Banc of California (BANC) Risk Factors

We are subject to extensive regulation, supervision and legal requirements that affect virtually all aspects of our business and operations. The regulatory agencies governing banking organizations are focused on protecting customers, depositors, the Deposit Insurance Fund, and the overall financial stability of the United States-not our stockholders or creditors. See Item 1 -Supervision and Regulation included in this Annual Report on Form 10-K for information on the regulation and supervision framework which governs our Company and its activities. We are regularly examined and inspected by our regulators, including the FRB and DFPI. Our regulators have extensive authority and discretion in their interpretation, implementation, supervision and enforcement of their regulatory agenda, including on matters related to: - dividends or capital distributions by the Bank or the Company;- capital and liquidity requirements applicable to us, including the imposition of requirements more stringent than those required under generally applicable laws;- the types and terms of products we offer, activities we may conduct, our operations, or investments we may make;- the composition, risk characteristics, potential adverse classification, allowance and risk reserves in connection with our loans or other assets, including reclassifying assets;- level of our deposit insurance premiums;- our deposit-gathering and other funding sources;- the quality of our board and management oversight;- the effectiveness of our risk management and compliance program, including with respect to consumer protection, information technology, cybersecurity, third-party risk management, anti-money laundering and sanctions;- the Bank's commitment to helping meet the credit needs of low- and moderate-income neighborhoods under the CRA;- their willingness to approve applications, such as the establishment of new branches, the commencement of new activities, or the conduct of mergers and acquisitions; and - our rate of growth and other expansionary or strategic initiatives. Also, failure by the Company to meet the applicable eligibility requirements for financial holding company status (including capital and management requirements and that the Bank maintain at least a "Satisfactory" CRA rating) may result in restrictions on certain activities of the Company, including the commencement of new activities and mergers with or acquisitions of other financial institutions and could ultimately result in the loss of financial holding company status. We must devote substantial time and resources to compliance and meeting our regulators' supervisory expectations, which may adversely affect our ability to operate profitably or to pursue advantageous business opportunities. Congress, state legislatures and federal and state agencies continually review banking, lending and other laws, regulations and policies for possible changes. We face the risk of becoming subject to new or more stringent requirements in connection with the introduction of new regulations or modifications of existing regulations, which could require us to hold more capital or liquidity or have other adverse effects on our businesses or profitability. Any change in such regulation and oversight, whether in the form of regulatory policy, new regulations or legislation, that applies to us or additional deposit insurance premiums could have a material adverse impact on our operations. Because our business is highly regulated, the laws and applicable regulations are subject to frequent change. Any new laws, rules and regulations such as the California Consumer Privacy Act (the "CCPA") and the Colorado Privacy Act could make compliance more difficult, expensive, costly to implement or may otherwise adversely affect our business, financial condition or growth prospects. Such changes could subject us to additional costs, limit the types of financial services and products we may offer and/or increase the ability of non-banks to offer competing financial services and products, among other things. Also, the FRB regulates the supply of money and credit in the United States. Its fiscal and monetary policies determine in a large part our cost of funds for lending and investing and the return that can be earned on those loans and investments, both of which affect our net interest margin. FRB policies can also materially affect the value of financial instruments that we hold, such as debt securities, certain mortgage loans held-for-sale and MSRs. Its policies also can affect our borrowers, potentially increasing the risk that they may fail to repay their loans or satisfy their obligations to us. Changes in policies of the FRB are beyond our control and the impact of changes in those policies on our activities and results of operations can be difficult to predict.

We are subject to changes in tax law that could increase our effective tax rates. These law changes may be retroactive to previous periods and as a result could negatively affect our current and future financial performance. In particular, the Tax Cuts and Jobs Act, which was signed into law in December 2017, includes a number of provisions impacting the banking industry and the borrowers and the market for residential and commercial real estate. Changes include a lower limit on the deductibility of interest on residential mortgage loans and home equity loans; a limitation on the deductibility of business interest expense; a limitation on the deductibility of property taxes and state and local income taxes, etc. The law's limitation on the mortgage interest deduction and state and local tax deduction for individual taxpayers has increased the after-tax cost of owning a home for many of our existing clients. The value of the properties securing loans in our loan portfolio may be adversely impacted as a result of the changing economics of home ownership, which could require an increase in our provision for loan losses, which would reduce our profitability and could materially adversely affect our business, financial condition, and results of operations. Further, these changes implemented by this tax law could make some businesses and industries less inclined to borrow, potentially reducing demand for our commercial loan products. Finally, we may be negatively impacted more than our competitors because our business strategy focuses on California, which has a higher cost real estate market compared to other states. We are also subject to potential tax audits in various jurisdictions and in such event, tax authorities may disagree with certain positions we have taken and assess penalties or additional taxes. While we assess regularly the likely outcomes of these potential audits, there can be no assurance that we will accurately predict the outcome of a potential audit, and an audit could have a material adverse impact on our business, results of operations, and financial condition.

Robust demand, labor shortages, and supply chain constraints have led to persistent inflationary pressures throughout the economy. In response to these inflationary pressures, the FRB has raised benchmark interest rates in the past two years and may continue raising interest rates in response to economic conditions, particularly a continued high rate of inflation. However, in the final three policy meetings of 2023, the FRB left rates unchanged, and in January 2024, the FRB signaled that it could begin cutting interest rates in the year 2024 if there is continuing evidence that inflation has been stabilized on a sustained basis. Amidst these uncertainties, including potential recessionary economic conditions, financial markets have continued to experience volatility. Changes in interest rates can affect numerous aspects of our business and may impact our future performance. Prolonged periods of inflation have impacted, and may continue to impact, our profitability by negatively impacting our costs and expenses, including increasing funding costs and expense related to talent acquisition and retention, and negatively impacting the demand for our products and services. Additionally, inflation has led to, and may continue to lead to, a decrease in consumer and clients purchasing power and negatively affect the need or demand for our products and services. If significant inflation continues, our business could be negatively affected by, among other things, increased default rates leading to credit losses which could decrease our appetite for new credit extensions. If financial markets remain volatile, this may impact the future performance of various segments of our business, including the value of our investment securities portfolio. We continue to closely monitor economic conditions and the pace of inflation and the impacts of inflation on the larger market, including labor and supply chain impacts. Any of the effects of these adverse economic conditions would likely have an adverse impact on our earnings, with the significance of the impact generally depending on the nature and severity of such adverse economic conditions.

In connection with our merchant acquiring and payment processing business, we face potential chargeback liability for fraudulent payment transactions initiated by merchants or others. In the event a transaction dispute between a cardholder and a merchant is not resolved in favor of the merchant, the transaction is normally charged back to the merchant and the purchase price is refunded to the cardholder. If we are unable to collect such amounts from the merchant, either due to their refusal, closure, bankruptcy, or otherwise, we are responsible to the card issuing bank for the amount of the refund paid to the cardholder. Failure to effectively manage these risks and prevent fraud could increase our chargeback liability or other liabilities due to merchant failures. Increases in chargebacks or other liabilities not paid by our merchants could have a material adverse effect on our business, financial condition, and results of operations.

Our cybersecurity measures may not be sufficient to mitigate losses or exposure to cyber-attack or cyber theft. Communications and information systems are essential to the conduct of our business, as we use such systems to manage our client relationships, our general ledger and virtually all other aspects of our business as well as process customer and merchant payments via the Deepstack platform. Our operations rely on the secure processing, storage, and transmission of confidential and other information in our computer systems and networks. Although we take protective measures and endeavor to modify them as circumstances warrant, the security of our computer systems, software, and networks are vulnerable to breaches, unauthorized access either directly or indirectly through our vendors, misuse, computer viruses, or other malicious code and other types of cyber-attacks. If one or more of these events occur, this could jeopardize our clients' confidential and other information that we process and store, or otherwise cause interruptions in our operations or the operations of our clients or counterparties. In addition, the U.S. banking regulatory agencies recently adopted a rule requiring us to notify the FRB within 36 hours of any significant computer security incident, and in July 2023, the SEC adopted new rules that require reporting on Form 8-K of material cybersecurity incidents. Several states and their governmental agencies also have adopted or proposed cybersecurity laws. Privacy laws in the State of California and the State of Colorado, for example, require regulated entities to establish measures to identify, manage, secure, track, produce, and delete personal information. The occurrence of cyber-attacks may require us to expend significant additional resources to modify our protective measures or to investigate and remediate vulnerabilities or other exposures, and we may be subject to litigation and financial losses that are either not insured against or not fully covered through our current insurance policies. If a cyber-attack succeeds in disrupting our operations or disclosing confidential data, we could also suffer significant reputational damage in addition to possible regulatory fines or client lawsuits. We provide internet banking services to our clients which have additional cyber risks related to our client's personal electronic devices and electronic communication. Any compromise of personal electronic device security could jeopardize the confidential information of our clients (including user names and passwords) and expose our clients to account take-overs and the possibility for financial crimes such as fraud or identity theft and deter clients from using our internet banking services. We rely on and employ industry-standard tools and processes to safeguard data. These precautions may not protect our systems from future vulnerabilities, data breaches or other cyber threats. Losses due to unauthorized account activity could harm our reputation and may have a material adverse effect on our business, financial condition, results of operations, and prospects. Our security measures may not protect us from systems failures or interruptions. While we have established policies and technical controls to prevent or limit the impact of systems failures and interruptions, there are no absolute assurances that such events will not occur or that the resulting damages will be adequately mitigated. We rely on communications, information, operating and financial control systems technology from third party service providers, and we may suffer an interruption in those systems. We outsource certain aspects of our data processing and operational functions to third party service providers. If our third party service providers encounter difficulties, or if we have difficulty in communicating with them, our ability to adequately process and account for transactions could be affected, and our business operations could be adversely impacted. The occurrence of any systems failure or interruption could damage our reputation and result in a loss of clients and business, could subject us to additional regulatory scrutiny, or could expose us to legal liability. Any of these occurrences could have a material adverse effect on our financial condition and results of operations. We rely heavily on third party service providers for much of our communications, information, operating and financial control systems technology, including our online banking services and data processing systems. We rely on third party service providers to help ensure the confidentiality of our client information and acknowledge the additional risks these third parties expose us to. Third party service providers may experience unauthorized access to and disclosure of our consumer or client information or result in the destruction or corruption of Company information. In addition, we are exposed indirectly through our third party service providers who may experience their own cyber breach and as a result compromise our data and/or lead to service interruptions. Any failure or interruption, or breaches in security, of these systems could result in failures or interruptions in our client relationship management, general ledger, deposit, loan origination and servicing systems, thereby harming our business reputation, operating results, and financial condition. Additionally, interruptions in service and security breaches could lead existing clients to terminate their banking relationships with us and could make it more difficult for us to attract new banking clients in the future.