or subjecting the Funds to potential financial losses as well as additional
compliance, legal, and operational costs. Such events could negatively impact the Fund, its shareholders and the business, financial condition and performance or results of operations of the Service Providers.
The trend toward broad consumer and general public
notification of Systems failures and cybersecurity breaches could exacerbate the harm to the Fund, its shareholders and Service Provider business, financial condition and performance or results of operations. Even if we successfully protect our
Systems from failures or cybersecurity breaches, we may incur significant expenses in connection with our responses to any such events, as well as the need for adoption, implementation and maintenance of appropriate security measures. We could also
suffer harm to our business and reputation if attempted or actual cybersecurity breaches are publicized. We cannot be certain that evolving threats from cyber-criminals and other cyber-threat actors, exploitation of new vulnerabilities in our
Systems, or other developments, or data thefts, System break-ins or inappropriate access will not compromise or breach the technology or other security measures protecting our Systems.
We continue to encounter and seek to address threats of
business disruption associated with Systems failure. For example, in 2015 the then-available Columbia ETFs were for a period unable to price their portfolios due to a technology issue impacting the ETFs’ third-party administrator. In another
case, in 2014, Ameriprise Financial and other financial institutions experienced distributed denial-of-service attacks intended to disrupt clients’ online access. Ameriprise Financial was able to detect and respond to this incident without
evident loss of client assets or information, Ameriprise Financial has since worked to enhance its security capabilities and will continue to assess its ability to monitor and respond to such threats. In addition to the foregoing, the experiences of
Ameriprise Financial and its affiliates with Systems failures, cybersecurity breaches and technology threats have included, as examples, phishing scams, introductions of malware, attempts at electronic break-ins, and unauthorized payment requests.
Systems failures and cybersecurity breaches may be difficult to detect, may go undetected for long periods or may never be detected. The impact of such events may be compounded over time. Although we and the Funds evaluate the materiality of Systems
failures and cybersecurity breaches detected, we and the Funds may conclude that some such events are not material and may choose not to address them. Such conclusions may not prove to be correct.
Although we have established business continuity/disaster
recovery plans and systems (Continuity and Recovery Plans) designed to prevent or mitigate the effects of Systems and Personnel disruptions and failures and cybersecurity breaches, there are inherent limitations in Continuity and Recovery Plans.
These limitations include the possibility that certain risks have not been identified or that Continuity and Recovery Plans might not – despite testing and monitoring – operate as designed, be sufficient to stop or mitigate negative
impacts, including financial losses, or otherwise be unable to achieve their objectives. The Funds and their shareholders could be negatively impacted as a result. In addition, the Fund cannot control the Continuity and Recovery Plans of the Service
Providers. As a result, there can be no assurance that the Funds will not suffer financial losses relating to Systems or Personnel disruptions or failures or cybersecurity breaches affecting them or us in the future.
Systems and Personnel disruptions and failures and
cybersecurity breaches may necessitate significant investment to repair or replace impacted Systems. In addition, the Funds may incur substantial costs for risk management in connection with failures or interruptions of Systems, Personnel,
Continuity and Recovery Plans and cybersecurity defense measures in order to attempt to prevent any such events or incidents in the future, which, if they should occur, may be prolonged, negatively impacting business operations.
Any insurance or other risk-shifting tools available to us in
order to manage or mitigate the risks associated with Systems and Personnel disruptions and failures and cybersecurity breaches are generally subject to terms and limitations such as deductibles, coinsurance, limits and policy exclusions, as well as
risk of counterparty denial of coverage, default or insolvency. While Ameriprise Financial and its affiliates maintain cyber liability insurance that provides both third-party liability and first-party liability coverages, this insurance may not be
sufficient to protect us against all losses. In addition, contractual remedies may not be available with respect to Service Providers or may prove inadequate if available (e.g., because of limits on the liability of the Service Providers) to protect
the Funds against all losses.
Stock and other market
exchanges, financial intermediaries, and issuers of, and counterparties to, the Funds’ investments and, in the case of ETFs, market makers and authorized participants, also may be adversely impacted by Systems and Personnel disruptions and
failures and cybersecurity breaches, in their own businesses, subjecting them to the risks described here, as well as other additional or enhanced risks particular to their businesses, which could result in losses to the Funds and their
shareholders. Issuers of securities or other instruments in which the Funds invest may also experience Systems and Personnel disruptions and failures and cybersecurity breaches, which could result in material adverse consequences for such issuers,
which may cause the Funds’ investment in such issuers to lose money.
Columbia Management and its affiliates have systematically
implemented strategies to address the operating environment spurred by the COVID-19 pandemic. To promote the safety and security of our employees and to assure the continuity of our business operations, we have implemented a work from home protocol
for virtually all of our employee population, restricted business travel, and provided resources for complying with the guidance from the World Health Organization, the U.S. Centers for Disease Control and governments. Our operations teams seek to
operate without significant disruptions in service. Our pandemic strategy takes into consideration that a pandemic could be widespread and may occur in multiple waves, affecting different communities at different times with varying levels of
severity. We cannot, however, predict the impact that natural or man-made disasters, including the COVID-19 pandemic, may have on the ability of our employees and third-party service providers to continue ordinary business operations and technology
functions over near- or longer-term periods.