Northwest Bancshares (NWBI) Risk Analysis

Competition in the banking and financial services industry is intense. We compete with commercial banks, savings institutions, mortgage brokerage firms, credit unions, finance companies, fintech companies, money market funds and other mutual funds, insurance companies, and brokerage and investment banking firms operating locally and elsewhere. Many of these competitors (whether regional or national institutions) have substantially greater resources and lending limits than we have and may offer certain services that we do not or cannot provide. In addition, some have competitive advantages such as the credit union exemption from paying federal income tax. Competitive factors driven by consumer sentiment or otherwise can also reduce our ability to generate fee income, such as through overdraft fees. Our profitability depends upon our ability to successfully compete in our market areas.

Our reputation is one of the most valuable components of our business. A key component of our business strategy is to rely on our reputation for customer service and knowledge of local markets to expand our presence by capturing new business opportunities from existing and prospective customers in our current market and contiguous areas. As such, we strive to conduct our business in a manner that enhances our reputation. This is done, in part, by recruiting, hiring and retaining employees who share our core values of being an integral part of the communities we serve, delivering superior service to our customers and caring about our customers and associates. If our reputation is negatively affected by the actions of our employees, by our inability to conduct our operations in a manner that is appealing to current or prospective customers, or otherwise, our business and operating results may be adversely affected.

From time to time, we may implement new lines of business or offer new products and services within existing lines of business. In addition, we will continue to make investments in research, development, and marketing for new products and services. There are substantial risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and/or new products and services we may invest significant time and resources. Initial timetables for the development and introduction of new lines of business and/or new products or services may not be achieved and price and profitability targets may not prove feasible. Furthermore, if customers do not perceive our new offerings as providing significant value, they may fail to accept our new products and services. External factors, such as compliance with regulations, competitive alternatives, and shifting market preferences, may also impact the successful implementation of a new line of business or a new product or service. Furthermore, the burden on management and our information technology of introducing any new line of business and/or new product or service could have a significant impact on the effectiveness of our system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business or new products or services could have a material adverse effect on our business, financial condition and results of operations.

Our competition, or other third parties, may allege that we have infringed, misappropriated, or otherwise violated their intellectual property rights or challenge our rights in intellectual property that is important to our business. To defend against such allegations and challenges, we may have to engage in litigation that could be expensive, time-consuming, disruptive to our operations, and distracting to management. We may not be successful in defending against any such allegations or challenges, which could subject us to significant monetary damages, require significant license fees or royalty payments (which also may not be available on acceptable terms), restrict our ability to offer our products or services, or otherwise require changes to the way we conduct our business. We rely on, and expect to continue to rely on, a variety of measures to obtain, maintain, defend, and enforce our intellectual property rights, including intellectual property laws and contractual provisions, including confidentiality agreements, invention assignments, and intellectual property licenses. These measures may not prevent third parties from infringing, misappropriating or otherwise violating our intellectual property rights or otherwise duplicating or improving upon our products or services, any of which may adversely affect our competitive position. Any of the foregoing could have a material adverse effect on our business, financial condition and results of operations.

Information technology systems are critical to our business. We use various information technology systems to manage our customer relationships, general ledger, deposits, and loans. We have established policies and procedures to prevent or limit the impact of system failures, interruptions, and cybersecurity breaches, but such events may still occur or may not be adequately addressed if they do occur. In addition, any compromise of our information technology systems could deter customers from using our products and services. Although we rely on information technology systems designed to provide security and authentication necessary to effect the secure transmission of data, these precautions may not protect our information technology systems from system failures, interruptions, or cybersecurity breaches. Despite the defensive measures we take designed to manage our internal technological and operational infrastructure, threats may originate externally from foreign governments, state-sponsored actors, organized crime, terrorists, hackers, and other third parties or internally from within our organization, including our personnel or third-party providers (including infrastructure-support providers and application developers). Furthermore, we may not be able to ensure that all of our clients, suppliers and other third-party providers, counterparties and other third parties have appropriate controls in place to protect the confidentiality of the information that they exchange with us, particularly where such information is transmitted by electronic means. Our heavy reliance on information technology systems exposes us to operational risks, which include the risk of malfeasance by personnel or persons outside of our organization, denial of service attacks, computer viruses, worms, ransomware, social engineering (including phishing attacks), service outages, software bugs or defects, server failures, errors relating to transaction processing and technology, failures to properly implement systems upgrades, breaches of our internal control systems and compliance requirements, business continuation and disaster recovery issues and other system failures, interruptions, or cybersecurity breaches. Such risks have significantly increased in recent years in part because of the proliferation of new technologies, including artificial intelligence, and the use of the internet and telecommunications technologies to conduct financial transactions. In addition, we outsource a significant amount of our data processing to, and otherwise rely on, certain third-party providers, and our ability to monitor such third-party providers' data privacy and cybersecurity practices is limited. If these third-party providers encounter difficulties or experience system failures, interruptions, or cybersecurity breaches, or if we have difficulty communicating with them, our ability to adequately process and account for transactions could be affected, and our business operations could be adversely affected. Additionally, any system failures, interruptions or cybersecurity breaches impacting such third-party providers may not be disclosed to us in a timely manner, and we cannot guarantee that we can obtain adequate or any reimbursement from such third-party providers in the event we should suffer any disruption, compromise, failure, liability, reputational harm or other cost or expense. Due to applicable laws and regulations or contractual obligations, we may be held responsible for system failures, interruptions, or cybersecurity breaches attributed to such third-party providers as they relate to the information we share with them. The occurrence, or perceived occurrence (whether unfounded or not), of any system failure, interruption, or cybersecurity breach affecting our information technology systems, or those of our third-party providers, could damage our reputation, result in a loss of customers and business, violate applicable laws and regulations, subject us to additional regulatory scrutiny, or expose us to litigation, liability or other costs or expenses. Any of these events could have a material adverse effect on our financial condition and results of operations. In addition, any insurance coverage we may have may not be adequate to compensate for losses from any of the foregoing. We also cannot be sure that such insurance coverage will continue to be available on acceptable terms or at all or that any applicable insurer will not deny coverage as to any future claim.

The Board of the Company has an Innovation and Technology Sub-Committee, consisting of wholly independent directors chartered, among other items, with a focus on cybersecurity risk. Additionally, the Company's Board has a designated Risk Management Sub-Committee with the responsibility of monitoring enterprise level risks, including those related to cybersecurity. Furthermore, management of the Company has both an Enterprise Risk Management Committee and an Information Technology Steering Committee ("ITSC"), both of which are comprised of the most senior members of management, including the Chief Executive Officer, Chief Information Officer ("CIO"), and Chief Operating Officer. The ITSC meets monthly, or more frequently if needed, and the ERMC meets quarterly, or more frequently if needed. Material items related to cybersecurity are reported to the Innovation and Technology and Risk Management Sub-Committees. The Company also engages outside consultants to support its cybersecurity efforts. The directors of the Company do not have significant experience in cybersecurity risk management in other business entities comparable to the Company and rely on members of management, including, but not limited to, the CISO, CIO, Chief Operational Risk Management Officer, Chief Technology Officer and Chief Data Officer, for cybersecurity guidance.

From time to time, the card networks increase the fees, known as interchange fees, that they charge to acquirers and that we charge to our merchants. It is possible that competitive pressures will result in us absorbing a portion of such increases in the future, which would increase our costs, reduce our profit margin and adversely affect our business and financial condition. In addition, the card networks require certain capital requirements. An increase in the required capital level would further limit our use of capital for other purposes.