Banc of California (BANC) Risk Analysis

We are subject to a variety of litigation pertaining to fiduciary and other claims and legal proceedings in the ordinary course of business and in connection with the Merger. Currently, there are certain legal proceedings pending against us in the ordinary course of business and in connection with the Merger. Such legal proceedings have caused us to incur costs and diverted the time and attention of our board and management, and may continue to do so in the future. While the outcome of any legal proceeding is inherently uncertain, we believe that any liabilities arising from pending legal matters would be immaterial based on information currently available. However, if actual results differ from our expectations, it could have a material adverse effect on the Company's financial condition, results of operations, or cash flows.

In prior years, due to weakness of the U.S. economy and, more specifically, the California economy, including higher levels of unemployment than the nationwide average and declines in real estate values, certain borrowers have been unable to meet their loan repayment obligations and, as a result, we have had to initiate foreclosure proceedings with respect to and take title to a number of real properties that had collateralized their loans. As an owner of such properties, we could become subject to environmental liabilities and incur substantial costs for any property damage, personal injury, investigation and clean-up that may be required due to any environmental contamination that may be found to exist at any of those properties, even though we did not engage in the activities that led to such contamination. In addition, if we are the owner or former owner of a contaminated site, we may be subject to common law claims by third parties seeking damages for environmental contamination emanating from the site. If we were to become subject to significant environmental liabilities or costs, our business, financial condition, results of operations, and prospects could be adversely affected.

Severe weather events, natural disasters such as earthquakes and wildfires, pandemics, epidemics and other public health crises, acts of war or terrorism (and any responses thereto), and other external events have had and could have a significant adverse impact on our ability to conduct business. Such events could affect the stability of our deposit base, impair the ability of our borrowers to repay their outstanding loans, cause significant property damage or otherwise impair the value of collateral securing our loans, and result in loss of revenue and/or cause us to incur additional expenses. The occurrence of any such event could have a material adverse effect on us or our results of operations and our financial condition. Ongoing geopolitical instability, including as a result of Russia's invasion of Ukraine and the conflict in the Middle East, has negatively impacted, and could in the future negatively impact, the global and U.S. economies, including by causing supply chain disruptions, rising prices for oil and other commodities, volatility in capital markets and foreign currency exchange rates, rising interest rates and heightened cybersecurity risks. The extent to which such geopolitical instability adversely affects our business, financial condition and results of operations, as well as our liquidity and capital profile, will depend on future developments, which are highly uncertain and unpredictable.

Liquidity is essential to our business. An inability to raise funds through deposits, borrowings, the sale of loans, and other sources has had, and could continue to have, a substantial negative effect on our liquidity. Our access to funding sources in amounts adequate to finance our activities or on terms that are acceptable to us has been, and could continue to be, impaired by factors that affect us specifically or the financial services industry or economy in general. Factors that could detrimentally impact our access to liquidity sources include a decrease in the level of our business activity as a result of a downturn in the markets in which our loans are concentrated or adverse regulatory action against us. Our ability to borrow has also been, and could continue to be, impaired by factors that are not specific to us, such as a disruption in the financial markets or negative views and expectations about the prospects for the financial services industry. The failure of other financial institutions may cause deposit outflows as customers spread deposits among several different banks so as to maximize their amount of FDIC insurance, move deposits to banks deemed "too big to fail" or remove deposits from the banking system entirely. As of December 31, 2025, approximately 28% of our deposits were uninsured and uncollateralized and we rely on these deposits for liquidity. A failure to maintain adequate liquidity could have a material adverse effect on our business, financial condition, and results of operations.

Competition in the banking and financial services industry is intense. In our market areas, we compete with commercial banks, savings institutions, mortgage brokerage firms, credit unions, finance companies, non-bank lenders, mutual funds, insurance companies, and brokerage and investment banking firms operating locally and elsewhere. Many of these competitors have substantially greater name recognition, resources and lending limits than we do and may offer certain services or prices for services that we do not or cannot provide. Our profitability depends upon our continued ability to successfully compete in our markets. Continued technological advances, including cryptocurrencies and blockchain and other distributed ledger technologies, and the growth of e-commerce have made it possible for non-depository institutions to offer products and services that traditionally were banking products, and for financial institutions and other companies to provide electronic and internet-based financial solutions, including electronic securities trading, lending and payment solutions. In addition, technological advances, including digital currencies and alternative payment methods, may diminish the importance of depository institutions and other financial intermediaries in the transfer

We provide payment processing and merchant acquiring services and are subject to extensive requirements imposed by payment card networks, NACHA, and other payment networks. Failure by us, our merchants, or third-party intermediaries to comply with these requirements, or changes in network rules or their interpretation, could result in fines, penalties, increased costs, suspension, or termination of our registrations or certifications, which could limit our ability to provide these services and adversely affect our business. In some cases, we may be required to bear fines, penalties, or other losses if we are unable to recover such amounts from merchants or other third parties. Our payment processing activities also expose us to fraud, chargebacks, and other losses arising from merchant activity, including situations in which merchants are unwilling or unable to satisfy their obligations due to financial distress, closure, or bankruptcy. In addition, our reliance on independent sales organizations, employees, third-party vendors, and technology systems increases our exposure to operational risks, including failures in oversight, execution errors, data processing or technology disruptions, cybersecurity incidents, and breakdowns in internal controls. Any of these risks, individually or in the aggregate, could have a material adverse effect on our business, financial condition, and results of operations.

Threats to our reputation can come from many sources, including adverse sentiment about financial institutions generally, unethical practices, employee misconduct, failure to deliver minimum standards of service or quality, compliance deficiencies, regulatory investigations, marketplace rumors and fraudulent activities of our clients. Negative publicity regarding our business, employees, or clients, with or without merit, may result in the loss of clients, investors and employees, costly litigation, a decline in revenues, and/or increased governmental oversight. If the public perception of financial institutions remains negative, then our reputation and business may be adversely affected by negative publicity or information regarding our business and personnel, whether or not accurate or true. Such information has in the past and may in the future be posted on social media or other Internet forums or published by news organizations and the speed and pervasiveness with which information can be disseminated through these channels, in particular social media, may magnify risks relating to negative publicity. Moreover, our customers, shareholders, employees, regulators, and other stakeholders have diverse expectations, demands, and perspective on a range of topics, including environmental and social topics, which are continuing to evolve and, in some cases, diverge. We may not be able to meet the diverse expectations and demands of all of our stakeholders, which could harm our reputation, reduce customer demand for our products and services, and subject us to legal and operational risks.

Our success, to a large extent, depends on the continued employment of our key management personnel. The unexpected loss of the services of any of these individuals could have a detrimental effect on our business. Although we have entered into employment agreements with our Chief Executive Officer and our Chief Financial Officer, no assurance can be given that these individuals, or any of our key management personnel, will continue to be employed by us. The loss of any of these individuals could negatively affect our ability to achieve our business plan and could have a material adverse effect on our results of operations and financial condition.

As of December 31, 2025, $3.3 billion, or 14%, of our total loans HFI were loans in the other residential real estate mortgage loan portfolio class, as compared with $2.8 billion, or 12%, of our total loans HFI as of December 31, 2024. This type of lending is particularly sensitive to regional and local economic conditions that significantly impact the ability of borrowers to meet their loan payment obligations, making loss levels difficult to predict. A decline in residential real estate values as a result of a downturn in the national housing markets has reduced in some areas, and may continue to reduce, the value of the real estate collateral securing these types of loans and increase the risk that we would incur losses if borrowers default on their loans. As a result, these loans may experience higher rates of delinquencies, defaults and losses, which will in turn adversely affect our financial condition and results of operations.

Our cybersecurity measures may not be sufficient to mitigate losses or exposure to cyber-attack or cyber theft. Communications and information systems are essential to the conduct of our business, as we use such systems to manage our client relationships, our general ledger and virtually all other aspects of our business as well as process customer and merchant payments via the BancEdge platform. Our operations rely on the secure processing, storage, and transmission of confidential and other information in our computer systems and networks. Although we take protective measures and endeavor to modify them as circumstances warrant, the security of our computer systems, software, and networks are vulnerable to breaches, unauthorized access either directly or indirectly through our vendors, misuse, computer viruses, or other malicious code and other types of cyber-attacks. Generative artificial intelligence is further increasing risks in this area, including by making fraud detection more difficult, particularly with detection devices that use voice recognition or authentication. The techniques used by bad actors change frequently, may not be recognized until launched, and may not be recognized until well after a breach has occurred. If one or more of these events occur, this could jeopardize our clients' confidential and other information that we process and store, or otherwise cause interruptions in our operations or the operations of our clients or counterparties. Several states and their governmental agencies also have adopted or proposed cybersecurity laws. Privacy laws in the State of California and the State of Colorado, for example, require regulated entities to establish measures to identify, manage, secure, track, produce, and delete personal information. The occurrence of cyber-attacks may require us to expend significant additional resources to modify our protective measures or to investigate and remediate vulnerabilities or other exposures, and we may be subject to litigation and financial losses that are either not insured against or not fully covered through our current insurance policies. If a cyber-attack succeeds in disrupting our operations or disclosing confidential data, we could also suffer significant reputational damage in addition to possible regulatory fines or client lawsuits. We provide internet banking services to our clients which have additional cyber risks related to our client's personal electronic devices and electronic communication. Any compromise of personal electronic device security could jeopardize the confidential information of our clients and expose our clients to account take-overs and the possibility for financial crimes such as fraud or identity theft and deter clients from using our internet banking services. The precautions we take may not protect our systems from future vulnerabilities, data breaches or other cyber threats. Losses due to unauthorized account activity could harm our reputation and may have a material adverse effect on our business, financial condition, results of operations, and prospects. Our security measures may not protect us from systems failures or interruptions. While we have established policies and technical controls to prevent or limit the impact of systems failures and interruptions, there are no absolute assurances that such events will not occur or that the resulting damages will be adequately mitigated. We rely on communications, information, operating and financial control systems technology from third-party service providers, and we may suffer an interruption in those systems. We outsource certain aspects of our data processing and operational functions to third-party service providers. If our third-party service providers encounter difficulties, or if we have difficulty in communicating with them, our ability to adequately process and account for transactions could be affected, our and our clients' information may be compromised, and our business operations could be adversely impacted. We rely on third-party service providers to help ensure the confidentiality of our and our clients' information and acknowledge the additional risks these third parties expose us to. Third-party service providers may experience unauthorized access to and disclosure of or destruction or corruption of our or our clients' information. In addition, we are exposed indirectly through our third-party service providers who may experience their own cyber breach and as a result compromise our data and/or lead to service interruptions. Any failure or interruption, or breaches in security, of these systems could result in failures or interruptions in our client relationship management, general ledger, deposit, loan origination, and servicing systems. The occurrence of any systems failure or interruption could damage our reputation and result in a loss of clients and business, could subject us to additional regulatory scrutiny, or could expose us to legal liability. Any of these occurrences could have a material adverse effect on our financial condition and results of operations. The development and use of new technologies, including artificial intelligence ("AI"), presents risks and challenges that may adversely impact our business. The banking and financial services industry is experiencing rapid technological change, including increased use of AI. We and our third-party vendors may develop or utilize AI and other emerging technologies in certain business processes, products, or services. Our ability to successfully implement and manage these technologies, or to integrate them into existing systems, may be limited and could result in service disruptions, processing errors, compliance failures, or increased operational risk. AI systems, particularly those developed or operated by third parties, may produce inaccurate or harmful outputs, improperly disclose confidential or proprietary information, reflect unintended biases, or otherwise fail to perform as intended. Our reliance on third-party technology providers may limit our visibility into or control over these risks. Any failures in the development, implementation, or use of AI or other technologies, or evolving legal and regulatory requirements governing their use, could expose us to regulatory scrutiny, litigation, financial losses, or reputational harm and adversely affect our business, financial condition, and results of operations.