Banc of California (BANC) Risk Analysis

A bank holding company is required to act as a source of financial and managerial strength to its subsidiary banks and to commit resources to support its subsidiary banks. The FRB may require a bank holding company to make capital injections into, or take other action in support of, a troubled subsidiary bank at times when the bank holding company may not be inclined to do so and may charge the bank holding company with engaging in unsafe and unsound practices for failing to commit resources to such a subsidiary bank. Accordingly, we could be required to provide financial assistance to the Bank if it experiences financial distress-even if doing so is not otherwise in the best interest of the Company. Such a capital injection or other support may be required at a time when our resources are limited, and we may be required to borrow the funds to make the required capital injection. In the event of a bank holding company's bankruptcy, the bankruptcy trustee will assume any commitment by the holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank. Moreover, bankruptcy law provides that claims based on any such commitment will be entitled to a priority of payment over the claims of the holding company's general unsecured creditors, including the holders of any note obligations.

We are subject to changes in tax law that could increase our effective tax rates. These law changes may be retroactive to previous periods and as a result could negatively affect our current and future financial performance. In particular, the Tax Cuts and Jobs Act, which was signed into law in December 2017, includes a number of provisions impacting the banking industry and the borrowers and the market for residential and commercial real estate. Changes include a lower limit on the deductibility of interest on residential mortgage loans and home equity loans; a limitation on the deductibility of business interest expense; a limitation on the deductibility of property taxes and state and local income taxes, etc. The law's limitation on the mortgage interest deduction and state and local tax deduction for individual taxpayers has increased the after-tax cost of owning a home for many of our existing clients. The value of the properties securing loans in our loan portfolio may be adversely impacted as a result of the changing economics of home ownership, which could require an increase in our provision for loan losses, which would reduce our profitability and could materially adversely affect our business, financial condition, and results of operations. Further, these changes implemented by this tax law could make some businesses and industries less inclined to borrow, potentially reducing demand for our commercial loan products. Finally, we may be negatively impacted more than our competitors because our business strategy focuses on California, which has a higher cost real estate market compared to other states. We are also subject to potential tax audits in various jurisdictions and in such event, tax authorities may disagree with certain positions we have taken and assess penalties or additional taxes. While we assess regularly the likely outcomes of these potential audits, there can be no assurance that we will accurately predict the outcome of a potential audit, and an audit could have a material adverse impact on our business, results of operations, and financial condition.

Robust demand, labor shortages, and supply chain constraints have led to persistent inflationary pressures throughout the economy. In response to these inflationary pressures, beginning early in 2022, the FRB raised benchmark interest rates rapidly, causing the federal funds rate to reach a 23-year high. Although the FRB reduced its benchmark rates in September, November, and December 2024, the inflationary outlook in the United States is currently uncertain. Amidst these uncertainties, including potential recessionary economic conditions, financial markets have continued to experience volatility. Changes in interest rates can affect numerous aspects of our business and may impact our future performance. Prolonged periods of inflation have impacted, and may continue to impact, our profitability by negatively impacting our costs and expenses, including increasing funding costs and expense related to talent acquisition and retention, and negatively impacting the demand for our products and services. Additionally, inflation has led to, and may continue to lead to, a decrease in consumer and clients purchasing power and negatively affect the need or demand for our products and services. If significant inflation continues, our business could be negatively affected by, among other things, increased default rates leading to credit losses which could decrease our appetite for new credit extensions. If financial markets remain volatile, this may impact the future performance of various segments of our business, including the value of our investment securities portfolio. We continue to closely monitor economic conditions and the pace of inflation and the impacts of inflation on the larger market, including labor and supply chain impacts. Any of the effects of these adverse economic conditions would likely have an adverse impact on our earnings, with the significance of the impact generally depending on the nature and severity of such adverse economic conditions.

In connection with our merchant acquiring and payment processing business, we face potential chargeback liability for fraudulent payment transactions initiated by merchants or others. In the event a transaction dispute between a cardholder and a merchant is not resolved in favor of the merchant, the transaction is normally charged back to the merchant and the purchase price is refunded to the cardholder. If we are unable to collect such amounts from the merchant, either due to their refusal, closure, bankruptcy, or otherwise, we are responsible to the card issuing bank for the amount of the refund paid to the cardholder. Failure to effectively manage these risks and prevent fraud could increase our chargeback liability or other liabilities due to merchant failures. Increases in chargebacks or other liabilities not paid by our merchants could have a material adverse effect on our business, financial condition, and results of operations.

Our cybersecurity measures may not be sufficient to mitigate losses or exposure to cyber-attack or cyber theft. Communications and information systems are essential to the conduct of our business, as we use such systems to manage our client relationships, our general ledger and virtually all other aspects of our business as well as process customer and merchant payments via the Deepstack platform. Our operations rely on the secure processing, storage, and transmission of confidential and other information in our computer systems and networks. Although we take protective measures and endeavor to modify them as circumstances warrant, the security of our computer systems, software, and networks are vulnerable to breaches, unauthorized access either directly or indirectly through our vendors, misuse, computer viruses, or other malicious code and other types of cyber-attacks. Generative artificial intelligence is further increasing risks in this area, including by making fraud detection more difficult, particularly with detection devices that use voice recognition or authentication. The techniques used by bad actors change frequently, may not be recognized until launched, and may not be recognized until well after a breach has occurred. If one or more of these events occur, this could jeopardize our clients' confidential and other information that we process and store, or otherwise cause interruptions in our operations or the operations of our clients or counterparties. In addition, the U.S. banking regulatory agencies adopted a rule requiring us to notify the FRB within 36 hours of any significant computer security incident, and in July 2023, the SEC adopted rules that require reporting on Form 8-K of material cybersecurity incidents. Several states and their governmental agencies also have adopted or proposed cybersecurity laws. Privacy laws in the State of California and the State of Colorado, for example, require regulated entities to establish measures to identify, manage, secure, track, produce, and delete personal information. The occurrence of cyber-attacks may require us to expend significant additional resources to modify our protective measures or to investigate and remediate vulnerabilities or other exposures, and we may be subject to litigation and financial losses that are either not insured against or not fully covered through our current insurance policies. If a cyber-attack succeeds in disrupting our operations or disclosing confidential data, we could also suffer significant reputational damage in addition to possible regulatory fines or client lawsuits. We provide internet banking services to our clients which have additional cyber risks related to our client's personal electronic devices and electronic communication. Any compromise of personal electronic device security could jeopardize the confidential information of our clients (including user names and passwords) and expose our clients to account take-overs and the possibility for financial crimes such as fraud or identity theft and deter clients from using our internet banking services. We rely on and employ industry-standard tools and processes to safeguard data. These precautions may not protect our systems from future vulnerabilities, data breaches or other cyber threats. Losses due to unauthorized account activity could harm our reputation and may have a material adverse effect on our business, financial condition, results of operations, and prospects. Our security measures may not protect us from systems failures or interruptions. While we have established policies and technical controls to prevent or limit the impact of systems failures and interruptions, there are no absolute assurances that such events will not occur or that the resulting damages will be adequately mitigated. We rely on communications, information, operating and financial control systems technology from third party service providers, and we may suffer an interruption in those systems. We outsource certain aspects of our data processing and operational functions to third party service providers. If our third party service providers encounter difficulties, or if we have difficulty in communicating with them, our ability to adequately process and account for transactions could be affected, our and our clients' information may be compromised, and our business operations could be adversely impacted. We rely on third party service providers to help ensure the confidentiality of our and our clients' information and acknowledge the additional risks these third parties expose us to. Third party service providers may experience unauthorized access to and disclosure of or destruction or corruption of our or our clients' information. In addition, we are exposed indirectly through our third party service providers who may experience their own cyber breach and as a result compromise our data and/or lead to service interruptions. Any failure or interruption, or breaches in security, of these systems could result in failures or interruptions in our client relationship management, general ledger, deposit, loan origination, and servicing systems. The occurrence of any systems failure or interruption could damage our reputation and result in a loss of clients and business, could subject us to additional regulatory scrutiny, or could expose us to legal liability. Any of these occurrences could have a material adverse effect on our financial condition and results of operations. The development and use of new technologies, including artificial intelligence ("AI"), presents risks and challenges that may adversely impact our business. The banking and financial services industry continually experiences technological changes, with frequent introductions of new technology-driven products and services, including recent and rapid developments in AI. Our future success will depend, in part, upon our ability to address the needs of our clients by using technology to provide products and services that will satisfy client demands for convenience, as well as to assess the proper operation of AI models and capabilities to create additional efficiencies in our operations. We may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our clients. In addition, the implementation of technological changes and upgrades to maintain current systems and integrate new ones may also create service interruptions, transaction processing errors, and system conversion delays and may cause us to fail to comply with applicable laws. There can be no assurance that we will be able to successfully manage the risks associated with our increased dependency on technology. Failure to successfully keep pace with technological change affecting the banking and financial services industry could negatively affect our revenue and profitability. We or our third-party vendors or counterparties may develop or utilize AI in certain business processes, services, or products. The development and use of AI presents a number of risks and challenges to our business. AI models, particularly generative AI models, may produce output or take action that is incorrect, that result in the release of private, confidential, or proprietary information, that reflect biases included in the data on which they are trained, infringe on the intellectual property rights of others, or that is otherwise harmful. To the extent we utilize AI models developed by third parties, we may be dependent in part on the manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models, and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which we may have limited visibility. Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures.