Company: CMA
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000028412-25-000108
Chunk: 341

Company: COMERICA INC
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1A
Chunk 341
---
 of this information are governed by federal and state law. Both personally identifiable information and personal financial information are increasingly subject to legislation and regulation, the intent of which is to protect the privacy of personal information that is collected and handled. For example, the CCPA applies to for-profit businesses that conduct business in California and meet certain revenue or data collection thresholds, including Comerica. For more information regarding data privacy regulation, refer to the “Supervision and Regulation” section of this report.

Comerica may become subject to new legislation or regulation concerning cybersecurity or the privacy of personally identifiable information and personal financial information or of any other information Comerica may store or maintain. Comerica could be adversely affected if new legislation or regulations are adopted or if existing legislation or regulations are modified such that Comerica is required to alter its systems or require changes to its business practices or privacy policies. If cybersecurity, data privacy, data protection, data transfer or data retention laws are implemented, interpreted or applied in a manner inconsistent with Comerica’s current practices, it may be subject to fines, litigation or regulatory enforcement actions or ordered to change its business practices, policies or systems in a manner that adversely impacts Comerica’s operating results.

OPERATIONAL RISK

•Comerica’s operational or security systems or infrastructure, or those of third parties, could fail or be breached, which could disrupt Comerica’s business and adversely impact Comerica’s results of operations, liquidity and financial condition, as well as cause legal or reputational harm.

Operational risk exposure exists throughout Comerica’s business and, as a result of its interactions with, and reliance on, third parties, is not limited to Comerica’s own internal operational functions. Comerica's operations rely on the secure processing, storage and transmission of confidential and other information on its technology systems and networks. These networks are subject to infrastructure failures, ongoing system maintenance and upgrades and planned network outages. Comerica's use of mobile and cloud technologies, as well as its hybrid work options permitting remote work, can heighten these and other operational risks. Any failure, interruption or breach in security of these systems could result in failures or disruptions in Comerica's customer relationship management, general ledger, deposit, loan and other systems. 

Comerica relies on its employees and third parties in its day-to-day and ongoing operations, who may, as a result of human error, misconduct, malfeasance or failure, or breach of Comerica’s or of third