With the evolving proliferation of new technologies and the increasing use of the Internet, mobile devices and cloud technologies to conduct financial transactions, including credit card transactions, large global financial institutions such as Citibank have been, and will continue to be, subject to an increasing risk of operational disruption or cyber or information security incidents from these activities (for additional information on cybersecurity risk, see the discussion below). These incidents are unpredictable and can arise from numerous sources, not all of which are in Citibank’s control, including, among others, human error, fraud or malice on the part of employees, accidental technological failure, electrical or telecommunication outages, failures of computer servers or other similar damage to Citibank’s property or assets. These issues can also arise as a result of failures by third parties with which Citibank does business, such as failures by Internet, mobile technology and cloud service providers or other vendors to adequately safeguard their systems and prevent system disruptions or cyber attacks.
Such events could cause interruptions or malfunctions in the operations of Citibank, including its credit card business (such as the temporary loss of availability of Citibank’s online banking system or mobile banking platform), as well as the operations of its clients, customers, partners or other third parties. Given Citibank’s global footprint and the high volume of transactions processed by Citibank, certain errors or actions may be repeated or compounded before they are discovered and rectified, which would further increase these costs and consequences. Any such events could also result in financial losses as well as misappropriation, corruption or loss of confidential and other information or assets, which could negatively impact Citibank’s reputation, customers, clients, partners, businesses or results of operations and financial condition, as well as the issuance trust and master trust, perhaps significantly.
Citibank’s and third parties’ computer systems and networks have been, and will continue to be, subject to an increasing risk of continually evolving, sophisticated cybersecurity risks that could result in the theft, loss, misuse or disclosure of confidential client or customer information, damage to Citibank’s reputation, additional costs to Citibank, regulatory penalties, legal exposure and financial losses
Citibank’s computer systems, software and networks are subject to ongoing cyber incidents such as unauthorized access, loss or destruction of data (including confidential client information), account takeovers, unavailability of service, computer viruses or other malicious code, cyber attacks and other similar events. These threats can arise from external parties, including criminal organizations, extremist parties and certain foreign state actors that engage in cyber activities.
Third parties with which Citibank does business, as well as retailers and other third parties with which Citibank’s customers do business, may also be sources of cybersecurity risks, particularly where activities of customers are beyond Citibank’s security and control systems. For example, Citibank outsources certain functions, such as processing customer credit card transactions, uploading content on customer-facing websites, and developing software for new products and services. These relationships allow for the storage and
-53-