Northern (NTRS) Risk Factors

In conducting our U.S. and non-U.S. business, we are subject to risks of loss from various unfavorable political, economic, legal, public health, or other developments, including social or political instability, changes in governmental policies or policies of central banks, expropriation, nationalization, confiscation of assets, price controls, capital controls, exchange controls, unfavorable tax rates and tax court rulings and changes in laws and regulations. Less mature and often less regulated business and investment environments heighten these risks in various emerging markets. Our non-U.S. operations accounted for 31% of our revenue in 2021. Our non-U.S. businesses are subject to extensive regulation by various non-U.S. regulators, including governments, securities exchanges, central banks and other regulatory bodies in the jurisdictions in which those businesses operate. In many countries, the laws and regulations applicable to the financial services industry are uncertain and evolving and may be applied with extra scrutiny to foreign companies. Moreover, the regulatory and supervisory standards and expectations in one jurisdiction may not conform with standards or expectations in other jurisdictions. Even within a particular jurisdiction, the standards and expectations of multiple supervisory agencies exercising authority over our affairs may not be harmonized fully. Accordingly, it may be difficult for us to determine the exact requirements of local laws in every market or manage our relationships with multiple regulators in various jurisdictions. Our inability to remain in compliance with local laws in a particular market and manage our relationships with regulators could have an adverse effect not only on our businesses in that market but also on our reputation generally. The failure to mitigate properly such risks or the failure of our operating infrastructure to support such international activities could result in operational failures and regulatory fines or sanctions, which could affect our business and results of operations adversely. We actively strive to optimize our geographic footprint. This optimization may occur by establishing operations in lower-cost locations or by outsourcing to third-party vendors in various jurisdictions. These efforts expose us to the risk that we may not maintain service quality, control or effective management within these operations. In addition, we are exposed to the relevant macroeconomic, political, public health, and similar risks generally involved in doing business in those jurisdictions. The increased elements of risk that arise from conducting certain operating processes in some jurisdictions could lead to an increase in reputational risk. During periods of transition, greater operational risk and client concern exist with respect to maintaining a high level of service delivery. In addition, we are subject in our global operations to rules and regulations relating to corrupt and illegal payments, money laundering, and laws relating to doing business with certain individuals, groups and countries, such as the U.S. Foreign Corrupt Practices Act, the USA PATRIOT Act, the UK Bribery Act, and economic sanctions and embargo programs administered by the U.S. Office of Foreign Assets Control and similar agencies worldwide. While we have invested and continue to invest significant resources in training and in compliance monitoring, the geographic diversity of our operations, employees, clients and customers, as well as the vendors and other third parties with whom we deal, presents the risk that we may be found in violation of such rules, regulations, laws or programs and any such violation could subject us to significant penalties or affect our reputation adversely.

Both U.S. and non-U.S. governments and tax authorities, including states and municipalities, from time to time issue new, or modify existing, tax laws and regulations. These authorities may also issue new, or modify existing, interpretations of those laws and regulations. These new laws, regulations or interpretations, and our actions taken in response to, or reliance upon, such changes in the tax laws may impact our tax position in a manner that affects our earnings negatively. In the course of our business, we are sometimes subject to challenges from U.S. and non-U.S. tax authorities, including states and municipalities, regarding the amount of taxes due. These challenges may result in adjustments to the timing or amount of taxable income, deductions, tax credits, or the allocation of income among tax jurisdictions, all of which may require a greater provision for taxes or otherwise affect earnings negatively.

Any failure, interruption or breach in the security of our systems could severely disrupt our operations. Our systems involve the processing, storage and transmission of clients' and our proprietary and confidential information, and security breaches, including cyber-attacks, could expose us to a risk of theft, loss or other misappropriation of this information. Our security measures may be breached due to the actions of outside parties, employee error, failure of our controls with respect to access to our systems, malfeasance or otherwise, and, as a result, an unauthorized party may obtain access to our or our clients' proprietary and confidential information, resulting in the theft, loss, destruction, gathering, monitoring, or other misappropriation of this information. Additionally, we are subject to complex and evolving laws and regulations governing cybersecurity, data privacy and data protection, which may differ and potentially conflict, in various jurisdictions. Regulators globally are introducing the potential for greater monetary fines on institutions that suffer from breaches leading to the misappropriation of such information. Most states, the EU and other non-U.S. jurisdictions also have adopted their own statutes and/or regulations concerning data privacy and security and notification of data breaches. These and other changes in laws or regulations associated with the enhanced protection of personal and other types of information could greatly increase compliance costs and the size of potential fines related to the protection of such information. Information security and data privacy risks for large financial institutions like us are significant in part because of the evolving proliferation of new technologies, the use of the internet, mobile devices, and cloud technologies to conduct financial transactions and the increased sophistication and activities of hackers, terrorists, organized crime and other external parties, including foreign state actors. If we fail to continue to upgrade our technology infrastructure to ensure effective information security and data privacy relative to the type, size and complexity of our operations, we could become more vulnerable to cyber-attack and, consequently, subject to significant regulatory penalties. Also, like many large enterprises, in response to the COVID-19 pandemic, we have shifted the majority of our professionals to remote work arrangements, and expect that many will continue to work remotely to some extent even as we begin to institute return-to-office plans. This change has enabled us successfully to continue business operations, but also introduces potential new vulnerabilities to cyber threats. Additionally, our computer, communications, data processing, networks, backup, business continuity or other operating, information or technology systems, including those that we outsource to other providers, may fail to operate properly or become disabled, overloaded or damaged as a result of a number of factors, including events that are wholly or partially beyond our control, which could have a negative effect on our ability to conduct our business activities. The third parties with which we do business also are susceptible to the foregoing risks (including regarding the third parties with which they are similarly interconnected or on which they otherwise rely), and our or their business operations and activities may therefore be affected adversely, perhaps materially, by failures, terminations, errors or malfeasance by, or attacks or constraints on, one or more financial, technology, infrastructure or government institutions or intermediaries with whom we or they are interconnected or conduct business. While we conduct security assessments on third-party vendors, we cannot be certain that their information security protocols are sufficient to withstand a cyber-attack or other security breach. In addition, our clients often use their own devices, such as computers, smart phones and tablets, as well as third parties with whom they share information used for authentication, to manage their accounts, which may heighten the risk of system failures, interruptions or security breaches. In recent years, several financial services firms suffered successful cyber-attacks launched both domestically and from abroad, resulting in the disruption of services to clients, loss or misappropriation of sensitive or private information, and reputational harm. We and our clients have been, and expect to continue to be, subject to a wide variety of cyber-attacks and threats, including computer viruses, ransomware and other malicious code, distributed denial of service attacks, and phishing attacks, and it is possible that we could suffer material losses resulting from a breach. Because the techniques used to obtain unauthorized access, disable or degrade service or sabotage systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques, to implement adequate preventative measures, or to address them until they are discovered. In addition, successful cyber-attacks may persist for an extended period of time before being detected. Because any investigation of an information security incident would be inherently unpredictable, the extent of a particular information security incident and the path of investigating the incident may not be immediately clear. It may take a significant amount of time before such an investigation can be completed and full and reliable information about the incident is known. While such an investigation is ongoing, we may not necessarily know the extent of the harm or how best to remediate it, certain errors or actions could be repeated or compounded before they are discovered and remediated, and communication to the public, regulators, clients and other stakeholders may be inaccurate, any or all of which could further increase the costs and consequences of an information security incident. We could be the subject of legal claims or proceedings related to security incidents, including regulatory investigations and actions. Further, the market perception of the effectiveness of our security measures could be harmed, our reputation could suffer and we could lose clients in conjunction with security incidents, each of which could have a negative effect on our business, financial condition and results of operations. A breach of our security also may affect adversely our ability to effect transactions, service our clients, manage our exposure to risk or expand our business. An event that results in the loss of information also may require us to reconstruct lost data or reimburse clients for data and credit monitoring services, which could be costly and have a negative impact on our business and reputation. Although we maintain insurance covering information theft, damage, or destruction from cyber breach incidents, there can be no assurance that liabilities or losses we may incur will be covered under such policies or that the amount of insurance will be adequate. Further, even if not directed at us, attacks on financial or other institutions important to the overall functioning of the financial system or on our counterparties could affect, directly or indirectly, aspects of our business.

Our success depends, in large part, on our ability to attract new employees, retain and motivate our existing employees, and continue to compensate our employees competitively. Competition for the best employees in most activities in which we engage can be intense, and there can be no assurance that we will be successful in our efforts to recruit and retain necessary personnel. Factors that affect our ability to attract and retain talented and diverse employees include our compensation and benefits programs, our profitability and our reputation for rewarding and promoting qualified employees. Our ability to attract and retain key executives and other employees may be hindered as a result of existing and potential regulations applicable to incentive compensation and other aspects of our compensation programs. These regulations may not apply to some of our competitors and to other institutions with which we compete for talent. In addition, our current or future approach to in-office and remote work arrangements may not meet the needs or expectations of our current or prospective employees, may not be perceived as favorable as compared to the arrangements offered by competitors and may not be conducive to a collaborative working environment, which could adversely affect our ability to attract, retain and motivate employees. The unexpected loss of services of necessary personnel, both in businesses and corporate functions, could have a material adverse impact on our business because of their skills, knowledge of our markets, operations and clients, years of industry experience and, in some cases, the difficulty of promptly finding qualified replacement personnel. Similarly, the loss of necessary employees, either individually or as a group, could affect our clients' perception of our abilities adversely. The current competitive labor market may also have the effect of heightening many of these risks.

Our success in controlling the costs and expenses of our business operations also impacts operating results. Through various parts of our business strategy, we aim to produce efficiencies in operations that help reduce and control costs and expenses, including the costs of losses associated with operating risks attributable to servicing and managing financial assets. Failure to control these and other costs, as a result of our failure to execute on our strategies successfully, an overall inflationary environment, or otherwise, could affect our earnings negatively and reduce our competitive position.

We provide a broad range of financial products and services in highly competitive markets. We compete against large, well-capitalized, and geographically diverse companies that are capable of offering a wide array of financial products and services at competitive prices. In certain businesses, such as foreign exchange trading, electronic networks present a competitive challenge. Additionally, technological advances and the growth of internet-based commerce have made it possible for other types of institutions to offer a variety of products and services competitive with certain areas of our business. Many of these nontraditional service providers have fewer regulatory constraints and some have lower cost structures. The same may be said for competitors based in non-U.S. jurisdictions, where legal and regulatory environments may be more favorable than those applicable to the Corporation and the Bank as U.S.-domiciled financial institutions. These competitive pressures may have a negative effect on our earnings and ability to grow. Pricing pressures, as a result of the willingness of competitors to offer comparable or improved products or services at a lower price, also may result in a reduction in the price we can charge for our products and services, which could have, and in some cases has had, a negative effect on our ability to maintain or increase our profitability.

The failure or perceived failure to meet or appropriately address client expectations or fiduciary or other obligations, operational failures, legal and regulatory requirements, potential conflicts of interest, cybersecurity and privacy, social and sustainability concerns related to our business activities or any other of the risks discussed in this Item 1A could materially and adversely affect our reputation as well as our ability to attract and retain clients or employees. Additionally, the actual or alleged actions of our affiliates, vendors or other third parties with which we do business, the actual or alleged actions or statements of our employees or adverse publicity could negatively impact our reputation and significantly harm our business prospects. Damage to our reputation for delivery of a high level of service could undermine the confidence of clients and prospects in our ability to serve them and accordingly affect our earnings negatively. Damage to our reputation also could affect the confidence of rating agencies, regulators, stockholders and other parties in a wide range of transactions that are important to our business and the performance of our common stock. Failure to maintain our reputation ultimately could have an adverse effect on our ability to manage our balance sheet or grow our business. Actions by the financial services industry generally or by other members of or individuals in the financial services industry also could impact our reputation negatively or lead to a general loss of confidence in, or impact market perception of, financial institutions that could negatively affect us. Further, whereas negative public opinion once was driven primarily by adverse news coverage in traditional media, the proliferation of social media channels utilized by us and third parties, as well as the personal use of social media by our employees and others, may increase the risk of negative publicity, including through the rapid dissemination of inaccurate, misleading or false information, which could harm our reputation or have other negative consequences.