Northwest Bancshares (NWBI) Risk Factors

A significant portion of our loan portfolio is secured by real estate, and we could become subject to environmental liabilities with respect to one or more of these properties. During the ordinary course of business, we may foreclose on and take title to properties securing defaulted loans. In doing so, there is a risk that hazardous or toxic substances could be found on these properties. If hazardous conditions or toxic substances are found on these properties, we may be liable for remediation costs, as well as for personal injury and property damage, civil fines and criminal penalties regardless of when the hazardous conditions or toxic substances first affected any particular property. Environmental laws may require us to incur substantial expenses to address unknown liabilities and may materially reduce the affected property's value or limit our ability to use or sell the affected property. In addition, future laws or regulations or more stringent interpretations or enforcement policies with respect to existing laws and regulations may increase our exposure to environmental liability, and heightened pressure from investors and other stakeholders may require to incur additional expenses with respect to environmental matters. Although we have policies and procedures to perform an environmental review before initiating any foreclosure action on nonresidential real property, these reviews may not be sufficient to detect all potential environmental hazards. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on us.

Competition in the banking and financial services industry is intense. We compete with commercial banks, savings institutions, mortgage brokerage firms, credit unions, finance companies, fintech companies, mutual funds, insurance companies, and brokerage and investment banking firms operating locally and elsewhere. Many of these competitors (whether regional or national institutions) have substantially greater resources and lending limits than we have and may offer certain services that we do not or cannot provide. In addition, some have competitive advantages such as the credit union exemption from paying federal income tax. Competitive factors driven by consumer sentiment or otherwise can also reduce our ability to generate fee income, such as through overdraft fees. Our profitability depends upon our ability to successfully compete in our market areas.

We are a community bank, and our reputation is one of the most valuable components of our business. A key component of our business strategy is to rely on our reputation for customer service and knowledge of local markets to expand our presence by capturing new business opportunities from existing and prospective customers in our current market and contiguous areas. As such, we strive to conduct our business in a manner that enhances our reputation. This is done, in part, by recruiting, hiring and retaining employees who share our core values of being an integral part of the communities we serve, delivering superior service to our customers and caring about our customers and associates. If our reputation is negatively affected by the actions of our employees, by our inability to conduct our operations in a manner that is appealing to current or prospective customers, or otherwise, our business and operating results may be adversely affected.

From time to time, we may implement new lines of business or offer new products and services within existing lines of business. In addition, we will continue to make investments in research, development, and marketing for new products and services. There are substantial risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and/or new products and services we may invest significant time and resources. Initial timetables for the development and introduction of new lines of business and/or new products or services may not be achieved and price and profitability targets may not prove feasible. Furthermore, if customers do not perceive our new offerings as providing significant value, they may fail to accept our new products and services. External factors, such as compliance with regulations, competitive alternatives, and shifting market preferences, may also impact the successful implementation of a new line of business or a new product or service. Furthermore, the burden on management and our information technology of introducing any new line of business and/or new product or service could have a significant impact on the effectiveness of our system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business or new products or services could have a material adverse effect on our business, financial condition and results of operations.

Information technology systems are critical to our business. We use various technology systems to manage our customer relationships, general ledger, deposits, and loans. We have established policies and procedures to prevent or limit the impact of system failures, interruptions, and security breaches, but such events may still occur or may not be adequately addressed if they do occur. In addition, any compromise of our systems could deter customers from using our products and services. Although we rely on security systems to provide security and authentication necessary to effect the secure transmission of data, these precautions may not protect our systems from compromises or breaches of security. Our business is subject to the Gramm-Leach-Bliley Act which, among other things: (i) imposes certain limitations on our ability to share nonpublic personal information about our customers with nonaffiliated third parties; (ii) requires that we provide certain disclosures to customers about our information collection, sharing and security practices and afford customers the right to "opt out" of any information sharing by us with nonaffiliated third parties (with certain exceptions); and (iii) requires that we develop, implement and maintain a written comprehensive information security program containing appropriate safeguards based on our size and complexity, the nature and scope of our activities, and the sensitivity of customer information we process, as well as plans for responding to data security breaches. Ensuring that our collection, use, transfer and storage of personal information complies with all applicable laws and regulations can increase our costs. Despite the defensive measures we take to manage our internal technological and operational infrastructure, threats may originate externally from third parties such as foreign governments, organized crime and other hackers, and outsource or infrastructure-support providers and application developers, or may originate internally from within our organization. Furthermore, we may not be able to ensure that all of our clients, suppliers, counterparties and other third parties have appropriate controls in place to protect the confidentiality of the information that they exchange with us, particularly where such information is transmitted by electronic means. Our heavy reliance on information technology systems exposes us to operational risks, which include the risk of malfeasance by employees or persons outside of our organization, errors relating to transaction processing and technology, systems failures or interruptions, failures to properly implement systems upgrades, breaches of our internal control systems and compliance requirements, and business continuation and disaster recovery. In addition, we outsource a significant amount of our data processing to certain third-party providers. If these third-party providers encounter difficulties, or if we have difficulty communicating with them, our ability to adequately process and account for transactions could be affected, and our business operations could be adversely affected. Threats to information security also exist in the processing of customer information through various other vendors and their personnel. The occurrence of any system failures, interruption, or breach of security could damage our reputation and result in a loss of customers and business, could subject us to additional regulatory scrutiny, or could expose us to litigation and possible financial liability. Any of these events could have a material adverse effect on our financial condition and results of operations.

The Board of the Company has an Innovation and Technology Sub-Committee, consisting of wholly independent directors chartered, among other items, with a focus on cybersecurity risk. Additionally, the Company's Board has a designated Risk Management Sub-Committee with the responsibility of monitoring enterprise level risks, including those related to cybersecurity. Furthermore, management of the Company has both an Enterprise Risk Management Committee and an Information Technology Steering Committee (ITSC), both of which are comprised of the most senior members of management, including the Chief Executive Officer, Chief Information Officer, and Chief Operating Officer. The ITSC meets monthly, or more frequently if needed, and the ERMC meets quarterly, or more frequently if needed. Material items related to cybersecurity are reported to the Innovation and Technology and Risk Management Sub-Committees. The Company also engages outside consultants to support its cybersecurity efforts. The directors of the Company do not have significant experience in cybersecurity risk management in other business entities comparable to the Company and rely on members of management, including, but not limited to, the Chief Information Security Officer, Chief Information Security Officer, Chief Technology Officer and Chief Data Officer, for cybersecurity guidance.

From time to time, the card networks increase the fees (known as interchange fees) that they charge to acquirers and that we charge to our merchants. It is possible that competitive pressures will result in us absorbing a portion of such increases in the future, which would increase our costs, reduce our profit margin and adversely affect our business and financial condition. In addition, the card networks require certain capital requirements. An increase in the required capital level would further limit our use of capital for other purposes.