First Internet Bancorp (INBK) Risk Analysis

Competition in the banking and financial services industry is strong. We compete with commercial banks, savings institutions, credit unions, finance companies, fintechs, mutual funds, insurance companies and securities brokerage and investment banking firms operating locally and nationwide, and may soon compete with entities granted "special purpose national bank" ("SPNB") charters by the Office of the Comptroller of the Currency. Some of our competitors have greater name financial resources, recognition and market presence than we do and offer certain services that we do not or cannot provide. In addition, larger competitors may be able to price loans and deposits more aggressively than we do, which could affect our ability to increase our market share and remain profitable on a long-term basis.

Our ability to attract and retain customers is highly dependent upon other external perceptions of our business practices and financial condition. Adverse perceptions could damage our reputation to a level that could lead to difficulties in generating and maintaining lending and deposit relationships and accessing equity or credit markets, as well as increased regulatory scrutiny of our business. Adverse developments or perceptions regarding the business practices or financial condition of our competitors, or our industry as a whole, may also indirectly adversely affect our reputation. In addition, adverse reputational developments with respect to third parties with whom we have important relationships may negatively affect our reputation. All of the above factors may result in greater regulatory and/or legislative scrutiny, which may lead to laws or regulations that may change or constrain the manner in which we engage with our customers and the products we offer and may also increase our litigation risk. If these risks were to materialize, they could negatively affect our business, financial condition and results of operations.

We depend upon our ability to process, record and monitor our client transactions on a continuous basis. As customer, public and regulatory expectations regarding data privacy and information security have increased, our operational systems and infrastructure must continue to be safeguarded and monitored for potential failures, disruptions and breakdowns. Our business, financial, accounting and data processing systems, or other operating systems and facilities, may stop operating properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control. For example, there could be electrical or telecommunications outages; natural disasters such as earthquakes, tornadoes and hurricanes; pandemics; events arising from local or larger-scale political or social matters, including terrorist acts; and, as described below, cyber-attacks. Although we have business continuity plans and other safeguards in place, our business operations may be adversely affected by significant and widespread disruption to our physical infrastructure or operating systems that support our business. Information security risks for financial institutions such as ours have generally increased in recent years in part because of the proliferation of new technologies, the use of digital technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, activists and other external parties. As noted above, our operations rely on the secure processing, transmission and storage of confidential information in our computer systems and networks. Our business relies on our digital technologies, computer and email systems, software and networks to conduct its operations. In addition, to access our products and services, our customers may use smartphones, tablets, personal computers and other mobile devices that are beyond our control systems. Although we have information security procedures and controls in place, our technologies, systems, networks and our customers' devices may become the target of cyber-attacks or information security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of our or our customers' confidential, proprietary and other information, or otherwise disrupt our or our customers' or other third parties' business operations. Third parties with whom we do business or that facilitate our business activities, including financial intermediaries or vendors that provide services or security solutions for our operations, could also be sources of operational and information security risk to us, including from breakdowns or failures of their own systems or capacity constraints. Although to date we have not experienced any material losses relating to cyber-attacks or other information security breaches, like other companies, we and our vendors face a wide range of ongoing cyber threats that include phishing emails and social engineering schemes, ransomware threats, and criminal re-use of credentials sold on the dark web. There can be no assurance that we will not suffer such material losses in the future. Our risk and exposure to these matters remains heightened because of the evolving nature of these threats. As a result, cybersecurity and the continued development and enhancement of our controls, processes and practices designed to protect our systems, computers, software, company data, networks, and customer information from attack, damage or unauthorized access remain a focus for us. As threats continue to evolve, we may be required to expend additional resources to continue to modify or enhance our protective measures or to investigate and remediate information security vulnerabilities. Disruptions or failures in the physical infrastructure or operating systems that support our business and clients, or cyber-attacks or security breaches of the networks, systems or devices that our clients use to access our products and services, could result in client attrition, regulatory fines, penalties or intervention, breach investigation and notification expenses,reputational damage, claims or litigation, reimbursement or other compensation costs and/or additional compliance costs, any of which could materially and adversely affect our business, financial condition and results of operations.

We could experience other external events such as severe weather, natural disasters, acts of war, terrorism or widespread public health issues, such as the COVID-19 pandemic or another highly contagious or infectious disease, that could impair the ability of our customers to repay outstanding loans; impair the value of collateral, if any, securing outstanding loans; negatively impact our deposit base, loan originations or general demand for our services; cause significant property damage; result in loss of revenue or cause us to incur additional expenses or losses. We could also be adversely affected if key personnel or a significant number of employees were to become unavailable due to external events affecting the places they live. Although we have business continuity plans and other safeguards in place, there is no assurance that such plans and safeguards will completely mitigate the adverse impacts of any significant external event. The occurrence or continuation of any such event could materially adversely impact our business, our ability to provide our services, demand for our services, asset quality, financial condition and results of operations.

Our future success and profitability are substantially dependent upon our management and the abilities of our senior executives. We believe that our future results will also depend in part upon our ability to attract and retain highly skilled and qualified management. Competition for senior personnel is intense, and we may not be successful in attracting and retaining such personnel. Changes in key personnel and their responsibilities may be disruptive to our business and could have a material adverse effect on our business, financial condition and results of operations. In particular, the loss of our chief executive officer could have a material adverse effect on our business, financial condition and results of operations.

The deposits of the Bank are insured by the FDIC up to legal limits and, accordingly, subject to the payment of FDIC deposit insurance assessments. The Bank's regular assessments are determined by its risk classification, which is based on a number of factors, including regulatory capital levels, asset growth and asset quality. High levels of bank failures during and following the financial crisis and increases in the statutory deposit insurance limits have increased resolution costs to the FDIC and put significant pressure on the DIF. In order to maintain a strong funding position and restore the reserve ratios of the DIF, the FDIC may increase deposit insurance assessment rates and may charge a special assessment to all FDIC-insured financial institutions. Further increases in assessment rates or special assessments may occur in the future, especially if there are significant additional financial institution failures. Any future special assessments, increases in assessment rates or required prepayments in FDIC insurance premiums could reduce our profitability or limit our ability to pursue certain business opportunities, which could have a material adverse effect on our business, financial condition and results of operations.