Company: FCNCB
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000798941-25-000010
Chunk: 261

Company: FIRST CITIZENS BANCSHARES INC /DE/
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1A
Chunk 261
---
 conducted risk assessments regarding use of new technologies like AI. Refer to Item 1. Business—Regulatory Considerations—Artificial Intelligence for additional information. Cyberattacks involving LFIs, including distributed denial of service attacks designed to disrupt external customer-facing services, nation state cyberattacks and ransomware attacks designed to deny organizations access to key internal resources or systems or other critical data, as well as targeted social engineering and phishing email and text message attacks designed to allow unauthorized persons to obtain access to an institution’s information systems and data or that of its customers, are becoming more common and increasingly sophisticated. In particular, there has been an observed increase in the number of distributed denial of service attacks against the financial sector in recent years, which increase is believed to be partially attributable to politically motivated attacks as well as financial demands coupled with extortion. These risks are expected to continue and further intensify in the future. Even the most advanced control environment may be vulnerable to compromise given the possibility of employee error, failures to follow security procedures or malfeasance. Additionally, the increase of supply chain attacks, including potential attacks on third parties with access to our data or those providing critical services to us, remain an operational risk. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our layers of defense or to investigate and remediate any information security vulnerabilities. Furthermore, past and future business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies.

We also face indirect technology, cybersecurity and operational risks relating to customers and other third parties with whom we do business or upon whom we rely to facilitate or enable our business activities, including financial counterparties; financial intermediaries such as clearing agents, exchanges and clearing houses; vendors and other external dependencies; regulators; and providers of critical infrastructure such as internet access and electrical power. As a result of increasing consolidation, interdependence and complexity of financial entities and technology systems, an event that materially degrades, or disrupts systems of one or more financial entities could have a material impact on counterparties or other market participants, including us. This consolidation interconnectivity and complexity increases the risk of operational failure, for both individual and industry-wide bases, as disparate systems need to be integrated, often on an accelerated basis. Any third-party technology failure, cyberattack or other information or security breach, termination or constraint could, among other things, adversely affect our ability to