Atlantic Union Bankshares (AUB) Risk Factors

Before the proposed merger and related subsidiary bank merger may be completed, various approvals, consents and non-objections must be obtained from bank regulatory authorities, including the Federal Reserve. In determining whether to grant these approvals, regulatory authorities consider a variety of factors, including the regulatory standing of each party. These approvals could be delayed or not obtained at all, including due to any or all of the following: an adverse development in any party's regulatory standing or any other factors considered by regulators in granting such approvals; governmental, political or community group inquiries, investigations or opposition; or changes in legislation or the political or regulatory environment generally, including as a result of changes of the U.S. executive administration, or Congressional leadership and regulatory agency leadership. Even if the approvals are granted, they may impose terms and conditions, limitations, obligations or costs, or place restrictions on the conduct of the combined company's business or require changes to the terms of the transactions contemplated by the merger agreement. There can be no assurance that regulators will not impose any such conditions, limitations, obligations or restrictions or that such conditions, limitations, obligations or restrictions will not have the effect of delaying the completion of any of the transactions contemplated by the merger agreement, imposing additional material costs on or materially limiting the revenues of the combined company following the merger or otherwise reduce the anticipated benefits of the merger if the merger were completed successfully within the expected timeframe. In addition, there can be no assurance that any such conditions, limitations, obligations or restrictions will not result in the delay or abandonment of the merger. The completion of the merger is conditioned on the receipt of the requisite regulatory approvals without the imposition of any materially burdensome regulatory condition and the expiration of all statutory waiting periods. Additionally, the completion of the merger is conditioned on the absence of certain orders, injunctions or decrees issued by any court or any governmental entity of competent jurisdiction that would prevent, prohibit or make illegal the completion of the merger, the related subsidiary bank merger or any of the other transactions contemplated by the merger agreement. Despite the parties' expected commitment to use their reasonable best efforts to respond to any request for information and resolve any objection that may be asserted by any governmental entity with respect to the merger agreement, neither party is required under the terms of the merger agreement to take any action, commit to take any action, or agree to any condition or restriction in connection with obtaining these approvals, that would reasonably be expected to have a material adverse effect on the combined company and its subsidiaries, taken as a whole, after giving effect to the proposed merger (measured on a scale relative only to the size of Sandy Spring and its subsidiaries, taken as a whole (without the Company and its subsidiaries)).

From time to time, we are, or may become, the subject of self-regulatory agency information-gathering requests, reviews, investigations and proceedings, and other forms of regulatory inquiry, including by bank regulatory agencies, the SEC and law enforcement authorities. The results of such proceedings could lead to significant civil or criminal penalties, including monetary penalties, damages, adverse judgments, settlements, fines, injunctions, restrictions on the way we conduct our business, or reputational harm.

We operate in a competitive market for financial services and face intense competition from other financial institutions both in making loans and attracting deposits, which can greatly affect pricing for our products and services and could adversely affect our cost of funds. Our primary competitors include community, regional, national and internet banks, as well as credit unions and mortgage companies. Many of these financial institutions are significantly larger and have established customer bases, greater financial resources, and higher lending limits. In addition, credit unions are exempt from corporate income taxes, providing a significant competitive pricing advantage compared to banks. In addition, as customer preferences and expectations continue to evolve, technology has lowered barriers to entry and made it possible for nonbanks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. In addition, many of these nonbank competitors are not subject to the same extensive federal regulations that govern bank holding companies and federally insured banks. As a result, some of our competitors have the ability to offer products and services that we are unable to offer or to offer such products and services at more competitive rates.

In deciding whether to extend credit or to enter into other transactions with clients and counterparties, we may rely on information furnished to us by or on behalf of clients and counterparties, including financial statements and other financial information, which we do not independently verify. We also may rely on representations of clients and counterparties as to the accuracy and completeness of that information and, with respect to financial statements, on reports of independent auditors. For example, in deciding whether to extend credit to clients, we may assume that a customer's audited financial statements conform to GAAP and present fairly, in all material respects, the financial condition, results of operations, and cash flows of the borrower. Our earnings are significantly affected by our ability to properly originate, underwrite and service loans. Our financial condition and results of operations could be negatively impacted to the extent we incorrectly assess the creditworthiness of borrowers due to our reliance on financial statements that do not comply with GAAP or are materially misleading.

Our reputation is critical to the success of our business. As such, we strive to conduct our business in a manner that enhances our reputation. We do this, in part, by recruiting, hiring and retaining employees who share our core values of being an integral part of the communities we serve; delivering superior service to our customers; and caring about our customers and employees. Damage to our reputation could undermine the confidence of our current and potential customers in our ability to provide financial services. Such damage could also impair the confidence of our counterparties and business partners, and ultimately affect our ability to effect transactions. Maintenance of our reputation depends not only on our success in maintaining our core values and controlling and mitigating the various risks described herein, but also on our success in identifying and appropriately addressing issues that may arise in areas such as potential conflicts of interest, anti-money laundering, client personal information and privacy issues, record-keeping, regulatory investigations and any litigation that may arise from the failure or perceived failure of us to comply with legal and regulatory requirements. Additionally, whereas negative publicity once was driven primarily by adverse news coverage in traditional media, the widespread use of social media platforms by us, our employees, third parties, and others, facilitates the rapid dissemination of information or misinformation, which may increase the risk of negative publicity and potential harm to our reputation. If our reputation is negatively affected, by the actions of our employees or otherwise, our business and, therefore, our operating results may be materially adversely affected. Further, negative public opinion can expose us to litigation and regulatory action as we seek to implement our growth strategy, which could adversely affect our business, financial condition and results of operations.

Our computer systems and network infrastructure and those of third parties, on which we are highly dependent, are subject to security risks and could be susceptible to cyber-attacks, such as denial of service attacks, hacking, social engineering attacks targeting our employees and customers, malware intrusion or data corruption attempts, terrorist activities or identity theft. Our business relies on the secure processing, transmission, storage and retrieval of confidential, proprietary and other information in our computer and data management systems and networks, and in the computer and data management systems and networks of third parties. In addition, to access our network, products and services, our customers and other third parties may use personal mobile devices or computing devices that are outside of our network environment and are subject to their own cybersecurity risks. We, our customers, regulators and other third parties, including other financial services institutions and companies engaged in data processing, have been subject to, and are likely to continue to be the target of, cyber-attacks. These cyber-attacks include computer viruses, malicious or destructive code, phishing attacks, denial of service attacks, ransomware, improper access by employees or service providers, attacks on personal email of employees, ransom demands to not expose security vulnerabilities in our systems or the systems of third parties or other security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary and other information of ours, our employees, our customers or of third parties, damage our systems or otherwise materially disrupt our or our customers' or other third parties' network access or business operations. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities or incidents. Despite efforts to ensure the integrity of our systems and implement controls, processes, policies, and other protective measures, we may not be able to anticipate all security breaches, nor may we be able to implement guaranteed preventive measures against such security breaches. Cyber threats are rapidly evolving, and we may not be able to anticipate or prevent all such attacks and could be held liable for any security breach or loss. Cybersecurity risks for banking organizations have significantly increased in recent years, in part because of the proliferation of new technologies and the use of the internet and telecommunications technologies to conduct financial transactions. Cybersecurity risks have also significantly increased in recent years in part due to the increased sophistication and activities of organized crime affiliates, terrorist organizations, hostile foreign governments, disgruntled employees or service providers, activists, and other external parties, including those involved in corporate espionage. Targeted social engineering attacks and "spear phishing" attacks are becoming more sophisticated and are extremely difficult to prevent. In such an attack, an attacker will attempt to fraudulently induce employees, customers, or other users of our systems to disclose sensitive information in order to gain access to its data or that of its clients. In addition, our customers access our products and services using personal devices that are necessarily external to our security control systems. There has also been a significant proliferation of consumer information available on the internet resulting from breaches of third-party entities, including personal information, log-in credentials, and authentication data. While we were not directly involved in these third-party breach events, the stolen information can create a threat for our customers if their Bank log-in credentials are the same as or similar to the credentials that have been compromised on other internet sites. This threat could include the risk of unauthorized account access, data loss and fraud. The use of artificial intelligence, "bots" or other automation software can increase the velocity and efficacy of these types of attacks. As our employees are currently operating under our hybrid work model, our remote interaction with service providers, partners and other third parties on systems, networks, and environments over which we have less control increases our cybersecurity risk exposure. We will likely face an increasing number of attempted cyber-attacks as we expand our mobile and other internet-based products and services, as well as our usage of mobile and cloud technologies and as we provide more of these services to a greater number of retail banking customers. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cyber criminals change frequently, may not be recognized until launched and may not be recognized until well after a breach has occurred. The risk of a security breach caused by a cyber-attack at a service provider or by unauthorized service provider access has also increased in recent years. Additionally, the existence of cyber-attacks or security breaches at third-party service providers with access to our data may not be disclosed to us in a timely manner. We also face indirect technology, cybersecurity and operational risks relating to the customers, clients and other third parties with whom we do business or upon whom we rely to facilitate or enable our business activities, including, for example, financial counterparties, regulators, providers of critical infrastructure such as internet access and electrical power, and software providers. As a result of increasing consolidation, interdependence and complexity of financial entities and technology systems, a technology failure, cyber-attack or other information or security breach that significantly degrades, deletes, or compromises the systems or data of one or more financial entities could have a material impact on counterparties or other market participants, including us. This consolidation, interconnectivity and complexity increases the risk of operational failure, on both individual and industry-wide bases, as disparate systems need to be integrated, often on an accelerated basis. Any third-party technology failure, cyber-attack or other information or security breach, termination or constraint could, among other things, adversely affect our ability to effect transactions, service our clients, manage our exposure to risk or expand our business. In addition, we, our employees and our customers, are increasingly transitioning our and their computing infrastructure to cloud-based computing, storage, data processing, networking and other services, which may increase these security risks. Cyber-attacks or other information or security breaches, whether directed at us or third parties, may result in a material loss or have material consequences. Furthermore, the public perception that a cyber-attack on our systems has been successful, whether or not this perception is correct, may damage our reputation with customers and third parties with whom we do business. Hacking of personal information and identity theft risks, in particular, could cause serious reputational harm. A successful penetration or circumvention of system security could cause us serious negative consequences, including our loss of customers and business opportunities, significant business disruption to our operations and business, misappropriation or destruction of our confidential information and/or that of our customers and/or other third parties, or damage to our or our customers' and/or third parties' computers or systems, and could result in a violation of applicable privacy laws and other laws, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in our security measures, reputational damage, reimbursement or other compensatory costs, additional remediation and/or compliance costs, increased insurance premiums and could adversely impact our results of operations, liquidity, and financial condition. Although to date we have not experienced any material losses related to cyber-attacks or other information security breaches, there can be no assurance that we will not suffer such losses in the future.

The financial services industry is continually undergoing technological change with frequent introductions of new technology-driven products and services, and we anticipate that new technologies will continue to emerge. Our continued success depends, in part, on our ability to address the needs of our customers by using technology to provide products and services that satisfy customer demands and create efficiencies in our operations. Developing or acquiring access to new technologies and incorporating those technologies into our products and services, or using them to expand our products and services, may require significant investments, may take considerable time to complete, and ultimately may not be successful. If we fail to maintain or enhance our competitive position with respect to technology, whether because of a failure to anticipate customer expectations, substantially fewer resources to invest in technological improvements than our larger competitors, or because our technological developments fail to perform as desired or are not rolled out in a timely manner, we may lose market share or incur additional expense. In addition, any future implementation of technological changes and upgrades to maintain current systems may cause operational and customer challenges upon implementation and for some time afterwards. Key challenges include service interruptions, transaction processing errors and system conversion delays, which may cause us to lose customers or fail to comply with applicable laws, and may cause us to incur additional expenses, which may be substantial and could have a material adverse effect on our business, financial condition, results of operations, and future prospects.