Company: FRME
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000712534-25-000058
Chunk: 167

Company: FIRST MERCHANTS CORP
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1A
Chunk 167
---
 control system, improper operation of systems or improper employee actions, the Corporation could suffer financial loss, face regulatory action and suffer damage to its reputation.

•Cyber incidents and other security breaches at the Corporation, its service providers or counterparties, or in the business community or markets may negatively impact the Corporation’s business or performance.

The increased use of, and dependence on, information management systems in order to engage with customers and conduct business necessarily creates cyber risk.  Despite the significant resources and security measures used by the Corporation, the incentives for threat actors to obtain financial payment information and customer non-public information, or to conduct ransomware will continue to exist.  Cyber breach statistics over the past several years evidence the targeting of numerous banking institutions and credit bureaus.  Phishing attempts have also significantly increased and political conflict also presents cyber threats by nation states. 

Operational risk is inherent in the Corporation’s activities and can present itself in numerous ways, including internal or external fraud, business disruptions or failures, noncompliance with applicable laws and regulations, cyber breach, or failure of third parties, among other events.  The result of these could be reputational harm, financial losses, or litigation and regulatory fines for the Bank.  The Corporation operates in a fashion that allows operational risk to be in line with its risk appetite.  To govern, monitor and control operational risk, the Corporation maintains an Enterprise Risk Management (“ERM”) Program, which sets thresholds for risk appetite by key risk areas, such as strategic risk and operational risk.  These thresholds are monitored by the Compliance and Internal Audit Departments and key metrics are reported to management and Board committees.

Use of third-party software and services also exposes the Corporation to cybersecurity risk as numerous service providers host critical data or have direct contact with our bank customers.  Although the Corporation adheres to industry standard practices in conducting thorough due diligence of vendors and contract management, should a vendor experience a breach, similar to the MOVEit breach in 2023 which impacted a vendor utilized by the Bank, the Bank could still suffer reputational harm, and potentially financial losses.  Expanded use of cloud-based technologies and providing our customers more internet-based product offerings to continue to remain competitive will serve to increase these potential risks.  The Corporation’s third-party management program helps to mitigate risks posed by reliance on third and fourth parties.

To combat these ever-present cyber risks, the Corporation maintains a comprehensive Information Security Program, which includes annual risk assessments, an Incident Response Plan, and a layered control environment meant to detect, prevent, and limit unauthorized