Heritage Financial (HFWA) Risk Analysis

Severe weather, natural disasters, effects of climate change, widespread disease or pandemics, military conflicts, acts of war or terrorism, civil unrest or other adverse external events could have a significant impact on the Company's ability to conduct business. In addition, such events could affect the stability of the Company's deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue or cause the Company to incur additional expenses. The occurrence of any of these events could have a material adverse effect on the Company's business, financial condition, results of operations and growth prospects.

Liquidity is essential to the Company's business. Generally, liquidity risk is the risk of being unable to fund obligations to creditors, including, in the case of financial institutions, obligations to depositors, as such obligations become due and/or fund the acquisition of assets, as they come due, and is inherent in the Company's operations. An inability to raise funds through deposits, borrowings, the sale of loans or investment securities, and from other sources could have a substantial negative effect on our liquidity. The Company's most important source of funds consists of customer deposits, which can decrease for a variety of reasons, including when customers perceive alternative investments, such as bonds, treasuries or stocks, as providing a better risk/return trade off. Additionally, uninsured deposits have historically been viewed by the FDIC as less stable than insured deposits. According to statements made by the FDIC staff and leadership of the federal banking agencies, customers with larger uninsured deposit account balances often are small- to mid-sized businesses that rely upon deposit funds for payment of operational expenses and are therefore more likely to closely monitor the financial condition and performance of their depository institutions. In the event of financial distress, uninsured depositors historically have been more likely to withdraw deposits. If a significant portion of our deposits were to be withdrawn within a short period of time such that additional sources of funding would be required to meet withdrawal demands, the Company may be unable to obtain funding on favorable terms, which may have an adverse effect on our net interest margin. Moreover, obtaining adequate funding to meet our deposit obligations may be more challenging during periods of higher prevailing interest rates. Our ability to attract depositors during a time of actual or perceived distress or instability in the marketplace may be limited. Interest rates paid for borrowings generally exceed the interest rates paid on deposits, which spread may be exacerbated during a time of higher prevailing interest rates. In addition, because our available for sale securities lose value when interest rates rise, after-tax proceeds resulting from the sale of such assets may be diminished during periods when interest rates are elevated. Under such circumstances, we may be required to access funding from sources such as the FRB's discount window in order to manage our liquidity risk. Other primary sources of funds consist of cash from operations, investment security maturities and sales and proceeds from the issuance and sale of the Company's equity and debt securities to investors, with additional liquidity from the ability to borrow from the FRB, FHLB, and third party lenders. The Company's access to funding sources in amounts adequate to finance or capitalize the Company's activities or on favorable terms, could be impaired by factors that affect the Company directly or the financial services industry or economy in general, such as disruptions in the financial markets or negative views and expectations about the prospects for the financial services industry. Economic conditions and a loss of confidence in financial institutions may increase the Company's cost of funding and limit access to certain customary sources of capital, including inter-bank borrowings and borrowings from the discount window of the FRB. Any decline in available funding could adversely impact the Company's ability to continue to implement its strategic plan or to fulfill its financial obligations, any of which could have a material adverse effect on the Company's business, financial condition, results of operations and growth prospects.

The Company's business is subject to increased litigation and regulatory risks because of a number of factors, including the highly regulated nature of the financial services industry and the focus of state and federal prosecutors on banks and the financial services industry generally. In the normal course of business, from time to time, the Company has in the past and may in the future be named as a defendant in various legal actions, including arbitrations, class actions and other litigation, arising in connection with the Company's current or prior business or acquisition activities. Legal actions could include claims for substantial compensatory or punitive damages or claims for indeterminate amounts of damages. The Company may also, from time to time, be the subject of subpoenas, requests for information, reviews, investigations and proceedings (both formal and informal) by governmental agencies regarding the Company's current or prior business or acquisition activities. Any such legal or regulatory actions may subject the Company to substantial compensatory or punitive damages, significant fines, penalties, obligations to change the Company's business practices or other requirements resulting in increased expenses, diminished income and damage to the Company's reputation. The Company's involvement in any such matters, whether tangential or otherwise and even if the matters are ultimately determined in the Company's favor, could also cause significant harm to the Company's reputation and divert management attention from the operation of the Company's business. Further, any settlement, enforcement action or adverse judgment in connection with any formal or informal proceeding or investigation by government agencies may result in litigation, investigations or proceedings as other litigants and government agencies begin independent reviews of the same activities. As a result, the outcome of legal and regulatory actions could have a material adverse effect on the Company's business, reputation, financial condition, results of operations and growth prospects.

The Company is subject to various privacy, information security and data protection laws, including requirements concerning security breach notification, and the Company could be negatively affected by these laws. Various state and federal banking regulators and states have also enacted data security breach notification requirements with varying levels of individual, consumer, regulatory or law enforcement notification in certain circumstances in the event of a security breach. Legislators and regulators are also increasingly adopting or revising privacy, information security and data protection laws, including with respect to the use of artificial intelligence by financial institutions and their service providers, that potentially could have a significant impact on the Company's current and planned privacy, data protection and information security-related practices, the Company's collection, use, sharing, retention and safeguarding of consumer or employee information and some of the Company's current or planned business activities. This could also increase the Company's costs of compliance and business operations and could reduce income from certain business initiatives.

As a financial institution, the Company is susceptible to fraudulent activity, information security breaches and cybersecurity-related incidents that may be committed against the Company, its customers or third parties with whom it interacts, which may result in financial losses or increased costs to the Company or its customers, disclosure or misuse of the Company's information or its customer information, misappropriation of assets, privacy breaches against the Company's customers, litigation or damage to the Company's reputation. Such fraudulent activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering and other dishonest acts. Information security breaches and cybersecurity-related incidents may include fraudulent or unauthorized access to systems used by the Company or its customers by insiders or third parties, denial or degradation of service attacks and malware or other cyber-attacks. In recent periods, there continues to be a rise in electronic fraudulent activity, security breaches and cyber-attacks within the financial services industry, especially in the commercial banking sector, due to both insider fraud and cyber criminals targeting commercial bank accounts, and as a result of increasingly sophisticated methods of conducting cyber-attacks, including those employing artificial intelligence tools. Consistent with industry trends, the Company has also experienced an increase in attempted electronic fraudulent activity, security breaches and cybersecurity related incidents in recent periods. During 2025, the Company is not aware of having experienced any misappropriation, loss or other unauthorized disclosure of confidential or personally identifiable information having a material impact on the Company as a result of a direct cyber security breach or other act on the Bank; however, some of the Company's customers and third party vendors may have been affected by such breaches, which could increase their risks of identity theft and other fraudulent activity that could involve customer accounts at the Bank. Information pertaining to the Company and its customers is maintained, and transactions are executed, on networks and systems maintained by the Company and third party partners, including online banking, mobile banking, record-keeping or accounting systems. The secure maintenance and transmission of confidential information, as well as execution of transactions over these systems, are essential to protect the Company and its customers against fraud and security breaches and to maintain customer confidence. Breaches of information security also may occur through intentional or unintentional acts by those having access to the Company's systems or the confidential information of its customers, including employees. In addition, increases in criminal activity levels and sophistication, advances in computer capabilities, new discoveries, vulnerabilities in third party technologies or other developments could result in a compromise or breach of the technology, processes and controls that the Company uses to prevent fraudulent transactions and to protect data about us, our customers and underlying transactions, as well as the technology used by our customers to access our systems. The Company's third party partners' inability to anticipate, or failure to adequately mitigate, breaches of security could result in a number of negative events, including losses to the Company or its customers, loss of business or customers, damage to the Company's reputation, additional expenses, disruption to the Company's business, additional regulatory scrutiny or penalties or the Company's exposure to civil litigation and possible financial liability, any of which could have a material adverse effect on the Company's business, financial condition, results of operations and growth prospects.

The Company's success is dependent, to a large degree, upon the continued service and skills of the Company's executive management team and employees. The loss of any of the members of the Company's executive management team or other key personnel, including successful individuals employed by banks or other businesses that the Company may acquire, to a new or existing competitor or otherwise, could have an adverse impact on the Company's ability to retain valuable relationships and some of its customers could choose to use the services of a competitor instead of the Company's services. Leadership changes may occur from time to time, and the Company cannot predict whether significant retirements or resignations will occur or whether the Company will be able to recruit additional qualified personnel. Competition for high quality personnel is strong and the Company may not be successful in attracting or retaining the personnel it requires, and means the cost of hiring, incentivizing and retaining skilled personnel may continue to increase. In particular, many of the Company's competitors are significantly larger with greater financial resources and may be able to offer more attractive compensation packages and broader career opportunities. Additionally, the Company may incur significant expenses and expend significant time and resources on training, integration, and business development before the Company is able to determine whether a new employee will be profitable or effective in their role. The loss of the services of any senior executive or other key personnel, the inability to recruit and retain qualified personnel in the future or the failure to develop and implement a viable succession plan could have a material adverse effect on the Company's business, financial condition, results of operations and growth prospects.

The Company's use of third party vendors for certain information systems is subject to increasingly demanding regulatory requirements and attention by the Company's federal bank regulators. Recent regulations require the Company to enhance its due diligence, ongoing monitoring and control over the Company's third party vendors and other ongoing third party business relationships. In certain cases, the Company may be required to renegotiate the Company's agreements with these vendors to meet these enhanced requirements, which could increase costs. The Company expects that regulators will hold the Company responsible for deficiencies in oversight and control of its third party relationships and in the performance of the parties with which the Company has these relationships. As a result, if the Company's regulators conclude that it has not exercised adequate oversight and control over the Company's third party vendors or other ongoing third party business relationships or that such third parties have not performed appropriately, the Company could be subject to enforcement actions, including civil money penalties or other administrative or judicial penalties or fines, as well as requirements for customer remediation, any of which could have a material adverse effect on the Company's business, financial condition, results of operations and growth prospects.

The Company competes with national commercial banks, regional banks, private banks, mortgage companies, online lenders, savings banks, credit unions, non-bank financial services companies and other financial institutions, including investment advisory and wealth management firms, fintech companies and digital asset service providers and securities brokerage firms, operating within or near the areas the Company serves. Many of the Company's non-bank competitors are not subject to the same extensive regulations that govern the Company's activities and may have greater flexibility in competing for business. The financial services industry could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. While the Company does not offer products relating to digital assets, including cryptocurrencies, stablecoins and other similar assets, there has been a significant increase in digital asset adoption globally over the past several years. Certain characteristics of digital asset transactions, such as the speed with which such transactions can be conducted, the ability to transact without the involvement of regulated intermediaries, the ability to engage in transactions across multiple jurisdictions, and the anonymous nature of the transactions, are appealing to certain consumers notwithstanding the various risks posed by such transactions. Accordingly, digital asset service providers-which, at present are not subject to the same degree of scrutiny and oversight as banking organizations and other financial institutions-are becoming active competitors to more traditional financial institutions. The process of eliminating banks as intermediaries, known as "disintermediation," could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from using those deposits to fund loans and investment securities. The loss of these revenue streams and the lower cost deposits as a source of funds could have a material adverse effect on the Company's business, financial condition, results of operations and growth prospects.