Brighthouse Financial Inc

Any gaps in our policies, procedures, or processes may leave us exposed to unidentified or unanticipated risk, and our models used by our business may not operate properly and could contain errors, each of which could adversely affect our business, financial condition, or results of operations

We have developed policies, procedures and processes to enable and support the ongoing review of the actual and potential risks facing the Company. Nonetheless, our policies, procedures and processes may not be fully effective in identifying and assessing such risks, leaving us exposed to unidentified or unanticipated risks. In addition, we rely on third-party providers to administer and service many of our products, and our policies, procedures and processes may not enable us to identify and assess every risk with respect to those products, especially to the extent we rely on those providers for relevant information, including detailed information regarding the holders of our products.

We use models to manage our business and evaluate the associated risk exposures. The models may not operate properly and could contain errors related to model inputs, data, assumptions, calculations, or output that may adversely impact our results of operations. In addition, these models may not fully predict future exposures, which may be significantly greater than our historical measures indicate. For example, we use actuarial models to assist us in establishing reserves for liabilities arising from our insurance policies and annuity contracts. We periodically review the effectiveness of these models, their underlying logic, and, from time to time, implement refinements to our models based on these reviews. We implement refinements after rigorous testing and validation; even after such validation and testing, our models remain subject to inherent limitations. Accordingly, no assurances can be given as to whether or when we will implement refinements to our actuarial models, and, if implemented, whether such refinements will be sufficient. Furthermore, if implemented, any such refinements could cause us to increase the reserves we hold for our insurance policy and annuity contract liabilities. If models are misused or fail to serve their intended purposes, they could produce incorrect or inappropriate results. Business decisions based on incorrect or misused model outputs or reports could have a material adverse impact on our results of operations.

Other risk management models depend upon the evaluation of information regarding markets, clients, catastrophe occurrence, or other matters that are publicly available or otherwise accessible to us. This information may not always be accurate, complete, up-to-date, or properly evaluated. Furthermore, there can be no assurance that we can effectively review and monitor all risks or that all of our employees will follow our policies, procedures and processes, nor can there be any assurance that our policies, procedures and processes, or the policies, procedures and processes of third parties that administer or service our products, will enable us to accurately identify all risks and limit our exposures based on our assessments. In addition, if our business changes or the markets in which we operate evolve and new risks emerge, we may have to implement more extensive and perhaps different policies, procedures or processes and our risk management framework may not evolve at the same pace as those changes. See “— Risks Related to Our Business — Our variable annuity exposure risk management strategy may not be effective, may result in significant volatility in our profitability measures or may negatively affect our statutory capital.”

Any failure in cyber- or other information security systems, as well as the occurrence of events unanticipated in Brighthouse Financial’s or our third-party service providers’ disaster recovery systems and business continuity planning could result in a loss or disclosure of confidential information, damage to our reputation and impairment of our ability to conduct business effectively

We heavily rely on communications, information systems (both internal and provided by third parties), and the internet to conduct our business. We rely on these systems throughout our business for a variety of functions, including processing new business, claims, and post-issue transactions, providing information to customers and distributors, performing actuarial analyses, managing our investments and maintaining financial records. A failure in the security of such systems or a failure to maintain the security of such systems, or the confidential information stored thereon, may result in regulatory enforcement action, harm our reputation or otherwise adversely affect our ability to conduct business, our financial condition or results of operations. In addition, our continuous technological evaluations and enhancements, including changes designed to update our protective measures, may increase our risk of a breach or gap in our security, and there can be no assurance that any such efforts will be effective in preventing or limiting the impact of future cyberattacks.

We and our vendors, like other commercial entities, have been, and will likely continue to be, subject to a variety of forms of cyberattacks with the objective of gaining unauthorized access to our systems and data, or disrupting our operations. Potential attacks may include, but are not limited to, cyberattacks, phishing attacks, account takeover attempts, the introduction of computer viruses or malicious code (commonly referred to as “malware”), ransomware or other extortion tactics, denial of service attacks, credential stuffing, and other computer-related penetrations. Hardware, software or applications developed by us or received from third parties may contain exploitable vulnerabilities, bugs, or defects in design, maintenance or manufacture or other issues that could compromise information and cybersecurity. The risk of cyberattacks has also increased and may continue to increase in connection with recent geopolitical conflicts, including in Europe and the Middle East, and other geopolitical events and dynamics that may adversely disrupt or degrade our operations and may compromise our data. Malicious actors may attempt to fraudulently induce employees, customers, or other users of our systems to disclose credentials or other similar sensitive information in order to gain access to our systems or data, or that of our customers, through social engineering, phishing, mobile phone malware, and other methods.

Cybersecurity threats are rapidly evolving, and those threats and the means for obtaining access to our systems are becoming increasingly sophisticated. Cybersecurity threats can originate from a wide variety of sources including terrorists, nation states, financially motivated actors, internal actors, or third parties, such as external service providers, and the techniques used change frequently or are often not recognized until after they have been launched. The rapid evolution and increased adoption of artificial intelligence technologies may intensify our cybersecurity risks, including the deployment of artificial intelligence technologies by threat actors. There is no assurance that administrative, physical and technical controls and other preventive actions taken to reduce the risk of cyberattacks and protect our information technology will prevent physical and electronic break-ins, cyberattacks or other security breaches to such computer systems. In some cases, such physical and electronic break-ins, cyberattacks or other security breaches may not be immediately detected. If we or our vendors fail to prevent, detect, address and mitigate such incidents, this may impede or interrupt our business operations and could adversely affect our business, financial condition and results of operations.

A disaster such as a natural catastrophe, epidemic, pandemic, industrial accident, blackout, terrorist attack, cyberattack or war, unanticipated problems with our or our vendors’ disaster recovery systems (and the disaster recovery systems of such vendors’ suppliers, vendors or subcontractors), could cause our computer systems to be inaccessible to our employees, distributors, vendors or customers or may destroy valuable data. In addition, in the event that a significant number of our or our vendors’ managers were unavailable following a disaster, our ability to effectively conduct business could be severely compromised. These interruptions also may interfere with our suppliers’ ability to provide goods and services and our employees’ ability to perform their job responsibilities. Unanticipated problems with, or failures of, our disaster recovery systems and business continuity plans could have a material impact on our ability to conduct business and on our financial condition and results of operations.

A failure of our or relevant third-party (or such third-party’s supplier’s, vendor’s or subcontractor’s computer systems) computer systems could cause significant interruptions in our operations, result in a failure to maintain the security, confidentiality or privacy of sensitive data, harm our reputation, subject us to regulatory sanctions and legal claims, lead to a loss of customers and revenues, and otherwise adversely affect our business and financial results. Our cyber liability insurance may not be sufficient to protect us against all losses. See also “— Any failure to protect the confidentiality of customer, employee, or other third-party information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations.”

Our employees and those of our third-party service providers may take excessive risks which could negatively affect our financial condition and business

As an insurance enterprise, we are in the business of accepting certain risks. The individuals who conduct our business include executive officers and other members of management, sales intermediaries, investment professionals, product managers, and other associates, as well as associates of our various third-party service providers. Each of these individuals makes decisions and choices that may expose us to risk. These include decisions such as setting underwriting guidelines and standards, product design and pricing, determining what assets to purchase for investment and when to sell them, which business opportunities to pursue, and other decisions. Such individuals may take excessive risks regardless of the structure of our risk management framework or our compensation programs and practices, which may not effectively deter excessive risk-taking or misconduct. Similarly, our controls and procedures designed to monitor associates’ business decisions and prevent them from taking excessive risks, and to prevent employee misconduct, may not be effective. If our associates and those of our third-party service providers take excessive risks, the impact of those risks could harm our reputation and have a material adverse effect on our financial condition and results of operations.

Any failure to protect the confidentiality of customer, employee, or other third-party information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations

Federal and state legislatures and various government agencies have established laws and regulations protecting the privacy and security of personal information. See “Business — Regulation — Privacy and Cybersecurity Regulation.” Our third-party service-providers and our employees have access to, and routinely process, personal information through a variety of media, including information technology systems. It is possible that an employee or third-party service provider (or their suppliers, vendors or subcontractors) could, intentionally or unintentionally, disclose or misappropriate confidential personal information, and there can be no assurance that our information security policies and systems in place can prevent unauthorized use or disclosure of confidential information, including nonpublic personal information. Additionally, our data has been and could in the future be the subject of cyberattacks, and the misappropriation or intentional or unintentional inappropriate disclosure or misuse of employee or client information could occur, including as a result of us or our third-party service providers (or their suppliers, vendors or subcontractors) failing to maintain adequate internal controls or if our associates or any of our third-party service providers fail to comply with applicable policies and procedures. Any failure or perceived failure by us to comply with our privacy policies, our privacy-related obligations to customers, employees, or other third parties, or our privacy-related legal obligations, or any compromise of security that results in the unauthorized release or transfer of sensitive information, which could include personally identifiable information or other user data, may result in governmental investigations, enforcement actions, regulatory fines, litigation and public statements against us by consumer advocacy groups or others, and could cause our customers, employees, or other third parties to lose trust in us, all of which could be costly and have a material adverse effect on our business, financial condition and results of operations. See “— Any failure in cyber- or other information security systems, as well as the occurrence of events unanticipated in Brighthouse Financial’s or our third-party service providers’ disaster recovery systems and business continuity planning could result in a loss or disclosure of confidential information, damage to our reputation and impairment of our ability to conduct business effectively.” In addition, compliance with complex variations in privacy and data security laws may require modifications to current business practices, including significant technology efforts that require long implementation timelines, increased costs and dedicated resources.

Furthermore, there has been increased scrutiny as well as enacted and proposed additional regulation, including from state regulators, regarding the use of customer data. We may analyze customer data or input such data into third-party analytics in order to better manage our business. Any inquiry in connection with our analytics business practices, as well as any misuse or alleged misuse of those analytics insights, could cause reputational harm or result in regulatory enforcement actions or litigation, and any related limitations imposed on us could have a material impact on our business, financial condition and results of operations.