Cnb Financial (CCNE) Risk Analysis

The Corporation's financial condition and results of operations are impacted by global markets and economic conditions over which the Corporation has no control. Inflation has significantly increased since the start of 2021 and continues to remain at elevated levels compared to recent years prior to 2021, which has led to increased costs for businesses and consumers. An economic downturn or recession, including deterioration in the economic conditions in the U.S., or a slowing or stalled recovery therefrom, may have a material adverse effect on our business, financial condition or results of operations. Poor economic conditions have in the past adversely affected, and may in the future affect, the demand for the Corporation's products, the creditworthiness of the Corporation's borrowers and the value of the Corporation's investment securities and other interest-earning assets. In particular, the Corporation may face the following risks in connection with the economic or market environment: - The Corporation's and the Bank's ability to borrow from other financial institutions or to access the debt or equity capital markets on favorable terms or at all could be adversely affected by disruptions in the capital markets or other events, including actions by rating agencies and deteriorating investor expectations. - The Corporation faces increased regulation of the banking and financial services industry. Compliance with such regulation may increase its costs and limit its ability to pursue business opportunities. - Market developments may affect customer confidence levels and may cause increases in loan delinquencies and default rates, which management expects would adversely impact the Bank's charge-offs and provision for credit losses. - Market developments may adversely affect the Bank's securities portfolio by causing other-than-temporary-impairments, prompting write-downs and securities losses. - Competition in the banking and financial services industry could intensify as a result of the consolidation of financial services companies in connection with current market conditions.

The Corporation is and will continue to be dependent upon the services of its executive management team. In addition, it will continue to depend on its ability to retain and recruit key client relationship managers. The unexpected loss of services of any key management personnel, or the inability to recruit and retain qualified personnel in the future, could have an adverse effect on its business and financial condition.

The Corporation relies on certain external vendors to provide products and services necessary to maintain the day-to-day operations of the Corporation. Some of the products and services provided by vendors include key components of our business infrastructure including data processing and storage and internet connections and network access, among other products and services. Accordingly, the Corporation's operations are exposed to the risk that these vendors will not perform in accordance with the contracted arrangements or under service level agreements. The failure of an external vendor to perform in accordance with the contracted arrangements or under service level agreements, because of changes in the vendor's organizational structure, financial condition, support for existing products and services or strategic focus or for any other reason, could disrupt the Corporation's operations. If we are unable to find alternative sources for our vendors' services and products quickly and cost-effectively, the failures of our vendors could have a material adverse impact on the Corporation's business and, in turn, the Corporation's financial condition and results of operations. Additionally, our information technology and telecommunications systems interface with and depend on third-party systems, and we could experience service denials if demand for such services exceeds capacity or such third-party systems fail or experience interruptions. If sustained or repeated, a system failure or service denial could result in a deterioration of our ability to process new and renewal loans, gather deposits and provide customer service, compromise our ability to operate effectively, damage our reputation, result in a loss of customer business and subject us to additional regulatory scrutiny and possible financial liability, any of which could have a material adverse effect on our financial condition and results of operations.

In the event the Bank forecloses on a defaulted commercial or residential mortgage loan to recover its investment, it may be subject to environmental liabilities in connection with the underlying real property, which could significantly exceed the value of the real property. Although the Bank exercises due diligence to discover potential environmental liabilities prior to acquiring any property through foreclosure, hazardous substances or wastes, contaminants, pollutants, or their sources may be discovered on properties during its ownership or after a sale to a third party. The Corporation cannot assure you that the Bank would not incur full recourse liability for the entire cost of any removal and cleanup on an acquired property, that the cost of removal and cleanup would not exceed the value of the property, or that the Bank could recover any of the costs from any third party. Losses arising from environmental liabilities could have a material adverse impact on the Corporation's business, financial condition, results of operations, or liquidity.

The Corporation, primarily through the Bank, depends on its information technology networks and systems to continuously process, record and monitor a large number of customer transactions and to process, transmit and store proprietary and confidential information, including personal information of employees and customers. Accordingly, the Corporation's and its subsidiaries' information technology networks and systems must continue to be safeguarded and monitored for potential failures, vulnerabilities, disruptions and breakdowns. We face cybersecurity threats, including system, network or internet failures, cyber-attacks, ransomware and other malware, social engineering, phishing schemes and workforce member error, negligence, or fraud. Although the Corporation has business continuity plans and other safeguards in place, any such cybersecurity incident, including those impacting personal information, could result in customer attrition, regulatory fines, penalties or intervention, reputational damage, reimbursement or other compensation costs, and/or additional compliance costs, any of which could materially adversely affect the Corporation's results of operations or financial condition. Furthermore, increased regulation of data collection, use and retention practices, including self-regulation and industry standards, changes in existing laws and regulations, enactment of new laws and regulations, increased enforcement activity, and changes in interpretation of laws, could increase our cost of compliance and operation, limit our ability to grow our business or otherwise harm the Corporation. In addition, significant disruptions of our third party vendors' and/or service providers' security systems or infrastructure, or other similar data security incidents, could adversely affect our business operations and/or result in the loss, misappropriation, and/or unauthorized access, use or disclosure of, or the prevention of access to, regulated personal or confidential information, which could harm our business. While we may be entitled to damages if our third party service providers fail to satisfy their security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. Although to date the Corporation has not experienced any material losses relating to cyber attacks or cybersecurity incidents, there can be no assurance that it or its subsidiaries will not suffer such losses in the future and our information systems remain a target of cyber attacks. Given the evolving nature of security threats and evolving safeguards, there can be no assurance that any preventive, protective, or remedial data security measures that we or our third party service providers implement are or will be adequate to detect or prevent all cybersecurity incidents. Additionally, while we have implemented security measures that we believe are appropriate, a regulator could deem our security measures not to be appropriate given the lack of prescriptive measures in certain data protection laws. The Corporation continues to enhance its data security systems, technology platforms, employee education and risk management processes, in an effort to underpin its business strategy as well as in response to the evolving threat landscape and any incidents we experience. In connection with these efforts, we have incurred costs and expect to incur additional costs as we continue to enhance our data security infrastructure and take further steps to prevent unauthorized access to our systems and the data we maintain. In addition, any actual or perceived failure by the Corporation or our vendors or business partners to comply with our privacy, confidentiality, or data security-related legal or other obligations to third parties may result in claims by third parties that we have breached our privacy- or confidentiality-related obligations, which could materially and adversely affect our business and prospects. The Corporation's risk and exposure to these matters, including future "phishing" attempts like the 2020 incident, which was disclosed in the Corporation's Annual Form 10-K for the year ended December 31, 2020, remain heightened because of, among other things, the evolving nature of these threats, our plans to continue to implement our Internet banking and mobile banking channel strategies and develop additional remote connectivity solutions to serve our customers when and how they want to be served. As a result, cybersecurity and the continued development and enhancement of the Corporation's controls, processes and practices designed to protect its and its subsidiaries systems, computers, software, data and networks from attack, damage or unauthorized access remain a priority for the Corporation. As cyber threats continue to evolve, the Corporation may be required to expend further significant resources to continue to modify or enhance its protective measures or to investigate and remediate future information security vulnerabilities. While we have purchased cybersecurity insurance, there are no assurances that the coverage would be adequate in relation to any incurred losses. Moreover, as cyber attacks increase in frequency and magnitude, we may be unable to obtain cybersecurity insurance in amounts and on terms we view as adequate for our operations. Further information relating to cybersecurity risk management is discussed in Item 1C. "Cybersecurity" of this report.

In deciding whether to extend credit or enter into other transactions with customers and counterparties, we rely on information furnished to us by or on behalf of customers and counterparties, including financial statements and other financial information. We also rely on representations of customers and counterparties as to the accuracy and completeness of that information and, with respect to financial statements, on reports of independent auditors. For example, in deciding whether to extend credit to clients, we may assume that a customer's audited financial statements conform to U.S. generally accepted accounting principles ("GAAP") and present fairly, in all material respects, the financial condition, results of operations and cash flows of the customer. Our earnings are significantly affected by our ability to properly originate, underwrite and service loans. Our financial condition, results of operations and capital could be negatively impacted to the extent we incorrectly assess the creditworthiness of our borrowers, fail to detect or respond to deterioration in asset quality in a timely manner, or rely on financial statements that do not comply with GAAP or are materially misleading.

The Corporation competes with an ever-increasing array of financial service providers. As noted above, as a financial holding company and state-chartered financial institution, respectively, the Corporation and the Bank are subject to extensive regulation and supervision, including, in many cases, regulations that limit the type and scope of activities. The non-bank financial service providers that compete with the Corporation and the Bank may not be subject to such extensive regulation, supervision, and tax burden. Competition from nationwide banks, as well as local institutions, is strong in the Corporation's markets. The financial services industry is undergoing rapid technological change and technological advances are likely to intensify competition. In addition to improving customer services, effective use of technology increases efficiency and enables financial institutions to reduce costs. Accordingly, the Corporation's future success will depend in part on its ability to address customer needs by using technology. The Corporation cannot assure you that it will be able to successfully take advantage of technological changes or advances or develop and market new technology driven products and services to its customers. Failure to keep pace with technological change affecting the financial services industry could have a material adverse effect on the Corporation's financial condition, results of operations, or liquidity. Many regional, national, and international competitors have far greater assets and capitalization than the Corporation has and greater resources to invest in technology and access to capital markets and can consequently offer a broader array of financial services than the Corporation can. We cannot assure you that we will continue to be able to compete effectively with other financial institutions in the future. Developments increasing the nature or level of competition could have a material adverse effect on the Corporation's business, financial condition, results of operations, or liquidity. For further information on competition, refer to Part I, Item?1, "Competition," herein.