Franklin Resources (BEN) Risk Analysis

We are highly dependent upon the use of various proprietary and third-party information and security technology, software applications, external third-party services and other technology systems, and remote equipment and connectivity infrastructure, to access critical business systems necessary to operate our business. We are also dependent on the continuity and effectiveness of our information and cybersecurity infrastructure, management oversight and reporting framework, policies, procedures and capabilities to protect our computer and telecommunications systems and the data that reside on or are transmitted through them and contracted third-party systems. We use technology and third-party providers on a daily basis in our business to, among other things, support our business continuity and operations, process and transmit confidential communications, store and maintain confidential and proprietary data including personal employee and/or client data, obtain securities pricing information, process client transactions, and provide reports and other services to our clients. In addition, developments in our use of process automation and artificial intelligence further heighten our dependency on technology. Any disruptions, inaccuracies, mismanagement, delays, theft, systems failures, data security or privacy breaches, cybersecurity threats, incidents, attacks or other cyber-related fraud, or other security breaches in these and other processes, could subject us to significant client dissatisfaction and losses and damage our reputation. We and our third-party providers have been, and we expect to continue to be, the subject of these types of risks, breaches and/or attacks, as well as attempts to co-opt our brand. Ongoing advances in technology, including generative artificial intelligence, as well as the malicious use of such technology, could further heighten the risks to our business. Although we take protective measures, including measures to secure and protect information through system security technology and our internal security procedures, as well as measures to assess third-party provider security posture and controls, we can provide no assurance that any of these measures will prove effective or comply with evolving information security standards, particularly given the evolving nature and sophistication of cyber and technology threats and attacks. The technology systems we use or rely on, including those provided and/or leveraged by third-party providers, remain vulnerable to denial of service attacks, unauthorized access, computer viruses, human error and other events and circumstances that may have a security impact, such as an external or internal hacker attack by one or more cyber criminals (including through the use of social engineering, phishing attacks, malware, ransomware and other methods and activities maliciously designed to obtain and exploit confidential information and to cause system and service disruption and other damage) and to our personnel or vendors inadvertently or recklessly causing release of confidential information, which could materially harm our operations and reputation. System disruptions, failures or breaches of the technology we use or the security infrastructure we rely upon, including third-party applications and services, or our failure to properly manage, mitigate, disclose or communicate a cybersecurity incident, could result in: (i) material financial loss or costs, (ii) delays in clients' ability to access account information or in our ability to process transactions, (iii) the unauthorized disclosure or modification of sensitive or confidential client and business information, (iv) loss of valuable information, (v) breach of client and vendor contracts, (vi) liability for stolen assets, information or identity, (vii) remediation costs to repair damage caused by the failure or breach, (viii) additional security and organizational costs to mitigate against future incidents, (ix) reputational harm, (x) loss of confidence in our business and products, (xi) liability for failure to review and disclose applicable incidents or provide relevant updated disclosure properly and timely, (xii) regulatory investigations or actions, and/or (xiii) legal claims, litigation, and liability costs, any one or more of which may be material. Moreover, loss or unauthorized disclosure or transfer of confidential and proprietary data or confidential customer identification information could further harm our reputation and subject us to liability under laws that protect confidential data and personal information, resulting in increased costs or a decline in our revenues or common stock price. Further, although we take precautions to password protect and encrypt our laptops and sensitive information on our mobile electronic devices, if such devices are stolen, misplaced or left unattended, they may become vulnerable to hacking or other unauthorized use, creating a possible security risk, which may require us to incur additional administrative costs and/or take remedial actions. In addition, failure to manage and operate properly the data centers and third-party cloud storage and computing application services we use could have an adverse impact on our business. Although we have in place certain disaster recovery plans, we may experience system delays and interruptions as a result of natural disasters, power failures, acts of war, and third-party failures.