POPULAR, INC. (BPOP) FY 2023 MD&A
This page reproduces the company's own Item 7 MD&A text from the linked SEC filing. It is filer text, not grepcent analysis, scoring, or investment advice.
results of
operations
and
capital
position.
These
risks
could
cause
our
actual
results
to
differ
materially
from
our
historical
results
or
the
results
contemplated by the forward-looking statements contained
in this report.
The risks described in
this report are not the
only risks we face. Additional
risks and uncertainties not currently
known by
us
or
that
we
currently
deem
to
be
immaterial,
or
that
are
generally
applicable
to
all
financial
institutions,
may
also
materially
adversely affect our business, financial condition, liquidity, results of operations or capital
position.
ECONOMIC AND MARKET RISKS
Weakness in
the economy,
particularly in
Puerto Rico,
where a
significant portion
of our
business is
concentrated, has
adversely impacted us in the past and may adversely
impact us in the future.
We have been, and will continue to be, impacted by global and local
economic and market conditions, including weakness
in the
economy,
disruptions and
volatility in
the financial
markets, inflation,
monetary and
fiscal policies,
public policy,
geopolitical
conflicts, business and consumer sentiment and unemployment. A significant portion of our business is concentrated
in Puerto Rico,
which accounted for approximately 77% of
our assets and 81% of
our deposits as of December 31,
2023 and 78% of our
revenues
for the
year ended
December 31,
2023. As
a result,
our financial
condition and
results of
operations are
highly dependent
on the
general
trends
of
the
Puerto
Rico
economy
and
other
conditions
affecting
Puerto
Rico
consumers
and
businesses.
The
concentration of
our operations in
Puerto Rico
exposes us to
greater risks than
other banking companies
with a
wider geographic
base.
Puerto Rico
has faced significant
economic and fiscal
challenges in the
past, including a
severe recession that
began in
2007 and
persisted for
over a
decade and
an acute
fiscal crisis
that led
the Puerto
Rico government
to file
for a
form
of federal
bankruptcy protection
in 2017.
Puerto Rico’s
fiscal and
economic challenges
have in
the past
adversely affected
our customers,
resulting
in
higher
delinquencies,
charge-offs
and
increased
losses
for
us.
While
Puerto
Rico’s
economy
has
been
gradually
recovering
and
the
Puerto
Rico
government
emerged
from
bankruptcy
in
2022,
Puerto
Rico
still
faces
economic
and
fiscal
challenges.
Moreover,
Puerto
Rico
has
historically
received
a
significant
amount
of
federal
funds
through
non-recurring
appropriations, particularly to cover costs associated with its health insurance program, and Puerto Rico’s recent economic recovery
has
been partially
driven by
significant federal
disaster relief
and stimulus
funding. Therefore,
the Puerto
Rico economy
is highly
susceptible
to
changes
in
federal
public
policy
towards
Puerto
Rico.
Public
policy
changes
that
result
in
a
reduction
of
federal
funding for Puerto
Rico, or in
delays in the
receipt of such funding,
could significantly impact Puerto
Rico’s economy.
A weakening
of the Puerto
Rico economy or other
adverse economic conditions affecting
Puerto Rico consumers and
businesses could result in
25
decreased demand
for our
products or services,
deterioration in the
credit quality
of our
customers, higher
delinquencies, charge-
offs or increased losses, all of which could adversely affect
our financial condition and results of operations.
We are
also exposed
to risks
related to
the state
of the
local economies
of the
other markets
in which
we do
business,
such as New York and Florida, and to the state of the global and U.S. economy and financial
markets. Global financial markets have
recently
experienced periods
of
extraordinary disruption
and volatility,
exacerbated by
geopolitical conflicts,
the
U.S.
debt-ceiling
situation,
high
levels
of
inflation
and
rapid
increases
in
interest
rates.
Inflationary
pressures
increased
certain
of
our
expenses
(including our
personnel expenses)
and adversely
affected consumer
sentiment. Central
bank responses
to inflationary
pressures
led to higher
market interest rates
and, in turn,
lower activity levels across
U.S. and global financial
markets. These circumstances
resulted in,
and could
continue to
result in,
reductions in
the value
of
our investments.
If these
conditions persist
or worsen,
our
results of operations, financial position and liquidity
could be materially and adversely affected.
Changes
in
interest
rates
and
credit
spreads
can
adversely
impact
our
financial
condition,
including
our
investment
portfolio,
since
a
significant
portion
of
our
business involves
borrowing
and
lending
money,
and
investing in
financial
instruments.
Our business
and financial
performance are
impacted by
market interest
rates and
movements in
those rates.
Since a
high percentage of our assets and liabilities are interest bearing or otherwise sensitive in value to changes in interest rates, changes
in interest rates, in the shape of the yield curve or in spreads between different types of rates, have had and could in the future have
a material impact on our results
of operations and the values of our
assets and liabilities, including our investment portfolio.
Interest
rates are
highly sensitive
to many
factors over
which we
have no
control and
which we
may not
be able
to anticipate
adequately,
including general
economic conditions
and the
monetary and
tax policies
of various
governmental bodies,
particularly the
Federal
Reserve Board.
Increasing levels of inflation, driven
by pent-up demand and supply-chain disruptions caused
by the COVID-19 pandemic
and the war in Ukraine, led
the Federal Market Committee of the Federal Reserve Board
(the “FOMC”) to execute a series of sharp
benchmark interest
rate increases
beginning in
the first
quarter of
2022. While
the
FOMC has
indicated that
it
may conclude
its
interest rate hike cycle, the amount and pace of any reduction in interest rates remains uncertain. Higher interest rates could lead to
fewer originations of
commercial and residential
real estate loans,
loss of deposits,
a misalignment in
the pricing of
short-term and
long-term
borrowings,
less
liquidity
in
the
financial
markets
and
higher
funding
costs.
Furthermore,
higher
interest
rates
could
negatively affect
the payment
performance on
loans linked
to variable
interest rates
to the
extent borrowers
are unable
to afford
higher interest
payments, which
could result
in higher
delinquencies. Inflationary
pressure arising
from increases
in interest
rates
may also affect
borrowers’ financial condition and
their ability to
pay their debts
when due. Additionally,
if the interest
rates we pay
on
our
deposits
and
other
borrowings
were
to
increase
at
a
faster
rate
than
the
interest
rates
we
receive
on
loans
and
other
investments,
our
net
interest
income,
and,
therefore,
our
earnings,
could
be
adversely
affected.
All
of
these
outcomes
could
adversely affect our earnings, liquidity and capital levels.
The
rapid
rise
in
interest
rates
in
2022
resulted
in
approximately
$2.5
billion
in
unrealized
mark-to-market
losses
on
available-for-sale securities held in our investment securities portfolio. In October 2022, we transferred U.S. Treasury securities with
a fair value of approximately $6.5 billion (par value of
$7.4 billion), and with accumulated unrealized losses of $873 million, from our
available-for-sale portfolio to
our held-to-maturity portfolio.
While the size
of our unrealized
mark-to-market losses on
available-for-
sale
securities
had
been
reduced
to
$1.4
billion
as
of
December
31,
2023,
if
interest
rates
were
to
again
rise
rapidly
or
for
a
prolonged period, we may accumulate significant additional mark-to-market
losses on investment securities in our available-for-sale
portfolio, which may adversely affect our tangible capital
and impact our ability to return capital to our
stockholders.
For a discussion of the Corporation’s
interest rate sensitivity, please refer
to the “Risk Management” section of the MD&A
in this Form 10-K.
BUSINESS RISKS
Negative
changes
in
the
financial
condition
of
our
clients
have
adversely
impacted
us
in
the
past
and
may
adversely
impact us in the future.
A significant portion of
our business involves lending money,
which exposes us to
credit risk and
risk of loss if
borrowers
do
not
repay
their
loans,
leases, credit
cards
or
other
credit
obligations.
The
performance of
these
credit
portfolios
significantly
affects our
financial condition
and results
of operations.
We have
in the
past been
adversely affected
by negative
changes in
the
financial condition of our clients due to weakness in
the Puerto Rico and U.S. economy. If the current economic environment were to
26
deteriorate, more customers may have difficulty in repaying their credit obligations, which may result in higher levels
of credit losses
and reserves for credit losses.
We are exposed to
increased credit risks and credit losses
to the extent our clients are
concentrated by industry segment
or type of client.
Our credit risk and credit
losses can increase to the extent
our loans are concentrated in borrowers engaged in
the same
or similar
activities or
in borrowers
who as
a group
may be
uniquely or
disproportionately affected
by certain
economic or
market
conditions. We have significant
exposure to borrowers in certain
economic sectors, such as residential
and commercial real estate,
hospitality and healthcare. Challenging economic or market conditions that affect
the industries or types of clients to
which we have
significant exposure could result in higher credit
losses and adversely affect our financial condition
and results of operations.
We also
have direct
lending and
investment exposure
to Puerto
Rico government
entities, which
have faced
significant
fiscal challenges.
At December
31, 2023,
our exposure
to the
Puerto Rico
government consisted
of $362
million in
direct lending
exposure to Puerto
Rico municipalities and
$238 million in
loans insured or
securities issued by
Puerto Rico governmental
entities
but for
which the
principal source
of repayment
is non-governmental.
We also
have indirect
lending exposure
to the
Puerto Rico
government in the
form of loans
to private borrowers
who are service
providers, lessors, suppliers
or have other
relationships with
the Puerto Rico government. While the overall fiscal situation
of the Puerto Rico government has improved in recent years,
including
as
result
of
the
government
and
certain
of
its
instrumentalities
having
restructured
their
debt
obligations,
some
Puerto
Rico
government entities, including certain municipalities, still face significant
fiscal challenges. A deterioration in the fiscal situation of the
Puerto Rico
government and its
instrumentalities, and in
particular in the
fiscal situation
of the
Puerto Rico
municipalities to
which
we have direct lending exposure, could result in
higher credit losses and reserves for credit losses. For
a discussion of risks related
to the Corporation’s credit exposure to the Puerto Rico
and USVI governments, see the Geographic and
Government Risk section in
the MD&A section of this Form 10-K.
Deterioration in the
values of real
properties securing our commercial, mortgage
loan and construction portfolios
have in
the past resulted, and may in the future result,
in increased credit losses and harm our results
of operations.
As of
December 31,
2023, approximately
55% of
our loan
portfolio consisted
of loans
secured by
real estate
collateral
(comprised of 30% in commercial loans, 22% in residential
mortgage loans and 3% in construction loans). The
value of the collateral
securing such loans is dependent upon economic conditions in the area in which the collateral is located. Weakness in the economy
of some of the
markets we serve has in
the past resulted in significant
declines in the value of
the real properties securing our
loan
portfolio, leading to increased credit losses. If the value of
the real estate properties securing our loan portfolio declines again in
the
future, we may be
required to increase our
provisions for loan losses
and allowance for loan
losses. Any such increase could
have
an adverse effect on
our financial condition and results of
operations. For more information on the credit
quality of our construction,
commercial and mortgage portfolio, see the Credit
Risk section of the MD&A included in this
Form 10-K.
We
are
exposed
to
credit
risk
from
mortgage
loans
that
have
been
sold
or
are
being
serviced
subject
to
recourse
arrangements.
Popular
is
generally
at
risk
for
mortgage
loan
defaults
from
the
time
it
funds
a
loan
until
the
time
the
loan
is
sold
or
securitized into a
mortgage-backed security.
However, we
have retained part
of the credit
risk on sales
of mortgage loans
through
recourse
arrangements,
and
we
also
service
certain
mortgage
loan
portfolios
with
recourse.
At
December
31,
2023,
we
were
exposed to credit risk with respect to $0.6 billion in residential mortgage loans sold
or serviced subject to credit recourse provisions,
consisting principally of loans associated with the Fannie Mae and
Freddie Mac programs. Pursuant to such recourse provisions,
we
are required to repurchase the loan or reimburse the third-party investor for the incurred loss in the event of a customer default. The
maximum potential amount of future payments that
we would be required to make
under the recourse arrangements in the event
of
nonperformance
by
the
borrowers
is
equivalent
to
the
total
outstanding balance
of
the
residential mortgage
loans
serviced
with
recourse
and
interest, if
applicable. In
the
event
of
nonperformance by
the borrower,
we
have
rights
to
the
underlying collateral
securing the
mortgage loan.
During 2023,
we repurchased
approximately $2
million in
mortgage loans
subject to
credit recourse
provisions. As
of December
31, 2023,
our liability
established to
cover the
estimated credit
loss exposure
related to
loans sold
or
serviced with credit recourse amounted to $4 million. We may suffer losses on these loans if the proceeds from a foreclosure sale of
the property underlying
a defaulted mortgage
loan are less
than the outstanding
principal balance of
the loan plus
any uncollected
interest advanced and the costs of holding and disposing
of the related property.
Defective and repurchased loans may harm our business
and financial condition.
27
In
connection
with
the
sale
and
securitization
of
mortgage
loans,
we
are
required
to
make
a
variety
of
customary
representations
and
warranties regarding
Popular
and
the
loans
being
sold
or
securitized.
Our
obligations with
respect to
these
representations and warranties are generally outstanding for the
life of the loan, and they
relate to, among other things, compliance
with
laws
and
regulations,
underwriting
standards,
the
accuracy
of
information
in
the
loan
documents
and
loan
file
and
the
characteristics
and
enforceability of
the
loan.
A
loan
that
does
not
comply
with
the
secondary
market’s
requirements
may
take
longer to
sell, impact
our ability
to securitize
the loans
or pledge
the loans
as collateral
for borrowings,
or be
unsalable or
salable
only
at
a
significant
discount.
Moreover,
if
any
such
loan
is
sold
before
we
detect
non-compliance,
we
may
be
obligated
to
repurchase the loan and bear any associated loss directly,
or we may be obligated to indemnify the purchaser against any loss.
We
seek to
minimize repurchases and
losses from defective
loans by correcting
flaws, if possible,
and selling or
re-selling such loans.
However,
if
we
were
to
suffer
significant
losses
from
defective
and
repurchased
loans,
our
results
of
operations
and
financial
condition could be materially impacted.
If we are
unable to maintain
or grow our
deposits, we may
be subject to
paying higher funding costs
and our net
interest
income may decrease.
We rely primarily
on bank deposits as
a low cost and
stable source of funding
for our lending activities
and the operation
of
our
business.
Therefore,
our
funding
costs
are
largely
dependent
on
our
ability
to
maintain
and
grow
our
deposits.
As
our
competitors have raised the
interest rates they pay
on deposits, our
funding costs have increased,
as we have
needed to increase
the rates we
pay to our depositors
to avoid losing deposits
and to procure new
ones. Rising interest rates
have also led customers
to move their funds to alternative investments that
pay higher interest rates.
Additionally, periods of market stress
or lack of market
or customer confidence in financial institutions may result in
a loss of customer deposits, especially to the
extent those deposits are
in excess of the FDIC-insured limit of $250,000. As of
December 31, 2023, we had $14.6 billion of deposits (other
than collateralized
public funds, which represent public deposit balances from governmental entities in the U.S. and its territories, including Puerto Rico
and the United States Virgin Islands, that are collateralized based on such jurisdictions’
applicable collateral requirements) in excess
of the FDIC-insured limit. As deposits decrease, we
may need to rely on more
expensive sources of funding. Furthermore, we have
a
significant
amount
of
deposits
from
the
Puerto
Rico
government,
its
instrumentalities
and
municipalities
($18.1
billion,
or
approximately 28% of our
total deposits, as of
December 31, 2023), and
the amount of these
deposits may fluctuate depending on
the financial
condition and
liquidity of
these entities,
as well
as on
our ability
to maintain
these customer
relationships. Under
the
terms of
BPPR’s deposit
pricing agreement
with Puerto
Rico public
sector,
public fund
deposit rates
are market
linked with
a lag
minus a
specified spread.
Therefore, as
market rates
rise, we
are required
to sequentially
increase the
rates we
pay our
public
deposits. If
we are unable
to maintain or
grow our deposits
for any
reason, we may
be subject to
paying higher funding
costs and
our net interest income may decrease.
OPERATIONAL RISKS
We
and our
third-party providers
have been,
and expect
in the
future to
continue to
be, subject
to cyber-attacks,
which
could cause substantial harm and have an adverse
effect on our business and results of operations.
Cybersecurity
risks
for
large
financial
institutions
such
as
Popular
have
increased
significantly
in
recent
years
in
part
because of
the proliferation
of new
technologies, such
as mobile
banking, artificial
intelligence and
the ability
to conduct
instant
financial transactions anywhere
globally, growing
geo-political threats, such
as the ongoing
wars in Ukraine
and in the
Gaza Strip,
and the increased sophistication and activities of
organized crime, hackers, terrorists, nation-states, hacktivists and other parties. In
the ordinary
course of
business, we
rely on
electronic communications
and information
systems to
conduct our
operations and
to
transmit
and
store
sensitive
data.
We
employ
a
layered
defensive approach
that
employs
people, processes
and
technology
to
manage and
maintain cybersecurity
controls through
a variety
of preventative
and detective
tools that
monitor, block,
and provide
alerts
regarding suspicious
activity
and
identify suspected
advanced persistent
threats.
Notwithstanding our
defensive measures
and
the
significant
resources
we
devote
to
protect
the
security
of
our
systems,
there
is
no
assurance
that
all
of
our
security
measures will be effective at all times, especially as the threats from cyber-attacks are continuous and severe. The risk of a security
breach due
to a
cyber-attack could
increase in
the future
as we
continue to
expand our
mobile banking
and other
internet-based
product
offerings,
the
use
of
the
cloud
for
system
development
and
hosting
and
internal
use
of
internet-based
products
and
applications.
We
continue to
detect and
identify attacks
that are
becoming more
sophisticated and
increasing in
volume, as
well as
attackers
that
respond
rapidly
to
changes
in
defensive
countermeasures. The
most
significant
cyber-attack
risks
that
we
or
our
critical service providers may face include, but are not limited to,
e-fraud, denial-of-service (DDoS), ransomware, computer intrusion
and
the
exploitation of
software zero-day
vulnerabilities that
might result
in
disruption of
services
and in
the
exposure or
loss of
customer
or
proprietary
data.
Loss
from
e-fraud
occurs
when
cybercriminals
compromise
our
systems
or
the
systems
of
our
28
customers and extract
funds from customer’s
credit cards or
bank accounts, including
through brute force,
password spraying and
credential
stuffing
attacks
directed
at
gaining
unauthorized
access
to
individual
accounts.
Denial-of-service
attacks
intentionally
disrupt
the
ability
of
legitimate
users,
including
customers
and
employees,
to
access
networks,
websites
and
online
resources.
Computer intrusion attempts either direct or through social engineering (pretext calls), supply chain compromise, email, text or voice
messages, including using brand impersonation (regularly referred
to as phishing, vishing, smishing
and quishing), have resulted in
and may continue to result in the compromise of sensitive customer data, such as account numbers, credit cards and social security
numbers,
and
could
present
significant
reputational, legal
and
regulatory costs
to
Popular
if
successful.
The
emergence of
new
technologies such as artificial intelligence and quantum
computing are further expected to exacerbate
the risk of cyber-attacks.
Our
customer-facing
platforms
are
also
routinely
attacked
by
threat
actors
aiming
to
gain
unauthorized
access
to
our
clients’ accounts.
Popular has
recently implemented
certain defensive
measures in
response to
brute force
attacks on
one of
our
platforms which resulted in certain
of our customers log-in credentials
and information being exposed. As
a result, Popular notified,
as required
or otherwise
deemed appropriate,
customers identified
as affected
by the
incident. We
have to
date not
experienced
material losses in connection with these attacks. Cyber-security risks have also been recently exacerbated by the discovery of zero-
day vulnerabilities in widely distributed third party software,
such as the vulnerability identified in the Apache
log4j in December 2021
and in the MOVEit file transfer application in
May 2023, which could affect Popular’s or any
of its service provider’s systems.
The
increased
use
of
remote
access
and
third-party
video
conferencing
solutions
to
enable
work-from-home
arrangements for employees and facilitate
the use of digital
channels by our customers,
has also increased our
exposure to cyber-
attacks. In
addition, a
third party
could misappropriate
confidential information
obtained by
intercepting signals
or communications
from mobile devices
used by Popular’s customers
or employees. Recent events,
including the wars
in Ukraine and
the Gaza Strip,
have also
illustrated increased
geo-political factors
and the
risks related
to supply-chain
compromises and
de-stabilizing activities
linked to
nation-state sponsored
activity as
an increasing
trend to
monitor actively.
Risks and
exposures related
to cyber
security
attacks are expected to remain high for the foreseeable future due to
the rapidly evolving nature and sophistication of these threats,
including the
rise in
the use
of cyber-attacks
as geopolitical
weapons. Although
we are
regularly targeted
by unauthorized
threat-
actor activity, including denial-of-service attacks, we have not, to date, experienced
any material losses as a result of cyber-attacks.
A material compromise or circumvention of the security of our systems could
have serious negative consequences for us,
including
significant
disruption
of
our
operations
and
those
of
our
clients,
customers
and
counterparties,
misappropriation
of
confidential information
of us
or that
of our
clients, customers,
counterparties or
employees, or
damage to
computers or
systems
used
by
us
or
by
our
clients,
customers
and
counterparties,
and
could
result
in
violations
of
applicable
privacy
and
other
laws,
financial loss
to us
or to
our customers,
loss of
confidence in
our security
measures, customer
dissatisfaction, significant litigation
exposure and harm to
our reputation, all of
which could have a
material adverse effect
on us. For example,
if personal, non-public,
confidential
or
proprietary
information
in
our
possession
were
to
be
mishandled,
misused
or
stolen,
we
could
suffer
significant
regulatory consequences, reputational damage
and financial loss.
Such mishandling, misuse
or misappropriation could include,
for
example, if such information
were provided to parties
who are not permitted
to have the
information, either by fault
of our systems,
by our employees
or counterparties, or
where such information
is intercepted or
otherwise inappropriately taken by
our employees
or third parties.
The
extent
of
a
particular
cyber-attack
and
the
steps
that
we
may
need
to
take
to
investigate
the
attack
may
not
be
immediately
clear,
and
it
may
take
a
significant
amount
of
time
before
such
an
investigation
can
be
completed.
While
such
an
investigation is ongoing, Popular may not necessarily know the full extent
of the harm caused by the cyber-attack, and that
damage
may continue to spread.
These factors may inhibit
our ability to provide
rapid, full and reliable
information about the cyber-attack to
our clients,
customers, counterparties
and regulators,
as well
as the
public. Moreover,
new regulations may
require us
to disclose
information about a cybersecurity event before
it has been resolved or
fully investigated. Furthermore, it may not
be clear how best
to
contain
and
remediate
the
potential
harm
caused
by
the
cyber-attack,
and
certain
errors
or
actions
could
be
repeated
or
compounded before they are discovered and remediated. Cyber-attacks could cause interruptions
in our operations and result in the
incurrence
of
significant
costs,
including those
related
to
forensic analysis
and
legal counsel,
each of
which may
be
required to
ascertain the extent
of any potential
harm to our
customers, or employees, or
damage to our information
systems and any
legal or
regulatory obligations that
may result therefrom.
Any cyber incidents
could also result
in, among other
things, increased regulatory
scrutiny
and adverse
regulatory or
civil
litigation consequences.
For a
discussion of
the guidance
and rules
that federal
banking
regulators
have
released
or
proposed
regarding
cybersecurity
and
cyber
risk
management
standards,
see
“Regulation
and
Supervision” in
Part
I,
Item
1 —
Business,
included in
the
Form 10-K
for the
year
ended December
31,
2023. Any
or
all
of
the
foregoing factors could further increase the impact
of the incident and thereby the costs and consequences
of a cyber-attack.
We also
rely on
third parties
for the
performance of
a significant
portion of
our information
technology functions and
the
29
provision of information security,
technology and business process services. As a result, a
successful compromise or circumvention
of
the security
of
the systems
of these
third-party service
providers could
have serious
negative consequences
for us,
including
compromise
of
our
systems,
misappropriation of
our
confidential
information
or
that
of
our
clients,
customers,
counterparties
or
employees,
or
other
negative
implications
identified
above
with
respect
to
a
cyber-attack
on
our
systems,
which
could
have
a
material
adverse effect
on
us.
Cyber-attacks at
third-party service
providers
are
also
becoming increasingly
common,
and,
as
a
result, cybersecurity risks relating to our vendors have
increased. The most important of these third-party service providers
for us is
Evertec. Certain risks particular to Evertec and
our dependence on third parties are discussed
under “We rely on other companies to
provide key components of our business infrastructure, including certain of our core financial transaction processing and information
technology and
security services, which
exposes us
to a
number of operational
risks that
could have
a material
adverse effect
on
us”
in
the
Operational
Risks
section
of