Company: CMA
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000028412-25-000108
Chunk: 240

Company: COMERICA INC
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1
Chunk 240
---
 to its business practices or privacy policies. If cybersecurity, data privacy, data protection, data transfer or data retention laws are implemented, interpreted or applied in a manner inconsistent with Comerica’s current practices, it may be subject to fines, litigation or regulatory enforcement actions or ordered to change its business practices, policies or systems in a manner that adversely impacts Comerica’s operating results.

OPERATIONAL RISK

•Comerica’s operational or security systems or infrastructure, or those of third parties, could fail or be breached, which could disrupt Comerica’s business and adversely impact Comerica’s results of operations, liquidity and financial condition, as well as cause legal or reputational harm.

Operational risk exposure exists throughout Comerica’s business and, as a result of its interactions with, and reliance on, third parties, is not limited to Comerica’s own internal operational functions. Comerica's operations rely on the secure processing, storage and transmission of confidential and other information on its technology systems and networks. These networks are subject to infrastructure failures, ongoing system maintenance and upgrades and planned network outages. Comerica's use of mobile and cloud technologies, as well as its hybrid work options permitting remote work, can heighten these and other operational risks. Any failure, interruption or breach in security of these systems could result in failures or disruptions in Comerica's customer relationship management, general ledger, deposit, loan and other systems. 

Comerica relies on its employees and third parties in its day-to-day and ongoing operations, who may, as a result of human error, misconduct, malfeasance or failure, or breach of Comerica’s or of third-party systems or infrastructure, expose Comerica to risk. For example, Comerica’s ability to conduct business may be adversely affected by any significant disruptions to Comerica or to third parties with whom Comerica interacts or upon whom it relies. Although Comerica has programs in place related to business continuity, disaster recovery and information security to maintain the confidentiality, integrity and availability of its systems, business applications and customer information, such disruptions may still give rise to interruptions in service to customers and loss or liability to Comerica, including loss of customer data. In addition, Comerica’s ability to implement backup systems and other safeguards with respect to 

20

third-party systems is more limited than with respect to its own systems. Increasing usage of automation and a measured approach to leveraging artificial intelligence by Comerica or third parties on which Com