First Financial Bancorp (FFBC) Risk Analysis

Our community banking business model and local market focus has led to a concentration in the markets in which we operate, namely Indiana, Ohio, Kentucky and Illinois. As a result of this geographic concentration, our results of operations are largely dependent on economic conditions in these local markets. Changes to the economic conditions in these local markets, which may be different from the national economic conditions, may adversely affect our financial condition, results of operations, and business prospects.

Given the nature of our business, and the fact that most of our assets and liabilities are financial in nature, we tend to be sensitive to market interest rate movements and the performance of the financial markets. Our primary source of income is net interest income, which is the difference between the interest income generated by our interest-earning assets (consisting primarily of loans and, to a lesser extent, securities) and the interest expense generated by our interest-bearing liabilities. Prevailing economic conditions, fiscal and monetary policies and the policies of various regulatory agencies all affect market rates of interest and the availability and cost of credit, which, in turn, significantly affect financial institutions' net interest income. If the interest we pay on deposits and other borrowings increases at a faster rate than increases in the interest we receive on loans and investments, net interest income, and, therefore, our earnings, could be affected. Earnings and capital levels could also be affected if the interest we receive on loans and other investments falls more quickly than the interest we pay on deposits and other borrowings. In addition to the general impact of the economy, changes in interest rates or in valuations in the debt, equity, commodities or currency markets could directly impact us in one or more of the following ways: the yield on earning assets and rates paid on interest bearing liabilities may change in disproportionate ways;the value of certain balance sheet and off-balance sheet financial instruments or the value of equity investments that we hold could decline;the value of assets for which we provide processing services could decline;the bank's profitability may decline due to negative impacts of increased market volatility;insured and/or uninsured depositors may seek alternative investments, making the bank more reliant on alternative, more expensive funding sources;the demand for loans and refinancings may decline, which could negatively impact income related to loan originations;the reset on interest rates on adjustable rate mortgages could cause financial strain on borrowers, making them more likely to default; or to the extent we access capital markets to raise funds to support our business, such changes could affect the cost of such funds or the ability to raise such funds. During 2025, the Federal Reserve implemented a series of rate cuts that decreased the target fed funds rate by 75 basis points. Although we have implemented procedures we believe will prepare us for the potential effects of changes in interest rates on our results of operations, these procedures may not always be successful. In addition, any substantial or prolonged change in market interest rates could affect our financial condition, results of operations and liquidity.

We, as well as our subsidiaries, are subject to the supervision and regulation of various state and federal regulators, including the Federal Reserve Board, the FDIC, the SEC, the CFPB, the Financial Industry Regulatory Authority, and ODFI. As such, we are subject to a wide variety of state and federal laws and regulations that require compliance of a complex and evolving regulatory framework. This includes, among others, capital adequacy requirements, Anti-Money Laundering and Bank Secrecy Act compliance, consumer protection laws and data privacy laws. As part of their supervisory process, which includes periodic examinations and continuous monitoring, the regulators have the authority to impose restrictions or conditions on our activities and the manner in which we operate our business. These actions could impact the Company and the Bank in a variety of ways, including subjecting us to fines, restricting our ability to pay dividends, precluding mergers or acquisitions, limiting our ability to offer certain products or services, requiring us to undertake significant remedial measures, removing key employees from their positions, imposing additional capital, operating, or oversight requirements or ultimately, in the event that any regulatory violations or actions cannot be corrected and are substantial in nature to cause an imminent risk of loss to depositors, we could be placed into receivership or conservatorship. Additionally, investigations and/or actions by regulatory agencies against us could cause us to devote significant time and resources to defending our business and/or modifying our practices and operations and may lead to penalties or fines that materially affect us and our shareholders. These regulatory inquiries, investigations, examinations and actions ultimately could have an adverse effect on our reputation, lead to increased costs and impact our financial condition and the results of our operations.

Financial institutions continue to face evolving expectations from customers, regulators, investors, and other stakeholders regarding environmental, social, governance, and sustainability-related practices and disclosures. In addition, climate-related physical and transition risks may affect borrowers, collateral values, insurance availability, supply chains, and economic conditions in the markets we serve, while shifts in public policy, technology, and investor or customer preferences may affect certain industries and business activities differently. Adapting to changing regulatory requirements and stakeholder expectations, as well as managing risks associated with environmental and social developments, may increase operational and compliance costs, affect relationships with customers or business partners, and could adversely impact our reputation, access to capital, financial condition, and results of operations.

We are exposed to many types of operational risks, some of which are outside of our control, including, but not limited to, the risk of fraud or theft by employees and outsiders, clerical and record-keeping errors, computer/telecommunications systems malfunctions, and risks regarding the operations of our third party vendors. Our business is dependent on our ability to process a large number of increasingly complex transactions. If any of our financial, accounting or other data processing or technological systems fail or have other significant shortcomings, our business could be affected. We depend on internal systems and outsourced technology to support these data storage and processing operations, as well as harm our reputation amongst our customers. Our inability to use or access these information systems at critical points in time could unfavorably impact the timeliness and efficiency of our business operations. In recent years, some banks have experienced denial of service attacks in which individuals or organizations flood a bank's website with extraordinarily high volumes of traffic, with the goal and effect of disrupting the ability of the bank to process and/or communicate information about transactions. These, and similar types of attacks and/or breaches of data, could result in losses in the form of lost revenues, costs to remediate, reputational harm, litigation losses and other impacts to our financial condition and results of operations. Additionally, we could be affected if one of our employees or a third-party service provider causes a significant operational breakdown or failure, either as a result of human error or where an individual purposefully sabotages or fraudulently manipulates our operations or systems. We are also at risk of an impact on our systems and operations from natural disasters, accidents outside of our control, terrorism, international hostilities, and other exceptional or outlier events outside of our control. Increasing electricity demand, including from data centers and industrial activity, is placing pressure on regional power grid operators, including PJM Interconnection LLC, which serves many of the markets in which we operate, and prolonged or widespread power disruptions could adversely affect our facilities, third-party service providers, customers, and business continuity. Such events can impact operational systems operated by us or others on which we rely and can result in an impact to our business operations and subsequent impacts to our financial condition and results of operations. In addition, continuing cyberattacks and current geopolitical tensions highlight the importance of heightened threat monitoring and safeguarding against disruptive attacks targeting the financial sector. There have been instances where financial institutions have been victims of fraudulent activity in which criminals pose as customers to initiate wire and automated clearinghouse transactions out of customer accounts. There have also been increased instances of scammers who target and socially engineer clients to gain access to their accounts to conduct transactions or induce customers to authorize fraudulent transactions for the scammers' benefit. Although we have commercially reasonable policies and procedures in place to verify the authenticity of our customers, we cannot assure that such policies and procedures will prevent all fraudulent transfers. AI tools may also be utilized by bad actors to increase the sophistication and speed of cyberattacks and fraud attempts. For more information on the risks associated with AI, see the Risk Factor titled "" The fraudulent activity and cybersecurity risks can result in financial liability and litigation risk to us and/or our customers, as well as harm to our reputation and negative impacts on our financial condition, results of our operations, business and prospects. The use and capacity of AI, Generative AI, LLMs and AI agents has increased in the past year and is being employed by customers, competitors, and vendors at increased rates. Many of these tools can increase cybersecurity risks, require specific technical expertise to operate, or expose information through open source code. These tools are being used by parties in various capacities, and employing these tools without sufficient knowledge or expertise of the power and risks associated with the tools can increase risks for the users. These tools are relatively new and there is potential of continued and/or increased adoption of legal and regulatory frameworks governing the use of these tools, by law, our primary banking regulators, other federal or state regulatory bodies, or other self-regulatory organizations. The use of these tools by customers can increase the risk of exposure to their personal information and/or banking credentials which can result in increased opportunities for bad actors to initiate fraudulent activity with respect to a customer's account(s). While we have implemented commercially reasonable policies and procedures to protect against fraudulent activity on the accounts of our customers, we cannot assure that such policies and procedures will prevent all fraudulent activity or capture activity that has been inadvertently been authorized by the customer. Such activity can result in financial liability and litigation risk to us and/or our customers, as well as harm to our reputation and negative impacts on our financial condition, results of our operations, business and prospects. The use of these tools by vendors engaged by us can increase the risk of unauthorized use or disclosure of sensitive or confidential client or customer information and cyberattacks. In conducting due diligence of our vendors, we request detailed information regarding how the vendor uses these tools and attempt to mitigate risks related to exposure by agreement with vendors. While these processes seek to mitigate risks associated with vendor use of these tools, we cannot eliminate this risk. Vendors may employ tools without realizing the risks associated with the tools, may have employees that use unauthorized technology tools that were not disclosed to us during our diligence process, or the tools that were disclosed may implement new services, features, or technologies that increase the exposure to cybersecurity risks. If a vendor engaged by us experienced a cyberattack related to use of these tools, or deliberately or inadvertently exposed sensitive or confidential client or customer information, we may experience financial liability and litigation risk to us and/or our customers, as well as harm to our reputation and negative impact on our financial condition, results of operations and business. Additionally, if any vendors incur additional costs related to any legal or regulatory framework adopted governing the use of such tools, we may face increased costs to engage such vendor, which could impact or financial condition and results of operations if we continue to use such vendor or as a result of costs incurred to find an alternative vendor. The use of these tools by competitors may impair our ability to attract or retain business if our competitors are successful in their implementation. Failure to keep pace with these evolving technologies can have a negative impact on our financial condition, results of operations, business and prospects. In addition, if our competitors suffer any reputational harm as a result of the implementation of these evolving technologies, it could have a negative effect on the financial services industry as a whole and have a negative impact on our financial condition, results of operations, business and prospects. The increased use of these tools by competitors may also increase pressure to impose legal or regulatory frameworks regarding these tools, which could impact the financial services industry as a whole and cause us to incur increased costs to comply with such legal or regulatory frameworks, which may result in a negative impact on our financial condition, results of operations and business.

Another increasingly competitive factor in the financial services industry is the competition to attract and retain talented employees across many of our business and support areas, many of whom are key to executing our strategic plan and to maintaining relationships with the customers and communities they serve. We face competition for talented employees not only by others in the financial services industry, but across sectors and geographic locations, as technological advancements have made it easier for employees to pursue opportunities that previously were inaccessible because of geographical restrictions. Failure to attract and/or retain key employees, or otherwise experiencing persistent or extreme levels of employee turnover, could lead to adverse effects on our business, financial condition or operating results and could also cause us to not pursue certain business opportunities.