Hancock Whitney (HWC) Risk Analysis

Competitors or other third parties have in the past alleged, and in the future may allege that we, or consultants or other third parties retained or indemnified by us or from whom we license critical information technology systems, infringe on their intellectual property rights. Given the complex, rapidly changing and competitive technological and business environment in which we operate, and the potential risks and uncertainties of intellectual property-related litigation, an assertion of an infringement claim against us or our vendors may cause us to spend significant amounts to defend the claim (even if we ultimately prevail); to pay significant money damages; to lose significant revenues; to be prohibited from using the relevant systems, processes, technologies or other intellectual property; to cease offering certain products or services or to incur significant license, royalty or technology development expenses. Moreover, it has become common in recent years for individuals and groups to purchase intellectual property assets for the sole purpose of making claims of infringement and attempting to extract settlements from companies like ours. Even in instances where we believe that claims and allegations of intellectual property infringement against us are without merit, defending against such claims is time consuming and expensive and could result in the diversion of time and attention of our management and employees. In addition, although in some cases a third party may have agreed to indemnify us for such costs, such indemnifying party may refuse, or be unable, to uphold its contractual obligations.

We depend on our ability to process, record and monitor a large number of client transactions and to communicate with clients and other institutions on a continuous basis. Our clients depend on us for access to their assets and account information. Our online, business, financial, accounting, data processing, or other operating systems and facilities, or those of our third-party service providers, may stop operating properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control. For example, there could be sudden increases in client transaction volume; electrical or telecommunications outages; natural disasters such as earthquakes, tornadoes, floods, and hurricanes; pandemics; events arising from local or larger scale political or social matters, including terrorist acts; occurrences of employee error, fraud, or malfeasance; and, as described below, cyber-attacks. Furthermore, for most financial institutions, transitioning from existing systems and software (or transitioning legacy systems and software) to a new provider is a significant and expensive undertaking and includes a number of risks, including crashes and system downtime, transition costs, decreased productivity, security risk, and legal and regulatory compliance risks. Although we have response plans, business continuity plans and other safeguards in place, our operations and communications may be adversely affected by significant and widespread disruption to our systems and infrastructure that support our businesses and clients. While we continue to evolve and modify our response and business continuity plans, there can be no assurance in an escalating threat environment that they will be effective in avoiding disruption and business impacts. Our insurance may not be adequate to compensate us for all resulting losses, and the cost to obtain adequate coverage may continue to increase for us or the industry. Security risks for financial institutions such as ours have dramatically increased in recent years, in part because of the proliferation of new technologies, included but not limited to AI, that may be used by threat actors to perpetuate cyberattacks, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication, resources and activities of hackers, terrorists, activists, organized crime, and other external parties, including nation state actors. In addition, clients may use devices or software to access our products and services that are beyond our control environment, which may provide additional avenues for attackers to gain access to confidential information. Although we have information security procedures and controls in place, certain of our technologies, systems, networks, and clients' devices and software have in the past and in the future likely will continue to be the target of cyber-attacks or information security incidents that could result in the unauthorized access, release, gathering, monitoring, use, loss, change or destruction of our or our clients' confidential, proprietary and other information (including personal identifying information of individuals), or otherwise disrupt our or our clients' or other third parties' business operations. From time to time, we, like other financial institutions, become aware of information security vulnerabilities in software emanating from outside vendors and must take active steps to mitigate and prevent the potential exploitation of such vulnerabilities. Further, U.S. financial institutions and financial services companies will continue to face compromises in security of their websites or other systems, including ransomware attacks to shut down access to their networks and systems in an attempt to extract compensation from them to regain control. Financial institutions have also experienced, and will continue to be the target of, distributed denial-of-service attacks, a sophisticated and targeted attack intended to disable or degrade internet service or to sabotage systems. We and others in our industry regularly are, and will continue to be, the subject of attempts by attackers to gain unauthorized access to our networks, systems, data and other infrastructure, or to obtain, change, or destroy confidential data (including personal identifying information of individuals) through a variety of means, including computer hacking, acts of vandalism or theft, malware, computer viruses or other malicious codes, phishing, brute force attacks, exploiting software vulnerabilities (including "zero-day attacks"), supply chain attacks, employee error or malfeasance, catastrophes, unforeseen events or other cyber-attacks. In the future, these attacks may result in unauthorized individuals obtaining access to our confidential information or that of our clients, or otherwise materially accessing, damaging, or disrupting our systems or infrastructure, or those of our third-party service providers. To date, we have seen no material adverse impact on our business or operations from cyber-attacks or events. Any future significant compromise or breach of our data security, whether external or internal, or misuse of customer, associate, supplier or Company data, could result in significant disruption of our operations, reimbursement and other costs, lost sales, fines (which fines may not be covered by our insurance policies), lawsuits, regulatory scrutiny, and other legal exposure, a loss of trust in us on the part of our clients, vendors or other counterparties, client attrition and damage to our reputation. Any of these could materially and adversely affect our results of operations, our financial condition, and/or our share price. However, the ever-evolving threats mean we and our third-party service providers and vendors must continually evaluate and adapt our respective systems and processes and overall security environment, as well as those of any companies we acquire. We are continuously enhancing our controls, processes and practices designed to protect our networks, systems, data and other infrastructure from attack, damage or unauthorized access. This continued enhancement will require us to expend additional resources, including to investigate and remediate any information security vulnerabilities that may be detected. Despite our ongoing investments in security resources, talent, and business practices, there is no guarantee that these measures will be adequate to safeguard against all data security incidents, system compromises or misuses of data.

Changes to tax laws could significantly impact our business in the form of greater than expected income tax expense and taxes payable. Such changes may also negatively impact the financial condition of our customers and/or overall economic conditions. Further, future regulatory reforms that could include a heightened focus and scrutiny on BSA/AML-related compliance, expansion of consumer protections, the regulation of loan portfolios and credit concentrations to borrowers impacted by climate change, increased capital and liquidity requirements and limitations or additional taxes on share repurchases and dividends, could increase our costs and impact our business. Regulatory agencies may also alter examination priorities or enforcement approaches in light of recent market stresses, which could result in higher compliance burden, increased operational costs, or constraints on certain business activities.

As a regulated financial institution and a publicly traded company, we are facing increasing public, investor, activist, legislative and regulatory scrutiny related to sustainability practices, disclosures and developments. Regulators, politicians, investor advocacy groups, investment funds, and influential investors are increasingly focused on these practices, especially as they relate to climate risk, hiring practices, diversity, health and safety and human rights. Failure to adapt to or comply with regulatory requirements or regulatory, investor or stakeholder expectations and standards could negatively impact the Company's reputation, ability to do business with certain partners, and stock price. Ongoing legislative or regulatory uncertainties, divergence and changes regarding sustainability may result in higher compliance, credit and reputational risks and costs. To the extent that we or our customers experience increases in costs, including with respect to compliance with any additional regulatory or disclosure requirements or expectations, reductions in the value of assets, constraints on operations or similar concerns driven by changes in sustainability oversight and regulation, our results of operations, financial condition, and business could be adversely affected.

Our market areas are often impacted by hurricanes and flooding. Natural disasters, such as hurricanes, flooding, tornados, freezes and other natural and man-made disasters, such as oil spills, can disrupt our operations, result in significant damage to our properties or properties and businesses of our borrowers, including property pledged as collateral, interrupt our ability to conduct business, negatively affect the local economies in which we operate, and increase circumstances leading to litigation. We cannot predict whether or to what extent damage caused by future hurricanes and other disasters will affect our operations or the economies in our market areas, but such events could cause a decline in loan originations, a decline in the value or destruction of properties securing the loans and an increase in the risk of delinquencies, foreclosures, loan losses and litigation. Climate change may increase the nature, severity and frequency of adverse weather conditions in our footprint, making the impact from these types of natural disasters on us or our customers worse. We and our customers rely on the existence of, and ability of private and public insurance programs to provide coverage for these types of events. Cost for insurance coverage under these programs has and may continue to increase, negatively impacting our business costs and our customers' levels of liquidity and the ability to service their debt. The unavailability of these types of coverage or the inability of these entities to perform could also have a materially adverse impact on our operations. Further, our business, financial condition, and results of operations may be adversely affected by potential changes in federal emergency response, disaster relief, and recovery policies, including, but not limited to, actions by the Federal Emergency Management Agency or reductions in federal disaster funding. Delays or changes in governmental support programs, rebuilding assistance, flood-insurance availability, or disaster-recovery rules could slow economic recovery in affected areas, impact collateral values, and adversely affect borrower repayment capacity.

We rely on certain third parties to provide products and services necessary to maintain day-to-day operations, such as back-office support, data processing and storage, recording and monitoring transactions, online banking interfaces and services, internet connections, telecommunications, and network access. The failure of a third party to perform in accordance with the contracted arrangements under service level agreements as a result of changes in the third party's organizational structure, financial condition, support for existing products and services, strategic focus, system interruption or breaches, or for any other reason, could be disruptive to our operations, which could have a material adverse effect on our business, financial condition and results of operations. Our third-party applications may include confidential and proprietary data provided by vendors and by us, including personal employee and/or customer data. While we conduct due diligence prior to engaging with third-party vendors and perform ongoing monitoring of vendor controls, we do not control their operations. Further, while our third-party risk management policies and practices are designed to comply with current regulations, these policies and practices cannot eliminate this risk. Replacing these third parties could also create significant delays and expense. Transitioning services, integrating new platforms, or converting data from one provider to another can introduce operational complexity, require extensive testing, and temporarily disrupt customer service or internal workflows. Accordingly, use of such third parties creates an inherent risk to our business operations.

Our profitability depends on our ability to compete successfully in a highly competitive market for banking and financial services, and we expect such challenges to continue. Certain of our competitors are larger, have more resources than we do and may be perceived as better than regional banks at safeguarding deposits in excess of federally insured limits. We face competition in our regional market areas from other commercial banks, savings associations, credit unions, mortgage banking firms, securities brokerage firms, mutual funds and insurance companies, fintechs and other financial institutions that offer similar services. Some of our nonbank competitors are not subject to the same extensive supervision and regulation to which we or the Bank are subject and may, accordingly, have greater flexibility in competing for business. Over time, certain sectors of the financial services industry have become more concentrated, as institutions involved in a broad range of financial services have been acquired by other firms. These developments could result in our competitors gaining greater capital and other resources or being able to offer a broader range of products and services with more geographic range. Our loan and deposit pricing may be negatively impacted by our competitive environment. If our fee structures are deemed less favorable than other financial services providers, we may be at a competitive disadvantage in attracting customers for certain fee producing products. Further, we may choose to implement changes to remain competitive that could adversely affect our operating results. Another competitive factor is that the financial services market, including banking services, is undergoing rapid changes with frequent introductions of new technology-driven products and services, primarily as a result of the increased digitization of banking services. We compete with many forms of payments offered by both bank and non-bank providers, including a variety of new and evolving alternative payment mechanisms, systems and products, such as aggregators and web-based and wireless payment platforms or technologies, digital or "crypto" currencies, including but not limited to stablecoins, prepaid systems and payment services targeting users of social networks, communications platforms and online gaming. Our future success may depend, in part, on our ability to use technology competitively to offer products and services that provide convenience to customers and create additional efficiencies in our operations. The widespread adoption of new technologies has and will continue to require us to make substantial capital expenditures to modify or adapt our systems to remain competitive and offer new products and services. Our ability to effectively implement new technologies to improve our operations and systems will impact our competitive position in the financial services industry. Furthermore, we may not be successful in introducing new products and services in response to industry trends or developments in technology, or those new products may not be accepted by customers. If we are unable to successfully compete with traditional competitors as well as the evolving landscape of fintech companies and other nontraditional competitors to attract and retain customers, our business, financial condition or results of operations may also be adversely affected, perhaps materially. In particular, if we experience an outflow of deposits as a result of our customers desiring to do business with our competitors, we may be forced to rely more heavily on borrowings and other sources of funding to operate our business and meet withdrawal demands, thereby adversely affecting our net interest margin.