Company: CMA
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000028412-25-000108
Chunk: 35

Company: COMERICA INC
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1
Chunk 35
---
’s operations and business, misappropriation, exposure, or destruction of its confidential information, intellectual property, funds, and/or those of its customers; or damage to Comerica’s or Comerica’s customers’ and/or third parties’ computers or systems, and could result in a violation of applicable privacy laws and other laws, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in Comerica’s security measures, reputational damage, reimbursement or other compensatory costs, and additional compliance costs, and could adversely impact its results of operations, liquidity and financial condition. In addition, although Comerica maintains insurance coverage that may cover certain cyber attack losses (subject to policy terms and conditions), Comerica may not have adequate insurance coverage to compensate for losses from a cybersecurity event.

•Cybersecurity and data privacy are areas of heightened legislative and regulatory focus.

As cybersecurity and data privacy risks for banking organizations and the broader financial system have significantly increased in recent years, cybersecurity and data privacy issues have become the subject of increasing legislative and regulatory focus. The federal bank regulatory agencies continue to assess cybersecurity risks in their supervision and examination of banks, including Comerica. In addition, several states have proposed or adopted cybersecurity legislation and regulations, which require, among other things, notification to affected individuals when there has been a security breach of their personal data. For more information regarding cybersecurity regulation, refer to the “Supervision and Regulation” section of this report.

Comerica receives, maintains and stores non-public personal information of Comerica’s customers and counterparties, including, but not limited to, personally identifiable information and personal financial information. The sharing, use, disclosure and protection of this information are governed by federal and state law. Both personally identifiable information and personal financial information are increasingly subject to legislation and regulation, the intent of which is to protect the privacy of personal information that is collected and handled. For example, the CCPA applies to for-profit businesses that conduct business in California and meet certain revenue or data collection thresholds, including Comerica. For more information regarding data privacy regulation, refer to the “Supervision and Regulation” section of this report.

Comerica may become subject to new legislation or regulation concerning cybersecurity or the privacy of personally identifiable information and personal financial information or of any other information Comerica may store or maintain. Comerica could be adversely affected if new legislation or regulations are adopted or if existing legislation or regulations are modified such that Comerica is required to alter its systems or require changes