entities,
as well
as
on our
ability to
maintain these
customer relationships.
If we
are
unable to
maintain or
grow our
deposits for
any
reason, we
may be
subject to
paying higher
funding costs
and
our
net interest
income may decrease.
OPERATIONAL RISKS
We
and our
third-party providers
have been,
and expect
in the
future to
continue to
be, subject
to cyber
attacks, which
could cause substantial harm and have an adverse
effect on our business and results of operations.
Information security risks for large financial institutions such as Popular have increased significantly in recent years in part
because
of
the
proliferation
of
new
technologies,
such
as
Internet
and
mobile
banking
to
conduct
instant
financial
transactions
anywhere globally,
growing geo-political threats,
such as the
ongoing Russian conflict
in Ukraine, and
the increased sophistication
and activities of organized crime, hackers,
terrorists, nation-states, hacktivists and other parties. In
the ordinary course of business,
we rely on
electronic communications and
information systems to
conduct our operations
and to transmit
and store sensitive
data.
We employ
a layered
defensive approach
that employs
people, processes
and technology
to manage
and maintain
cybersecurity
controls through a variety of preventative and detective tools that monitor, block, and provide alerts regarding suspicious activity
and
identify suspected advanced persistent threats. Notwithstanding our defensive measures and the significant resources we devote to
protect the security of our systems, there is no assurance that all of our security measures will be effective at all times, especially as
the threats from cyber-attacks
are continuous and severe. The
risk of a
security breach due to
a cyber attack could
increase in the
future as
we continue
to expand
our mobile
banking and
other internet
based product
offerings, the
use
of the
cloud for
system
development and hosting and internal use of
internet-based products and applications.
We
continue to
detect and
identify attacks
that are
becoming more
sophisticated and
increasing in
volume, as
well as
attackers that
respond rapidly to
changes in
defensive countermeasures. The
most significant cyber-attack
risks that we
may face
are e-fraud, denial-of-service (DDoS), ransomware,
computer intrusion and the
exploitation of software zero-day
vulnerabilities that
might result
in disruption
of services
and in
the exposure
or loss
of customer
or proprietary
data. Loss
from e-fraud
occurs when
cybercriminals compromise
our systems
or the
systems of
our customers
and extract
funds from
customer’s credit
cards or
bank
accounts, including through
brute force, password
spraying and credential
stuffing attacks directed
at gaining unauthorized
access
to
individual
accounts.
Denial-of-service
attacks
intentionally
disrupt
the
ability
of
legitimate
users,
including
customers
and
27
employees,
to
access
networks,
websites
and
online
resources.
Computer
intrusion
attempts
either
direct
or
through
social
engineering, supply chain compromise, email, text or voice messages, including
using brand impersonation (regularly referred to as
phishing, vishing and smishing), might
result in the compromise
of sensitive customer data,
such as account numbers,
credit cards
and social security numbers, and could present
significant reputational, legal and regulatory costs
to Popular if successful.
We are
the target of
phishing, smishing and vishing
attacks targeting both
our customers and
employees through brand,
email, text and
voicemail impersonation, that
have compromised the
email accounts of
certain of our
customers and employees
or
have
resulted
in
our
customers
being
deceived
into
revealing
their
sensitive
information
to
threat
actors.
There
can
be
no
assurances that there will not be further compromises of sensitive customer information in the future. Our customer-facing platforms
are
also
routinely
attacked
by
threat
actors
aiming
to
gain
unauthorized
access
to
our
clients’
accounts.
Popular
has
recently
implemented certain defensive measures in response to
brute force attacks on one
of our platforms which
resulted in certain of our
customers
log-in
credentials
and
information
being
exposed.
As
a
result,
Popular
notified,
as
required
or
otherwise
deemed
appropriate, customers
identified as
affected by
the incident.
We have
to date
not experienced
material losses
in connection
with
these
attacks.
Cyber-security
risks
have
also
been
recently
exacerbated
by
the
discovery
of
zero-day
vulnerabilities
in
widely
distributed
third
party
software,
such
as
the
vulnerability
identified
in
December
2021
in
the
Apache
log4j,
which
could
affect
Popular’s or any of its service provider’s
systems.
The
increased
use
of
remote
access
and
third-party
video
conferencing
solutions
to
enable
work-from-home
arrangements for
employees
and
facilitating the
use
of
digital channels
by
our
customers,
has
increased
our
exposure to
cyber
attacks. In
addition, a
third party
could misappropriate
confidential information
obtained by
intercepting signals
or communications
from mobile devices used by Popular’s customers or employees. Recent events, including the Russian conflict in Ukraine, have also
illustrated
increased geo-political
factors
and the
risks related
to
supply-chain compromises
and
de-stabilizing activities
linked to
nation-state sponsored activity as an increasing trend
to monitor actively.
Risks and exposures related to cyber security
attacks are
expected to
remain high for
the foreseeable future
due to
the rapidly evolving
nature and sophistication
of these
threats, including
the rise in the use of cyber-attacks as geopolitical weapons. Although we are
regularly targeted by unauthorized threat-actor activity,
we have not, to date, experienced any material
losses as a result of any cyber-attacks.
A material compromise or circumvention of the security of our systems could
have serious negative consequences for us,
including
significant
disruption
of
our
operations
and
those
of
our
clients,
customers
and
counterparties,
misappropriation
of
confidential information
of us
or that
of our
clients, customers,
counterparties or
employees, or
damage to
computers or
systems
used
by
us
or
by
our
clients,
customers
and
counterparties,
and
could
result
in
violations
of
applicable
privacy
and
other
laws,
financial loss
to us
or to
our customers,
loss of
confidence in
our security
measures, customer
dissatisfaction, significant litigation
exposure and harm to
our reputation, all of
which could have a
material adverse effect
on us. For example,
if personal, non-public,
confidential
or
proprietary
information
in
our
possession
were
to
be
mishandled,
misused
or
stolen,
we
could
suffer
significant
regulatory consequences, reputational damage
and financial loss.
Such mishandling, misuse
or misappropriation could include,
for
example, if such information
were provided to parties
who are not permitted
to have the
information, either by fault
of our systems,
by our employees
or counterparties, or
where such information
is intercepted or
otherwise inappropriately taken by
our employees
or third parties.
The
extent
of
a
particular
cyber
attack
and
the
steps
that
we
may
need
to
take
to
investigate the
attack
may
not
be
immediately
clear,
and
it
may
take
a
significant
amount
of
time
before
such
an
investigation
can
be
completed.
While
such
an
investigation is ongoing, Popular may not necessarily know the full
extent of the harm caused by the cyber
attack, and that damage
may continue to spread.
These factors may inhibit
our ability to provide
rapid, full and reliable
information about the cyber
attack to
our clients,
customers, counterparties and
regulators, as well
as the public.
Moreover, potential
new regulations may
require us to
disclose information about
a cybersecurity event before
it has been
resolved or fully
investigated. Furthermore, it may
not be clear
how best to contain and remediate the potential harm caused by the cyber attack, and certain errors or actions could be repeated or
compounded before they are discovered and remediated. Cyber attacks could cause interruptions in our operations and result in the
incurrence
of
significant
costs,
including those
related
to
forensic analysis
and
legal counsel,
each of
which may
be
required to
ascertain the extent
of any potential
harm to our
customers, or employees, or
damage to our information
systems and any
legal or
regulatory obligations that
may result therefrom.
Any cyber incidents
could also result
in, among other
things, increased regulatory
scrutiny
and adverse
regulatory or
civil
litigation consequences.
For a
discussion of
the guidance
and rules
that federal
banking
regulators
have
released
or
proposed
regarding
cybersecurity
and
cyber
risk
management
standards,
see
“Regulation
and
Supervision” in
Part
I,
Item
1 —
Business,
included in
the
Form 10-K
for the
year
ended December
31,
2022. Any
or
all
of
the
foregoing factors could further increase the impact
of the incident and thereby the costs and consequences
of a cyber attack.
We also
rely on
third parties
for the
performance of
a significant
portion of
our information
technology functions and
the
28
provision of information security,
technology and business process services. As a result, a
successful compromise or circumvention
of
the security
of
the systems
of these
third-party service
providers could
have serious
negative consequences
for us,
including
misappropriation of
confidential information
of us
or that
of our
clients, customers,
counterparties or
employees, or
other negative
implications identified above with respect to a cyber-attack on our systems, which could have a material adverse effect on us. Cyber
attacks at third-party service
providers are also becoming
increasingly common, and, as
a result, cybersecurity risks
relating to our
vendors have
increased. The most
important of
these third-party service
providers for us
is Evertec, and
certain risks
particular to
Evertec are
discussed under
“Operational Risks
— We
are subject
to additional
risks relating
to the
Evertec Business
Acquisition
Transaction”. During 2021, we
determined that, as a result
of the widely reported breach of
Accellion, Inc.’s File Transfer
Appliance
tool, which
was being
used at
the time
of such
breach by
a U.S.-based
third-party advisory
services vendor
of Popular,
personal
information
of
certain
Popular
customers
was
compromised.
As
a
result,
Popular
notified,
as
required
or
otherwise
deemed
appropriate, customers identified as affected by the incident. Although we are not aware of fraudulent activity
in connection with this
incident,
Popular’s
networks
and
systems
were
not
impacted,
and
our
third-party
service
provider
agreed
to
cover
external
remediation costs associated with the incident. A compromise of the personal information of our
customers maintained by third party
vendors
could
result
in
significant
regulatory
consequences,
reputational
damage
and
financial
loss
to
us.
The
success
of
our
business depends
in part
on the
continuing ability
of these
(and other)
third parties
to perform
these functions
and services
in a
timely
and
satisfactory
manner,
which
performance
could
be
disrupted
or
otherwise
adversely
affected
due
to
failures
or
other
information security
events originating at
the third
parties or at
the third parties’
suppliers or vendors
(so-called “fourth party
risk”).
We
may
not
be
able
to
effectively
directly
monitor
or
mitigate
fourth-party
risk,
in
particular
as
it
relates
to
the
use
of
common
suppliers
or
vendors
by
the
third
parties that
perform
functions
and
services
for
us.
For
a
discussion of
the
risks
related
to
our
dependence
on
third
parties,
including
Evertec,
see
“We
rely
on
other
companies
to
provide
key
components
of
our
business
infrastructure, including certain of our core
financial transaction processing and information technology and
security services, which
exposes us to a number of operational risks that could have a material
adverse effect on us” in the Operational Risks section of Item
1A in this Form 10-K.
As
cyber
threats
continue
to
evolve,
we
expect
to
expend
significant
additional
resources
to
continue
to
modify
or
enhance our
layers of
defense or
to investigate
and remediate
additional information
security vulnerabilities
or incidents.
System
enhancements and
updates also
create risks
associated with
implementing new
systems and
integrating them
with existing
ones,
including risks associated with supply chain compromises
and the software development lifecycle of the
systems used by us and our
service providers. Due
to the complexity
and interconnectedness of information
technology systems, the
process of enhancing
our
layers
of
defense can
itself
create
a
risk
of
systems
disruptions
and
security
issues.
In
addition,
addressing
certain
information
security vulnerabilities, such as
hardware-based vulnerabilities, may affect
the performance of our
information technology systems.
The ability of our
hardware and software providers to deliver
patches and updates to mitigate vulnerabilities
in a timely manner
can
introduce additional risks, particularly when a vulnerability
is being actively exploited by threat
actors. Moreover, our ability
to timely
mitigate
vulnerabilities
and
manage
such
risks,
given
the
rise
in
number
of
required
patches
and
third-party
software,
including
“zero-day
vulnerabilities”,
as
well
as
the
obsolescence
in
some
of
our
hardware
and
software,
may
impact
our
day-to-day
operations, the availability of our systems and
delay the deployment of technology enhancements
and innovation.
If Popular’s operational systems,
or those of
external parties on which
Popular’s businesses depend, are
unable to meet
the requirements of our
businesses and operations or bank
regulatory standards, or if they
fail, have other significant
shortcomings
or are impacted by cyber attacks, Popular could be
materially and adversely affected.
Unforeseen or
catastrophic events,
including
extreme weather
events and
other natural
disasters, man-made
disasters,
acts of violence or
war, or the
emergence of pandemics or epidemics, could
cause a disruption in our
operations or other
consequences that could have a material adverse
effect on our financial condition and results
of operations.
A
significant
portion
of
our
operations
are
located
in
the
Caribbean
and
Florida,
a
region
susceptible
to
hurricanes,
earthquakes and other
similar events. In
2017, Puerto Rico,
USVI and BVI
were severely impacted
by Hurricanes Irma
and María,
which resulted in significant disruption to our operations and adversely affected
our clients in these markets, and in 2022, Hurricane
Fiona impacted the
southwest area of
Puerto Rico,
adversely affecting our
customers in
that region. Other
types of
unforeseen or
catastrophic events, including
pandemics, epidemics, man-made
disasters, or acts
of violence or
war, or
the fear that
such events
could
occur,
could
also
adversely
impact
our
operations
and
financial
results.
For
example,
in
2020,
the
COVID-19
pandemic
severely
impacted
global
health,
financial
markets,
consumer
spending
and
global
economic
conditions,
and
caused
significant
disruption
to
businesses worldwide,
including
our
business
and
those
of
our
customers, service
providers
and
suppliers.
Future
unforeseen
or
catastrophic
events,
including
the
appearance
of
new
strains
of
the
COVID-19
virus,
and
actions
taken
by
governmental
authorities and
other
third
parties in
response to
such
events,
could
again
adversely affect
our
operations, cause
economic
and
market disruption,
adversely
impact the
ability
of
borrowers to
timely
repay their
loans,
or
affect
the value
of
any
29
collateral held by us, any of
which could have a material adverse effect
on our business, financial condition or results
of operations.
The frequency,
severity and
impact of
future unforeseen
or catastrophic
events is
difficult to
predict. While
we maintain
insurance
against
natural
disasters
and
other
unforeseen
events,
including
coverage
for
business
interruption,
the
insurance
may
not
be
sufficient to cover all
of the damage from any such
event, and there is no insurance
against the disruption that a catastrophic event
could produce to the markets that we serve and
the potential negative impact to economic
activity.
Climate change could have a material adverse
impact on our business operations and that
of our clients and customers.
Our business and
the activities and
operations of our
clients and customers
may be disrupted
by global climate
change.
Potential physical risks
from climate change
include the increase
in the
frequency and severity
of weather
events, such as
storms
and
hurricanes,
and
long-term
shifts
in
climate
patterns, such
as
sustained
higher
and
lower
temperatures,
sea
level
rise,
heat
waves and
droughts, among
others. Additionally,
the impact
of climate
change in
the markets
that we
operate and
in other
global
markets may
have the
effect of
increasing the
costs or
reducing the
availability of
insurance needed
for our
business operations.
Climate change may also create transitional risks resulting from a shift to a low-carbon economy.
These transition risks may include
changes in the legal and regulatory landscape, technology, consumer sentiment and preferences, and market demands that seek to
mitigate the
effects
of climate
change. Changes
in the
legal
and regulatory
landscape may
additionally increase
our compliance
costs.
These
climate
driven
changes
could
have
a
material
adverse
impact
on
asset
values
and
on
our
business
and
financial
performance and those of our clients and customers.
We
rely
on
other
companies
to
provide
key
components
of
our
business
infrastructure,
including
certain
of
our
core
financial
transaction
processing
and
information
technology
and
security
services,
which
exposes
us
to
a
number
of
operational risks that could have a material
adverse effect on us.
Third parties provide key components of our business operations, such
as data processing, information security, recording
and monitoring transactions,
online banking interfaces and
services, Internet connections and
network access. The most
important
of these third-party
service providers for
us is Evertec.
Although the Evertec
Business Acquisition Transaction
narrowed the scope
of
services
which
we
are
dependent
on
Evertec to
obtain
and
released
us
from
exclusivity
restrictions
that
limited
our
ability
to
engage other third-party
providers of financial
technology services, we
are still dependent
on Evertec for
the provision of
essential
services
to
our
business,
including
certain
of
our
core
financial
transaction
processing
and
information
technology
and
security
services. As
a
result, we
are
particularly exposed
to
the operational
risks
of Evertec,
including those
relating to
a
breakdown or
failure of Evertec’s systems or internal controls environment. Over the course of
our relationship with Evertec, we have experienced
interruptions
and
delays
in
key
services
provided
by
Evertec,
as
well
as
cyber
breaches,
as
a
result
of
system
breakdowns,
misconfigurations
and
instances
of
application
obsolescence,
which
have
in
certain
cases
led
to
exposure
of
BPPR
customer
information.
For
a
discussion
of
the
Evertec
Business
Acquisition
Transaction,
please
refer
to
the
Year
2022
Significant Events
section of the MD&A.
While we
select third-party vendors
carefully and
have increased our
oversight of these
relationships, we do
not control
the
actions
of
our
vendors.
Any
problems
caused
by
these
vendors,
including
those
resulting
from
disruptions
in
the
services
provided, vulnerabilities in or breaches
of the vendor’s systems, failure of
the vendor to handle
current or higher volumes,
failure of
the vendor
to provide services
for any
reason or
poor performance of
services, or
failure of
the vendor to
notify us of
a reportable
event in a timely manner,
could adversely affect our ability to deliver products and services to
our customers and otherwise conduct
our
business,
result in
potential liability
to
clients
and customers,
result in
the
imposition of
fines,
penalties or
judgments by
our
regulators or
harm to
our reputation,
any of
which could
materially and
adversely affect
us. The
inability of
our third-party
service
providers to timely address
evolving cybersecurity threats may further
exacerbate these risks. Financial or
operational difficulties of
a third-party vendor could also
hurt our operations if those
difficulties interfere with the vendor’s ability to
serve us. Replacing these
third-party vendors, when possible, could also create significant
delay and expense. Accordingly,
the use of third parties
creates an
unavoidable inherent risk to our business operations.
30
The transition to new financial services technology providers, and the replacement of services currently provided
to us by
Evertec, will be lengthy and complex.
Switching from
one vendor
of core
bank processing
and related
technology and
security services
to
one
or more
new
vendors
is
a
complex
process
that
carries
business
and
financial
risks.
The
implementation
cycle
for
such
a
transition
can
be
lengthy and require significant financial and
management resources from us. Such
a transition can also expose us,
and our clients,
to
increased
costs
(including
conversion
costs),
business
disruption,
as
well
as
operational
and
cybersecurity
risks.
Upon
the
transition of all or
a portion of existing services
provided by Evertec to a
new financial services technology provider,
either (i) at the
end of the term of the Second Amended and Restated
Master Services Agreement (the “MSA”) and related
agreements or (ii) earlier
upon the
termination of any
service for
convenience under the
MSA, these transition
risks could result
in an
adverse effect
on our
business, financial condition and results of operations. Although Evertec
has agreed to provide certain transition assistance to
us in
connection with
the termination of
the MSA,
we are
ultimately dependent on
their ability
to provide
those services
in a
responsive
and competent manner. Furthermore, we
may require transition assistance from Evertec beyond the term of
the MSA, delaying and
lengthening any transition process away from Evertec
while increasing related costs.
Under the
MSA, we
are able
to terminate
services for
convenience with
180 days’
prior notice.
We expect
to exercise
during the
term of
the MSA
the right
to terminate
certain services
for convenience
and to
transition such
services to
other service
providers prior to the expiration
of the MSA, subject to
complying with the revenue minimums contemplated in
the MSA and certain
other conditions. In
practice, in order
to switch
to a
new provider for
a particular
service, we will
have to commence
procuring and
working on
a transition
process for
such service
significantly in
advance of
its termination
and, in
any case,
much earlier
than the
automatic renewal notice date or the expiration date of
the MSA, and such process may extend beyond the current
term of the MSA.
Furthermore, if
we
are
unsuccessful or
decide not
to
complete
the transition
after
expending significant
funds
and
management
resources, it could also result in an adverse
effect on our business, financial condition and results of
operations.
We are subject to additional risks relating to the
Evertec Business Acquisition Transaction.
There are numerous additional risks and uncertainties
associated with the Evertec Business Acquisition
Transaction, including:
●
unforeseen events may materially diminish the expected
benefits of the Evertec Business Acquisition Transaction;
●
we have devoted, and will continue to, devote significant attention and resources to post closing implementation efforts, which
will involve a significant degree of technological complexity
and reliance on Evertec and other third parties;
●
we may be
unable to retain the
employees and third-party contractors hired or
engaged by us in connection
with the Evertec
Business Acquisition
Transaction and who are
necessary to operate and integrate the
assets acquired as part of
the Evertec
Business Acquisition
Transaction (the “Acquired Assets”);
●
we may
be subject
to incremental
operational and
security risks
arising from
the transfer
of the
Acquired Assets
to BPPR,
including those risks arising from, among
other things, the activities required to
execute network segmentation, the possibility
of misconfiguration of access or security services during
the transition period and during the implementation
of new processes
or
security
controls,
the
possibility
of
mismanagement
of
security
services
during
the
transition
phase,
and
the
need
to
develop a robust internal control framework;
●
the anticipated benefits of the Evertec Business Acquisition
Transaction could be limited if Evertec fails to
deliver to BPPR, in
a timely manner and in a manner that meets BPPR’s requirements, the core
application programming interfaces (“Core APIs”)
that Evertec has committed
to develop in
order for BPPR to
connect future enhancements to the
Acquired Assets to existing
Evertec core applications;
●
we may be exposed to heightened business risks
as a result of the extension until
2035 of BPPR’s exclusivity with Evertec in
connection with
its merchant
acquiring business, as
well as
the extension
until 2030
of BPPR’s
commitment with respect
to
the ATH Network, in light of the pace of technology changes and competition
in the payments industry; and
●
Evertec’s strategy and investments after the
closing of the Evertec Business
Acquisition
Transaction may be refocused away
from Popular towards other strategic initiatives.
Any of the foregoing risks and uncertainties could have a
material adverse effect on our earnings, cash flows, financial
condition,
and/or stock price.
31
LEGAL AND REGULATORY RISKS
Our
businesses
are
highly
regulated,
and
the
laws
and
regulations
that
apply
to
us
have
a
significant
impact
on
our
business and operations.
We are
subject to
extensive regulation
under U.S.
federal, state
and Puerto
Rico laws
that govern
almost all
aspects of
our operations and limit the businesses
in which we may be
engaged, including regulation, supervision and examination by federal,
state and foreign banking
authorities. These laws and regulations
have expanded significantly over an
extended period of time
and
are primarily intended
for the protection
of consumers, borrowers and
depositors. Compliance with
these laws and
regulations has
resulted, and will continue to result, in significant
costs.
Additional
laws
and
regulations
may
be
enacted
or
adopted
in
the
future
that
could
significantly
affect
our
powers,
authority
and
operations and
which could
have a
material adverse
effect
on
our
financial condition
and
results
of
operations. In
particular,
we
could
be
adversely
impacted
by
changes
in
laws
and
regulations,
or
changes
in
the
application,
interpretation
or
enforcement of
laws and
regulations, that proscribe
or institute more
stringent restrictions on
certain financial
services activities or
impose new
requirements relating to
the impact of
business activities on
ESG concerns, the
management of
risks associated with
those
concerns
and
the
offering of
products
intended to
achieve ESG-related
objectives. If
we
do not
appropriately comply
with
current or
future laws
or regulations,
we may
be subject
to fines,
penalties or
judgements, or to
material regulatory restrictions
on
our business, which could also materially and adversely
affect our financial condition and results of operations.
Our participation
(or lack
of participation)
in certain
governmental programs,
such as
the Paycheck
Protection Program
(“PPP”) enacted
in response
to the
COVID-19 pandemic,
also exposes
us to
increased legal
and regulatory
risks. We
have also
been and could continue to
be exposed to adverse
action for the violation of
applicable legal requirements or the improper
conduct
of our employees in connection with such loans. For example, on January 24, 2023, Popular Bank consented to the imposition of an
order from
the Federal
Reserve Board
requiring it
to
pay a
$2.3 million
civil money
penalty to
settle certain
findings arising
from
Popular Bank’s approval of six (6) Payment Protection Program loans. We may also have credit risk with respect to PPP loans if the
SBA determines that
there have been
deficiencies in the
way a PPP
loan was originated,
funded, or serviced
by us and
denies its
liability under the guaranty,
reduces the amount of the
guaranty or, if
it has already paid
under the guaranty,
seeks recovery of any
loss related to the deficiency.
We
are from
time to
time subject
to information
requests, investigations
and other
regulatory enforcement
proceedings
from departments
of the
U.S. and
Puerto Rico
governments, including
those that
investigate compliance
with consumer
protection
laws
and
regulations, which
may
expose
us
to
significant penalties
and
collateral consequences,
and
could
result in higher compliance costs or restrictions
on our operations.
We from time-to-time self-report
compliance matters to, or receive
requests for information from, departments of
the U.S.
and Puerto
Rico governments,
including with
respect to
compliance with
consumer protection
laws and
regulations. For
example,
BPPR has
in the
past received
subpoenas and
other requests
for information
from the
departments of
the U.S.
government that
investigate
mortgage-related conduct,
mainly
concerning
real
estate
appraisals
and
residential
and
construction
loans
in
Puerto
Rico. BPPR
has also
self-identified and
reported to
applicable regulators compliance
matters related
to mortgage,
credit reporting
and other consumer lending practices.
Incidents of this nature and investigations or examinations by governmental authorities have resulted in the past, and may
in the
future result, in
judgments, settlements, fines,
enforcement actions, penalties
or other sanctions
adverse to the
Corporation,
which could materially and adversely affect the
Corporation’s business, financial condition or results of operations, or cause
serious
reputational
harm.
In
connection with
the
resolution
of
regulatory proceedings,
enforcement authorities
may
seek
admissions of
wrongdoing
and,
in
some
cases,
criminal
pleas,
which
could
lead
to
increased
exposure
to
private
litigation,
loss
of
clients
or
customers,
and
restrictions
on
offering
certain
products
or
services.
In
addition,
responding
to
information-gathering
requests,
investigations and
other regulatory
proceedings, regardless
of the
ultimate
outcome of
the matter,
could be
time-consuming and
expensive. Further, regulators in the performance of their supervisory and enforcement duties, have significant discretion and power
to
prevent
or
remedy
what
they
deem
to
be
unsafe
and
unsound
practices
or
violations
of
laws
by
banks
and
bank
holding
companies. The exercise of this regulatory discretion
and power could have a negative impact
on Popular.
Complying with economic and trade sanctions programs
and anti-money laundering laws and regulations
can increase our
operational
and
compliance
costs
and
risks.
If
we,
and
our
subsidiaries,
affiliates
or
third-party
service
providers,
are
found to
have failed
to comply
with applicable
economic and
trade sanctions
programs and
anti-money laundering
laws
and
regulations,
we
could
be
exposed
to
fines,
sanctions
and
penalties,
and
other
regulatory
actions,
as
well
as
governmental investigations.
32
As
a
federally
regulated
financial
institution,
we
must
comply
with
regulations
and
economic
and
trade
sanctions
and
embargo
programs
administered by
the
Office
of
Foreign
Assets
Control
(“OFAC”)
of
the
U.S.
Treasury,
as
well
as
anti-money
laundering laws and regulations, including those under
the Bank Secrecy Act.
Economic and trade sanctions regulations and programs administered by OFAC prohibit U.S.-based entities from entering
into or facilitating
unlicensed transactions with, for
the benefit of,
or in some
cases involving the
property and property interests
of,
persons,
governments or
countries
designated by
the
U.S.
government under
one
or
more
sanctions
regimes,
and
also
prohibit
transactions
that
provide
a
benefit
that
is
received in
a
country
designated
under
one
or
more
sanctions
regimes.
We
are
also
subject to
a variety
of reporting
and other
requirements under
the Bank
Secrecy Act,
including the
requirement to
file suspicious
activity and currency
transaction reports, that
are designed to
assist in
the detection
and prevention of
money laundering, terrorist
financing
and
other
criminal
activities.
In
addition,
as
a
financial
institution
we
are
required
to,
among
other
things,
identify
our
customers, adopt formal
and comprehensive anti-money
laundering programs, scrutinize
or altogether prohibit
certain transactions
of special concern, and be prepared to respond to inquiries from U.S.
law enforcement agencies concerning our customers and
their
transactions. Failure
by the
Corporation, its
subsidiaries, affiliates
or
third-party service
providers to
comply with
these
laws
and
regulations
could
have
serious
legal
and
reputational
consequences
for
the
Corporation,
including
the
possibility
of
regulatory
enforcement
or
other
legal
action,
including
significant
civil
and
criminal
penalties.
We
also
incur
higher
costs
and
face
greater
compliance risks in
structuring and operating
our businesses to comply
with these requirements. The
markets in which
we operate
heighten these costs and risks.
We have established risk-based policies and procedures designed to assist us
and our personnel in complying with these
applicable laws and
regulations. With respect
to OFAC
regulations and economic
and trade sanction
programs, these policies
and
procedures employ software to screen transactions for
evidence of sanctioned-country and person’s involvement. Consistent with
a
risk-based approach and the
difficulties in identifying and
where applicable, blocking and rejecting
transactions of our customers
or
our customers’ customers that may involve a sanctioned
person, government or country, there can be no assurance that our policies
and
procedures
will
prevent
us
from
violating
applicable
laws
and
regulations
in
transactions
in
which
we
engage,
and
such
violations could adversely affect our reputation, business,
financial condition and results of operations.
From time
to time
we have
identified and
voluntarily self-disclosed
to OFAC
transactions that
were not
timely identified,
blocked
or
rejected
by
our
policies,
controls
and
procedures
for
screening
transactions
that
might
violate
the
regulations
and
economic and
trade sanctions
programs administered
by OFAC.
For example,
during the
second quarter
of 2022,
BPPR entered
into
a
settlement
agreement
with
OFAC
with
respect
to
certain
transactions
processed
on
behalf
of
two
employees
of
the
Government
of
Venezuela,
in
apparent
violation
of
U.S.
sanctions
against
Venezuela.
Popular
agreed
to
pay
approximately
$256,000 to settle the
apparent violations, which had been
self disclosed to OFAC.
There can be no
assurances that any failure
to
comply with
U.S. sanctions
and embargoes,
or
with anti-money
laundering laws
and
regulations, will
not result
in material
fines,
sanctions or other penalties being imposed on us.
Furthermore, if
the policies,
controls, and
procedures of
one of
the Corporation’s
third-party service
providers, together
with our
third-party oversight
of such
providers, do
not prevent
it from
violating applicable
laws and
regulations in
transactions in
which it engages, such violations could adversely affect its
ability to provide services to us.
We
are
subject
to
regulatory
capital
adequacy
requirements,
and
if
we
fail
to
meet
these
requirements
our
business and financial condition will be adversely
affected.
Under regulatory capital adequacy requirements, and other
regulatory requirements, Popular and our banking subsidiaries
must
meet
requirements
that
include
quantitative
measures
of
assets,
liabilities
and
certain
off-balance
sheet
items,
subject
to
qualitative
judgments
by
regulators
regarding
components,
risk
weightings
and
other
factors.
If
we
fail
to
meet
these
minimum
capital
requirements
and
other
regulatory
requirements,
our
business
and
financial
condition
will
be
materially
and
adversely
affected. If
a financial
holding company
fails to
maintain well-capitalized
status under
the regulatory
framework, or
is deemed
not
well managed
under regulatory
exam procedures, or
if it
experiences certain
regulatory violations, its
status as
a financial
holding
company and its
related eligibility for
a streamlined review
process for acquisition
proposals, and its
ability to offer
certain financial
products, may be
compromised and its
financial condition and
results of operations
could be adversely
affected. The failure
of any
depository
institution
subsidiary
of
a
financial
holding
company
to
maintain
well-capitalized
or
well-managed
status
could
have
similar consequences.
In addition,
the Basel
Committee on
Banking Supervision
published a
set of
standards to
finalize Basel
III in
December
2017. These standards significantly revise the Basel capital framework, which could heighten regulatory capital standards if adopted
in the U.S. The federal bank regulators
have not yet proposed rules to implement these
revisions,
and the impact on us will depend
33
on the way
the revisions are implemented
in the U.S.
See the “Supervision and
Regulation – Capital Adequacy”
discussion in Item
1. Business of this Form 10-K for additional information
related to the Basel III Capital Rules and
Basel III finalization.
Increases in FDIC insurance premiums may
have a material adverse effect on our earnings.
Substantially all the deposits of BPPR and PB are subject to insurance up to applicable limits by the FDIC’s DIF and, as a
result, BPPR and PB are subject to FDIC deposit insurance assessments.
On October 18, 2022, the FDIC finalized a rule that would
increase initial
base deposit insurance
assessment rates by
2 basis
points, beginning with
the first
quarterly assessment period
of
2023.
We
are
generally
unable to
control the
amount
of
premiums that
we
are
required to
pay
for
FDIC
insurance. If
there
are
additional bank or financial institution failures, our level of non-performing assets increases, or our risk profile changes or our capital
position is
impaired, we
may be
required to
pay even
higher FDIC
premiums. Any
future increases
or special
assessments may
materially adversely
affect our
results of
operations. See
the “Supervision
and Regulation—FDIC Insurance”
discussion in
Item 1.
Business of this Form
10-K for additional information related to
the FDIC’s deposit insurance
assessments applicable to BPPR and
PB.
The
resolution
of
pending
litigation
and
regulatory
proceedings,
if
unfavorable,
could
have
material
adverse
financial
effects or cause significant reputational harm to
us, which, in turn, could seriously harm
our business prospects.
We
face
legal
risks
in
our
businesses,
and
the
volume
of
claims
and
amount
of
damages
and
penalties
claimed
in
litigation
and
regulatory
proceedings against
financial
institutions
remains
high.
Substantial
legal
liability
or
significant
regulatory
action
against
us
could
have
material adverse
financial
effects
or cause
significant
reputational harm
to
us,
which
in
turn
could
seriously
harm
our
business
prospects.
For
further
information
relating
to
our
legal
risk,
see
Note
24
-
“Commitments
&
Contingencies”, to the Consolidated Financial Statements in this Form 10-K.
LIQUIDITY RISKS
We are
subject to risks
related to our
own credit rating
and capital levels.
Actions by the
rating agencies or
decreases in
our capital
levels may
have adverse effects
on our
business, including by
raising the cost
of our
obligations or affecting
our ability to borrow.
Actions by the rating agencies
could raise the cost of
our borrowings, since lower rated securities
are usually required by
the market
to pay
higher rates
than obligations
of higher
credit quality.
Our credit
ratings were
reduced substantially in
2009 and,
although one of
the three major rating
agencies upgraded our senior
unsecured rating back to
“investment grade” during 2021,
the
remaining two rating agencies have not
upgraded their current “non-investment grade” rating. The
market for non-investment grade
securities is much smaller and less liquid than for investment grade securities. If we were to attempt to issue preferred stock or
debt
securities into the capital markets, it
is possible that there would not
be sufficient demand to complete
a transaction or that the
cost
could be substantially higher than for more highly
rated securities.
In
addition,
changes
in
our
ratings
and
capital
levels
could
affect
our
relationships
with
some
creditors
and
business
counterparties. For example, having
negative tangible capital may
impact our ability to
access some sources of
wholesale funding.
The Federal Housing Finance Agency
restricts the Federal Home
Loan Bank of New
York
(“FHLBNY”) from lending to members
of
the FHLBNY with negative
tangible capital unless the
member’s primary banking regulator makes a
written request to the
FHLBNY
to
maintain access
to
borrowings. Both
BPPR
and PB
have secured
borrowing facilities
with the
FHLBNY,
and
had
outstanding
exposures of $1.9
billion and $1.4 million
respectively as of December 31,
2022. Losing access to
the FHLBNY borrowing facilities
could adversely impact
liquidity at the
banking subsidiaries. Additionally,
if BPPR or
PB cease to
be well-capitalized, the
FDIA and
regulations
adopted thereunder
would
restrict
their
ability to
accept
brokered
deposits
and
limits
the
rate
of
interest
payable
on
deposits.
Our banking
subsidiaries also have
recourse obligations under
certain agreements with
third parties, including
servicing and
custodial agreements,
that include
ratings covenants.
Upon failure
to
maintain the
required credit
ratings, the
third
parties could
have the
right to
require us
to
engage a
substitute fund
custodian and
increase collateral
levels securing
recourse
obligations. Collateral pledged by
us to secure
recourse obligations approximated $29
million at December
31, 2022. Management
expects
that
we
would
be
able
to
meet
any
additional
collateral
requirements
if
and
when
needed.
The
requirements
to
post
collateral under
certain agreements
or the
loss of
custodian funds,
however,
could reduce
our liquidity
resources and
impact our
results of operations. The termination of those agreements or the
inability to realize servicing income for our businesses could have
an
adverse
effect
on
those
businesses.
Other
counterparties
are
also
sensitive
to
the
risk
of
a
ratings
downgrade
and
the
implications
for
our
businesses,
and
may
be
less
likely
to
engage
in
transactions
with
us,
or
may
only
engage
in
them
at
a
substantially higher cost, if our ratings remain below
investment grade.
34
As a holding company, we depend on dividends and distributions from
our subsidiaries for liquidity.
As a bank holding company,
we depend primarily on dividends from
our banking and other operating subsidiaries
to fund
our cash needs, including to capitalize our subsidiaries. Our banking subsidiaries, BPPR and PB, are limited by law in their ability to
make dividend
payments and other
distributions to
us based
on their earnings,
dividend history,
and capital
position. Based
on its
current financial condition,
PB may
not declare or
pay a
dividend without the
prior approval of
the Federal Reserve
Board and
the
NYSDFS. A
failure by
our banking subsidiaries
to generate
sufficient income
and free
cash flow to
make dividend
payments to
us
may
affect
our
ability to
fund
our cash
needs, which
could have
a negative
impact on
our financial
condition, liquidity,
results
of
operation or capital position. Such failure could also affect
our ability to pay dividends to our stockholders and to
repurchase shares
of our common stock. We have in the past suspended dividend payments
on our common stock and preferred stock during times of
economic uncertainty,
and there
can be
no assurance
that we
will be
able to
continue to
declare dividends to
our stockholders
in
any future periods.
An
impact
on
the
tangible
capital
levels
of
our
operating
subsidiaries,
could
also
limit
the
amount
of
capital
we
may
upstream to the holding company.
Tangible
capital levels have, and may continue to
be, adversely affected by the impact
of rapidly
rising interest rates on investment securities in our available-for-sale portfolio. For a discussion
of risks related to changes in interest
rates,
see
“Changes
in
interest
rates
and
credit
spreads
can
adversely
impact
our
financial
condition,
including
our
investment
portfolio, since a significant portion of our
business involves borrowing and lending money,
and investing in financial instruments”
in