Carter Bankshares (CARE) Risk Analysis

The Company and the Bank are each subject to capital adequacy guidelines and other regulatory requirements specifying minimum amounts and types of capital, which each must maintain. From time to time, regulators implement changes to these regulatory capital adequacy guidelines. In addition, regulators may require the Company to maintain higher levels of regulatory capital based on the Company's condition, risk profile, or growth plans or conditions in the banking industry or economy. The Basel III capital adequacy standards applicable to the Company and the Bank impose stricter capital requirements and leverage limits than the requirements to which the Company and the Bank were subject in the past. The application of more stringent capital requirements could, among other things, result in lower returns on equity, require the raising of additional capital, and result in regulatory actions if the Company were to be unable to comply with such requirements. Furthermore, the imposition of liquidity requirements in connection with the implementation of Basel III capital adequacy standards could result in the Company having to lengthen the term of its funding, restructure its business models, and/or increase its holdings of liquid assets. Implementation of changes to asset risk weightings for risk-based capital calculations, items included or deducted in calculating regulatory capital and/or additional capital conservation buffers could result in management modifying its business strategy, and could limit the Company's ability to make distributions, including paying out dividends or buying back shares. If the Company and the Bank fail to meet these minimum capital guidelines and/or other regulatory requirements, the Company's financial condition would be materially and adversely affected.

The successful implementation of our business strategy will require us to continue to attract, hire, motivate and retain skilled personnel to develop new customer relationships as well as new financial products and services. The market for qualified management personnel is competitive, which has contributed to salary and employee benefit costs that have risen and are expected to continue to rise, which may have an adverse effect on the Company's net income (loss). In addition, the process of identifying and recruiting individuals with the combination of skills and attributes required to carry out our strategy is often lengthy, and we may not be able to effectively integrate these individuals into our operations. Our inability to identify, recruit and retain talented personnel to manage our operations effectively and in a timely manner could limit our growth or impair our ability to implement our business strategy effectively and efficiently, which could materially adversely affect our business.

The Company's business is highly dependent on the security and efficacy of our infrastructure, computer and data management systems, as well as those of third parties with whom we interact and rely upon. Cyber security risks for financial institutions have significantly increased in recent years in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties, including foreign state actors. Our operations rely on the secure processing, transmission, storage and retrieval of confidential, proprietary and other information in our computer and data management systems and networks, and in the computer and data management systems and networks of third parties. We rely on digital technologies, computer, database and email systems, software, and networks to conduct our operations. In addition, to access our network, products and services, our customers and third parties may use personal mobile devices or computing devices that are outside of our network environment. Financial services institutions have been subject to, and are likely to continue to be the target of, cyber-attacks, including computer viruses, malicious or destructive code, phishing attacks, denial of service or other security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary and other information of the institution, its associates or customers or of third parties, or otherwise materially disrupt network access or business operations. For example, denial of service attacks have been launched against a number of large financial institutions and several large retailers have disclosed substantial cyber security breaches affecting debit and credit card accounts of their customers. We have not experienced material cyber security incidents in the past, but there is no assurance that we will not experience an attack in the future. Technology failures, cyber-attacks or other information or security breaches can cause material losses or other material consequences, and even with all reasonable security efforts, not every system or network breach can be prevented or even detected. Furthermore, because some of our employees are working remotely from their homes, there is an increased risk of disruption to our operations because our employees' residential networks and infrastructure may not be as secure as our office environment. In addition to external threats, insider threats also represent a risk to us. Insiders, having legitimate access to our systems and the information contained in them, have the opportunity to make inappropriate use of the systems and information. We have policies, procedures and controls in place designed to prevent or limit this risk, but we cannot guarantee that such policies, procedures and controls fully mitigate this risk. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify and enhance our protective measures or to investigate and remediate any information security vulnerabilities or incidents. Any of these matters could result in loss of customers and business opportunities, significant disruption to our operations and business, misappropriation or destruction of our confidential information and/or that of our customers, damage to computers or systems of our customers and/or third parties, violation of applicable privacy laws and other laws, litigation, costs associated with customer notification and credit monitoring services, increased insurance premiums, regulatory fines, penalties or intervention, loss of confidence in our security measures, reputational damage, reimbursement or other compensatory costs, and additional compliance costs. In addition, any of the matters described above could adversely impact our results of operations and financial condition.

Our success depends primarily on the general economic conditions of the geographic markets in which we operate, primarily in Virginia and North Carolina. The local economic conditions in the areas where we operate have a significant impact on our commercial, real estate and construction loans, the ability of our borrowers to repay their loans and the value of the collateral securing these loans and on customer demand for loans, deposits and other bank products. A significant decline in general economic conditions, including pandemics or significant health hazards (such as the COVID-19 pandemic), inflation, recession, acts of terrorism, outbreak of hostilities (including the military conflict between Russia and Ukraine) or other international or domestic calamities, unemployment or other factors, all of which are beyond our control, could impact economic conditions and negatively affect our financial results.