SB Financial Group (SBFG) Risk Analysis

The financial services industry is extensively regulated. We are subject to extensive state and federal regulation, supervision and legislation that govern almost all aspects of our operations. Laws and regulations may change from time to time and are primarily intended for the protection of consumers, depositors, borrowers, the DIF and the banking system as a whole, and not to benefit our shareholders. Regulations affecting banks and financial services businesses are undergoing continuous change, and management cannot predict the effect of these changes. While such changes are generally intended to lessen the regulatory burden on financial institutions, the impact of any changes to laws and regulations or other actions by regulatory agencies may negatively impact us or our ability to increase the value of our business. Regulatory authorities have extensive discretion in connection with their supervisory and enforcement activities, including the imposition of restrictions on the operation of a financial institution, the classification of assets held by a financial institution, the adequacy of a financial institution's ACL and the ability to complete acquisitions. Additionally, actions by regulatory agencies against us could cause us to devote significant time and resources to defending our business and may lead to penalties that materially affect us and our shareholders. Even the reduction of regulatory restrictions could have an adverse effect on us and our shareholders if such lessening of restrictions increases competition within our industry or our market area.

Numerous federal and state governmental, legislative and regulatory authorities are investigating practices in the business of mortgage and home equity lending and servicing and in the mortgage-related insurance and reinsurance industries. We could face the risk of class actions, other litigation and claims from: the owners of or purchasers of such loans originated or serviced by us, homeowners involved in foreclosure proceedings or various mortgage-related insurance programs, downstream purchasers of homes sold after foreclosure, title insurers, and other potential claimants. Included among these claims are claims from purchasers of mortgage and home equity loans seeking the repurchase of loans where the loans allegedly breached origination covenants, representations, and warranties made to the purchasers in the purchase and sale agreements. The CFPB has issued new rules for mortgage origination and mortgage servicing. Both the origination and servicing rules create new private rights of action for consumers against lenders and servicers in the event of certain violations.

A significant portion of our loan portfolio is secured by real property. During the ordinary course of business, we foreclose on and take title to properties securing certain loans. In doing so, there is a risk that hazardous or toxic substances could be found on these properties. If hazardous or toxic substances are found, we may be liable for remediation costs, as well as for personal injury and property damage. Environmental laws and evolving regulation may require us to incur substantial expenses and may materially reduce the affected property's value or limit our ability to use or sell the affected property. In addition, future laws and regulations or more stringent interpretations or enforcement policies with respect to existing laws or regulations may increase our exposure to environmental liability. Environmental reviews of real property before initiating foreclosure actions may not be sufficient to detect all potential environmental hazards. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on our business, financial condition and results of operations.

The policies of the FRB impact us significantly. The FRB regulates the supply of money and credit in the United States. Its policies directly and indirectly influence the rate of interest earned on loans and paid on borrowings and interest-bearing deposits and can also affect the value of financial instruments we hold. Those policies determine to a significant extent our cost of funds for lending and investing. Changes in those policies are beyond our control and are difficult to predict. FRB policies can also affect our borrowers, potentially increasing the risk that they may fail to repay their loans. For example, a tightening of the money supply by the FRB could reduce the demand for a borrower's products and services. This could adversely affect the borrower's earnings and ability to repay its loan, which could have a material adverse effect on our financial condition and results of operations.

We collect, process and store sensitive consumer data by utilizing computer systems and telecommunications networks operated by both third-party service providers and us. State Bank's necessary dependence upon automated systems to record and process State Bank's transactions poses the risk that technical system flaws, employee errors, tampering or manipulation of those systems, or attacks by third parties will result in losses and may be difficult to detect. We have security and backup and recovery systems in place, as well as a business continuity plan, to ensure the computer systems will not be inoperable, to the extent possible. We also routinely review documentation of such controls and backups related to third party service providers. Our inability to use or access these information systems at critical points in time could unfavorably impact the timeliness and efficiency of our business operations. In recent years, some banks have experienced cyberattacks with the goal and effect of disrupting the ability of the bank to process transactions. Other businesses have been victims of ransomware attacks in which the business becomes unable to access its own information and is presented with a demand to pay a ransom in order to once again have access to its information. We could be adversely affected if one of our employees or a third-party service provider causes a significant operational breakdown or failure, either as a result of human error or where an individual purposefully sabotages or fraudulently manipulates our operations or systems. State Bank is further exposed to the risk that the third-party service providers may be unable to fulfill their contractual obligations (or will be subject to the same risks as we are). These disruptions may interfere with service to our customers, cause additional regulatory scrutiny and result in a financial loss or liability. We are also at risk of the impact of natural disasters, terrorism and international hostilities on our systems or for the effects of outages or other failures involving power or communications systems operated by others. Misconduct by employees could include fraudulent, improper or unauthorized activities on behalf of clients or improper use of confidential information. We may not be able to prevent employee errors or misconduct, and the precautions we take to detect this type of activity might not be effective in all cases. Employee errors or misconduct could subject us to civil claims for negligence or regulatory enforcement actions, including fines and restrictions on our business. In addition, there have been instances where financial institutions have been victims of fraudulent activity in which criminals pose as customers to initiate wire and automated clearinghouse transactions out of customer accounts. Although we have policies and procedures in place to verify the authenticity of our customers, we cannot assure that such policies and procedures will prevent all fraudulent transfers. We have implemented security controls to prevent unauthorized access to our computer systems, and we require that our third-party service providers maintain similar controls. However, the Company's management cannot be certain that these measures will be successful. A security breach of the computer systems and loss of confidential information, such as customer account numbers and related information, could result in a loss of customers' confidence and, thus, loss of business. We could also lose revenue if competitors gain access to confidential information about our business operations and use it to compete with us. While we maintain specific "cyber" insurance coverage, which would apply in the event of various breach scenarios, the amount of coverage may not be adequate in any particular case. Furthermore, because cyber threat scenarios are inherently difficult to predict and can take many forms, some breaches may not be covered under our cyber insurance coverage. Further, we may be affected by data breaches at retailers and other third parties who participate in data interchanges with us and our customers that involve the theft of customer credit and debit card data, which may include the theft of our debit card PIN numbers and commercial card information used to make purchases at such retailers and other third parties. Such data breaches could result in us incurring significant expenses to reissue debit cards and cover losses, which could result in a material adverse effect on our results of operations. There can be no assurance that we will not suffer such cyber-attacks or other information security breaches (or attempted breaches) or incur resulting losses in the future. Our risk and exposure to these matters remains heightened because of, among other things, the evolving nature of these threats, and our plans to continue to implement internet and mobile banking capabilities to meet customer demand. As cyber and other data security threats continue to evolve, we may be required to expend significant additional resources to continue to modify and enhance protective measures or to investigate and remediate any security vulnerabilities. All of the types of cybersecurity incidents discussed above could result in damage to the Company's reputation, loss of customer business, litigation, increased regulatory scrutiny and potential enforcement actions, repairs of system damage, increased investments in cybersecurity (such as obtaining additional technology, making organizational changes, deploying additional personnel, training personnel and engaging consultants), increased insurance premiums, and loss of investor confidence and a reduction in the price of our common shares, all of which could result in financial loss and material adverse effects on the Company's results of operations and financial condition.