BayCom (BCML) Risk Analysis

The FDIC, the Federal Reserve and the Office of the Comptroller of the Currency have promulgated joint guidance on sound risk management practices for financial institutions with concentrations in commercial real estate lending. Under this guidance, a financial institution that, like us, is actively involved in commercial real estate lending, should perform a risk assessment to identify concentrations. A financial institution may have a concentration in commercial real estate lending if, among other factors, (i) total reported loans for construction, land development and other land represent 100.0% or more of total capital, or (ii) total reported commercial real estate loans (as defined in the guidance) represent 300.0% or more of total capital. The particular focus of the guidance is on exposure to commercial real estate loans that are dependent on the cash flow from the real estate held as collateral and that are likely to be at greater risk to conditions in the commercial real estate market (as opposed to real estate collateral held as a secondary source of repayment or as an abundance of caution). The purpose of the guidance is to assist banks in developing risk management practices and capital levels commensurate with the level and nature of their real estate concentrations. The guidance states that management should employ heightened risk management practices, including board and management oversight and strategic planning, development of underwriting standards, risk assessment and monitoring through market analysis and stress testing. As of December 31, 2024, the Bank's aggregate recorded loan balances for construction, land development and land loans were 2.0% of total regulatory capital, while the Bank's commercial real estate loans as calculated in accordance with regulatory guidance were 320.2% of total regulatory capital. As a result, we have concluded that we have a concentration in commercial real estate lending under the foregoing standards. While we believe we have implemented policies and procedures with respect to our commercial real estate loan portfolio consistent with this guidance, bank regulators could require us to implement additional policies and procedures consistent with their interpretation of the guidance that may result in additional costs to us.

Our security measures may not be sufficient to mitigate the risk of a cyber-attack. Communications and information systems are essential to the conduct of our business, as we use such systems to manage our client relationships, our general ledger, and virtually all other aspects of our business. Our operations rely on the secure processing, storage, and transmission of confidential and other information in our computer systems and networks. Although we take protective measures and endeavor to modify them as circumstances warrant, the security of our computer systems, software, and networks may be vulnerable to breaches, fraudulent or unauthorized access, denial or degradation of service, attacks, misuse, computer viruses, malware, or other malicious code and cyber-attacks that could have a security impact. If one or more of these events occur, this could jeopardize our or our clients' confidential and other information processed and stored in, and transmitted through, our computer systems and networks, or otherwise cause interruptions or malfunctions in our operations or the operations of our clients or counterparties. We may be required to expend significant additional resources to modify our protective measures or to investigate and remediate vulnerabilities or other exposures, and we may be subject to litigation and financial losses that are either not insured against or not fully covered through any insurance maintained by us. Security breaches in our internet banking activities could further expose us to possible liability and damage our reputation. Increases in criminal activity levels and sophistication, advances in computer capabilities, new discoveries, vulnerabilities in third party technologies (including browsers and operating systems), or other developments could result in a compromise or breach of the technology, processes and controls that we use to prevent fraudulent transactions, and to protect data about us, our clients, and underlying transactions. Any compromise of our security could deter clients from using our internet banking services that involve the transmission of confidential information. Although we have developed and continue to invest in systems and processes that are designed to detect and prevent security breaches and cyber-attacks and periodically test our security, these precautions may not protect our systems from compromises or breaches of our security measures, and could result in losses to us or our clients, our loss of business and/or clients, damage to our reputation, the incurrence of additional expenses, disruption to our business, our inability to grow our online services, or other businesses, additional regulatory scrutiny or penalties, or our exposure to civil litigation and possible financial liability, any of which could have a material adverse effect on our business, financial condition and results of operations. Our security measures may not protect us from system failures or interruptions. We have established policies and procedures to prevent or limit the impact of system breaches, failures and interruptions. In addition, we outsource certain aspects of our data processing and other operational functions to certain third-party providers. While we select third-party vendors carefully, we do not control their actions. If our third-party providers encounter difficulties, including those resulting from breakdowns or other disruptions in communication services provided by a vendor, failure of a vendor to handle current or higher transaction volumes, cyber-attacks or security breaches or if we otherwise have difficulty in communicating with them, our ability to adequately process and account for transactions could be affected, and our ability to deliver products and services to our clients and otherwise conduct business operations could be adversely impacted. Replacing these third-party vendors could also entail significant delay and expense. Threats to information security also exist in the processing of client information through various other vendors and their personnel. We cannot assure you that such breaches, failures or interruptions will not occur or, if they do occur, that they will be adequately addressed by us or the third parties on which we rely. Further, while we believe we maintain adequate insurance to cover these risks, our insurance coverage may not cover all losses resulting from breaches, system failures or other disruptions. The occurrence of any systems failure or interruption could damage our reputation and result in a loss of clients and business, could subject us to additional regulatory scrutiny, or could expose us to legal liability. Any of these occurrences could have a material adverse effect on our financial condition and results of operations.

Our financial condition and results of operations are affected by credit policies of monetary authorities, particularly the Federal Reserve.  Actions by monetary and fiscal authorities, including the Federal Reserve, could lead to inflation, deflation, or other economic phenomena that could adversely affect our financial performance. Higher U.S. tariffs on imported goods could exacerbate inflationary pressures by increasing the cost of goods and materials for businesses and consumers. This may particularly affect small to medium-sized businesses, as they are less able to leverage economies of scale to mitigate cost pressures compared to larger businesses. Consequently, our business clients may experience increased financial strain, reducing their ability to repay loans and adversely impacting our results of operations and financial condition. Furthermore, a prolonged period of inflation could cause wages and other costs to us to increase, which could adversely affect our results of operations and financial condition. Virtually all of our assets and liabilities are monetary in nature and, as a result, market interest rates tend to have a more significant impact on our performance than general levels of inflation or deflation. However, interest rates do not necessarily move in the same direction or magnitude as the prices of goods and services, creating additional uncertainty in the economic environment.