Company: MTB-PJ
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001628280-25-006267
Chunk: 69

Company: M&T BANK CORP
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1A
Chunk 69
---
 organization. In addition, the Dodd-Frank Act required those agencies, along with the SEC, to adopt rules to require reporting of incentive compensation and to prohibit certain compensation arrangements. If as a result of complying with such rules the Company is unable to attract and retain qualified employees, or do so at rates necessary to maintain its competitive position, or if the compensation costs required to attract and retain employees become more significant, the Company’s performance, including its competitive position, could be materially adversely affected.

Operational Risk

The Company is subject to operational risk which could adversely affect the Company’s business and reputation and create material legal and financial exposure.

Like all businesses, the Company is subject to operational risk, which represents the risk of loss resulting from human error or misconduct, inadequate or failed internal processes and systems, and external events, including the risk of loss resulting from fraud by employees or persons outside the Company, and breaches in data security. Operational risk also encompasses reputational risk and compliance and legal risk, which is the risk of loss from violations of, or noncompliance with, laws, rules, regulations, prescribed practices or ethical standards, as well as the risk of noncompliance with contractual and other obligations. The Company is also exposed to the above referenced operational risks through outsourcing arrangements, as such outsourced vendors are exposed to operational risks themselves, as well as the effects that changes in circumstances or capabilities of its outsourced vendors can have on the Company’s ability to continue to perform operational functions necessary to its business. Although the Company seeks to mitigate operational risk through a system of internal controls that are reviewed and updated, no system of controls, however well designed and maintained, is infallible. Control weaknesses or failures or other operational risks could result in charges, increased operational costs, harm to the Company’s reputation, regulatory scrutiny or foregone business opportunities.

The Company’s information systems may experience interruptions or breaches in security, including due to events beyond the Company’s control.

The Company relies heavily on communications and information systems, including those of third-party service providers, to conduct its business. Any failure, interruption or breach in security of these systems could result in disruptions to its accounting, deposit, loan and other systems, and adversely affect the Company’s customer relationships. Disruption of operating systems caused by events beyond the Company’s control may include computer viruses, electrical or telecommunications outages, quality of vulnerability patches, coding errors, cyber attacks (including Distributed Denial of Service attacks, which occur when legitimate users are unable to access information systems, devices, or other network