Bar Harbor Bankshares (BHB) Risk Analysis

Banking regulations are primarily intended to protect depositors' funds, the Federal Deposit Insurance Fund and the safety and soundness of the banking system as a whole, not shareholders. These regulations affect our lending practices, capital structure, investment practices, dividend policy and growth, among other things. Congress and federal regulatory agencies continually review banking laws, regulations and policies for possible changes. Changes to statutes, regulations or regulatory policies, including changes in interpretation or implementation of statutes, regulations or policies, could affect us in substantial and unpredictable ways. Such changes could subject us to additional costs, limit the types of financial services and products we can offer, and/or limit the pricing we can charge on certain banking services, among other things. Compliance personnel and resources may increase costs of operations and adversely impact earnings.

From time to time, customers make claims and take legal action pertaining to our performance of fiduciary responsibilities. Whether customer claims and legal action related to our performance of fiduciary responsibilities are founded or unfounded, if such claims and legal actions are not resolved in a favorable manner, they may result in significant financial liability and/or adversely affect the market perception of us and products and services as well as impact customer demand for our products and services. Failure to comply with laws, regulations or policies could result in sanctions by regulatory agencies, civil money penalties and/or reputation damage, which could have a material adverse effect on our business, financial condition and results of operations. While we have policies and procedures designed to prevent any such violations, there can be no assurance that such violations will not occur.

We are exposed to many types of operational risks, including reputational risk, legal and compliance risk, the risk of fraud or theft by employees or outsiders, and unauthorized transactions by employees or operational errors, including clerical or record-keeping errors or those resulting from faulty or disabled computer or telecommunications systems. If personal, non-public, confidential, or proprietary information of customers in our possession were to be mishandled or misused, we could suffer significant regulatory consequences, reputational damage, and financial loss. Because the nature of the financial services business involves a high volume of transactions, certain errors may be repeated or compounded before they are discovered and successfully rectified. Our necessary dependence upon automated systems to record and process transactions and its large transaction volume may further increase the risk that technical flaws or employee tampering or manipulation of those systems will result in losses that are difficult to detect. We may also be subject to disruptions of our operating systems arising from events that are wholly or partially beyond its control (e.g., computer viruses or electrical or telecommunications outages, natural disaster, pandemics, or other damage to property or physical assets), which may give rise to disruption of service to customers and to financial loss or liability. We are further exposed to the risk that its external vendors may be unable to fulfill their contractual obligations (or will be subject to the same risk of fraud or operational errors by their respective employees) and to the risk that our vendors' business continuity and data security systems prove to be inadequate. The occurrence of any of these risks could result in a diminished ability to operate (e.g., by requiring us to expend significant resources to correct the defect), as well as potential liability to customers, reputational damage, and regulatory intervention. In addition, we are dependent on our reputation within our market area, as a trusted and responsible financial company, for all aspects of our relationships with customers, employees, vendors, third-party service providers and others with whom we conduct business or potential future business, particularly because our business is primarily concentrated in Northern New England. Our actual or perceived failure, including, to (i) identify and address potential conflicts of interest, ethical issues, money-laundering, or privacy issues; (ii) meet legal and regulatory requirements applicable to the Bank and to the Company; (iii) maintain the privacy of customer and accompanying personal information; (iv) maintain adequate record keeping; (v) engage in proper sales and trading practices; and (vi) identify the legal, reputational, credit, liquidity and market risks inherent in our products; or any action of one of our employees that results in actual or perceived misconduct or error, among other things, could give rise to reputational risk that could cause harm to the Bank and our business prospects. If we fail to address any of these issues in an appropriate manner, we could be subject to additional legal risks, which, in turn, could increase the size and number of litigation claims and damages asserted or subject us to enforcement actions, fines and penalties and cause us to incur related costs and expenses. Because we primarily serve individuals and businesses located in Northern New England, any negative impact resulting from reputational harm, including any impact on our ability to attract and retain customers and employees, likely would be greater than if our business were more geographically diverse.

Our operations are dependent on the use of certain outside vendors for its day-to-day operations. Vendors may not perform in accordance with established performance standards required in their agreements for any number of reasons including a change in the vendor's senior management, financial condition, product line or mix and how they support existing customers, or simply change their strategic focus putting us at risk. While we have comprehensive policies and procedures in place to mitigate risk in all phases of vendor management from selection to performance monitoring, the failure of a vendor to perform in accordance with contractual agreements could be disruptive to our business, which could have a material adverse effect on our financial condition and results of operations.

In the ordinary course of business, we rely on electronic communications and information systems to conduct its businesses and to store sensitive data, including financial information regarding its customers. The integrity of information systems is under significant threat from cyberattacks by third parties, including through coordinated attacks sponsored by foreign nations and criminal organizations to disrupt business operations and other compromises to data and systems for political or criminal purposes. We employ an in-depth, layered, defense approach that leverages people, processes and technology to manage and maintain cybersecurity controls. Notwithstanding the strength of defensive measures, the threat from cyberattacks is severe, attacks are sophisticated and attackers respond rapidly to changes in defensive measures. Cybersecurity risks may also occur with our third-party service providers, and may interfere with their ability to fulfill their contractual obligations to us, with additional potential for financial loss or liability that could adversely affect our financial condition or results of operations. We offer our customers the ability to bank remotely and provide other technology-based products and services, which services include the secure transmission of confidential information over the Internet and other remote channels. To the extent that our customers' systems are not secure or are otherwise compromised, its network could be vulnerable to unauthorized access, malicious software, phishing schemes and other security breaches. To the extent that our activities or the activities of its customers or third-party service providers involve the storage and transmission of confidential information, security breaches and malicious software could expose us to claims, regulatory scrutiny, litigation and other possible liabilities. Information security risks have generally increased in recent years, and continue to increase, in part because of the proliferation of new technologies, the implementation of work-from-home arrangements, the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, activists, and other external parties, some of which may be linked to terrorist organizations or hostile foreign governments. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our systems or to investigate and remediate vulnerabilities. System enhancements and updates may also create risks associated with implementing and integrating new systems. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our systems can itself create a risk of systems disruptions and security issues. While to date we believe that we have not experienced a significant compromise, significant data loss or material financial losses related to cybersecurity attacks, our systems and those of our customers and third-party service providers, are under constant threat and may experience a significant event in the future. We may suffer material financial losses related to these risks or be subject to liability for compromises to its customers or third-party providers. Any such losses or liabilities could adversely affect our financial condition or results of operations, and could expose us to reputation risk, the loss of client business, increased operational costs, as well as additional regulatory scrutiny, possible litigation, and related financial liability. These risks also include possible business interruption, including the inability to access critical information and systems.

We compete with an ever-increasing array of financial service providers. See the section entitled "Competition" in Part I.  Item 1, "Business" of this Annual Report for additional competitor information. Competition from nationwide banks, as well as local institutions, continues to mount in our markets. To compete, we focus on quality customer service, making decisions at the local level, maintaining long-term customer relationships, building customer loyalty, and providing products and services designed to address the specific needs of customers. Failure to perform in any of these areas could significantly weaken our competitive position, which could adversely affect growth and profitability.