M&T Bank (MTB) Risk Factors

M&T has expanded its business through past acquisitions and may do so in the future. The Company's ability to complete acquisitions is in many instances subject to regulatory approval, and the Company cannot be certain when or if, or on what terms and conditions, any required regulatory approvals would be granted. In recent years, federal authorities, including the bank regulators and Department of Justice, have increased their scrutiny of bank mergers and acquisitions, and there is continued uncertainty with regard to how they will evaluate bank mergers and acquisitions, including from an antitrust perspective. Any requisite approval could be delayed or not obtained at all, including due to, among other factors, an adverse development in either party's regulatory standing or in any other factors considered by regulators when granting such approval, including factors not known at the time of entering into the definitive agreement for the acquisition or submission of the related application for regulatory approval, and factors that may arise subsequently; governmental, political or community group inquiries, investigations or opposition; or changes in legislation or the political environment more generally. Anticipated challenges in obtaining any requisite regulatory approval, or uncertainty as to the prospects for obtaining approvals, could also prevent the Company from pursuing a potential acquisition it may otherwise view as attractive. In addition, inherent uncertainties exist when integrating the operations of an acquired entity, such as with respect to the Company's People's United acquisition in April 2022. Acquiring other entities involves potential risks that could have a material adverse impact on the Company's business, financial condition and results of operations, including: - Inability to fully achieve the Company's strategic objectives and planned operating efficiencies in an acquisition. - Issues arising during transition and integration. - Disruption of the Company's business and diversion of management's time and attention. - Exposure to unknown or contingent liabilities of acquired institutions. - Loss of key employees and customers of acquired institutions. - Dilution in the ownership percentage of holders of M&T common stock. - Payment of a premium over book and market values that may dilute the Company's tangible book value and earnings per common share in the short and long-term. - Inability to realize the expected benefits of the acquisition due to lower financial results pertaining to the acquired entity (for example, the Company could experience higher credit losses, incur higher operating expenses or realize less revenue than originally anticipated related to an acquired entity). - Changes in banking or tax laws or regulations that could impair or eliminate the expected benefits of merger and acquisition activities. - Reputational risks.

A negative public opinion of the Company and its business can result from any number of activities, including the Company's lending practices, corporate governance and regulatory compliance, acquisitions and actions taken by regulators or by community organizations in response to these activities. Significant harm to the Company's reputation could also arise as a result of regulatory or governmental actions, litigation, employee misconduct or the activities of customers, developments and the actions of other participants in the financial services industry, including failures of other financial institutions or activities of the Company's contractual counterparties, such as service providers and vendors. A service disruption of the Company's technology platforms, or to those of the Company's service providers or vendors, or an impact to the Company's branches could have a negative impact on a customer's access to banking services and harm the Company's reputation with customers. In particular, a cybersecurity event impacting the Company's or its customers' data could have a negative impact on the Company's reputation and customer confidence in the Company and its cybersecurity. Damage to the Company's reputation could also adversely affect its credit ratings and access to the capital markets. Additionally, whereas negative public opinion once was primarily driven by adverse news coverage in traditional media, the increased use of social media platforms facilitates the rapid dissemination of information or misinformation, which magnifies the potential harm to the Company's reputation.

Poor business and economic conditions in general or specifically in markets served by the Company could have adverse effects on the Company's business including: - A decrease in the demand for loans and other products and services offered by the Company. - A decrease in net interest income derived from the Company's lending and deposit gathering activities. - A decrease in the value of the Company's investment securities, loans held for sale or other assets secured by residential or commercial real estate. - A decrease in fees from the Company's brokerage, trust, and investment management businesses associated with declines or lack of growth in stock market prices. - Potential higher FDIC assessments due to the DIF falling below minimum required levels or special FDIC assessments relating to the failure of specific banks. - An impairment of certain intangible assets, such as goodwill. - An increase in the number of customers and counterparties who become delinquent, file for protection under bankruptcy laws or default on their loans or other obligations to the Company. An increase in the number of delinquencies, bankruptcies or defaults could result in higher levels of nonperforming assets, net charge-offs, provision for credit losses as well as impairment write-downs of certain investment securities and valuation adjustments on loans held for sale. If recessionary economic conditions develop, they would likely have a negative financial impact across the financial services industry, including on the Company. If recessionary economic conditions are more severe, the extent of the negative impact on the Company's business and financial performance can increase and be more severe, including the adverse effects listed above and discussed throughout this "Risk Factors" section. Supply chain constraints, robust demand and labor shortages have led to persistent inflationary pressures throughout the economy. Volatility and uncertainty related to inflation and the effects of inflation, including potentially higher interest rates, which may lead to increased costs for businesses and consumers and potentially contribute to poor business and economic conditions generally, may also enhance or contribute to some of the risks discussed herein. For example, higher inflation, or volatility and uncertainty related to inflation, could reduce demand for the Company's products, adversely affect the creditworthiness of the Company's borrowers, result in lower values for the Company's investment securities and other interest-earning assets and increase expense related to talent acquisition and retention. Additionally, economic conditions, financial markets and inflationary pressures may be adversely affected by the impact of current or anticipated geopolitical uncertainties; military conflicts, including Russia's invasion of Ukraine and the attacks on Israel and conflict in the Middle East; pandemics, including the COVID-19 pandemic; and global, national and local responses thereto by governmental authorities and other third parties. These unpredictable events could create, increase or prolong economic and financial disruptions and volatility that adversely affects the Company's business, financial condition, capital and results of operations. Concern regarding the ability of Congress to reach agreement on federal budgetary matters (including the debt ceiling), or total or partial governmental shutdowns, also can adversely affect the economy and increase the risk of economic instability or market volatility, which could have adverse consequences on our business, financial condition, liquidity and results of operations.

Pandemics, such as the COVID-19 pandemic; acts of war; military conflicts, such as Russia's invasion of Ukraine and the conflict in the Middle East as a result of recent attacks on Israel; or terrorism and other adverse external events, including severe weather and other natural disasters, could have a significant impact on the Company's ability to conduct business. Such events could affect the stability of the Company's deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue and/or cause the Company to incur additional expenses. Although the Company has established disaster recovery plans and procedures, and monitors for significant environmental effects on its properties or its investments, the occurrence of any such event could have a material adverse effect on the Company. For example, the COVID-19 pandemic created economic and financial disruptions that adversely affected, and may in the future adversely affect, the Company's business, financial condition, capital and results of operations. Depending on the impact of pandemics, military conflicts, terrorism and other detrimental or destabilizing global and national events on general economic and market conditions, consumer and corporate spending and investment and borrowing patterns, there is a risk that adverse conditions could occur, including supply chain disruptions; higher inflation; decreased demand for the Company's products and services or those of its borrowers, which could increase credit risk; challenges related to maintaining sufficient qualified personnel due to labor shortages, talent attrition, employee illness and willingness to return to work; and disruptions to business operations at the Company and at counterparties, vendors and other service providers. Even after such events fully subside, the U.S. economy may experience a prolonged economic slowdown or recession, and M&T anticipates the Company's businesses would be materially and adversely affected by a prolonged economic slowdown or recession. The escalation or continuation of the war between Russia and Ukraine or other hostilities, such as the conflict in the Middle East resulting from recent attacks on Israel, could result in, among other things, further increased risk of cybersecurity attacks, supply chain disruptions, higher inflation, lower consumer demand and increased volatility in commodity, currency and other financial markets. To the extent that pandemics, acts of war or conflict, terrorism and other detrimental external events adversely affect the Company's business, financial condition, liquidity, capital or results of operations, such factors may also have the effect of heightening many of the other risks described in this "Risk Factors" section.

The Company relies heavily on communications and information systems, including those of third-party service providers, to conduct its business. Any failure, interruption or breach in security of these systems could result in disruptions to its accounting, deposit, loan and other systems, and adversely affect the Company's customer relationships. Disruption of operating systems caused by events beyond the Company's control may include computer viruses, electrical or telecommunications outages, quality of vulnerability patches, cybersecurity attacks (including Distributed Denial of Service attacks, which occur when legitimate users are unable to access information systems, devices, or other network resources due to the actions of a malicious cyber threat actor), damage to property or physical assets, or events arising from political protests or terrorist acts. While the Company has policies and procedures designed to prevent or limit the effect of these possible events, there can be no assurance that any such failure, disruption, interruption or security breach will not occur or, if any does occur, that it can be sufficiently or timely remediated. Information security risks for large financial institutions such as M&T have increased significantly in recent years in part because of the proliferation of new technologies, such as digital and mobile banking to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, activists and other external parties. There have been increasing efforts on the part of third parties, including through cybersecurity attacks, to breach data security at financial institutions or with respect to financial transactions. There have been numerous instances involving financial services and consumer-based companies reporting unauthorized access to and disclosure of client or customer information or the destruction or theft of corporate data, including by executive impersonation and third party vendors, or the freezing of operating systems and databases making them inaccessible or unusable. There have also been several highly publicized cases where hackers have requested "ransom" payments in exchange for not disclosing customer information or for restoring access to, or the usage of, operating systems and databases. Ransomware is a form of malicious software, known as "malware," designed to block access to, and often encrypt, computer systems or data. Once the victim's computer system or data is locked down and encrypted, rendering it essentially useless, the malicious cyber actor then extorts the victim by demanding a ransom payment in exchange for providing a method to decrypt it. The attacker may also copy the victim's data in the course of the attack and threaten to sell or publish the data if the ransom is not paid. Ransomware attacks can result in a loss of business functionality and of sensitive data. As cybersecurity threats continue to evolve, the Company expects to continue to expend significant additional resources to modify or enhance its layers of defense or to investigate and remediate any information security vulnerabilities. The techniques used by cybersecurity criminals change frequently, may not be recognized until launched and can be initiated by a variety of actors, including terrorist organizations and hostile foreign governments. These techniques may include attempts to fraudulently induce employees, customers or others to disclose sensitive information in order to gain access to data or systems. These risks may increase as the use of mobile payment and other Internet-based applications expands. Further, third parties with which the Company does business, as well as vendors and other third parties with which the Company's customers do business, can also be sources of information security risk to the Company, particularly where activities of customers are beyond the Company's security and control systems, such as through the use of the Internet, personal computers, tablets, smart phones and other mobile services. Risks relating to cybersecurity attacks on vendors and other third parties, including supply chain attacks affecting software and information technology service providers, have been rising as such attacks become increasingly frequent and severe. For example, in 2023, a widely reported global cybersecurity incident occurred involving MOVEit, a file transfer software product owned by Progress Software Corporation that is used by thousands of public and private sector entities worldwide. As reported, this incident resulted in the theft of sensitive data from a large number of organizations, and certain Company customer information in the possession of the Company's external service providers was compromised in connection with it, while no information was obtained from the Company's internal systems and these systems were not at risk from the MOVEit incident. Security breaches affecting the Company's customers, or systems breakdowns, failures, security breaches or employee misconduct affecting such other third parties, may require the Company to take steps to protect the integrity of its own systems or to safeguard confidential information of the Company or its customers, thereby increasing the Company's operational costs and adversely affecting its business. Additionally, successful cybersecurity attacks at other large financial institutions, whether or not the Company is impacted, could lead to a general loss of customer confidence in financial institutions that could negatively affect M&T, including harming the market perception of the effectiveness of the Company's security measures or the financial system in general which could result in reduced use of the Company's financial products. Though the Company has insurance against some cybersecurity risks and attacks, it may not be sufficient to offset the impact of a material loss event. The Company, as well as third parties with which the Company does business, has expanded the use of cloud service providers, which could experience system breakdowns or failures, outages, downtime, cybersecurity attacks, negative changes to financial condition, bankruptcy, or other adverse conditions, which could have a material adverse effect on the Company's business and reputation. For example, during 2021, there were a number of widely publicized cases of outages in connection with access to cloud service providers. Thus, increasing the amount of infrastructure that the Company or its vendors and service providers outsource to the cloud or to other parties may increase M&T's risk exposure. The failure to properly upgrade or maintain the computer systems could result in greater susceptibility to attacks, particularly in light of the greater frequency and severity of attacks in recent years, as well as the growing prevalence of supply chain attacks affecting software and information technology service providers. Failures related to upgrades and maintenance also increase risks related to unauthorized access and misuse, as well as the Company's ability to achieve its business continuity and resiliency objectives.