HomeStreet (HMST) Risk Analysis

In the event of future public health crises, epidemics, pandemics or similar events, the communities where we do business may be put under varying degrees of restrictions on social gatherings and retail operations. These restrictions, combined with related changes in consumer behavior and significant increases in unemployment, may result in extreme financial hardship for certain industries, especially travel, energy, hotel, food and beverage service and retail. Some of our customers may be unable to meet their debt obligations to us in a timely manner, or at all, and we may experience a heightened number of requests from customers for forbearances on loans. If health emergency related Federal, state and local moratoriums on evictions for non-payment of rent are enacted, they may negatively impact the ability of some borrowers to make payments on loans made for multifamily housing. In addition, such action may ultimately cause a meaningful number of loans in our portfolio to need forbearance or significant modification and migrate to an adverse risk rating because of impacts of an economic recession. In light of these, and other credit issues, we cannot be sure that our allowance for credit losses will be adequate or that additional increases to the allowance for credit losses will not be needed in subsequent periods. If our allowance is not adequate, future net charge-offs may be in excess of our current expected losses, which would create the need for more provisioning and will have a negative impact on our financial condition, results of operations and capital position.

We are from time to time subject to legal claims or regulatory actions related to our operations. These legal claims or regulatory actions could include supervisory or enforcement actions by our regulators, criminal proceedings by prosecutorial authorities, claims by customers or by former and current employees, including class, collective and representative actions, or environmental lawsuits stemming from property that we may hold as OREO following a foreclosure action in the course of our business. Such actions are a substantial management distraction and could involve large monetary claims, including civil money penalties or fines imposed by government authorities and significant defense costs. To mitigate the cost of some of these claims, we maintain insurance coverage in amounts and with deductibles that we believe are appropriate for our operations. However, our insurance coverage does not cover any civil monetary penalties or fines imposed by government authorities and may not cover all other claims that might be brought against us, including certain wage and hour class, collective and representative actions brought by customers, employees or former employees. In addition, such insurance coverage may not continue to be available to us at a reasonable cost or at all. As a result, we may be exposed to substantial uninsured liabilities, which could adversely affect our business, prospects, financial condition, results of operations and capital position. Substantial legal liability or significant regulatory action against us could cause significant reputational harm to us and/or could have a material adverse impact on our business, prospects, financial condition, results of operations and capital position.

We are subject to federal and state privacy regulations and confidentiality obligations, including the California Consumer Privacy Act of 2018 and the California Privacy Rights Act of 2020, that, among other things restrict the use and dissemination of, and access to, certain information that we produce, store or maintain in the course of our business and establishes a new state agency to enforce these rules. We also have contractual obligations to protect certain confidential information we obtain from our existing vendors and customers. These obligations generally include protecting such confidential information in the same manner and to the same extent as we protect our own confidential information, and in some instances may impose indemnity obligations on us relating to unlawful or unauthorized disclosure of any such information. The continued development and enhancement of our information security controls, processes and practices designed to protect customer information, our systems, computers, software, data and networks from attack, damage or unauthorized access remain a priority for our management as we increase our online and mobile banking offerings. As cyber threats continue to evolve, including supply chain risks, our costs to combat the cybersecurity threat may also increase. Nonetheless, our measures may be insufficient to prevent all physical and electronic break-ins, denial of service and other cyber-attacks or security breaches. If we do not properly comply with privacy regulations and contractual obligations that require us to protect confidential information, or if we experience a security breach or network compromise, we could face regulatory sanctions, penalties or fines, increased compliance costs, remedial costs such as providing credit monitoring or other services to affected customers, litigation and damage to our reputation, which in turn could result in decreased revenues and loss of customers, any or all of which would have a material adverse effect on our financial condition, results of operations and capital position.

We face pricing competition for loans and deposits, both in pricing and products, as well as in customer service and convenience. Our most direct competition comes from other banks, credit unions, mortgage banking companies and finance companies. Competition has also come from companies that rely heavily on technology to provide financial services, are moving to provide cryptocurrency products and offerings, and often target a younger customer demographic. The significant competition in attracting and retaining deposits and making loans, as well as in providing other financial services, throughout our market area may impact future earnings and growth. Our success depends, in part, on our ability to adapt products and services to evolving industry standards and customer preferences and trends and provide consistent customer service while keeping costs in line. We sometimes experience increasing pressure to provide products and services at lower prices, which could reduce net interest income and noninterest income from fee-based products and services. New technology-driven products and services are often introduced and adopted, including innovative ways that customers can make payments, access products and manage accounts. We could be required to make substantial capital expenditures to modify or adapt existing products and services or develop new products and services. We may not be successful in introducing new products and services or those new products may not achieve market acceptance. In addition, advances in technology such as artificial intelligence products and services, telephone, text and online banking, e-commerce and self-service automatic teller machines and other equipment, as well as changing customer preferences to access our products and services through digital channels, could decrease the value of our branch network and other assets. As a result of these competitive pressures, our business, financial condition, results of operations and capital position may be adversely affected.

Although we presently have retail deposit branches in four states, with lending offices in these states and two others, a substantial majority of our revenues are derived from operations in the Puget Sound region of Washington, the Portland, Oregon metropolitan area, and the Los Angeles, Orange County, Riverside and San Diego metropolitan areas in Southern California. All of our markets are located in the Western United States. Each of our primary markets is subject to various types of natural disasters, including earthquakes, wildfires, volcanic eruptions, mudslides and floods, and many have experienced disproportionately significant economic volatility in the past, as well as more recent local political unrest and calls to action, including calls for rent disruption, when compared to other parts of the United States. Economic events, political unrest or natural disasters that affect the Western United States and our primary markets in that region may have an unusually pronounced impact on our business. Because our operations are not more geographically diversified, we may lack the ability to mitigate those impacts from operations in other regions of the United States.

We originate a substantial portion of our single family mortgage loans for sale to third party investors, including government-sponsored enterprises ("GSEs") such as Fannie Mae, Freddie Mac and Ginnie Mae. Changes in the types of loans purchased by these GSEs or the program requirements for those entities could adversely impact our ability to sell certain of the loans we originate for sale, leaving us unable to find a buyer on similar terms. Similarly, changes in the fee structures by any of our third party loan purchasers, including the GSEs, may increase our costs of doing business, the cost of loans to our customers, and the cost of selling loans to third party loan purchasers, all of which could in turn decrease our margin and negatively impact our profitability. In addition, significant changes in the underwriting criteria of third party loan purchasers could increase our costs or decrease our ability to sell into the secondary markets. Any of these changes can have a negative impact on our liquidity, financial condition, results of operations and capital position.

The financial services industry undergoes rapid technological changes with frequent introductions of new technology-driven products and services to better serve customers and to reduce costs. Our future success will depend, in part, upon our ability to provide products and services using technology that will satisfy client demands for convenience, as well as to create additional efficiencies in our operations. Many national vendors provide turn-key services to community banks, such as Internet banking and remote deposit capture that allow smaller banks to compete with institutions that have substantially greater resources to invest in technological improvements. However, we may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers.

As a financial institution, we are susceptible to fraudulent activity, operational and informational security breaches and cybersecurity incidents that are committed against us or our customers, employees, third-party vendors and others, which may result in financial losses or increased costs, disclosure or misuse of our information or customer information, misappropriation of assets, data privacy breaches, litigation or reputational damage. Related risks for financial institutions have increased in recent years in part because of proliferation and use of new and existing technologies to conduct financial transactions and transmit data, as well as the increased sophistication and unlawful or clandestine activities of organized crime, state-sponsored and other hackers, terrorists, activists, and other malicious external parties to engage in fraudulent activity such as phishing or check, electronic or wire fraud, unauthorized access to our controls and systems, denial or degradation of service attacks, malware and other dishonest acts. Within the financial services industry, the commercial banking sector has generally experienced, and will continue to experience, increased electronic fraudulent activity, security breaches and cybersecurity-related incidents. The nature of our industry sector exposes us to these risks because our business and operations include the protection and storage of confidential and proprietary corporate and personal information, including sensitive financial and other personal data, and any breach thereof could result in identity theft, account or credit card fraud or other fraudulent activity. The risk to our organization may be further elevated over the near term because of recent geopolitical events in Eastern Europe and the Middle East, which may result in increased attacks against U.S. critical infrastructure, including financial institutions. Our computer systems, software and networks are subject to ongoing cyber incidents such as unauthorized access; loss or destruction of data (including confidential client information); account takeovers; unavailability of service; computer viruses or other malicious code; cyber-attacks; and other events. While we have experienced and continue to experience various forms of these cyber incidents in the past, we have not been materially impacted by them. However, cyber incidents may occur again and they could occur more frequently and on a more significant scale. Our business and operations rely on the secure processing, transmission, protection and storage of confidential, private and personal information by our computer operation systems and networks, as well as our online banking or reporting systems used by customers to perform certain financial transactions, all of which are either managed directly by us or through our third-party data processing vendors. The secure maintenance and transmission of confidential information, and the execution of transactions through our systems, are critical to protecting us and our customers against fraud and security breaches and to maintaining customer confidence. To access our products and services, our customers may use personal computers, smartphones, tablet PCs, and other mobile devices that function beyond our control systems. Although we believe we have invested in, and plan to continue investing in, maintaining and routinely testing adequate operational and informational security procedures and controls, we rely heavily on our third-party vendors, technologies, systems, networks and our customers' devices, all of which are the target of cyber-attacks, computer viruses, malicious code, unauthorized access, hackers or information security breaches that have resulted in and could again in the future result in the unauthorized release, gathering, monitoring, misuse, loss, theft or destruction of our confidential, proprietary and other information or that of our customers, or that could disrupt our operations or those of our customers or third parties. Even though we invest in, maintain and routinely test our operational and informational security procedures and controls, we may fail to anticipate or sufficiently mitigate security breaches, or we may experience data privacy breaches, that could result in losses to us or our customers, damage to our reputation, incurrence of significant costs, business disruption, our inability to grow our business and exposure to regulatory scrutiny or penalties, litigation and potential financial liability, any of which could adversely affect our business, financial condition, results of operations or capital position. Our computer systems could be vulnerable to unforeseen problems other than cybersecurity related incidents or other data security breaches, including the potential for infrastructure damage to our systems or the systems of our vendors from fire, power loss, telecommunications failure, physical break-ins, theft, natural disasters or similar catastrophic events. Any damage or failure that causes interruptions in operations may compromise our ability to perform critical functions in a timely manner (or may give rise to perceptions of such compromise) and could increase our costs of doing business, or have a material adverse effect on our financial condition, results of operations or capital position, as well as our reputation and customer or vendor relationships. In addition, some of the technology we use in our regulatory compliance, including our mortgage loan origination and servicing technology, as well as other critical business activities such as core systems processing, essential web hosting and deposit and processing services, as well as security solutions, are provided by third party vendors. If those providers fail to update their systems or services in a timely manner to reflect new or changing regulations, or if our personnel operate these systems in a non-compliant manner, our ability to meet regulatory requirements may be impacted and may expose us to heightened regulatory scrutiny and the potential for monetary penalties. These vendors are also sources of operational and informational security risk to us, including from interruptions or failures of their own systems, cybersecurity or ransomware attacks, capacity constraints or failures of their own internal controls. Such third parties are targets of cyber-attacks, computer viruses, malicious code, unauthorized access, hackers, ransomware attacks or information security breaches that have compromised and could again in the future compromise the confidential or proprietary information of HomeStreet and our customers.