Fulton Financial (FULT) Risk Analysis

Our business is highly dependent on information systems and technology and the ability to collect, process, transmit and store significant amounts of confidential information on a daily basis. While we perform some of the functions required to operate our business directly, we also rely on third parties for significant business functions, such as processing customer transactions, providing cloud-based infrastructure, software and data storage services, maintaining customer-facing websites, including our online and mobile banking functions, and developing software for new products and services. These relationships require us to allow third parties to access, store, process and transmit customer information. As a result, we may be subject to cybersecurity risks directly, as well as indirectly, through the vendors to whom we outsource business functions and the downstream service providers of those vendors. Cyber threats could result in unauthorized access, loss or destruction of confidential information or customer data; unavailability, degradation or denial of service; introduction of computer viruses or ransomware; and other adverse events causing us to incur additional costs repairing systems, restoring date or adding new personnel or protection technologies. Cyber threats may also subject us to regulatory investigations, litigation or enforcement actions, require the payment of fines, penalties or damages, or undertaking costly remediation efforts with respect to third parties affected by a cybersecurity incident, all or any of which could adversely affect our business, financial condition or results of operations and/or damage our reputation. Critical infrastructure sectors, including the financial services sector, increasingly have been the targets of cyberattacks. Cyberattacks involving large financial institutions, including denial of service attacks, nation-state cyberattacks, ransomware attacks designed to deny access to key internal resources or systems, and targeted social engineering and email and text message attacks designed to allow unauthorized persons to obtain access to an institution's information systems and data or that of its customers, are becoming more common and increasingly sophisticated. Further, threat actors are increasingly seeking to target vulnerabilities in software systems (and third-party vendors providing those systems) used by large numbers of banking organizations in order to conduct malicious cyber activities. Like other financial institutions, we experience malicious cyber activity on an ongoing basis directed at our websites, computer systems, software, networks and our users. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware, and denial of service attacks. We also experience large volumes of phishing and other forms of social engineering attempted for the purpose of perpetuating fraud against us, our employees or our customers. While, to date, malicious cyber activity, cyberattacks and other information security breaches have not had a material adverse impact on us, risk to our systems remains significant. Cybersecurity risks for financial institutions also have evolved as a result of the use of cloud computing and new technologies, devices and delivery channels to transmit and store data and conduct financial transactions. The adoption of new products, services and delivery channels contribute to a more complex operating environment, which enhances operational risk and presents the potential for additional structural vulnerabilities. There can be no assurance that the measures we employ to detect and combat direct or indirect cyber threats will be effective. In addition, because the methods of cyberattacks change frequently or, in some cases, are not recognized until launched, we may be unable to implement effective preventive control measures to proactively address these methods. There can be no assurance that any future third-party vendor data breach would not be material, and if we or a third-party vendor were to experience a cyberattack or information security breach, we could suffer damage to our reputation, productivity losses, response costs associated with investigation and resumption of services, and incur substantial additional expenses, including remediation expenses costs associated with client notification and credit monitoring services, increased insurance premiums, regulatory penalties and fines, and costs associated with civil litigation, any of which could have a materially adverse effect on our business, financial condition, results of operations and reputation. Although we maintain insurance coverage that may, subject to policy terms and conditions, cover certain aspects of cyber risks, our insurance coverage may be inapplicable or otherwise insufficient to cover any or all losses. Additionally, account data compromise, malware and ransomware events affecting a broad spectrum of commercial businesses and governmental entities in recent years have resulted in heightened legislative and regulatory focus on privacy, data protection and information security. Changes in laws and regulations may significantly impact our current and planned privacy, data protection and information security-related practices, the collection, use, sharing, retention and safeguarding of consumer and employee information, and current or planned business activities. Compliance with current or future privacy, data protection and information security laws could result in higher compliance and technology costs and could restrict our ability to provide certain products and services that could materially and adversely affect our profitability.

We rely on quantitative models to measure risks and to estimate certain financial values. We use models in such processes as determining the pricing of various products, measuring interest rate and other market risks, predicting or estimating losses and assessing capital adequacy, as well as to estimate the value of financial instruments and balance sheet items. Our reliance on models continues to increase as rules, guidance, and expectations change. The most recent example of this is the additional models used in the determination of our ACL under CECL. Poorly designed or implemented models present the risk that our business decisions based on information incorporating model output could be adversely affected due to the inaccuracy of that information. Models are often based on historical experience to predict future outcomes, and, as a result, new experiences or events which are not part of historical experience can significantly increase model imprecision and impact model reliability. Model inputs can also include information provided by third parties, such as economic forecasts or macroeconomic variables (unemployment rates, real GDP, etc.) upon which we rely. Some of the decisions that our regulators make, including those related to capital actions, could be affected due to the perception that the quality of the models used to generate the relevant information is insufficient, which could have a negative impact on our ability to take certain actions, including making dividend payments or engaging in share repurchases.