STIFEL FINANCIAL CORP

Previous wording

Lack of funding, liquidity, or access to capital could impair our business and financial condition. An inability to maintain adequate funding and liquidity to operate our business could have a significant negative effect on our financial condition. We have a contingency funding plan which would guide our actions if one or more of our businesses were to experience disruptions from normal funding and liquidity sources. If the available funding from one or more of our contingent funding sources is not sufficient to sustain normal operating levels, we may be required to scale back or curtail our operations, such as by limiting lending, selling assets at unfavorable prices, cutting or eliminating dividend payments, or limiting our recruiting of financial advisors. Our liquidity could be negatively affected by: any inability of our subsidiaries to generate cash to distribute to the parent company, liquidity or capital requirements that may prevent our subsidiaries from distributing cash, limitations on our subsidiaries’ access to credit markets for secured and unsecured borrowings, diminished access to the credit and capital markets, and other commitments or restrictions on capital as a result of adverse legal settlements, judgments, regulatory sanctions, or an adverse change in our credit rating by one or more of the national rating agencies. Furthermore, as a bank holding company, we may become subject to prohibitions or limitations on our ability to pay dividends to our shareholders and/or repurchase our stock. Certain of our regulators have the authority, and under certain circumstances, the duty, to prohibit or to limit dividend payments by regulated subsidiaries to their parent company.

Current wording

Lack of funding, liquidity, or access to capital could impair our business and financial condition. An inability to maintain adequate funding and liquidity to operate our business could have a significant negative effect on our financial condition. We have a contingency funding plan which would guide our actions if one or more of our businesses were to experience disruptions from normal funding and liquidity sources. If the available funding from one or more of our contingent funding sources is not sufficient to sustain normal operating levels, we may be required to scale back or curtail our operations, such as by limiting lending, selling assets at unfavorable prices, reducing or eliminating dividend payments, or limiting our recruiting of financial advisors. Our liquidity could be negatively affected by: any inability of our subsidiaries to generate cash to distribute to the parent company, liquidity or capital requirements that may prevent our subsidiaries from distributing cash, limitations on our subsidiaries’ access to credit markets for secured and unsecured borrowings, diminished access to the credit and capital markets, and other commitments or restrictions on capital as a result of adverse legal settlements, judgments, regulatory sanctions, or an adverse change in our credit rating by one or more of the national rating agencies. Furthermore, as a bank holding company, we may become subject to prohibitions or limitations on our ability to pay dividends to our shareholders and/or repurchase our stock. Certain of our regulators have the authority, and under certain circumstances, the duty, to prohibit or to limit dividend payments by regulated subsidiaries to their parent company.

Previous wording

We rely heavily on bank deposits as a low-cost source of funding for Stifel Bancorp to extend loans to clients and purchase investment securities. Our bank deposits are primarily driven by our multi-bank sweep program in which clients’ cash deposits in their brokerage accounts are swept into FDIC-insured interest-bearing accounts at our bank subsidiaries and various third-party banks. A significant reduction in our domestic clients’ cash balances, a change in the allocation of that cash between our bank subsidiaries and third-party banks, a movement of cash away from our company, or an inability to implement new or modified deposit offerings in order to retain or grow our client base, could significantly impact our ability to continue growing interest-earning assets and/or require us to use higher-cost deposit sources to grow interest-earning assets. Rapidly rising rates, for example, have made and may continue to make investments in securities, such as fixed income securities and money market funds, more attractive for investors, thereby incentivizing them to reduce the cash they hold.

Current wording

We rely heavily on bank deposits as a low-cost source of funding for Stifel Bancorp to extend loans to clients and purchase investment securities. Our bank deposits are primarily driven by our multi-bank sweep program in which clients’ cash deposits in their brokerage accounts are swept into FDIC-insured interest-bearing accounts at our bank subsidiaries and various third-party banks. During 2025, we have seen an increase in deposits from our commercial, venture banking, and fund banking clients. A significant reduction in our domestic clients’ cash balances, a change in the allocation of that cash between our bank subsidiaries and third-party banks, a movement of cash away from our company, or an inability to implement new or modified deposit offerings in order to retain or grow our client base, could significantly impact our ability to continue growing interest-earning assets and/or require us to use higher-cost deposit sources to grow interest-earning assets. Rapidly rising rates, for example, have made and may continue to make investments in securities, such as fixed income securities and money market funds, more attractive for investors, thereby incentivizing them to reduce the cash they hold.

Previous wording

A credit rating downgrade would also result in the Company incurring a higher facility fee on its $750 million unsecured revolving credit facility agreement (the “Credit Facility”), in addition to triggering a higher interest rate applicable to any borrowings outstanding on the line as of and subsequent to such downgrade. See “Item 7 – Management’s Discussion and Analysis of Financial Condition and Results of Operations – Liquidity and Capital Resources” of this Form 10-K and Note 11 of the Notes to Consolidated Financial Statements of this Form 10-K for information on the Credit Facility.

Current wording

A credit rating downgrade would also result in the Company incurring a higher facility fee on its $1.0 billion unsecured revolving credit facility agreement (the “Credit Facility”), in addition to triggering a higher interest rate applicable to any borrowings outstanding on the line as of and subsequent to such downgrade. See “Item 7 – Management’s Discussion and Analysis of Financial Condition and Results of Operations – Liquidity and Capital Resources” of this Form 10-K and Note 11 of the Notes to Consolidated Financial Statements of this Form 10-K for information on the Credit Facility.

Previous wording

We are exposed to market risk, including interest rate risk. Market risk generally represents the risk that values of assets and liabilities or revenues will be adversely affected by changes in market conditions, which directly and indirectly affect us. Market conditions that change from time to time, thereby exposing us to market risk, include fluctuations in interest rates, equity prices, foreign exchange rates, and price deterioration or changes in value due to changes in market perception, actual credit quality of an issuer, or other factors.

Current wording

We are exposed to market risk, including interest rate risk. Market risk generally represents the risk that values of assets and liabilities or revenues will be adversely affected by changes in market conditions, which directly and indirectly affect us. Market conditions that change from time to time, thereby exposing us to market risk, include fluctuations in interest rates, equity prices, foreign exchange rates, and price deterioration or changes in value due to changes in market perception of the credit quality of an issuer, or other factors.

Previous wording

In our brokerage operations, increases in short-term interest rates have historically resulted in an increase in our net earnings, and we expect decreases in short-term interest rates to generally reduce our net earnings, although there may be offsetting favorable impacts. As it relates to our net interest income, the magnitude of the effect of a decrease in short-term interest rates depends on a number of factors impacting balances, asset yields, and the cost of funding. The magnitude of the impact to our net interest margin depends on the yields on interest-earning assets relative to the cost of interest-bearing liabilities, including deposit rates paid to clients on their cash balances. Decreases in short-term interest rates generally also result in a decrease to fees earned from third-party banks, although the magnitude of the impact may also be impacted by demand for cash balances by third-party banks and the rate paid to clients on their cash sweep balances. Rates paid to clients on their cash balances are generally impacted by the level of short-term interest rates, as well as competitive industry dynamics and the demand for client cash. Additionally, any future changes to regulatory rules or interpretations governing the fees the firm earns on cash sweep balances could also impact the rates we pay to clients on cash balances. If we are unable to effectively manage our interest rate risk, changes in interest rates could have a material adverse effect on our profitability.

Current wording

In our brokerage operations, increases in short-term interest rates have historically resulted in an increase in our net earnings, and we expect decreases in short-term interest rates to generally reduce our net earnings, although there may be offsetting favorable impacts. As it relates to our net interest income, the magnitude of the effect of a decrease in short-term interest rates depends on a number of factors impacting balances, asset yields, and the cost of funding. The magnitude of the impact to our net interest margin depends on the yields on interest-earning assets relative to the cost of interest-bearing liabilities, including deposit rates paid to clients on their cash balances. Decreases in short-term interest rates generally also result in a decrease to fees earned from third-party banks, although the magnitude of the decline may also be impacted by demand for cash balances by third-party banks and the rate paid to clients on their cash sweep balances. Rates paid to clients on their cash balances are generally impacted by the level of short-term interest rates, as well as competitive industry dynamics and the demand for client cash. Additionally, any future changes to regulatory rules or interpretations governing the fees the firm earns on cash sweep balances could also impact the rates we pay to clients on cash balances. If we are unable to effectively manage our interest rate risk, changes in interest rates could have a material adverse effect on our profitability.

Previous wording

In addition, disruptions in the liquidity or transparency of the financial markets may result in our inability to sell, syndicate, or realize the value of security positions, thereby leading to increased concentrations. The inability to reduce our positions in specific securities may not only increase the market and credit risks associated with such positions, but also increase the level of risk-weighted assets on our balance sheet, thereby increasing our capital requirements, which could have an adverse effect on our business results, financial condition and liquidity.

Current wording

In addition, disruptions in the liquidity or transparency of the financial markets may result in our inability to sell, syndicate, or realize the value of security positions, potentially leading to increased concentrations. The inability to reduce our positions in specific securities may not only increase the market and credit risks associated with such positions, but also increase the level of risk-weighted assets on our balance sheet, thereby increasing our capital requirements, which could have an adverse effect on our business results, financial condition and liquidity.

Previous wording

Our business is sensitive to domestic and international macroeconomic conditions caused by political and geopolitical developments, fiscal, monetary, and tax policies, regulations, and other domestic and international events. We are engaged in various financial services businesses. As such, we are affected by domestic and international macroeconomic and political conditions, as well as economic output levels, interest and inflation rates, employment levels, prices of commodities, consumer confidence levels, changes in consumer spending, international trade policy, and fiscal and monetary policy. For example, Fed policies determine, in large part, interest rates and the cost of funds which directly affect the returns and fair value on our lending and investing activities. The market impact from such policies can also materially decrease the value of certain of our financial assets, most notably debt securities, as well as our cash flows. In addition, our results of operations may be impacted by changes resulting from different political philosophies governing individual and corporate taxation, as well as regulation, which may result from the outcome of the recent federal elections in the U.S. For example, changes to tax laws and regulations, including various provisions of the TCJA which will expire in 2025 if not extended, may negatively impact our effective income tax rate, financial results, or the amount of any tax assets or liabilities. Changes in tax law and regulation, or any market uncertainty caused by a change in the political environment, may also affect our clients and, directly or indirectly, our business. Macroeconomic conditions may also be negatively affected by domestic or international events, including natural disasters, political unrest, the indirect impact of wars and conflicts, such as the wars in Ukraine and Israel, or public health epidemics and pandemics, as well as by a number of factors in the global financial markets that may be detrimental to our operating results, including trading levels, investing, and origination activity in the securities markets, security valuations, the absolute and relative level and volatility of interest and currency rates, real estate values, the actual and perceived quality of issuers and borrowers, and the supply of and demand for loans and deposits.

Current wording

Our business is sensitive to domestic and international macroeconomic conditions caused by political and geopolitical developments, fiscal, monetary, and tax policies, regulations, and other domestic and international events. We are engaged in various financial services businesses. As such, we are affected by domestic and international macroeconomic and political conditions, as well as economic output levels, interest and inflation rates, employment levels, prices of commodities, consumer confidence levels, changes in consumer spending, international trade policy, and fiscal and monetary policy. For example, Fed policies determine, in large part, interest rates and the cost of funds which directly affect the returns and fair value on our lending and investing activities. The market impact from such policies can also materially decrease the value of certain of our financial assets, most notably debt securities, as well as our cash flows. In addition, our results of operations may be impacted by governmental policy changes and/or regulatory reform in multiple areas, including tax, international trade, immigration, healthcare, labor, infrastructure, and energy. While there is uncertainty around the timing of many such potential changes, such changes, or any market uncertainty caused by a potential change in governmental policies, may also affect our clients and, directly or indirectly, our business. Furthermore, over the last several years, the federal government has shut down multiple times, in some cases for prolonged periods, and it is possible that the federal government may shut down again in the future. Although the recent government shutdown is not expected to materially affect our results of operations, any prolonged future shutdown could significantly impact business and economic conditions generally or specifically in our key markets, which could have a material adverse effect on our results and financial condition. Macroeconomic conditions may also be negatively affected by domestic or international events, including natural disasters, political unrest, the indirect impact of wars and conflicts, or public health epidemics and pandemics, as well as by several factors in the global financial markets that may be detrimental to our operating results.

Previous wording

As a market-maker, we may take ownership of positions in specific securities, and these undiversified holdings concentrate the risk of market fluctuations and may result in greater losses than would be the case if our holdings were more diversified. Despite risk mitigation policies, we may incur losses as a result of positions we hold in connection with these activities.

Current wording

As a market-maker, we may take ownership of positions in specific securities, and these undiversified holdings concentrate the risk of market fluctuations and may result in greater losses than would be the case if our holdings were more diversified. Despite risk mitigation policies and practices, we may incur losses as a result of positions we hold in connection with these activities.

Previous wording

We deposit our cash in depository institutions as a means of maintaining the liquidity necessary to meet our operating needs, and we also facilitate the deposit of cash awaiting investment in depository institutions on behalf of our clients. Many of these deposits exceed FDIC-insured limits. Recent events in the financial services industry, including the failure of certain banks, have increased counterparty credit risk. While we perform extensive diligence on the banks we select to hold these deposits, a failure of one or more of these depository institutions to return these deposits could affect our operating liquidity, result in reputational damage, and impair our financial performance.

Current wording

We deposit our cash in depository institutions as a means of maintaining the liquidity necessary to meet our operating needs, and we also facilitate the deposit of cash awaiting investment in depository institutions on behalf of our clients. Many of these deposits exceed FDIC-insured limits. While we perform extensive diligence on the banks we select to hold these deposits, a failure of one or more of these depository institutions to return these deposits could affect our operating liquidity, result in reputational damage, and impair our financial performance.

Previous wording

We face intense competition and pricing pressures and may not be able to keep pace with technological change. We are engaged in intensely competitive businesses. We compete on the basis of a number of factors, including the quality of our associates, our products and services, pricing (such as execution pricing and fee levels), technology solutions, and location and reputation in relevant markets. Over time, there has been substantial consolidation and convergence among companies in the financial services industry, which has significantly increased the capital base and geographic reach of our competitors. See “Item 1 – Business - Competition” of this Form 10-K for additional information about our competitors.

Current wording

We face intense competition and pricing pressures and may not be able to keep pace with technological change. We are engaged in intensely competitive businesses. We compete on the basis of a number of factors, including the quality of our associates and financial advisors, our products and services, pricing (such as execution pricing and fee levels), technology solutions, and location and reputation in relevant markets. Over time, there has been substantial consolidation and convergence among companies in the financial services industry, which has significantly increased the capital base and geographic reach of our competitors. See “Item 1 – Business - Competition” of this Form 10-K for additional information about our competitors.

Previous wording

Although we currently do not use AI extensively, we may in the future use, develop, and incorporate within our technology platform and services, systems and tools that incorporate AI and machine learning, including generative AI. Although we strive to establish and maintain appropriate governance and risk management processes, ineffective or inadequate AI development or deployment practices by us or third-party vendors could result in unintended consequences, such as AI algorithms that produce inaccurate output or that are based on biased, incomplete, and/or inaccurate datasets. Any of the foregoing may result in harm to our business, results of operations, or reputation. Compliance with new or changing laws, regulations, or industry standards relating to AI may impose significant operational costs and limit our ability to develop, deploy, or use AI and machine learning technologies.

Current wording

We use, develop, and incorporate within our technology platform and services, systems and tools that incorporate AI and machine learning, including generative AI. Although we strive to establish and maintain appropriate governance and risk management processes, ineffective or inadequate AI development or deployment practices by us or third-party vendors could result in unintended consequences, such as AI algorithms that produce inaccurate output or that are based on biased, incomplete, and/or inaccurate datasets. Despite implementing polices and safeguards to prevent unauthorized disclosures, our use of AI may still pose heightened security and privacy risks, which we seek to mitigate by relying on proprietary or “walled-garden” environments to enhance data protection and operational controls and maintain confidentiality. Any of the foregoing may result in harm to our business, results of operations, or reputation. Compliance with new or changing laws, regulations, or industry standards relating to AI may impose significant operational costs and limit our ability to develop, deploy, or use AI and machine learning technologies.

Previous wording

A continued interruption to our telecommunications or data processing systems, or the failure to effectively update the technology we utilize, could be materially adverse to our business. Our businesses rely extensively on data processing and communications systems. In addition to better serving clients, the effective use of technology increases efficiency and enables us to reduce costs. Adapting or developing our technology systems to meet new regulatory requirements, client needs, and competitive demands is critical for our business. Introduction of new technology presents challenges on a regular basis. There are significant technical and financial costs and risks in the development of new or enhanced applications, including the risk that we might be unable to effectively use new technologies, adapt our applications to emerging industry standards, or keep applications current as it relates to vulnerabilities and security controls.

Current wording

A continued interruption to our telecommunications or data processing systems, or the failure to effectively update the technology we utilize, could be materially adverse to our business. Our businesses rely extensively on data processing and communications systems, including both third-party and internally developed technology solutions. In addition to better serving clients, the effective use of technology increases efficiency and enables us to reduce costs. Adapting or developing our technology systems to meet new regulatory requirements, client needs, and competitive demands is critical for our business. Introduction of new technology presents challenges on a regular basis. There are significant technical and financial costs and risks in the development of new or enhanced applications, including the risk that we might be unable to effectively use new technologies, adapt our applications to emerging industry standards, or keep applications current as it relates to vulnerabilities and security controls.

Previous wording

Cyber attack or other security breach of our technology systems, or those of other third-party vendors we rely on, could subject us to significant liability reputational harm. Our operations rely heavily on the secure processing, storage, and transmission of sensitive and confidential financial, personal, and other information in our computer systems and networks. There have been numerous highly publicized cases involving financial services companies reporting the unauthorized disclosure of client or other confidential information in recent years, as well as cyber attacks involving the theft, dissemination, and destruction of corporate information or other assets, in some cases as a result of failure to follow procedures by employees or contractors or as a result of actions by third parties. There have also been numerous highly publicized cases where hackers have requested “ransom” payments in exchange for not disclosing customer information or for restoring access to information or systems. Like other financial services firms, we experience malicious cyber activity directed at our computer systems, software, networks, and its users on a daily basis. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware, and denial-of-service attacks. We also experience large volumes of phishing and other forms of social engineering attempted for the purpose of perpetrating fraud against our company, our associates, our advisors, or our clients. Additionally, like many large enterprises, we provide secure remote work capabilities, which can introduce potential cyber vulnerabilities as well.

Current wording

Cyber attack or other security breach of our technology systems, or those of other third parties we rely on, could subject us to significant liability and reputational harm. Our operations rely heavily on the secure processing, storage, and transmission of sensitive and confidential financial, personal, and other information in our computer systems and networks. There have been numerous highly publicized cases involving financial services companies reporting the unauthorized disclosure of client or other confidential information in recent years, as well as cyber attacks involving the theft, dissemination, and destruction of corporate information or other assets, in some cases as a result of failure to follow procedures by employees or contractors or as a result of actions by third parties. There have also been numerous highly publicized cases where hackers have requested “ransom” payments in exchange for not disclosing customer information or for restoring access to information or systems. Like other financial services firms, we experience malicious cyber activity directed at our computer systems, software, networks, and its users on a daily basis. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware, and denial-of-service attacks. We also experience large volumes of phishing and other forms of social engineering attempted for the purpose of perpetrating fraud against our company, our associates, our advisors, or our clients. Additionally, like many large enterprises, we provide secure remote work capabilities, which can introduce potential cyber vulnerabilities as well.

Previous wording

We also face increased cybersecurity risk for a period of time after acquisitions as we transition the acquired entity’s historical systems and networks to our standards. We also face additional cybersecurity risk related to an increased focus on mobile and cloud technologies. Our reliance on public cloud services introduces cybersecurity risks, including potential data breaches, unauthorized access, and compromised application programming interfaces (APIs) which could impact the confidentiality, integrity, or availability of our systems and data. Likewise, our mobile and web-facing technologies expose us to risks such as data leakage, malicious applications, phishing attacks, and network level threats which pose similar risks. We seek to continuously monitor for and nimbly react to any and all such malicious cyber activity, and we develop our systems to protect the confidentiality, integrity, and availability of our data and technology infrastructure and data from misuse, misappropriation, or corruption.

Current wording

We also face increased cybersecurity risk for a period of time after acquisitions as we transition the acquired entity’s historical systems and networks to our standards. We also face additional cybersecurity risk related to an increased focus on mobile and cloud technologies and reliance on external service providers. Our reliance on public cloud services introduces cybersecurity risks, including potential data breaches, unauthorized access, and compromised application programming interfaces (APIs) which could impact the confidentiality, integrity, or availability of our systems and data. Cloud-related risks may also arise from misconfiguration, weaknesses in identity and access controls, vulnerabilities in cloud workloads, and failures or outages at cloud service providers. Likewise, our mobile and web-facing technologies expose us to risks such as data leakage, malicious applications, phishing attacks, and network level threats which pose similar risks. We seek to continuously monitor for and nimbly react to malicious cyber activity, and we develop our systems to protect the confidentiality, integrity, and availability of our data and technology infrastructure from misuse, misappropriation, or corruption. We also rely on numerous third-party service providers to conduct aspects of our business operations and face similar risks relating to those third parties, including operational disruptions, security weaknesses, delayed incident notification, and supply chain risks.

Previous wording

Cyber attacks can originate from a variety of sources, including threat actors affiliated with foreign governments, organized crime, or terrorist organizations. Threat actors may also attempt to place individuals within our company or induce associates, clients, or other users of our systems to disclose sensitive information or provide access to our data, and these types of risks may be difficult to detect or prevent. Although cybersecurity incidents among financial services firms are on the rise, we have not experienced any material losses relating to cyber attacks or other information security breaches. However, the techniques used in these attacks are increasingly sophisticated, change frequently and are often not recognized until launched. Although we seek to maintain a robust suite of layered information security controls, including our cyber threat analytics, data encryption, and monitoring technologies, anti-malware defenses, and vulnerability management programs, any one or combination of these controls could fail to detect, mitigate, or remediate these risks in a timely manner. Despite our implementation of protective measures and endeavoring to modify them as circumstances warrant, our computer systems, software, and networks may be vulnerable to human error, equipment failure, natural disasters, power loss, unauthorized access, supply chain attacks, distributed denial of service attacks, zero-day vulnerabilities, computer viruses and other malicious code, and other events that could result in significant liability and damage to our reputation, and have an ongoing impact on the security and stability of our operations. In addition, although we maintain insurance coverage that may, subject to terms and conditions, cover certain aspects of cyber and information security risks, such insurance coverage may be insufficient to cover all losses, such as litigation costs or financial losses that exceed our policy limits or are not covered under any of our current insurance policies.

Current wording

We maintain a suite of layered information security controls, including cyber threat analytics, data encryption and monitoring technologies, anti-malware defenses, and vulnerability management programs. However, any one or combination of these controls could fail to detect, mitigate, or remediate these risks in a timely manner. Despite our implementation of protective measures and our efforts to modify them as circumstances warrant, our computer systems, software, and networks may remain vulnerable to human error, equipment failure, natural disasters, power loss, unauthorized access, supply-chain attacks, distributed denial-of-service (DDoS) attacks, zero-day vulnerabilities, computer viruses and other malicious code, and other events that could result in significant liability, reputational harm, and ongoing disruption to our operations. In addition, although we maintain cybersecurity insurance as one component of our broader risk-mitigation strategy, coverage is subject to policy terms, exclusions, and limits and may be insufficient to cover all losses, including litigation costs or losses that exceed policy limits or are otherwise excluded.

Previous wording

Notwithstanding the precautions we take, if a cyber attack or other information security breach were to occur, this could jeopardize the information we confidentially maintain, or otherwise cause interruptions in our operations or those of our clients and counterparties, exposing us to liability. As attempted attacks continue to evolve in scope and sophistication, we may be required to expend substantial additional resources to modify or enhance our protective measures, to investigate and remediate vulnerabilities or other exposures or to communicate about cyber attacks to our customers and regulators. A technological breakdown could also interfere with our ability to comply with financial reporting and other regulatory requirements, exposing us to potential disciplinary action by regulators. Further, successful cyber attacks at other large financial institutions or other market participants, whether or not we are affected, could lead to a general loss of confidence in financial institutions that could negatively affect us, including harming the market perception of the effectiveness of our security measures or the financial system in general, which could result in reduced use of our financial products and services.

Current wording

Notwithstanding the precautions we take, a cyber attack or other information security breach could jeopardize confidential information we maintain and could cause interruptions in our operations or those of our clients and counterparties, exposing us to liability. As attempted attacks continue to evolve in scope and sophistication, we may be required to expend substantial additional resources to enhance protective measures, investigate and remediate vulnerabilities or other exposures, or communicate about cyber attacks to our customers and regulators. A technological breakdown could interfere with our ability to comply with financial reporting and other regulatory requirements, potentially resulting in disciplinary action by regulators. In addition, successful cyber attacks at other large financial institutions or market participants, whether or not we are directly affected, could erode confidence in financial institutions generally and in our firm specifically, including perceptions of the effectiveness of our security measures, which could reduce demand for our financial products and services. We maintain incident response, business continuity, and remediation programs designed to mitigate these impacts and to support timely regulatory reporting and recovery.

Previous wording

Further, in light of the high volume of transactions we process, use of remote work, the large number of our clients, partners, and counterparties, and the increasing sophistication of malicious actors, a cyber attack could occur. Moreover, any such cyber attack may persist for an extended period of time without detection. We endeavor to design and implement policies and procedures to identify such cyber attacks as quickly as possible; however, we expect that any investigation of a cyber attack would take substantial amounts of time, and that there may be extensive delays before we obtain full and reliable information. During such time, we would not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, all of which would further increase the costs and consequences of such an attack.

Current wording

Given our high transaction volumes, remote-work environment, and the large number of clients, partners, and counterparties we serve, a cyber attack could occur. Such an attack may persist for an extended period without detection. Investigations can require substantial time and resources, and there may be significant delays before we obtain complete and reliable information. During an extended investigation, we may not know the full extent of the harm or the optimal remediation path, and certain errors or malicious actions could be repeated or compounded before they are identified and remediated, which could significantly increase the costs and consequences of such an attack. Our Security Operations Center is designed to contain attacks and to support incident investigation and remediation, but notwithstanding these capabilities, detection or remediation may be delayed in some circumstances.

Previous wording

We may also be subject to liability under various data protection laws. In providing services to clients, we manage, utilize, and store sensitive or confidential client or associate data, including personal data. As a result, we are subject to numerous laws and regulations designed to protect this information, such as U.S. federal, state, and international laws governing the protection of personally identifiable information. These laws and regulations are increasing in complexity and number. If any person, including any of our associates, negligently disregards or intentionally breaches our established controls with respect to client or associate data, or otherwise mismanages or misappropriates such data, we could be subject to significant monetary damages, regulatory enforcement actions, fines, and/or criminal prosecution. In addition, unauthorized disclosure of sensitive or confidential client or associate data, whether through system failure, associate negligence, fraud, or misappropriation, could damage our reputation and cause us to lose clients and related revenue. Potential liability in the event of a security breach of client data could be significant. Depending on the circumstances giving rise to the breach, this liability may not be subject to a contractual limit or an exclusion of consequential or indirect damages. Further, lapses in cybersecurity controls, as perceived by our regulators, could lead to fines and penalties compounding monetary losses.

Current wording

We may be subject to liability under various data protection and privacy laws. In providing services to clients, we collect, use, store, and transmit sensitive client and associate information, including personal data, and are subject to an evolving matrix of U.S. federal, state, and international privacy and data-protection laws and regulations, including, where applicable, the Gramm-Leach-Bliley Act (GLBA), the EU General Data Protection Regulation (GDPR), and state consumer privacy laws such as the CCPA/CPRA. These laws and regulations are increasing in complexity and may impose obligations related to data security, breach notification, cross-border data transfers, data subject rights, and recordkeeping. If any person, including an associate or a third-party service provider, negligently disregards or intentionally breaches our controls or otherwise mismanages or misappropriates such data, we could incur significant monetary damages, regulatory enforcement actions, fines, and criminal penalties. Unauthorized disclosure of sensitive or confidential client or associate data, whether through system failure, human error, fraud, or third-party compromise, could damage our reputation, cause loss of clients and related revenue, and expose us to substantial liability. Depending on the circumstances giving rise to a breach, this liability may not be subject to contractual limits or exclusions for consequential or indirect damages. Lapses in our cybersecurity or privacy controls, or regulatory findings that our controls are inadequate, could lead to fines, penalties, or other remediation obligations that would compound monetary losses. We maintain a privacy governance framework that includes a designated privacy lead, a documented data inventory and mapping process, privacy impact assessments for high-risk processing, technical controls, such as encryption and data-loss prevention, and contractual requirements for processors and other third parties to meet our security and privacy obligations. Our incident response and escalation procedures incorporate regulatory notification requirements and roles to support timely reporting and cooperation with regulators.

Previous wording

We also rely on numerous third-party service providers to conduct other aspects of our business operations, and we face similar risks relating to them. While we regularly conduct security assessments and external scans on these third-party vendors, we cannot be certain that their information security protocols are sufficient to withstand a cyber attack or other security breach. We also cannot be certain that we will receive timely notification of such cyber attacks or other security breaches. In addition, in order to access our products and services, our customers may use computers and other devices that are beyond our security control systems.

Current wording

We also rely on numerous third parties, including service providers that utilize cloud technologies to conduct other aspects of our business operations, and we face similar risks relating to them. While we conduct security assessments on these third-party service providers, we cannot be certain that their information security protocols are sufficient to withstand a cyber attack or other security breach. We also cannot be certain that we will receive timely notification of such cyber attacks or other security breaches. In addition, in order to access our products and services, our customers may use computers and other devices that are beyond our security control systems.

Previous wording

Financial services firms are subject to numerous actual or perceived conflicts of interest, which are routinely examined by regulators and SROs such as FINRA and are often used as the basis for claims for legal liability by plaintiffs in actions against the Company. Our risk management processes include addressing potential conflicts of interest that arise in our business. Management of potential conflicts of interest has become increasingly complex as we expand our business activities. A perceived or actual failure to address conflicts of interest adequately could affect our reputation, the willingness of clients to transact business with us or give rise to litigation or regulatory actions. Therefore, there can be no assurance that conflicts of interest will not arise in the future that could result in material harm to our business and financial condition.

Current wording

Financial services firms are subject to numerous actual or perceived conflicts of interest, which are routinely examined by regulators and SROs such as FINRA and may be used as the basis for claims for legal liability by plaintiffs in actions against the Company. Through our risk management processes, we seek to address potential conflicts of interest that arise in our business. Management of potential conflicts of interest becomes increasingly complex as our business activities expand. A perceived or actual failure to address conflicts of interest adequately could affect our reputation, the willingness of clients to transact business with us, or give rise to litigation or regulatory actions. Therefore, there can be no assurance that conflicts of interest will not arise in the future that could result in material harm to our business and financial condition.

Previous wording

Associate misconduct, which is difficult to detect and deter, could harm us by impairing our ability to attract and retain clients and subject us to significant legal liability and reputational harm. There is a risk that our associates could engage in misconduct that adversely affects our business. For example, our investment banking business often requires that we deal with confidential matters of great significance to our clients. Our associates interact with clients, customers, and counterparties on an ongoing basis. All associates are expected to exhibit the behaviors and ethics that are reflected in our framework of principles, policies, and technology to protect both our own information as well as that of our clients. If our associates improperly use or disclose confidential information provided by our clients, we could be subject to future regulatory sanctions and suffer serious harm to our reputation, financial position, current client relationships, and ability to attract future clients. We are also subject to a number of obligations and standards arising from our asset management business and our authority over our assets under management. In addition, our financial advisors are required to act in the best interests of our clients and may act in a fiduciary capacity, providing financial planning, investment advice, and discretionary asset management. The violation of these obligations and standards by any of our associates would adversely affect our clients and us. Associate conduct on non-business matters, such as social issues, including the posting of information on social media or other internet forums, could be inconsistent with our policies and ethics and result in reputational harm to our business due to their employment by us or affiliation with us. It is not always possible to deter or prevent every instance of associate misconduct, and the precautions we take to detect and prevent this activity may not be effective in all cases. If our associates engage in misconduct, our business would be adversely affected.

Current wording

Associate misconduct, which is difficult to detect and deter, could harm us by impairing our ability to attract and retain clients and subject us to significant legal liability and reputational harm. There is a risk that our associates could engage in misconduct, fraudulent, unauthorized, or illegal acts, or noncompliance with firm policies or regulations that adversely affects our business and/or results in substantial liability. For example, our investment banking business often requires that we appropriately manage the use of our institutional clients’ non-public, confidential information. Similarly, many of our associates interact routinely with clients and counterparties and are expected to comply with our policies and procedures to protect both our clients’ confidential information and our own. If confidential information, for example, is improperly used or disclosed by any associate, we could be subject to regulatory action and suffer serious harm to our reputation, financial position, current client relationships, and ability to attract future clients. Additionally, associate misconduct on non-business matters, such as social issues, including the posting of information on social media or other internet forums, could be inconsistent with our policies and values and result in reputational harm to our business due to their employment by us or affiliation with us. It is not always possible to deter or prevent every instance of misconduct, and the precautions we take to detect and prevent this activity may not be effective in all cases. If our associates engage in misconduct, our business could be adversely affected.

Previous wording

We are subject to risks relating to environmental, social, and governance matters that could adversely affect our reputation, business, financial condition, and results of operations. We are subject to a variety of risks, including reputational risk, associated with environmental, social, and governance matters. As a large financial institution, we have multiple stakeholders, including our shareholders, clients, associates, federal and state regulatory authorities, and the communities in which we operate, and these stakeholders will often have differing priorities and expectations regarding such matters. For example, individual U.S. states are increasingly developing differing, and sometimes conflicting, rules related to environmental, social, and governance matters. If we take action in conflict with one or another of those stakeholders’ expectations, we could experience an increase in client complaints, a loss of business, or reputational harm. We could also face negative publicity or reputational harm based on the identity of those with whom we choose to do business. Any adverse publicity in connection with environmental, social, and governance issues could damage our reputation, our ability to attract and retain clients and associates, compete effectively, and grow our business.

Current wording

We have multiple stakeholders, including our shareholders, clients, associates, federal, state, and foreign regulatory authorities, and the communities in which we operate, and these stakeholders will often have differing priorities and expectations regarding environmental, social, and governance matters. For example, individual U.S. states are increasingly developing differing, and sometimes conflicting, rules related to environmental, social, and governance matters, while at the federal level, the SEC has recently stopped pursuing rulemaking efforts focused on certain of these matters. In addition, proxy advisory firms and certain institutional investors who manage investments in public companies may integrate environmental, social, and governance factors into their investment analysis. Frameworks for evaluating such matters remain underdeveloped and vary widely, which may lead to misperceptions of our policies and practices. Organizations that provide ratings information to investors on such matters may also assign unfavorable ratings to Stifel. Stakeholders continue to focus on environmental, social, and governance issues in corporate actions, such as the election of directors and approval of executive compensation. Certain of our clients might also require that we implement additional procedures or standards in these areas in order to continue to do business with them. If we take action in conflict with one or another of those stakeholders’ expectations, we could experience an increase in client complaints, a loss of business, or reputational harm. We could also face negative publicity or reputational harm based on the identity of those with whom we choose to do business. Any adverse publicity in connection with environmental, social, and governance issues could damage our reputation, ability to attract and retain clients, associates, and independent advisors, compete effectively, and grow our business.

Previous wording

Moreover, there has been increased regulatory focus on the disclosure practices of investment managers offering sustainable and values-based investment strategies, resulting in increased risk that we could be perceived as making inaccurate or misleading statements regarding the investment strategies of our funds and ETFs, commonly referred to as “greenwashing.” Such perceptions or accusations could damage our reputation, result in litigation or regulatory enforcement actions, and adversely affect our business.

Current wording

Regulatory scrutiny of disclosure practices for sustainable and values-based investment strategies has been a focus in recent years, though that focus appears to be moderating following the SEC’s decision to withdraw proposed rulemaking in this area. Nonetheless, we could still face reputational risk if our investment managers are perceived as making inaccurate or misleading statements regarding the investment strategies of our funds and ETFs, commonly referred to as “greenwashing.” Such perceptions or accusations could damage our reputation, result in litigation or regulatory enforcement actions, and adversely affect our business.

Previous wording

Financial services firms are highly regulated and are currently subject to a number of new and proposed regulations, all of which may increase our risk of financial liability and reputational harm resulting from adverse regulatory actions. Financial services firms operate in an evolving regulatory environment and are subject to extensive supervision and regulation. The laws and regulations governing financial services firms are intended primarily for the protection of our depositors, our clients, the financial system, and the FDIC insurance fund, not our shareholders or creditors. The financial services industry has experienced an extended period of significant change in laws and regulations, as well as a high degree of scrutiny from various regulators, including the SEC, the Fed, the FDIC, the OCC, and the CFPB, in addition to stock exchanges, FINRA, and governmental authorities, such as state attorneys general. The SEC has recently been very active in proposing and adopting major new rules and regulations that affect public companies and, in particular, the financial services industry. Several of these new rules have been adopted after significantly abbreviated periods for public comments, and these new or proposed rules involve sweeping changes that could require significant shifts in industry operations and practices, thereby increasing uncertainty for markets and investors. Further, final and proposed rules and regulations have been increasingly subjected to legal challenge, which creates uncertainty in planning our compliance and could lead to increased compliance costs. Penalties and fines imposed by regulatory and other governmental authorities have also been substantial and growing in recent years. Additionally, an increasing number of U.S. states have proposed, or are considering, their own laws and regulations, and as a result, our activities could be subject to overlapping and conflicting regulation. We may be adversely affected by the adoption of new rules and by changes in the interpretation or enforcement of existing laws, rules, and regulations. Existing and new laws and regulations could negatively affect our revenue, limit our ability to pursue business opportunities, impact the value of our assets, require us to alter our business practices, impose additional compliance costs, and otherwise adversely affect our businesses.

Current wording

Financial services firms are highly regulated and are subject to new and proposed regulations, all of which may increase our risk of financial liability and reputational harm resulting from adverse regulatory actions. Financial services firms operate in an evolving regulatory environment and are subject to extensive supervision and regulation. The laws and regulations governing financial services firms are intended primarily for the protection of our depositors, our clients, the financial system, and the FDIC insurance fund, not our shareholders or creditors. The financial services industry has experienced an extended period of significant change in laws and regulations, as well as a high degree of scrutiny from various regulators, including the SEC, the Fed, the FDIC, the OCC, the DOL, and the CFPB, in addition to stock exchanges, FINRA, and governmental authorities, such as state attorneys general. Further, final and proposed rules and regulations have been increasingly subjected to legal challenge, which creates uncertainty in planning our compliance and could lead to increased compliance costs. Penalties and fines imposed by regulatory and other governmental authorities have also been substantial and growing in recent years. Additionally, an increasing number of U.S. states have proposed, or are considering, their own laws and regulations, and as a result, our activities could be subject to overlapping and conflicting regulation. We may be adversely affected by the adoption of new rules and by changes in the interpretation or enforcement of existing laws, rules, and regulations. Existing and new laws and regulations could negatively affect our revenue, limit our ability to pursue business opportunities, impact the value of our assets, require us to alter our business practices, impose additional compliance costs, and otherwise adversely affect our businesses.

Previous wording

The Federal Reserve requires a bank holding company to act as a source of financial and managerial strength for its subsidiary banks. The Federal Reserve could require the Company to commit resources to its bank subsidiaries when doing so is not otherwise in the best interests of our company or its shareholders or creditors.

Current wording

The Federal Reserve requires a bank holding company to act as a source of financial and managerial strength for its subsidiary banks and could require the Company to commit resources to its bank subsidiaries when doing so is not otherwise in the best interests of our company or its shareholders or creditors.

Previous wording

Regulatory actions brought against us may result in judgments, settlements, fines, penalties, or other results, any of which could have a material adverse effect on our business, financial condition, reputation, or results of operations. There is no assurance that regulators will be satisfied with the policies and procedures implemented by our company and its subsidiaries. In addition, from time to time, the Company and its subsidiaries have been or may in the future become subject to additional findings with respect to supervisory, compliance, or other regulatory deficiencies, which could subject us to additional liability, including penalties, and restrictions on our business activities. Among other things, these restrictions could limit our ability to make investments, complete acquisitions, onboard new branches or financial advisors, expand into new business lines, pay dividends on our common and preferred stock, and/or engage in share repurchases. See “Item 1, Business – Regulation,” of this Form 10-K for additional information regarding our regulatory environment.

Current wording

Regulatory actions brought against us may result in judgments, settlements, fines, penalties, or other results, any of which could have a material adverse effect on our business, financial condition, reputation, or results of operations. In particular, the banking regulators have broad enforcement power over bank holding companies and banks, including with respect to unsafe or unsound practices or violations of the law. There is no assurance that regulators will be satisfied with the policies and procedures implemented by our company and its subsidiaries. In addition, from time to time, the Company and its subsidiaries have been or may in the future become subject to additional findings with respect to supervisory, compliance, or other regulatory deficiencies, which could subject us to additional liability, including penalties, and restrictions on our business activities. Among other things, these restrictions could limit our ability to make investments, complete acquisitions, onboard new branches or financial advisors, expand into new business lines, pay dividends on our common and preferred stock, and/or engage in share repurchases. See “Item 1, Business – Regulation,” of this Form 10-K for additional information regarding our regulatory environment.

Previous wording

We are exposed to litigation and regulatory investigations and proceedings, which could materially and adversely impact our business operations and prospects. The financial services industry faces significant litigation and regulatory risks. Additionally, our litigation and regulatory risks continue to increase as our business expands internationally. Many aspects of our business involve substantial risk of liability. We have been named as a defendant or co-defendant in lawsuits and arbitrations primarily involving claims for damages. The risks associated with potential litigation often may be difficult to assess or quantify, and the existence and magnitude of potential claims often remain unknown for substantial periods of time.

Current wording

We are exposed to litigation and regulatory investigations and proceedings, which could materially and adversely impact our business operations and prospects. The financial services industry faces significant litigation and regulatory risks. Additionally, our litigation and regulatory risks continue to increase as our business expands internationally. Many aspects of our business involve substantial risk of liability. We have been named as a defendant or co-defendant in lawsuits and arbitrations primarily involving claims for damages. The risks associated with potential litigation often may be difficult to assess or quantify, and the existence and magnitude of potential claims often remain unknown for substantial periods of time. Unauthorized or illegal acts or noncompliance with firm policies by our associates could also result in substantial liability. We are also the subject of inquiries, investigations, and proceedings by regulatory and other governmental agencies.

Previous wording

In addition to the SEC, various states have adopted, or are considering adopting, laws and regulations seeking to impose new standards of conduct on broker-dealers that, as written, differ from the SEC’s regulations and may lead to additional implementation costs. Implementation of the SEC regulations, as well as any new state rules that are adopted addressing similar matters, has resulted in (and may continue to result in) increased costs related to compliance, legal, operations, and information technology. Furthermore, certain non-U.S. jurisdictions have imposed heightened standards of conduct, which may have similar impacts on our business in those jurisdictions.

Current wording

In addition to the SEC, various states might consider adopting laws and regulations that would impose new standards of conduct on broker-dealers that differ from the SEC’s regulations and could lead to additional implementation costs. Implementation of the SEC regulations, as well as any new state rules that are adopted addressing similar matters, has resulted in (and may continue to result in) increased costs related to compliance, legal, operations, and information technology. Furthermore, certain non-U.S. jurisdictions have imposed heightened standards of conduct, which may have similar impacts on our business in those jurisdictions.

Previous wording

As a financial holding company, our company’s liquidity depends on payments from its subsidiaries, which may be subject to regulatory restrictions. The Company, as a financial holding company, depends on dividends, distributions, and other payments from its subsidiaries in order to meet its obligations, including its debt service obligations and to fund dividend payments and share repurchases. Our subsidiaries are subject to laws and regulations that restrict dividend payments or authorize regulatory bodies to prevent or reduce the flow of funds from those subsidiaries to our company. If our subsidiaries are unable to make dividend payments to us and sufficient cash or liquidity is otherwise not available, the Company may not be able to make dividend payments to its shareholders, repurchase its shares, or make principal and interest payments on its outstanding debt. Our broker-dealers and bank subsidiaries are limited in their ability to lend or transact with affiliates, are subject to minimum regulatory capital and other requirements, and, in the case of our broker-dealer subsidiaries, have limitations on their ability to use funds deposited with them in brokerage accounts to fund their businesses. These requirements and limitations may hinder our company’s ability to access funds from its subsidiaries. Federal regulators, including the Federal Reserve and the SEC (through FINRA), have the authority and, under certain circumstances, the obligation to limit or prohibit dividend payments and share repurchases by the banking organizations they supervise, including our company and its bank subsidiaries.

Current wording

As a financial holding company, our company’s liquidity depends on payments from its subsidiaries, which may be subject to regulatory restrictions. The Company, as a financial holding company, depends on dividends, distributions, and other payments from its subsidiaries in order to meet its obligations, including its debt service obligations and to fund dividend payments and share repurchases. Our subsidiaries are subject to laws and regulations that restrict dividend payments or authorize regulatory bodies to prevent or reduce the flow of funds from those subsidiaries to our company. If our subsidiaries are unable to make dividend payments to us and sufficient cash or liquidity is otherwise not available, the Company may not be able to make dividend payments to its shareholders, repurchase its shares, or make principal and interest payments on its outstanding debt. Our broker-dealer and bank subsidiaries are limited in their ability to lend or transact with affiliates, are subject to minimum regulatory capital and other requirements, and, in the case of our broker-dealer subsidiaries, have limitations on their ability to use funds deposited with them in brokerage accounts to fund their businesses. These requirements and limitations may hinder our company’s ability to access funds from its subsidiaries. Federal regulators, including the Federal Reserve and the SEC (through FINRA), have the authority and, under certain circumstances, the obligation to limit or prohibit dividend payments and share repurchases by the banking organizations they supervise, including our company and its bank subsidiaries.