Company: UMBFO
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-028420
Chunk: 44

Company: UMB FINANCIAL CORP
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 44
---
 above, third-party service providers also present a source of risk to the Company if their own security measures or other systems or infrastructure were to be breached or subject to another cybersecurity incident, rendered inaccessible or interrupted, experience an outage, downtime or degradation in service, or otherwise fail or experience adverse conditions (including conditions which interfere with the Company’s access to and use of such third-party services). The Company’s ability to monitor its third-party service providers’ cybersecurity practices is inherently limited. Although the agreements that the Company has in place with its third-party service providers generally include requirements relating to privacy, data protection and data security where and as appropriate, the Company cannot guarantee that such agreements will prevent a cyber incident impacting the Company’s systems or information or enable it to obtain adequate or any reimbursement from its third-party service providers in the event the Company should suffer any such incidents. In addition, due to applicable laws and regulations or contractual 

20

obligations, the Company may be held responsible for cyber incidents attributed to its third-party service providers as they relate to the information shared with them. 

Likewise, a cyber-attack, hacking incident, or other security breach affecting the business community, the markets, or parts of them may cycle or cascade through the financial system and adversely affect the Company or its service providers or counterparties. Many of these risks and uncertainties are beyond the Company’s control. Any failure, attempted or successful data breach or other cybersecurity incident or significant disruption in the Company’s information technology infrastructure, or those of the Company’s third-party service providers, could lead to transaction delays, compromised cybersecurity or data, inability to access critical services, and a failure to comply with applicable laws, regulations and standards governing financial transactions, data privacy, and cybersecurity. The consequences of such disruptions could be severe, resulting in financial losses, identity theft, loss of consumer trust, regulatory fines, monetary damages or other penalties or fines as well as a tarnished reputation among customers, partners and other third parties, any of which could adversely affect the Company’s business, results of operations, financial condition and future prospects. Although the Company believes it has appropriate measures in place to help manage the risk, there can be no guarantee that its efforts will be effective in preventing a material loss event. 

Even when an attempted cyber-attack, hacking incident or other security breach is successfully avoided or thwarted, the Company may need to expend substantial resources to avoid such breach, may be required to take actions that could adversely affect customer satisfaction or behavior, and may be exposed to reputational damage