# POPULAR, INC. (BPOP) FY 2023 MD&A

Verbatim Item 7 Management's Discussion and Analysis from POPULAR, INC.'s 10-K for fiscal year 2023.

SEC filing source: https://www.sec.gov/Archives/edgar/data/763901/000119312524053017/d52551d10k.htm
Accession: 0001193125-24-053017
Filing date: 2024-02-29
Report date: 2023-12-31
Extracted from a substantive MD&A body after the formal Item 7 span was a TOC or reference stub.
Confidence: high

Company profile: /company/BPOP/
All MD&A years: /company/BPOP/mda/
Previous year: /company/BPOP/mda/fy2022/ (FY 2022)
Next year: /company/BPOP/mda/fy2024/ (FY 2024)

results of
 
operations

and
 
capital
 
position.
 
These
 
risks
 
could
 
cause
 
our
 
actual
 
results
 
to
 
differ
 
materially
 
from
 
our
 
historical
 
results
 
or
 
the
 
results

contemplated by the forward-looking statements contained
 
in this report.

The risks described in
 
this report are not the
 
only risks we face. Additional
 
risks and uncertainties not currently
 
known by

us
 
or
 
that
 
we
 
currently
 
deem
 
to
 
be
 
immaterial,
 
or
 
that
 
are
 
generally
 
applicable
 
to
 
all
 
financial
 
institutions,
 
may
 
also
 
materially

adversely affect our business, financial condition, liquidity, results of operations or capital
 
position.

ECONOMIC AND MARKET RISKS

Weakness in
 
the economy,
 
particularly in
 
Puerto Rico,
 
where a
 
significant portion
 
of our
 
business is
 
concentrated, has

adversely impacted us in the past and may adversely
 
impact us in the future.

We have been, and will continue to be, impacted by global and local
 
economic and market conditions, including weakness

in the
 
economy,
 
disruptions and
 
volatility in
 
the financial
 
markets, inflation,
 
monetary and
 
fiscal policies,
 
public policy,
 
geopolitical

conflicts, business and consumer sentiment and unemployment. A significant portion of our business is concentrated
 
in Puerto Rico,

which accounted for approximately 77% of
 
our assets and 81% of
 
our deposits as of December 31,
 
2023 and 78% of our
 
revenues

for the
 
year ended
 
December 31,
 
2023. As
 
a result,
 
our financial
 
condition and
 
results of
 
operations are
 
highly dependent
 
on the

general
 
trends
 
of
 
the
 
Puerto
 
Rico
 
economy
 
and
 
other
 
conditions
 
affecting
 
Puerto
 
Rico
 
consumers
 
and
 
businesses.
 
The

concentration of
 
our operations in
 
Puerto Rico
 
exposes us to
 
greater risks than
 
other banking companies
 
with a
 
wider geographic

base.

Puerto Rico
 
has faced significant
 
economic and fiscal
 
challenges in the
 
past, including a
 
severe recession that
 
began in

2007 and
 
persisted for
 
over a
 
decade and
 
an acute
 
fiscal crisis
 
that led
 
the Puerto
 
Rico government
 
to file
 
for a
 
form
 
of federal

bankruptcy protection
 
in 2017.
 
Puerto Rico’s
 
fiscal and
 
economic challenges
 
have in
 
the past
 
adversely affected
 
our customers,

resulting
 
in
 
higher
 
delinquencies,
 
charge-offs
 
and
 
increased
 
losses
 
for
 
us.
 
While
 
Puerto
 
Rico’s
 
economy
 
has
 
been
 
gradually

recovering
 
and
 
the
 
Puerto
 
Rico
 
government
 
emerged
 
from
 
bankruptcy
 
in
 
2022,
 
Puerto
 
Rico
 
still
 
faces
 
economic
 
and
 
fiscal

challenges.
 
Moreover,
 
Puerto
 
Rico
 
has
 
historically
 
received
 
a
 
significant
 
amount
 
of
 
federal
 
funds
 
through
 
non-recurring

appropriations, particularly to cover costs associated with its health insurance program, and Puerto Rico’s recent economic recovery

has
 
been partially
 
driven by
 
significant federal
 
disaster relief
 
and stimulus
 
funding. Therefore,
 
the Puerto
 
Rico economy
 
is highly

susceptible
 
to
 
changes
 
in
 
federal
 
public
 
policy
 
towards
 
Puerto
 
Rico.
 
Public
 
policy
 
changes
 
that
 
result
 
in
 
a
 
reduction
 
of
 
federal

funding for Puerto
 
Rico, or in
 
delays in the
 
receipt of such funding,
 
could significantly impact Puerto
 
Rico’s economy.
 
A weakening

of the Puerto
 
Rico economy or other
 
adverse economic conditions affecting
 
Puerto Rico consumers and
 
businesses could result in

25

decreased demand
 
for our
 
products or services,
 
deterioration in the
 
credit quality
 
of our
 
customers, higher
 
delinquencies, charge-

offs or increased losses, all of which could adversely affect
 
our financial condition and results of operations.

We are
 
also exposed
 
to risks
 
related to
 
the state
 
of the
 
local economies
 
of the
 
other markets
 
in which
 
we do
 
business,

such as New York and Florida, and to the state of the global and U.S. economy and financial
 
markets. Global financial markets have

recently
 
experienced periods
 
of
 
extraordinary disruption
 
and volatility,
 
exacerbated by
 
geopolitical conflicts,
 
the
 
U.S.
 
debt-ceiling

situation,
 
high
 
levels
 
of
 
inflation
 
and
 
rapid
 
increases
 
in
 
interest
 
rates.
 
Inflationary
 
pressures
 
increased
 
certain
 
of
 
our
 
expenses

(including our
 
personnel expenses)
 
and adversely
 
affected consumer
 
sentiment. Central
 
bank responses
 
to inflationary
 
pressures

led to higher
 
market interest rates
 
and, in turn,
 
lower activity levels across
 
U.S. and global financial
 
markets. These circumstances

resulted in,
 
and could
 
continue to
 
result in,
 
reductions in
 
the value
 
of
 
our investments.
 
If these
 
conditions persist
 
or worsen,
 
our

results of operations, financial position and liquidity
 
could be materially and adversely affected.

Changes
 
in
 
interest
 
rates
 
and
 
credit
 
spreads
 
can
 
adversely
 
impact
 
our
 
financial
 
condition,
 
including
 
our
 
investment

portfolio,
 
since
 
a
 
significant
 
portion
 
of
 
our
 
business involves
 
borrowing
 
and
 
lending
 
money,
 
and
 
investing in
 
financial

instruments.

Our business
 
and financial
 
performance are
 
impacted by
 
market interest
 
rates and
 
movements in
 
those rates.
 
Since a

high percentage of our assets and liabilities are interest bearing or otherwise sensitive in value to changes in interest rates, changes

in interest rates, in the shape of the yield curve or in spreads between different types of rates, have had and could in the future have

a material impact on our results
 
of operations and the values of our
 
assets and liabilities, including our investment portfolio.
 
Interest

rates are
 
highly sensitive
 
to many
 
factors over
 
which we
 
have no
 
control and
 
which we
 
may not
 
be able
 
to anticipate
 
adequately,

including general
 
economic conditions
 
and the
 
monetary and
 
tax policies
 
of various
 
governmental bodies,
 
particularly the
 
Federal

Reserve Board.

Increasing levels of inflation, driven
 
by pent-up demand and supply-chain disruptions caused
 
by the COVID-19 pandemic

and the war in Ukraine, led
 
the Federal Market Committee of the Federal Reserve Board
 
(the “FOMC”) to execute a series of sharp

benchmark interest
 
rate increases
 
beginning in
 
the first
 
quarter of
 
2022. While
 
the
 
FOMC has
 
indicated that
 
it
 
may conclude
 
its

interest rate hike cycle, the amount and pace of any reduction in interest rates remains uncertain. Higher interest rates could lead to

fewer originations of
 
commercial and residential
 
real estate loans,
 
loss of deposits,
 
a misalignment in
 
the pricing of
 
short-term and

long-term
 
borrowings,
 
less
 
liquidity
 
in
 
the
 
financial
 
markets
 
and
 
higher
 
funding
 
costs.
 
Furthermore,
 
higher
 
interest
 
rates
 
could

negatively affect
 
the payment
 
performance on
 
loans linked
 
to variable
 
interest rates
 
to the
 
extent borrowers
 
are unable
 
to afford

higher interest
 
payments, which
 
could result
 
in higher
 
delinquencies. Inflationary
 
pressure arising
 
from increases
 
in interest
 
rates

may also affect
 
borrowers’ financial condition and
 
their ability to
 
pay their debts
 
when due. Additionally,
 
if the interest
 
rates we pay

on
 
our
 
deposits
 
and
 
other
 
borrowings
 
were
 
to
 
increase
 
at
 
a
 
faster
 
rate
 
than
 
the
 
interest
 
rates
 
we
 
receive
 
on
 
loans
 
and
 
other

investments,
 
our
 
net
 
interest
 
income,
 
and,
 
therefore,
 
our
 
earnings,
 
could
 
be
 
adversely
 
affected.
 
All
 
of
 
these
 
outcomes
 
could

adversely affect our earnings, liquidity and capital levels.

The
 
rapid
 
rise
 
in
 
interest
 
rates
 
in
 
2022
 
resulted
 
in
 
approximately
 
$2.5
 
billion
 
in
 
unrealized
 
mark-to-market
 
losses
 
on

available-for-sale securities held in our investment securities portfolio. In October 2022, we transferred U.S. Treasury securities with

a fair value of approximately $6.5 billion (par value of
 
$7.4 billion), and with accumulated unrealized losses of $873 million, from our

available-for-sale portfolio to
 
our held-to-maturity portfolio.
 
While the size
 
of our unrealized
 
mark-to-market losses on
 
available-for-

sale
 
securities
 
had
 
been
 
reduced
 
to
 
$1.4
 
billion
 
as
 
of
 
December
 
31,
 
2023,
 
if
 
interest
 
rates
 
were
 
to
 
again
 
rise
 
rapidly
 
or
 
for
 
a

prolonged period, we may accumulate significant additional mark-to-market
 
losses on investment securities in our available-for-sale

portfolio, which may adversely affect our tangible capital
 
and impact our ability to return capital to our
 
stockholders.

For a discussion of the Corporation’s
 
interest rate sensitivity, please refer
 
to the “Risk Management” section of the MD&A

in this Form 10-K.

BUSINESS RISKS

Negative
 
changes
 
in
 
the
 
financial
 
condition
 
of
 
our
 
clients
 
have
 
adversely
 
impacted
 
us
 
in
 
the
 
past
 
and
 
may
 
adversely

impact us in the future.

A significant portion of
 
our business involves lending money,
 
which exposes us to
 
credit risk and
 
risk of loss if
 
borrowers

do
 
not
 
repay
 
their
 
loans,
 
leases, credit
 
cards
 
or
 
other
 
credit
 
obligations.
 
The
 
performance of
 
these
 
credit
 
portfolios
 
significantly

affects our
 
financial condition
 
and results
 
of operations.
 
We have
 
in the
 
past been
 
adversely affected
 
by negative
 
changes in
 
the

financial condition of our clients due to weakness in
 
the Puerto Rico and U.S. economy. If the current economic environment were to

26

deteriorate, more customers may have difficulty in repaying their credit obligations, which may result in higher levels
 
of credit losses

and reserves for credit losses.

We are exposed to
 
increased credit risks and credit losses
 
to the extent our clients are
 
concentrated by industry segment

or type of client.

Our credit risk and credit
 
losses can increase to the extent
 
our loans are concentrated in borrowers engaged in
 
the same

or similar
 
activities or
 
in borrowers
 
who as
 
a group
 
may be
 
uniquely or
 
disproportionately affected
 
by certain
 
economic or
 
market

conditions. We have significant
 
exposure to borrowers in certain
 
economic sectors, such as residential
 
and commercial real estate,

hospitality and healthcare. Challenging economic or market conditions that affect
 
the industries or types of clients to
 
which we have

significant exposure could result in higher credit
 
losses and adversely affect our financial condition
 
and results of operations.

We also
 
have direct
 
lending and
 
investment exposure
 
to Puerto
 
Rico government
 
entities, which
 
have faced
 
significant

fiscal challenges.
 
At December
 
31, 2023,
 
our exposure
 
to the
 
Puerto Rico
 
government consisted
 
of $362
 
million in
 
direct lending

exposure to Puerto
 
Rico municipalities and
 
$238 million in
 
loans insured or
 
securities issued by
 
Puerto Rico governmental
 
entities

but for
 
which the
 
principal source
 
of repayment
 
is non-governmental.
 
We also
 
have indirect
 
lending exposure
 
to the
 
Puerto Rico

government in the
 
form of loans
 
to private borrowers
 
who are service
 
providers, lessors, suppliers
 
or have other
 
relationships with

the Puerto Rico government. While the overall fiscal situation
 
of the Puerto Rico government has improved in recent years,
 
including

as
 
result
 
of
 
the
 
government
 
and
 
certain
 
of
 
its
 
instrumentalities
 
having
 
restructured
 
their
 
debt
 
obligations,
 
some
 
Puerto
 
Rico

government entities, including certain municipalities, still face significant
 
fiscal challenges. A deterioration in the fiscal situation of the

Puerto Rico
 
government and its
 
instrumentalities, and in
 
particular in the
 
fiscal situation
 
of the
 
Puerto Rico
 
municipalities to
 
which

we have direct lending exposure, could result in
 
higher credit losses and reserves for credit losses. For
 
a discussion of risks related

to the Corporation’s credit exposure to the Puerto Rico
 
and USVI governments, see the Geographic and
 
Government Risk section in

the MD&A section of this Form 10-K.

Deterioration in the
 
values of real
 
properties securing our commercial, mortgage
 
loan and construction portfolios
 
have in

the past resulted, and may in the future result,
 
in increased credit losses and harm our results
 
of operations.

As of
 
December 31,
 
2023, approximately
 
55% of
 
our loan
 
portfolio consisted
 
of loans
 
secured by
 
real estate
 
collateral

(comprised of 30% in commercial loans, 22% in residential
 
mortgage loans and 3% in construction loans). The
 
value of the collateral

securing such loans is dependent upon economic conditions in the area in which the collateral is located. Weakness in the economy

of some of the
 
markets we serve has in
 
the past resulted in significant
 
declines in the value of
 
the real properties securing our
 
loan

portfolio, leading to increased credit losses. If the value of
 
the real estate properties securing our loan portfolio declines again in
 
the

future, we may be
 
required to increase our
 
provisions for loan losses
 
and allowance for loan
 
losses. Any such increase could
 
have

an adverse effect on
 
our financial condition and results of
 
operations. For more information on the credit
 
quality of our construction,

commercial and mortgage portfolio, see the Credit
 
Risk section of the MD&A included in this
 
Form 10-K.

We
 
are
 
exposed
 
to
 
credit
 
risk
 
from
 
mortgage
 
loans
 
that
 
have
 
been
 
sold
 
or
 
are
 
being
 
serviced
 
subject
 
to
 
recourse

arrangements.

Popular
 
is
 
generally
 
at
 
risk
 
for
 
mortgage
 
loan
 
defaults
 
from
 
the
 
time
 
it
 
funds
 
a
 
loan
 
until
 
the
 
time
 
the
 
loan
 
is
 
sold
 
or

securitized into a
 
mortgage-backed security.
 
However, we
 
have retained part
 
of the credit
 
risk on sales
 
of mortgage loans
 
through

recourse
 
arrangements,
 
and
 
we
 
also
 
service
 
certain
 
mortgage
 
loan
 
portfolios
 
with
 
recourse.
 
At
 
December
 
31,
 
2023,
 
we
 
were

exposed to credit risk with respect to $0.6 billion in residential mortgage loans sold
 
or serviced subject to credit recourse provisions,

consisting principally of loans associated with the Fannie Mae and
 
Freddie Mac programs. Pursuant to such recourse provisions,
 
we

are required to repurchase the loan or reimburse the third-party investor for the incurred loss in the event of a customer default. The

maximum potential amount of future payments that
 
we would be required to make
 
under the recourse arrangements in the event
 
of

nonperformance
 
by
 
the
 
borrowers
 
is
 
equivalent
 
to
 
the
 
total
 
outstanding balance
 
of
 
the
 
residential mortgage
 
loans
 
serviced
 
with

recourse
 
and
 
interest, if
 
applicable. In
 
the
 
event
 
of
 
nonperformance by
 
the borrower,
 
we
 
have
 
rights
 
to
 
the
 
underlying collateral

securing the
 
mortgage loan.
 
During 2023,
 
we repurchased
 
approximately $2
 
million in
 
mortgage loans
 
subject to
 
credit recourse

provisions. As
 
of December
 
31, 2023,
 
our liability
 
established to
 
cover the
 
estimated credit
 
loss exposure
 
related to
 
loans sold
 
or

serviced with credit recourse amounted to $4 million. We may suffer losses on these loans if the proceeds from a foreclosure sale of

the property underlying
 
a defaulted mortgage
 
loan are less
 
than the outstanding
 
principal balance of
 
the loan plus
 
any uncollected

interest advanced and the costs of holding and disposing
 
of the related property.

Defective and repurchased loans may harm our business
 
and financial condition.

27

In
 
connection
 
with
 
the
 
sale
 
and
 
securitization
 
of
 
mortgage
 
loans,
 
we
 
are
 
required
 
to
 
make
 
a
 
variety
 
of
 
customary

representations
 
and
 
warranties regarding
 
Popular
 
and
 
the
 
loans
 
being
 
sold
 
or
 
securitized.
 
Our
 
obligations with
 
respect to
 
these

representations and warranties are generally outstanding for the
 
life of the loan, and they
 
relate to, among other things, compliance

with
 
laws
 
and
 
regulations,
 
underwriting
 
standards,
 
the
 
accuracy
 
of
 
information
 
in
 
the
 
loan
 
documents
 
and
 
loan
 
file
 
and
 
the

characteristics
 
and
 
enforceability of
 
the
 
loan.
 
A
 
loan
 
that
 
does
 
not
 
comply
 
with
 
the
 
secondary
 
market’s
 
requirements
 
may
 
take

longer to
 
sell, impact
 
our ability
 
to securitize
 
the loans
 
or pledge
 
the loans
 
as collateral
 
for borrowings,
 
or be
 
unsalable or
 
salable

only
 
at
 
a
 
significant
 
discount.
 
Moreover,
 
if
 
any
 
such
 
loan
 
is
 
sold
 
before
 
we
 
detect
 
non-compliance,
 
we
 
may
 
be
 
obligated
 
to

repurchase the loan and bear any associated loss directly,
 
or we may be obligated to indemnify the purchaser against any loss.
 
We

seek to
 
minimize repurchases and
 
losses from defective
 
loans by correcting
 
flaws, if possible,
 
and selling or
 
re-selling such loans.

However,
 
if
 
we
 
were
 
to
 
suffer
 
significant
 
losses
 
from
 
defective
 
and
 
repurchased
 
loans,
 
our
 
results
 
of
 
operations
 
and
 
financial

condition could be materially impacted.

If we are
 
unable to maintain
 
or grow our
 
deposits, we may
 
be subject to
 
paying higher funding costs
 
and our net
 
interest

income may decrease.

We rely primarily
 
on bank deposits as
 
a low cost and
 
stable source of funding
 
for our lending activities
 
and the operation

of
 
our
 
business.
 
Therefore,
 
our
 
funding
 
costs
 
are
 
largely
 
dependent
 
on
 
our
 
ability
 
to
 
maintain
 
and
 
grow
 
our
 
deposits.
 
As
 
our

competitors have raised the
 
interest rates they pay
 
on deposits, our
 
funding costs have increased,
 
as we have
 
needed to increase

the rates we
 
pay to our depositors
 
to avoid losing deposits
 
and to procure new
 
ones. Rising interest rates
 
have also led customers

to move their funds to alternative investments that
 
pay higher interest rates.
 
Additionally, periods of market stress
 
or lack of market

or customer confidence in financial institutions may result in
 
a loss of customer deposits, especially to the
 
extent those deposits are

in excess of the FDIC-insured limit of $250,000. As of
 
December 31, 2023, we had $14.6 billion of deposits (other
 
than collateralized

public funds, which represent public deposit balances from governmental entities in the U.S. and its territories, including Puerto Rico

and the United States Virgin Islands, that are collateralized based on such jurisdictions’
 
applicable collateral requirements) in excess

of the FDIC-insured limit. As deposits decrease, we
 
may need to rely on more
 
expensive sources of funding. Furthermore, we have

a
 
significant
 
amount
 
of
 
deposits
 
from
 
the
 
Puerto
 
Rico
 
government,
 
its
 
instrumentalities
 
and
 
municipalities
 
($18.1
 
billion,
 
or

approximately 28% of our
 
total deposits, as of
 
December 31, 2023), and
 
the amount of these
 
deposits may fluctuate depending on

the financial
 
condition and
 
liquidity of
 
these entities,
 
as well
 
as on
 
our ability
 
to maintain
 
these customer
 
relationships. Under
 
the

terms of
 
BPPR’s deposit
 
pricing agreement
 
with Puerto
 
Rico public
 
sector,
 
public fund
 
deposit rates
 
are market
 
linked with
 
a lag

minus a
 
specified spread.
 
Therefore, as
 
market rates
 
rise, we
 
are required
 
to sequentially
 
increase the
 
rates we
 
pay our
 
public

deposits. If
 
we are unable
 
to maintain or
 
grow our deposits
 
for any
 
reason, we may
 
be subject to
 
paying higher funding
 
costs and

our net interest income may decrease.

OPERATIONAL RISKS

We
 
and our
 
third-party providers
 
have been,
 
and expect
 
in the
 
future to
 
continue to
 
be, subject
 
to cyber-attacks,
 
which

could cause substantial harm and have an adverse
 
effect on our business and results of operations.

Cybersecurity
 
risks
 
for
 
large
 
financial
 
institutions
 
such
 
as
 
Popular
 
have
 
increased
 
significantly
 
in
 
recent
 
years
 
in
 
part

because of
 
the proliferation
 
of new
 
technologies, such
 
as mobile
 
banking, artificial
 
intelligence and
 
the ability
 
to conduct
 
instant

financial transactions anywhere
 
globally, growing
 
geo-political threats, such
 
as the ongoing
 
wars in Ukraine
 
and in the
 
Gaza Strip,

and the increased sophistication and activities of
 
organized crime, hackers, terrorists, nation-states, hacktivists and other parties. In

the ordinary
 
course of
 
business, we
 
rely on
 
electronic communications
 
and information
 
systems to
 
conduct our
 
operations and
 
to

transmit
 
and
 
store
 
sensitive
 
data.
 
We
 
employ
 
a
 
layered
 
defensive approach
 
that
 
employs
 
people, processes
 
and
 
technology
 
to

manage and
 
maintain cybersecurity
 
controls through
 
a variety
 
of preventative
 
and detective
 
tools that
 
monitor, block,
 
and provide

alerts
 
regarding suspicious
 
activity
 
and
 
identify suspected
 
advanced persistent
 
threats.
 
Notwithstanding our
 
defensive measures

and
 
the
 
significant
 
resources
 
we
 
devote
 
to
 
protect
 
the
 
security
 
of
 
our
 
systems,
 
there
 
is
 
no
 
assurance
 
that
 
all
 
of
 
our
 
security

measures will be effective at all times, especially as the threats from cyber-attacks are continuous and severe. The risk of a security

breach due
 
to a
 
cyber-attack could
 
increase in
 
the future
 
as we
 
continue to
 
expand our
 
mobile banking
 
and other
 
internet-based

product
 
offerings,
 
the
 
use
 
of
 
the
 
cloud
 
for
 
system
 
development
 
and
 
hosting
 
and
 
internal
 
use
 
of
 
internet-based
 
products
 
and

applications.

We
 
continue to
 
detect and
 
identify attacks
 
that are
 
becoming more
 
sophisticated and
 
increasing in
 
volume, as
 
well as

attackers
 
that
 
respond
 
rapidly
 
to
 
changes
 
in
 
defensive
 
countermeasures. The
 
most
 
significant
 
cyber-attack
 
risks
 
that
 
we
 
or
 
our

critical service providers may face include, but are not limited to,
 
e-fraud, denial-of-service (DDoS), ransomware, computer intrusion

and
 
the
 
exploitation of
 
software zero-day
 
vulnerabilities that
 
might result
 
in
 
disruption of
 
services
 
and in
 
the
 
exposure or
 
loss of

customer
 
or
 
proprietary
 
data.
 
Loss
 
from
 
e-fraud
 
occurs
 
when
 
cybercriminals
 
compromise
 
our
 
systems
 
or
 
the
 
systems
 
of
 
our

28

customers and extract
 
funds from customer’s
 
credit cards or
 
bank accounts, including
 
through brute force,
 
password spraying and

credential
 
stuffing
 
attacks
 
directed
 
at
 
gaining
 
unauthorized
 
access
 
to
 
individual
 
accounts.
 
Denial-of-service
 
attacks
 
intentionally

disrupt
 
the
 
ability
 
of
 
legitimate
 
users,
 
including
 
customers
 
and
 
employees,
 
to
 
access
 
networks,
 
websites
 
and
 
online
 
resources.

Computer intrusion attempts either direct or through social engineering (pretext calls), supply chain compromise, email, text or voice

messages, including using brand impersonation (regularly referred
 
to as phishing, vishing, smishing
 
and quishing), have resulted in

and may continue to result in the compromise of sensitive customer data, such as account numbers, credit cards and social security

numbers,
 
and
 
could
 
present
 
significant
 
reputational, legal
 
and
 
regulatory costs
 
to
 
Popular
 
if
 
successful.
 
The
 
emergence of
 
new

technologies such as artificial intelligence and quantum
 
computing are further expected to exacerbate
 
the risk of cyber-attacks.

Our
 
customer-facing
 
platforms
 
are
 
also
 
routinely
 
attacked
 
by
 
threat
 
actors
 
aiming
 
to
 
gain
 
unauthorized
 
access
 
to
 
our

clients’ accounts.
 
Popular has
 
recently implemented
 
certain defensive
 
measures in
 
response to
 
brute force
 
attacks on
 
one of
 
our

platforms which resulted in certain
 
of our customers log-in credentials
 
and information being exposed. As
 
a result, Popular notified,

as required
 
or otherwise
 
deemed appropriate,
 
customers identified
 
as affected
 
by the
 
incident. We
 
have to
 
date not
 
experienced

material losses in connection with these attacks. Cyber-security risks have also been recently exacerbated by the discovery of zero-

day vulnerabilities in widely distributed third party software,
 
such as the vulnerability identified in the Apache
 
log4j in December 2021

and in the MOVEit file transfer application in
 
May 2023, which could affect Popular’s or any
 
of its service provider’s systems.

The
 
increased
 
use
 
of
 
remote
 
access
 
and
 
third-party
 
video
 
conferencing
 
solutions
 
to
 
enable
 
work-from-home

arrangements for employees and facilitate
 
the use of digital
 
channels by our customers,
 
has also increased our
 
exposure to cyber-

attacks. In
 
addition, a
 
third party
 
could misappropriate
 
confidential information
 
obtained by
 
intercepting signals
 
or communications

from mobile devices
 
used by Popular’s customers
 
or employees. Recent events,
 
including the wars
 
in Ukraine and
 
the Gaza Strip,

have also
 
illustrated increased
 
geo-political factors
 
and the
 
risks related
 
to supply-chain
 
compromises and
 
de-stabilizing activities

linked to
 
nation-state sponsored
 
activity as
 
an increasing
 
trend to
 
monitor actively.
 
Risks and
 
exposures related
 
to cyber
 
security

attacks are expected to remain high for the foreseeable future due to
 
the rapidly evolving nature and sophistication of these threats,

including the
 
rise in
 
the use
 
of cyber-attacks
 
as geopolitical
 
weapons. Although
 
we are
 
regularly targeted
 
by unauthorized
 
threat-

actor activity, including denial-of-service attacks, we have not, to date, experienced
 
any material losses as a result of cyber-attacks.

A material compromise or circumvention of the security of our systems could
 
have serious negative consequences for us,

including
 
significant
 
disruption
 
of
 
our
 
operations
 
and
 
those
 
of
 
our
 
clients,
 
customers
 
and
 
counterparties,
 
misappropriation
 
of

confidential information
 
of us
 
or that
 
of our
 
clients, customers,
 
counterparties or
 
employees, or
 
damage to
 
computers or
 
systems

used
 
by
 
us
 
or
 
by
 
our
 
clients,
 
customers
 
and
 
counterparties,
 
and
 
could
 
result
 
in
 
violations
 
of
 
applicable
 
privacy
 
and
 
other
 
laws,

financial loss
 
to us
 
or to
 
our customers,
 
loss of
 
confidence in
 
our security
 
measures, customer
 
dissatisfaction, significant litigation

exposure and harm to
 
our reputation, all of
 
which could have a
 
material adverse effect
 
on us. For example,
 
if personal, non-public,

confidential
 
or
 
proprietary
 
information
 
in
 
our
 
possession
 
were
 
to
 
be
 
mishandled,
 
misused
 
or
 
stolen,
 
we
 
could
 
suffer
 
significant

regulatory consequences, reputational damage
 
and financial loss.
 
Such mishandling, misuse
 
or misappropriation could include,
 
for

example, if such information
 
were provided to parties
 
who are not permitted
 
to have the
 
information, either by fault
 
of our systems,

by our employees
 
or counterparties, or
 
where such information
 
is intercepted or
 
otherwise inappropriately taken by
 
our employees

or third parties.

The
 
extent
 
of
 
a
 
particular
 
cyber-attack
 
and
 
the
 
steps
 
that
 
we
 
may
 
need
 
to
 
take
 
to
 
investigate
 
the
 
attack
 
may
 
not
 
be

immediately
 
clear,
 
and
 
it
 
may
 
take
 
a
 
significant
 
amount
 
of
 
time
 
before
 
such
 
an
 
investigation
 
can
 
be
 
completed.
 
While
 
such
 
an

investigation is ongoing, Popular may not necessarily know the full extent
 
of the harm caused by the cyber-attack, and that
 
damage

may continue to spread.
 
These factors may inhibit
 
our ability to provide
 
rapid, full and reliable
 
information about the cyber-attack to

our clients,
 
customers, counterparties
 
and regulators,
 
as well
 
as the
 
public. Moreover,
 
new regulations may
 
require us
 
to disclose

information about a cybersecurity event before
 
it has been resolved or
 
fully investigated. Furthermore, it may not
 
be clear how best

to
 
contain
 
and
 
remediate
 
the
 
potential
 
harm
 
caused
 
by
 
the
 
cyber-attack,
 
and
 
certain
 
errors
 
or
 
actions
 
could
 
be
 
repeated
 
or

compounded before they are discovered and remediated. Cyber-attacks could cause interruptions
 
in our operations and result in the

incurrence
 
of
 
significant
 
costs,
 
including those
 
related
 
to
 
forensic analysis
 
and
 
legal counsel,
 
each of
 
which may
 
be
 
required to

ascertain the extent
 
of any potential
 
harm to our
 
customers, or employees, or
 
damage to our information
 
systems and any
 
legal or

regulatory obligations that
 
may result therefrom.
 
Any cyber incidents
 
could also result
 
in, among other
 
things, increased regulatory

scrutiny
 
and adverse
 
regulatory or
 
civil
 
litigation consequences.
 
For a
 
discussion of
 
the guidance
 
and rules
 
that federal
 
banking

regulators
 
have
 
released
 
or
 
proposed
 
regarding
 
cybersecurity
 
and
 
cyber
 
risk
 
management
 
standards,
 
see
 
“Regulation
 
and

Supervision” in
 
Part
 
I,
 
Item
 
1 —
 
Business,
 
included in
 
the
 
Form 10-K
 
for the
 
year
 
ended December
 
31,
 
2023. Any
 
or
 
all
 
of
 
the

foregoing factors could further increase the impact
 
of the incident and thereby the costs and consequences
 
of a cyber-attack.

We also
 
rely on
 
third parties
 
for the
 
performance of
 
a significant
 
portion of
 
our information
 
technology functions and
 
the

29

provision of information security,
 
technology and business process services. As a result, a
 
successful compromise or circumvention

of
 
the security
 
of
 
the systems
 
of these
 
third-party service
 
providers could
 
have serious
 
negative consequences
 
for us,
 
including

compromise
 
of
 
our
 
systems,
 
misappropriation of
 
our
 
confidential
 
information
 
or
 
that
 
of
 
our
 
clients,
 
customers,
 
counterparties
 
or

employees,
 
or
 
other
 
negative
 
implications
 
identified
 
above
 
with
 
respect
 
to
 
a
 
cyber-attack
 
on
 
our
 
systems,
 
which
 
could
 
have
 
a

material
 
adverse effect
 
on
 
us.
 
Cyber-attacks at
 
third-party service
 
providers
 
are
 
also
 
becoming increasingly
 
common,
 
and,
 
as
 
a

result, cybersecurity risks relating to our vendors have
 
increased. The most important of these third-party service providers
 
for us is

Evertec. Certain risks particular to Evertec and
 
our dependence on third parties are discussed
 
under “We rely on other companies to

provide key components of our business infrastructure, including certain of our core financial transaction processing and information

technology and
 
security services, which
 
exposes us
 
to a
 
number of operational
 
risks that
 
could have
 
a material
 
adverse effect
 
on

us”
 
in
 
the
 
Operational
 
Risks
 
section
 
of