Comerica (CMA) Risk Analysis

The financial services industry experiences rapid technological change with regular introductions of new technology-driven products and services. The ability to access and use technology is an increasingly important competitive factor in the financial services industry, and having the right technology is a critically important component to customer satisfaction. As well, the efficient and effective utilization of technology enables financial institutions to reduce costs. Comerica's future success depends, in part, upon its ability to address the needs of its customers by using technology to market and deliver products and services that will satisfy customer demands, meet regulatory requirements, and create additional efficiencies in Comerica's operations. Comerica may not be able to effectively develop new technology-driven products and services or be successful in marketing or supporting these products and services to its customers, which could have a material adverse impact on Comerica's financial condition and results of operations.

Comerica's computer systems and network infrastructure and those of third parties, on which Comerica is highly dependent, are subject to security risks and could be susceptible to cyber attacks, such as denial of service attacks, hacking, terrorist activities or identity theft. Comerica's business relies on the secure processing, transmission, storage and retrieval of confidential, proprietary and other information in its computer and data management systems and networks, and in the computer and data management systems and networks of third parties. In addition, to access Comerica's network, products and services, its customers and other third parties may use personal mobile devices or computing devices that are outside of its network environment and are subject to their own cybersecurity risks. Cyber attacks could include computer viruses, malicious or destructive code, phishing attacks, denial of service or information, ransomware, improper access by employees or vendors, attacks on personal email of employees, ransom demands to not expose security vulnerabilities in Comerica's systems or the systems of third parties, or other security breaches, and could result in the destruction or exfiltration of data and systems. As cyber threats continue to evolve, Comerica may be required to expend significant additional resources to continue to modify or enhance its protective measures or to investigate and remediate any information security vulnerabilities or incidents. Despite efforts to ensure the integrity of Comerica's systems and implement controls, processes, policies and other protective measures, Comerica may not be able to anticipate all security breaches. Nor may it (or the third parties whose systems we rely upon) be able to implement guaranteed preventive measures against such security breaches. Cyber threats are rapidly evolving and Comerica may not be able to anticipate or prevent all such attacks and could be held liable for any security breach or loss. Although Comerica has programs in place related to business continuity, disaster recovery and information security to maintain the confidentiality, integrity, and availability of its systems, business applications and customer information, such disruptions may still give rise to interruptions in service to customers and loss or liability to Comerica, including loss of customer data. Like other financial services firms, Comerica and its third party providers continue to be the subject of cyber attacks. Although to this date Comerica has not experienced any material losses or other material consequences related to cyber attacks, future cyber attacks could be more disruptive and damaging, and Comerica may not be able to anticipate or prevent all such attacks. Further, cyber attacks may not be detected in a timely manner. Cyber attacks or other information or security breaches, whether directed at Comerica or third parties, may result in a material loss or have material consequences. Furthermore, the public perception that a cyber attack on Comerica's systems has been successful, whether or not this perception is correct, may damage its reputation with customers and third parties with whom it does business. Hacking of personal information and identity theft risks, in particular, could cause serious reputational harm. A successful penetration or circumvention of system security could cause Comerica serious negative consequences, including loss of customers and business opportunities, costs associated with maintaining business relationships after an attack or breach; significant business disruption to Comerica's operations and business, misappropriation, exposure, or destruction of its confidential information, intellectual property, funds, and/or those of its customers; or damage to Comerica's or Comerica's customers' and/or third parties' computers or systems, and could result in a violation of applicable privacy laws and other laws, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in Comerica's security measures, reputational damage, reimbursement or other compensatory costs, additional compliance costs, and could adversely impact its results of operations, liquidity and financial condition. In addition, although Comerica maintains insurance coverage that may cover certain cyber losses (subject to policy terms and conditions), we may not have adequate insurance coverage to compensate for losses from a cybersecurity event.

Comerica is subject to extensive regulation, supervision and examination by the U.S. Treasury, the Texas Department of Banking, the FDIC, the FRB, the OCC, the CFPB, the CFTC, the SEC, FINRA, DOL, MSRB and other regulatory bodies. Such regulation and supervision governs and limits the activities in which Comerica may engage. Regulatory authorities have extensive discretion in their supervisory and enforcement activities, including the imposition of restrictions on Comerica's operations and ability to make acquisitions, investigations and limitations related to Comerica's securities, the classification of Comerica's assets and determination of the level of Comerica's allowance for loan losses. Any change in such regulation and oversight, whether in the form of regulatory policy, regulations, legislation, changed interpretations or supervisory action, may have a material adverse impact on Comerica's business, financial condition or results of operations. The impact of any future legislation or regulatory actions may adversely affect Comerica's businesses or operations. Further, even if such regulations or oversight do not change, Comerica's business may develop such that it may be subject to increased regulatory requirements. For example, if Comerica's asset size increases in the future and exceeds $100 billion in average total consolidated assets calculated over four consecutive financial quarters, Comerica will become a Category IV institution. Category IV institutions ($100 to $250 billion in assets) under the Tailoring Rules are subject to additional requirements, such as certain enhanced prudential standards and monitoring and reporting certain risk-based indicators. Under the Tailoring Rules, Category IV firms are, among other things, subject to (1) supervisory capital stress testing on a biennial basis, (2) requirements to develop and maintain a capital plan on an annual basis and (3) certain liquidity risk management and risk committee requirements, including liquidity buffer and liquidity stress testing requirements. Comerica would also incur additional assessments under Regulation TT. If Comerica becomes subject to enhanced prudential standards, it will face more stringent requirements or limitations on its business, as well as increased compliance costs, and, depending on its levels of capital and liquidity, stress test results and other factors, may be limited in the types of activities it may conduct and be limited as to how it utilizes capital. Further, Comerica may be subject to heightened expectations, which could result in additional regulatory scrutiny, higher penalties, and more severe consequences if it is unable to meet those expectations. In particular,on July 27, 2023, the FRB, the FDIC, and the OCC issued a proposal, referred to as "Basel III Endgame," that would result in significant changes to the U.S. regulatory capital rules for banking organizations with total consolidated assets of $100 billion or more. As of December 31, 2023, the Corporation had total assets of $85.8 billion. While Basel III Endgame would not apply to Comerica as currently proposed, if Comerica becomes subject to those requirements or becomes subject to any other new laws or regulations related to capital and liquidity, such requirements could limit Comerica's ability to pay dividends or make share repurchases or require Comerica to reduce business levels or to raise capital, which would have a material adverse effect on Comerica's financial condition and results of operations.

Fraudulent activity can take many forms and has escalated as more tools for accessing financial services emerge, such as real-time payments. Fraud schemes are broad and continuously evolving. Examples include but are not limited to: debit card/credit card fraud, check fraud, mechanical devices attached to ATM machines, social engineering and phishing attacks to obtain personal information, impersonation of clients through the use of falsified or stolen credentials, employee fraud, information theft and other malfeasance. Increased deployment of technologies, such as chip card technology, defray and reduce aspects of fraud; however, criminals are turning to other sources to steal personally identifiable information in order to impersonate the consumer to commit fraud. Many of these data compromises have been widely reported in the media. Further, as a result of the increased sophistication of fraud activity, Comerica continues to invest in systems, resources, and controls to detect and prevent fraud. This will result in continued ongoing investments in the future.

Monetary and fiscal policies of various governmental and regulatory agencies, in particular the FRB, affect the financial services industry, directly and indirectly. The FRB regulates the supply of money and credit in the U.S., and its monetary policies determine in large part Comerica's cost of funds for lending and investing and the return that can be earned on such loans and investments. Changes in such policies, including changes in interest rates or changes in the FRB's balance sheet, influence the origination of loans, the value of investments, the generation of deposits and the rates received on loans and investment securities and paid on deposits. Changes in monetary and fiscal policies are beyond Comerica's control and difficult to predict. Comerica's financial condition and results of operations could be materially adversely impacted by changes in governmental monetary and fiscal policies.

Acts of terrorism, cyber-terrorism, political unrest, war, civil disturbance, armed regional and international hostilities and international responses to these hostilities, natural disasters (including tornadoes, hurricanes, earthquakes, fires, droughts and floods), global health risks or pandemics, or the threat of or perceived potential for these events could have a negative impact on us. Comerica's business continuity and disaster recovery plans may not be successful upon the occurrence of one of these scenarios, and a significant catastrophic event anywhere in the world could materially adversely affect Comerica's operating results. In particular, certain of the regions where Comerica operates, including California, Texas, and Florida, are known for being vulnerable to natural disasters. These types of natural catastrophic events have at times disrupted the local economies, Comerica's business and customers, and have caused physical damage to Comerica's property in these regions. Dangerous, potentially deadly, and easily-transmitted viruses and other pathogens, and government and social reactions to such epidemics and pandemics have affected, and may again affect, international trade (including supply chains and export levels), travel, employee productivity, and other economic activities. These potential events may negatively impact Comerica's and/or its clients' costs, demand for its clients' products, and/or the U.S. economy or certain sectors thereof and, thus, adversely affect Comerica's business, financial condition, and results of operations. Further, catastrophic events may have an impact on Comerica's customers and in turn, on Comerica. In addition, these events have had and may continue to have an adverse impact on the U.S. and world economy in general and consumer confidence and spending in particular, which could harm Comerica's operations. Any of these events could increase volatility in the U.S. and world financial markets, which could harm Comerica's stock price and may limit the capital resources available to Comerica and its customers. This could have a material adverse impact on Comerica's operating results, revenues and costs and may result in increased volatility in the market price of Comerica's common stock.