Company: KEY-PI
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000091576-25-000038
Chunk: 183

Company: KEYCORP /NEW/
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1A
Chunk 183
---
ected and persist for an extended period of time and/or we may be unable to remediate the event or its consequences timely or adequately. While we do maintain cyber information security and business interruption insurance, losses from a major interruption may exceed our coverage and there can be no assurance that liabilities or losses we may incur will be covered under such policies, that such insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim.

We rely on third parties to perform significant operational services for us, and their failure to perform to our standards or other issues of concern with them could harm us.

Third parties perform significant operational services on our business, and many of our third party vendors outsource aspects of their operations and contractual obligations to downstream service providers. These parties – both our vendors and their downstream service providers – are subject to similar risks as Key. While we have a third party risk management program and can exert varying degrees of influence over our service providers, we do not control them, their actions, or their businesses. For example, one or more of these parties may experience a cybersecurity event, financial distress (including, but not limited to, filing for bankruptcy), operational difficulties, or operational disruptions that could negatively impact performance and delivery of our services. In addition, some of our third party arrangements are located overseas and, therefore, are subject to risks unique to the regions in which they operate. Service providers have not always met our requirements and expectations, and no assurance can be provided that in the future they will perform to our standards, adequately represent our brand, comply with applicable law, appropriately manage their own risks, including cybersecurity, remain financially or operationally viable, abide by their contractual obligations, or continue to provide us with the services that we require or that they are contractually obligated to provide. Disruption in services provided by these third parties, including a discontinuation or delay in services, could increase the costs of doing business and adversely affect our ability to deliver products and services to clients, to support teammates, and otherwise to conduct business, which would negatively impact our customer relationships, our reputation, and our business.  

Further, regulatory guidance adopted by federal banking regulators related to how banks select, contract with, evaluate, engage with, and manage their third parties, including such third parties’ use of subcontractors and downstream service providers, impacts whether and how we work with such parties, as well as the cost of managing such relationships. In some instances, we may be responsible for failures