Question: What are the key operational risks identified in JPMorgan Chase's 2023 10-K report, and how could these impact JPMorgan Chase's financial performance?

JPMorgan Chase's 10-K report identifies several operational risks, including risks related to cybersecurity, fraud, and data protection. The report highlights that the increasing sophistication of cyberattacks could lead to significant financial losses, legal liabilities, and reputational damage.

JPMORGAN CHASE & CO 10-K form for the fiscal year ended 2023-12-31, page 9:
Item 1A. Risk Factors.

The following discussion sets forth the material risk factors that could affect JPMorgan Chase's financial condition and operations. Readers should not consider any descriptions of these factors to be a complete set of all potential risks that could affect the Firm. Any of the risk factors discussed below could by itself, or combined with other factors, materially and adversely affect JPMorgan Chase's business, results of operations, financial condition, capital position, liquidity, competitive position or reputation, including by materially increasing expenses or decreasing revenues, which could result in material losses or a decrease in earnings.

Summary

The principal risk factors that could adversely affect JPMorgan Chase's business, results of operations, financial condition, capital position, liquidity, competitive position or reputation include:
•Regulatory risks, including the impact that applicable laws, rules and regulations in the highly-regulated and supervised financial services industry, as well as changes to or in the application, interpretation or enforcement of those laws, rules and regulations, can have on JPMorgan Chase's business and operations, including JPMorgan Chase incurring additional costs associated with assessments, levies or other governmental charges; the ways in which differences in financial services regulation and supervision in different jurisdictions or with respect to certain competitors can negatively impact JPMorgan Chase's business; the penalties and collateral consequences, and higher compliance and operational costs, that JPMorgan Chase may incur when resolving a regulatory investigation; the ways in which less predictable legal and regulatory frameworks in certain jurisdictions can negatively impact JPMorgan Chase's operations and financial results; and the losses that security holders will absorb if JPMorgan Chase were to enter into a resolution.
•Political risks, including the potential negative effects on JPMorgan Chase's businesses due to economic uncertainty or instability caused by political developments.
•Market risks, including the effects that economic and market events and conditions, governmental policies, changes in interest rates and credit spreads, and market fluctuations can have on JPMorgan Chase's consumer and wholesale businesses and its investment and market-making positions and on JPMorgan Chase's earnings and its liquidity and capital levels.
•Credit risks, including potential negative effects from adverse changes in the financial condition of clients, customers, counterparties, custodians and central counterparties; the potential for losses due to declines in the value of collateral in stressed market conditions; and potential negative impacts from concentrations of credit risk with respect to clients, customers, counterparties and other market participants.

•Liquidity risks, including the risk that JPMorgan Chase's liquidity could be impaired by market-wide illiquidity or disruption, unforeseen liquidity or capital requirements, the inability to sell assets, default by a significant market participant, unanticipated outflows of cash or collateral, or lack of market or customer confidence in JPMorgan Chase; the dependence of JPMorgan Chase & Co. on the cash flows of its subsidiaries; and the potential adverse effects that any downgrade in any of JPMorgan Chase's credit ratings may have on its liquidity and cost of funding.
•Capital risks, including the risk that any failure by or inability of JPMorgan Chase to maintain the required level and composition of capital, or unfavorable changes in applicable capital requirements, could limit JPMorgan Chase's ability to distribute capital to shareholders or to support its business activities.
•Operational risks, including risks associated with JPMorgan Chase's dependence on its operational systems, its ability to maintain appropriately-staffed workforces and the competence, integrity, health and safety of its employees, as well as the systems and employees of third parties, market participants and service providers; the potential negative effects of failing to identify and address operational risks related to the failure of internal or external operational systems, the introduction of or changes to products, services and delivery platforms or the adoption of new technologies; legal and regulatory risks related to safeguarding personal information; the harm that could be caused by a successful cyber attack affecting JPMorgan Chase or by other extraordinary events; risks related to acquisitions, including the acquisition of certain assets and liabilities of First Republic Bank; risks associated with JPMorgan Chase's risk management framework and control environment, its models and estimations and associated judgments used in its stress testing and financial statements, and controls over disclosure and financial reporting; and potential adverse effects of failing to comply with heightened regulatory and other standards for the oversight of vendors and other service providers.
•Strategic risks, including the damage to JPMorgan Chase's competitive standing and results that could occur if management fails to develop and execute effective business strategies; risks associated with the significant and increasing competition that JPMorgan Chase faces; and the potential adverse impacts of climate change on JPMorgan Chase's business operations, clients and customers.
•Conduct risks, including the negative impact that can result from the actions or misconduct of employees, including any failure of employees to conduct themselves in accordance with JPMorgan Chase's expectations, policies and practices.
•Reputation risks, including the potential adverse effects on JPMorgan Chase's relationships with its clients,

|    |    |
|---:|---:|
|  1 |  9 |
, JPMORGAN CHASE & CO 10-K form for the fiscal year ended 2023-12-31, page 20:
Part I

A reduction in JPMorgan Chase's credit ratings could curtail JPMorgan Chase's business activities and reduce its profitability in a number of ways, including:
•reducing its access to capital markets
•materially increasing its cost of issuing and servicing securities
•triggering additional collateral or funding requirements, and
•decreasing the number of investors and counterparties that are willing or permitted to do business with or lend to JPMorgan Chase.
Any rating reduction could also increase the credit spreads charged by the market for taking credit risk on JPMorgan Chase & Co. and its subsidiaries. This could, in turn, adversely affect the value of debt and other obligations of JPMorgan Chase & Co. and its subsidiaries.

Capital

Maintaining the required level and composition of capital may impact JPMorgan Chase's ability to support business activities, meet evolving regulatory requirements and distribute capital to shareholders.
JPMorgan Chase is subject to various regulatory capital requirements, including leverage- and risk-based capital requirements. In addition, as a Global Systemically Important Bank ("GSIB"), JPMorgan Chase is required to hold additional capital buffers, including a GSIB surcharge, a Stress Capital Buffer ("SCB"), and a countercyclical buffer, each of which is reassessed at least annually. The amount of capital that JPMorgan Chase is required to hold in order to satisfy these leverage- and risk-based requirements could increase at any given time due to factors such as:
•actions by banking regulators, including changes in laws, rules, and regulations
•changes in the composition of JPMorgan Chase's balance sheet or developments that could increase RWA, such as increased market risk, customer delinquencies, client credit rating downgrades or other factors, and
•increases in estimated stress losses as determined by the Federal Reserve under the Comprehensive Capital Analysis and Review, which could increase JPMorgan Chase's SCB.
Any failure by or inability of JPMorgan Chase to maintain the required level and composition of capital, or unfavorable changes in applicable capital requirements, could have an adverse impact on JPMorgan Chase's shareholders, such as:
•reducing the amount of common stock that JPMorgan Chase is permitted to repurchase
•requiring the issuance of, or prohibiting the redemption of, capital instruments in a manner inconsistent with JPMorgan Chase's capital management strategy

•constraining the amount of dividends that may be paid on common stock, or
•curtailing JPMorgan Chase's business activities or operations.
Banking regulators have released a proposal to amend the Basel III risk-based capital framework which could significantly revise the risk-based capital requirements for banks with assets of $100 billion or more, including JPMorgan Chase. Uncertainty remains as to the manner in which these requirements will ultimately apply to JPMorgan Chase, however it is possible that these requirements could impact JPMorgan Chase's decisions concerning the business activities in which it will engage and its levels of capital distributions to its shareholders.

Operational

JPMorgan Chase's businesses are dependent on the effectiveness of internal and external operational systems.
JPMorgan Chase's businesses rely on the ability of JPMorgan Chase's financial, accounting, transaction execution, data processing and other operational systems to process, record, monitor and report a large number of transactions on a continuous basis, and to do so accurately, quickly and securely. In addition to proper design, installation, maintenance and training, the effective functioning of JPMorgan Chase's operational systems depends on:
•the quality of the information contained in those systems, as inaccurate, outdated, incomplete or corrupted data can significantly compromise the functionality or reliability of a particular system and other systems to which it transmits or from which it receives information, and
•JPMorgan Chase's ability to continue to maintain and upgrade its systems on a regular basis in line with technological advancements and evolving security requirements, carefully manage any changes introduced to its systems to maintain security and operational continuity, and adhere to all applicable legal and regulatory requirements, particularly in regions where JPMorgan Chase may face a heightened risk of malicious activity.
JPMorgan Chase has experienced and expects that it will continue to experience failures and disruptions in the stability of its operational systems, including degraded performance of data processing systems, data quality issues, disruptions of network connectivity and malfunctioning software, as well as disruptions in its ability to access and use the operational systems of third parties. These incidents have resulted in various negative effects for customers, including the inability to access account information or to make transactions through ATM, internet or mobile channels, the exfiltration of customer personal data, the recording of duplicative transactions and extended delays for customers requiring services from call

|    |    |
|---:|---:|
|  1 | 20 |
, JPMORGAN CHASE & CO 10-K form for the fiscal year ended 2023-12-31, page 21: centers. There can be no assurance that these and other types of operational failures or disruptions will not occur in the future.
JPMorgan Chase's ability to effectively manage the stability of its operational systems and infrastructure could be hindered by many factors, any of which could have a negative impact on JPMorgan Chase and its clients, customers and counterparties, including:
•JPMorgan Chase's ability to effectively maintain and upgrade systems and infrastructure can become more challenging as the speed, frequency, volume, interconnectivity and complexity of transactions continue to increase
•attempts by third parties to defraud JPMorgan Chase or its clients and customers are increasing, evolving and becoming more complex, and during periods of market disruption or economic uncertainty, these attempts can be expected to increase in volume
•errors made by JPMorgan Chase or another market participant, whether inadvertent or malicious, could cause widespread system disruption
•failure to detect weaknesses or shortcomings in operational systems in a timely manner
•isolated or seemingly insignificant errors in operational systems could compound, or migrate to other systems over time, to become larger issues
•disruptions in operational systems or in the ability of systems to communicate with each other could be caused by failures in synchronization or encryption software, or degraded performance of microprocessors, and
•attempts by third parties to block the use of key technology solutions by claiming that the use infringes on their intellectual property rights.
JPMorgan Chase also depends on its ability to access and use the operational systems of third parties, including its custodians, vendors (such as those that provide data and cloud computing services, and security and technology services) and other market participants (such as clearing and payment systems, CCPs and securities exchanges), and external operational systems with which JPMorgan is connected, whether directly or indirectly, can be sources of operational risk to JPMorgan Chase. JPMorgan Chase may be exposed not only to a systems failure or cyber attack that may be experienced by a vendor or market infrastructure with which JPMorgan Chase is directly connected, but also to a systems breakdown or cyber attack involving another party to which such a vendor or infrastructure is connected. Similarly, retailers, payment systems and processors, data aggregators and other external parties with which JPMorgan Chase's customers do business can increase JPMorgan Chase's operational risk. This is particularly the case where activities of customers or other parties are beyond JPMorgan Chase's security and control systems, including through the use of the internet,

cloud computing services, and personal smart phones and other mobile devices or services.
If an external party obtains access to customer account data on JPMorgan Chase's systems, whether authorized or unauthorized, and that party misappropriates that data, this could result in negative outcomes for JPMorgan Chase and its clients and customers, including a heightened risk of fraudulent transactions using JPMorgan Chase's systems, losses from fraudulent transactions and reputational harm arising from the perception that JPMorgan Chase's systems may not be secure.
As JPMorgan Chase's interconnectivity with clients, customers and other external parties continues to expand, JPMorgan Chase increasingly faces the risk of operational failure or cyber attacks with respect to the systems of those parties. Security breaches affecting JPMorgan Chase's clients or customers, or systems breakdowns or failures, security breaches or human error or misconduct affecting other external parties, may require JPMorgan Chase to take steps to protect the integrity of its own operational systems or to safeguard confidential information, including restricting the access of customers to their accounts. These actions can increase JPMorgan Chase's operational costs and potentially diminish customer satisfaction and confidence in JPMorgan Chase.
Furthermore, the widespread and expanding interconnectivity among financial institutions, clearing banks, CCPs, payments processors, financial technology companies, securities exchanges, clearing houses and other financial market infrastructures increases the risk that the disruption of an operational system involving one institution or entity, including due to a cyber attack, may cause industry-wide operational disruptions that could materially affect JPMorgan Chase's ability to conduct business. In addition, the risks associated with the disruption of an operational system of a third party could be exacerbated to the extent that the services provided by that system are used by a significant number or proportion of market participants.
The ineffectiveness, failure or other disruption of operational systems upon which JPMorgan Chase depends, including due to a systems malfunction, cyber incident or other systems failure, could result in unfavorable ripple effects in the financial markets and for JPMorgan Chase and its clients and customers, including:
•delays or other disruptions in providing services, including the provision of liquidity or information to clients and customers
•impairment of JPMorgan Chase's ability to execute transactions, including delays or failures in the confirmation or settlement of transactions or in obtaining access to funds or other assets required for settlement
•the possibility that funds transfers, capital markets trades or other transactions are executed erroneously

|    |    |
|---:|---:|
|  1 | 21 |
, JPMORGAN CHASE & CO 10-K form for the fiscal year ended 2023-12-31, page 22:
Part I

•financial losses, including due to loss-sharing requirements of CCPs, payment systems or other market infrastructures, or as possible restitution to clients and customers
•higher operational costs associated with replacing services provided by a system that has experienced a failure or other disruption
•limitations on JPMorgan Chase's ability to collect data needed for its business and operations
•loss of confidence in the ability of JPMorgan Chase, or financial institutions generally, to protect against and withstand operational disruptions
•dissatisfaction among JPMorgan Chase's clients or customers
•significant exposure to litigation and regulatory fines, penalties or other sanctions, and
•harm to JPMorgan Chase's reputation.
If JPMorgan Chase's operational systems, or those of acquired businesses or of external parties on which JPMorgan Chase's businesses depend, are unable to meet the requirements of JPMorgan Chase's businesses and operations or bank regulatory standards, or if they fail or have other significant shortcomings, JPMorgan Chase could be materially and adversely affected.
A successful cyber attack affecting JPMorgan Chase could cause significant harm to JPMorgan Chase and its clients and customers.
JPMorgan Chase experiences numerous cyber attacks on its computer systems, software, networks and other technology assets on a daily basis from various actors, including groups acting on behalf of hostile countries, cyber-criminals, "hacktivists" (i.e., individuals or groups that use technology to promote a political agenda or social change) and others. These cyber attacks can take many forms, including attempts to introduce computer viruses or malicious code, which are commonly referred to as "malware," into JPMorgan Chase's systems. These attacks are often designed to:
•obtain unauthorized access to confidential information belonging to JPMorgan Chase or its clients, customers, counterparties or employees
•manipulate data
•destroy data or systems with the aim of rendering services unavailable
•disrupt, sabotage or degrade service on JPMorgan Chase's systems

•steal money, or

•extort money through the use of so-called "ransomware."
JPMorgan Chase also experiences:

•distributed denial-of-service attacks intended to disrupt JPMorgan Chase's websites, including those that provide online banking and other services,
•a higher volume and complexity of cyber attacks against the backdrop of heightened geopolitical tensions, and
•a high volume of disruptions to internet-based services used by JPMorgan Chase that are provided by third parties.
JPMorgan Chase has experienced security breaches due to cyber attacks in the past, and it is inevitable that additional breaches will occur in the future. Any such breach could result in serious and harmful consequences for JPMorgan Chase or its clients and customers.
A principal reason that JPMorgan Chase cannot provide absolute security against cyber attacks is that it may not always be possible to anticipate, detect or recognize threats to JPMorgan Chase's systems, or to implement effective preventive measures against all breaches because:
•the techniques used in cyber attacks evolve frequently and are increasingly sophisticated, and therefore may not be recognized until launched or may go undetected for extended periods
•cyber attacks can originate from a wide variety of sources, including JPMorgan Chase's own employees, cyber-criminals, hacktivists, well-resourced groups linked to terrorist organizations or hostile nation-states that can sustain malicious activities for extended periods, or third parties whose objective is to disrupt the operations of financial institutions more generally
•JPMorgan Chase does not have control over the cybersecurity of the systems of the large number of clients, customers, counterparties and third-party service providers with which it does business, and
•it is possible that a third party, after establishing a foothold on an internal network without being detected, may gain access to other networks and systems.
The risk of a security breach due to a cyber attack could increase in the future due to factors such as:
•JPMorgan Chase's ongoing expansion of its mobile banking and other internet-based product offerings and its internal use of internet-based products and applications, including those that use cloud computing services
•advances in artificial intelligence, such as the use of machine learning and generative artificial intelligence by malicious actors to develop more advanced social engineering attacks, including targeted phishing attacks
•the inability to maintain the security of information transmitted by JPMorgan Chase due to advances in quantum computing that may counteract or nullify existing information protections, and
•the acquisition and integration of new businesses.

|    |    |
|---:|---:|
|  1 | 22 |
, JPMORGAN CHASE & CO 10-K form for the fiscal year ended 2023-12-31, page 23: In addition, a third party could misappropriate confidential information obtained by intercepting signals or communications from mobile devices used by JPMorgan Chase's employees.
The dynamic nature of the cyber threat landscape necessitates continuous enhancement and adaptation of cybersecurity controls. Failure to discover or address known vulnerabilities or shortcomings in cybersecurity controls, or to prioritize or complete enhancements to address them, in each case in a timely manner, may leave JPMorgan Chase vulnerable to cyber attacks, potentially resulting in data breaches, financial losses, reputational damage and regulatory penalties, including the failure to prioritize or complete enhancements relating to:
•preventing unauthorized access and protecting against the misuse of access, including the maintenance and enhancement of controls related to secure software development practices and identity and access management, such as those relating to the management of administrative access to systems
•detecting, escalating and addressing effectively and in a timely manner any vulnerabilities that may be present either in internally-developed software or externally-provided software or services, including vulnerabilities that could allow attackers to exploit unknown security flaws in software and hardware ("zero-day vulnerabilities")
•enhancing early detection of attacks against third-party vendors, including attacks targeting vulnerabilities in third-party open-source software, in support of the secure development and maintenance of internal systems
•maintaining and enhancing controls related to technology asset management and inventory systems to prevent the risk of undetected vulnerabilities that could undermine JPMorgan Chase's ability to operate an effective control process
•upgrading the coverage and capabilities of systems and controls to protect JPMorgan Chase and its clients and customers from the impact of distributed denial-of-service attacks, or to recover from outages that could be caused by a malware or ransomware attack
•strengthening network security and management of outbound connections to reduce the risk of data loss
•identifying, assessing and mitigating insider threat activities that could lead to the misuse of JPMorgan Chase's systems or client and customer information, and
•integrating acquired businesses where system integration may be complex or may require extensive and lengthy remediation or enhancement of controls.
A successful penetration or circumvention of the security of JPMorgan Chase's systems or the systems of a vendor, governmental body or another market participant could cause serious negative consequences, including:

•significant disruption of JPMorgan Chase's operations and those of its clients, customers and counterparties, including losing access to operational systems
•misappropriation of confidential information of JPMorgan Chase or that of its clients, customers, counterparties, employees or regulators
•disruption of or damage to JPMorgan Chase's systems and those of its clients, customers and counterparties
•the inability, or extended delays in the ability, to fully recover and restore data that has been stolen, manipulated or destroyed, or the inability to prevent systems from processing fraudulent transactions
•demands that JPMorgan Chase pay a ransom to a malicious actor that has perpetrated a cybersecurity breach
•unintended violations by JPMorgan Chase of applicable privacy and other laws
•financial loss to JPMorgan Chase or to its clients, customers, counterparties or employees
•loss of confidence in JPMorgan Chase's cybersecurity and business resiliency measures
•dissatisfaction among JPMorgan Chase's clients, customers or counterparties
•significant exposure to litigation and regulatory fines, penalties or other sanctions, and
•harm to JPMorgan Chase's reputation.
The extent of a particular cyber attack, the methods and tools used by various actors, and the steps that JPMorgan Chase may need to take to investigate the attack may not be immediately clear, and it may take a significant amount of time before such an investigation can be completed. While such an investigation is ongoing, JPMorgan Chase may not necessarily know the full extent of the harm caused by the cyber attack, and that damage may continue to spread. These factors may inhibit JPMorgan Chase's ability to provide rapid, full and reliable information about the cyber attack to its clients, customers, counterparties and regulators, as well as the public. Furthermore, it may not be clear how best to contain and remediate the harm caused by the cyber attack, and certain errors or actions could be repeated or compounded before they are discovered and remediated. Any or all of these factors could further increase the costs and consequences of a cyber attack.
JPMorgan Chase can be negatively affected if it fails to identify and address operational risks associated with the introduction of or changes to products, services and delivery platforms or the adoption of new technologies.
When JPMorgan Chase launches a new product or service, introduces a new platform for the delivery or distribution of products or services (including mobile connectivity, electronic trading and cloud computing), acquires or invests in a business, makes changes to an existing product, service

|    |    |
|---:|---:|
|  1 | 23 |
, JPMORGAN CHASE & CO 10-K form for the fiscal year ended 2023-12-31, page 24:
Part I

or delivery platform, or adopts a new technology, it may not fully appreciate or identify new operational risks that may arise from those changes, including increased reliance on third party providers, or may fail to implement adequate controls to mitigate the risks associated with those changes. Any significant failure in this regard could diminish JPMorgan Chase's ability to operate one or more of its businesses or result in:
•potential liability to clients, counterparties and customers
•higher compliance and operational cost
•higher litigation costs, including regulatory fines, penalties and other sanctions
•damage to JPMorgan Chase's reputation
•impairment of JPMorgan Chase's liquidity

•regulatory intervention, or

•weaker competitive standing.
Any of the foregoing consequences could materially and adversely affect JPMorgan Chase's businesses and results of operations.
JPMorgan Chase's business and operations rely on its ability, and the ability of key external parties, to maintain appropriately-staffed workforces, and on the competence, trustworthiness, health and safety of employees.
JPMorgan Chase's ability to operate its businesses efficiently and profitably, to offer products and services that meet the expectations of its clients and customers, and to maintain an effective risk management framework is highly dependent on its ability to staff its operations appropriately and on the competence, trustworthiness, health and safety of its employees. JPMorgan Chase's businesses and operations similarly rely on the workforces of third parties, including employees of vendors, custodians and financial markets infrastructures, and of businesses that it may seek to acquire. JPMorgan Chase's businesses could be materially and adversely affected by:
•the ineffective implementation of business decisions
•any failure to institute controls that appropriately address risks associated with business activities, or to appropriately train employees with respect to those risks and controls
•staffing shortages, particularly in tight labor markets
•the possibility that significant portions of JPMorgan Chase's workforce are unable to work effectively, including because of illness, quarantines, shelter-in-place arrangements, government actions or other restrictions in connection with health emergencies, the spread of infectious diseases, epidemics or pandemics, or due to extraordinary events beyond JPMorgan Chase's control such as natural disasters or an outbreak or escalation of hostilities

•a significant operational breakdown or failure, theft, fraud or other unlawful conduct, or
•other negative outcomes caused by human error or misconduct by an employee of JPMorgan Chase or of another party on which JPMorgan Chase's businesses or operations rely.
JPMorgan Chase's operations could also be impaired if the measures taken by it or by governmental authorities to protect the health and safety of its employees are ineffective, or if any external party on which JPMorgan Chase relies fails to take appropriate and effective actions to protect the health and safety of its employees.
JPMorgan Chase faces substantial legal and operational risks in the processing and safeguarding of personal information.
JPMorgan Chase's businesses and operations are subject to complex and evolving laws, rules and regulations, both within and outside the U.S., governing the privacy and protection of personal information of individuals. Governmental authorities around the world have adopted and are considering the adoption of numerous legislative and regulatory initiatives concerning privacy, data protection and security. Litigation or enforcement actions relating to these laws, rules and regulations could result in
fines or orders requiring that JPMorgan Chase change its data-related practices, which could have an adverse effect on JPMorgan Chase's ability to provide products and otherwise harm its business operations.
Implementing processes relating to JPMorgan Chase's collection, use, sharing and storage of personal information to comply with all applicable laws, rules and regulations in all relevant jurisdictions, including where the laws of different jurisdictions are in conflict, can:
•increase JPMorgan Chase's compliance and operating costs
•hinder the development of new products or services, curtail the offering of existing products or services, or affect how products and services are offered to clients and customers
•demand significant oversight by JPMorgan Chase's management, and
•require JPMorgan Chase to structure its businesses, operations and systems in less efficient ways.
Not all of JPMorgan Chase's clients, customers, vendors, counterparties and other external parties may have appropriate controls in place to protect the confidentiality, integrity or availability of the information exchanged between them and JPMorgan Chase, particularly where information is transmitted by electronic means. JPMorgan Chase could be exposed to litigation or regulatory fines, penalties or other sanctions if personal information of clients, customers, employees or others were to be mishandled or misused, such as situations where such information is:

|    |    |
|---:|---:|
|  1 | 24 |

Item 1A. Risk Factors.

The following discussion sets forth the material risk factors that could affect JPMorgan Chase's financial condition and operations. Readers should not consider any descriptions of these factors to be a complete set of all potential risks that could affect the Firm. Any of the risk factors discussed below could by itself, or combined with other factors, materially and adversely affect JPMorgan Chase's business, results of operations, financial condition, capital position, liquidity, competitive position or reputation, including by materially increasing expenses or decreasing revenues, which could result in material losses or a decrease in earnings.

Summary

The principal risk factors that could adversely affect JPMorgan Chase's business, results of operations, financial condition, capital position, liquidity, competitive position or reputation include:
•Regulatory risks, including the impact that applicable laws, rules and regulations in the highly-regulated and supervised financial services industry, as well as changes to or in the application, interpretation or enforcement of those laws, rules and regulations, can have on JPMorgan Chase's business and operations, including JPMorgan Chase incurring additional costs associated with assessments, levies or other governmental charges; the ways in which differences in financial services regulation and supervision in different jurisdictions or with respect to certain competitors can negatively impact JPMorgan Chase's business; the penalties and collateral consequences, and higher compliance and operational costs, that JPMorgan Chase may incur when resolving a regulatory investigation; the ways in which less predictable legal and regulatory frameworks in certain jurisdictions can negatively impact JPMorgan Chase's operations and financial results; and the losses that security holders will absorb if JPMorgan Chase were to enter into a resolution.
•Political risks, including the potential negative effects on JPMorgan Chase's businesses due to economic uncertainty or instability caused by political developments.
•Market risks, including the effects that economic and market events and conditions, governmental policies, changes in interest rates and credit spreads, and market fluctuations can have on JPMorgan Chase's consumer and wholesale businesses and its investment and market-making positions and on JPMorgan Chase's earnings and its liquidity and capital levels.
•Credit risks, including potential negative effects from adverse changes in the financial condition of clients, customers, counterparties, custodians and central counterparties; the potential for losses due to declines in the value of collateral in stressed market conditions; and potential negative impacts from concentrations of credit risk with respect to clients, customers, counterparties and other market participants.

•Liquidity risks, including the risk that JPMorgan Chase's liquidity could be impaired by market-wide illiquidity or disruption, unforeseen liquidity or capital requirements, the inability to sell assets, default by a significant market participant, unanticipated outflows of cash or collateral, or lack of market or customer confidence in JPMorgan Chase; the dependence of JPMorgan Chase & Co. on the cash flows of its subsidiaries; and the potential adverse effects that any downgrade in any of JPMorgan Chase's credit ratings may have on its liquidity and cost of funding.
•Capital risks, including the risk that any failure by or inability of JPMorgan Chase to maintain the required level and composition of capital, or unfavorable changes in applicable capital requirements, could limit JPMorgan Chase's ability to distribute capital to shareholders or to support its business activities.
•Operational risks, including risks associated with JPMorgan Chase's dependence on its operational systems, its ability to maintain appropriately-staffed workforces and the competence, integrity, health and safety of its employees, as well as the systems and employees of third parties, market participants and service providers; the potential negative effects of failing to identify and address operational risks related to the failure of internal or external operational systems, the introduction of or changes to products, services and delivery platforms or the adoption of new technologies; legal and regulatory risks related to safeguarding personal information; the harm that could be caused by a successful cyber attack affecting JPMorgan Chase or by other extraordinary events; risks related to acquisitions, including the acquisition of certain assets and liabilities of First Republic Bank; risks associated with JPMorgan Chase's risk management framework and control environment, its models and estimations and associated judgments used in its stress testing and financial statements, and controls over disclosure and financial reporting; and potential adverse effects of failing to comply with heightened regulatory and other standards for the oversight of vendors and other service providers.
•Strategic risks, including the damage to JPMorgan Chase's competitive standing and results that could occur if management fails to develop and execute effective business strategies; risks associated with the significant and increasing competition that JPMorgan Chase faces; and the potential adverse impacts of climate change on JPMorgan Chase's business operations, clients and customers.
•Conduct risks, including the negative impact that can result from the actions or misconduct of employees, including any failure of employees to conduct themselves in accordance with JPMorgan Chase's expectations, policies and practices.
•Reputation risks, including the potential adverse effects on JPMorgan Chase's relationships with its clients,

|    |    |
|---:|---:|
|  1 |  9 |
,
Part I

A reduction in JPMorgan Chase's credit ratings could curtail JPMorgan Chase's business activities and reduce its profitability in a number of ways, including:
•reducing its access to capital markets
•materially increasing its cost of issuing and servicing securities
•triggering additional collateral or funding requirements, and
•decreasing the number of investors and counterparties that are willing or permitted to do business with or lend to JPMorgan Chase.
Any rating reduction could also increase the credit spreads charged by the market for taking credit risk on JPMorgan Chase & Co. and its subsidiaries. This could, in turn, adversely affect the value of debt and other obligations of JPMorgan Chase & Co. and its subsidiaries.

Capital

Maintaining the required level and composition of capital may impact JPMorgan Chase's ability to support business activities, meet evolving regulatory requirements and distribute capital to shareholders.
JPMorgan Chase is subject to various regulatory capital requirements, including leverage- and risk-based capital requirements. In addition, as a Global Systemically Important Bank ("GSIB"), JPMorgan Chase is required to hold additional capital buffers, including a GSIB surcharge, a Stress Capital Buffer ("SCB"), and a countercyclical buffer, each of which is reassessed at least annually. The amount of capital that JPMorgan Chase is required to hold in order to satisfy these leverage- and risk-based requirements could increase at any given time due to factors such as:
•actions by banking regulators, including changes in laws, rules, and regulations
•changes in the composition of JPMorgan Chase's balance sheet or developments that could increase RWA, such as increased market risk, customer delinquencies, client credit rating downgrades or other factors, and
•increases in estimated stress losses as determined by the Federal Reserve under the Comprehensive Capital Analysis and Review, which could increase JPMorgan Chase's SCB.
Any failure by or inability of JPMorgan Chase to maintain the required level and composition of capital, or unfavorable changes in applicable capital requirements, could have an adverse impact on JPMorgan Chase's shareholders, such as:
•reducing the amount of common stock that JPMorgan Chase is permitted to repurchase
•requiring the issuance of, or prohibiting the redemption of, capital instruments in a manner inconsistent with JPMorgan Chase's capital management strategy

•constraining the amount of dividends that may be paid on common stock, or
•curtailing JPMorgan Chase's business activities or operations.
Banking regulators have released a proposal to amend the Basel III risk-based capital framework which could significantly revise the risk-based capital requirements for banks with assets of $100 billion or more, including JPMorgan Chase. Uncertainty remains as to the manner in which these requirements will ultimately apply to JPMorgan Chase, however it is possible that these requirements could impact JPMorgan Chase's decisions concerning the business activities in which it will engage and its levels of capital distributions to its shareholders.

Operational

JPMorgan Chase's businesses are dependent on the effectiveness of internal and external operational systems.
JPMorgan Chase's businesses rely on the ability of JPMorgan Chase's financial, accounting, transaction execution, data processing and other operational systems to process, record, monitor and report a large number of transactions on a continuous basis, and to do so accurately, quickly and securely. In addition to proper design, installation, maintenance and training, the effective functioning of JPMorgan Chase's operational systems depends on:
•the quality of the information contained in those systems, as inaccurate, outdated, incomplete or corrupted data can significantly compromise the functionality or reliability of a particular system and other systems to which it transmits or from which it receives information, and
•JPMorgan Chase's ability to continue to maintain and upgrade its systems on a regular basis in line with technological advancements and evolving security requirements, carefully manage any changes introduced to its systems to maintain security and operational continuity, and adhere to all applicable legal and regulatory requirements, particularly in regions where JPMorgan Chase may face a heightened risk of malicious activity.
JPMorgan Chase has experienced and expects that it will continue to experience failures and disruptions in the stability of its operational systems, including degraded performance of data processing systems, data quality issues, disruptions of network connectivity and malfunctioning software, as well as disruptions in its ability to access and use the operational systems of third parties. These incidents have resulted in various negative effects for customers, including the inability to access account information or to make transactions through ATM, internet or mobile channels, the exfiltration of customer personal data, the recording of duplicative transactions and extended delays for customers requiring services from call

|    |    |
|---:|---:|
|  1 | 20 |
, centers. There can be no assurance that these and other types of operational failures or disruptions will not occur in the future.
JPMorgan Chase's ability to effectively manage the stability of its operational systems and infrastructure could be hindered by many factors, any of which could have a negative impact on JPMorgan Chase and its clients, customers and counterparties, including:
•JPMorgan Chase's ability to effectively maintain and upgrade systems and infrastructure can become more challenging as the speed, frequency, volume, interconnectivity and complexity of transactions continue to increase
•attempts by third parties to defraud JPMorgan Chase or its clients and customers are increasing, evolving and becoming more complex, and during periods of market disruption or economic uncertainty, these attempts can be expected to increase in volume
•errors made by JPMorgan Chase or another market participant, whether inadvertent or malicious, could cause widespread system disruption
•failure to detect weaknesses or shortcomings in operational systems in a timely manner
•isolated or seemingly insignificant errors in operational systems could compound, or migrate to other systems over time, to become larger issues
•disruptions in operational systems or in the ability of systems to communicate with each other could be caused by failures in synchronization or encryption software, or degraded performance of microprocessors, and
•attempts by third parties to block the use of key technology solutions by claiming that the use infringes on their intellectual property rights.
JPMorgan Chase also depends on its ability to access and use the operational systems of third parties, including its custodians, vendors (such as those that provide data and cloud computing services, and security and technology services) and other market participants (such as clearing and payment systems, CCPs and securities exchanges), and external operational systems with which JPMorgan is connected, whether directly or indirectly, can be sources of operational risk to JPMorgan Chase. JPMorgan Chase may be exposed not only to a systems failure or cyber attack that may be experienced by a vendor or market infrastructure with which JPMorgan Chase is directly connected, but also to a systems breakdown or cyber attack involving another party to which such a vendor or infrastructure is connected. Similarly, retailers, payment systems and processors, data aggregators and other external parties with which JPMorgan Chase's customers do business can increase JPMorgan Chase's operational risk. This is particularly the case where activities of customers or other parties are beyond JPMorgan Chase's security and control systems, including through the use of the internet,

cloud computing services, and personal smart phones and other mobile devices or services.
If an external party obtains access to customer account data on JPMorgan Chase's systems, whether authorized or unauthorized, and that party misappropriates that data, this could result in negative outcomes for JPMorgan Chase and its clients and customers, including a heightened risk of fraudulent transactions using JPMorgan Chase's systems, losses from fraudulent transactions and reputational harm arising from the perception that JPMorgan Chase's systems may not be secure.
As JPMorgan Chase's interconnectivity with clients, customers and other external parties continues to expand, JPMorgan Chase increasingly faces the risk of operational failure or cyber attacks with respect to the systems of those parties. Security breaches affecting JPMorgan Chase's clients or customers, or systems breakdowns or failures, security breaches or human error or misconduct affecting other external parties, may require JPMorgan Chase to take steps to protect the integrity of its own operational systems or to safeguard confidential information, including restricting the access of customers to their accounts. These actions can increase JPMorgan Chase's operational costs and potentially diminish customer satisfaction and confidence in JPMorgan Chase.
Furthermore, the widespread and expanding interconnectivity among financial institutions, clearing banks, CCPs, payments processors, financial technology companies, securities exchanges, clearing houses and other financial market infrastructures increases the risk that the disruption of an operational system involving one institution or entity, including due to a cyber attack, may cause industry-wide operational disruptions that could materially affect JPMorgan Chase's ability to conduct business. In addition, the risks associated with the disruption of an operational system of a third party could be exacerbated to the extent that the services provided by that system are used by a significant number or proportion of market participants.
The ineffectiveness, failure or other disruption of operational systems upon which JPMorgan Chase depends, including due to a systems malfunction, cyber incident or other systems failure, could result in unfavorable ripple effects in the financial markets and for JPMorgan Chase and its clients and customers, including:
•delays or other disruptions in providing services, including the provision of liquidity or information to clients and customers
•impairment of JPMorgan Chase's ability to execute transactions, including delays or failures in the confirmation or settlement of transactions or in obtaining access to funds or other assets required for settlement
•the possibility that funds transfers, capital markets trades or other transactions are executed erroneously

|    |    |
|---:|---:|
|  1 | 21 |
,
Part I

•financial losses, including due to loss-sharing requirements of CCPs, payment systems or other market infrastructures, or as possible restitution to clients and customers
•higher operational costs associated with replacing services provided by a system that has experienced a failure or other disruption
•limitations on JPMorgan Chase's ability to collect data needed for its business and operations
•loss of confidence in the ability of JPMorgan Chase, or financial institutions generally, to protect against and withstand operational disruptions
•dissatisfaction among JPMorgan Chase's clients or customers
•significant exposure to litigation and regulatory fines, penalties or other sanctions, and
•harm to JPMorgan Chase's reputation.
If JPMorgan Chase's operational systems, or those of acquired businesses or of external parties on which JPMorgan Chase's businesses depend, are unable to meet the requirements of JPMorgan Chase's businesses and operations or bank regulatory standards, or if they fail or have other significant shortcomings, JPMorgan Chase could be materially and adversely affected.
A successful cyber attack affecting JPMorgan Chase could cause significant harm to JPMorgan Chase and its clients and customers.
JPMorgan Chase experiences numerous cyber attacks on its computer systems, software, networks and other technology assets on a daily basis from various actors, including groups acting on behalf of hostile countries, cyber-criminals, "hacktivists" (i.e., individuals or groups that use technology to promote a political agenda or social change) and others. These cyber attacks can take many forms, including attempts to introduce computer viruses or malicious code, which are commonly referred to as "malware," into JPMorgan Chase's systems. These attacks are often designed to:
•obtain unauthorized access to confidential information belonging to JPMorgan Chase or its clients, customers, counterparties or employees
•manipulate data
•destroy data or systems with the aim of rendering services unavailable
•disrupt, sabotage or degrade service on JPMorgan Chase's systems

•steal money, or

•extort money through the use of so-called "ransomware."
JPMorgan Chase also experiences:

•distributed denial-of-service attacks intended to disrupt JPMorgan Chase's websites, including those that provide online banking and other services,
•a higher volume and complexity of cyber attacks against the backdrop of heightened geopolitical tensions, and
•a high volume of disruptions to internet-based services used by JPMorgan Chase that are provided by third parties.
JPMorgan Chase has experienced security breaches due to cyber attacks in the past, and it is inevitable that additional breaches will occur in the future. Any such breach could result in serious and harmful consequences for JPMorgan Chase or its clients and customers.
A principal reason that JPMorgan Chase cannot provide absolute security against cyber attacks is that it may not always be possible to anticipate, detect or recognize threats to JPMorgan Chase's systems, or to implement effective preventive measures against all breaches because:
•the techniques used in cyber attacks evolve frequently and are increasingly sophisticated, and therefore may not be recognized until launched or may go undetected for extended periods
•cyber attacks can originate from a wide variety of sources, including JPMorgan Chase's own employees, cyber-criminals, hacktivists, well-resourced groups linked to terrorist organizations or hostile nation-states that can sustain malicious activities for extended periods, or third parties whose objective is to disrupt the operations of financial institutions more generally
•JPMorgan Chase does not have control over the cybersecurity of the systems of the large number of clients, customers, counterparties and third-party service providers with which it does business, and
•it is possible that a third party, after establishing a foothold on an internal network without being detected, may gain access to other networks and systems.
The risk of a security breach due to a cyber attack could increase in the future due to factors such as:
•JPMorgan Chase's ongoing expansion of its mobile banking and other internet-based product offerings and its internal use of internet-based products and applications, including those that use cloud computing services
•advances in artificial intelligence, such as the use of machine learning and generative artificial intelligence by malicious actors to develop more advanced social engineering attacks, including targeted phishing attacks
•the inability to maintain the security of information transmitted by JPMorgan Chase due to advances in quantum computing that may counteract or nullify existing information protections, and
•the acquisition and integration of new businesses.

|    |    |
|---:|---:|
|  1 | 22 |
, In addition, a third party could misappropriate confidential information obtained by intercepting signals or communications from mobile devices used by JPMorgan Chase's employees.
The dynamic nature of the cyber threat landscape necessitates continuous enhancement and adaptation of cybersecurity controls. Failure to discover or address known vulnerabilities or shortcomings in cybersecurity controls, or to prioritize or complete enhancements to address them, in each case in a timely manner, may leave JPMorgan Chase vulnerable to cyber attacks, potentially resulting in data breaches, financial losses, reputational damage and regulatory penalties, including the failure to prioritize or complete enhancements relating to:
•preventing unauthorized access and protecting against the misuse of access, including the maintenance and enhancement of controls related to secure software development practices and identity and access management, such as those relating to the management of administrative access to systems
•detecting, escalating and addressing effectively and in a timely manner any vulnerabilities that may be present either in internally-developed software or externally-provided software or services, including vulnerabilities that could allow attackers to exploit unknown security flaws in software and hardware ("zero-day vulnerabilities")
•enhancing early detection of attacks against third-party vendors, including attacks targeting vulnerabilities in third-party open-source software, in support of the secure development and maintenance of internal systems
•maintaining and enhancing controls related to technology asset management and inventory systems to prevent the risk of undetected vulnerabilities that could undermine JPMorgan Chase's ability to operate an effective control process
•upgrading the coverage and capabilities of systems and controls to protect JPMorgan Chase and its clients and customers from the impact of distributed denial-of-service attacks, or to recover from outages that could be caused by a malware or ransomware attack
•strengthening network security and management of outbound connections to reduce the risk of data loss
•identifying, assessing and mitigating insider threat activities that could lead to the misuse of JPMorgan Chase's systems or client and customer information, and
•integrating acquired businesses where system integration may be complex or may require extensive and lengthy remediation or enhancement of controls.
A successful penetration or circumvention of the security of JPMorgan Chase's systems or the systems of a vendor, governmental body or another market participant could cause serious negative consequences, including:

•significant disruption of JPMorgan Chase's operations and those of its clients, customers and counterparties, including losing access to operational systems
•misappropriation of confidential information of JPMorgan Chase or that of its clients, customers, counterparties, employees or regulators
•disruption of or damage to JPMorgan Chase's systems and those of its clients, customers and counterparties
•the inability, or extended delays in the ability, to fully recover and restore data that has been stolen, manipulated or destroyed, or the inability to prevent systems from processing fraudulent transactions
•demands that JPMorgan Chase pay a ransom to a malicious actor that has perpetrated a cybersecurity breach
•unintended violations by JPMorgan Chase of applicable privacy and other laws
•financial loss to JPMorgan Chase or to its clients, customers, counterparties or employees
•loss of confidence in JPMorgan Chase's cybersecurity and business resiliency measures
•dissatisfaction among JPMorgan Chase's clients, customers or counterparties
•significant exposure to litigation and regulatory fines, penalties or other sanctions, and
•harm to JPMorgan Chase's reputation.
The extent of a particular cyber attack, the methods and tools used by various actors, and the steps that JPMorgan Chase may need to take to investigate the attack may not be immediately clear, and it may take a significant amount of time before such an investigation can be completed. While such an investigation is ongoing, JPMorgan Chase may not necessarily know the full extent of the harm caused by the cyber attack, and that damage may continue to spread. These factors may inhibit JPMorgan Chase's ability to provide rapid, full and reliable information about the cyber attack to its clients, customers, counterparties and regulators, as well as the public. Furthermore, it may not be clear how best to contain and remediate the harm caused by the cyber attack, and certain errors or actions could be repeated or compounded before they are discovered and remediated. Any or all of these factors could further increase the costs and consequences of a cyber attack.
JPMorgan Chase can be negatively affected if it fails to identify and address operational risks associated with the introduction of or changes to products, services and delivery platforms or the adoption of new technologies.
When JPMorgan Chase launches a new product or service, introduces a new platform for the delivery or distribution of products or services (including mobile connectivity, electronic trading and cloud computing), acquires or invests in a business, makes changes to an existing product, service

|    |    |
|---:|---:|
|  1 | 23 |
,
Part I

or delivery platform, or adopts a new technology, it may not fully appreciate or identify new operational risks that may arise from those changes, including increased reliance on third party providers, or may fail to implement adequate controls to mitigate the risks associated with those changes. Any significant failure in this regard could diminish JPMorgan Chase's ability to operate one or more of its businesses or result in:
•potential liability to clients, counterparties and customers
•higher compliance and operational cost
•higher litigation costs, including regulatory fines, penalties and other sanctions
•damage to JPMorgan Chase's reputation
•impairment of JPMorgan Chase's liquidity

•regulatory intervention, or

•weaker competitive standing.
Any of the foregoing consequences could materially and adversely affect JPMorgan Chase's businesses and results of operations.
JPMorgan Chase's business and operations rely on its ability, and the ability of key external parties, to maintain appropriately-staffed workforces, and on the competence, trustworthiness, health and safety of employees.
JPMorgan Chase's ability to operate its businesses efficiently and profitably, to offer products and services that meet the expectations of its clients and customers, and to maintain an effective risk management framework is highly dependent on its ability to staff its operations appropriately and on the competence, trustworthiness, health and safety of its employees. JPMorgan Chase's businesses and operations similarly rely on the workforces of third parties, including employees of vendors, custodians and financial markets infrastructures, and of businesses that it may seek to acquire. JPMorgan Chase's businesses could be materially and adversely affected by:
•the ineffective implementation of business decisions
•any failure to institute controls that appropriately address risks associated with business activities, or to appropriately train employees with respect to those risks and controls
•staffing shortages, particularly in tight labor markets
•the possibility that significant portions of JPMorgan Chase's workforce are unable to work effectively, including because of illness, quarantines, shelter-in-place arrangements, government actions or other restrictions in connection with health emergencies, the spread of infectious diseases, epidemics or pandemics, or due to extraordinary events beyond JPMorgan Chase's control such as natural disasters or an outbreak or escalation of hostilities

•a significant operational breakdown or failure, theft, fraud or other unlawful conduct, or
•other negative outcomes caused by human error or misconduct by an employee of JPMorgan Chase or of another party on which JPMorgan Chase's businesses or operations rely.
JPMorgan Chase's operations could also be impaired if the measures taken by it or by governmental authorities to protect the health and safety of its employees are ineffective, or if any external party on which JPMorgan Chase relies fails to take appropriate and effective actions to protect the health and safety of its employees.
JPMorgan Chase faces substantial legal and operational risks in the processing and safeguarding of personal information.
JPMorgan Chase's businesses and operations are subject to complex and evolving laws, rules and regulations, both within and outside the U.S., governing the privacy and protection of personal information of individuals. Governmental authorities around the world have adopted and are considering the adoption of numerous legislative and regulatory initiatives concerning privacy, data protection and security. Litigation or enforcement actions relating to these laws, rules and regulations could result in
fines or orders requiring that JPMorgan Chase change its data-related practices, which could have an adverse effect on JPMorgan Chase's ability to provide products and otherwise harm its business operations.
Implementing processes relating to JPMorgan Chase's collection, use, sharing and storage of personal information to comply with all applicable laws, rules and regulations in all relevant jurisdictions, including where the laws of different jurisdictions are in conflict, can:
•increase JPMorgan Chase's compliance and operating costs
•hinder the development of new products or services, curtail the offering of existing products or services, or affect how products and services are offered to clients and customers
•demand significant oversight by JPMorgan Chase's management, and
•require JPMorgan Chase to structure its businesses, operations and systems in less efficient ways.
Not all of JPMorgan Chase's clients, customers, vendors, counterparties and other external parties may have appropriate controls in place to protect the confidentiality, integrity or availability of the information exchanged between them and JPMorgan Chase, particularly where information is transmitted by electronic means. JPMorgan Chase could be exposed to litigation or regulatory fines, penalties or other sanctions if personal information of clients, customers, employees or others were to be mishandled or misused, such as situations where such information is:

|    |    |
|---:|---:|
|  1 | 24 |

JPMORGAN CHASE & CO 10-K form for the fiscal year ended 2023-12-31, page 9:
Item 1A. Risk Factors.

The following discussion sets forth the material risk factors that could affect JPMorgan Chase's financial condition and operations. Readers should not consider any descriptions of these factors to be a complete set of all potential risks that could affect the Firm. Any of the risk factors discussed below could by itself, or combined with other factors, materially and adversely affect JPMorgan Chase's business, results of operations, financial condition, capital position, liquidity, competitive position or reputation, including by materially increasing expenses or decreasing revenues, which could result in material losses or a decrease in earnings.

Summary

The principal risk factors that could adversely affect JPMorgan Chase's business, results of operations, financial condition, capital position, liquidity, competitive position or reputation include:
•Regulatory risks, including the impact that applicable laws, rules and regulations in the highly-regulated and supervised financial services industry, as well as changes to or in the application, interpretation or enforcement of those laws, rules and regulations, can have on JPMorgan Chase's business and operations, including JPMorgan Chase incurring additional costs associated with assessments, levies or other governmental charges; the ways in which differences in financial services regulation and supervision in different jurisdictions or with respect to certain competitors can negatively impact JPMorgan Chase's business; the penalties and collateral consequences, and higher compliance and operational costs, that JPMorgan Chase may incur when resolving a regulatory investigation; the ways in which less predictable legal and regulatory frameworks in certain jurisdictions can negatively impact JPMorgan Chase's operations and financial results; and the losses that security holders will absorb if JPMorgan Chase were to enter into a resolution.
•Political risks, including the potential negative effects on JPMorgan Chase's businesses due to economic uncertainty or instability caused by political developments.
•Market risks, including the effects that economic and market events and conditions, governmental policies, changes in interest rates and credit spreads, and market fluctuations can have on JPMorgan Chase's consumer and wholesale businesses and its investment and market-making positions and on JPMorgan Chase's earnings and its liquidity and capital levels.
•Credit risks, including potential negative effects from adverse changes in the financial condition of clients, customers, counterparties, custodians and central counterparties; the potential for losses due to declines in the value of collateral in stressed market conditions; and potential negative impacts from concentrations of credit risk with respect to clients, customers, counterparties and other market participants.

•Liquidity risks, including the risk that JPMorgan Chase's liquidity could be impaired by market-wide illiquidity or disruption, unforeseen liquidity or capital requirements, the inability to sell assets, default by a significant market participant, unanticipated outflows of cash or collateral, or lack of market or customer confidence in JPMorgan Chase; the dependence of JPMorgan Chase & Co. on the cash flows of its subsidiaries; and the potential adverse effects that any downgrade in any of JPMorgan Chase's credit ratings may have on its liquidity and cost of funding.
•Capital risks, including the risk that any failure by or inability of JPMorgan Chase to maintain the required level and composition of capital, or unfavorable changes in applicable capital requirements, could limit JPMorgan Chase's ability to distribute capital to shareholders or to support its business activities.
•Operational risks, including risks associated with JPMorgan Chase's dependence on its operational systems, its ability to maintain appropriately-staffed workforces and the competence, integrity, health and safety of its employees, as well as the systems and employees of third parties, market participants and service providers; the potential negative effects of failing to identify and address operational risks related to the failure of internal or external operational systems, the introduction of or changes to products, services and delivery platforms or the adoption of new technologies; legal and regulatory risks related to safeguarding personal information; the harm that could be caused by a successful cyber attack affecting JPMorgan Chase or by other extraordinary events; risks related to acquisitions, including the acquisition of certain assets and liabilities of First Republic Bank; risks associated with JPMorgan Chase's risk management framework and control environment, its models and estimations and associated judgments used in its stress testing and financial statements, and controls over disclosure and financial reporting; and potential adverse effects of failing to comply with heightened regulatory and other standards for the oversight of vendors and other service providers.
•Strategic risks, including the damage to JPMorgan Chase's competitive standing and results that could occur if management fails to develop and execute effective business strategies; risks associated with the significant and increasing competition that JPMorgan Chase faces; and the potential adverse impacts of climate change on JPMorgan Chase's business operations, clients and customers.
•Conduct risks, including the negative impact that can result from the actions or misconduct of employees, including any failure of employees to conduct themselves in accordance with JPMorgan Chase's expectations, policies and practices.
•Reputation risks, including the potential adverse effects on JPMorgan Chase's relationships with its clients,

		9

, JPMORGAN CHASE & CO 10-K form for the fiscal year ended 2023-12-31, page 20:
Part I

A reduction in JPMorgan Chase's credit ratings could curtail JPMorgan Chase's business activities and reduce its profitability in a number of ways, including:
•reducing its access to capital markets
•materially increasing its cost of issuing and servicing securities
•triggering additional collateral or funding requirements, and
•decreasing the number of investors and counterparties that are willing or permitted to do business with or lend to JPMorgan Chase.
Any rating reduction could also increase the credit spreads charged by the market for taking credit risk on JPMorgan Chase & Co. and its subsidiaries. This could, in turn, adversely affect the value of debt and other obligations of JPMorgan Chase & Co. and its subsidiaries.

Capital

Maintaining the required level and composition of capital may impact JPMorgan Chase's ability to support business activities, meet evolving regulatory requirements and distribute capital to shareholders.
JPMorgan Chase is subject to various regulatory capital requirements, including leverage- and risk-based capital requirements. In addition, as a Global Systemically Important Bank ("GSIB"), JPMorgan Chase is required to hold additional capital buffers, including a GSIB surcharge, a Stress Capital Buffer ("SCB"), and a countercyclical buffer, each of which is reassessed at least annually. The amount of capital that JPMorgan Chase is required to hold in order to satisfy these leverage- and risk-based requirements could increase at any given time due to factors such as:
•actions by banking regulators, including changes in laws, rules, and regulations
•changes in the composition of JPMorgan Chase's balance sheet or developments that could increase RWA, such as increased market risk, customer delinquencies, client credit rating downgrades or other factors, and
•increases in estimated stress losses as determined by the Federal Reserve under the Comprehensive Capital Analysis and Review, which could increase JPMorgan Chase's SCB.
Any failure by or inability of JPMorgan Chase to maintain the required level and composition of capital, or unfavorable changes in applicable capital requirements, could have an adverse impact on JPMorgan Chase's shareholders, such as:
•reducing the amount of common stock that JPMorgan Chase is permitted to repurchase
•requiring the issuance of, or prohibiting the redemption of, capital instruments in a manner inconsistent with JPMorgan Chase's capital management strategy

•constraining the amount of dividends that may be paid on common stock, or
•curtailing JPMorgan Chase's business activities or operations.
Banking regulators have released a proposal to amend the Basel III risk-based capital framework which could significantly revise the risk-based capital requirements for banks with assets of $100 billion or more, including JPMorgan Chase. Uncertainty remains as to the manner in which these requirements will ultimately apply to JPMorgan Chase, however it is possible that these requirements could impact JPMorgan Chase's decisions concerning the business activities in which it will engage and its levels of capital distributions to its shareholders.

Operational

JPMorgan Chase's businesses are dependent on the effectiveness of internal and external operational systems.
JPMorgan Chase's businesses rely on the ability of JPMorgan Chase's financial, accounting, transaction execution, data processing and other operational systems to process, record, monitor and report a large number of transactions on a continuous basis, and to do so accurately, quickly and securely. In addition to proper design, installation, maintenance and training, the effective functioning of JPMorgan Chase's operational systems depends on:
•the quality of the information contained in those systems, as inaccurate, outdated, incomplete or corrupted data can significantly compromise the functionality or reliability of a particular system and other systems to which it transmits or from which it receives information, and
•JPMorgan Chase's ability to continue to maintain and upgrade its systems on a regular basis in line with technological advancements and evolving security requirements, carefully manage any changes introduced to its systems to maintain security and operational continuity, and adhere to all applicable legal and regulatory requirements, particularly in regions where JPMorgan Chase may face a heightened risk of malicious activity.
JPMorgan Chase has experienced and expects that it will continue to experience failures and disruptions in the stability of its operational systems, including degraded performance of data processing systems, data quality issues, disruptions of network connectivity and malfunctioning software, as well as disruptions in its ability to access and use the operational systems of third parties. These incidents have resulted in various negative effects for customers, including the inability to access account information or to make transactions through ATM, internet or mobile channels, the exfiltration of customer personal data, the recording of duplicative transactions and extended delays for customers requiring services from call

20

, JPMORGAN CHASE & CO 10-K form for the fiscal year ended 2023-12-31, page 21: centers. There can be no assurance that these and other types of operational failures or disruptions will not occur in the future.
JPMorgan Chase's ability to effectively manage the stability of its operational systems and infrastructure could be hindered by many factors, any of which could have a negative impact on JPMorgan Chase and its clients, customers and counterparties, including:
•JPMorgan Chase's ability to effectively maintain and upgrade systems and infrastructure can become more challenging as the speed, frequency, volume, interconnectivity and complexity of transactions continue to increase
•attempts by third parties to defraud JPMorgan Chase or its clients and customers are increasing, evolving and becoming more complex, and during periods of market disruption or economic uncertainty, these attempts can be expected to increase in volume
•errors made by JPMorgan Chase or another market participant, whether inadvertent or malicious, could cause widespread system disruption
•failure to detect weaknesses or shortcomings in operational systems in a timely manner
•isolated or seemingly insignificant errors in operational systems could compound, or migrate to other systems over time, to become larger issues
•disruptions in operational systems or in the ability of systems to communicate with each other could be caused by failures in synchronization or encryption software, or degraded performance of microprocessors, and
•attempts by third parties to block the use of key technology solutions by claiming that the use infringes on their intellectual property rights.
JPMorgan Chase also depends on its ability to access and use the operational systems of third parties, including its custodians, vendors (such as those that provide data and cloud computing services, and security and technology services) and other market participants (such as clearing and payment systems, CCPs and securities exchanges), and external operational systems with which JPMorgan is connected, whether directly or indirectly, can be sources of operational risk to JPMorgan Chase. JPMorgan Chase may be exposed not only to a systems failure or cyber attack that may be experienced by a vendor or market infrastructure with which JPMorgan Chase is directly connected, but also to a systems breakdown or cyber attack involving another party to which such a vendor or infrastructure is connected. Similarly, retailers, payment systems and processors, data aggregators and other external parties with which JPMorgan Chase's customers do business can increase JPMorgan Chase's operational risk. This is particularly the case where activities of customers or other parties are beyond JPMorgan Chase's security and control systems, including through the use of the internet,

cloud computing services, and personal smart phones and other mobile devices or services.
If an external party obtains access to customer account data on JPMorgan Chase's systems, whether authorized or unauthorized, and that party misappropriates that data, this could result in negative outcomes for JPMorgan Chase and its clients and customers, including a heightened risk of fraudulent transactions using JPMorgan Chase's systems, losses from fraudulent transactions and reputational harm arising from the perception that JPMorgan Chase's systems may not be secure.
As JPMorgan Chase's interconnectivity with clients, customers and other external parties continues to expand, JPMorgan Chase increasingly faces the risk of operational failure or cyber attacks with respect to the systems of those parties. Security breaches affecting JPMorgan Chase's clients or customers, or systems breakdowns or failures, security breaches or human error or misconduct affecting other external parties, may require JPMorgan Chase to take steps to protect the integrity of its own operational systems or to safeguard confidential information, including restricting the access of customers to their accounts. These actions can increase JPMorgan Chase's operational costs and potentially diminish customer satisfaction and confidence in JPMorgan Chase.
Furthermore, the widespread and expanding interconnectivity among financial institutions, clearing banks, CCPs, payments processors, financial technology companies, securities exchanges, clearing houses and other financial market infrastructures increases the risk that the disruption of an operational system involving one institution or entity, including due to a cyber attack, may cause industry-wide operational disruptions that could materially affect JPMorgan Chase's ability to conduct business. In addition, the risks associated with the disruption of an operational system of a third party could be exacerbated to the extent that the services provided by that system are used by a significant number or proportion of market participants.
The ineffectiveness, failure or other disruption of operational systems upon which JPMorgan Chase depends, including due to a systems malfunction, cyber incident or other systems failure, could result in unfavorable ripple effects in the financial markets and for JPMorgan Chase and its clients and customers, including:
•delays or other disruptions in providing services, including the provision of liquidity or information to clients and customers
•impairment of JPMorgan Chase's ability to execute transactions, including delays or failures in the confirmation or settlement of transactions or in obtaining access to funds or other assets required for settlement
•the possibility that funds transfers, capital markets trades or other transactions are executed erroneously

		21

, JPMORGAN CHASE & CO 10-K form for the fiscal year ended 2023-12-31, page 22:
Part I

•financial losses, including due to loss-sharing requirements of CCPs, payment systems or other market infrastructures, or as possible restitution to clients and customers
•higher operational costs associated with replacing services provided by a system that has experienced a failure or other disruption
•limitations on JPMorgan Chase's ability to collect data needed for its business and operations
•loss of confidence in the ability of JPMorgan Chase, or financial institutions generally, to protect against and withstand operational disruptions
•dissatisfaction among JPMorgan Chase's clients or customers
•significant exposure to litigation and regulatory fines, penalties or other sanctions, and
•harm to JPMorgan Chase's reputation.
If JPMorgan Chase's operational systems, or those of acquired businesses or of external parties on which JPMorgan Chase's businesses depend, are unable to meet the requirements of JPMorgan Chase's businesses and operations or bank regulatory standards, or if they fail or have other significant shortcomings, JPMorgan Chase could be materially and adversely affected.
A successful cyber attack affecting JPMorgan Chase could cause significant harm to JPMorgan Chase and its clients and customers.
JPMorgan Chase experiences numerous cyber attacks on its computer systems, software, networks and other technology assets on a daily basis from various actors, including groups acting on behalf of hostile countries, cyber-criminals, "hacktivists" (i.e., individuals or groups that use technology to promote a political agenda or social change) and others. These cyber attacks can take many forms, including attempts to introduce computer viruses or malicious code, which are commonly referred to as "malware," into JPMorgan Chase's systems. These attacks are often designed to:
•obtain unauthorized access to confidential information belonging to JPMorgan Chase or its clients, customers, counterparties or employees
•manipulate data
•destroy data or systems with the aim of rendering services unavailable
•disrupt, sabotage or degrade service on JPMorgan Chase's systems

•steal money, or

•extort money through the use of so-called "ransomware."
JPMorgan Chase also experiences:

•distributed denial-of-service attacks intended to disrupt JPMorgan Chase's websites, including those that provide online banking and other services,
•a higher volume and complexity of cyber attacks against the backdrop of heightened geopolitical tensions, and
•a high volume of disruptions to internet-based services used by JPMorgan Chase that are provided by third parties.
JPMorgan Chase has experienced security breaches due to cyber attacks in the past, and it is inevitable that additional breaches will occur in the future. Any such breach could result in serious and harmful consequences for JPMorgan Chase or its clients and customers.
A principal reason that JPMorgan Chase cannot provide absolute security against cyber attacks is that it may not always be possible to anticipate, detect or recognize threats to JPMorgan Chase's systems, or to implement effective preventive measures against all breaches because:
•the techniques used in cyber attacks evolve frequently and are increasingly sophisticated, and therefore may not be recognized until launched or may go undetected for extended periods
•cyber attacks can originate from a wide variety of sources, including JPMorgan Chase's own employees, cyber-criminals, hacktivists, well-resourced groups linked to terrorist organizations or hostile nation-states that can sustain malicious activities for extended periods, or third parties whose objective is to disrupt the operations of financial institutions more generally
•JPMorgan Chase does not have control over the cybersecurity of the systems of the large number of clients, customers, counterparties and third-party service providers with which it does business, and
•it is possible that a third party, after establishing a foothold on an internal network without being detected, may gain access to other networks and systems.
The risk of a security breach due to a cyber attack could increase in the future due to factors such as:
•JPMorgan Chase's ongoing expansion of its mobile banking and other internet-based product offerings and its internal use of internet-based products and applications, including those that use cloud computing services
•advances in artificial intelligence, such as the use of machine learning and generative artificial intelligence by malicious actors to develop more advanced social engineering attacks, including targeted phishing attacks
•the inability to maintain the security of information transmitted by JPMorgan Chase due to advances in quantum computing that may counteract or nullify existing information protections, and
•the acquisition and integration of new businesses.

22

, JPMORGAN CHASE & CO 10-K form for the fiscal year ended 2023-12-31, page 23: In addition, a third party could misappropriate confidential information obtained by intercepting signals or communications from mobile devices used by JPMorgan Chase's employees.
The dynamic nature of the cyber threat landscape necessitates continuous enhancement and adaptation of cybersecurity controls. Failure to discover or address known vulnerabilities or shortcomings in cybersecurity controls, or to prioritize or complete enhancements to address them, in each case in a timely manner, may leave JPMorgan Chase vulnerable to cyber attacks, potentially resulting in data breaches, financial losses, reputational damage and regulatory penalties, including the failure to prioritize or complete enhancements relating to:
•preventing unauthorized access and protecting against the misuse of access, including the maintenance and enhancement of controls related to secure software development practices and identity and access management, such as those relating to the management of administrative access to systems
•detecting, escalating and addressing effectively and in a timely manner any vulnerabilities that may be present either in internally-developed software or externally-provided software or services, including vulnerabilities that could allow attackers to exploit unknown security flaws in software and hardware ("zero-day vulnerabilities")
•enhancing early detection of attacks against third-party vendors, including attacks targeting vulnerabilities in third-party open-source software, in support of the secure development and maintenance of internal systems
•maintaining and enhancing controls related to technology asset management and inventory systems to prevent the risk of undetected vulnerabilities that could undermine JPMorgan Chase's ability to operate an effective control process
•upgrading the coverage and capabilities of systems and controls to protect JPMorgan Chase and its clients and customers from the impact of distributed denial-of-service attacks, or to recover from outages that could be caused by a malware or ransomware attack
•strengthening network security and management of outbound connections to reduce the risk of data loss
•identifying, assessing and mitigating insider threat activities that could lead to the misuse of JPMorgan Chase's systems or client and customer information, and
•integrating acquired businesses where system integration may be complex or may require extensive and lengthy remediation or enhancement of controls.
A successful penetration or circumvention of the security of JPMorgan Chase's systems or the systems of a vendor, governmental body or another market participant could cause serious negative consequences, including:

•significant disruption of JPMorgan Chase's operations and those of its clients, customers and counterparties, including losing access to operational systems
•misappropriation of confidential information of JPMorgan Chase or that of its clients, customers, counterparties, employees or regulators
•disruption of or damage to JPMorgan Chase's systems and those of its clients, customers and counterparties
•the inability, or extended delays in the ability, to fully recover and restore data that has been stolen, manipulated or destroyed, or the inability to prevent systems from processing fraudulent transactions
•demands that JPMorgan Chase pay a ransom to a malicious actor that has perpetrated a cybersecurity breach
•unintended violations by JPMorgan Chase of applicable privacy and other laws
•financial loss to JPMorgan Chase or to its clients, customers, counterparties or employees
•loss of confidence in JPMorgan Chase's cybersecurity and business resiliency measures
•dissatisfaction among JPMorgan Chase's clients, customers or counterparties
•significant exposure to litigation and regulatory fines, penalties or other sanctions, and
•harm to JPMorgan Chase's reputation.
The extent of a particular cyber attack, the methods and tools used by various actors, and the steps that JPMorgan Chase may need to take to investigate the attack may not be immediately clear, and it may take a significant amount of time before such an investigation can be completed. While such an investigation is ongoing, JPMorgan Chase may not necessarily know the full extent of the harm caused by the cyber attack, and that damage may continue to spread. These factors may inhibit JPMorgan Chase's ability to provide rapid, full and reliable information about the cyber attack to its clients, customers, counterparties and regulators, as well as the public. Furthermore, it may not be clear how best to contain and remediate the harm caused by the cyber attack, and certain errors or actions could be repeated or compounded before they are discovered and remediated. Any or all of these factors could further increase the costs and consequences of a cyber attack.
JPMorgan Chase can be negatively affected if it fails to identify and address operational risks associated with the introduction of or changes to products, services and delivery platforms or the adoption of new technologies.
When JPMorgan Chase launches a new product or service, introduces a new platform for the delivery or distribution of products or services (including mobile connectivity, electronic trading and cloud computing), acquires or invests in a business, makes changes to an existing product, service

		23

, JPMORGAN CHASE & CO 10-K form for the fiscal year ended 2023-12-31, page 24:
Part I

or delivery platform, or adopts a new technology, it may not fully appreciate or identify new operational risks that may arise from those changes, including increased reliance on third party providers, or may fail to implement adequate controls to mitigate the risks associated with those changes. Any significant failure in this regard could diminish JPMorgan Chase's ability to operate one or more of its businesses or result in:
•potential liability to clients, counterparties and customers
•higher compliance and operational cost
•higher litigation costs, including regulatory fines, penalties and other sanctions
•damage to JPMorgan Chase's reputation
•impairment of JPMorgan Chase's liquidity

•regulatory intervention, or

•weaker competitive standing.
Any of the foregoing consequences could materially and adversely affect JPMorgan Chase's businesses and results of operations.
JPMorgan Chase's business and operations rely on its ability, and the ability of key external parties, to maintain appropriately-staffed workforces, and on the competence, trustworthiness, health and safety of employees.
JPMorgan Chase's ability to operate its businesses efficiently and profitably, to offer products and services that meet the expectations of its clients and customers, and to maintain an effective risk management framework is highly dependent on its ability to staff its operations appropriately and on the competence, trustworthiness, health and safety of its employees. JPMorgan Chase's businesses and operations similarly rely on the workforces of third parties, including employees of vendors, custodians and financial markets infrastructures, and of businesses that it may seek to acquire. JPMorgan Chase's businesses could be materially and adversely affected by:
•the ineffective implementation of business decisions
•any failure to institute controls that appropriately address risks associated with business activities, or to appropriately train employees with respect to those risks and controls
•staffing shortages, particularly in tight labor markets
•the possibility that significant portions of JPMorgan Chase's workforce are unable to work effectively, including because of illness, quarantines, shelter-in-place arrangements, government actions or other restrictions in connection with health emergencies, the spread of infectious diseases, epidemics or pandemics, or due to extraordinary events beyond JPMorgan Chase's control such as natural disasters or an outbreak or escalation of hostilities

•a significant operational breakdown or failure, theft, fraud or other unlawful conduct, or
•other negative outcomes caused by human error or misconduct by an employee of JPMorgan Chase or of another party on which JPMorgan Chase's businesses or operations rely.
JPMorgan Chase's operations could also be impaired if the measures taken by it or by governmental authorities to protect the health and safety of its employees are ineffective, or if any external party on which JPMorgan Chase relies fails to take appropriate and effective actions to protect the health and safety of its employees.
JPMorgan Chase faces substantial legal and operational risks in the processing and safeguarding of personal information.
JPMorgan Chase's businesses and operations are subject to complex and evolving laws, rules and regulations, both within and outside the U.S., governing the privacy and protection of personal information of individuals. Governmental authorities around the world have adopted and are considering the adoption of numerous legislative and regulatory initiatives concerning privacy, data protection and security. Litigation or enforcement actions relating to these laws, rules and regulations could result in
fines or orders requiring that JPMorgan Chase change its data-related practices, which could have an adverse effect on JPMorgan Chase's ability to provide products and otherwise harm its business operations.
Implementing processes relating to JPMorgan Chase's collection, use, sharing and storage of personal information to comply with all applicable laws, rules and regulations in all relevant jurisdictions, including where the laws of different jurisdictions are in conflict, can:
•increase JPMorgan Chase's compliance and operating costs
•hinder the development of new products or services, curtail the offering of existing products or services, or affect how products and services are offered to clients and customers
•demand significant oversight by JPMorgan Chase's management, and
•require JPMorgan Chase to structure its businesses, operations and systems in less efficient ways.
Not all of JPMorgan Chase's clients, customers, vendors, counterparties and other external parties may have appropriate controls in place to protect the confidentiality, integrity or availability of the information exchanged between them and JPMorgan Chase, particularly where information is transmitted by electronic means. JPMorgan Chase could be exposed to litigation or regulatory fines, penalties or other sanctions if personal information of clients, customers, employees or others were to be mishandled or misused, such as situations where such information is:

24

Item 1A. Risk Factors.

The following discussion sets forth the material risk factors that could affect JPMorgan Chase's financial condition and operations. Readers should not consider any descriptions of these factors to be a complete set of all potential risks that could affect the Firm. Any of the risk factors discussed below could by itself, or combined with other factors, materially and adversely affect JPMorgan Chase's business, results of operations, financial condition, capital position, liquidity, competitive position or reputation, including by materially increasing expenses or decreasing revenues, which could result in material losses or a decrease in earnings.

Summary

The principal risk factors that could adversely affect JPMorgan Chase's business, results of operations, financial condition, capital position, liquidity, competitive position or reputation include:
•Regulatory risks, including the impact that applicable laws, rules and regulations in the highly-regulated and supervised financial services industry, as well as changes to or in the application, interpretation or enforcement of those laws, rules and regulations, can have on JPMorgan Chase's business and operations, including JPMorgan Chase incurring additional costs associated with assessments, levies or other governmental charges; the ways in which differences in financial services regulation and supervision in different jurisdictions or with respect to certain competitors can negatively impact JPMorgan Chase's business; the penalties and collateral consequences, and higher compliance and operational costs, that JPMorgan Chase may incur when resolving a regulatory investigation; the ways in which less predictable legal and regulatory frameworks in certain jurisdictions can negatively impact JPMorgan Chase's operations and financial results; and the losses that security holders will absorb if JPMorgan Chase were to enter into a resolution.
•Political risks, including the potential negative effects on JPMorgan Chase's businesses due to economic uncertainty or instability caused by political developments.
•Market risks, including the effects that economic and market events and conditions, governmental policies, changes in interest rates and credit spreads, and market fluctuations can have on JPMorgan Chase's consumer and wholesale businesses and its investment and market-making positions and on JPMorgan Chase's earnings and its liquidity and capital levels.
•Credit risks, including potential negative effects from adverse changes in the financial condition of clients, customers, counterparties, custodians and central counterparties; the potential for losses due to declines in the value of collateral in stressed market conditions; and potential negative impacts from concentrations of credit risk with respect to clients, customers, counterparties and other market participants.

•Liquidity risks, including the risk that JPMorgan Chase's liquidity could be impaired by market-wide illiquidity or disruption, unforeseen liquidity or capital requirements, the inability to sell assets, default by a significant market participant, unanticipated outflows of cash or collateral, or lack of market or customer confidence in JPMorgan Chase; the dependence of JPMorgan Chase & Co. on the cash flows of its subsidiaries; and the potential adverse effects that any downgrade in any of JPMorgan Chase's credit ratings may have on its liquidity and cost of funding.
•Capital risks, including the risk that any failure by or inability of JPMorgan Chase to maintain the required level and composition of capital, or unfavorable changes in applicable capital requirements, could limit JPMorgan Chase's ability to distribute capital to shareholders or to support its business activities.
•Operational risks, including risks associated with JPMorgan Chase's dependence on its operational systems, its ability to maintain appropriately-staffed workforces and the competence, integrity, health and safety of its employees, as well as the systems and employees of third parties, market participants and service providers; the potential negative effects of failing to identify and address operational risks related to the failure of internal or external operational systems, the introduction of or changes to products, services and delivery platforms or the adoption of new technologies; legal and regulatory risks related to safeguarding personal information; the harm that could be caused by a successful cyber attack affecting JPMorgan Chase or by other extraordinary events; risks related to acquisitions, including the acquisition of certain assets and liabilities of First Republic Bank; risks associated with JPMorgan Chase's risk management framework and control environment, its models and estimations and associated judgments used in its stress testing and financial statements, and controls over disclosure and financial reporting; and potential adverse effects of failing to comply with heightened regulatory and other standards for the oversight of vendors and other service providers.
•Strategic risks, including the damage to JPMorgan Chase's competitive standing and results that could occur if management fails to develop and execute effective business strategies; risks associated with the significant and increasing competition that JPMorgan Chase faces; and the potential adverse impacts of climate change on JPMorgan Chase's business operations, clients and customers.
•Conduct risks, including the negative impact that can result from the actions or misconduct of employees, including any failure of employees to conduct themselves in accordance with JPMorgan Chase's expectations, policies and practices.
•Reputation risks, including the potential adverse effects on JPMorgan Chase's relationships with its clients,

		9

,
Part I

A reduction in JPMorgan Chase's credit ratings could curtail JPMorgan Chase's business activities and reduce its profitability in a number of ways, including:
•reducing its access to capital markets
•materially increasing its cost of issuing and servicing securities
•triggering additional collateral or funding requirements, and
•decreasing the number of investors and counterparties that are willing or permitted to do business with or lend to JPMorgan Chase.
Any rating reduction could also increase the credit spreads charged by the market for taking credit risk on JPMorgan Chase & Co. and its subsidiaries. This could, in turn, adversely affect the value of debt and other obligations of JPMorgan Chase & Co. and its subsidiaries.

Capital

Maintaining the required level and composition of capital may impact JPMorgan Chase's ability to support business activities, meet evolving regulatory requirements and distribute capital to shareholders.
JPMorgan Chase is subject to various regulatory capital requirements, including leverage- and risk-based capital requirements. In addition, as a Global Systemically Important Bank ("GSIB"), JPMorgan Chase is required to hold additional capital buffers, including a GSIB surcharge, a Stress Capital Buffer ("SCB"), and a countercyclical buffer, each of which is reassessed at least annually. The amount of capital that JPMorgan Chase is required to hold in order to satisfy these leverage- and risk-based requirements could increase at any given time due to factors such as:
•actions by banking regulators, including changes in laws, rules, and regulations
•changes in the composition of JPMorgan Chase's balance sheet or developments that could increase RWA, such as increased market risk, customer delinquencies, client credit rating downgrades or other factors, and
•increases in estimated stress losses as determined by the Federal Reserve under the Comprehensive Capital Analysis and Review, which could increase JPMorgan Chase's SCB.
Any failure by or inability of JPMorgan Chase to maintain the required level and composition of capital, or unfavorable changes in applicable capital requirements, could have an adverse impact on JPMorgan Chase's shareholders, such as:
•reducing the amount of common stock that JPMorgan Chase is permitted to repurchase
•requiring the issuance of, or prohibiting the redemption of, capital instruments in a manner inconsistent with JPMorgan Chase's capital management strategy

•constraining the amount of dividends that may be paid on common stock, or
•curtailing JPMorgan Chase's business activities or operations.
Banking regulators have released a proposal to amend the Basel III risk-based capital framework which could significantly revise the risk-based capital requirements for banks with assets of $100 billion or more, including JPMorgan Chase. Uncertainty remains as to the manner in which these requirements will ultimately apply to JPMorgan Chase, however it is possible that these requirements could impact JPMorgan Chase's decisions concerning the business activities in which it will engage and its levels of capital distributions to its shareholders.

Operational

JPMorgan Chase's businesses are dependent on the effectiveness of internal and external operational systems.
JPMorgan Chase's businesses rely on the ability of JPMorgan Chase's financial, accounting, transaction execution, data processing and other operational systems to process, record, monitor and report a large number of transactions on a continuous basis, and to do so accurately, quickly and securely. In addition to proper design, installation, maintenance and training, the effective functioning of JPMorgan Chase's operational systems depends on:
•the quality of the information contained in those systems, as inaccurate, outdated, incomplete or corrupted data can significantly compromise the functionality or reliability of a particular system and other systems to which it transmits or from which it receives information, and
•JPMorgan Chase's ability to continue to maintain and upgrade its systems on a regular basis in line with technological advancements and evolving security requirements, carefully manage any changes introduced to its systems to maintain security and operational continuity, and adhere to all applicable legal and regulatory requirements, particularly in regions where JPMorgan Chase may face a heightened risk of malicious activity.
JPMorgan Chase has experienced and expects that it will continue to experience failures and disruptions in the stability of its operational systems, including degraded performance of data processing systems, data quality issues, disruptions of network connectivity and malfunctioning software, as well as disruptions in its ability to access and use the operational systems of third parties. These incidents have resulted in various negative effects for customers, including the inability to access account information or to make transactions through ATM, internet or mobile channels, the exfiltration of customer personal data, the recording of duplicative transactions and extended delays for customers requiring services from call

20

, centers. There can be no assurance that these and other types of operational failures or disruptions will not occur in the future.
JPMorgan Chase's ability to effectively manage the stability of its operational systems and infrastructure could be hindered by many factors, any of which could have a negative impact on JPMorgan Chase and its clients, customers and counterparties, including:
•JPMorgan Chase's ability to effectively maintain and upgrade systems and infrastructure can become more challenging as the speed, frequency, volume, interconnectivity and complexity of transactions continue to increase
•attempts by third parties to defraud JPMorgan Chase or its clients and customers are increasing, evolving and becoming more complex, and during periods of market disruption or economic uncertainty, these attempts can be expected to increase in volume
•errors made by JPMorgan Chase or another market participant, whether inadvertent or malicious, could cause widespread system disruption
•failure to detect weaknesses or shortcomings in operational systems in a timely manner
•isolated or seemingly insignificant errors in operational systems could compound, or migrate to other systems over time, to become larger issues
•disruptions in operational systems or in the ability of systems to communicate with each other could be caused by failures in synchronization or encryption software, or degraded performance of microprocessors, and
•attempts by third parties to block the use of key technology solutions by claiming that the use infringes on their intellectual property rights.
JPMorgan Chase also depends on its ability to access and use the operational systems of third parties, including its custodians, vendors (such as those that provide data and cloud computing services, and security and technology services) and other market participants (such as clearing and payment systems, CCPs and securities exchanges), and external operational systems with which JPMorgan is connected, whether directly or indirectly, can be sources of operational risk to JPMorgan Chase. JPMorgan Chase may be exposed not only to a systems failure or cyber attack that may be experienced by a vendor or market infrastructure with which JPMorgan Chase is directly connected, but also to a systems breakdown or cyber attack involving another party to which such a vendor or infrastructure is connected. Similarly, retailers, payment systems and processors, data aggregators and other external parties with which JPMorgan Chase's customers do business can increase JPMorgan Chase's operational risk. This is particularly the case where activities of customers or other parties are beyond JPMorgan Chase's security and control systems, including through the use of the internet,

cloud computing services, and personal smart phones and other mobile devices or services.
If an external party obtains access to customer account data on JPMorgan Chase's systems, whether authorized or unauthorized, and that party misappropriates that data, this could result in negative outcomes for JPMorgan Chase and its clients and customers, including a heightened risk of fraudulent transactions using JPMorgan Chase's systems, losses from fraudulent transactions and reputational harm arising from the perception that JPMorgan Chase's systems may not be secure.
As JPMorgan Chase's interconnectivity with clients, customers and other external parties continues to expand, JPMorgan Chase increasingly faces the risk of operational failure or cyber attacks with respect to the systems of those parties. Security breaches affecting JPMorgan Chase's clients or customers, or systems breakdowns or failures, security breaches or human error or misconduct affecting other external parties, may require JPMorgan Chase to take steps to protect the integrity of its own operational systems or to safeguard confidential information, including restricting the access of customers to their accounts. These actions can increase JPMorgan Chase's operational costs and potentially diminish customer satisfaction and confidence in JPMorgan Chase.
Furthermore, the widespread and expanding interconnectivity among financial institutions, clearing banks, CCPs, payments processors, financial technology companies, securities exchanges, clearing houses and other financial market infrastructures increases the risk that the disruption of an operational system involving one institution or entity, including due to a cyber attack, may cause industry-wide operational disruptions that could materially affect JPMorgan Chase's ability to conduct business. In addition, the risks associated with the disruption of an operational system of a third party could be exacerbated to the extent that the services provided by that system are used by a significant number or proportion of market participants.
The ineffectiveness, failure or other disruption of operational systems upon which JPMorgan Chase depends, including due to a systems malfunction, cyber incident or other systems failure, could result in unfavorable ripple effects in the financial markets and for JPMorgan Chase and its clients and customers, including:
•delays or other disruptions in providing services, including the provision of liquidity or information to clients and customers
•impairment of JPMorgan Chase's ability to execute transactions, including delays or failures in the confirmation or settlement of transactions or in obtaining access to funds or other assets required for settlement
•the possibility that funds transfers, capital markets trades or other transactions are executed erroneously

		21

,
Part I

•financial losses, including due to loss-sharing requirements of CCPs, payment systems or other market infrastructures, or as possible restitution to clients and customers
•higher operational costs associated with replacing services provided by a system that has experienced a failure or other disruption
•limitations on JPMorgan Chase's ability to collect data needed for its business and operations
•loss of confidence in the ability of JPMorgan Chase, or financial institutions generally, to protect against and withstand operational disruptions
•dissatisfaction among JPMorgan Chase's clients or customers
•significant exposure to litigation and regulatory fines, penalties or other sanctions, and
•harm to JPMorgan Chase's reputation.
If JPMorgan Chase's operational systems, or those of acquired businesses or of external parties on which JPMorgan Chase's businesses depend, are unable to meet the requirements of JPMorgan Chase's businesses and operations or bank regulatory standards, or if they fail or have other significant shortcomings, JPMorgan Chase could be materially and adversely affected.
A successful cyber attack affecting JPMorgan Chase could cause significant harm to JPMorgan Chase and its clients and customers.
JPMorgan Chase experiences numerous cyber attacks on its computer systems, software, networks and other technology assets on a daily basis from various actors, including groups acting on behalf of hostile countries, cyber-criminals, "hacktivists" (i.e., individuals or groups that use technology to promote a political agenda or social change) and others. These cyber attacks can take many forms, including attempts to introduce computer viruses or malicious code, which are commonly referred to as "malware," into JPMorgan Chase's systems. These attacks are often designed to:
•obtain unauthorized access to confidential information belonging to JPMorgan Chase or its clients, customers, counterparties or employees
•manipulate data
•destroy data or systems with the aim of rendering services unavailable
•disrupt, sabotage or degrade service on JPMorgan Chase's systems

•steal money, or

•extort money through the use of so-called "ransomware."
JPMorgan Chase also experiences:

•distributed denial-of-service attacks intended to disrupt JPMorgan Chase's websites, including those that provide online banking and other services,
•a higher volume and complexity of cyber attacks against the backdrop of heightened geopolitical tensions, and
•a high volume of disruptions to internet-based services used by JPMorgan Chase that are provided by third parties.
JPMorgan Chase has experienced security breaches due to cyber attacks in the past, and it is inevitable that additional breaches will occur in the future. Any such breach could result in serious and harmful consequences for JPMorgan Chase or its clients and customers.
A principal reason that JPMorgan Chase cannot provide absolute security against cyber attacks is that it may not always be possible to anticipate, detect or recognize threats to JPMorgan Chase's systems, or to implement effective preventive measures against all breaches because:
•the techniques used in cyber attacks evolve frequently and are increasingly sophisticated, and therefore may not be recognized until launched or may go undetected for extended periods
•cyber attacks can originate from a wide variety of sources, including JPMorgan Chase's own employees, cyber-criminals, hacktivists, well-resourced groups linked to terrorist organizations or hostile nation-states that can sustain malicious activities for extended periods, or third parties whose objective is to disrupt the operations of financial institutions more generally
•JPMorgan Chase does not have control over the cybersecurity of the systems of the large number of clients, customers, counterparties and third-party service providers with which it does business, and
•it is possible that a third party, after establishing a foothold on an internal network without being detected, may gain access to other networks and systems.
The risk of a security breach due to a cyber attack could increase in the future due to factors such as:
•JPMorgan Chase's ongoing expansion of its mobile banking and other internet-based product offerings and its internal use of internet-based products and applications, including those that use cloud computing services
•advances in artificial intelligence, such as the use of machine learning and generative artificial intelligence by malicious actors to develop more advanced social engineering attacks, including targeted phishing attacks
•the inability to maintain the security of information transmitted by JPMorgan Chase due to advances in quantum computing that may counteract or nullify existing information protections, and
•the acquisition and integration of new businesses.

22

, In addition, a third party could misappropriate confidential information obtained by intercepting signals or communications from mobile devices used by JPMorgan Chase's employees.
The dynamic nature of the cyber threat landscape necessitates continuous enhancement and adaptation of cybersecurity controls. Failure to discover or address known vulnerabilities or shortcomings in cybersecurity controls, or to prioritize or complete enhancements to address them, in each case in a timely manner, may leave JPMorgan Chase vulnerable to cyber attacks, potentially resulting in data breaches, financial losses, reputational damage and regulatory penalties, including the failure to prioritize or complete enhancements relating to:
•preventing unauthorized access and protecting against the misuse of access, including the maintenance and enhancement of controls related to secure software development practices and identity and access management, such as those relating to the management of administrative access to systems
•detecting, escalating and addressing effectively and in a timely manner any vulnerabilities that may be present either in internally-developed software or externally-provided software or services, including vulnerabilities that could allow attackers to exploit unknown security flaws in software and hardware ("zero-day vulnerabilities")
•enhancing early detection of attacks against third-party vendors, including attacks targeting vulnerabilities in third-party open-source software, in support of the secure development and maintenance of internal systems
•maintaining and enhancing controls related to technology asset management and inventory systems to prevent the risk of undetected vulnerabilities that could undermine JPMorgan Chase's ability to operate an effective control process
•upgrading the coverage and capabilities of systems and controls to protect JPMorgan Chase and its clients and customers from the impact of distributed denial-of-service attacks, or to recover from outages that could be caused by a malware or ransomware attack
•strengthening network security and management of outbound connections to reduce the risk of data loss
•identifying, assessing and mitigating insider threat activities that could lead to the misuse of JPMorgan Chase's systems or client and customer information, and
•integrating acquired businesses where system integration may be complex or may require extensive and lengthy remediation or enhancement of controls.
A successful penetration or circumvention of the security of JPMorgan Chase's systems or the systems of a vendor, governmental body or another market participant could cause serious negative consequences, including:

•significant disruption of JPMorgan Chase's operations and those of its clients, customers and counterparties, including losing access to operational systems
•misappropriation of confidential information of JPMorgan Chase or that of its clients, customers, counterparties, employees or regulators
•disruption of or damage to JPMorgan Chase's systems and those of its clients, customers and counterparties
•the inability, or extended delays in the ability, to fully recover and restore data that has been stolen, manipulated or destroyed, or the inability to prevent systems from processing fraudulent transactions
•demands that JPMorgan Chase pay a ransom to a malicious actor that has perpetrated a cybersecurity breach
•unintended violations by JPMorgan Chase of applicable privacy and other laws
•financial loss to JPMorgan Chase or to its clients, customers, counterparties or employees
•loss of confidence in JPMorgan Chase's cybersecurity and business resiliency measures
•dissatisfaction among JPMorgan Chase's clients, customers or counterparties
•significant exposure to litigation and regulatory fines, penalties or other sanctions, and
•harm to JPMorgan Chase's reputation.
The extent of a particular cyber attack, the methods and tools used by various actors, and the steps that JPMorgan Chase may need to take to investigate the attack may not be immediately clear, and it may take a significant amount of time before such an investigation can be completed. While such an investigation is ongoing, JPMorgan Chase may not necessarily know the full extent of the harm caused by the cyber attack, and that damage may continue to spread. These factors may inhibit JPMorgan Chase's ability to provide rapid, full and reliable information about the cyber attack to its clients, customers, counterparties and regulators, as well as the public. Furthermore, it may not be clear how best to contain and remediate the harm caused by the cyber attack, and certain errors or actions could be repeated or compounded before they are discovered and remediated. Any or all of these factors could further increase the costs and consequences of a cyber attack.
JPMorgan Chase can be negatively affected if it fails to identify and address operational risks associated with the introduction of or changes to products, services and delivery platforms or the adoption of new technologies.
When JPMorgan Chase launches a new product or service, introduces a new platform for the delivery or distribution of products or services (including mobile connectivity, electronic trading and cloud computing), acquires or invests in a business, makes changes to an existing product, service

		23

,
Part I

or delivery platform, or adopts a new technology, it may not fully appreciate or identify new operational risks that may arise from those changes, including increased reliance on third party providers, or may fail to implement adequate controls to mitigate the risks associated with those changes. Any significant failure in this regard could diminish JPMorgan Chase's ability to operate one or more of its businesses or result in:
•potential liability to clients, counterparties and customers
•higher compliance and operational cost
•higher litigation costs, including regulatory fines, penalties and other sanctions
•damage to JPMorgan Chase's reputation
•impairment of JPMorgan Chase's liquidity

•regulatory intervention, or

•weaker competitive standing.
Any of the foregoing consequences could materially and adversely affect JPMorgan Chase's businesses and results of operations.
JPMorgan Chase's business and operations rely on its ability, and the ability of key external parties, to maintain appropriately-staffed workforces, and on the competence, trustworthiness, health and safety of employees.
JPMorgan Chase's ability to operate its businesses efficiently and profitably, to offer products and services that meet the expectations of its clients and customers, and to maintain an effective risk management framework is highly dependent on its ability to staff its operations appropriately and on the competence, trustworthiness, health and safety of its employees. JPMorgan Chase's businesses and operations similarly rely on the workforces of third parties, including employees of vendors, custodians and financial markets infrastructures, and of businesses that it may seek to acquire. JPMorgan Chase's businesses could be materially and adversely affected by:
•the ineffective implementation of business decisions
•any failure to institute controls that appropriately address risks associated with business activities, or to appropriately train employees with respect to those risks and controls
•staffing shortages, particularly in tight labor markets
•the possibility that significant portions of JPMorgan Chase's workforce are unable to work effectively, including because of illness, quarantines, shelter-in-place arrangements, government actions or other restrictions in connection with health emergencies, the spread of infectious diseases, epidemics or pandemics, or due to extraordinary events beyond JPMorgan Chase's control such as natural disasters or an outbreak or escalation of hostilities

•a significant operational breakdown or failure, theft, fraud or other unlawful conduct, or
•other negative outcomes caused by human error or misconduct by an employee of JPMorgan Chase or of another party on which JPMorgan Chase's businesses or operations rely.
JPMorgan Chase's operations could also be impaired if the measures taken by it or by governmental authorities to protect the health and safety of its employees are ineffective, or if any external party on which JPMorgan Chase relies fails to take appropriate and effective actions to protect the health and safety of its employees.
JPMorgan Chase faces substantial legal and operational risks in the processing and safeguarding of personal information.
JPMorgan Chase's businesses and operations are subject to complex and evolving laws, rules and regulations, both within and outside the U.S., governing the privacy and protection of personal information of individuals. Governmental authorities around the world have adopted and are considering the adoption of numerous legislative and regulatory initiatives concerning privacy, data protection and security. Litigation or enforcement actions relating to these laws, rules and regulations could result in
fines or orders requiring that JPMorgan Chase change its data-related practices, which could have an adverse effect on JPMorgan Chase's ability to provide products and otherwise harm its business operations.
Implementing processes relating to JPMorgan Chase's collection, use, sharing and storage of personal information to comply with all applicable laws, rules and regulations in all relevant jurisdictions, including where the laws of different jurisdictions are in conflict, can:
•increase JPMorgan Chase's compliance and operating costs
•hinder the development of new products or services, curtail the offering of existing products or services, or affect how products and services are offered to clients and customers
•demand significant oversight by JPMorgan Chase's management, and
•require JPMorgan Chase to structure its businesses, operations and systems in less efficient ways.
Not all of JPMorgan Chase's clients, customers, vendors, counterparties and other external parties may have appropriate controls in place to protect the confidentiality, integrity or availability of the information exchanged between them and JPMorgan Chase, particularly where information is transmitted by electronic means. JPMorgan Chase could be exposed to litigation or regulatory fines, penalties or other sanctions if personal information of clients, customers, employees or others were to be mishandled or misused, such as situations where such information is:

24