Riverview Bancorp (RVSB) Risk Analysis

The Bank is susceptible to fraudulent activity that may be committed against us or our clients, which may result in financial losses or increased costs to us or our clients, disclosure or misuse of our information or our client information, misappropriation of assets, privacy breaches against our clients, litigation or damage to our reputation. Such fraudulent activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering and other dishonest acts. Nationally, reported incidents of fraud and other financial crimes have increased. We have also experienced losses due to apparent fraud and other financial crimes. While we have policies and procedures designed to prevent such losses, there can be no assurance that such losses will not occur.

Competition for qualified employees and personnel in the banking industry is intense and there are a limited number of qualified persons with knowledge of, and experience in, the community banking industry where the Bank conducts its business. The process of recruiting personnel with the combination of skills and attributes required to carry out our strategies is often lengthy. Our success depends to a significant degree upon our ability to attract and retain qualified management, loan origination, finance, administrative, marketing and technical personnel and upon the continued contributions of our management and personnel. Our ability to retain and grow our loans, deposits, and fee income depends upon the business generation capabilities, reputation, and relationship management skills of our lenders. If we were to lose the services of any of our bankers, including successful bankers employed by banks that we may acquire, to a new or existing competitor, or otherwise, we may not be able to retain valuable relationships and some of our customers could choose to use the services of a competitor instead of our services. In addition, our success has been and continues to be highly dependent upon the services of our directors, many of whom are at or nearing retirement age, and we may not be able to identify and attract suitable candidates to replace such directors.

We rely on numerous external vendors to provide us with products and services necessary to maintain our day-to-day operations. Accordingly, our operations are exposed to risk that these vendors will not perform in accordance with the contracted arrangements under service level agreements. The failure of an external vendor to perform in accordance with the contracted arrangements under service level agreements because of changes in the vendor's organizational structure, financial condition, support for existing products and services or strategic focus or for any other reason, could be disruptive to our operations, which in turn could have a material negative impact on our financial condition and results of operations. We also could be adversely affected to the extent such an agreement is not renewed by the third-party vendor or is renewed on terms less favorable to us. Additionally, the bank regulatory agencies expect financial institutions to be responsible for all aspects of a vendor's performance, including aspects which a vendor delegates to third parties. Disruptions or failures in the physical infrastructure or operating systems that support our business and clients, or cyber-attacks or security breaches of the networks, systems or devices that our clients use to access our products and services could result in client attrition, regulatory fines, penalties or intervention, reputational damage, reimbursement or other compensation costs, and/or additional compliance costs, any of which could materially adversely affect our results of operations or financial condition.

At March 31, 2024, $96.4 million, or 9.41% of our total loan portfolio, consisted of real estate one-to-four family loans and home equity loans. We primarily base our lending decisions on the borrower's repayment capacity and the collateral securing these loans, particularly with first-lien real estate one-to-four family loans. However, home equity lines of credit pose greater risks, especially those secured by a second mortgage, as the likelihood of full loan recovery in the event of default diminishes. Our ability to foreclose  on  such loans  depends upon  the property's value which must cover both the primary mortgage and foreclosure costs. This type of lending is highly sensitive to regional and local economic conditions, making it challenging to predict potential losses. Economic downturns or fluctuations in the housing market could diminish property values, increasing the risk of losses if borrowers default. Loans with high combined loan -to value-ratios are particularly vulnerable to declining property values, leading to higher default rates and increased severity of losses. Moreover, if borrowers sell their homes, they may struggle to repay their loans in full from the proceeds. As a result, these loans may experience elevated rates of delinquencies, defaults and losses negatively impacting our financial condition and results of operations.

Although we consider ourselves competitive in our market areas, we face intense competition in both making loans and attracting deposits. Price competition for loans and deposits might result in our earning less on our loans and paying more on our deposits, which reduces net interest income. Some of the institutions with which we compete have substantially greater resources than we have and may offer services that we do not provide. We expect competition to increase in the future as a result of legislative, regulatory and technological changes and the continuing trend of consolidation in the financial services industry. Our profitability will depend upon our continued ability to compete successfully in our market areas.

Our current business strategy includes an emphasis on commercial and multi-family real estate lending. This type of lending activity, while potentially more profitable than one-to-four family lending, is generally more sensitive to regional and local economic conditions, making loss levels more difficult to predict. Collateral evaluation and financial statement analysis in these types of loans requires a more detailed analysis at the time of loan underwriting and on an ongoing basis. At March 31, 2024, we had $654.3 million of commercial and multi-family real estate loans, representing 63.9% of our total loan portfolio. Commercial and multi-family real estate loans typically involve higher principal amounts than other types of loans, and some commercial borrowers maintain multiple loans with us. Consequently, an adverse development in any single loan or credit relationship can significantly heighten our exposure to potential losses, far more than the impact of a similar development in a one-to-four family residential mortgage loan. The repayment of  these loans relies on income generated from the property securing the loan. This income must sufficiently cover operational expenses and debt service. Economic fluctuations or shifts in local market conditions may adversely affect the property's income, posing potential repayment challenges.  Moreover, a substantial portion of our commercial and multi-family real estate loans do not fully amortize and include substantial balloon payments upon maturity. These balloon payments may require the borrower to either sell or refinance the property, potentially heightening the risk of default on non-payment. In the event of a foreclosure on a commercial or multi-family real estate loan, our holding period for the collateral tends to be more extended compared to one-to-four family residential loans. This elongated holding period results from a limited  pool of  potential purchasers for the collateral. In recent years financial institutions have witnessed substantial growth in commercial real estate markets, compounded by intensified competitive pressures that have led to historically low capitalization rates and surging property valuations. The economic disruption spurred by the COVID-19 pandemic has particularly affected commercial real estate markets. Additionally, the pandemic has accelerated the adoption of remote work options, potentially influencing the long-term performance of certain office properties within our commercial real estate portfolio. Moreover, the federal banking regulatory agencies have raised concerns about vulnerabilities within the current commercial real estate market, recognizing the risks associated with these assets. Failures in our risk management policies, procedures, and controls could impede our ability to effectively manage this portfolio, potentially leading to increased delinquencies and higher losses, thereby materially impacting our business, financial condition, and operational performance.

Our security measures may not be sufficient to mitigate the risk of a cyber-attack. Communications and information systems are essential to the conduct of our business, as we use such systems to manage our customer relationships, our general ledger and virtually all other aspects of our business. Our operations rely on the secure processing, storage, and transmission of confidential and other information in our computer systems and networks. Although we take protective measures and endeavor to modify them as circumstances warrant, the security of our computer systems, software, and networks may be vulnerable to breaches, fraudulent or unauthorized access, denial or degradation of service attacks, misuse, computer viruses, malware or other malicious code and cyber-attacks that could have a security impact. If one or more of these events occur, this could jeopardize our or our customers' confidential and other information processed and stored in, and transmitted through, our computer systems and networks, or otherwise cause interruptions or malfunctions in our operations or the operations of our customers or counterparties. We may be required to expend significant additional resources to modify our protective measures or to investigate and remediate vulnerabilities or other exposures, and we may be subject to litigation and financial losses that are either not insured against or not fully covered through any insurance maintained by us. We could also suffer significant reputational damage. Additionally, as our cardholders use debit and credit cards for transactions with third parties or through third-party processing services, we face additional risks from data breaches in their system or payment processors. Such breaches could expose our account information, leading to liabilities for fraudulent transactions, fines, and higher transaction fees. Breaches may also erode customer trust, prompting shifts in payment methods and potential changes to our payment systems, which could incur higher costs. Despite ongoing efforts to enhance our information technology systems and provide employee awareness training, cyber threats remain pervasive, particularly in the financial services industry. We must continuously monitor and fortify our networks and infrastructure to prevent, detect, and address unauthorized access, misuses, computer viruses, and other security risks. While we have not experienced significant breaches, some of our clients may have been affected by third-party breaches, potentially increasing their risks of identity theft and fraud involving their accounts with us. Security breaches in our internet banking activities could further expose us to possible liability and damage our reputation. Increases in criminal activity levels and sophistication, advances in computer capabilities, new discoveries, vulnerabilities in third-party technologies (including browsers and operating systems) or other developments could result in a compromise or breach of the technology, processes and controls that we use to prevent fraudulent transactions and to protect data about us, our clients and underlying transactions. Any compromise of our security could deter customers from using our internet banking services that involve the transmission of confidential information. Although we have developed and continue to invest in systems and processes that are designed to detect and prevent security breaches and cyber-attacks and periodically test our security, these precautions may not protect our systems from compromises or breaches of our security measures, and could result in losses to us or our clients, our loss of business and/or clients, damage to our reputation, the incurrence of additional expenses, disruption to our business, our inability to grow our online services or other businesses, additional regulatory scrutiny or penalties, or our exposure to civil litigation and possible financial liability, any of which could have a material adverse effect on our business, financial condition and results of operations. Our security measures may not protect us from system failures or interruptions. While we have established policies and procedures to prevent or limit the impact of systems failures and interruptions, there can be no assurance that such events will not occur or that they will be adequately addressed if they do. In addition, we outsource certain aspects of our data processing and other operational functions to certain third-party providers. While the Company selects third-party vendors carefully, it does not control their actions. If our third-party providers encounter difficulties, including those resulting from breakdowns or other disruptions in communication services provided by a vendor, failure of a vendor to handle current or higher transaction volumes, cyber-attacks and security breaches or if we otherwise have difficulty in communicating with them, our ability to adequately process and account for transactions could be affected, and our ability to deliver products and services to our customers and otherwise conduct our business operations could be adversely impacted. Replacing these third-party vendors could also entail significant delay and expense. Threats to information security also exist in the processing of customer information through various other vendors and their personnel. We cannot assure you that such breaches, failures or interruptions will not occur or, if they do occur, that they will be adequately addressed by us or the third parties on which we rely. We may not be insured against all types of losses as a result of third-party failures and insurance coverage may be inadequate to cover all losses resulting from breaches, system failures or other disruptions. If any of our third-party service providers experience financial, operational or technological difficulties, or if there is any other disruption in our relationships with them, we may be required to identify alternative sources of such services, and we cannot assure that we could negotiate terms that are as favorable to us, or could obtain services with similar functionality as found in our existing systems without the need to expend substantial resources, if at all. Further, the occurrence of any systems failure or interruption could damage our reputation and result in a loss of customers and business, could subject us to additional regulatory scrutiny, or could expose us to legal liability. Any of these occurrences could have a materially adverse effect on our financial condition and results of operations. The board of directors oversees the risk management process, including the risk of cybersecurity, and engages with management on cybersecurity issues.