Bank Of Hawaii (BOH) Risk Analysis

A prolonged period of inflation or other period of high cost of goods such as a result of tariffs given that Hawai?i imports certain goods from Mexico, Canada and other countries that may become subject to tariffs, may impact our profitability by negatively impacting our costs and expenses. Economic and inflationary pressure on consumers and uncertainty regarding the economic environment could result in changes in consumer and commercial spending, borrowing and savings habits. Such conditions could have a material adverse effect on the credit quality of our loans and our business, financial condition and results of operations.

Real estate and real estate property values play an important role for the Bank in several ways. The Bank owns or leases many real estate properties in connection with its operations, primarily located in Hawai?i with its unique weather and geology. Our business operations could suffer to the extent the Bank cannot utilize its branch network due to damage from weather or other natural disasters. Real estate is also utilized as collateral for many of our loans. A natural disaster in Hawai?i or the West Pacific could cause property values in the affected areas to fall, might limit our customers' access to adequate property insurance, or otherwise impact borrowers' ability to pay their financial obligations, any of which would increase our exposure to loan defaults and could require the Bank to record an impairment on our financial statements. In August 2023, wildfires broke out in West Maui destroying the historic town of Lahaina as well as structures and farmland in Upcountry Maui and North Kihei. Roughly 2,200 structures were lost in the fire, 85% of which were homes. Though the economic recovery has been faster than anticipated, Maui's visitor industry remains depressed as the Maui economy continues its gradual post-wildfire recovery. While loans to our customers impacted by the Maui wildfires were not material to our total loan portfolio, real estate property values in the wildfire area were negatively affected and continue to be negatively affected during the wild-fire recovery period.

We are, from time-to-time, involved in various legal proceedings arising from our normal business activities. These claims and legal actions, including supervisory actions by our regulators, could involve large monetary claims and significant defense costs. The outcome of these cases is uncertain. Substantial legal liability or significant regulatory action against us could have material financial effects or cause significant reputational harm to us, which in turn could seriously harm our business prospects. In recent years, regulatory enforcement and fines have increased across the banking and financial services sector. There is no assurance that those actions will not result in regulatory settlements or other enforcement actions against the Company or the Bank. Furthermore, a single event involving a potential violation of law or regulation may give rise to numerous and overlapping investigations and proceedings by multiple federal and state agencies and officials. In addition, if one or more financial institutions are found to have violated a law or regulation relating to certain business activities, this could lead to investigations by regulators or other governmental agencies of the same or similar activities by other financial institutions, including the Company,and large fines and remedial measures that may have been imposed in resolving earlier investigations for the same or similar activities at other financial institutions may be used as the basis for future settlements. We may be exposed to substantial uninsured liabilities, which could materially affect our results of operations and financial condition. Based on information currently available, we believe that the eventual outcome of known actions against us will not be materially in excess of such amounts accrued by us. However, in the event of unexpected future developments, it is possible that the ultimate resolution of those matters may be material to our financial results for any particular period. See Note 20 in Item 8. "Notes to the Consolidated Financial Statements" under the discussion related to Contingencies for more information.

Our business requires the collection and retention of large volumes of customer data, including payment card numbers and other personally identifiable information in various information systems that we maintain and in those maintained by third parties with whom we contract to provide data services. We also maintain important internal company data such as personally identifiable information about our employees and information relating to our operations. The integrity and protection of that customer and company data is important to us. As customer, public, legislative and regulatory expectations and requirements regarding operational and information security have increased, our operating systems and infrastructure must continue to be safeguarded and monitored for potential failures, disruptions and breakdowns. Our technologies, systems, networks and software, and those of other financial institutions have been, and are likely to continue to be, the target of cybersecurity threats and attacks, which may range from uncoordinated individual attempts to sophisticated and targeted measures directed at us. These cybersecurity threats and attacks may include, but are not limited to, attempts to access information, including customer and company information, malicious code, computer viruses and denial of service attacks that could result in unauthorized access, misuse, loss or destruction of data (including confidential customer information), account takeovers, unavailability of service or other events. These types of threats may result from human error, fraud or malice on the part of external or internal parties, intelligence-gathering by foreign governments, or from accidental technological failure internally or by our vendors. Further, to access our products and services our customers may use computers and mobile devices that are beyond our security control systems. The risk of a security breach or disruption, particularly through cyber-attack or cyber intrusion, including by computer hackers, has increased as the number, intensity and sophistication of attempted attacks and intrusions around the world have increased. Our customers and employees have been, and will continue to be, targeted by parties using fraudulent emails and other communications in attempts to misappropriate passwords, payment card numbers, bank account information or other personal information or to introduce viruses or other malware through "trojan horse" programs to our customers' devices. These communications may appear to be legitimate messages sent by the Bank or other businesses, but direct recipients to fake websites operated by the sender of the email or request that the recipient send a password or other confidential information via email or download a program. Despite our efforts to mitigate these threats through product improvements, use of encryption and authentication technology to secure online transmission of confidential consumer information, and customer and employee education, such attempted frauds against us or our merchants and our third party service providers remain a serious issue. The pervasiveness of cyber security incidents in general and the risks of cyber-crime are complex and continue to evolve. In light of several recent high-profile data breaches involving other companies' losses of customer personal and financial information, a material cybersecurity incident could cause customer and/or Bank losses, damage to our brand, and increase our costs through the ongoing cost of technology investments to improve security, as well as the potential financial and reputational impact of a cyber security incident involving the Company. Although we make significant efforts to maintain the security and integrity of our information systems and have implemented various measures to manage the risk of a security breach or disruption, there can be no assurance that our security efforts and measures will be effective or that attempted security breaches or disruptions would not be successful or damaging. Even the most well-protected information, networks, systems and facilities remain potentially vulnerable because attempted security breaches, particularly cyber-attacks and intrusions, or disruptions will occur in the future, and because the techniques used in such attempts are constantly evolving and generally are not recognized until launched against a target, in some cases are designed not to be detected and, in fact, may not be detected. Accordingly, we may be unable to anticipate these techniques or to implement adequate security barriers or other preventative measures, and thus making it virtually impossible for us to entirely mitigate this risk. A security breach or other significant disruption could: 1) disrupt the proper functioning of our networks and systems and therefore our operations and/or those of certain of our customers; 2) result in the unauthorized access to, and destruction, loss, theft, misappropriation or release of confidential, sensitive or otherwise valuable information of ours or our customers, including account numbers and other financial and personal information; 3) result in a violation of applicable privacy, data breach and other laws, subjecting the Bank to additional regulatory scrutiny and exposing the Bank to civil litigation, governmental fines and possible financial liability; 4) require significant management attention and resources to remedy the damages that result; or 5) harm our reputation or cause a decrease in the number of customers that choose to do business with us or reduce the level of business that our customers do with us. The occurrence of any such failures, disruptions or security breaches could have a negative impact on our results of operations, financial condition, and cash flows as well as damage our brand and reputation.