Metropolitan Bank Holding (MCB) Risk Factors

The Company relies upon operational and information systems, some of which are managed by third parties, to process, transmit and store electronic information and to manage or support a variety of our business processes, activities and products. Additionally, we collect and store sensitive data, including the personally identifiable information of our customers and employees, in data centers and on information systems (including systems that may be controlled or maintained by third parties). The Company's business, and in particular, the debit card and cash management solutions business and global payments business, is dependent on its ability to process and monitor, on a daily basis, a large number of transactions, many of which are highly complex, across numerous and diverse markets. These transactions, as well as the information technology services provided to clients, often must adhere to client-specific guidelines, as well as legal and regulatory standards. Due to the breadth and geographical reach of the Company's client base, developing and maintaining its operational and information systems and infrastructure is challenging, particularly as a result of rapidly evolving legal and regulatory requirements and technological shifts. Although the Company continues to take protective measures to maintain the confidentiality, integrity and security of our operational and information systems and infrastructure, the techniques used in cyberattacks are becoming increasingly diverse and sophisticated. For example, the Company's operational and information systems or infrastructure, or those of our third-party providers, may be vulnerable to unauthorized access, loss or destruction of data (including confidential client information), account takeovers, disruptions of service, computer viruses or other malicious code, cyberattacks and other incidents that could create a cybersecurity event, any of which could remain undetected for an extended period of time. Furthermore, the Company may not be able to ensure that all of its clients, suppliers, counterparties and other third parties have appropriate controls in place to protect themselves from cyberattacks or to protect the confidentiality of the information that they exchange with us, particularly where such information is transmitted by electronic means. Given the increasingly high volume of transactions, certain errors may be repeated or compounded before they can be discovered and rectified. In addition, the increasing reliance on information systems, and the occurrence and potential adverse impact of attacks on such systems, both generally and in the financial services industry, have encouraged increased government and regulatory scrutiny of the measures taken by companies to protect against cybersecurity threats and incidents. As these threats, incidents and government and regulatory oversight of associated risks continue to evolve, the Company may be required to expend additional resources to enhance or expand upon the security measures it currently maintains. Although the Company has developed, and continues to invest in, systems and processes that are designed to detect and prevent security breaches and cyberattacks, a breach of its systems and global payments infrastructure or those of our non-bank financial service partners and processors could result in: losses to the Company and its customers; loss of business and/or customers; damage to its reputation; the incurrence of additional expenses (including the cost of notification to consumers, credit monitoring and forensics, and fees and fines imposed by the card networks); disruption to its business; an inability to grow its online services or other businesses; additional regulatory scrutiny or penalties; and/or exposure to civil litigation and possible financial liability - any of which could have a material adverse effect on the Company's business, financial condition and results of operations. We have not encountered cybersecurity threats or incidents that have materially and adversely affected, or are reasonably likely to materially and adversely affect, the Company's business, results of operations or financial condition; however, the impacts of such threats or incidents in the future may be material. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For information on our cybersecurity risk management, strategy and governance, see Part I, Item 1C., "Cybersecurity."

The Company's ability to grow and compete is dependent on its ability to build or acquire and manage the necessary operational and technological infrastructure and to manage the cost of that infrastructure as it expands. Similar to other large corporations, operational risk can manifest itself in many ways, such as errors related to failed or inadequate processes, faulty or disabled computer systems, fraud by employees or outside persons and exposure to external events. In addition, the Company is heavily dependent on the strength and capability of its technology systems, which are used both to interface with customers and manage internal financial and other systems. The Company's ability to develop and deliver new products and services that meet the needs of its existing customers and attract new ones depends on the functionality of its technology systems. The financial services industry is undergoing rapid technological changes with frequent introductions of new technology-driven products and services. The Company's future success will depend in part upon its ability to address the needs of its clients by using technology to provide products and services that will satisfy client demands for convenience as well as provide secure electronic environments and create additional efficiencies as it continues to grow and expand its market area. The Company continuously monitors its operational and technological capabilities and makes modifications and improvements as it deems appropriate. Many of the Company's larger competitors have substantially greater resources to invest in operational and technological infrastructure. As a result, competitors may be able to offer more convenient products and services than the Company, which would put it at a competitive disadvantage. The Company also outsources some of its operational and technological infrastructure to third parties. If these third-party service providers experience difficulties, fail to comply with banking regulations or terminate their services and if the Company is unable to replace them with other service providers, its operations could be interrupted. If an interruption were to continue for a significant period of time, its business, financial condition and results of operations could be adversely affected, perhaps materially. Even if the Company were able to replace the third-party providers, it may be at a higher cost, which could adversely affect its business, financial condition and results of operations.

Employee errors and employee and customer misconduct could subject the Company to financial losses or regulatory sanctions and have a material adverse impact on its reputation. Misconduct by its employees could include concealing unauthorized activities, engaging in improper or unauthorized activities on behalf of customers or improper use of confidential information. It is not always possible to prevent employee errors and misconduct, and the precautions the Company takes to prevent and detect this activity may not be effective in all cases. Employee errors could also subject the Company to financial claims for negligence. The Company maintains a system of internal controls and insurance coverage to mitigate operational risks, including data processing system failures and errors and customer or employee fraud. If internal controls fail to prevent or detect an occurrence, or if any resulting loss is not insured or exceeds applicable insurance limits, it could have a material adverse impact on the Company's business, financial condition and results of operations.

The Company's success depends in large part on the performance of its key personnel, as well as on its ability to attract, motivate and retain highly qualified senior and middle management and other skilled employees. Competition for employees is intense, and the process of locating key personnel with the combination of skills and attributes required to execute its business plan may be lengthy. The Company may not be successful in retaining its key employees, and the unexpected loss of services of one or more of key personnel could have a material adverse effect on its business because of their skills, knowledge of primary markets, years of industry experience and the difficulty of promptly finding qualified replacement personnel. If the services of any key personnel should become unavailable for any reason, the Company may not be able to identify and hire qualified persons on acceptable terms, or at all, which could have a material adverse effect on the business, financial condition, results of operations and future prospects of the Company.