LPL Financial (LPLA) Risk Factors

Our business, including securities and investment advisory services, is subject to extensive regulation under both federal and state laws, rules and regulations, as well as SRO rules. Our subsidiary LPL Financial is: - registered as a clearing broker-dealer with the SEC, each of the 50 states, the District of Columbia, Puerto Rico and the U.S. Virgin Islands;- registered as an investment adviser with the SEC;- registered as an introducing broker-dealer with the CFTC;- a member of FINRA and various other SROs, and a participant in various clearing organizations, including the Depository Trust Company, the National Securities Clearing Corporation and the Options Clearing Corporation; and - subject to oversight by the DOL relative to its servicing of retirement plan accounts subject to ERISA and the Code. The primary SRO of LPL Financial's broker-dealer activity is FINRA, and the primary regulator of LPL Financial's investment advisory activity is the SEC. LPL Financial is also subject to state laws, including state "blue sky" laws, and the rules of the Municipal Securities Rulemaking Board for its municipal securities activities. The CFTC has designated the NFA as LPL Financial's primary regulator for futures and commodities trading activities. The SEC, FINRA, DOL, CFTC, NFA, OCC, various securities and futures exchanges and other United States and state-level governmental or regulatory authorities continuously review legislative and regulatory initiatives and may adopt new or revised laws, regulations or interpretations. There can be no assurance that other federal or state agencies will not attempt to further regulate our business or that specific interactions with foreign countries or foreign nationals will not trigger regulation in non-U.S. law in particular circumstances. These legislative and regulatory initiatives may affect the way in which we conduct our business and may make our business model less profitable. Our ability to conduct business in the jurisdictions in which we currently operate depends on our compliance with the laws, rules and regulations promulgated by federal regulatory bodies and the regulatory authorities in each of the states and other jurisdictions in which we do business. Our ability to comply with all applicable laws, rules and regulations and interpretations is largely dependent on our establishment and maintenance of compliance, audit and reporting systems and procedures, as well as our ability to attract and retain qualified compliance, audit, supervisory and risk management personnel. We cannot assure you that our systems and procedures are, or have been, effective in complying with all applicable laws, rules and regulations and interpretations. In particular, the diversity of information security environments in which our services are offered makes it difficult to ensure a uniformly robust level of compliance. Regulators have in the past raised, and may in the future raise, concerns with respect to the quality, consistency or oversight of certain aspects of our compliance systems and programs and our past or future compliance with applicable laws, rules and regulations. As of the date of this Annual Report on Form 10-K, we have a number of pending regulatory matters. For example, in October 2022, we received a request for information from the SEC in connection with an investigation of the Company's compliance with records preservation requirements for business-related electronic communications stored on personal devices or messaging platforms that we have not approved. Under the SEC's proposed resolution, we would pay a $50.0 million civil monetary penalty. As a result of the foregoing, we have recorded $40.0 million in other expense on the consolidated statements of income for the year ended December 31, 2023, to reflect the amount of the penalty that is not covered by our captive insurance subsidiary. We have not yet reached a settlement in principle with the SEC, and any settlement agreement remains subject to negotiation of the civil monetary penalty and definitive documentation. For more information, see Note 14 - Commitments and Contingencies within the notes to the consolidated financial statements in this Annual Report on Form 10-K. Violations of laws, rules or regulations and settlements in respect of alleged violations have in the past resulted in, and could in the future result in, legal liability, censures, penalties and fines, disgorgement of profits, restitution to customers, remediation, the issuance of cease-and-desist orders or injunctive or other equitable relief against us, which individually or in the aggregate could negatively impact our financial results or adversely affect our ability to attract or retain financial advisors and institutions. Depending on the nature of the violation, we may be required to offer restitution or remediation to customers, and the costs of doing so could exceed our loss reserves. We have established a captive insurance subsidiary that underwrites insurance for various regulatory and legal risks, although self-insurance coverage is not available for all matters, and may not be sufficient to protect us from losses we may incur. For more information about the potential limits of our insurance coverage, including our self-insurance coverage, see "Our insurance coverage may be expensive and we may exceed our limits of insurance coverage" above.

As discussed above, we are subject to ERISA and Section 4975 of the Code, and to regulations promulgated thereunder, insofar as we provide services with respect to plan clients, or otherwise deal with plans, participants and certain types of investment/savings accounts that are subject to ERISA or the Code. ERISA imposes certain duties on persons who are "fiduciaries" (as defined in Section 3(21) of ERISA and the related rules or interpretations) and prohibits certain transactions involving plans subject to ERISA and fiduciaries or other service providers to such plans. Non-compliance with or breaches of these provisions may expose an ERISA fiduciary or other service provider to liability under ERISA, which may include monetary and criminal penalties as well as equitable remedies for the affected plan. Section 4975 of the Code prohibits certain transactions involving "plans" (as defined in Section 4975(e)(1)), which include, for example, IRAs and certain Keogh plans and other qualified savings accounts, and service providers, including fiduciaries (as defined in Section 4975(e)(3)), to such plans. Section 4975 also imposes excise taxes for violations of these prohibitions. Our failure to comply with ERISA and the Code could result in significant penalties against us that could have a material adverse effect on our business or severely limit the extent to which we could act as fiduciaries for or provide services to these plans.

Clients of our advisors have control over their assets that are served under our platforms. Poor service or performance of the financial products that we offer, the emergence of new financial products or services from others, harm to our reputation or competitive pressures on pricing of such services or products may result in the loss of clients. In addition, we must monitor the pricing of our services and financial products in relation to competitors and periodically may need to adjust commission and fee rates, interest rates on deposits and margin loans and other fee structures to remain competitive. Competition from other financial services firms, such as reduced or zero commissions to attract clients or trading volume, direct-to-investor online financial services, including so-called "robo" advice, or higher deposit rates to attract client cash balances, could result in pricing pressure or otherwise adversely impact our business. The decrease in revenue that could result from such an event could have a material adverse effect on our business.

We cannot be certain that our systems and networks will not be subject to successful attacks, despite the measures we have taken and may take in the future to address and mitigate cybersecurity, privacy and technology risks. Additionally, in the course of operations, we share sensitive proprietary information and personal data with vendors, third parties and other financial institutions. We also rely upon software and data feeds from various third parties. Although we have a third party management program and conduct due diligence before sharing sensitive data with third-party vendors, this due diligence may not uncover administrative, technical or electronic gaps or flaws in their processes or systems. In the past we have experienced limited breaches of information security with our vendors, which have led to notification costs and reputational harm with regulators, current and potential advisors, and advisors' clients, and we may experience similar or more significant events in the future. Future data security incidents involving individual and regulatory notifications could lead to litigation involving other financial institutions, class actions, regulatory investigations or other harm. Data security incidents within the financial services industry are increasing, and threat actors continue to find novel ways to attack security environments. In light of the diversity of our advisors' security environments and the increasing sophistication of malicious actors, an attack could occur and persist for an extended period of time without detection. We expect that any investigation of a cyber-attack could take substantial amounts of time, and that there may be extensive delays before we obtain full and reliable information. In some cases, the nature of the attack may be such that full and reliable information may never be available. During such time we would not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, all of which would further increase the costs and consequences of such an attack. These incidents could involve operational disruptions, notification costs, ransom payments and reputational harm, investigations, litigation and fines with regulators, and increases in insurance premiums as well as litigation, financial disputes and reputational harm with current and potential advisors and advisors' clients.

Our business relies extensively on electronic data processing, storage and communications systems. In addition to better serving our advisors and their clients, the effective use of technology increases efficiency and enables firms like ours to reduce costs, support our regulatory compliance and reporting functions, and better serve advisors and their clients. Our continued success will depend, in part, upon our ability to continue to invest significant resources on our technology systems in order to: - successfully maintain and upgrade the capabilities and resiliency of our systems;- address the needs of our advisors and their clients by using technology to provide products and services that satisfy their demands while ensuring the security of the data involving those products and services;- use technology effectively and securely to support our regulatory compliance and reporting functions;- comply with the changing landscape of laws and regulations that govern protection of personally identifiable information; and - retain skilled information technology employees. Extraordinary trading volumes, malware, ransomware or attempts by hackers to introduce large volumes of fraudulent transactions into our systems, beyond reasonably foreseeable spikes in volumes, could cause our computer systems to operate at an unacceptably slow speed or even fail. Failure of our systems, which could result from these or other events beyond our control, or an inability or failure to effectively upgrade those systems, implement new technology-driven products or services, or implement adequate disaster recovery capabilities, could result in financial losses, unanticipated disruptions in our service, liability to our advisors or advisors' clients, compliance failures, regulatory sanctions and damage to our reputation. We continually update our technology platform with the goal of improving its reliability, resiliency, security and functionality, including in connection with regulatory requirements, acquisitions and strategic relationships. While we seek to implement these updates with no or limited interruption to our operations or the availability of our systems, we may not be successful and resulting interruptions could be widespread, lengthy, or both. Even if no interruption occurs, these updates may not result in the benefits to our systems that we contemplate. For example, we are upgrading our technology systems in connection with our current and future business development opportunities, pending acquisitions, investments and strategic relationships. These efforts involve a significant investment of financial and personnel resources and we cannot guarantee that these upgrades or the investments that support them will be completed successfully, on time or at all, or that they will not result in interruptions to the availability of our technology systems or business operations. More generally, our failure to upgrade our systems successfully could have a material adverse effect on our business, financial condition and results of operations, as well as our ability to achieve our growth objectives. For more information about risks related to upgrading our technology platform, see "Failure to maintain technological capabilities, flaws in existing technology, difficulties in upgrading our technology platform or the introduction of a competitive platform could have material adverse effect on our business" below. Our operations rely on the secure processing, storage and transmission of confidential and other proprietary information in our computer systems and networks, including personally identifiable information of advisors and their clients, as well as our employees. Although we take protective measures and endeavor to strengthen the security of these systems as circumstances warrant, our computer systems, software and networks are to some degree vulnerable to unauthorized access, human error, computer viruses, denial-of-service attacks, malicious code, spam attacks, phishing, ransomware or other forms of social engineering and other events that could impact the security, reliability, confidentiality, integrity and availability of our systems. To the extent third parties, such as product sponsors, also retain similarity sensitive information about our advisors or their clients, their systems may face similar vulnerabilities. We are not able to protect against these events completely given the rapid evolution of new vulnerabilities, the complex and distributed nature of our systems, our interdependence on the systems of other companies and the increased sophistication of potential attack vectors and methods against our systems. In particular, advisors work in a wide variety of environments, and although we require our advisors to maintain certain minimum security levels and adopt certain security procedures by policy, we cannot ensure the universal or consistent compliance with these policies across all of our advisors, or that our policy will be adequate to address the evolving threat environment. If one or more of these events occur, they could jeopardize our own, our advisors' or their clients', or our counterparties' confidential and other proprietary information processed, stored in and transmitted through our computer systems and networks, or otherwise cause interruptions or malfunctions in our own, our advisors' or their clients', our counterparties', or third parties' operations. As a result, we could be subject to litigation, client loss, reputational harm, regulatory sanctions and financial losses that are either not insured or are not fully covered through any insurance we maintain. If any person, including any of our employees or advisors, negligently disregards or intentionally breaches our established controls with respect to confidential client data, or otherwise mismanages or misappropriates that data, we could also be subject to significant monetary damages, regulatory enforcement actions, fines and/or criminal prosecution in one or more jurisdictions. We currently and may in the future use, develop, and incorporate within our technology platform and services, systems and tools that incorporate artificial intelligence ("AI") and machine learning, including generative AI. As with many innovations, AI and machine learning present risks and challenges that could adversely impact our business. The development, adoption and application of generative AI technologies are still in their early stages, and ineffective or inadequate AI development or deployment practices by third-party developers or vendors could result in unintended consequences. For example, AI algorithms that we use may be flawed or may be based on datasets that are biased or insufficient. In addition, any latency, disruption or failure in our AI and machine learning systems or infrastructure could result in delays or errors in our products and services. Developing, testing, and deploying resource-intensive AI systems may require additional investment and increase our costs. There also may be real or perceived social harm, unfairness or other outcomes that undermine public confidence in the use and deployment of AI and machine learning. Any of the foregoing may result in harm to our business, results of operations or reputation. The legal and regulatory landscape surrounding AI and machine learning technologies is rapidly evolving and remains uncertain, including in the areas of intellectual property, cybersecurity, privacy and data protection. For example, there is uncertainty around the validity and enforceability of intellectual property rights related to use, development and deployment of AI and machine learning. Compliance with new or changing laws, regulations or industry standards relating to AI may impose significant operational costs and may limit our ability to develop, deploy or use AI and machine learning technologies. Failure to appropriately respond to this evolving landscape may result in legal liability, regulatory action or brand and reputational harm.