PennyMac Mortgage (PMT) Risk Analysis

We and our Manager license third-party software and depend on services from various third parties for use in our and our Manager's services. For example, we and our Manager rely on third-party vendors for cloud-based and artificial intelligence systems and for certain mortgage production and servicing applications. Third-party software applications, products and services are constantly evolving, and we and our Manager may not be able to maintain or modify our or our Manager's information services to ensure its compatibility with third-party offerings following development changes. In addition, some of our or our Manager's competitors, partners, or other service providers may take actions that disrupt the inter-operability of our or our Manager's business with their own products or services, or exert strong business influence on our or our Manager's ability to, and the terms on which we or our Manager operate our or its business. Loss of the right to use any third-party software or services could result in decreased functionality of our or our Manager's services until equivalent technology is either developed by us or our Manager or, if available from another provider, is identified, obtained and integrated, which could adversely affect our business, financial condition, liquidity, results of operations and ability to make distributions to our shareholders. Furthermore, we and our Manager remain responsible for ensuring that our and our Manager's mortgage loan businesses are in compliance with applicable laws and regulations. Despite our and our Manager's efforts to monitor such compliance, any errors or failures of such third party vendors or their software to perform in the manner intended could result in loan defects potentially requiring repurchase. Many of our and our Manager's third party vendors attempt to impose limitations on their liability for such errors, defects or failures, and if enforceable, we and our Manager may have additional liability to our clients, borrowers or other third parties that could harm our reputation and increase our operating costs. Any failure to do so could adversely affect our business. The development, proliferation and use of artificial intelligence could give rise to legal and/or regulatory action, damage our and our Manager's reputation or otherwise materially harm our and our Manager's business. We believe the development and proliferation of artificial intelligence will have a significant impact in our industry; however, the recent development of artificial intelligence presents risks, challenges, and unintended consequences, including potential defects in the design and development of the technologies used to automate processes, misapplication of technologies, the reliance on data, rules or assumptions that may prove inadequate, information security vulnerabilities and failure to meet customer expectations, among others. The use of artificial intelligence can introduce the generation, processing or use of erroneous and "hallucinated" information into our and our Manager's systems, workflows, processes and procedures that can cause service interruptions. In addition, the use of artificial intelligence algorithms may raise ethical concerns and legal issues due to perceived or actual unintentional bias and/or inaccuracies in the processing and servicing of mortgage loans. While we and our Manager aim to develop and use artificial intelligence responsibly, we and our Manager may be unsuccessful in identifying or resolving issues before they arise. We and our Manager currently use and integrate artificial intelligence technologies into our and our Manager's business processes and services. Development, use, and deployment of these technologies could pose cybersecurity, data privacy, IT, intellectual property, regulatory, legal, operational, competitive, reputational, and other risks and challenges that could affect our and our Manager's business. Specifically, risks related to bias, artificial intelligence hallucinations, discrimination, harmful content, misinformation, fraud, scams, targeted attacks such as model poisoning or data poisoning, surveillance, data leakage, loss of consensus reality, inequality, environmental harms, and other harms may flow from our and our Manager's development, use, or deployment of artificial intelligence technologies. Artificial intelligence-related issues, including potential government regulation of artificial intelligence, deficiencies or failures could give rise to legal and regulatory actions, damage our and our Manager's reputation or otherwise materially impact our and our Manager's business, financial condition, and liquidity. Laws and regulations related to artificial intelligence are evolving, and there is uncertainty as to potential adoption of new laws and regulations that may restrict or impose burdensome and costly requirements on our and our Manager's ability to use and scale the deployment of artificial intelligence. We and our Manager may receive claims from third parties, including our and our Manager's competitors, alleging that the use of artificial intelligence technology infringes on or violates such third party's intellectual property rights. Adverse consequences of these risks related to artificial intelligence could undermine the decisions, predictions or analyses such technologies produce and subject us to competitive harm, legal liability, heightened regulatory scrutiny and brand or reputational harm. We may face significant competition in the market and may be unable to develop, implement and scale artificial intelligence at the same rate to keep pace with our competitors. The collection, processing, storage, use and disclosure of personal data could give rise to liabilities as a result of governmental regulations and conflicting legal requirements. We and our Manager receive, transmit and store a large volume of personally identifiable information and other user and consumer data. There are various federal and state laws regarding privacy and the storing, sharing, use, disclosure and protection of personally identifiable information that could give rise to liabilities. Federal privacy requirements such as those under the Gramm-Leach-Bliley Act and Fair Credit Reporting Act are within the regulatory and enforcement authority of the CFPB and Federal Trade Commission. We are also subject to a variety of state laws and regulations that apply to the collection, use, retention, protection, disclosure, transfer and other processing of personal information, such as the California Consumer Privacy Act (CCPA), that provide data privacy rights for consumers. Some of these laws include a private rights of action against businesses, including for failure to implement reasonable security procedures and practices to prevent data breaches. Numerous states now have laws that impose similar, additional, and in some cases more restrictive requirements than the CCPA, including for narrow aspects of privacy, such as biometric data, children's data, and health data. The effects of state and federal privacy laws are potentially significant and may require us to modify our and our Manager's data processing practices and policies and to incur substantial costs and potential liability in an effort to comply with such legislation. Failure to comply with any of these privacy laws, or a perceived failure to comply, could result in enforcement action against us, including fines and public censure, or litigation and could result in serious harm to our and our Manager's reputation or business and have a material adverse effect on our and our Manager's financial condition and results of operations. The collection, processing, storage, use and disclosure of personal data could give rise to liabilities as a result of governmental regulations and conflicting legal requirements.

Housing affordability has been negatively impacted by rising housing costs and tax payments. The average share of borrowers' mortgage payments allocated to property taxes and insurance premiums has been steadily rising in recent years due to inflation, natural disasters and other factors. For example, due to wildfires in Northern and Southern California and other areas in the Pacific Northwest, many private insurance carriers will no longer offer homeowner insurance policies in certain high risk areas to new or existing homeowners. The decrease in available private insurers increases insurance premiums and a borrower's monthly expenses and creates a higher likelihood that loan payments in respect of the mortgaged property may become delinquent or default, which could materially and adversely affect our business, financial condition, liquidity and results of operations.

Climate change, adverse weather conditions, man-made or natural disasters, pandemics, wars and armed conflicts, terrorist attacks and other long term physical and environmental changes and conditions could adversely impact properties that we own or that collateralize loans we own or service. In addition, such adverse conditions and long term physical and environmental changes could impact the demand for, and value of, our assets, as well as the cost to service or manage such assets, or directly impact the value of our assets through damage, destruction or loss, and thereafter materially impact the availability or cost of insurance to protect against these events. Real estate value declines could also decrease the value supporting certain of our assets, such as CRTs and subordinate bonds, where we may provide a credit guaranty or otherwise be responsible for all or a portion of any credit losses. Upon the occurrence of a catastrophic event, we may be unable to continue our operations and may endure significant business interruptions, reputational harm, delays in servicing our customers and working with our partners, interruptions in the availability of our technology and systems, breaches of data security, and loss of critical data, all of which could have an adverse effect on our future operating results. Catastrophic events may also be uninsurable or not economically insurable and might make the insurance proceeds insufficient to repair or replace a property if it is damaged or destroyed. There continues to be global concern over the risks of climate change and related environmental sustainability matters. The physical risks of climate change may include rising average global temperatures, rising sea levels and an increase in the frequency and severity of extreme weather events and natural disasters, including floods, wildfires, hurricanes and tornados, and these events could impact our owned real estate and the properties collateralizing our loan assets or underlying our MSR assets and the local economies of certain areas in which we operate. Although we believe our owned real estate and the properties collateralizing our loan assets or underlying our MSR assets are appropriately covered by insurance, we cannot predict at this time if we or our borrowers will be able to obtain appropriate coverage at a reasonable cost in the future, or if we will be able to continue to pass along all of the costs of insurance. There also is a risk that one or more of our property insurers may not be able to fulfill their obligations with respect to payment claims due to a deterioration in its financial condition or may even cancel policies due to increasing costs of providing insurance coverage in certain geographic areas. Numerous treaties, laws and regulations have been enacted or proposed in an effort to regulate climate change, including regulations aimed at limiting greenhouse gas emissions and the implementation of "green" building codes. These laws and regulations may impact the rates at which we obtain property insurance and result in increased operating costs, or impose substantial costs on our borrowers or affect their ability to obtain appropriate coverage at reasonable costs. We may also incur costs associated with increased regulations or investor requirements for increased environmental and social disclosures and reporting. Additionally, climate change concerns could result in transition risk. Changes in consumer preferences and additional legislation and regulatory requirements, including those associated with a transition to a low-carbon economy, could increase expenses or otherwise adversely impact our operations and business.

Initiating new business activities or investment strategies, developing new products, or significantly expanding existing business activities or investment strategies, are ways to grow our businesses and respond to changing circumstances in our industry; however, they may expose us to new risks and regulatory compliance requirements. We cannot be certain that we will be able to manage these risks and compliance requirements effectively. Furthermore, our efforts may not succeed and any revenues we earn from any new or expanded business initiative or investment strategy may not be sufficient to offset the initial and ongoing costs of that initiative, which would result in a loss with respect to that initiative or strategy.

Our agreements with PCM and PLS provide that PCM and PLS will not assume any responsibility other than to provide the services specified in the applicable agreements. Our management agreement further provides that PCM will not be responsible for any action of our board of trustees in following or declining to follow its advice or recommendations. In addition, each of PCM and PLS and their respective affiliates, including each such entity's managers, officers, directors, employees and members, will be held harmless from, and indemnified by us against, certain liabilities on customary terms. As a result, to the extent we are damaged through certain actions or inactions of PCM or PLS, our recourse is limited and we may not be able to recover our losses.

A cyber incident is considered to be any adverse event that threatens the confidentiality, integrity or availability of our or our Manager's information resources. These incidents may be an intentional attack or an unintentional event and could involve gaining unauthorized access to our or our Manager's information systems for purposes of theft of certain personally identifiable information of consumers, misappropriating assets, stealing confidential information, corrupting data or causing operational disruption. The result of these incidents may include disrupted operations, misstated or unreliable financial data, liability for stolen assets or information, increased cybersecurity protection and insurance costs, litigation and damage to our investor relationships. As our and our Manager's reliance on rapidly changing technology has increased, so have the risks posed to our and our Manager's information systems, both proprietary and those provided by third party service providers including cloud-based and artificial intelligence service providers. System disruptions and failures caused by unauthorized intrusion, malware, natural disasters and other similar events have interrupted or delayed our ability to provide services to our and our Manager's customers. The risk of a security breach or disruption, particularly through cyber attack or cyber intrusion, including by computer hackers and foreign governments, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased, which, in turn, may lead to increased costs to protect our network and systems. Despite our and our Manager's efforts to ensure the integrity of our and our Manager's systems and our and our Manager's investment in significant physical and technological security measures, employee training, contractual precautions, policies and procedures, board oversight and business continuity plans, there can be no assurance that any such cyber intrusions will not occur or, if they do occur, that they will be adequately addressed. We and our Manager also may not be able to anticipate or implement effective preventive measures against all security breaches, especially because the methods of attack change frequently, have become increasingly sophisticated, including through the use of artificial intelligence, and may not be recognized until after such attack has been launched, and because security attacks can originate from a wide variety of sources, including third parties such as persons involved with organized crime or associated with third party service providers. Our and our Manager's data security management program includes identity, trust, vulnerability and threat management business processes as well as the adoption of standard data protection policies. We and our Manager are also held accountable for the actions and inactions of our or our Manager's third-party vendors regarding cybersecurity and other consumer-related matters. Any of the foregoing events could result in violations of applicable privacy and other laws, financial loss, loss of confidence in our or our Manager's security measures, customer dissatisfaction, additional regulatory scrutiny, significant litigation exposure and harm to our or our Manager's reputation, any of which could have a material adverse effect on our business, financial condition, liquidity, results of operations and our ability to make distributions to our shareholders. Technology disruptions or failures, including a failure in our and our Manager's information systems or those of third parties with whom we or our Manager does business, could disrupt our or our Manager's business, cause legal or reputational harm and adversely impact our results of operations and financial condition. Many of our services are dependent on the secure, efficient, and uninterrupted operation of our Manager's technology infrastructure, including computer systems, related software applications and cloud-based and artificial intelligence systems, as well as those of certain third parties and affiliates. Our and our Manager's information systems must accommodate a high volume of traffic and deliver frequently updated, accurate and timely information. Like other companies in our industry, we, our Manager and our third-party vendors, have experienced threats and cybersecurity incidents relating to information technology systems and infrastructure. We and our Manager have experienced, and may in the future experience, service disruptions and failures caused by system or software failure, human error or misconduct, external attacks (e.g., computer hackers, hacktivists, nation state-backed hackers), denial of service or information, malicious or destructive code (e.g., ransomware, computer viruses and disabling devices), as well as natural disasters, pandemics, strikes, and other similar events, and our contingency planning may not be sufficient for all situations. Attempts to disrupt or gain unauthorized access to our, our Manager's and our third-party service providers' information systems from malicious third parties or insider threats may incorporate widely varying and frequently changing tactics, which may be enhanced or facilitated by artificial intelligence. We cannot guarantee that our or our Manager's data protection efforts and our and our Manager's investment in information technology will prevent significant breakdowns, data leakages, or cybersecurity incidents or breaches in or compromises of our or our Manager's systems or those of vendors, contractors, consultants and/or third parties with whom we or our Manager does business. Our or our Manager's contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in the contracts are sufficient to protect us or our Manager from liabilities, damages, or claims related to our or our Manager's privacy and data security obligations. The implementation of technology changes and upgrades to maintain current and integrate new technology systems may also cause service interruptions. Any such disruptions could materially interrupt or delay our Manager's ability to provide services, and could also impair the ability of third parties to provide critical services to us or our Manager. If our or our Manager's operations are disrupted or otherwise negatively affected by a technology disruption or failure, this could result in material adverse impacts on our and our Manager's business.

We operate in a highly competitive industry that could become even more competitive as a result of economic, legislative, regulatory and technological changes. We compete in our investment activities with other mortgage REITs, specialty finance companies, private funds, banks, mortgage bankers, insurance companies, mutual funds, institutional investors, investment banking firms, depository institutions, governmental bodies and other entities, many of which focus on acquiring mortgage assets. In addition, financial institutions, mortgage lenders and servicers are becoming increasingly competitive in the acquisition of newly originated loans. Many of these institutions have competitive advantages over us, including size, financial strength, access to capital, cost of funds, federal pre-emption and higher risk tolerance. Additionally, our existing and potential competitors may decide to modify their business models to compete more directly with our correspondent production business. Competition may result in fewer investments, higher prices, acceptance of greater risk, lower yields and a narrower spread of yields over our financing costs. Our correspondent production activities may generate lower volumes and/or margins as more competitors enter this market.

Our ability to generate revenues through loan sales depends on programs administered by the Agencies and others that facilitate the issuance of MBS in the secondary market. We acquire loans from PLS through our correspondent production activities that qualify under existing standards for inclusion in mortgage securities backed by the Agencies. We also derive other material financial benefits from these relationships, including the ability to avoid certain loan inventory finance costs through streamlined loan funding and sale procedures and the assumption of credit risk on certain loans. Significant changes in our Agency relationships could impact our ability to finance and sell mortgage loans and materially impact our revenues and profit margin. Any changes in laws and regulations affecting the relationship between Fannie Mae and Freddie Mac and their regulators or the U.S. federal government, and any changes in leadership at any of these entities could adversely affect our business and prospects, including any decision to go public via an initial public offering or make any other changes in the ownership structure for Fannie Mae or Freddie Mac. Any discontinuation of, or significant reduction in or significant organizational change in, the operations of Fannie Mae or Freddie Mac or any significant adverse change in their capital structure, financial condition, activity levels in the primary or secondary mortgage markets or underwriting criteria could materially and adversely affect our business, liquidity, financial condition, results of operations and our ability to make distributions to our shareholders. Our ability to generate revenues from newly originated loans that we acquire from PLS through our correspondent production activities is also highly dependent on the fact that the Agencies have not historically acquired such loans directly from mortgage lenders, but have instead relied on banks and non-bank aggregators such as us to acquire, aggregate and securitize or otherwise sell such loans to investors in the secondary market. To the extent that mortgage lenders choose to sell directly to the Agencies rather than through loan aggregators like us, this would reduce the number of loans available for purchase, which could materially and adversely affect our business, financial condition, liquidity, results of operations and ability to make distributions to our shareholders. Under certain Agency capital rules, loans sourced from loan aggregators, such as ourselves, have higher capital requirements and we may incur higher Agency fees for third-party originated loans that we aggregate and deliver to the Agencies as compared to individual loans delivered by third-party mortgage lenders directly to the Agencies' cash windows without the assistance of a loan aggregator. To the extent the Agencies increase the number of purchases and sales for their own accounts, our business, liquidity, financial condition and results of operations could be materially and adversely affected.