things, the loss of a license as an approved Agency lender, the inability to gain additional approvals or licenses, the termination of contractual rights without compensation, demands for indemnification or loan repurchases, class action lawsuits and administrative enforcement actions.
As a registered broker-dealer, one of our subsidiaries is subject to extensive regulation that exposes us to a variety of risks associated with the securities industry.
Broker-dealer and other financial services firms are subject to extensive regulatory requirements under federal and state laws and regulations and self-regulatory organization (“SRO”) rules. One of our subsidiary entities, Zelman Partners, LLC (“Zelman Partners”) is registered with the SEC as a broker-dealer under the Exchange Act and in the states in which Zelman Partners conducts securities business and is a member of FINRA and other SROs. Zelman Partners is subject to regulation, examination and disciplinary action by the SEC, FINRA and state securities regulators, as well as other governmental authorities and SROs with which Zelman Partners is registered or licensed or of which Zelman Partners is a member.
The regulations applicable to broker-dealers depend in part on the nature of the business conducted by the broker-dealer, and generally cover all aspects of the securities business, including, among other things, sales practices, fee arrangements, disclosures to clients, capital adequacy, use and safekeeping of clients’ funds and securities, recordkeeping and reporting and the qualification and conduct of officers, employees and independent contractors. As part of this regulatory scheme, broker-dealers are subject to regular and special examinations by the SEC and FINRA intended to determine their compliance with securities laws, regulations and rules. Following an examination’s conclusion, a broker-dealer may receive a deficiency letter identifying potential compliance or supervisory weaknesses or rule violations which the firm must address. Any such proceeding against Zelman Partners, or any of its associated persons, could harm our reputation, cause us to lose clients or fail to gain new clients and have a material adverse effect on our business.
Our ability to comply with applicable laws, rules and regulations will be largely dependent on our establishment and maintenance of compliance, supervision, recordkeeping and reporting and audit systems and procedures, as well as our ability to attract and retain qualified compliance, audit and risk management personnel. While we have adopted policies and procedures we believe are reasonably designed to comply with applicable laws, rules and regulations, these systems and procedures may not be fully effective, and there can be no assurance that regulators or third parties will not raise material issues with respect to our past or future compliance with applicable regulations.
If we fail to comply with laws, regulations and market standards regarding the privacy, use, and security of customer information, or if we are the target of a successful cyber-attack, we may be subject to legal and regulatory actions and our reputation would be harmed.
We receive, maintain, and store non-public personal information of our customers. The technology and other controls and processes designed to secure our customer information and to prevent, detect, and remedy any unauthorized access to that information were designed to obtain reasonable, not absolute, assurance that such information is secure and that any unauthorized access is identified and addressed appropriately. We, and our service providers, are regularly subject to and expect to continue to experience cyberattacks that are increasingly sophisticated (including using artificial intelligence), that are often designed to evade detection, and/or that seek to damage or disrupt our network, as well as those of our service providers, and other information systems. Certain of these cyberattacks, including phishing attacks, have resulted in unauthorized access by third parties to information that we receive, maintain and store in the course of our business. Although these cyberattacks have not resulted in material financial impacts or disruptions to our business, given the accelerating scope, sophistication, and frequency of cyberattacks, there can be no assurance that the cybersecurity incidents we have experienced or any future incident will not materially impact our security, operations and financial results. Future cyberattacks, or the perception thereof, could result in a loss of data, operational disruptions, and even lost business and goodwill. Additionally, we could incur significant costs associated with the recovery from a cyber-attack, and these costs may exceed, or the events to which they relate, may be excluded from, coverage under, our cyber insurance.
If customer information is inappropriately accessed and used by a third party or an employee for illegal purposes, such as identity theft, we may be responsible for any losses the affected applicant or borrower may have incurred as a result of misappropriation. In such an instance, we may be liable to a governmental authority for fines or penalties associated with a lapse in the integrity and security of our customers' information. Additionally, if we are the target of a successful cyberattack, we may experience reputational harm that could impact our standing with our borrowers and adversely impact our financial results.
We regularly update our existing information technology systems and install new technologies when deemed necessary and regularly provide employee awareness training around phishing, malware, and other cyber risks and physical security to address the risk of cyber-attacks and other security breaches. However, such preventative measures may not be sufficient to prevent future cyberattacks or a breach of customer information. Additionally, most of our employees work remotely or in a hybrid arrangement and will continue to do so for the foreseeable future. Remote and hybrid working arrangements at our Company (and at many third-party providers) increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. While we have designed our controls and processes to operate in a remote working environment, there is a heightened risk such