Southside Bancshares (SBSI) Risk Analysis

Third parties provide key components of our business infrastructure, such as banking services, core processing and internet connections and network access. Any disruption in such services provided by these third parties or any failure of these third parties to handle current or higher volumes of use could adversely affect our ability to deliver products and services to our customers and otherwise to conduct business. Technological or financial difficulties of one of our third-party service providers or their subcontractors could adversely affect our business to the extent those difficulties result in the interruption or discontinuation of services provided by that party.  In addition, one or more of our third-party service providers may become subject to cyber-attacks or information security breaches, including as a result of remote working, that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of our or our customers' confidential, proprietary and other information, or otherwise disrupt our or our customers' or other third parties' business strategies, financial condition or results of operations. While we have processes in place to monitor our third-party service providers' data and information security safeguards, there can be no assurance that we will adhere to such processes. We also do not control such service providers' day-to-day operations, and preventing a successful attack or security breach at one or more of such third-party service providers is not within our control.  The occurrence of any such breaches or failures could damage our reputation, result in a loss of customer business and expose us to additional regulatory scrutiny, disclosure obligations, civil litigation and possible financial liability, any of which could have a material adverse effect on our business strategy, financial condition and results of operations. Further, in some instances we may be held responsible for the failure of such third parties to comply with government regulations. We may not be insured against all types of losses as a result of third-party failures, and our insurance coverage may not be adequate to cover all losses resulting from system failures, third-party breaches or other disruptions. Failures in our business structure or in the structure of one or more of our third-party service providers could interrupt our operations or increase the cost of doing business.

Severe weather, natural disasters, climate change, acts of war or terrorism, health emergencies, epidemics or pandemics and other adverse external events could have a significant impact on our ability to conduct business.  Such events could affect the stability of our deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue and/or cause us to incur additional expenses.  For example, severe weather is more likely in our location and the market areas we serve than in other areas of the country.  Although management has established disaster recovery policies and procedures, there can be no assurance of the effectiveness of such policies and procedures, and the occurrence of any such event could have a material adverse effect on our business, financial condition and results of operations.

We rely heavily on communications and information systems to conduct our business.  Our communications and information systems remain vulnerable to unexpected disruptions and failures. Any failure, interruption or breach in security of these systems could result in a material adverse effect on our customer relationships, general ledger, deposit, loan and other systems.  While we have policies and procedures designed to prevent or limit the effect of a failure, interruption or security breach of our information systems, there can be no assurance that we will adhere to such policies or procedures or that they can prevent any such failures, interruptions, cybersecurity breaches or other security breaches or, if they do occur, that they will be adequately addressed.  The occurrence of any failures, interruptions or security breaches of our information systems could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny and disclosure obligations or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on our business strategy, financial condition and results of operations. In our ordinary course of business, we rely on electronic communications and information systems to conduct our businesses and to collect and store sensitive data, including our proprietary business information and that of our clients, and personally identifiable information of our customers and employees. The secure processing, maintenance, and transmission of this information is critical to our operations. Our systems, including those we maintain with our service providers, vendors, or our clients, could be vulnerable to cybersecurity-related incidents, which include compromises of information systems, attempts to access information, including customer and company information, malicious code, computer viruses or other malware, denial of service attacks, phishing attempts, brute force attacks, exploiting software vulnerabilities (including "zero-day attacks"), ransomware, supply chain attacks, and other events that could result in unauthorized access, theft, misuse, loss, release, or destruction of data (including confidential customer information), account takeovers, unavailability of service, or other events. These types of threats may result from human error, fraud, or criminal activity on the part of external or internal parties or may result from the failure of technology or information systems. Further, these types of threats may be exacerbated by developments in artificial intelligence and its increased use to produce sophisticated malware, phishing schemes, and other fraudulent activities. Any failure, interruption, or compromise in security of these systems could result in significant disruption to our operations. We employ an in-depth, layered, defense approach that leverages people, processes and technology to manage and maintain cybersecurity controls. Financial institutions and companies engaged in data processing have increasingly reported compromises in the security of their websites or other systems, some of which have involved sophisticated and targeted attacks intended to obtain unauthorized access to confidential information, destroy data, disrupt or degrade service, sabotage systems, or cause other damage. Our technologies, systems, networks, and software have been and continue to be subject to cybersecurity threats and attacks, which range from uncoordinated individual attempts to sophisticated and targeted measures by criminal organizations directed at us. Our customers, associates, and third parties that we do business with have been, and will likely continue to be, targeted in cybersecurity-related incidents by parties using fraudulent e-mails, artificial intelligence, and other communications in attempts to misappropriate passwords, bank account information, or other personal information, or to introduce viruses or other malware programs to our information systems, or the information systems and devices of our third-party service providers and our customers that are beyond our security control systems. Although we try to mitigate these threats through product improvements, use of encryption and authentication technology, and customer and employee education, among other things, cybersecurity-attacks against us, our third-party service providers, and our customers are a risk to our business. We may be required to spend significant capital and other resources to protect against the threat of cybersecurity-related incidents or to alleviate problems caused by such incidents. Any failures related to upgrades and maintenance of our technology and information systems could increase our information and system security risk. Our increased use of cloud and other technologies, such as remote work technologies, and the increased connectivity of third parties and electronic devices to our systems also increases our risk of being subject to a cybersecurity-related incident. The risk of a cybersecurity-related incident has increased as the number, intensity, and sophistication of attempted attacks and intrusions from around the world have increased. A cybersecurity-related incident or other significant disruption of our information systems or those of our customers or third-party service providers and vendors could (i) disrupt the proper functioning of our networks and systems and, therefore, our operations and those of our customers; (ii) result in the unauthorized access to, destruction, loss, theft, misappropriation, or release of confidential, sensitive, or otherwise valuable information of ours or our customers; (iii) result in a violation of applicable privacy, data protection, and other laws, subjecting us to additional regulatory scrutiny and exposing us to civil litigation, enforcement actions, governmental fines, sanctions, or penalties (which may not be covered by our insurance policies), and possible financial liability; (iv) require significant management attention and resources to remedy the damages that result; (v) cause increased expenses and lost revenue; or (vi) cause negative publicity, harm our reputation, or cause a decrease in the number of customers that choose to do business with us, damaging our ability to generate deposits. The occurrence of any of the foregoing could have a material adverse effect on our business, financial condition, and results of operations. Furthermore, in the event of a cybersecurity-related incident, we may be delayed in identifying or responding to the incident, which could increase the negative impact of the incident on our business, financial condition, and results of operations. While we maintain cybersecurity insurance coverage, which may apply in the event of certain cybersecurity-related incidents, the amount of coverage may not be adequate depending on the magnitude of the incident. Furthermore, because cybersecurity-related incidents are inherently difficult to predict and can take many forms, some incidents may not be covered under our cyber insurance coverage. Our systems and those of our customers and third-party service providers are under constant threat, and it is possible that we could experience a significant compromise, significant data loss or material financial losses related to cyber-attacks in the future. We may suffer material financial losses related to these risks in the future or we may be subject to liability for compromises to our customer or third-party service provider systems. Any such losses or liabilities could have a material adverse effect on our business strategy, financial condition or results of operations and could expose us to reputation risk, the loss of customer business, increased operational costs, as well as additional regulatory scrutiny, possible litigation and related financial liability. These risks also include possible business interruption, including the inability to access critical information and systems.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services including those related to or involving artificial intelligence, machine learnings, blockchain and other distributed ledger technologies.  The effective use of technology increases efficiency and enables financial institutions to better serve customers and reduce costs.  Our future success depends, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations.  Many of our competitors have substantially greater resources to invest in technological improvements.  We may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers, and even if we implement such products and services, we may incur substantial costs in doing so.  Failure to successfully keep pace with technological changes affecting the financial services industry could have a material adverse impact on our business, financial condition and results of operations.

From time to time, customers make claims and take legal action pertaining to the performance of our fiduciary responsibilities.  Whether customer claims and legal actions related to the performance of our fiduciary responsibilities are merited, defending claims is costly and diverts management's attention, and if such claims and legal actions are not resolved in a manner favorable to us, they may result in significant financial liability and/or adversely affect our market perception and products and services as well as impact customer demand for those products and services.  Any financial liability or reputational damage resulting from claims and legal actions could have a material adverse effect on our business, financial condition and results of operations.

A significant portion of our loan portfolio is secured by real property.  During the ordinary course of business, we may foreclose on and take title to properties securing certain loans.  There is a risk that hazardous or toxic substances could be found on these properties.  If hazardous or toxic substances are found, we may be liable for remediation costs, as well as for personal injury and property damage.  Environmental remediation may require us to incur substantial expenses and may materially reduce the affected property's value or limit our ability to use or sell the affected property.  In addition, future laws or more stringent interpretations or enforcement policies with respect to existing laws may increase our exposure to environmental liability.  Although we have policies and procedures that require us to perform an environmental review before initiating any foreclosure action on nonresidential real property, these reviews may not be sufficient to detect all potential environmental hazards.  The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on our financial condition and results of operations.

We face substantial competition in all areas of our operations from a variety of different competitors, many of which are larger and may have more financial resources.  Such competitors primarily include national, regional and community banks within the various markets we operate.  Additionally, various out-of-state banks have entered or have announced plans to enter the market areas in which we currently operate.  We also face competition from many other types of financial institutions, including, without limitation, credit unions, fintech companies, finance companies, brokerage firms, insurance companies, factoring companies and other financial intermediaries.  The financial services industry could become even more competitive as a result of legislative, regulatory and technological changes, continued consolidation and recent trends in the credit and mortgage lending markets.  Banks, securities firms and insurance companies can be affiliated under the umbrella of a financial holding company, which can offer virtually any type of financial service, including banking, securities underwriting, insurance (both agency and underwriting) and merchant banking.  Also, technology has lowered barriers to entry and made it possible for nonbanks to offer certain products and services traditionally provided by banks, such as automatic transfer and automatic payment systems.  Our competitors may have fewer regulatory constraints and may have lower cost structures.  Additionally, due to their size, many competitors may be able to achieve economies of scale and, as a result, may offer a broader range of products and services as well as better pricing for those products and services than we can, including lower or discontinued fees, such as non-sufficient funds and overdraft fees. Our ability to compete successfully depends on a number of factors, including: - the ability to develop, maintain and build upon long-term customer relationships based on top quality service, high ethical standards and safe, sound assets;- the ability to expand our market position;- the scope, relevance and pricing of products and services offered to meet customer needs and demands;- the rate at which we introduce new products and services relative to our competitors;- our ability to invest in or partner with technology providers offering banking solutions and delivery channels at a level equal to our competitors;- customer satisfaction with our level of service; and - industry and general economic trends. Failure to perform in any of these areas could significantly weaken our competitive position, which could adversely affect our growth and profitability, which, in turn, could have a material adverse effect on our financial condition and results of operations.

With the launch of real-time payments networks, such as RTP from The Clearing House and FedNow from the Federal Reserve, instantaneous cash settlement capabilities are available 24 hours a day and 7 days a week. The implications of the new settlement capabilities are far reaching and have not yet significantly affected the banking industry. As market adoption increases, we may be required to hold more liquidity reserves in cash to facilitate cash settlement activity outside of traditional business hours. Additionally, instantaneous settlement will likely reduce float benefits associated with providing deposit and banking services, as well as pose incremental fraud risk due to a reduced ability to reverse fraudulent transactions due to the speed of money movement.