Bank of America (BAC) risk factors, 2026 10-K

Bank of America's 2026 10-K lists 34 risk factors. Against the prior year's 32: 7 new, 5 dropped, 19 substantially reworded.

Risk factors listed
340 groups
New this year
7vs 32 last year
Dropped
5since the prior 10-K
Substantially reworded
19of those kept
Section length
17k wordsItem 1A

What the changes say

  • New risks emphasize subsidiary funding constraints, cross-border fragmentation, third-party operational and cybersecurity vulnerabilities, and evolving regulation.
  • Bank of America now highlights misconduct and enforcement exposure plus technology-driven competitive risk involving AI, digital assets and distributed-ledger payments.
  • 2025 updates refine housing, climate, legal, capital, ratings and macroeconomic risks, including held-for-investment mortgage exposure and U.S. sovereign ratings.

What changed since the prior 10-K

New

  • New

    fund payments on our other obligations, including debt obligations. Any inability of our subsidiaries to transfer funds, pay dividends or make payments to the parent company may adversely affect our cash flow, liquidity and financial condition

    Subsidiaries may be unable to transfer funds or dividends to the parent because of regulatory, capital, liquidity and resolution-planning restrictions.

  • New

    changes in legislation. These risks are heightened in emerging markets

    Fragmented relations with China and other trading partners could bring sanctions, tariffs, data restrictions, supply disruptions, higher costs and currency-related client credit risks.

  • New

    and reliance on, third parties and the financial services industry, including the processing and reporting of a large number of complex transactions at increasing speeds in many currencies and jurisdictions, creates additional operational risk

    Failures or damage at Bank of America or third-party systems could disrupt site access, information protection, transaction processing, services and reporting.

  • New

    security of our information and systems and strengthen threat actor capabilities in ways that are difficult to anticipate. These technologies, alone or in combination with others, may amplify the risks they pose

    Third-party technology weaknesses, software vulnerabilities and delayed incident reporting could leave Bank of America more exposed to cyberattacks and operational failures.

  • New

    We are highly regulated and subject to evolving government legislation and regulations and certain settlements, orders and agreements with government authorities from time to time

    Changing federal, state and foreign regulations and executive actions could increase costs, require more capital, restrict products and complicate reporting.

  • New

    established by our regulators and other government authorities, could result in further settlements, orders or agreements and additional fines, penalties or judgments, or material regulatory restrictions on our businesses

    Misconduct, conflicts, fiduciary failures or confidential-information misuse could trigger overlapping investigations, settlements, fines, penalties and business restrictions across jurisdictions.

  • New

    We rely on a diversified mix of businesses that deliver a broad range of financial products and services through multiple

    Rapid changes in AI, digital assets, automated trading and distributed-ledger payments could require costly product changes and weaken competitiveness.

Dropped

  • Dropped

    pay dividends or make payments to us may adversely affect our cash flow, liquidity and financial condition

  • Dropped

    Our operations and information systems and components thereof, and those of our third parties, have been, and in the

  • Dropped

    machine learning and generative AI) and robotics, increases our cybersecurity risks and exposure, including by making fraud detection and authentication more difficult

  • Dropped

    Our inability to adapt our business strategies, products and services could harm our business

  • Dropped

    widespread health emergencies or pandemics, cyberattacks, and military conflicts or other significant geopolitical events

Reworded

  • 91% rewritten

    We are subject to numerous political, economic, market, reputational, operational, compliance, legal, regulatory and other risks in the jurisdictions in which we operate

    The wording now emphasizes global political, economic and market risks, with valuation declines replacing reduced market value and weather events replacing some prior environmental wording.

  • 85% rewritten

    We may be adversely affected by weaknesses in the U.S. housing market

    The update shifts from 2024 to 2025 conditions and identifies regional housing-price dispersion plus held-for-investment residential mortgage and home equity exposures.

  • 84% rewritten

    Our risk management framework may not be effective in mitigating risk and reducing the potential for losses

    The risk taxonomy now calls concentration-related risk financial risk associated with concentration and climate risk, rather than listing concentration and climate separately.

  • 79% rewritten

    Our operations, businesses and clients could be adversely affected by climate-related matters and impacts

    The update removes the broader environmental-sustainability framing and more specifically describes physical, collateral, deposit, credit-facility, insurance and transition risks.

    Was: Our operations, businesses and clients could be adversely affected by the impacts related to climate change

  • 60% rewritten

    U.S. federal banking agencies may require increased capital and liquidity levels, which could adversely impact the Corporation

    The substantive capital and liquidity risk is unchanged; the update mainly standardizes the article before SCB.

  • 53% rewritten

    Reduction in our credit ratings could limit our access to funding or the capital markets, increase borrowing costs or trigger additional collateral or funding requirements

    The update adds U.S. sovereign debt ratings as a factor that rating agencies may consider and tightens the funding-access wording.

  • 53% rewritten

    We are subject to significant financial and reputational harm from potential liability arising from lawsuits and regulatory and government action

    The update expands the described enforcement sources to U.S. federal and state authorities, state attorneys general and foreign regulators.

    Was: We are subject to significant financial and reputational risks from potential liability arising from lawsuits and regulatory and government action

  • 47% rewritten

    macroeconomic conditions, as well as result in increased market volatility and disruptions and recessionary risk

    The update adds that central-bank actions may respond to uncertain inflation paths, while otherwise retaining the macroeconomic risk description.

    Was: macroeconomic conditions, as well as result in additional market volatility and disruptions and recessionary risk

  • 46% rewritten

    We face significant and increasing competition in the financial services industry

  • 44% rewritten

    If we are unable to access capital markets, we experience sustained net deposit outflows, or our borrowing costs increase, our liquidity and competitive position may be negatively affected

    Was: If we are unable to access the capital markets, have prolonged net deposits outflows, or our borrowing costs increase, our liquidity and competitive position will be negatively affected

  • 43% rewritten

    We could suffer operational, reputational and financial harm if our models fail to properly anticipate and manage risk

  • 42% rewritten

    We may be adversely affected by the financial markets, fiscal, monetary, and regulatory policies, and economic conditions

  • 41% rewritten

    Damage to our reputation could harm our businesses, including our competitive position and business prospects

  • 36% rewritten

    A failure in or breach of our operations or information systems, or those of third parties or the financial services industry, could cause disruptions, adversely impact our businesses, results of operations and financial condition, and cause legal or reputational harm

  • 35% rewritten

    Bank of America Corporation is a holding company, is dependent on its subsidiaries for liquidity and may be restricted from transferring funds from subsidiaries

  • 29% rewritten

    Our concentrations of credit risk could adversely affect our credit losses, results of operations and financial condition

  • 25% rewritten

    Defaults by one or more counterparties, or market uncertainty about the financial stability of one or more financial services institutions, or the financial services industry generally, could lead to market-wide liquidity disruptions, losses, defaults and related disputes and litigation

    Was: could lead to market-wide liquidity disruptions, losses, defaults and related disputes and litigation

  • 21% rewritten

    Economic or market disruptions and insufficient credit loss reserves may result in a higher provision for credit losses

  • 21% rewritten

    Changes in the structure of and relationship among the GSEs could adversely impact our business

All 34 risk factors

Headings as the filing states them, in filing order.

Other

  1. 01We may be adversely affected by the financial markets, fiscal, monetary, and regulatory policies, and economic conditions42% rewritten
  2. 02macroeconomic conditions, as well as result in increased market volatility and disruptions and recessionary risk47% rewritten
  3. 03Increased market volatility and adverse changes in financial or capital market conditions may increase our market risk
  4. 04If asset values decline, we may incur losses and negative impacts, including to capital and liquidity positions and requirements
  5. 05If we are unable to access capital markets, we experience sustained net deposit outflows, or our borrowing costs increase, our liquidity and competitive position may be negatively affected44% rewritten
  6. 06Reduction in our credit ratings could limit our access to funding or the capital markets, increase borrowing costs or trigger additional collateral or funding requirements53% rewritten
  7. 07Bank of America Corporation is a holding company, is dependent on its subsidiaries for liquidity and may be restricted from transferring funds from subsidiaries35% rewritten
  8. 08fund payments on our other obligations, including debt obligations. Any inability of our subsidiaries to transfer funds, pay dividends or make payments to the parent company may adversely affect our cash flow, liquidity and financial conditionnew
  9. 09Bank of America Corporation’s liquidity and financial condition, and the ability to pay dividends and obligations, could be adversely affected in the event of a resolution
  10. 10Economic or market disruptions and insufficient credit loss reserves may result in a higher provision for credit losses21% rewritten
  11. 11Our concentrations of credit risk could adversely affect our credit losses, results of operations and financial condition29% rewritten
  12. 12Defaults by one or more counterparties, or market uncertainty about the financial stability of one or more financial services institutions, or the financial services industry generally, could lead to market-wide liquidity disruptions, losses, defaults and related disputes and litigation25% rewritten
  13. 13We may be adversely affected by weaknesses in the U.S. housing market85% rewritten
  14. 14Our derivatives businesses may expose us to unexpected risks, which may result in losses and adversely affect liquidity
  15. 15We are subject to numerous political, economic, market, reputational, operational, compliance, legal, regulatory and other risks in the jurisdictions in which we operate91% rewritten
  16. 16changes in legislation. These risks are heightened in emerging marketsnew
  17. 17A failure in or breach of our operations or information systems, or those of third parties or the financial services industry, could cause disruptions, adversely impact our businesses, results of operations and financial condition, and cause legal or reputational harm36% rewritten
  18. 18and reliance on, third parties and the financial services industry, including the processing and reporting of a large number of complex transactions at increasing speeds in many currencies and jurisdictions, creates additional operational risknew
  19. 19security of our information and systems and strengthen threat actor capabilities in ways that are difficult to anticipate. These technologies, alone or in combination with others, may amplify the risks they posenew
  20. 20Failure to satisfy our obligations as servicer for residential mortgage securitizations, loans owned by other entities and other related losses could adversely impact our reputation, servicing costs or results of operations
  21. 21Changes in the structure of and relationship among the GSEs could adversely impact our business21% rewritten
  22. 22Our risk management framework may not be effective in mitigating risk and reducing the potential for losses84% rewritten
  23. 23We are highly regulated and subject to evolving government legislation and regulations and certain settlements, orders and agreements with government authorities from time to timenew
  24. 24established by our regulators and other government authorities, could result in further settlements, orders or agreements and additional fines, penalties or judgments, or material regulatory restrictions on our businessesnew
  25. 25We are subject to significant financial and reputational harm from potential liability arising from lawsuits and regulatory and government action53% rewritten
  26. 26U.S. federal banking agencies may require increased capital and liquidity levels, which could adversely impact the Corporation60% rewritten
  27. 27Changes in accounting standards or assumptions in applying accounting policies could adversely affect us
  28. 28Damage to our reputation could harm our businesses, including our competitive position and business prospects41% rewritten
  29. 29We face significant and increasing competition in the financial services industry46% rewritten
  30. 30We rely on a diversified mix of businesses that deliver a broad range of financial products and services through multiplenew
  31. 31We could suffer operational, reputational and financial harm if our models fail to properly anticipate and manage risk43% rewritten
  32. 32Failure to properly manage data may adversely affect our ability to manage compliance risk and business needs, and result in errors in our operations, reporting and decision-making, and compliance with LRRs
  33. 33Our operations, businesses and clients could be adversely affected by climate-related matters and impacts79% rewritten
  34. 34Our ability to attract, develop and retain qualified employees is critical to our success, business prospects and competitive position

Other Bank of America 10-Ks

  • 2025 10-K risk factors

    32 risks. Market volatility, funding access, credit losses, and asset valuations dominate Bank of America’s financial risks.

    Filed Feb 25, 2025

About this page

Item 1A of the 10-K on EDGAR was split into its risk factors and, where the company's previous 10-K is on file, each heading was matched to last year's and the text compared word for word. The headings are the filing's own. The one-line readings and the overview were written by a language model from the text of the new, dropped, and rewritten risks; they refer to risks by position and cannot misquote a heading.

Bank of America (BAC) Risk Factors: 2026 10-K, What Changed | Gloomberb