Axos Financial (AX) Risk Analysis

We operate in a highly regulated industry and are subject to oversight, regulation and examination by federal and/or state governmental authorities under various laws, regulations and policies, which impose requirements or restrictions on our operations, capitalization, payment of dividends, mergers and acquisitions, investments, loans and interest rates charged and interest rates paid on deposits. We must also comply with federal anti-money laundering, bank secrecy, tax withholding and reporting, and various consumer protection statutes and regulations. A considerable amount of management time and resources is devoted to oversight of, and development, implementation and execution of controls and procedures relating to, compliance with these laws, regulations and policies. The laws, rules, regulations and supervisory policies governing our business are intended primarily for the protection of our depositors, our customers, the financial system and the FDIC insurance fund, not our stockholders or other creditors and are subject to regular modification and change. New or amended laws, rules, regulations and policies, including those resulting from changes in U.S. Presidential administration, could impact our operations, increase our capital requirements or substantially restrict our growth and adversely affect our ability to operate profitably by making compliance more difficult or expensive, restricting our ability to originate or sell loans, or impacting the amount of interest or other charges or fees earned on loans or other products. It is difficult to predict future changes in regulation or the competitive impact that any such changes would have on our business. Any new laws, rules and regulations could make compliance more difficult, expensive, costly to implement or may otherwise adversely affect our business, financial condition or growth prospects. Other changes to statutes, regulations, or regulatory policies, including changes in interpretation or implementation of statutes, regulations, or policies, could affect us in substantial and unpredictable ways including subjecting us to additional costs, limiting the types of financial services and products we may offer, and increasing the ability of non-banks to offer competing financial services and products. The Bank Secrecy Act, the USA PATRIOT Act, and similar laws and regulations require financial institutions, among other duties, to institute and maintain effective anti-money laundering programs and to file suspicious activity and currency transaction reports as appropriate. The Financial Crimes Enforcement Network, a bureau of the United States Department of Treasury, is authorized to impose significant civil money penalties for violations of those requirements and has engaged in coordinated enforcement efforts with the individual federal banking regulators, as well as the U.S. Department of Justice, Drug Enforcement Administration and the Internal Revenue Service. There is increased scrutiny of compliance with the rules enforced by the OFAC. Federal and state bank regulators have focused on compliance with the Bank Secrecy Act and anti-money laundering regulations. Several banking institutions have received large fines, or suffered limitations on their operations, for non-compliance with these laws and regulations. Although we have developed policies, procedures and processes designed to assist in compliance with these laws and regulations, no assurance can be given that these policies, procedures and processes will be effective in detecting violations of these laws and regulations. If our policies, procedures, processes and systems are deemed deficient, we may be subject to liability, including fines and regulatory actions such as restrictions on our ability to pay dividends and the necessity to obtain regulatory approval to proceed with acquisitions and other strategic transactions, which could negatively impact our business, financial condition, results of operations and prospects. Failure to maintain and implement adequate programs to combat money laundering and terrorist financing could have material adverse reputational consequences for us. State regulators have been increasingly active in implementing privacy and cybersecurity standards and regulations. Many states have also recently implemented or modified their data breach notification and data privacy requirements. New laws or changes to existing laws, including privacy-related enforcement activity, increase our operating and compliance costs (including technology costs) and could reduce income from certain business initiatives or restrict our ability to provide certain products and services. Our failure, or perceived failure, to comply with privacy policies, or applicable data protection and information security laws, regulations, rules, standards or contractual obligations, could result in significant regulatory or governmental investigations or actions, litigation, fines, sanctions, and damage to our reputation, which could have a material adverse effect on our business, financial condition or results of operations. Our failure to comply with current, or adapt to new or changing, laws, regulations or policies could result in enforcement actions and sanctions against us by regulatory agencies, civil money penalties and/or reputation damage, along with corrective action plans required by regulatory agencies, any of which could have a material adverse effect on our business, financial condition and results of operations, and the value of our common stock.

We are subject to various privacy, information security and data protection laws and regulations, such as the GLBA, which among other things requires privacy disclosures and maintenance of a robust security program. These laws and regulations are rapidly evolving and growing in complexity, and could have a significant impact on our current and planned privacy, data protection and information security-related practices, our collection, use, sharing, retention and safeguarding of consumer and employee information, and some of our current or planned business activities. The costs of compliance with these laws or regulatory actions may increase our operational costs, restrict our ability to provide certain products and services, reduce income from certain business initiatives, or result in interruptions or delays in the availability of systems. Concerns about our practices with regard to the collection, use, disclosure or security of personal information of our customers or other privacy related matters, even if unfounded, could damage our reputation and results of operations. While we strive to comply with all applicable data protection laws and regulations, as well as our own posted privacy policies, any failure or perceived failure to comply may result in proceedings or actions against us by government entities or others, or could cause us to lose customers, which could potentially have an adverse effect on our business. Misconduct by employees and third-party vendors could also result in fraudulent, improper or unauthorized activities on behalf of clients or improper use of confidential personal information. The Company may not be able to prevent employee errors or misconduct, and the precautions the Company takes to detect this type of activity might not be effective in all cases. Employee errors or misconduct could subject the Company to civil claims for negligence or regulatory enforcement actions, including fines and restrictions on our business. As nearly all of our products and services are smartphone and internet-based, the amount of data we store for our customers on our servers (including personal information) has been increasing and will continue to increase. Any systems failure or compromise of our security that results in the release of our customers' data could seriously limit the adoption of our products and services, as well as harm our reputation and brand and, therefore, our business. We may need to expend significant resources to protect against security breaches. System enhancements and updates may create risks associated with implementing new systems and integrating them with existing ones. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our technical layers of defense can create a risk of systems disruptions and security issues. In addition, addressing certain information security vulnerabilities, such as hardware-based vulnerabilities, may affect the performance of our information technology systems. The ability of our hardware and software providers to deliver patches and updates to mitigate vulnerabilities in a timely manner can introduce additional risks, particularly when a vulnerability is being actively exploited by threat actors. The risk that these types of events could seriously harm our business is likely to increase as we add more customers and expand the number of smartphone and internet-based products and services we offer.

We rely on technology and information systems for, among other things, communications, processing customer transactions, recordkeeping and financial controls. We rely substantially upon third-party service providers for our core banking and securities transactions technology and to protect us from system failures or disruptions. This reliance may mean that we will not be able to resolve operational problems internally or on a timely basis, which could lead to customer dissatisfaction or long-term disruption of our operations. Due to our interconnectivity with these third parties, we may be adversely affected if any of them are subject to a cyber-attack or other privacy or information security event, including those arising due to the use of mobile technology or a third-party cloud environment. Our operations depend upon our ability to replace a third-party service provider if it experiences difficulties that interrupt operations or if an essential third-party service terminates. If these service arrangements are terminated for any reason without an immediately available substitute arrangement, our operations may be severely interrupted or delayed. If such interruption or delay were to continue for a substantial period of time, our business, prospects, financial condition and results of operations could be adversely affected.

We face significant risks related to various types of fraud, including fraud or theft by colleagues or outsiders and unauthorized transactions, which could result in financial loss, litigation, and damage to our reputation. We rely heavily on information provided by clients and third parties in conducting our business, and misrepresentations in this information can lead to funding loans that do not meet our expectations or on unfavorable terms. We bear the risk of loss associated with such misrepresentations, and it can be challenging to recover any monetary losses suffered. We have implemented various controls and security measures, but because of their inherent limitations, internal controls may not prevent or detect misrepresentations. Further, the failure of any of these controls could result in a failure to detect or mitigate fraud risks in a timely manner.

The brand identities that we have developed will significantly contribute to the success of our business. Maintaining and enhancing the "Axos" brands (including our other trade styles and trade names) is critical to expanding our customer base. We believe that the importance of brand recognition will increase due to the relatively low barriers to entry for our "brick and mortar" competitors in the internet-based banking market. Our brands could be negatively impacted by a number of factors, including data privacy and security issues, service outages, product malfunctions, and trademark infringement. If we fail to maintain and enhance our brands generally, or if we incur excessive expenses in these efforts, our business, financial condition and results of operations may be adversely affected.

Our business and financial results are significantly affected by the fiscal and monetary policies of the federal government of the United States and its agencies. We are particularly affected by the monetary policies of the Federal Reserve, including the regulation of the supply of money and credit in the United States. The Federal Reserve and its policies influence the availability and demand for loans and deposits, the rates and other terms for loans and deposits, the conditions in equity, fixed-income, currency, and other markets, and the value of securities and other financial instruments. Both the timing and the nature of any changes in monetary or fiscal policies, as well as their consequences for the economy and the markets in which we operate, are beyond our control and difficult to predict but could adversely affect our business and operating results. It is difficult to predict the legislative and executive regulatory changes that will result from the current Congress and Presidential Administration. President Trump and certain members of Congress have advocated for the reduction of regulation of the financial services industry. Congress and the current administration may also cause broader economic changes due to various changes in the federal government's approach to regulation and administration. New appointments to the Board of Governors of the Federal Reserve System (the "FRB") could also affect monetary policy and interest rates. Future legislation, regulation, and changes in trade and fiscal policy, including uncertainty surrounding the ongoing operations of the CFPB, could affect the banking industry as a whole, including our business and results of operations, in ways that are difficult to predict. In addition, our results of operations could be adversely affected by changes in the way in which existing statutes and regulations are interpreted or applied by courts and government agencies, including, but not limited to, changes resulting from efforts to limit the operations of the CFPB.