Heritage Commerce (HTBK) Risk Analysis

We are and will continue to be involved from time to time in a variety of litigation, investigations or similar matters arising out of our business. It is inherently difficult to assess the outcome of these matters, and we may not prevail in any proceedings or litigation. Any claims and lawsuits, and the disposition of such claims and lawsuits, whether through settlement, or litigation, could be time-consuming and expensive to resolve, divert management attention from executing our business plan, and lead to attempts on the part of other parties to pursue similar claims. Any claims asserted against us, regardless of merit or eventual outcome may harm our reputation. To mitigate the cost of some of these claims, we maintain insurance coverage in amounts and with deductibles that we believe are appropriate for our operations. However, our insurance coverage does not cover any civil monetary penalties, punitive damages or fines imposed by government authorities and may not cover all other claims that might be brought against us, including certain wage and hour class, collective and representative actions brought by clients, employees or former employees, and ponzi schemes. In addition, such insurance coverage may not continue to be available to us at a reasonable cost or at all. As a result, we may be exposed to substantial uninsured liabilities. Substantial legal liability or significant regulatory action against us could cause significant reputational harm to us and could have a material adverse impact on our business, financial condition, and results of operations.

Deferred tax assets and liabilities are the expected future tax amounts for the temporary differences between the carrying amounts and tax basis of assets and liabilities computed using enacted tax rates. We regularly assess available positive and negative evidence to determine whether it is more likely than not that our net deferred tax assets will be realized. Realization of a deferred tax asset requires us to apply significant judgment and is inherently speculative because it requires estimates that cannot be made with certainty. At September 30, 2024, we had a net deferred tax asset of $26.4 million. If we were to determine at some point in the future that we will not achieve sufficient future taxable income to realize our net deferred tax asset, we would be required, under generally accepted accounting principles, to establish a full or partial valuation allowance which would require us to incur a charge to income for the period in which the determination was made.

Our business and operations are sensitive to general business and economic conditions in the United States, generally, and particularly the state of California and our market area, which is situated primarily in the general San Francisco Bay Area. Unfavorable or uncertain economic and market conditions could lead to credit quality concerns related to borrowers' repayment ability and collateral coverage as well as reduced demand for our products and services. These economic conditions can arise suddenly, as did the conditions associated with the COVID-19 pandemic, and the full impact of such conditions can be difficult to predict. In addition, geopolitical and domestic political developments, such as existing and potential trade wars and other events beyond our control, can increase levels of political and economic unpredictability globally and increase the volatility of financial markets. Concerns about the performance of international economies, especially in Europe and emerging markets, and economic conditions in Asia, can impact the economy and financial markets here in the United States. If the national, regional and local economies experience worsening economic conditions, including declining growth and high levels of unemployment, our growth and profitability could be constrained. Weak economic conditions are characterized by, among other indicators, deflation, inflation, elevated levels of unemployment, fluctuations in debt and equity capital markets, increased delinquencies on mortgage, commercial and consumer loans, residential and commercial real estate price declines, related vacancy rates, and lower home sales and commercial activity. Various market conditions may also negatively affect our operating results. Real estate market conditions directly affect performance of our loans secured by real estate. Debt markets affect the availability of credit, which affects the rates and terms at which we offer loans and leases. Stock market downturns affect businesses' ability to raise capital and invest in business expansion. Stock market downturns often signal broader economic deterioration and/or a downward trend in business earnings, which adversely affects businesses' ability to service their debts. There can be no assurance that economic conditions will improve, and these conditions could worsen. Economic pressure on consumers and uncertainty regarding continuing economic improvement may result in changes in consumer and business spending, borrowing and saving habits. Such conditions could have a material adverse effect on the credit quality of our loans or our business, financial condition and results and operations. An economic recession or a downturn in various markets could have one or more of the following adverse effects on our business: - a decrease in the demand for our loan or other products and services offered by us;- a decrease in our deposit balances due to an overall reduction in client balances;- a decrease in the value of our investment securities and loans;- an increase in the level of nonperforming and classified loans;- an increase in the provision for credit losses and loan charge-offs;- a decrease in net interest income derived from our lending and deposit gathering activities;- a decrease in the Company's stock price;- an increase in our operating expenses associated with attending to the effects of the above-listed circumstances; and/or - a decrease in real estate values or a general decrease in capital available to finance real estate transactions, which could have a negative impact on borrowers' ability to pay off their loans as they mature.

We depend to a significant extent on relationships with third-party service providers. Specifically, we utilize third-party core banking services and receive credit card and debit card services, branch capture services, Internet banking services and services complementary to our banking products from various third party service providers. These types of third-party relationships are subject to increasingly demanding regulatory requirements that require us to maintain and continue to enhance our due diligence and ongoing monitoring and control over our third-party vendors. We may be required to renegotiate our agreements to meet these enhanced requirements, which could increase our costs. If our service providers experience difficulties or terminate their services and we are unable to replace them, our operations could be interrupted. It may be difficult for us to timely replace some of our service providers, which may be at a higher cost due to the unique services they provide. A third-party provider may fail to provide the services we require, or meet contractual requirements, comply with applicable laws and regulations, or suffer a cyberattack or other security breach. We expect that our regulators would hold us responsible for deficiencies of our third-party relationships which could result in enforcement actions, including civil money penalties or other administrative or judicial penalties or fines, or client remediation, any of which could have a material adverse effect on our business, financial condition and results of operations.

At September 30, 2024, land and construction loans, (including land acquisition and development loans) totaled $125.8 million or 4% of our portfolio. Of these loans, 16% were comprised of owner occupied and 84% non-owner occupied land and construction loans. These loans involve additional risks because funds are advanced upon the security of the project, which is of uncertain value prior to its completion, and costs may exceed realizable values in declining real estate markets. Because of the uncertainties inherent in estimating construction costs and the realizable market value of the completed project and the effects of governmental regulation of real property, it is relatively difficult to evaluate accurately the total funds required to complete a project and the related loan-to-value ratio. As a result, construction loans often involve the disbursement of substantial funds with repayment dependent, in part, on the success of the ultimate project and the ability of the borrower to sell or lease the property, rather than the ability of the borrower or guarantor to repay principal and interest. If our appraisal of the value of the completed project proves to be overstated or market values or rental rates decline, we may have inadequate security for the repayment of the loan upon completion of project construction. If we are forced to foreclose on a project prior to or at completion due to a default, we may not be able to recover all of the unpaid balance of, and accrued interest on, the loan as well as related foreclosure and holding costs. In addition, we may be required to fund additional amounts to complete the project and may have to hold the property for an unspecified period of time while we attempt to dispose of it.

From time to time, we may implement or may acquire new lines of business or offer new products and services within existing lines of business. There are substantial risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and new products and services we may invest significant time and resources. We may not achieve target timetables for the introduction and development of new lines of business and new products or services and price and profitability targets may not prove feasible. External factors, such as regulatory compliance obligations, competitive alternatives, and shifting market preferences, may also impact the successful implementation of a new line of business or a new product or service. Furthermore, any new line of business and/or new product or service could have a significant impact on the effectiveness of our system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business or new products or services could have a material adverse effect on our business, financial condition and results of operations.

In the normal course of business, we (directly or through third parties) collect, store, share, process and retain sensitive and confidential information regarding our clients. We also rely heavily upon electronic infrastructure that we own or that we obtain via license or other contractual arrangements with third parties. This infrastructure is essential in the conduct of our business, including for allowing our clients to access and transfer funds, initiate and pay loans and leases, communicating with our client service teams, and a variety of other activities that form the foundation of modern financial services businesses. There have been a number of recent and well-publicized incidents involving various types of cybersecurity lapses, and many of these have had substantial impacts upon targeted businesses and on clients of even some of the world's most prominent cybersecurity firms. One of the most recent events resulted in a widespread failure of a large cybersecurity platform, some of the consequences of which are ongoing and may not be fully known or estimable. Similarly, extremely sophisticated criminal and nation-state organizations routinely target and exploit information technology networks, data systems, and other critical infrastructure. Some of the most common types of threats targeting financial institutions include: - Ransomware Attacks. These threats ordinarily involve intrusions into networks or data storage systems by actors who render the platform inoperable or that obtain or obstruct access to sensitive data, whereupon the malefactor notifies the platform's owner and demands cash payment in exchange for a complex code that "unlocks" the malware. Another variant of this practice demands a ransom in exchange for a promise not to make sensitive data, such as client information, available to unauthorized sources. - Cloud Services Attacks. Because financial institutions are highly reliant on data that is stored in "cloud" servers, and on services that use cloud-based software platforms, malefactors often seek to "hijack" these services, either by rendering them inaccessible or by misusing or damaging information or programs that depend on these systems. - Artificial Intelligence-Based Attacks. As we experience an unprecedented growth in the development of artificial intelligence, various hostile actors and criminals are actively developing means by which this technology can be used to exploit computer networks. This technology can be used to manipulate a business' processes to produce erroneous or unreliable results, to perpetrate ransomware or cloud-based attacks, or to destroy or render unusable a company's systems or data. - Phishing. A longstanding but still highly effective threat known as "phishing" involves tricking an unwitting employee, client or vendor into disclosing passwords, encryption keys, or other sensitive information that allows a threat actor to access networks or data systems, where the actor can engage in a ransomware attack, install a worm or virus, or engage in fraudulent activity. We devote significant resources and management focus to ensure the integrity of our systems against cybercriminals and similar actors, as well as against threats from fires and other natural disasters; power or telecommunications failures; acts of terrorism or wars or other catastrophic events; breaches, physical break-ins or errors resulting in interruptions and unauthorized disclosure of confidential information, through information security and business continuity programs. Likewise, we have made, and we continue to make, substantial investments in systems that are intended to protect against these vulnerabilities, including real-time threat detection and warning, security programs and protocols, backup and alternative-access systems, virus and malware protection programs, and a wide variety of other protective measures. Notwithstanding these efforts, cybersecurity measures are, by their nature, largely reactive, and threats are constantly evolving. We expect that the development of AI-based technology will cause a rapid expansion in both the number and the sophistication of these threats. While we believe we maintain state-of-the-art defensive measures, we routinely experience attempts to exploit our networks and systems, and we must continue investing in increasingly sophisticated (and concomitantly expensive) technology to counteract these threats. Further, if our systems cannot timely detect and mitigate vulnerabilities, or cannot promptly respond to threats, we may experience damage to or interruptions in the availability of our computer networks, or we may experience a loss of data, unauthorized use or disclosure of client information, or a loss of client funds as a result of unauthorized access to client accounts. Furthermore, enhancements and upgrades to our infrastructure or computer systems may be time-consuming, may entail significant costs, and may themselves create risks associated with implementing new systems and integrating them with existing ones. Due to the complexity and interconnectedness of our systems, the process of enhancing our infrastructure and operating systems, including their security measures and controls, also can create an inherent risk of system disruptions and security issues. Similarly, we may not be able to timely recover critical business processes or operations that have been disrupted, which may further increase any associated costs and consequences of such disruptions. Although we have enterprise incident response processes, business continuity plans and other safeguards in place to help provide operational resiliency, our business operations may be adversely affected by significant and widespread disruption to our physical infrastructure or computer systems that support our businesses and clients. Additionally, as financial institutions and technology systems become more interconnected and more complex, any operational incident at a third party, such as a vendor or client, may increase our operational risks, including from information breaches or loss, breakdowns, disruptions or failures of their own systems or infrastructure, or any deficiencies in the performance of their responsibilities. These risks are increased to the extent we rely on a single-source vendor or provider. We also must meet stringent and increasingly complex regulatory requirements regarding our use of third-party service providers, and any failure by our third-party service providers to meet their obligations to us or to comply with applicable laws, rules, regulations, or internal policies could result in the Company becoming subject to fines, penalties, or business restrictions, as well as to increased costs to remediate any actual or perceived deficiencies and potentially to legal and other costs associated with defending against such regulatory sanctions. Disruptions or failures in the physical infrastructure, controls or operating systems that support our businesses and clients, failures of the third parties on which we rely to adequately or appropriately provide their services or perform their responsibilities, or our failure to effectively manage or oversee our third-party relationships, could result in business disruptions, loss of revenue or clients, legal or regulatory proceedings, remediation and other costs, violations of applicable privacy and other laws, reputational damage, client harm, or other adverse consequences, any of which could materially adversely affect our results of operations or financial condition. Further, new and evolving SEC regulations, as well as federal and state banking and consumer privacy laws and regulations, could require us to provide notices of security breaches. Such failures could result in increased regulatory scrutiny, legal liability, a loss of confidence in the security of our systems or an adverse perception of our products and services. The access by unauthorized persons to, or the improper disclosure by us or our third-party vendors of, confidential information regarding our clients or our own proprietary information, software, methodologies and business secrets, failures or disruptions in our communications, information and technology systems, or our failure to adequately address them, could negatively affect our client relationship management, online banking, accounting or other systems. We cannot assure readers that such breaches, failures or interruptions will not occur or, if they do occur, that they will be adequately addressed by us or the third parties on which we rely. Our insurance may not fully cover all types of losses. Accordingly, any failures or interruptions of our communications, information and technology systems could damage our reputation, result in a loss of client business, subject us to additional regulatory scrutiny or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on our business, financial condition or results of operations.

In deciding whether to extend credit or to enter into other transactions with clients and counterparties, we may rely on information furnished to us by or on behalf of clients and counterparties, including financial statements and other financial information. Some of the information regarding clients provided to us is also used in our proprietary credit decision making and scoring models, which we use to determine whether to do business with clients and the risk profiles of such clients some of these protocols are subsequently utilized by counterparties who may lend us capital to fund our operations. We may also rely on representations of clients and counterparties as to the accuracy and completeness of that information. In deciding whether to extend credit, we may rely upon our clients' representations that their financial statements conform to stated accounting principles and present fairly, in all material respects, the financial condition, results of operations and cash flows of the client. We also may rely on client representations and certifications, or other audit or accountants' reports, with respect to the business and financial condition of our clients. Whether a misrepresentation is made by the applicant, another third party or one of our employees, we generally bear the risk of loss associated with the misrepresentation. We may not detect all misrepresented information in our originations or from service providers we engage to assist in the approval process. Any such misrepresented information could have a material adverse effect on our business, financial condition and results of operations.