Hanmi Financial (HAFC) Risk Factors

In the course of our business, we may foreclose and take title to real estate, and could be subject to environmental liabilities with respect to these properties. We may be held liable to a governmental entity or to third parties for property damage, personal injury or investigation and clean-up costs incurred by these parties in connection with environmental contamination or the release of hazardous or toxic substances at a property. The costs associated with investigation or remediation activities could be substantial. In addition, if we are the owner or former owner of a contaminated site, we may be subject to claims by third parties based on damages and costs resulting from environmental contamination emanating from the property. In addition, future laws or more stringent interpretations or enforcement policies with respect to existing laws may increase our exposure to environmental liability. Although we have policies and procedures to perform an environmental review before initiating any foreclosure on nonresidential real property, these reviews may not be sufficient to detect all potential environmental hazards. If we become subject to significant environmental liabilities, our business, financial condition, results of operations and prospects could be materially and adversely affected.

Liquidity is essential to our business. An inability to raise funds through deposits, including brokered deposits, borrowings, the sale of securities and loans, and other sources, could have a material adverse effect on our liquidity. Our access to funding sources in amounts adequate to finance our activities could be impaired by factors that affect us specifically or the financial services industry in general. Factors that could detrimentally impact our access to liquidity sources include a decrease in the level of our business activity due to a market downturn or adverse regulatory action against us. Furthermore, if certain funding sources become unavailable, we may need to seek alternatives at higher costs, which would negatively impact our results of operations. Our ability to acquire deposits or borrow could also be impaired by factors that are not specific to us, such as a severe disruption of the financial markets or negative views and expectations about the prospects for the financial services industry as a whole.

We face additional risk of failure in or breach of operational or security systems or infrastructure related to our reliance on third-party vendors and other service providers. Third parties with which we do business or that facilitate our business activities or vendors that provide services or security solutions for our operations, particularly those that are cloud-based, could be sources of operational and information security risk to us, including from breakdowns or failures of their own systems or capacity constraints. We are subject to operational risks relating to such third parties' technology and information systems. The continued efficacy of our technology and information systems, related operational infrastructure and relationships with third-party vendors in our ongoing operations is integral to our performance. Failure of any of these resources, including operational or systems failures, interruptions of client service operations and ineffectiveness of or interruption in third-party data processing or other vendor support, may cause material disruptions in our business, impairment of customer relations and exposure to liability for our customers, as well as action by bank regulatory authorities. In addition, a number of our vendors are large national entities, and their services could prove difficult to replace in a timely manner if a failure or other service interruption were to occur. Failures of certain vendors to provide contracted services could adversely affect our ability to deliver products and services to our customers and cause us to incur significant expense.

The banking and financial services businesses in our market areas are highly competitive. We face competition in attracting deposits, making loans, and attracting and retaining employees, particularly in the Korean-American community. Price competition for loans and deposits sometimes requires us to charge lower interest rates on our loans and pay higher interest rates on our deposits, which may reduce our net interest income. Many of our competitors have substantially greater resources and lending limits than we have and may offer services that we do not provide. The greater resources and broader offering of deposit and loan products of some of our competitors may also limit our ability to increase our interest-earning assets. The increasingly competitive environment is a result of changes in regulation,changes in technology and product delivery systems, new competitors in the market, and the pace of consolidation among financial services providers. Our results in the future may be materially and adversely impacted depending upon the nature and level of competition.

As a financial institution, we depend on our ability to process, record and monitor a large number of customer transactions. As our customer base and locations have expanded throughout the U.S., and as customer, public, legislative and regulatory expectations regarding operational and information security have increased, our operational systems and infrastructure must continue to be safeguarded and monitored for potential failures, disruptions and breakdowns. Our business, financial, accounting, data processing and other operating systems and facilities may stop operating properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control. For example, there could be: sudden increases in customer transaction volume; electrical or telecommunications outages; degradation or loss of public internet domain; climate change-related impacts and natural disasters such as earthquakes, tornados, and hurricanes; pandemics; events arising from local or larger scale political or social matters, including terrorist acts; building emergencies such as water leakage, fires and structural issues; and cyber-attacks. Although we have business continuity plans and other safeguards in place, our business operations may be adversely affected by significant and widespread disruption to our physical infrastructure or operating systems that support our businesses and customers. As a financial institution, we are susceptible to information security breaches and cybersecurity-related incidents that may be committed against us, our clients or our vendors, which may result in financial losses or increased costs to us, our clients or our vendors, disclosure or misuse of our information or our client or vendor information, misappropriation of assets, privacy breaches against our clients or our vendors, litigation or damage to our reputation. Information security breaches and cybersecurity-related incidents may include fraudulent or unauthorized access to systems used by us, our clients or our vendors, attacks resulting in denial or degradation of service, and malware or other cyber-attacks. We also may become subject to governmental enforcement actions or litigation in the event we do not comply with data privacy requirements or experience a data breach. Our business relies on the use of our digital technologies, computer and email systems, software, and networks. In addition, to access our products and services, our customers may use personal smart-phones, tablet PCs, and other mobile devices that are beyond our control systems. Although we believe we have strong information security procedures and controls, our technologies, systems, networks, and our customers' devices may become the target of cyber-attacks or information security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of our customers' confidential, proprietary and other information, or otherwise disrupt our customers' or other third parties' business operations. Our risk and exposure to cyber-attacks or other information security breaches remains heightened because of, among other things, the evolving nature of these threats, our plans to continue to enhance our internet banking and mobile banking channel strategies, our expanded geographic footprint and that a portion of our employee base works remotely. There continues to be a rise in security breaches and cyber-attacks within the financial services industry, especially in the commercial banking sector. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. Disruptions or failures in the physical infrastructure or operating systems that support our businesses, customers or third parties, or cyber-attacks or security breaches of the networks, systems or devices that our customers or third parties use to access our products and services could result in customer attrition, financial losses, the inability of our customers or vendors to transact business with us, violations of applicable privacy and other laws, regulatory fines, penalties or intervention, reputational damage, reimbursement or other compensation costs, and/or additional compliance costs, any of which could materially adversely affect our results of operations or financial condition.

We invest significant resources in information technology system enhancements to improve functionality and security. We may not be able to successfully implement and integrate future system enhancements, which could adversely impact our ability to provide timely and accurate financial information in compliance with legal and regulatory requirements, which could result in enforcement actions from regulatory authorities. In addition, future system enhancements could have higher than expected costs and/or result in operating inefficiencies. Failure to properly utilize future system enhancements could result in impairment charges that adversely impact our financial condition and results of operations and could result in significant costs to remediate or replace the defective components. In addition, we may incur significant training, licensing, maintenance, consulting and amortization expenses during and after systems implementations, and any such costs may continue for an extended period of time.