Company: BOKF
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0000875357-25-000013
Chunk: 133

Company: BOK FINANCIAL CORP
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1A
Chunk 133
---
 and information security and reliability have increased over time. We face compliance risks and costs relating to the data privacy laws existing in multiple jurisdictions. Congress and the legislatures of states in which we operate regularly consider legislation that would impose more stringent data privacy requirements resulting in increased compliance costs.

Cybersecurity risks for financial institutions have increased significantly in recent years in part because of the proliferation of new technologies, the increased use of the internet and mobile technologies to conduct financial transactions, and the increased sophistication and ever changing cyberattack techniques used by organized crime, hackers, terrorists, hostile foreign governments, and other external parties to obtain confidential customer information and misappropriate customer funds, and may disrupt operations through Ransomware. Such parties may seek to gain access to our systems directly or use equipment or security passwords belonging to employees, customers, third-party services providers, or other users of our systems. Accordingly, our operational systems and infrastructure must continue to be safeguarded and monitored for potential failures, disruptions, breakdowns, and cyber attacks. 

Our business, financial, accounting, data processing systems, and other operating systems and facilities may stop operating properly or become disabled as a result of a number of factors that may be wholly or partially beyond our control. In addition to cyber attacks, there could be sudden increases in customer transaction volume, electrical or telecommunications outages, extended disruptions in operations or technology, natural disasters, pandemics, and events arising from political or social matters, including terrorist attacks. Third parties with whom we do business or that facilitate our business activities including exchanges, clearing houses, financial intermediaries, or vendors that provide services or security solutions for our operations, could also be sources of operational or information security risk to the Company including breakdowns or failures of their own systems, capacity constraints, or cyber attacks.

Cybersecurity risk management programs are expensive to maintain and will not protect the Company from all risks associated with maintaining the security of customer data from external and internal intrusions, disaster recovery and failures in controls used by our vendors. A material breach of customer data security or operational or system failure may negatively impact our business reputation and cause a loss of customers, result in increased expense to contain the event and/or require that we provide credit monitoring services for or reimburse affected customers, result in regulatory fines, penalties or intervention, or result in litigation, all of which could have a materially adverse effect on our results of operations and financial condition.

Although to date we have not experienced any material losses relating to cyber attacks or other information security breaches or operational failures, there can be no assurance that