Risk Factors Dashboard
Once a year, publicly traded companies issue a comprehensive report of their business, called a 10-K. A component mandated in the 10-K is the ‘Risk Factors’ section, where companies disclose any major potential risks that they may face. This dashboard highlights all major changes and additions in new 10K reports, allowing investors to quickly identify new potential risks and opportunities.
View risk factors by ticker
Search filings by term
Risk Factors - BKU
-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing
Item 1A. Risk Factors
Our risk-based policies, procedures, and practices are integrated into our overall risk management program and have been implemented across the organization to manage and mitigate risks from cybersecurity threats. We continuously assess risks from cybersecurity threats and monitor our information systems for potential vulnerabilities. We conduct regular reviews and tests of our information security program including penetration and vulnerability testing, and other exercises to evaluate the effectiveness of our program and improve our cybersecurity posture. These evaluations provide the Company with an unbiased view of its environment and controls. All identified cybersecurity incidents, technology outages or failures and vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to impacted users and to management on a regular basis. All identified cybersecurity incidents or technology outages or failures and vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to impacted users and to management on a regular basis. A multi-step approach is applied to identify, prioritize, report, and remediate these vulnerabilities. Response and resolution times (commonly known as SLAs) are established for remediation of any incidents or outages detected, depending on their nature and potential impact. Our cybersecurity policies, procedures and practices are integrated with our overall risk management program by inclusion of cybersecurity and information systems metrics in our enterprise-wide comprehensive risk assessment process and risk appetite statement, the involvement of our Chief Risk Officer in the MAT and oversight of cybersecurity risk by our Enterprise Risk Management Committee and the Risk Committee of the Board of Directors. Our cybersecurity policies, procedures and practices are integrated with our overall risk management program by inclusion of cybersecurity and information systems KRIs in our enterprise-wide comprehensive risk assessment process and risk appetite statement, the involvement of our Chief Risk Officer in the MAT and oversight of cybersecurity risk by our Enterprise Risk Management Committee and the Risk Committee of the Board of Directors. We have engaged cybersecurity service provider experts and maintain an industry-leading incident response retainer to further enhance our cybersecurity safeguards and support our processes for assessing, identifying, and managing material risks from cybersecurity threats. Our third-party experts perform assessments that aid us in effectively detecting and responding to evolving cybersecurity threats and, in the event of a cybersecurity incident, our experts will assist us with incident response support, digital forensics and incident remediation. The Company’s third-party risk management framework and processes have been aligned with regulatory requirements and with industry best practices to oversee and identify risks from cybersecurity threats associated with use of third-party service providers. We take a risk-based approach in performing cybersecurity assessments of third-party service providers at the time of onboarding, as part of regular ongoing monitoring, at the time of contract renewal, and upon detection of any increase in risk profile. Our information security division collaborates with our third-party risk management unit to evaluate the information technology and security programs of significant third-party service providers. As applicable, these reviews evaluate the design and operational effectiveness of information technology and security related controls employed by service providers. In addition, the third-party’s information technology and security policies and procedures are evaluated to form an overall opinion of the third-party service provider's technology and information security posture. In addition, the third party’s information technology and security policies and procedures are evaluated to form an overall opinion of the third party service provider's technology and information security posture. The Risk Committee of the Board of Directors is ultimately responsible for oversight of cybersecurity risk, the Company's information risk management function, and the effective implementation of its cybersecurity program. The CISO reports routinely, typically at each of its regularly scheduled meetings, to the Risk Committee on matters including the Company's cybersecurity program, cybersecurity threats and the cybersecurity threat environment. The Risk Committee formally approves the Company's cybersecurity policy and program annually, and more frequently if material changes are adopted. At the management level, the CISO provides oversight of the ongoing technical and business functions that include cybersecurity, information assurance, network security, systems engineering, and information security management. A dedicated information security division reports to the CISO. The CISO has over 30 years of experience in information security including physical, cyber, IT, disaster recovery, business continuity planning, secure software development, and cloud services and security, among others. The CISO holds multiple designations from the International Information System Security Certification Consortium, including Certified Information Systems Security Professional and has been a member of various boards including IT, Cybersecurity and Enterprise Risk Committees. Organizationally, the CISO reports to the CRO and provides reporting directly to the Risk Committee of the Board of Directors. Organizationally, the CISO reports to the CIO, but also provides reporting directly to and has access to the Risk Committee of the Board of Directors.
An investment in our common stock is subject to risks inherent in our business. The material risks and uncertainties that management believes affect us are described below. Before making an investment decision, you should carefully consider the risks and uncertainties described below, together with all of the other information included or incorporated by reference herein. The risks and uncertainties described below are not the only ones facing us. Additional risks and uncertainties that management is not aware of or focused on or that management currently deems immaterial may also impair our business operations. If any of the events described in the risk factors should actually occur, our financial condition, results of operations and the value of our securities could be materially and adversely affected.
Strategic Risk
We may not realize the expected benefits of our business strategy.
Our fundamental business strategy is centered on building a leading regional commercial and small business bank, focused on relationship-based, granular and diversified business on both sides of the balance sheet. Our near-term strategic priorities include (i) improving the funding mix, primarily by growing core deposits and paying down high cost wholesale funding; (ii) improving risk adjusted returns by re-positioning the balance sheet away from typically lower yielding transactional business such as residential mortgages and organically growing core commercial loans, which are generally higher-yielding; (iii) managing credit quality; (iv) investing in organic growth capabilities while managing the rate of increase in expenses; and (v) maintaining robust capital and liquidity. Our near-term strategic priorities include (i) improving the funding mix, primarily by growing core deposits, while maintaining ample liquidity; (ii) improving risk adjusted returns by re-positioning the balance sheet away from typically lower yielding transactional business such as 11residential mortgages and securities and organically growing core commercial loans, which are generally higher-yielding, as a percentage of the portfolio; (iii) managing credit quality; (iv) managing the rate of increase in expenses; and (v) maintaining robust capital levels. Our ability to execute on these strategic priorities depends on a number of factors, many of which are outside of our direct control. Some of the factors that impact our ability to execute on our strategic priorities are (i) our ability to attract and retain talent; (ii) competition in our markets; (iii) fiscal, monetary and regulatory policy and the macro-economic environment; (iv) the health of our primary markets; and (v) the availability and cost of capital. Some of the factors that will impact our ability to execute on our strategic priorities are (i) our ability to attract and retain talent; (ii) competition in our markets; (iii) fiscal and monetary policy and the macro-economic environment; (iv) the health of our primary markets; and (v) the availability and cost of capital. There is no guarantee that we will be able to successfully execute our strategic plans and fundamental business strategy.
While acquisitions have not historically been a primary component of our business strategy, we may opportunistically consider potential acquisitions of financial institutions and complementary non-bank businesses. There are risks that may inhibit our ability to successfully execute such acquisitions, such as competition with other potential acquirers, the ability to obtain the required regulatory approvals in a timely matter or at all, the availability of capital and the successful integration of a consummated acquisition and realization of the expected benefits.
We face significant competition from other financial institutions and financial services providers, which may adversely impact our ability to execute on strategic objectives, our growth or profitability.
Although our geographic footprint is expanding, our business is currently concentrated in Florida and the New York tri-state area.Although our geographic presence is expanding, our business is currently concentrated in Florida and the New York tri-state area. Commercial and consumer banking in these markets is highly competitive. Our markets contain not only a large number of community and regional banks, but also a significant presence of the country's largest commercial banks. We compete with other state and national banks as well as savings and loan associations, savings banks and credit unions located in our markets as well as those targeting our markets digitally for deposits and loans. In addition, we compete with financial intermediaries, such as private credit funds, FinTech companies, consumer finance companies, marketplace lenders, mortgage banking companies, insurance companies, securities firms, mutual funds and several government agencies as well as major retailers, all actively engaged in providing various types of financial services. In addition, we compete with financial intermediaries, such as FinTech companies, consumer finance companies, marketplace lenders, mortgage banking companies, insurance companies, securities firms, mutual funds and several government agencies as well as major retailers, all actively engaged in providing various types of financial services. The variety of entities providing financial services to businesses and consumers, as well as the technologies and delivery channels through which those services are provided are rapidly evolving.
The financial services industry is likely to become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. Increased competition among financial services companies may adversely affect our ability to market our products and services. Technology has lowered barriers to entry and made it possible for financial services providers to compete in our markets without a physical footprint and enabled non-bank providers to offer a growing variety of traditional and nontraditional alternatives, such as crowdfunding, digital wallets. Technology has lowered barriers to entry and made it possible for financial services providers to compete in our markets without a physical footprint and enabled non-bank providers to offer products and services traditionally provided by banks. cryptocurrencies, and money transfer services. Many of our competitors have fewer regulatory constraints and may have lower cost structures. Additionally, due to their size or particular technology capabilities, many competitors may offer a broader range of products and services or may be able to offer better pricing for certain products and services than we can.
11
Our ability to compete successfully depends on a number of factors, including but not limited to (i) the ability to develop, maintain and build upon long-term customer relationships; (ii) our ability to pro-actively and quickly respond to technological change and emerging or unanticipated innovations in financial services; (iii) our ability to attract and retain talent; (iv) our ability to expand our market position or successfully enter new markets; (v) the scope, relevance and pricing of our products and services and our ability to respond quickly to changing customer preferences; (vi) the rate at which we introduce new products and services relative to our competitors; (vii) customer satisfaction with our level of service; and (viii) industry and general economic trends.
Failure to perform well in any of these areas or in general to successfully respond to the competitive pressures we face could make it harder for us to attract and retain customers and significantly weaken our competitive position, which could adversely affect our ability to achieve strategic objectives, our growth and profitability, which, in turn, could harm our business, financial condition and results of operations.
Major disruptive events such as but not limited to hurricanes, fires or other weather-related events, social or health-care crises such as pandemics, political or social unrest, government shutdowns, geopolitical conflict, terrorist activity or other natural or man-made disasters could disrupt our operations or otherwise have adverse impacts on our customers, our business and results of operations.
Our geographic markets in Florida and other coastal areas are particularly susceptible to severe weather, including hurricanes, flooding and damaging winds. The occurrence of a hurricane or other natural disaster, a man-made catastrophe such as terrorist activity, pandemic outbreaks and other health emergencies, political or social unrest, government shutdowns, U.S sovereign credit rating deterioration, geopolitical conflicts or other man-made or natural disasters could disrupt our operations or those of our clients or our work-force, result in damage to our facilities, jeopardize our ability to continue to provide essential services to our customers and negatively affect our customers and the local economies in which we operate. These events may lead to a decline in loan originations, an increase in deposit outflows, strain our liquidity position, reduce or destroy the value of collateral for our loans, particularly real estate, negatively impact the business operations of our customers, and cause an increase in delinquencies, foreclosures and loan losses. Our business, financial condition and results of operations may be materially, adversely impacted by these and other negative effects of such events.
Both physical and transitional risks related to climate change or societal and governmental responses, could adversely affect our business reputation and performance, including indirectly through impacts on our customers.Both physical and transitional risks related to climate change or societal and governmental responses to climate change could adversely affect our business and performance, including indirectly through impacts on our customers.
Governmental efforts to mitigate climate change and shifting consumer and business preference resulting from climate change concerns may require us and our customers to respond to new laws and regulations which may lead to cost increases, asset value reductions and operating process changes, as well as negatively impact our reputation. These impacts will vary depending on the customers' specific attributes, including reliance on or role in carbon intensive activities and may also affect us directly through a drop in demand for our products and services, reductions in creditworthiness, declines in collateral values, and the rising property and casualty insurance costs related to physical risks brought on by weather events or climate change, particularly in one of our primary market areas in Florida coastal areas which may increase our vulnerability to the ultimate impacts of climate change as compared to some of our competitors and our efforts to account for these risks may not fully protect us from negative impacts of new laws, regulations, behavioral changes, or evolving expectations of stakeholders including investors, customers, regulators, employees, and ratings agencies regarding our ESG practices. Divergent ideological and social views may create competing stakeholder, legislative, and regulatory scrutiny around ESG practices, potentially increasing costs or affecting operations. While we strive to take a balanced approach, stakeholder expectations and externally imposed requirements continue to evolve, remain uncertain, and are sometimes conflicting. If our ESG practices fail to meet these evolving rules or expectations, our reputation and ability to attract or retain employees, customers, and investors could be negatively impacted. If our ESG practices do not meet evolving rules and regulations or investor or other stakeholder expectations, then our reputation or our ability to attract or retain employees, customers and investors could be negatively impacted.
Failure to attract and retain employees may adversely impact our ability to successfully execute our business strategy
We believe that our continued growth and future success will depend in large part on the skills of our senior management team and other key personnel. We believe our senior management team possesses valuable knowledge about and experience in the banking industry that could be challenging to replicate. The composition of our senior management team and our other key personnel may change over time. Our success also depends on the experience and skills of other key personnel and on their relationships with the customers and communities they serve. Our success also depends on the experience of other key personnel and on their relationships with the customers and communities they serve. Competition, general labor market dynamics and the evolving transition around remote and hybrid work may also present challenges in recruiting and retaining talent. The loss of service of one or more of our executive officers or key personnel, or the inability to recruit and retain qualified personnel in the future, could have an adverse effect on our business, financial condition or operating results.
12
The actual or perceived financial stability of other financial institutions and in particular other regional and mid-size banks could adversely affect our business, market valuation and results of operations.
The actual or perceived financial instability of one or more other financial institutions, particularly but not necessarily limited to other regional and mid-size banks, may lead to a crisis in confidence in the financial system or particular sectors thereof, such as the regional and mid-size sector. This could lead to material unanticipated deposit outflows, threatening the safety and soundness of impacted financial institutions and/or significant market volatility and adversely impacting the stock prices of other publicly traded financial institutions, including the Company. Events such as these could materially adversely impact the Company’s liquidity, results of operations, business strategy, market valuation and capital. Moreover, the speed with which information spreads through news, social media and other sources on the Internet and the ease with which customers transact may amplify the onset of and negative effects from such perceptions.
We may need to raise additional capital in the future, and such capital may not be available when needed or at all.
BankUnited, Inc. as a BHC and BankUnited N.A. are required by Federal banking agencies to maintain specified levels of capital. At a minimum, our capital policy requires us to maintain capital sufficient to meet the “well-capitalized” standard established by capital adequacy guidelines and the regulatory framework for prompt corrective action. While we anticipate that our current capital resources will satisfy our capital requirements for the foreseeable future, we may, at some point need to raise additional capital to support current operations or continued growth. Furthermore, even if our assumptions are accurate predictors of future performance, the tools and models that utilize them may prove to be inadequate or inaccurate because of other flaws in their design or implementation. In addition, we may elect to raise capital for strategic reasons even when we are not required to do so. As a publicly traded company, the most likely source of additional capital is the issuance of equity or debt instruments in the capital markets. Our ability to raise capital on favorable terms, or at all, will depend on a variety of factors, many of which are outside of our control, including market conditions, credit availability, our credit rating and credit capacity, and marketability of our stock. Accordingly, we cannot be assured of being able to raise capital when needed or on favorable terms. In addition, if we needed to raise capital in the future, we may have to do so when many other financial institutions are also seeking to raise capital and would then have to compete with those institutions for investors. The inability to raise additional capital on favorable terms when needed could have a materially adverse effect on our business, financial condition and results of operations. In addition, the issuance of equity to raise capital may dilute the shares of our current shareholders.
A downgrade of our credit rating could increase our cost of capital or place limitations on business activities.
NRSROs regularly evaluate us, and their ratings are based on a number of factors, including our financial strength and conditions affecting the financial services industry generally.The major ratings agencies regularly evaluate us, and their ratings are based on a number of factors, including our financial strength and conditions affecting the financial services industry generally. In general, ratings agencies base their ratings on many quantitative and qualitative factors, including capital adequacy, liquidity, asset quality, business mix and level and quality of earnings and management, and we may not be able to maintain our current credit ratings. The ratings assigned to the Bank and the Company remain subject to change at any time, and it is possible that any ratings agency will take action to downgrade the Bank and the Company in the future. Additionally, ratings agencies may also make substantial changes to their ratings policies and practices, which may affect our credit ratings. A downgrade of our credit rating, particularly to a level below investment grade, could adversely impact the liquidity or value of our rated securities, our ability to access the capital or certain short-term funding markets, and our cost of capital. Additionally, certain commercial customers could be prohibited from placing deposits with us, impacting our liquidity position.
Credit Risk
As a lender, our business is highly susceptible to credit risk.
As a lender, we are exposed to the risk that our customers will be unable to repay their loans according to their terms and that the collateral securing the payment of their loans, if any, may be insufficient to ensure repayment. Credit losses are inherent in the business of making loans. We are also subject to credit risk that is embedded in our securities portfolio. Our credit risk management framework inclusive of our underwriting standards, procedures and policies may not prevent us from incurring substantial credit losses, particularly if economic or market conditions deteriorate. It is difficult to determine or forecast the many ways in which a decline in economic or market conditions may impact the credit quality of our assets.
Our ACL may not be adequate to cover actual credit losses.
We maintain an ACL that represents management's estimate of current expected credit losses, or the amount of amortized cost basis not expected to be collected, on our loan portfolio and the amount of credit loss impairment on our available for sale securities portfolio. Determining the amount of the ACL is complex and requires extensive judgment by management about matters that are inherently subjective and uncertain. The measurement of expected credit losses encompasses information about historical events, current conditions and reasonable and supportable economic forecasts. Factors that may be considered in
13
determining the amount of the ACL include, but are not necessarily limited to, product or collateral type, industry, geography, internal risk rating, credit characteristics such as credit scores or collateral values, delinquency rates, historical or expected credit loss patterns and other quantitative and qualitative factors considered by management to have an impact on the adequacy of the ACL and the ability of borrowers to repay their loans. The adequacy of the ACL is also dependent on the effectiveness of the underlying models used in determining the estimate.
If management's assumptions and judgments prove to be incorrect, our credit loss models prove to be inaccurate or our processes and controls governing the determination of the amount of the ACL prove ineffective, our ACL may be insufficient and we may be required to increase our ACL. In addition, regulatory authorities periodically review our ACL and may require us to increase our provision for credit losses or recognize further loan charge-offs, based on judgments different from those of our management. Adverse or volatile actual or forecasted economic conditions could make management's estimate even more complex and difficult to determine. Any increase in our ACL will result in a decrease in net income and capital and could have a material adverse effect on our financial condition and results of operations. See Item 7 "Management's Discussion and Analysis of Financial Condition and Results of Operations—Analysis of the Allowance for Credit Losses" and "Management's Discussion and Analysis of Financial Condition and Results of Operations—Critical Accounting Policies and Estimates—Allowance for Credit Losses."
We depend on the accuracy and completeness of information about clients and counterparties in making credit decisions.
In deciding whether to extend credit or enter into other transactions with clients and counterparties, we may rely on information furnished by or on behalf of clients and counterparties, including financial statements and other financial information. We also may rely on representations of clients and counterparties as to the accuracy and completeness of that information and, with respect to financial statements, on reports of independent auditors.
The credit quality of a substantial portion of our assets and our results of operations are affected by residential and commercial real estate values and the level of residential and commercial real estate sales and rental activity.The credit quality of our loan portfolio and results of operations are affected by residential and commercial real estate values and the level of residential and commercial real estate sales and rental activity.
A material portion of our loans are secured by residential or commercial real estate. The ability of our borrowers to repay their obligations and our financial results may therefore be adversely affected by changes in real estate values or in real estate market dynamics. Commercial real estate valuations in particular are highly subjective, as they are based on many assumptions. Such valuations can be significantly affected over relatively short periods of time by changes in business climate, economic conditions, demographic and market trends such as the impact of the ongoing shift to online shopping on retail properties or the evolution of remote and hybrid work on office properties. The value of commercial real estate and ability of commercial real estate borrowers to service debt is also sensitive to occupancy rates, the level of rents, regulatory and tax law changes, interest rates, other operating costs and, in many cases, the results of operations of businesses and other occupants of the real property. The value of commercial real estate and ability of commercial real estate borrowers to service debt is also sensitive to occupancy rates, the level of rents, regulatory changes, interest rates, other operating costs and, in many cases, the results of operations of businesses and other occupants of the real property. The properties securing income-producing investor real estate loans may not be fully leased at the origination of the loans or vacancies may arise during the terms of the loans. A borrower's ability to repay these loans is dependent upon stabilization of the properties and additional leasing through the life of the loan or the borrower's successful operation of a business. Weak economic conditions or demographic and market trends may impair a borrower's business operations, lead to elevated vacancy rates or lease turnover, slow the execution of new leases or result in falling rents. In particular, the office segment continues to be impacted by evolving trends around remote or hybrid work. In particular, the office segment continues to be impacted by the evolving trend toward remote or hybrid work. The ultimate outcome of this trend and, as a result, the level of future demand for office space, remains uncertain. Lease turnover may increase, and tenants may reduce the amount of space leased when existing leases expire. Lower occupancy rates may lead to lower rents and lower valuations of office buildings. These factors could lead to deterioration in fundamentals underlying some of our commercial real estate loans. A sustained higher interest rate environment as well as rising property and casualty insurance and other operating costs have negatively impacted and may continue to negatively impact operating cash flows for some borrowers and the ability of those borrowers to service or refinance outstanding debt. Recent increases in interest rates as well as rising property and casualty insurance and other operating costs have negatively impacted and may continue to negatively impact operating cash flows for some borrowers and the ability of those borrowers to service or refinance outstanding debt. These factors could result in further deterioration in the fundamentals underlying the commercial real estate market and the deterioration in value of some of our loans or the underlying collateral and ultimately to higher loan losses.
Similarly, residential real estate valuations can be impacted by housing trends, demographic trends, the availability of financing and property and casualty insurance at reasonable rates, the supply of available housing, governmental policy regarding housing and housing finance and general economic conditions affecting consumers. Real estate values may also be impacted by weather-related events and other man-made or natural disasters, or ultimately, by the impact of climate change.
We make credit and reserve decisions based on current and projected real estate values, the current conditions of borrowers, properties or projects and our expectations for the future. If real estate values or fundamentals underlying commercial or residential real estate decline, we could experience higher delinquencies and charge-offs beyond that provided for in the ACL.
14
The underlying collateral for a significant portion of the securities in our investment portfolio also consists of commercial or residential real estate. While we typically invest in senior tranches of these securities and their structures provide significant credit enhancement, the value and performance of underlying collateral is subject to the same risks described above. A deterioration in the value or performance of underlying collateral to an extent that credit enhancement inherent in the structure of the securities is insufficient to protect us from underlying collateral losses would result in the recognition of impairment losses and adversely impact our financial condition, results of operations and capital.
Since we engage in lending secured by real estate, we may be forced to foreclose on the collateral property and thereby be subject to risks associated with the ownership of commercial or residential real property, which could have an adverse effect on our business, financial condition or results of operations.
A significant portion of our loan portfolio is secured by residential or commercial real property. During the ordinary course of business, we may foreclose on and take title to properties securing certain loans, in which case, we are exposed to the risks and costs inherent in the ownership of real estate. The amount that we, as a mortgagee, may realize after a default is dependent upon factors outside of our control, including: (i) general or local economic conditions; (ii) sub-market property values and supply/demand dynamics; (iii) interest rates; (iv) costs of ownership such as real estate taxes, insurance, maintenance; (v) governmental rules and regulations such as but not limited to zoning laws; (vi) natural or man-made disasters; (vii) political or social unrest, crime levels and other conditions in sub-markets or neighborhoods where property is located; and (viii) the ability to maintain occupancy particularly of commercial properties. The amount that we, as a mortgagee, may realize after a default is dependent upon factors outside of our control, including: (i) general or local economic conditions; (ii) sub-market property values and supply/demand dynamics; (iii) interest rates; (iv) costs of ownership such as real estate taxes, insurance, maintenance; (v) governmental rules and regulations such as but not limited to zoning laws; (vi) natural or man-made disasters such as hurricanes or healthcare crises; (vii) political or social unrest, crime levels and other conditions in sub-markets or neighborhoods where property is located; and (viii) the ability to maintain occupancy particularly of commercial properties. Additionally, bank-owned properties obtained in foreclosure often sell at a discount to the price that might otherwise be obtained in the market.
The geographic concentration of our markets in Florida and the New York Tri-State area makes our business highly susceptible to local conditions in those markets.
While we are expanding our geographic footprint, our operations remain concentrated in Florida and the New York Tri-State area. Additionally, a significant portion of our loans secured by real estate are secured by properties in these geographic regions. Additionally, a significant portion of our loans secured by real estate are secured by commercial and residential properties in these geographic regions. The ability of our borrowers to repay their loans and the value of the collateral securing such loans may be significantly affected by economic and market conditions as well as demographic trends, the regulatory environment and tax policy in these regions, which could differ from broader national dynamics. Many of our customers in Florida have incurred or are likely to incur significantly higher property and casualty insurance premiums on their properties. This may adversely affect real estate sales and property values in Florida or negatively impact borrowers' operating cash flows or debt service capability. If, in the future, borrowers are unable to obtain property and casualty insurance, they may be unable to repay their loans in the event of catastrophic events such as hurricanes. Florida is more vulnerable to severe weather events like hurricanes than some regions of the country and may also be more susceptible in the future to the physical risks of climate change or rising sea levels. The New York region has, in the past, been a target of terrorist activity and social unrest; these events can have adverse impacts on our business operations and those of our customers. While we are not directly engaged in international business activities, businesses in both Florida and New York may be more likely than those in some other regions to be engaged in international trade and commerce, making them more susceptible to international economic disruption and unrest. Adverse regional demographic trends and tax or regulatory policy can also lead to a decline in demand for our loan or deposit products. Recently, the New York region has experienced population declines while Florida has experienced positive demographic trends.
Our portfolio of operating lease equipment is exposed to fluctuations in the demand for and valuation of the underlying assets. Many of these assets are in service to the fossil fuel industry, and subject to transition risks related to climate change.
Although we have been reducing our exposure to this business, our equipment leasing business is exposed to asset risk resulting from ownership of the equipment on operating lease. Asset risk arises from fluctuations in supply and demand for the underlying leased equipment. We are exposed to the risk that, at the end of the lease term or in the event of early termination, the value of the asset will be lower than expected, resulting in reduced future lease income over the remaining life of the asset or a lower sale value, which could lead to impairment charges or operating losses. A significant portion of our equipment under operating lease consists of railcars and other equipment used directly or indirectly by the fossil fuel industry. Demand for this equipment, rental rates and its valuation are heavily influenced by conditions in the energy industry and the impact of transition to a lower-carbon economy including related regulation and societal norms.
Interest Rate Risk
Our business is inherently highly susceptible to interest rate risk.
Our business and financial performance are materially impacted by market interest rates and movements in those rates. Since a high percentage of our assets and liabilities are interest bearing or otherwise sensitive in value to changes in interest rates, changes in rates, in the shape of the yield curve or in spreads between different types of rates can have a material impact
15
on our financial condition and results of operations and the values of our assets and liabilities. Changes in the value of investment securities available for sale and certain derivatives directly impact equity through adjustments of accumulated other comprehensive income and changes in the values of certain other assets and liabilities may directly or indirectly impact earnings. Changes in the values of assets and liabilities brought about by changes in interest rates, even those that do not directly impact reported GAAP or regulatory capital levels, may affect investors’ perceptions of the value of the Company, rating agency opinions, or customers’ perceptions of the Company’s financial strength and stability, which could result in unanticipated deposit outflows or other adverse effects. Changes in the values of assets and liabilities brought about by changes in interest rates, even those that do not directly impact reported GAAP or regulatory capital levels, may impact investors' perceptions of the value of the Company, rating agency opinions, or customers' perceptions of the stability of the Company leading to unanticipated deposit outflows. Interest rates are highly sensitive to many factors beyond our control and which we may not be able to anticipate, including general economic conditions and the monetary and fiscal policies of various governmental authorities, particularly the Federal Reserve Board. Interest rates are highly sensitive to many factors over which we have no control and which we may not be able to anticipate, including general economic conditions and the monetary and fiscal policies of various governmental bodies, particularly the Federal Reserve Board. The impact of changes in interest rates on our business and financial performance may be exacerbated if the magnitude, direction, or pace of those changes exceeds historical experience or market expectations. The impact of changes in interest rates on our business and financial performance may be exacerbated if the extent or pace of those changes are beyond historical norms.
Our earnings and cash flows depend to a great extent upon the level of our net interest income. Net interest income represents the difference between the interest income we earn on loans, investments and other interest earning assets, and the interest we pay on interest bearing liabilities, such as deposits and borrowings. Net interest income is the difference between the interest income we earn on loans, investments and other interest earning assets, and the interest we pay on interest bearing liabilities, such as deposits and borrowings. A flat or inverted yield curve or tightening credit spreads may constrain our ability to deploy assets at favorable yields and may reduce the spread between the yield on interest‑earning assets and the cost of interest-bearing liabilities, placing downward pressure on our net interest margin and net interest income. A flat or inverted yield curve or tightening credit spreads may limit our ability to add higher yielding assets to the balance sheet and reduce the spread between rates paid on deposits and those earned on interest-earning assets, placing downward pressure on our net interest margin and net interest income. Our deposit costs are generally correlated with short‑term interest rates; increases in short-term interest rates or generally tightening liquidity conditions may exert upward pressure on the rates we must pay to attract and retain deposits. Changes in interest rates can increase or decrease our net interest income, because different types of assets and liabilities may react differently, and at different times, to market interest rate changes. In a rising interest rate environment, if interest‑bearing liabilities mature or reprice more rapidly than interest‑earning assets, our net interest income may decline. If interest bearing liabilities mature or reprice more quickly than interest earning assets in a period of rising rates, net interest income will be reduced. In a declining interest rate environment, if interest‑earning assets mature or reprice more rapidly than interest‑bearing liabilities, our net interest income may likewise be adversely affected. An increase in interest rates may also reduce the demand for loans and lower‑cost deposit products, slow loan repayment activity, and negatively affect borrowers’ ability to meet their contractual obligations. An increase in interest rates may also reduce the demand for loans and lower-priced deposit products, decrease loan repayment rates and negatively affect borrowers' ability to meet their obligations. A decrease in the general level of interest rates may affect us through, among other things, increased prepayments on higher‑yielding fixed‑rate loans and mortgage‑backed securities. Competitive conditions may also impact the interest rates we are able to earn on new loans or are required to pay on deposits, negatively impacting both our ability to grow loans and deposits and our net interest income. In addition, our ability to manage interest rate risk may be adversely affected by changes in depositor behavior that differ from historical patterns, including changes in the timing, magnitude, or sensitivity of deposit movements in response to interest rate changes. Rapid or unanticipated movements in interest rates, changes in the shape of the yield curve, or changes in spreads between different types of interest rates could have an adverse effect on our net interest margin and results of operations. A rapid or unanticipated increase or decrease in interest rates, changes in the shape of the yield curve or in spreads between rates could have an adverse effect on our net interest margin and results of operations.
We attempt to manage interest rate risk by monitoring and managing the rates, maturity, repricing, mix and balances of the different types of interest earning assets and interest bearing liabilities and through the use of hedging instruments; however, interest rate risk management techniques are not precise, and we may not be able to successfully manage our interest rate risk.We attempt to manage interest rate risk by monitoring and managing the rates, maturity, repricing, mix and balances of the different types of interest-earning assets and interest bearing liabilities and through the use of hedging instruments; however, interest rate risk management techniques are not precise, and we may not be able to successfully manage our interest rate risk. The modeling and measurement techniques we use to assess and manage interest rate risk rely on a variety of assumptions, many of which are based on historical relationships, trends, and expectations, and may not accurately reflect or predict the impact of future interest rate movements or economic conditions. The modeling techniques we use to manage interest rate risk are based on a wide variety of assumptions generally derived from historical data and patterns, and may fail to accurately predict the impact of future movements in interest rates on our financial performance. Assumptions regarding depositor behavior are an integral component of our interest rate risk management processes, and changes in customer behavior, increased availability of alternative financial products, technological advances that facilitate the movement of funds, and ongoing changes in the financial services industry have made such behavior more difficult to predict. . See Item 7 "Management's Discussion and Analysis of Financial Condition and Results of Operations—Interest Rate Risk" for a discussion on the methodology and assumptions used by the Company in managing its interest rate risk. See Item 7 "Management's Discussion and Analysis of Financial Condition and Results of Operations—Analysis of the Allowance for Credit Losses" and "Management's Discussion and Analysis of Financial Condition and Results of Operations—Critical Accounting Policies and Estimates—Allowance for Credit Losses.
Liquidity Risk
A failure to maintain adequate liquidity could adversely affect our ability to sustain normal operations, our financial condition and results of operations.
Effective liquidity management is essential for the operation of our business. We require sufficient liquidity to meet customer loan requests, customer deposit maturities and withdrawals and other cash commitments under both normal operating conditions and under extraordinary or unpredictable circumstances. Our access to funding sources in amounts adequate to finance our activities on terms that are acceptable to us could be impaired by factors or events that affect us specifically, other financial institutions, or the financial services industry or economy generally. Our access to funding sources in amounts adequate to finance our activities on terms that are acceptable to us could be impaired by factors or events that affect us specifically or the financial services industry or economy generally. Factors that could detrimentally impact our access to liquidity at an acceptable price, or at all include, but are not limited to: (i) national, to a lesser extent global, and regional economic and market conditions; (ii) interest rates; (iii) competition for depositor funds from banks and other investment alternatives; (iv) the availability of sufficient collateral that is acceptable to the FHLB and the Federal Reserve Bank, both of which are significant sources of contingent liquidity for us; (v) fiscal and monetary policy; (vi) public and market perception of
16
BankUnited specifically, peer banks and the banking sector more broadly; (vii) our ability to access the capital markets as a potential liquidity source; and (viii) regulatory requirements or changes. Our access to liquidity in the form of deposits may also be affected by the liquidity needs of our depositors. A substantial portion of our liabilities consist of deposit accounts that are payable on demand or upon several days' notice, while by comparison, the majority of our assets are loans, which cannot be called or sold in the same time frame. Although we have historically been able to replace maturing deposits and borrowings as necessary, we might not be able to replace such funds in the future. A failure to maintain adequate liquidity could materially and adversely affect our ability to sustain business operations, our financial condition or results of operations.
We may be subject to material unanticipated outflows of deposits, jeopardizing our ability to maintain sufficient liquidity to conduct normal business operations.
We are susceptible to internal or external circumstances, perceptions or events, some of which we may be unable to anticipate or control or may be of an unprecedented nature, that could lead to material unexpected deposit outflows. Depositors increasingly have the ability to move funds quickly and easily using digital channels. Depositors increasingly have the ability to move funds quickly and easily. If a significant portion of our deposits were to be withdrawn within a short period of time, the Company’s liquidity, financial condition, results of operations and ability to sustain normal operations could be materially, adversely affected.
The FRB and the FHLB are important sources of both operating and contingent liquidity.The Federal Reserve Bank and the FHLB are important sources of both operating and contingent liquidity. If the availability of those liquidity sources were compromised, our business, financial condition or results of operations could be materially adversely affected.
The FRB and FHLB provide important sources of stable, reliable and specifically with respect to the FRB, emergency liquidity to banks including BankUnited. Should the availability, nature, design or provisions of the various liquidity facilities provided by these entities change materially, BankUnited's ability to access operating or contingent liquidity as needed could be adversely impacted. The availability of liquidity from these sources is also dependent on the nature and value, which could be negatively impacted by changes in interest rates or general economic and market conditions, of collateral BankUnited is able to provide and on their evaluation of the Bank's creditworthiness. The availability of liquidity from these sources is also dependent on the nature and value, which could be negatively impacted by changes in interest rates, of collateral BankUnited is able to provide and on their evaluation of the Bank's creditworthiness. A significant portion of collateral available to be pledged to the FHLB and FRB consists of loans and securities collateralized by residential and commercial real estate; the value of this collateral is subject to many of the same risks discussed above with respect to the value of real estate collateral for our loans. The FHFA, the primary regulator of the FHLB system, is actively implementing recommendations from its 2023 comprehensive review of the FHLB system. Any future regulatory or legislative action resulting from the comprehensive, multi-year implementation effort could impact the future amount, terms and availability of liquidity provided by the FHLBs to their members, including BankUnited. Our ability to access funds on a timely basis from the FRB and FHLB also depends on our operational readiness; while we test operational readiness regularly and believe our processes and procedures are adequate in this regard, a failure of those processes and procedures could compromise our ability to access needed liquidity. Our ability to access funds in a timely basis from the Federal Reserve Bank and FHLB also depends on our operational readiness; while we test operational readiness 17regularly and believe our processes and procedures are adequate in this regard, a failure of those processes and procedures could compromise our ability to access needed liquidity.
A significant percentage of our deposits are commercial deposits, many of which are uninsured.
Our business strategy is heavily focused on commercial customers, and as such, a large percentage of our deposits are commercial deposits. Inherently, due to the design and purpose of FDIC deposit insurance, across the U.S. banking system and at BankUnited, a significant portion of commercial deposits are uninsured. While we offer programs and products to our commercial customers that allow them to increase the amount of their deposits that are insured, not all depositors choose to take advantage of these programs and products. Uninsured deposits may be more subject to unanticipated outflows than insured deposits, particularly during times of systemic or institution-specific stress.
Loss of deposits or a change in deposit mix could increase our funding costs.
Deposits are typically a relatively low cost and stable source of funding. We compete with banks and other financial service providers for customer funds; as a result, we could lose deposits in the future, clients may shift their deposits into higher cost products, or we may need to raise interest rates to avoid deposit attrition. Funding costs may also increase if deposits are replaced with wholesale funding. Higher funding costs reduce our net interest margin, net interest income, and net income. A portion of our deposit base consists of companies serving the residential real estate eco-system and is exposed to the overall health and level of activity in that eco-system. In a sustained high interest rate environment, the level of residential real estate activity would be expected to decline, which may lead to reduced deposit balances in this vertical.
The inability of BankUnited, Inc. to receive dividends from its subsidiary bank could have a material adverse effect on the ability of BankUnited, Inc. to make payments on its debt, pay cash dividends to its shareholders or execute share repurchases.
BankUnited, Inc. is a separate and distinct legal entity from the Bank, and the substantial majority of its revenue consists of dividends from the Bank. These dividends are the primary funding source for the dividends paid by BankUnited, Inc. on its common stock, the interest and principal payments on its debt and any repurchases of outstanding common stock. Various
17
federal and state laws and regulations limit the amount of dividends that a bank may pay to its parent company. In addition, our right to participate in a distribution of assets upon the liquidation or reorganization of a subsidiary may be subject to the prior claims of the subsidiary’s depositors and other creditors. If the Bank is unable to pay dividends, BankUnited, Inc. might not be able to service its debt, pay its obligations, pay dividends on its common stock or make share repurchases.
Operational Risk
We rely on analytical and forecasting models and tools that may prove to be inadequate or inaccurate, which could adversely impact the effectiveness of our strategic planning, the quality of certain accounting estimates including the ACL, the effectiveness of our risk management framework including but not limited to credit, interest rate and liquidity risk monitoring and management and thereby our results of operations.
The processes we use to forecast future performance and estimate expected credit losses, fair values of certain assets and liabilities and other significant accounting estimates, including in hypothetical periods of stress, the effects of changing interest rates, sources and uses of liquidity, real estate values, and economic trends and indicators on our financial condition and results of operations depend upon the use of analytical and forecasting tools and models.The processes we use to forecast future performance and estimate expected credit losses, including in hypothetical periods of stress, the effects of changing interest rates, sources and uses of liquidity, real estate values, and economic trends and indicators on our financial condition and results of operations depend upon the use of analytical and forecasting tools and models. These tools and models reflect assumptions that may prove inaccurate, particularly in times of market stress, volatility or other unforeseen or unprecedented circumstances. These tools and models reflect assumptions that may not be accurate, particularly in times of market stress or other unforeseen or unprecedented circumstances. Furthermore, even if our assumptions are accurate predictors of future performance, the tools and models that utilize them may prove to be inadequate or inaccurate because of other flaws in their design or implementation. If these tools prove to be inadequate or inaccurate, our strategic planning processes, risk management and monitoring framework, earnings and capital may be adversely impacted.
New lines of business, new products and services or strategic project initiatives may subject us to additional operational risks, and the failure to successfully implement these initiatives could affect our reputation and results of operations.
From time to time, we may launch new verticals or lines of business, expand into new geographies or offer new or modified banking products and services, which offerings may significantly increase operational, credit or reputational risks.From time to time, we may launch new lines of business, expand into new geographies or offer new banking products and services, which offerings may significantly increase operational, credit or reputational risks. Significant effort and resources may be required to manage and oversee the successful development, implementation, risk assessment, launch or scaling of new initiatives, which effort and resources may be diverted from other of our products or services. While we invest significant time and resources in developing, marketing and managing new products and services, there are material uncertainties that could adversely impact estimated implementation and operational costs or projected adoption, sales, revenues or profits, and no assurance can be given that any new offerings will be successfully developed, implemented, launched or scaled. New products and services may require startup and ongoing marketing costs and operational changes. The inability to successfully roll out new products and services may result in unmet profitability targets, increased costs, loss of customers or competitive advantage or other adverse impacts on our business and results of operations.
We are subject to the risk of fraud, theft or errors by employees or outsiders and to the impact of ineffective processes and controls, which may adversely affect our business, financial condition and results of operations.
We are exposed to the risk of fraud or theft by employees or outsiders and to operational errors, including clerical or record-keeping errors, the impact of ineffective processes and controls or faulty or disabled technology. Events such as these could cause us to suffer financial loss, the loss of customers, regulatory action and damage to our reputation.
Because the nature of the financial services business involves a high volume of transactions, certain errors may be repeated or compounded before they are discovered and successfully rectified. Our necessary dependence on automated systems to record and process transactions and our large transaction volume may further increase the risk that technical flaws or employee tampering or manipulation of those systems will result in losses that are difficult to detect. Our necessary dependence upon automated systems to record and process transactions and our large transaction volume may further increase the risk that technical flaws or employee tampering or manipulation of those systems will result in losses that are difficult to detect. The occurrence of any of these events could result in a diminished ability to operate our business as well as potential liability to customers and counterparties, reputational damage and regulatory intervention, which could adversely affect our business, financial condition or results of operations.
While we regularly monitor, evaluate and update our internal control framework including controls over financial reporting and corporate governance policies and procedures, any system of controls, however well designed and operated, can provide only reasonable, not absolute, assurances that the objectives of the controls are met. Failure of our system of controls and procedures could have a material adverse effect on our financial condition and results of operations.
We are dependent on our information technology and telecommunications systems. System failures or interruptions could have an adverse effect on our business, reputation, financial condition and results of operations. System failures or interruptions could have an adverse effect on our business, financial condition and results of operations.
Our business is highly dependent on the successful and uninterrupted functioning of our information technology, internet and network connectivity and telecommunications systems. We rely on these systems and connectivity to process new and
18
renewed loans, gather deposits, process customer and other transactions, provide customer service, facilitate collections, facilitate remote work and share data across our organization. The failure of these systems and technologies could interrupt our operations. We may be subject to disruptions of our information technology and telecommunications systems arising from events that are wholly or partially beyond our control which may give rise to disruption of service to customers and of our employees' ability to perform their jobs. Because our information technology and telecommunications systems interface with and depend on third-party systems, we could experience service denials if demand for such services exceeds capacity or such third-party systems fail or experience interruptions. If sustained or repeated, a system failure or service denial could result in a deterioration of our ability to process new and renewed loans, gather deposits, process customer transactions, provide customer service, compromise our ability to operate effectively, damage our reputation, result in a loss of customer business, and/or subject us to additional regulatory scrutiny and possible financial liability, any of which could have a material adverse effect on our financial condition and results of operations.
We are highly dependent on third-party service providers for significant aspects of our business infrastructure, information technology, and telecommunications systems.We are dependent on third-party service providers for significant aspects of our business infrastructure, information technology, and telecommunications systems.
We rely on third parties to provide key components of our business infrastructure and major systems including, but not limited to, core banking systems such as loan servicing and deposit transaction processing systems, cloud-based data storage, our electronic funds transfer transaction processing, cash management, online banking services, ERP systems and computer and networking infrastructure. We have migrated a significant portion of our core information technology systems, data storage and customer-facing applications to private and public cloud infrastructure platforms. If we fail to administer these environments in a well-managed, secure and effective manner, or if these platforms become unavailable or do not meet their service level agreements for any reason, we may experience unplanned service disruption or unforeseen costs which could result in material harm to our business, reputation, financial condition and results of operations. We must successfully develop and maintain information, financial reporting, disclosure, data-protection and other controls adapted to our reliance on outside platforms and providers. In addition, service providers could experience system breakdowns or failures, outages, downtime, cyber-attacks, adverse changes to financial condition, bankruptcy, or other adverse conditions, which could have a material adverse effect on our business and reputation. While we have an established third-party risk management framework and select and monitor the performance of third-party vendors carefully, we do not control their actions. Any problems caused by these third parties, including those resulting from disruptions in communication services provided by a third party, failure of a third party to handle current or higher volumes, failure of a third party to provide services for any reason or poor performance of services, or the termination of a third-party software license or service agreement on which any of these systems is based, could adversely affect our ability to deliver products and services to our customers and otherwise conduct our business. In many cases, our operations rely heavily on the secure processing, storage and transmission of information and the monitoring of a large number of transactions on a minute-by-minute basis, and even a short interruption in service could have significant consequences. Financial or operational difficulties of a third-party service provider could adversely affect our operations if those difficulties interfere with the service provider's ability to serve us effectively or at all. Replacing these third-party service providers could create significant delays and expense. Accordingly, use of such third party service providers creates an unavoidable material inherent risk to our business operations.
We are at risk of cybersecurity incidents, defined as any unauthorized occurrence, or series of related unauthorized occurrences, on or conducted through our information systems, including those of third-party service providers that we rely on, that jeopardizes the confidentiality, integrity or availability of those information systems or information residing therein.A cybersecurity incident, which is any unauthorized occurrence, or series of related unauthorized occurrences, on or conducted through our information systems, including those of third-party service providers that we rely on, that jeopardizes the confidentiality, integrity or availability of those information systems or information residing therein.
In the normal course of business, we collect, process, and retain sensitive and confidential client and customer information. Despite the security measures we and our third party service providers have in place, information systems may be vulnerable to cybersecurity incidents. Cybersecurity incidents can take many forms including cyber-attacks, security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming and/or human errors, or other similar events, especially because, in the case of any intentional breaches, the techniques used change frequently or may not be recognized until launched, and cyber-attacks can originate from a wide variety of sources.
We provide our customers the ability to bank remotely, including online, via mobile devices and over the telephone. The secure transmission of confidential information over the internet and other remote channels is a critical element of remote banking. Our network could be vulnerable to unauthorized access, computer viruses, social engineering schemes and other security breaches. Our network could be vulnerable to unauthorized access, computer viruses, phishing schemes and other security breaches. In addition to cybersecurity incidents involving the theft of sensitive and confidential information, hackers have engaged in attacks against financial institutions, particularly denial of service attacks, designed to disrupt key business services such as customer-facing websites. In addition to cybersecurity incidents involving the theft of sensitive and confidential information, hackers have engaged in attacks against financial institutions, particularly denial of service attacks, designed to disrupt key business services such as customer-facing websites. We may be required to spend significant capital and other resources to protect against the threat of cybersecurity incidents, or to alleviate problems caused by cybersecurity incidents. Any cybersecurity incident involving the misappropriation, loss or other unauthorized disclosure of confidential customer information could severely damage our reputation, erode confidence in the security of our systems, products and services, expose us to the risk of litigation and liability, disrupt our operations and have a material adverse effect on our business.
19
In addition, we interact with and rely on financial counterparties for whom we process transactions and who process transactions for us and rely on other third-party service providers, as discussed above. Each of these third parties may be targets of the same types of cybersecurity incidents described above. The measures that they maintain to mitigate the risk of such activity may be different from our own and, in many cases, we do not have any control over the types of security measures they may choose to implement. We may incur costs as a result of data or security breaches of third parties with whom we do not have a significant direct relationship. As a result of financial entities and technology systems becoming more interdependent and complex, a cybersecurity incident, information breach or loss, or technology failure that compromises the systems or data of one or more financial entities could have a material impact on counterparties or other market participants, including us.
Concerns regarding the effectiveness of our measures to safeguard personal information, or even the perception that such measures are inadequate, could cause us to lose customers or potential customers and thereby reduce our revenues. If another financial institution experiences a material cybersecurity incident, even if we are not directly impacted in any way, negative publicity about the incident could impact confidence in the banking system generally, including in BankUnited.
See "Item 1C - Cybersecurity. Also see "Item 1C - Cybersecurity. " for further discussion of measures we have taken to implement safeguards with respect to cybersecurity incidents.
The risk inherent in the adoption and implementation of new technologies, or the failure to keep pace with technological innovation may result in reputational harm, increased regulatory scrutiny, increased liability, heightened operational risk, an adverse impact on our ability to compete for loans and deposits and serve our customers, and an adverse impact on our business, financial condition and results of operations.
The financial services industry continues to experience rapid and significant technological change; financial products and services have become increasingly technology driven. Our ability to meet the needs of our customers competitively and in a cost-efficient manner is dependent on our ability to keep pace with and pro-actively and quickly respond to technological advances and to invest in relevant new technology as it becomes available. Many of our larger competitors have greater resources to invest in technology than we do and may be better equipped to market new technology-driven products and services. The widespread adoption of new technologies, including, but not limited to, digitally enabled products and delivery channels, payment systems and technologies supporting back-office and risk management capabilities could require us to incur substantial cost and effort to acquire new technology platforms, modify or adapt our existing products and services, infrastructure and control environment, to upskill our workforce and to modify related operational processes and procedures. Our operational change management framework may fail to effectively mitigate the operational risk and disruption inherent in or to remedy any challenges associated with the adoption of new technology. Our third-party service providers also regularly incorporate technological changes in the platforms and services they provide to us; while we regularly monitor and test their impact, we may have limited or no control over their implementation and are reliant on the third-party service providers for successful development and implementation of these changes.
Generative and Agentic AI are emerging technologies that present both opportunities and risks to users. While our current use of AI is not material to our operations, its evolving use is subject to risks that algorithms and datasets are flawed or may be insufficient, poorly suited to purpose or contain biased information. The models used and results generated by AI and machine learning are not always transparent, which could increase the risk of unintended deficiencies. These deficiencies could result in inaccurate or ineffective decisions, predictions or analyses, which could subject our business to competitive harm, legal liability, increased regulatory scrutiny, reputational harm or other consequences that we may not be able to predict, any of which could negatively affect our business, financial condition and results of operations. Our failure to comply with these laws and regulations, even if the failure follows good faith effort or reflects a difference in interpretation, could subject us to restrictions on our business activities, fines, remedial actions, administrative orders and other penalties, any of which could adversely affect our reputation, results of operations and capital base. The expanded adoption of AI may exacerbate the frequency and effectiveness of cybersecurity incidents. In addition, we expect our third-party service providers
20
to increasingly incorporate AI capabilities into their product offerings; our third party risk management framework may be inadequate to fully mitigate the associated risks.
Widespread adoption and rapid evolution of, as well as developments in the regulatory landscape relating to emerging technologies, including AI, automated decision-making, and digital assets, such as cryptocurrencies, including stablecoins, tokens and other crypto assets that utilize distributed ledger technology, create additional strategic risks, could negatively impact our ability to compete and require substantial expenditures to the extent we were to modify or adapt our existing products and services. As new technologies evolve and mature, our businesses and results of operations could be adversely impacted, including as a result of new competitors and increased volatility in deposits and/or significant long-term reduction in deposits. Our failure to keep pace with technological innovation, to successfully implement enhanced and emerging technologies or to fully realize their benefits could have a material adverse impact on our business, financial condition and results of operations.
The soundness of other financial institutions, particularly our financial institution counterparties, could adversely affect us.
Our ability to engage in routine funding and other transactions could be adversely affected by the stability and actions of other financial services institutions. Financial services institutions are interrelated as a result of trading, clearing, servicing, counterparty, and other relationships. We have exposure to an increasing number of financial institutions and counterparties. These counterparties include institutions that may be exposed to various risks over which we have little or no control.
Adverse developments affecting the overall strength and soundness of the financial services industry as a whole and third parties with whom we have important relationships could have a negative impact on our business even if we are not directly subject to the same adverse developments.
Regulatory, Legal and Compliance Risk
As a BHC, we and BankUnited operate in a highly regulated environment and the laws and regulations that apply to us, changes in them, or our failure to comply with them, may adversely affect us.
We operate in a highly regulated environment, and are subject to comprehensive statutory, legal and regulatory regimes.We operate in a highly regulated environment, and are subject to comprehensive statutory, legal and regulatory regimes, see Item 1 "Business—Regulation and Supervision. See Item 1 "Business—Regulation and Supervision." Intended to protect customers, depositors, the DIF, and the overall financial stability of the United States, these laws and regulations, among other matters, prescribe capital and liquidity requirements, impose limitations on the business activities in which we can engage, limit the dividend or distributions that BankUnited can pay to BankUnited, Inc., restrict the ability of institutions to guarantee our debt, and impose specific accounting and reporting requirements on us. Banking regulators may also from time to time focus on issues that may impact the pace of growth of our business, our ability to execute our business strategy and our operations. Compliance with laws and regulations can be difficult and costly, and changes to laws and regulations often impose additional costs. In addition, federal banking agencies including the OCC, Federal Reserve Board and CFPB periodically conduct examinations of our business, including compliance with laws and regulations. Our failure to comply with these laws and regulations, and to effectively navigate this complex regulatory landscape, even if the failure follows good faith effort or reflects a difference in interpretation, could subject us to restrictions on our business activities, fines, remedial actions, administrative orders and other penalties, any of which could adversely affect our reputation, results of operations and capital base. Our failure to comply with these laws and regulations, even if the failure follows good faith effort or reflects a difference in interpretation, could subject us to restrictions on our business activities, fines, remedial actions, administrative orders and other penalties, any of which could adversely affect our reputation, results of operations and capital base.
Further, federal, state and local legislators and regulators regularly introduce measures or take actions that would modify the regulatory requirements applicable to banks, their holding companies and other financial institutions. Changes in laws, regulations or regulatory policies could adversely affect the operating environment for the Company in substantial and unpredictable ways, increase our cost of doing business, impose new restrictions on the way in which we conduct our operations or add significant operational constraints that might impair our profitability. We cannot predict whether new legislation will be enacted and, if enacted, the effect that it, or any implementing regulations, would have on our business, financial condition or results of operations.
Changes in political administrations are likely to introduce new or modified regulations and related regulatory guidance and supervisory oversight. The current administration's regulatory reform agenda has impacted, and we expect it will continue to impact, the rulemaking, supervision, examination and enforcement priorities of the federal banking agencies. Newly enacted laws, regulations, or executive orders may significantly impact the regulatory framework in which we operate and may require material changes to our business processes in short time frames. Newly enacted laws may significantly impact the regulatory framework in which we operate and may require material changes to our business processes in short time frames. Inability to meet new statutory requirements within the prescribed periods could adversely affect our business, financial condition and results of operations, as well as impact our reputation.
21
Our ability to expand through acquisition or de novo branching requires regulatory approvals, and failure to obtain them may restrict our growth.
Although acquisitions have not historically been a material part of our growth strategy, we may identify opportunities to complement and expand our business by pursuing strategic acquisitions of financial institutions and other complementary businesses. We must generally receive federal regulatory approval before we can acquire an institution or business. In determining whether to approve a proposed acquisition, federal banking regulators will consider, among a number of other qualitative and quantitative factors, the effect of the acquisition on competition, the impact on communities served by the acquiring and target institution, the impact on compliance with the CRA and BSA/AML laws and regulations, our financial condition, our future prospects, and the impact of the proposal on U.S. financial stability. Regulatory approvals may not be granted on terms that are acceptable to us, or at all. We may also be required to sell or close branches, or precluded from doing so, as a condition to receiving regulatory approval, which condition may not be acceptable to us or, if acceptable to us, may reduce the benefit of any acquisition. We may continue de novo branching as a part of our organic growth strategy and possibly enter into new markets through de novo branching. The failure to obtain regulatory approvals for potential future strategic acquisitions and de novo branches may impact our business plans and restrict our growth.
Financial institutions, such as BankUnited, face a risk of noncompliance and enforcement action with the Bank Secrecy Act and other anti-money laundering statutes and regulations. Financial institutions, such as BankUnited, face a risk of noncompliance and enforcement action with the Bank Secrecy Act and other anti-money laundering statutes and regulations.
The Bank Secrecy Act, the USA PATRIOT Act, and other laws and regulations require financial institutions, among other duties, to institute and maintain an effective anti-money laundering program and file suspicious activity and currency transaction reports as appropriate. Financial institutions are also required to comply with sanctions and programs administered by OFAC. Financial institutions are also required to comply with sanctions and programs administered by the Office of Foreign Assets Control. Numerous regulatory agencies and other governmental departments are involved in enforcement and administration of these provisions.
We dedicate significant resources to ongoing compliance with these laws and regulations, continuously monitor and enhance as necessary related policies and procedures and maintain a robust automated anti-money laundering software solution. If our policies, procedures and systems are deemed deficient, we could be subject to liability, including significant civil monetary fines and to various regulatory actions such as restrictions on our ability to pay dividends, the inability to obtain approval of any contemplated acquisitions and restrictions on our ability to execute certain aspects of our business and expansion plans.
We are subject to the CRA and fair lending laws, and failure to comply with these laws could lead to material penalties.
The CRA, the Equal Credit Opportunity Act, the Fair Housing Act and other fair lending laws and regulations impose nondiscriminatory lending requirements on financial institutions. The Department of Justice and other federal agencies are responsible for enforcing these laws and regulations. A successful challenge to an institution's performance under the CRA or fair lending laws and regulations could result in a wide variety of sanctions, including the required payment of damages and civil money penalties, injunctive relief, imposition of restrictions on mergers and acquisitions activity, and restrictions on expansion activity. Private parties may also have the ability to challenge an institution's performance under fair lending laws in private class action litigation.
Any future FDIC assessments could adversely affect our earnings.
Insured depository institutions such as BankUnited are required to pay deposit insurance premiums to the FDIC, which maintains a DIF. If the current level of deposit premiums is insufficient for the DIF to meet its funding requirements in the future, special assessments or increases in deposit insurance premiums may be required. A change in BankUnited's risk classification within the FDIC's risk-based assessment framework could also result in increased deposit insurance premiums.
We are generally unable to control the amount of premiums that we are required to pay for FDIC insurance. There is also a risk that BankUnited’s deposit insurance premiums will further increase if failures of insured depository institutions deplete the DIF or if the FDIC changes its view of the risk BankUnited poses to the DIF or otherwise increases the assessment rate adjustment applicable to BankUnited’s deposits. There is also a risk that BankUnited’s deposit insurance premiums will further increase if additional failures of insured depository institutions further deplete the DIF or if the FDIC changes its view of the risk BankUnited poses to the DIF or otherwise increases the assessment rate adjustment applicable to BankUnited’s deposits. Any future increases in FDIC insurance premiums or additional assessments may adversely affect our financial condition or results of operations.
We are subject to laws regarding the privacy, information security and protection of personal information and any violation of these laws or another incident involving personal, confidential or proprietary information of individuals could damage our reputation, lead to monetary settlements or penalties and otherwise adversely affect our operations and financial condition.
Our business requires the collection and retention of large volumes of customer data, including personally identifiable information in various information systems that we maintain and in those maintained by third party service providers. We are
22
subject to complex and evolving laws and regulations governing the privacy and protection of personal information of individuals (including customers, employees, suppliers and other third parties). For example, our business is subject to the Gramm-Leach-Bliley Act which, among other things: (i) imposes certain limitations on our ability to share nonpublic personal information about our customers with non-affiliated third parties; (ii) requires that we provide certain disclosures to customers about our information collection, sharing and security practices and afford customers the right to “opt out” of any information sharing by us with non-affiliated third parties (with certain exceptions); and (iii) requires that we develop, implement and maintain a written comprehensive information security program. For example, our business is subject to the Gramm-Leach-Bliley Act which, among other things: (i) imposes certain limitations on our ability to share nonpublic personal information about our customers with non-affiliated third parties; (ii) requires that we provide certain disclosures to customers about our information collection, sharing and security practices and afford customers the right to “opt out” of any information sharing by us with non-affiliated third parties (with certain exceptions); and (iii) requires that we develop, implement and maintain a written comprehensive information security program containing appropriate safeguards based on our size and complexity, the nature and scope of our activities, and the sensitivity of customer information we process, as well as plans for responding to data security breaches. Various state and federal banking regulators and states have also enacted data security breach notification requirements with varying levels of individual, consumer, regulatory or law enforcement notification in certain circumstances in the event of a security breach. Ensuring that our collection, use, transfer and storage of personal information complies with all applicable laws and regulations increases our costs. Furthermore, we may not be able to ensure that all of our customers, suppliers, counterparties and other third parties have appropriate controls in place to protect the confidentiality of the information that they exchange with us, particularly where such information is transmitted by electronic means. If personal, confidential or proprietary information of customers or others were to be mishandled or misused, we could be exposed to litigation or regulatory sanctions under personal information laws and regulations. Laws and regulations in this area are evolving, and there is a reasonable possibility that additional or modified laws or regulations applicable to us will be enacted. We may incur significant costs to comply with any such new or modified laws or regulations, or our efforts to do so may not be effective. Any failure or perceived failure to comply with applicable privacy or data protection laws and regulations may subject us to inquiries, examinations and investigations that could result in requirements to modify or cease certain operations or practices or in significant liabilities, fines or penalties, and could damage our reputation and otherwise adversely affect our operations and financial condition.
General Risk Factors
Our business may be adversely affected by conditions in the financial markets and economic conditions generally.
Heightened levels of economic uncertainty, volatility or deterioration in business or economic conditions generally, or more specifically in the principal markets in which we do business could have material adverse effects on our business, financial condition and results of operations. These effects may include but are not necessarily limited to: (i) a decrease in demand for our products and services; (ii) an increase in delinquencies and defaults by borrowers or counterparties leading to increased credit losses; (iii) a decline in the value of our assets; (iv) a decrease in earnings; (v) a decline in liquidity and (vi) a decrease in our ability to access the capital markets. We may be negatively affected by the volatility and uncertainty related to inflation and the effects of inflation. Prolonged periods of inflation may lead to an increase in our operating expenses or those of our clients, in turn impacting borrowers' ability to repay their obligations to us. Loan demand could also be negatively impacted. The imposition of tariffs or immigration reform could directly or indirectly adversely impact our clients businesses, and in turn demand for our loan and deposit products or borrowers' ability to repay their loans.
Damage to our reputation could adversely affect our operating results.
Our ability to originate new business and maintain existing customer relationships is highly dependent upon customer and other external perceptions of our business practices. Adverse perceptions regarding our business practices, or those of other regional banks, could damage our reputation in the customer, funding and capital markets, leading to difficulties in generating and maintaining business as well as obtaining financing. Negative public opinion can result from our actual or alleged conduct in any number of activities, including lending practices, employee relations, corporate governance and acquisitions and from actions taken by government regulators and community organizations in response to those activities. The proliferation of social media may increase the likelihood that negative public opinion from any real or perceived events could impact our reputation and business. Adverse developments with respect to external perceptions regarding the practices of our competitors, or our industry as a whole, or the general economic climate may also adversely impact our reputation. These perceptions about us could cause our business to be negatively affected and exacerbate the other risks that we face. In addition, adverse reputational impacts on third parties with whom we have important relationships may adversely impact our reputation. Adverse reputational impacts or events may also increase our litigation risk.
Our enterprise risk management framework may not be effective in mitigating the risks to which we are subject, or in reducing the potential for losses in connection with such risks.
Our enterprise risk management framework is designed to identify, measure, mitigate and manage the risks to which we are subject, as well as any losses stemming from such risks. Although we seek to identify, measure, monitor, report, and control our exposure to such risks, and employ a broad and diversified set of risk monitoring and mitigation techniques in the process, those techniques are inherently limited in their ability to anticipate the existence or development of risks that are currently unknown and unanticipated. The ineffectiveness of our enterprise risk management framework in mitigating the impact of known risks or
23
the emergence of previously unknown or unanticipated risks may result in our incurring losses in the future that could adversely impact our financial condition and results of operations.
Our reported financial results depend on management's selection and application of accounting policies and methods and related assumptions and estimates.
Our accounting policies and estimates are fundamental to our reported financial condition and results of operations. Management is required to make difficult, complex or subjective judgments in selecting and applying many of these accounting policies. In some cases, management must select an accounting policy or method from two or more alternatives, any of which may be reasonable under the circumstances, yet may result in us reporting materially different results than would have been reported under a different alternative. From time to time, the FASB and SEC may change the financial accounting and reporting standards that govern the preparation of our financial statements.From time to time, the FASB and SEC may change the financial accounting and reporting standards that govern the preparation of our financial statements. These changes can be difficult to predict and can materially impact our reported financial condition and results of operations. In some cases, we could be required to apply a new or revised standard retrospectively, resulting in a restatement of prior period financial statements. See Note 1 to the consolidated financial statements for more information about our accounting policies and recent accounting pronouncements that may have a material impact on our reported financial results. See Note 1 to the consolidated financial statements for more information about recent accounting pronouncements that may have a material impact on our reported financial results.
Changes in taxes and other assessments may adversely affect us.
The legislatures and taxing authorities in the tax jurisdictions in which we operate regularly enact reforms to the tax and other assessment regimes to which we and our customers are subject. The effects of these changes and any other changes that result from interpreting and implementing regulations or enactment of additional tax reforms cannot be quantified and there can be no assurance that any such reforms would not have an adverse effect upon our business. Tax laws are complex and subject to different interpretations by the taxpayer and relevant governmental taxing authorities, which are sometimes subject to prolonged evaluation periods until a final resolution is reached. In establishing a provision for income tax expense, filing returns and establishing the value of deferred tax assets and liabilities for purposes of its financial statements, the Company must make judgments and interpretations about the application of these inherently complex tax laws. If the judgments, estimates and assumptions the Company uses in establishing provisions, preparing its tax returns or establishing the value of deferred tax assets and liabilities for purposes of its financial statements are subsequently found to be incorrect, there could be a material effect on our financial condition and results of operations.
The price of our common stock may be volatile or may decline.
The price of our common stock may be volatile or may decline. The price of our common stock may fluctuate as a result of a number of factors, many of which are external events outside of management's control. In addition, the stock market is subject to broad or systemic fluctuations in share prices and trading volumes that affect the market prices of the shares of many companies, including BankUnited, Inc. Factors that could affect our stock price include but are not limited to: (i) actual or anticipated changes in the Company's operating results or financial condition; (ii) performance of the regional banking sector; (iii) failure to meet analysts' estimates; (iv) actual or forecasted macro-economic conditions; (v) rating agency actions; (vi) changes in the competitive or regulatory environment; (vii) actions by large institutional shareholders or other market participants; (viii) events, circumstances or perceptions impacting the financial services sector broadly and (ix) negative publicity about us or other regional banks.
Item 1B. Unresolved Staff Comments
None.
Item 1C. Cybersecurity
Cybersecurity Risk Management and Strategy
We are committed to maintaining robust governance, oversight and management of cybersecurity risk. We have established and implemented processes, supported by written policies and procedures, to detect, assess, classify, respond to, report, track, and resolve cybersecurity threats or incidents. We have implemented systems and controls to address the information technology risks to our organization, our business partners and our customers. We employ a layered security approach leveraging diverse strategies including data loss prevention, identity and access management, network security, vulnerability management, end-point security and information security education and awareness, among others. As a federally regulated institution, the Company strongly supports an environment that facilitates and abides by the Confidentiality, Integrity, and Availability security principles.
24
The Company has developed a training program to educate employees about its cybersecurity policies and standards, best practices, and potential threats to instill a culture of cybersecurity awareness and compliance throughout the organization. The training program includes, but is not limited to, ongoing and targeted training on topics such as social engineering, mobile security, data handling and protection, password security and incident reporting. All employees are required to participate in the training.
In 2025, Clarium Managed Services, LLC conducted a Cybersecurity Assessment for the Bank. The assessment gauged the overall Cybersecurity Risk Posture of the Bank and resulted in a score of 5 on a scale of 0 to 5. In the last three fiscal years, the Company has not identified any material cybersecurity incidents. No specific identified cybersecurity threats or incidents, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. No specific cybersecurity threats or incidents, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. See Item 1A "Risk Factors" for a further discussion of our cybersecurity risks. See Item 1A "Risk Factors" for a discussion of our cybersecurity risks.
Cybersecurity Governance
25
The Company has designated the MAT to assess and oversee the management and reporting of identified potentially material cybersecurity threats or incidents. The MAT convenes when a qualifying cybersecurity threat is identified by the CIO, the CISO, or their designees in accordance with established processes and procedures. The MAT has the responsibility to determine whether a cybersecurity threat or incident is material and oversee appropriate reporting. The MAT is also responsible for communicating to the Risk Committee any material cybersecurity threats or incidents.
The CISO, CIO, CRO, CFO, CAO, and General Counsel comprise the MAT. The CISO, CIO, CRO, CFO, CAO, and General Counsel comprise the MAT. Other SMEs or technical experts may advise, consult with and provide information to the MAT as needed. In addition to the specific subject matter expertise and experience of the CISO and CIO, these executives have broad financial, legal, risk management, industry, regulatory and SEC compliance, and general leadership experience, which enable the MAT to effectively carry out its responsibilities.
Recently Filed
Click on a ticker to see risk factors
| Ticker * | File Date |
|---|---|
| AVPT | 2 hours ago |
| NXRT | 2 hours ago |
| SRE | 2 hours ago |
| CABO | 2 hours ago |
| TPC | 2 hours ago |
| BPAC | 2 hours ago |
| WERN | 2 hours ago |
| SDRL | 2 hours ago |
| CHRD | 2 hours ago |
| RYTM | 2 hours ago |
| STEL | 2 hours ago |
| FLOC | 2 hours ago |
| WRBY | 2 hours ago |
| XRAY | 2 hours ago |
| EIG | 2 hours ago |
| DXPE | 2 hours ago |
| AA | 2 hours ago |
| MKL | 2 hours ago |
| ENOV | 2 hours ago |
| MTCH | 2 hours ago |
| KNTK | 2 hours ago |
| WHD | 2 hours ago |
| VCTR | 2 hours ago |
| AUB | 2 hours ago |
| MP | 2 hours ago |
| AMPH | 2 hours ago |
| PBYI | 2 hours ago |
| PJT | 2 hours ago |
| GPCR | 2 hours ago |
| BUSE | 2 hours ago |
| NABL | 2 hours ago |
| Q | 2 hours ago |
| REAL | 2 hours ago |
| DGX | 2 hours ago |
| MTZ | 2 hours ago |
| CTKB | 2 hours ago |
| KGS | 2 hours ago |
| DNA | 2 hours ago |
| ALTG | 2 hours ago |
| WTFC | 2 hours ago |
| NNI | 2 hours ago |
| DEC | 2 hours ago |
| BKU | 2 hours ago |
| VCYT | 2 hours ago |
| JANX | 2 hours ago |
| SHAK | 2 hours ago |
| COLB | 2 hours ago |
| RKLB | 2 hours ago |
| ACRS | 2 hours ago |
| SITC | 2 hours ago |
