Risk Factors Dashboard

Once a year, publicly traded companies issue a comprehensive report of their business, called a 10-K. A component mandated in the 10-K is the ‘Risk Factors’ section, where companies disclose any major potential risks that they may face. This dashboard highlights all major changes and additions in new 10K reports, allowing investors to quickly identify new potential risks and opportunities.

Risk Factors - RJF

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

ITEM 1A. RISK FACTORS

Our operations and financial results are subject to various risks and uncertainties, including those described in the following sections, which could adversely affect our business, financial condition, results of operations, liquidity and the trading price of our common and preferred stock. The list of risk factors provided in the following sections is not exhaustive; there may be other factors that adversely impact our results of operations, harm our reputation or inhibit our ability to generate new business prospects. The following sections should be read in conjunction with “Item 1C - Cybersecurity,” “Item 7 - Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and accompanying notes in “Item 8 - Financial Statements and Supplementary Data” of this Annual Report on Form 10-K. The following sections should be read in conjunction with “Item 7 - Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and accompanying notes in “Item 8 - Financial Statements and Supplementary Data” of this Annual Report on Form 10-K. In particular, see “Item 1C - Cybersecurity” for additional information on how we assess, identify, and manage cybersecurity risks, “Item 7 - Management’s Discussion and Analysis of Financial Condition and Results of Operations - Liquidity and capital resources” for additional information on liquidity and how we manage our liquidity risk and “Item 7 - Management’s Discussion and Analysis of Financial Condition and Results of Operations - Risk management” for additional information on our exposure and how we monitor and manage our market, credit, liquidity, operational, model, and compliance, and certain other risks.

RISKS RELATED TO OUR BUSINESS AND INDUSTRY

Damage to our reputation could damage our businesses.

Maintaining our reputation is critical to attracting and maintaining clients, investors, and associates. If we fail to address, or appear to fail to address, issues that may give rise to reputational risk, we could significantly harm our business prospects. These issues may include, but are not limited to, any of the risks discussed in this Item 1A, including appropriately dealing with potential conflicts of interest, legal and regulatory requirements, fraud perpetrated against our clients, ethical issues, money laundering, cybersecurity and privacy, record-keeping, sales and trading practices, and associate misconduct. These issues may include, but are not limited to, any of the risks discussed in this Item 1A, including appropriately dealing with potential conflicts of interest, legal and regulatory requirements, ethical issues, money laundering, cybersecurity and privacy, record-keeping, sales and trading practices, and associate misconduct. In addition, the failure to either sell securities we have underwritten at anticipated price levels or to properly identify and communicate the risks inherent in the products and services we offer could also give rise to reputational risk. A failure or perceived failure to maintain appropriate service and quality standards or to treat clients fairly can result in client dissatisfaction, litigation, and heightened regulatory scrutiny, all of which can lead to lost revenue, higher operating costs, and reputational harm. Negative publicity about us, including information posted on social media or other internet forums or published by news organizations, whether or not true, may also harm our reputation. The speed and pervasiveness with which information can be disseminated through these channels, in particular social media, may magnify risk relating to negative publicity. Further, failures at other large financial institutions or other market participants, regardless of whether they relate to our activities, could lead to a general loss

20

RAYMOND JAMES FINANCIAL, INC. AND SUBSIDIARIES
of client confidence in financial institutions that could negatively affect us, including harming the market perception of the financial system in general.

Any cyber-attack or other security breach of our technology systems, or those of our clients or other third-party vendors we rely on, could subject us to significant liability and harm our reputation. AND SUSDIARIESIndexAny cyber-attack or other security breach of our technology systems, or those of our clients or other third-party vendors we rely on, could subject us to significant liability and harm our reputation.

Our operations rely heavily on the secure processing, storage, and transmission of sensitive and confidential financial, personal, and other information in our computer systems and networks. There have been numerous highly publicized cases involving financial services companies reporting the unauthorized disclosure of client or other confidential information in recent years, as well as cyber-attacks involving the theft, dissemination, and destruction of corporate information or other assets, in some cases as a result of failure to follow procedures by employees or contractors or as a result of actions by third parties. There have been several highly publicized cases involving financial services companies reporting the unauthorized disclosure of client or other confidential information in recent years, as well as cyber-attacks involving the theft, dissemination and destruction of corporate information or other assets, in some cases as a result of failure to follow procedures by employees or contractors or as a result of actions by third parties. There have also been numerous highly publicized cases where hackers have requested “ransom” payments in exchange for not disclosing customer information or for restoring access to information or systems. There have also been several highly publicized cases where hackers have requested “ransom” payments in exchange for not disclosing customer information or for restoring access to information or systems. Like other financial services firms, we experience malicious cyber activity directed at our computer systems, software, networks, and users on a daily basis. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware, and denial-of-service attacks. We also experience large volumes of phishing and other forms of social engineering attempted for the purpose of perpetrating fraud against the firm, our associates, or our clients. Additionally, we may face increased cybersecurity risk for a period of time after acquisitions as we transition the acquired entity’s historical systems and networks to our standards. We may also face increased cybersecurity risk for a period of time after acquisitions as we transition the acquired entity’s historical systems and networks to our standards. We also face increased cybersecurity risk related to mobile and cloud solutions or those related to new and emerging technologies such as AI. We also face increased cybersecurity risk as we deploy additional mobile and cloud technologies. We seek to continuously monitor for and nimbly react to any and all such malicious cyber activity, and we develop our systems to protect our technology infrastructure and data from misuse, misappropriation, or corruption.

Cyber-attacks can originate from a variety of sources, including threat actors affiliated with foreign governments, organized crime, or terrorist organizations. Threat actors may also attempt to place individuals within our firm, or induce employees, clients, or other users of our systems, to disclose sensitive information or provide access to our data, and these types of risks may be difficult to detect or prevent. Although cybersecurity incidents among financial services firms are on the rise, we have not experienced any material losses relating to cyber-attacks or other information security breaches. However, the techniques used in these attacks are increasingly sophisticated, change frequently, and are often not recognized until launched. Although we seek to maintain a robust suite of authentication and layered information security controls, including our cyber threat analytics, data encryption, anti-malware defenses, and vulnerability management programs, any one or combination of these controls could fail to detect, mitigate, or remediate these risks in a timely manner. Although we seek to maintain a robust suite of authentication and layered information security controls, including our cyber threat analytics, data encryption and tokenization technologies, anti-malware defenses and vulnerability management programs, any one or combination of these controls could fail to detect, mitigate or remediate these risks in a timely manner. Despite our implementation of protective measures and endeavoring to modify them as circumstances warrant, our computer systems, software, and networks may be vulnerable to human error, equipment failure, natural disasters, power loss, unauthorized access, supply chain attacks, distributed denial-of-service attacks, computer viruses and other malicious code, and other events that could result in significant liability and damage to our reputation, and have an ongoing impact on the security and stability of our operations. Despite our implementation of protective measures and endeavoring to modify them as circumstances warrant, our computer systems, software and networks may be vulnerable to human error, equipment failure, natural disasters, power loss, unauthorized access, supply chain attacks, distributed denial of service attacks, computer viruses and other malicious code, and other events that could result in significant liability and damage to our reputation, and have an ongoing impact on the security and stability of our operations. In addition, although we maintain insurance coverage that may, subject to terms and conditions, cover certain aspects of cyber and information security risks, such insurance coverage may be insufficient to cover all losses, such as litigation costs or financial losses that exceed our policy limits or are not covered under any of our current insurance policies.

We also rely on numerous third-party service providers to conduct other aspects of our business operations, and we face similar risks relating to them. While we regularly conduct security assessments on these third-party vendors, we cannot be certain that their information security protocols are sufficient to withstand a cyber-attack or other security breach. We also cannot be certain that we will receive timely notification of such cyber-attacks or other security breaches. In addition, in order to access our products and services, our clients, independent contractor financial advisors, and financial advisors associated with firms affiliated with us through our RCS division may use computers and other devices that are beyond our security control systems.

Notwithstanding the precautions we take, if a cyber-attack or other information security breach were to occur, this could jeopardize the information we confidentially maintain, or otherwise cause interruptions in our operations or those of our clients and counterparties, exposing us to liability. As attempted attacks continue to evolve in scope and sophistication, we may be required to expend substantial additional resources to modify or enhance our protective measures, to investigate and remediate vulnerabilities or other exposures or to communicate about cyber-attacks to our clients and/or regulators. A technological breakdown could also interfere with our ability to comply with financial reporting and other regulatory requirements, exposing us to potential disciplinary action by regulators. Further, successful cyber-attacks at other large financial institutions or other market participants, whether or not we are affected, could lead to a general loss of confidence in financial institutions that could negatively affect us, including harming the market perception of the effectiveness of our security measures or the financial system in general, which could result in reduced use of our financial products and services.

Further, in light of the high volume of transactions we process, the large number of our clients, partners, and counterparties, and the increasing sophistication of malicious actors, a cyber-attack could occur. Moreover, any such cyber-attack may persist for

21

RAYMOND JAMES FINANCIAL, INC. AND SUBSIDIARIES
an extended period of time without detection. We endeavor to design and implement policies and procedures to identify such cyber-attacks as quickly as possible; however, we expect that any investigation of a cyber-attack would take substantial amounts of time, and that there may be extensive delays before we obtain full and reliable information. During such time we would not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, all of which would further increase the costs and consequences of such an attack.

We may also be subject to liability under various data protection laws. In providing services to clients, we manage, utilize, and store sensitive or confidential client or employee data, including personal data. In providing services to clients, we manage, utilize and store sensitive or confidential client or employee data, including personal data. As a result, we are subject to numerous laws and regulations designed to protect this information, such as U.S. federal, state, and international laws governing the protection of personally identifiable information. These laws and regulations are increasing in complexity and number. If any person, including any of our associates, negligently disregards or intentionally breaches our established controls with respect to client or employee data, or otherwise mismanages or misappropriates such data, we could be subject to significant monetary damages, regulatory enforcement actions, fines, and/or criminal prosecution. In addition, unauthorized disclosure of sensitive or confidential client or employee data, whether through system failure, employee negligence, fraud, or misappropriation, could damage our reputation and cause us to lose clients and related revenue. Potential liability in the event of a security breach of client data could be significant. Depending on the circumstances giving rise to the breach, this liability may not be subject to a contractual limit or an exclusion of consequential or indirect damages. Further, lapses in cybersecurity controls, as perceived by our regulators, could lead to fines and penalties compounding monetary losses.

Lack of funding, liquidity, or access to capital could impair our business and financial condition.

An inability to maintain adequate funding and liquidity to operate our business could have a significant negative effect on our financial condition. We have a contingency funding plan which would guide our actions if one or more of our businesses were to experience disruptions from normal funding and liquidity sources. If the available funding from one or more of our contingent funding sources is not sufficient to sustain normal operating levels, we may be required to scale back or curtail our operations, such as by limiting lending, selling assets at unfavorable prices, cutting or eliminating dividend payments, or limiting our recruiting of financial advisors. Our liquidity could be negatively affected by: any inability of our subsidiaries to generate cash to distribute to the parent company, liquidity or capital requirements that may prevent our subsidiaries from distributing cash, limitations on our subsidiaries’ access to credit markets for secured and unsecured borrowings, diminished access to the capital markets for RJF, and other commitments or restrictions on capital as a result of adverse legal settlements, judgments, regulatory sanctions, or an adverse change in our credit rating by one or more of the national rating agencies. Furthermore, as a BHC, we may become subject to prohibitions or limitations on our ability to pay dividends to our shareholders and/or repurchase our stock. Furthermore, as a bank holding company, we may become subject to prohibitions or limitations on our ability to pay dividends to our shareholders and/or repurchase our stock. Certain of our regulators have the authority, and under certain circumstances, the duty, to prohibit or to limit dividend payments by regulated subsidiaries to their parent company.

The availability of financing, including access to the credit and capital markets, depends on various factors, such as conditions in the debt and equity markets, the general availability of credit, the volume of securities trading activity, the overall availability of credit to the financial services sector, and our credit ratings. Our cost of capital and the availability of funding may be adversely affected by illiquid credit markets, wider credit spreads, or our inability to pay a prevailing rate of interest that is competitive with other market offerings. Additionally, lenders may from time to time curtail, or even cease to provide, funding to borrowers as a result of future concerns over the strength of specific counterparties, as well as the stability of markets generally.

Significant volatility in our clients’ cash sweep and bank deposit balances and higher costs in sourcing such balances could negatively affect our net revenues, our Bank segment’s growth, and our regulatory capital ratios.

The RJBDP provides our Bank segment with relatively low-cost, stable deposits, and we rely heavily on the RJBDP to fund our Bank segment asset growth. Any significant reduction in PCG clients’ cash balances swept to the RJBDP, a change in the allocation of that cash between our Bank segment and third-party banks within the RJBDP, a movement of cash away from the firm, or an inability to implement new or modified deposit offerings, could significantly impair our ability to continue growing interest-earning assets and/or require our Bank segment to increase reliance on higher-cost deposit sources, such as the ESP and certain higher-yield RJBDP offerings to clients, or other sources of liquidity to grow interest-earning assets. Additionally, periods of higher interest rates have made and may continue to make investments in securities, such as fixed-income securities and money market funds, more attractive for investors, thereby incentivizing them to reduce their cash balances with us. Rapidly rising rates, for example, have made and may continue to make investments in securities, such as fixed-income securities and money market funds, more attractive for investors, thereby incentivizing them to reduce the cash they hold.

We also earn fees from third-party banks on deposits they receive through the RJBDP. If PCG clients’ cash balances decrease further or third-party bank demand or capacity for RJBDP deposits decline from current levels, our RJBDP fees from third-party banks could decline. If PCG clients’ cash balances continue to decrease or third-party bank demand or capacity for RJBDP deposits decline from current levels, our RJBDP fees from third-party banks could be adversely affected. In addition, an inability to deploy client cash to third-party banks through RJBDP would require us

22

RAYMOND JAMES FINANCIAL, INC. AND SUBSIDIARIES
to retain more cash in our Bank segment or in our Client Interest Program (“CIP”), both of which may cause a significant increase in our assets, thereby negatively affecting certain of our regulatory capital ratios. Any increase to the rates we pay clients can reduce our earnings. Such increases may result from competitive industry dynamics as well as changes to rules or interpretations governing the fees we earn on cash sweep balances.

The ESP provides a high-yield deposit offering to our PCG clients and operates through a reciprocal deposit program, which allows us to place deposits at third-party insured depository institutions in return for deposits received by our bank subsidiaries. This program allows us to offer higher levels of FDIC insurance to our clients. If third-party bank capacity for reciprocal deposits declines, or we are otherwise restricted from participating in this program, we may have to reduce FDIC insurance coverage on such deposits, which may cause clients to withdraw deposits that exceed FDIC insurance limits from our bank subsidiaries. If third-party bank capacity for reciprocal deposits declined, or we were otherwise restricted from participating in reciprocal deposit programs, we may have to reduce the amount of FDIC insurance coverage we offer on such deposits, which may cause clients to withdraw bank deposits that exceed FDIC insurance limits from our bank subsidiaries. In such event, we may have to pay higher interest rates to replace them with other sources of funding, which could adversely affect our liquidity and results of operations. In addition, reciprocal deposit balances in excess of $5 billion meet the FDIC definition of “brokered deposits. Reciprocal deposit balances in excess of $5 billion meet the FDIC definition of brokered deposits. ” Such brokered deposits are subject to additional scrutiny from regulators, incur higher FDIC insurance costs, and may also be viewed negatively by our rating agencies, shareholders, and other depositors. Such brokered deposits are subject to additional scrutiny from regulators and incur higher FDIC insurance costs.

We are exposed to litigation and regulatory investigations and proceedings, which could materially and adversely impact our business operations and prospects.

The financial services industry faces significant litigation and regulatory risks. Additionally, our litigation and regulatory risks continue to increase as our business grows both domestically and internationally. Additionally, our litigation and regulatory risks continue to increase as our business grows internationally. Many aspects of our business involve substantial risk of liability. We have been named as a defendant or co-defendant in lawsuits and arbitrations primarily involving claims for damages. The risks associated with potential litigation often may be difficult to assess or quantify and the existence and magnitude of potential claims often remain unknown for substantial periods of time. Unauthorized or illegal acts of our associates could also result in substantial liability. In addition, our business activities include providing custody, clearing, and back office support for certain non-affiliated, independent RIAs and broker-dealers. Even though these independent firms are exclusively responsible for their operations, supervision, compliance, and the suitability of their client’s investment decisions, we have been, and may in the future be, named as defendants in litigation involving their clients. We are also the subject of inquiries, investigations, and proceedings by regulatory and other governmental agencies.

In challenging market conditions, the volume of claims and amount of damages sought in litigation and regulatory proceedings against financial institutions have historically increased. Litigation risks include potential liability under securities laws or other laws for: alleged materially false or misleading statements made in connection with securities offerings and other transactions; issues related to our investment recommendations, including the suitability of such recommendations or potential concentration of investments; the inability to sell or redeem securities in a timely manner during adverse market conditions; contractual issues; employment claims; and potential liability for other advice we provide to participants in strategic transactions. Substantial legal liability could have a material adverse financial impact or cause us significant reputational harm, which in turn could seriously harm our business and future business prospects. In addition to financial costs and risks associated with potential liability, the costs of defending litigation, claims, and/or regulatory matters continue to increase over time. In addition to the foregoing financial costs and risks associated with potential liability, the costs of defending individual litigation and claims and/or regulatory matters continue to increase over time. The amount of attorneys’ fees incurred in connection with the defense of litigation, claims and/or regulatory matters could be substantial and might materially and adversely affect our results of operations. The amount of attorneys’ fees incurred in connection with the defense of litigation and claims and/or regulatory matters could be substantial and might materially and adversely affect our results of operations. See “Item 3 - Legal Proceedings” and Note 19 of the Notes to Consolidated Financial Statements of this Form 10-K for additional information about legal and regulatory matters. See “Item 3 - Legal Proceedings” and Note 19 of the Notes to Consolidated Financial Statements of this Form 10-K for further information about legal matters.

Our business is sensitive to domestic and international macroeconomic conditions caused by political and geopolitical developments, fiscal, monetary, and tax policies, regulations, and other domestic or international events.

We are engaged in various financial services businesses. As such, we are affected by domestic and international macroeconomic and political conditions, as well as economic output levels, interest and inflation rates, employment levels, prices of commodities, consumer confidence levels, changes in consumer spending, international trade policy, and fiscal and monetary policy. For example, Fed policies determine, in large part, interest rates and the cost of funds which directly affect the returns and fair value on our lending and investing activities. For example, Fed policies determine, in large part, interest rates and the cost of funds which directly affect 23RAYMOND JAMES FINANCIAL, INC. The market impact from such policies can also materially decrease the value of certain of our financial assets, most notably debt securities, as well as our cash flows. In addition, our results of operations may be impacted by changes resulting from different political philosophies governing individual and corporate taxation, as well as regulation, which may result from the outcome of the recent federal elections in the U.S. For example, changes to tax laws and regulations, including various provisions of the Tax Cut and Jobs Act (“TCJA”) which will expire in 2025 if not extended, may negatively impact our effective income tax rate, financial results, or the amount of any tax assets or liabilities. Changes in tax law and regulation, or any market uncertainty caused by a change in the political environment, may also affect our clients and, directly or indirectly, our business. Macroeconomic conditions may also be negatively affected by domestic or international events, including natural disasters, political unrest, the indirect impact of wars

23

RAYMOND JAMES FINANCIAL, INC. AND SUBSIDIARIES
and conflicts, such as the wars in Ukraine and Israel, or public health epidemics and pandemics, as well as by a number of factors in the global financial markets that may be detrimental to our operating results.

If we were to experience a period of sustained downturn in the securities markets, credit market dislocations, reductions in the value of real estate, increases in mortgage and other loan delinquencies, or other negative market factors, our revenues and the value of the assets we own could be adversely impacted. Market uncertainty could also cause clients to move their investments to lower margin products, or withdraw them, which could have an adverse impact on our profitability. We could also experience a material reduction in trading volume and lower asset prices in times of market uncertainty, which would result in lower brokerage revenues, including losses on firm inventory, as well as losses on certain of our investments. Conversely, periods of severe market volatility may result in a significantly higher level of transactions and activity which may cause operational challenges that may result in losses. These can include, but are not limited to, trade errors, failed transaction settlements, late collateral calls to borrowers and counterparties, credit losses, or interruptions to our system processing. Periods of reduced revenue and other losses could lead to reduced profitability because certain of our expenses, including our interest expense on debt, lease expenses, and salary expenses, are fixed, and our ability to reduce them over short time periods is limited.

Our businesses and revenues derived from non-U.S. operations may also be subject to risk of loss from currency fluctuations, social or political instability, less established regulatory regimes, changes in governmental or central bank policies, downgrades in the credit ratings of sovereign countries, expropriation, nationalization, confiscation of assets and unfavorable legislative, economic and political developments.

We are exposed to credit risk.

We are generally exposed to the risk that third parties that owe us money, securities, or other assets will fail to meet their obligations to us due to numerous causes, including bankruptcy, lack of liquidity, or operational failure, among others.We are generally exposed to the risk that third parties that owe us money, securities or other assets will fail to meet their obligations to us due to numerous causes, including bankruptcy, lack of liquidity, or operational failure, among others. Credit risk may also be affected by the deterioration of strength in the U.S. economy or adverse changes in the financial performance or condition of our clients and counterparties. We actively buy and sell securities from and to clients and counterparties in the normal course of our broker-dealers’ trading and underwriting activities, which exposes us to credit risk. Although generally collateralized by the underlying security to the transaction, we still face risk associated with changes in the market value of collateral through settlement date. We also hold certain securities, loans and derivatives as part of our trading operations. Deterioration in the actual or perceived credit quality of the underlying issuers of securities or loans or the non-performance of counterparties to certain derivatives could result in losses.

We incur credit risk by lending to businesses and individuals, including through offering SBL, C&I loans, CRE loans, REIT loans, residential mortgage loans, and tax-exempt loans. We also incur credit risk through certain of our investments. Our credit risk and credit losses can increase if our loans or investments are concentrated among borrowers or issuers engaged in the same or similar activities, industries, or geographies, or to borrowers or issuers who as a group may be uniquely or disproportionately affected by economic or market conditions. Declines in the real estate market or sustained economic downturns may cause us to experience credit losses or charge-offs related to our loans, sell loans at unattractive prices, or foreclose on certain real estate properties. Furthermore, the deterioration of an individually large exposure, for example due to natural disasters, health emergencies or pandemics, acts of terrorism, severe weather events, or other adverse economic events, could lead to additional credit loss provisions and/or charges-offs, and subsequently have a material impact on our net income and regulatory capital. In addition, TriState Capital Bank utilizes information provided by third-party organizations to monitor changes in the value of marketable securities that serve as collateral for substantially all of its SBL portfolio. These third parties also provide control over cash and marketable securities for purposes of perfecting TriState Capital Bank’s security interests and retaining the collateral in the applicable accounts. In the event that TriState Capital Bank would need to take control of collateral, it is dependent upon such third parties to follow contractual control agreements in order to mitigate any potential losses on its SBL.

We borrow securities from, and lend securities to, other financial institutions and may also enter into agreements to repurchase and/or resell securities as part of our financing activities. A sharp change in the market values of the securities utilized in these transactions may result in losses if counterparties to these transactions fail to honor their commitments. We manage the risk associated with these transactions by establishing and monitoring credit limits, as well as by evaluating collateral and transaction levels on a recurring basis. Significant deterioration in the credit quality of one of our counterparties could lead to widespread concerns about the credit quality of other counterparties in the same industry, thereby exacerbating our credit risk. In addition, we permit our clients to purchase securities on margin. During periods of steep declines in securities prices, the value of the collateral securing client margin loans may fall below the amount of the loan. If clients are unable to provide additional collateral for these margin loans, we may incur losses on those margin transactions. This may cause us to incur additional expenses defending or pursuing claims or litigation related to counterparty or client defaults.

24

RAYMOND JAMES FINANCIAL, INC. AND SUBSIDIARIES

We are exposed to market risk, including interest rate risk.

Market risk generally represents the risk that values of assets and liabilities or revenues will be adversely affected by changes in market conditions, which directly and indirectly affect us. Market conditions that change from time to time, thereby exposing us to market risk, include fluctuations in interest rates, equity prices, foreign exchange rates, and price deterioration or changes in value due to changes in market perception, actual credit quality of an issuer, or other factors. Market conditions that change from time to time, thereby exposing us to market risk, include fluctuations in interest rates, equity prices, foreign exchange rates, and price deterioration or changes in value due to changes in market perception, actual credit quality of an issuer, or other factors such as any potential shutdown of the US government or downgrade of the US government’s credit rating.

Market risk is inherent in financial instruments associated with our operations and activities, including loans, deposits, securities, short-term borrowings, long-term debt, trading assets and liabilities, derivatives, and investments. For example, interest rate increases could adversely affect the value of our available-for-sale securities portfolio. For example, interest rate increases could continue to adversely affect the value of our available-for-sale securities portfolio. Interest rate changes could also adversely affect the value of our fixed income trading inventories, as well as our net interest spread, which is the difference between the yield we earn on our interest-earning assets and the interest rate we pay for deposits and other sources of funding, in turn impacting our net interest income and interest-related earnings. Interest rate changes could affect the interest earned on assets differently than interest paid on liabilities. Market risk may also affect the value of our private equity portfolio, which is carried at fair value with unrealized gains and losses reflected in earnings. The value of such investments can fluctuate and the related earnings can be volatile and difficult to predict.

Increases in short-term interest rates have historically resulted in an increase in our net earnings and we expect decreases in short-term interest rates to generally reduce our net earnings, although there may be offsetting favorable impacts. As it relates to our net interest income, the magnitude of the effect of a decrease in short-term interest rates depends on a number of factors impacting balances, asset yields, and the cost of funding. The magnitude of the impact to our net interest margin depends on the yields on interest-earning assets relative to the cost of interest-bearing liabilities, including deposit rates paid to clients on their cash balances. The magnitude of the impact of interest rate changes to our net interest spread depends on the yields on interest-earning assets relative to the cost of interest-bearing liabilities, including deposit rates paid to clients on their cash balances. Decreases in short-term interest rates generally also result in a decrease to our RJBDP fees earned from third-party banks, although the magnitude of the impact may also be impacted by demand for cash balances by third-party banks and the rate paid to clients on their cash sweep balances. Rates paid to clients on their cash balances are generally impacted by the level of short-term interest rates, as well as competitive industry dynamics and the demand for client cash. Additionally, any future changes to regulatory rules or interpretations governing the fees the firm earns on cash sweep balances could also impact the rates we pay to clients on cash balances. If we are unable to effectively manage our interest rate risk, changes in interest rates could have a material adverse effect on our profitability.

In addition, disruptions in the liquidity or transparency of the financial markets may result in our inability to sell, syndicate or realize the value of security positions, thereby leading to increased concentrations. The inability to reduce our positions in specific securities may not only increase the market and credit risks associated with such positions, but also increase the level of risk-weighted assets on our balance sheet, thereby increasing our capital requirements, which could have an adverse effect on our business results, financial condition, and liquidity.

Our ability to attract and retain senior professionals, qualified financial advisors and other associates is critical to the continued success of our business.

Our ability to recruit, serve and retain our clients depends on the reputation, judgment, leadership, business generation capabilities and client service skills of our client-serving professionals, members of our executive team, as well as employees who support revenue-generating professionals and their clients. To compete effectively we must attract, develop, and retain qualified professionals, including successful financial advisors, investment bankers, trading professionals, portfolio managers and other revenue-producing or specialized support personnel. Further, effective management succession planning, including the execution of our succession plans for our current CEO and other senior management positions, is important for the continued success of the firm. Competitive pressures we experience, or inadequate management succession planning, could have an adverse effect on our business, results of operations, financial condition and liquidity.

The labor market remains competitive, and we face competition for talent across all aspects of our business, as well as competition with non-traditional firms, such as technology companies. Employers are developing a wide variety of offerings to attract talent, including but not limited to, increasing compensation, enhancing health and wellness solutions, and providing workplace flexibility. These can be important factors in a current associate’s decision to leave us as well as in a prospective associate’s decision to join us. As competition for skilled professionals remains intense, we may have to devote significant resources to attract and retain qualified personnel, which could negatively affect earnings.

Specifically within the financial industry, employers are increasingly offering guaranteed contracts, upfront payments, and increased compensation. Our financial results may be adversely affected by the costs we incur in connection with any loans or other incentives we may offer to newly recruited financial advisors and other key personnel. If we were to lose the services of

25

RAYMOND JAMES FINANCIAL, INC. AND SUBSIDIARIES
any of our financial advisors, investment bankers, senior equity research analysts, sales and trading professionals, asset managers, or executive officers to a competitor or otherwise, we may not be able to retain valuable relationships and some of our clients could choose to use the services of a competitor instead of our services. If we are unable to retain our senior professionals or recruit additional professionals, our reputation, business, results of operations and financial condition will be adversely affected. To the extent we have compensation targets, we may not be able to retain our associates, which could result in increased recruiting expense, result in our recruiting additional associates at compensation levels that are higher than our target range, and/or negatively impact our revenue growth. To the extent we have compensation targets, we may not be able to retain our associates, which could result in increased recruiting expense or result in our recruiting additional associates at compensation levels that are not within our target range. Further, new business initiatives and efforts to expand existing businesses generally require that we incur compensation and benefits expense before generating additional revenues.

Our PCG business is subject to risks arising from an ongoing industry-wide trend in which financial advisors are departing traditional firms to form independent RIAs or to join existing third-party RIAs, some of which are backed by private equity investors. Similarly, retiring financial advisors without a successor affiliated with us may sell their practices to unaffiliated third parties. Such developments reduce the number of our financial advisors and reported AUA. We seek to mitigate these risks through financial advisor succession planning and by providing our financial advisors with a broad range of services and resources to support their practices. We also offer, through our RCS division, extensive services to third-party RIAs. If these mitigation efforts are not successful, and the trend of financial advisors transitioning to an unaffiliated RIA channel continues or accelerates, this could have an adverse effect on our PCG business, its results of operations and financial condition.

Moreover, companies in our industry whose employees or independent contractors accept positions with competitors frequently claim that those competitors have engaged in unfair hiring practices. We have been subject to several such claims and may be subject to additional claims in the future as we seek to hire or otherwise affiliate with qualified personnel, some of whom may work for our competitors. Some of these claims may result in material litigation. We could incur substantial costs in defending against these claims, regardless of their merits. Such claims could also discourage potential associates who work for our competitors from joining us. We participate, with limited exceptions, in the Protocol for Broker Recruiting (“Protocol”), a voluntary agreement among many firms in the industry that governs, among other things, the client information that financial advisors may take with them when they affiliate with a new firm and the financial advisor’s ability to solicit clients of their prior firm. The ability to bring such client data to a new broker-dealer, as well as the ability to solicit clients generally, means that the clients of the financial advisor are more likely to choose to open accounts at the advisor’s new firm. Participation in the Protocol is voluntary, and it is possible that certain of our competitors will withdraw from it. Participation is voluntary, and it is possible that certain of our competitors will withdraw from the Protocol. If the broker-dealers and RIAs from whom we recruit new financial advisors prevent, or significantly limit, the transfer of client data and the solicitation of clients, our recruiting efforts may be adversely affected. If the broker-dealers and registered investment advisers from whom we recruit new financial advisors prevent, or significantly limit, the transfer of client data and the solicitation of clients, our recruiting efforts may be adversely affected. Additionally, we could experience a larger number of claims against us relating to our recruiting efforts.

Our business depends on fees generated from the distribution of financial products, fees earned from the management of client accounts, and other asset management fees.

A large portion of our revenues are derived from fees generated from the distribution of financial products, such as mutual funds and variable annuities, and the various services we perform related to such products. Changes in the structure or amount of the fees paid by the sponsors of these products could directly affect our revenues, business, and financial condition. In addition, if these products experience losses or increased investor redemptions, we may receive lower fees from the distribution and other services we provide on behalf of the mutual fund and annuity companies.

The asset management fees we are paid are dependent upon the value of client assets in fee-based accounts in our PCG segment, as well as AUM in our Asset Management segment. The value of our fee-based assets and AUM is impacted by market fluctuations and net inflows or outflows of assets. As our PCG clients increasingly show a preference for fee-based accounts over transaction-based accounts, a larger portion of our client assets are more directly impacted by market movements. Therefore, in periods of declining market values, the values of fee-based accounts and AUM may resultantly decline, which would negatively impact our revenues. In addition, below-market investment performance by our funds, portfolio managers, or financial advisors could result in reputational damage that might cause outflows or make it more difficult to attract new investors into our asset management products and thus, further impact our business and financial condition.

Our asset management fees may also decline over time due to factors such as increased competition and the renegotiation of contracts. Additionally, most of our clients may withdraw funds from under our management at their discretion at any time for any reason, including as a result of competition or poor performance of our products. In addition, the market environment in recent years has resulted in a shift to passive investment products, which generate lower fees than actively managed products. A continued trend toward passive investments or changes in market values or in the fee structure of asset management accounts would negatively affect our revenues, business, and financial condition.


26

RAYMOND JAMES FINANCIAL, INC. AND SUBSIDIARIES
Our underwriting, market-making, trading, lending, and other business activities place our capital at risk.

We may incur losses and be subject to reputational harm to the extent that, for any reason, we are unable to sell securities we have underwritten at anticipated price levels. As an underwriter, we also are subject to heightened standards regarding liability for material misstatements or omissions in prospectuses and other offering documents relating to offerings in which we are involved. From time to time as part of our underwriting processes, we may carry significant positions in securities of a single issuer or issuers engaged in a specific industry. Sudden changes in the value of these positions, despite our risk mitigation policies, could impact our financial results.

As a market maker, we take ownership of positions in specific securities, and these undiversified holdings concentrate the risk of market fluctuations and may result in greater losses than would be the case if our holdings were more diversified. AND SUSDIARIESIndexAs a market maker, we take ownership of positions in specific securities, and these undiversified holdings concentrate the risk of market fluctuations and may result in greater losses than would be the case if our holdings were more diversified. Despite risk mitigation policies, we may incur losses as a result of positions we hold in connection with these activities.

A continued interruption to our telecommunications or data processing systems, or the failure to effectively update the technology we utilize, could be materially adverse to our business.

Our businesses rely extensively on data processing and communications systems. In addition to better serving clients, the effective use of technology increases efficiency and enables us to reduce costs. Adapting or developing our technology systems to meet new regulatory requirements, client needs, and competitive demands is critical for our business. Introduction of new technology presents challenges on a regular basis. There are significant technical and financial costs and risks in the development of new or enhanced applications, including the risk that we might be unable to effectively use new technologies, adapt our applications to emerging industry standards, or keep applications current as it relates to vulnerabilities and security controls. There are significant technical and financial costs and risks in the development of new or enhanced applications, including the risk that we might be unable to effectively use new technologies or adapt our applications to emerging industry standards.

Our continued success depends, in part, upon our ability to: (i) successfully maintain and upgrade the capability of our technology systems on a regular basis; (ii) maintain the quality of the information contained in our data processing and communications systems; (iii) address the needs of our clients by using technology to provide products and services that satisfy their demands; (iv) retain skilled information technology employees; and (v) ensure that our existing and new technology systems conform to regulatory requirements.Our continued success depends, in part, upon our ability to: (i) successfully maintain and upgrade the capability of our technology systems on a regular basis; (ii) maintain the quality of the information contained in our data processing and communications systems; (iii) address the needs of our clients by using technology to provide products and services that satisfy their demands; and (iv) retain skilled information technology employees. Failure of our technology systems to operate appropriately, which could result from events beyond our control, including a systems malfunction or cyber-attack, failure by a third-party service provider, or an inability to effectively upgrade those systems or implement new technology-driven products or services, could result in financial losses, liability to clients for non-compliant data processing, and violations of privacy and other laws and regulations, as well as regulatory sanctions.

The soundness of other financial institutions and intermediaries affects us.

We face the risk of operational failure, termination or capacity constraints of any of the clearing agents, exchanges, clearing houses, or other financial intermediaries that we use to facilitate our securities and derivative transactions. As a result of regulatory changes and the consolidation over the years among clearing agents, exchanges, and clearing houses, our exposure to certain financial intermediaries has increased and could affect our ability to find adequate and cost-effective alternatives should the need arise. Any failure, termination, or constraint of these intermediaries could adversely affect our ability to execute transactions, service our clients, and manage our exposure to risk.

Our ability to engage in routine trading and funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services institutions are interdependent as a result of trading, clearing, funding, counterparty, or other relationships. We have exposure to many different industries and counterparties, and we routinely execute transactions with counterparties in the financial industry, including brokers and dealers, commercial banks, investment banks, mutual and hedge funds, and other institutional clients. Defaults by, or even rumors or questions about the financial condition of, one or more financial services institutions, or the financial services industry generally, have historically led to market-wide liquidity problems and could lead to losses or defaults by us or by other institutions. Many of these transactions expose us to credit risk in the event of default of our counterparty or client. In addition, our credit risk may be exacerbated when the collateral held by us cannot be realized or is liquidated at prices not sufficient to recover the full amount of the loan or derivative exposure due us. Losses arising in connection with counterparty defaults may have a material adverse effect on our results of operations.

We deposit our cash in depository institutions as a means of maintaining the liquidity necessary to meet our operating needs, and we also facilitate the deposit of cash awaiting investment in depository institutions on behalf of our clients. Many of these deposits exceed FDIC-insured limits. Recent events in the financial services industry, including the failure of certain banks, have increased counterparty credit risk. While we perform extensive diligence on the banks we select to hold these deposits, a

27

RAYMOND JAMES FINANCIAL, INC. AND SUBSIDIARIES
failure of one or more of these depository institutions to return these deposits could affect our operating liquidity, result in reputational damage, and impair our financial performance.

Our risk management and conflicts of interest policies and procedures may leave us exposed to unidentified or unanticipated risk.

We seek to manage, monitor, and control our market, credit, operational, liquidity, and legal and regulatory compliance risk through operational and compliance reporting systems, internal controls, management review processes, and other mechanisms; however, there can be no assurance that our procedures will be effective.We seek to manage, monitor and control our market, credit, operational, liquidity and legal and regulatory compliance risk through operational and compliance reporting systems, internal controls, management review processes and other mechanisms; however, there can be no assurance that our procedures will be effective. While we use limits and other risk mitigation techniques, those techniques and the judgments that accompany their application cannot always anticipate unforeseen economic and financial outcomes or the specifics and timing of such outcomes. Our risk management methods may not predict future risk exposures effectively. In addition, some of our risk management methods are based on an evaluation of information regarding markets, clients and other matters that are based on assumptions that may no longer be accurate or may have limited predictive value. A failure to manage our growth adequately, including growth in the products or services we offer or through acquisitions, or to manage our risk effectively, could materially and adversely affect our business and financial condition. A failure to manage our growth adequately, including growth in the products or services we offer, or to manage our risk effectively, could materially and adversely affect our business and financial condition.

Financial services firms are subject to numerous actual or perceived conflicts of interest, which are routinely examined by regulators and SROs, such as FINRA, and are often used as the basis for claims for legal liability by plaintiffs in actions against us. Our risk management processes include addressing potential conflicts of interest that arise in our business. Management of potential conflicts of interest has become increasingly complex as we expand our business activities. A perceived or actual failure to address conflicts of interest adequately could affect our reputation, the willingness of clients to transact business with us, or give rise to litigation or regulatory actions. Therefore, there can be no assurance that conflicts of interest will not arise in the future that could result in material harm to our business and financial condition.

We face intense competition and pricing pressures and may not be able to keep pace with technological change.

We are engaged in intensely competitive businesses. We compete on the basis of a number of factors, including the quality of our associates, our products and services, pricing (such as execution pricing and fee levels), technology solutions, and location and reputation in relevant markets. Over time, there has been substantial consolidation and convergence among companies in the financial services industry, which has significantly increased the capital base and geographic reach of our competitors. See “Item 1 - Business - Competition” of this Form 10-K for additional information about our competitors.

We compete directly with other national full service broker-dealers, investment banking firms, commercial banks, and investment advisors, investment managers, and to a lesser extent, with discount brokers and dealers. We face competition from more recent entrants into the market, including fintechs, and increased use of alternative sales channels by other firms. Technology has lowered barriers to entry and made it possible for fintechs to compete with larger financial institutions in providing electronic, internet-based, and mobile phone-based financial solutions. This competition has grown significantly over recent years and is expected to intensify. In addition, commercial firms and other non-traditional competitors have applied for banking licenses or have entered into partnerships with banks to provide banking services. We also compete indirectly for investment assets with insurance companies, real estate firms, and hedge funds, among others. Competition from other financial services firms to attract clients or trading volume, through direct-to-investor online financial services, or higher deposit rates to attract client cash balances, could result in pricing pressure or otherwise adversely impact our business and cause our business to suffer.

Our future success also depends in part on our ability to develop, maintain, and enhance our products and services, including factors such as customer experience, and the pricing and range of our offerings. The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services. If we are not able to develop new products and services, enhance existing offerings, effectively implement new technology-driven products and services, or successfully market these products and services to our customers, our business, financial condition or results of operations may be adversely affected. Furthermore, both financial institutions and their non-banking competitors face the risk that payments processing and other services could be significantly disrupted by technologies (e. Furthermore, both financial institutions and their non-banking competitors face the risk that payments processing and other services could be significantly disrupted by technologies, such as cryptocurrencies, that require no intermediation. g., AI, online trading platforms, digital payment technologies) that require no intermediation. New technologies have required, and could require us in the future, to spend more to modify or adapt our products to attract and retain clients or to match products and services offered by our competitors, including technology companies.

Although we currently do not use AI extensively, we may in the future use, develop, and incorporate within our technology platform and services, systems and tools that incorporate AI and machine learning, including generative AI. Although we strive to establish and maintain appropriate governance and risk management processes, ineffective or inadequate AI development or deployment practices by us or third-party vendors could result in unintended consequences such as AI algorithms that produce

28

RAYMOND JAMES FINANCIAL, INC. AND SUBSIDIARIES
inaccurate output or that are based on biased, incomplete, and/or inaccurate datasets. Any of the foregoing may result in harm to our business, results of operations, or reputation. Compliance with new or changing laws, regulations, or industry standards relating to AI may impose significant operational costs and limit our ability to develop, deploy, or use AI and machine learning technologies.

We must monitor the pricing of our services and financial products in relation to competitors and periodically may need to adjust our fees, commissions, margins, or interest rates on deposits to remain competitive. In fixed income markets, regulatory requirements have resulted in greater price transparency, leading to price competition and decreased trading margins. Our trading margins have been further compressed by the shift from high- to low-touch services over time, which has created additional competitive pressure. We believe that price competition and pricing pressures in these and other areas will continue as institutional investors continue to reduce the amounts they are willing to pay, including by reducing the number of brokerage firms they use, and some of our competitors seek to obtain market share by reducing fees, commissions, or margins.

A downgrade in our credit ratings could have a material adverse effect on our operations, earnings, and financial condition.

If our credit ratings were downgraded, or if rating agencies indicate that a downgrade may occur, our business, financial position, and results of operations could be adversely affected, perceptions of our financial strength could be damaged, and as a result, adversely affect our client relationships. Such a change in our credit ratings could also adversely affect our liquidity and competitive position, increase our borrowing costs, limit our access to the capital and credit markets, trigger obligations under certain financial agreements, cause clients to withdraw bank deposits that exceed FDIC insurance limits from our bank subsidiaries, or decrease the number of investors, clients, and counterparties willing or permitted to do business with or lend to us, thereby curtailing our business operations and reducing profitability.

We may not be able to obtain additional outside financing to fund our operations on favorable terms, or at all. The impact of a credit rating downgrade to a level below investment grade would result in our breaching provisions in certain of our derivative instruments, and may result in a request for immediate payment and/or ongoing overnight collateralization on our derivative instruments in liability positions. A credit rating downgrade would also result in the firm incurring a higher facility fee on its $750 million unsecured revolving credit facility agreement (the “Credit Facility”), in addition to triggering a higher interest rate applicable to any borrowings outstanding on the line as of and subsequent to such downgrade. See “Item 7 - Management’s Discussion and Analysis of Financial Condition and Results of Operations - Liquidity and capital resources” of this Form 10-K and Note 16 of the Notes to Consolidated Financial Statements of this Form 10-K for information on the Credit Facility.

Business growth, including through acquisitions, could increase costs and regulatory and integration risks.

We continue to grow, including through acquisitions and through our recruiting efforts. Integrating acquired businesses, providing a platform for new businesses and partnering with other firms involve risks and present financial, managerial, and operational challenges. While cultural fit is a requirement for both our recruiting and acquisition efforts, there can be no assurance that recruited talent and/or acquisition targets will ultimately assimilate into our firm in a manner which results in the expected financial benefits. We may incur significant expense, including in the areas of technology and cybersecurity, in connection with expanding our existing businesses, recruiting financial advisors, or when acquiring and integrating businesses. Our overall profitability would be negatively affected if investments and expenses associated with such growth are not matched or exceeded by the earnings derived from such investments or growth. Assumptions which underlie the basis of our acquisition decisions, such as the retention of key personnel, future revenue growth of an acquired business, cost efficiencies to be realized, or the value created through the application of specialized expertise we plan to bring to the acquired business, may not be fully realized post-acquisition, resulting in an adverse impact on the value of our investment and potential dilution of the value of our shares.

We may be unable to integrate an acquired business into our existing business successfully, or such integration may be materially delayed or become more costly or difficult than expected. Further, either company’s clients, suppliers, employees or other business partners may react negatively to the transaction. Such developments could have an adverse effect on our business, financial condition, and results of operations.

Domestic and international business growth, including through acquisitions, may expose us to additional regulatory oversight, create a need for additional compliance, risk management, and internal control procedures, and require us to hire additional personnel to address these procedures. To the extent such procedures are not adequate or not adhered to with respect to our expanded business or any new business, we could be exposed to a material loss or regulatory sanction.


29

RAYMOND JAMES FINANCIAL, INC. AND SUBSIDIARIES
Moreover, to the extent we pursue acquisitions, or enter into acquisition commitments, a number of factors may prevent us from completing such acquisitions on acceptable terms. For example, regulators such as the Fed could fail to approve a proposed transaction or such approvals could result in the imposition of conditions that could adversely affect the combined company or the expected benefits of the transaction. The shareholders of a publicly-traded target company could fail to approve the transaction. Closing conditions in the transaction agreement could fail to be satisfied, or there could be an unexpected delay in closing. Other developments that may affect future results of an acquired company may occur, including changes in asset quality and credit risk, changes in interest rates and capital markets, inflation, and/or changes in customer borrowing, repayment, investment and deposit practices. Finally, an event, change, or other circumstance could occur that gives rise to the termination of the transaction agreement.

In addition, we may need to raise capital or borrow funds in order to finance an acquisition, which could result in dilution or increased leverage. We may not be able to obtain such financing on favorable terms or perhaps at all. Further, we may issue our shares as a component of some or all of the purchase consideration for an acquisition, which may result in dilution.

Securities class action lawsuits and derivative lawsuits are often brought against public companies that have entered into merger agreements. Even if such lawsuits are without merit, defending against these claims could result in substantial costs and divert management time and resources. An adverse judgment could result in monetary damages, which could have a negative impact on our liquidity and financial condition.

Associate misconduct, which is difficult to detect and deter, could harm us by impairing our ability to attract and retain clients and subject us to significant legal liability and reputational harm. AND SUSDIARIESIndexAssociate misconduct, which is difficult to detect and deter, could harm us by impairing our ability to attract and retain clients and subject us to significant legal liability and reputational harm.

There is a risk that our associates could engage in misconduct that adversely affects our business. For example, our investment banking business often requires that we deal with confidential matters of great significance to our clients. Our associates interact with clients, customers, and counterparties on an ongoing basis. All associates are expected to exhibit the behaviors and ethics that are reflected in our framework of principles, policies, and technology to protect both our own information as well as that of our clients. If our associates improperly use or disclose confidential information provided by our clients, we could be subject to future regulatory sanctions and suffer serious harm to our reputation, financial position, current client relationships, and ability to attract future clients. We are also subject to a number of obligations and standards arising from our asset management business and our authority over our assets under management. In addition, our financial advisors are required to act in the best interests of our clients and may act in a fiduciary capacity, providing financial planning, investment advice, and discretionary asset management. The violation of these obligations and standards by any of our associates would adversely affect our clients and us. Associate conduct on non-business matters, such as social issues, including the posting of information on social media or other internet forums, could be inconsistent with our policies and ethics and result in reputational harm to our business due to their employment by us or affiliation with us. It is not always possible to deter or prevent every instance of associate misconduct, and the precautions we take to detect and prevent this activity may not be effective in all cases. If our associates engage in misconduct, our business would be adversely affected.

We are subject to risks relating to environmental, social, and governance matters that could adversely affect our reputation, business, financial condition, and results of operations, as well as the price of our common and preferred stock.

We are subject to a variety of risks, including reputational risk, associated with environmental, social, and governance matters. As a large financial institution, we have multiple stakeholders, including our shareholders, clients, associates, federal and state regulatory authorities, and the communities in which we operate, and these stakeholders will often have differing priorities and expectations regarding such matters. For example, individual U.S. states are increasingly developing differing, and sometimes conflicting, rules related to environmental, social, and governance matters. If we take action in conflict with one or another of those stakeholders’ expectations, we could experience an increase in client complaints, a loss of business, or reputational harm. We could also face negative publicity or reputational harm based on the identity of those with whom we choose to do business. Any adverse publicity in connection with environmental, social, and governance issues could damage our reputation, ability to attract and retain clients and associates, compete effectively, and grow our business. Any adverse publicity in connection with ESG issues could damage our reputation, ability to attract and retain clients and associates, compete effectively, and grow our business.

In addition, proxy advisory firms and certain institutional investors who manage investments in public companies may integrate environmental, social, and governance factors into their investment analysis.In addition, proxy advisory firms and certain institutional investors who manage investments in public companies are increasingly integrating ESG factors into their investment analysis. The consideration of environmental and social matters in making investment and voting decisions is relatively new. Accordingly, the frameworks and methods for assessing policies related to such matters are not fully developed, vary considerably among the investment community, and will likely continue to evolve over time. Accordingly, the frameworks and methods for assessing ESG policies are not fully developed, vary considerably among the investment community, and will likely continue to evolve over time. Moreover, the subjective nature of methods used by various stakeholders to assess a company with respect to environmental, social, and governance criteria could result in erroneous perceptions or a misrepresentation of our actual policies and practices in these areas. Moreover, the subjective nature of methods used by various stakeholders to assess a company with respect to ESG criteria could result in erroneous perceptions or a misrepresentation of our actual ESG policies and practices. Organizations that provide ratings information to investors on such matters may

30

RAYMOND JAMES FINANCIAL, INC. AND SUBSIDIARIES
also assign unfavorable ratings to RJF. Public companies continue to face pressure from stakeholders to consider environmental, social, and governance issues in corporate actions, such as the election of directors and approval of executive compensation. Public companies are facing increased pressure from stakeholders to consider ESG issues in corporate actions, such as the election of directors and approval of executive compensation. Certain of our clients might also require that we implement additional procedures or standards in these areas in order to continue to do business with them. Certain of our clients might also require that we implement additional ESG procedures or standards in order to continue to do business with them. If we fail to comply with specific investor or client expectations and standards, or to provide the disclosure relating to these issues that any third parties may believe is necessary or appropriate (regardless of whether there is a legal requirement to do so), our reputation, business, financial condition, and/or results of operations could be negatively impacted. If we fail to comply with specific ESG-related investor or client expectations and standards, or to provide the disclosure relating to ESG issues that any third parties may believe is necessary or appropriate (regardless of whether there is a legal requirement to do so), our reputation, business, financial condition, and/or results of operations, as well as the price of our common and preferred stock could be negatively impacted.

Moreover, there has been increased regulatory focus on the disclosure practices of investment managers offering sustainable and values-based investment strategies, resulting in increased risk that we could be perceived as making inaccurate or misleading statements regarding the investment strategies of our funds and ETFs, commonly referred to as “greenwashing.” Such perceptions or accusations could damage our reputation, result in litigation or regulatory enforcement actions, and adversely affect our business.

The preparation of the consolidated financial statements requires the use of estimates that may vary from actual results. AND SUSDIARIESIndexThe preparation of the consolidated financial statements requires the use of estimates that may vary from actual results.

The preparation of the consolidated financial statements in conformity with U.S. generally accepted accounting principles (“GAAP”) requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities, disclosure of contingent assets and liabilities at the date of the consolidated financial statements, and the reported amounts of revenues and expenses for the reporting period. Such estimates and assumptions may require management to make difficult, subjective, and complex judgments about matters that are inherently uncertain. One of our most critical estimates is our allowance for credit losses. At any given point in time, conditions in real estate and credit markets may increase the complexity and uncertainty involved in estimating the losses inherent in our loan portfolio. The recorded amount of liabilities related to legal and regulatory matters is also subject to significant management judgement. For either of these estimates, if management’s underlying assumptions and judgments prove to be inaccurate, our loss provisions could be insufficient to cover actual losses, and our financial condition, including our liquidity and capital, and results of operations could be materially and adversely impacted. For additional discussion of our significant accounting estimates, policies and standards, see “Item 7 - Management’s Discussion and Analysis of Financial Condition and Results of Operations - Critical accounting estimates” of this Form 10-K and Note 2 of the Notes to Consolidated Financial Statements of this Form 10-K.For further discussion of our significant accounting estimates, policies and standards, see “Item 7 - Management’s Discussion and Analysis of Financial Condition and Results of Operations - Critical accounting estimates” of this Form 10-K and Note 2 of the Notes to Consolidated Financial Statements of this Form 10-K.

Our operations could be adversely affected by serious weather conditions.

Certain of our principal operations are located in St. Petersburg, Florida. While we have a business continuity plan that provides for significant operations to be conducted out of remote locations, as well as our Southfield, Michigan and Memphis, Tennessee corporate offices, and our U.S. information systems processing to be conducted out of our information technology data center in the Denver, Colorado area, our operations could be adversely affected by hurricanes or other serious weather conditions, the magnitude and frequency of which may be affected by climate change. Such weather conditions could affect the processing of transactions, communications, and the ability of our associates to get to our offices, or work remotely. In addition, our operations are dependent on our associates’ ability to relocate to a secondary location in the event of a power outage or other disruption in their primary remote work location. Furthermore, such weather events may also have a negative impact on the operations and/or financial condition of our clients or counterparties, which may affect the processing of transactions with such parties, decrease revenues from such clients or increase the credit risk associated with loans and other credit exposures to such clients.

We are exposed to risks related to our insurance programs.

Our operations and financial results are subject to risks and uncertainties related to our use of a combination of insurance, self-insured retention and self-insurance for a number of risks. To a large extent, we have elected to self-insure our errors and omissions liability and our employee-related health care benefit plans. We have self-insured retention risk related to several exposures, including our property and casualty, workers compensation and professional liability policies.

While we endeavor to purchase insurance coverage appropriate to our risk assessment, we are unable to predict with certainty the frequency, nature or magnitude of claims for direct or consequential damages. Our business may be negatively affected if our insurance proves to be inadequate or unavailable. In addition, claims associated with risks we have retained either through our self-insurance retention or by self-insuring may exceed our recorded liabilities which could negatively impact future earnings. Insurance claims may divert management resources away from operating our business.


31

RAYMOND JAMES FINANCIAL, INC. AND SUBSIDIARIES

RISKS RELATED TO OUR REGULATORY ENVIRONMENT

Financial services firms are highly regulated and are currently subject to a number of new and proposed regulations, all of which may increase our risk of financial liability and reputational harm resulting from adverse regulatory actions.

Financial services firms operate in an evolving regulatory environment and are subject to extensive supervision and regulation. The laws and regulations governing financial services firms are intended primarily for the protection of our depositors, our clients, the financial system, and the FDIC insurance fund, not our shareholders or creditors. The financial services industry has experienced an extended period of significant change in laws and regulations, as well as a high degree of scrutiny from various regulators, including the SEC, the Fed, the FDIC, the OCC and the CFPB, in addition to stock exchanges, FINRA, and governmental authorities, such as state attorneys general. The SEC has recently been very active in proposing and adopting major new rules and regulations that affect public companies and, in particular, the financial services industry. Several of these new rules have been adopted after significantly abbreviated periods for public comments, and these new or proposed rules involve sweeping changes that could require significant shifts in industry operations and practices, thereby increasing uncertainty for markets and investors. Further, final and proposed rules and regulations have been increasingly subjected to legal challenge which creates uncertainty in planning our compliance and could lead to increased compliance costs. Penalties and fines imposed by regulatory and other governmental authorities have also been substantial and growing in recent years. Penalties and fines imposed by regulatory and other governmental authorities have also 31RAYMOND JAMES FINANCIAL, INC. Additionally, an increasing number of U.S. states have proposed, or are considering, their own laws and regulations, and as a result our activities could be subject to overlapping and divergent regulation. We may be adversely affected by the adoption of new rules and by changes in the interpretation or enforcement of existing laws, rules, and regulations. Existing and new laws and regulations could negatively affect our revenue, limit our ability to pursue business opportunities, impact the value of our assets, require us to alter our business practices, impose additional compliance costs, and otherwise adversely affect our businesses.

Additionally, our international business operations are subject to laws, regulations, and standards in the countries in which we operate. In many cases, our activities have been and may continue to be subject to overlapping and divergent regulation in different jurisdictions. As our international operations continue to grow, we may need to comply with additional laws, rules, and regulations which could require us to alter our business practices and/or result in additional compliance costs. Any violations of these laws, regulations or standards could subject us to a range of potential regulatory events or outcomes that could have a material adverse effect on our business, financial condition and prospects including potential adverse impacts on continued operations in the relevant international jurisdiction.

Broker-dealers and investment advisors are subject to regulations covering all aspects of the securities business, including, but not limited to: sales and trading methods; trade practices among broker-dealers; use and safekeeping of clients’ funds and securities; capital structure of securities firms; anti-money laundering efforts; recordkeeping; and the conduct of directors, officers and employees. Any violation of these laws or regulations could subject us to the following events, any of which could have a material adverse effect on our business, financial condition, reputation, and prospects: civil and criminal liability for us or our employees or affiliated financial advisors; sanctions, which could include the revocation of our subsidiaries’ registrations as investment advisors or broker-dealers; the revocation of the licenses of our financial advisors; censures; fines; conditions or limitations on our business activities, including higher capital requirements; or a temporary suspension or permanent bar from conducting business. See Note 19 of the Notes to Consolidated Financial Statements of this Form 10-K for additional information.

Federal and state laws or regulations governing, among other things, the wages we pay our employees, the terms of our employment contracts (e.g., post-employment non-competition agreements), or the criteria for determining whether a person is an employee or independent contractor could materially impact our relationships with our advisors and our business, result in higher compensation costs or otherwise adversely affect our results of operations.

Raymond James Bank and TriState Capital Bank are subject to the CRA, the Equal Credit Opportunity Act, the Fair Housing Act and other U.S. federal fair lending laws and regulations that impose nondiscriminatory lending requirements on financial institutions. The U.S. Department of Justice and other federal agencies, including the CFPB, are responsible for enforcing these laws and regulations. An unfavorable CRA rating or a successful challenge to an institution’s performance under the fair lending laws and regulations could result in a wide variety of sanctions, including the required payment of damages and civil monetary penalties, injunctive relief, and the imposition of restrictions on mergers, acquisitions and expansion activity. Private parties may also have the ability to challenge a financial institution’s performance under fair lending laws by bringing private class action litigation.


32

RAYMOND JAMES FINANCIAL, INC. AND SUBSIDIARIES
The Federal Reserve requires a bank holding company to act as a source of financial and managerial strength for its subsidiary banks. The Federal Reserve could require RJF to commit resources to Raymond James Bank and TriState Capital Bank when doing so is not otherwise in the best interests of RJF or its shareholders or creditors.

Regulatory actions brought against us may result in judgments, settlements, fines, penalties or other results, any of which could have a material adverse effect on our business, financial condition, reputation, or results of operations. In particular, the banking agencies have broad enforcement power over bank holding companies and banks, including with respect to unsafe or unsound practices or violations of law. There is no assurance that regulators will be satisfied with the policies and procedures implemented by RJF and its subsidiaries. In addition, from time to time, RJF and its subsidiaries have been and may in the future become subject to additional findings with respect to supervisory, compliance or other regulatory deficiencies, which could subject us to additional liability, including penalties and restrictions on our business activities. In addition, from time to time, RJF and its subsidiaries may become subject to additional findings with respect to supervisory, compliance or other regulatory deficiencies, which could subject us to additional liability, including penalties and restrictions on our business activities. Among other things, these restrictions could limit our ability to make investments, complete acquisitions, onboard new branches or financial advisors, expand into new business lines, pay dividends on our common and preferred stock and/or engage in share repurchases. Among other things, these restrictions could limit our ability to make investments, complete acquisitions, expand into new business lines, pay dividends on our common and preferred stock and/or engage in share repurchases. See “Item 1 - Business - Regulation” of this Form 10-K for additional information regarding our regulatory environment.

Continued asset growth may result in changes to our status with respect to existing regulations as well as increased oversight, which will result in additional capital and other financial requirements and may increase our compliance costs.

We will incur increased regulatory scrutiny and heightened supervision (together with related compliance costs) as we continue to grow and approach certain consolidated asset thresholds, which have the effect of imposing enhanced standards and requirements on larger financial institutions. These include enhanced prudential standards applicable to us if our average total consolidated assets for four consecutive calendar quarters equal or exceed $100 billion and we are therefore classified as a category IV bank holding company. These include the potential application of enhanced prudential standards to us if our average total consolidated assets for four consecutive calendar quarters exceed $100 billion and we are therefore classified as a category IV bank holding company. Under such enhanced prudential standards, category IV bank holding companies are subject to greater regulation and supervision, including, but not limited to: certain capital planning and stress capital buffer requirements; supervisory capital stress testing conducted by the Fed biennially; and certain liquidity risk management and liquidity stress testing and buffer requirements. These also include certain resolution planning requirements applicable to our insured depository institutions if their average total assets reported over the previous four quarters equal or exceed $50 billion. Deterioration in the actual or perceived credit quality of the underlying issuers of securities or loans or the non-performance of counterparties to certain derivatives could result in losses. Our preparations for, and the application of, these enhanced prudential standards for RJF and resolution planning requirements for our depository institutions could adversely affect our results of operations and financial performance through additional capital and liquidity requirements and increased compliance costs. Our preparations for, and the application of, these enhanced prudential standards to RJF could adversely affect our results of operations and financial performance through additional capital and liquidity requirements and increased compliance costs. On July 27, 2023, U.S. banking regulators issued proposed rules that, if enacted, would result in changes to regulations applicable to bank holding companies, including higher capital requirements and eliminating the AOCI opt-out election. These proposed rules, most of which would apply to us once we are classified as a category IV bank holding company, and any revisions to the proposals could reduce our regulatory capital ratios in the future and may negatively impact our business, including through increased costs related to compliance at the time such regulations become applicable to us. These proposals, most of which would apply to us once we are classified as a category IV bank holding company, create uncertainty in planning our compliance and any revisions to the proposals may negatively impact our business, including through increased costs related to compliance at the time such regulations become applicable to us.

Changes in requirements relating to the standard of care for broker-dealers have increased, and may continue to increase, our costs.

The SEC’s Regulation Best Interest requires, among other things, a broker-dealer to act in the best interest of a retail client when making a recommendation to that client of any securities transaction or investment strategy involving securities. The regulation imposes heightened standards on broker-dealers, and we have incurred substantial costs in order to review and modify our policies and procedures, including associated supervisory and compliance controls. We anticipate that we will continue to incur incremental costs in the future to comply with the standard.

In addition to the SEC, various states have adopted, or are considering adopting, laws and regulations seeking to impose new standards of conduct on broker-dealers that, as written, differ from the SEC’s regulations and may lead to additional implementation costs. Implementation of the SEC regulations, as well as any new state rules that are adopted addressing similar matters, has resulted in (and may continue to result in) increased costs related to compliance, legal, operations and information technology. Furthermore, certain non-U.S. jurisdictions have imposed heightened standards of conduct, which may have similar impacts on our business in those jurisdictions.

Numerous regulatory changes and enhanced regulatory and enforcement activity relating to our investment management activities may increase our compliance and legal costs and otherwise adversely affect our business.

As some of our wholly-owned subsidiaries are registered as investment advisers with the SEC, increased regulatory scrutiny and rulemaking initiatives may result in additional operational and compliance costs or the assessment of significant fines or penalties against our asset management business, and may otherwise limit our ability to engage in certain activities. While it is

33

RAYMOND JAMES FINANCIAL, INC. AND SUBSIDIARIES
not possible to determine the extent of the long-term impact of any new laws or regulations that have been promulgated, or initiatives that have been or may be proposed, even the short-term impact of preparing for or implementing changes to our infrastructure and processes could negatively affect the ways we conduct business and increase our compliance and legal costs. Conformance with any new law or regulations could also make compliance more difficult and expensive and affect our product and service offerings.

Failure to comply with regulatory capital requirements primarily applicable to RJF, Raymond James Bank, TriState Capital Bank or our broker-dealer subsidiaries would significantly harm our business.

As discussed in “Item 1 - Business - Regulation” of this Form 10-K, RJF, Raymond James Bank and TriState Capital Bank are subject to capital requirements administered by various federal regulators in the U.S. and, accordingly, must meet specific capital guidelines that involve quantitative measures of RJF’s, Raymond James Bank’s, and TriState Capital Bank’s assets, liabilities and certain off-balance sheet items, as calculated under regulatory guidelines. Failure to meet minimum capital requirements can trigger certain mandatory (and potentially discretionary) actions by regulators that, if undertaken, could harm either RJF’s, Raymond James Bank’s, or TriState Capital Bank’s operations and financial condition, including precluding us from accepting or renewing brokered deposits. Further, we are subject to the SEC’s Uniform Net Capital Rule (Rule 15c3-1) and FINRA’s net capital rule, which may limit our ability to make withdrawals of capital from our broker-dealer subsidiaries. Our non-U.S. subsidiaries are subject to similar limitations under applicable regulations in the countries in which they operate. Regulatory capital requirements applicable to some of our significant subsidiaries may impede access to funds that RJF may need to make payments on any of its obligations. See Note 24 of the Notes to Consolidated Financial Statements of this Form 10-K for additional information on regulatory capital requirements. See Note 24 of the Notes to Consolidated Financial Statements of this Form 10-K for further information on regulatory capital requirements.

The Basel III regulatory capital standards impose capital and other requirements on us that could negatively impact our profitability.

The Fed and other federal banking regulators have implemented the global regulatory capital requirements of Basel III and certain requirements implemented by the Dodd-Frank Act. The U.S. Basel III Rules establish the quantity and quality of regulatory capital, set forth a capital conservation buffer, and define the calculation of risk-weighted assets. The capital requirements stipulated under the U.S. Basel III Rules could restrict our ability to grow during favorable market conditions or require us to raise additional capital. Revisions to the Basel III Rules could, when implemented in the U.S., negatively impact our regulatory capital ratio calculations or subject us to higher and more stringent capital and other regulatory requirements. As a result, our business, results of operations, financial condition and prospects could be adversely affected. See “Item 1 - Business - Regulation” of this Form 10-K for additional information on the Basel III regulatory capital standards. See “Item 1 - Business - Regulation” of this Form 10-K for further information on the Basel III regulatory capital standards.

As a financial holding company, RJF’s liquidity depends on payments from its subsidiaries, which may be subject to regulatory restrictions.

RJF as a financial holding company depends on dividends, distributions and other payments from its subsidiaries in order to meet its obligations, including its debt service obligations and to fund dividend payments and share repurchases. RJF’s subsidiaries are subject to laws and regulations that restrict dividend payments or authorize regulatory bodies to prevent or reduce the flow of funds from those subsidiaries to RJF. If RJF’s subsidiaries are unable to make dividend payments to us and sufficient cash or liquidity is not otherwise available, RJF may not be able to make dividend payments to its shareholders, repurchase its shares, or make principal and interest payments on its outstanding debt. RJF’s broker-dealers and bank subsidiaries are limited in their ability to lend or transact with affiliates, are subject to minimum regulatory capital and other requirements and, in the case of our broker-dealer subsidiaries, limitations on their ability to use funds deposited with them in brokerage accounts to fund their businesses. These requirements and limitations may hinder RJF’s ability to access funds from its subsidiaries. Federal regulators, including the Fed and the SEC (through FINRA), have the authority and under certain circumstances, the obligation, to limit or prohibit dividend payments and share repurchases by the banking organizations they supervise, including RJF and its bank subsidiaries. In addition, RJF’s right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of creditors of that subsidiary, except to the extent that any of RJF’s claims as a creditor of such subsidiary may be recognized. As a result, shares of RJF’s capital stock are effectively subordinated to all existing and future liabilities and obligations of its subsidiaries.


34

RAYMOND JAMES FINANCIAL, INC. AND SUBSIDIARIES

RISKS RELATED TO AN INVESTMENT IN OUR PREFERRED AND COMMON STOCK

The rights of holders of our common stock are generally subordinate to the rights of holders of our outstanding, and any future issuances of, debt securities and preferred stock.

Our Board of Directors has the authority to issue debt securities as well as an aggregate of up to 10 million shares of preferred stock on the terms it determines appropriate without shareholder approval. Outstanding shares of our 6.375% Fixed-to-Floating Rate Series B Non-Cumulative Perpetual Preferred Stock, par value $0.10 per share are senior to our common stock. Any debt or shares of preferred stock that we may issue in the future will also be senior to our common stock. Because our decision to issue debt or equity securities or incur other borrowings in the future will depend on market conditions and other factors beyond our control, the amount, timing, nature or success of our future capital raising efforts is uncertain. Thus, holders of our common stock bear the risk that our future issuances of debt or equity securities or our incurrence of other borrowings may negatively affect the market price of our common stock.

The depositary shares representing our preferred stock are thinly traded and have limited voting rights.

The depositary shares representing interests in our preferred stock are listed on the NYSE, but an active, liquid trading market for such securities may not be sustained, and holders of our depositary shares may not be able to sell their shares at the volume, prices, or times desired. In addition, holders of our preferred stock (and, accordingly, holders of the depositary shares representing such stock), will have no voting rights with respect to matters that generally require the approval of our voting common shareholders. Holders of preferred stock have voting rights that are generally limited to: (i) authorizing, creating or issuing any capital stock ranking senior to such preferred stock, and (ii) amending, altering or repealing any provision of our Articles of Incorporation so as to adversely affect the powers, preferences or special rights of such series of preferred stock.

ITEM 1B. UNRESOLVED STAFF COMMENTS

None.


35

RAYMOND JAMES FINANCIAL, INC. AND SUBSIDIARIES

ITEM 1C. CYBERSECURITY

Overview

Cybersecurity risk is a key operational risk facing the firm, and measures to address such risk are an important component of the firm’s overall Enterprise Risk Management (“ERM”) program. As part of our ERM program, we have implemented and maintain a program to identify, assess, and manage risks arising from cybersecurity threats (“Cybersecurity Program”). Our Cybersecurity Program seeks to mitigate cybersecurity risk and associated legal, financial, reputational, regulatory and/or operational risks by protecting our clients, associates, and services through a comprehensive, cross-functional approach. Specifically, our Cybersecurity Program is focused on preserving the confidentiality, integrity, and availability of information, enabling the secure and uninterrupted delivery of financial services, and protecting the firm and the safe operation of our technology systems. Further, we consider cybersecurity risks in our business strategy decisions, including in our business continuity planning and in connection with our acquisition activity. We seek to continually adjust our Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory requirements.

Refer to “Management’s Discussion and Analysis of Financial Condition and Results of Operations - Risk management” section of this Form 10-K for additional information on our approach to risk management, including our governance framework. Refer to “Item 1A - Risk Factors” of this Form 10-K for additional information on our cybersecurity risks.

Cybersecurity risk management process

Our Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to our network, infrastructure, computing environment, and to third parties. We periodically assess the design of our cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity, as well as global cybersecurity regulations, and we seek to implement improvements to our controls in response to that assessment. Our Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect our clients’, associates’, and firm data against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, recovery planning, and providing appropriate public disclosure of cybersecurity risks and incidents when required. In addition, we maintain a global training program for our associates about cybersecurity risks and requirements and conduct regular phishing email simulations in order to test our associates’ understanding of these risks.

Our cybersecurity strategy takes a defense-in-depth approach, with layered controls consisting of both commercially available and proprietary technologies that are intended to prevent an adversary from conducting a successful attack. Included in that approach is our Cyber Threat Center which is a critical component of our Cybersecurity Program and operates internally with the purpose of monitoring, detecting, and responding to cyber threats that could jeopardize the integrity, confidentiality, or availability of information systems. Our Cyber Threat Center operates 24 hours per day, 7 days per week, continuously monitoring our systems for signs of tampering or unauthorized activity, utilizes an incident response playbook which is based on NIST industry best practices, and includes containment and recovery procedures. Furthermore, we maintain cybersecurity insurance coverage which provides certain limited protection.

In conjunction with third-party vendors and consultants, we perform a variety of periodic risk assessment initiatives to gauge the performance of the Cybersecurity Program, to estimate our risk profile, and to assess compliance with relevant regulatory requirements. We perform periodic assessments of control efficacy through our internal risk and control self-assessment process, a variety of cyber event simulation exercises focused on the effectiveness of our incident response and crisis management procedures, and external technical assessments, including external penetration tests and “red team” engagements where third parties test our defenses. The results of these risk assessments, together with control performance findings, are used to establish priorities, allocate resources, and identify and improve controls.

In addition, our processes are designed to help identify, oversee, and mitigate cybersecurity risks associated with our use of third-party vendors. We have a supplier risk management process that includes evaluation of, and response to, cybersecurity risks at our third-party vendors, and this process covers vendor selection, onboarding, performance monitoring, and risk management. Our supplier risk management program includes policies and standards requiring that we perform cybersecurity due diligence reviews on our vendors based on the inherent risk profile of a particular supplier or service provider. We also monitor certain of our principal suppliers and service providers on an ongoing basis by conducting additional periodic reviews. Additionally, we execute agreements with our third-party vendors, independent contractor financial advisors, and firms

36

RAYMOND JAMES FINANCIAL, INC. AND SUBSIDIARIES
affiliated with us through our RCS division under which these parties contractually agree to implement certain safeguards designed to protect firm data and mitigate cybersecurity risks.

We also maintain business continuity plans that include identification of critical functions, third-party suppliers, and personnel. Our information technology department executes several disaster recovery exercises per year in order to test our capabilities and ensure that business recovery needs could be met during a real-world event. Additionally, our information technology department participates in annual crisis management exercises to test our operational responses and assess our preparedness for various scenarios, including cyber incidents. We also participate annually in industry-wide and internal exercises to test our response capabilities.

While we and our third-party vendors have experienced cybersecurity incidents, as well as adverse impacts from such incidents, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the firm, including our business strategy, results of operations, or financial condition. However, due to the evolving threat environment, we expect to continue to experience cybersecurity incidents resulting in adverse impacts with increased frequency and severity, and there can be no assurance that future cybersecurity incidents, including incidents experienced by our third-party vendors, will not have a material adverse impact on the firm, including its business strategy, results of operations, financial condition, and/or reputation. See Item 1A - Risk Factors of this Form 10-K for additional information on our cybersecurity risks.

Governance

The Board of Directors has designated its Risk Committee to assist it in overseeing management’s responsibility to implement an effective risk management framework designed to identify, assess, and manage key risks, including cybersecurity risk. As part of our ERM program, executive management, with review and oversight of the Risk Committee, establishes key risk indicators to measure ongoing alignment with the firm’s risk appetite and tolerance levels related to cybersecurity risk. Risk appetite and tolerance thresholds are periodically reviewed by management and approved by the Risk Committee. The Risk Committee receives regular presentations and reports from our Chief Information Security Officer (“CISO”), which address a wide range of cybersecurity risk topics, including emerging threats and recent developments, cybersecurity policy and standards updates, vulnerability assessments, risk assessment outcomes (including third-party and independent reviews), technology trends, and information security considerations arising with respect to the firm, our peers, and third-party vendors. Additionally, the Board of Directors receives reports at least annually on the performance of the firm’s cybersecurity risk metrics.

Under the Risk Committee’s oversight, management works closely with key stakeholders, including regulators, government agencies, peer institutions, and industry groups, and develops and invests in human talent and innovative technology in order to better manage cybersecurity risk. The firm’s cybersecurity program is led by our CISO, who, effective October 1, 2024, reports to our Chief Information Officer (“CIO”). The CISO, in coordination with our information technology, compliance (including privacy), and risk management functions, works collaboratively across the firm to implement a program designed to protect the firm’s information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the firm’s incident response and recovery plans. We maintain policies and procedures for the escalation of cybersecurity incidents assessed as potentially being or becoming material. Such incidents are escalated to a multidisciplinary group of senior leaders from our risk management, regulatory, compliance, finance, and legal teams, to assess such incidents for reporting under regulatory guidelines. In evaluating cybersecurity incidents, management considers the potential impact to our results of operations, control framework and financial condition, as well as the potential impact, if any, to our business strategy or reputation. Through ongoing communications with these teams, the CISO monitors the mitigation and remediation of cybersecurity threats and incidents in real time, and reports such threats and incidents to the Risk Committee when appropriate.

The members of management who lead our Cybersecurity Program have extensive experience in technology, cybersecurity, and information security. Our CIO has over 35 years of relevant experience, including 25 years leading technology teams at multiple global financial services institutions, and is a Certified Information Security Manager and Registered Series 99 Operations Professional. Our CISO has over 25 years of financial services industry experience, with varying positions in information technology, security, and risk management, and is a Certified Information Systems Security Professional and Registered Series 99 Operations Professional. Both our CIO and CISO also participate in various financial services industry committees and cybersecurity advisory boards.


37

RAYMOND JAMES FINANCIAL, INC. AND SUBSIDIARIES

Recently Filed
Click on a ticker to see risk factors
Ticker * File Date
CLSK 14 hours ago
ALCO 1 day, 19 hours ago
ALTX 4 days, 10 hours ago
DBMM 4 days, 10 hours ago
TMRC 4 days, 10 hours ago
FLNC 4 days, 11 hours ago
EACO 4 days, 12 hours ago
ESE 4 days, 13 hours ago
SNEX 4 days, 17 hours ago
UNEX 4 days, 20 hours ago
CNBX 4 days, 20 hours ago
CENT 6 days, 10 hours ago
LESL 6 days, 10 hours ago
DSRO 6 days, 11 hours ago
SANM 6 days, 12 hours ago
CFFN 6 days, 13 hours ago
BDX 6 days, 13 hours ago
SPH 6 days, 15 hours ago
MOG-A 6 days, 18 hours ago
ENTA 6 days, 18 hours ago
HOLX 6 days, 19 hours ago
LGYV 6 days, 19 hours ago
LEDS 6 days, 20 hours ago
AZTA 1 week ago
UGI 1 week ago
JJSF 1 week ago
RJF 1 week ago
NJR 1 week ago
ARWR 1 week ago
CASH 1 week ago
BERY 1 week ago
ADI 1 week ago
ABQQ 1 week ago
ABC 1 week ago
WWD 1 week ago
LEXX 1 week ago
SMG 1 week ago
PNNT 1 week, 1 day ago
PFLT 1 week, 1 day ago
AEHA 1 week, 1 day ago
CRNC 1 week, 1 day ago
IIIV 1 week, 1 day ago
BLBD 1 week, 1 day ago
GLDM 1 week, 1 day ago
GLD 1 week, 1 day ago
ROAD 1 week, 1 day ago
J 1 week, 1 day ago
ENRT 1 week, 4 days ago
VVV 1 week, 4 days ago
GEOS 1 week, 4 days ago

OTHER DATASETS

House Trading

Dashboard

Corporate Flights

Dashboard

App Ratings

Dashboard