Stellar Bancorp (STEL) Risk Analysis

Lawsuits arising out of or relating to the Merger Agreement and/or the proposed acquisition of us by Prosperity may be filed in the future. There can be no assurances that we will be successful in the outcome of any lawsuits challenging the Merger. One of the conditions to completion of the Merger is the absence of any applicable injunction or other order being in effect that prohibits completion of the Merger or the Bank Merger. Accordingly, if a plaintiff is successful in obtaining an injunction, then such order may prevent the Merger from being completed, or from being completed within the expected timeframe. Lawsuits challenging the Merger could divert to some extent our management's and certain of our employee's attention from our day-to-day operations. We may also incur costs in connection with the defense or settlement of any litigation, including costs associated with the indemnification of our directors and officers and settlement payments. For these and other reasons, litigation related to the Merger Agreement could materially and adversely affect our business operations and financial condition, which in turn could materially and adversely affect the price of our common stock.

We participate in the SBA Preferred Lenders Program. As an SBA Preferred Lender, we enable our clients to obtain SBA loans without being subject to the potentially lengthy SBA approval process necessary for lenders who are not SBA Preferred Lenders. The SBA periodically reviews the lending operations of participating lenders to assess, among other things, whether the lender exhibits prudent risk management. When weaknesses are identified, the SBA may request corrective actions or impose enforcement actions, including revocation of the lender's Preferred Lender status. If we lose our status as an SBA Preferred Lender, we may lose some or all of our customers to lenders who are SBA Preferred Lenders, which could adversely affect our business, financial condition and results of operations. The laws, regulations and standard operating procedures that are applicable to SBA loan products may change in the future. We cannot predict the effects of these changes on our business and profitability. Because government regulation greatly affects the business and financial results of all commercial banks and bank holding companies, including our organization, changes in the laws, regulations and procedures applicable to SBA loans could adversely affect our ability to operate profitably. In addition, the aggregate amount of all SBA 7(a) and 504 loan guarantees by the SBA must be approved each fiscal year by the federal government. We cannot predict the amount of SBA 7(a) loan guarantees in any given fiscal year. If the federal government were to reduce the amount of SBA loan guarantees, such reduction could adversely impact our SBA lending program.

Acts of terrorism, cyber-terrorism, political unrest, war (including conflicts in Ukraine and the Middle East), civil disturbance, armed regional and international hostilities and international responses to these hostilities, natural disasters, global health risks or pandemics (such as Covid-19) or the threat of or perceived potential for these events could have a negative impact on us. In addition, malfunctions of the electronic grid and other infrastructure breakdowns (such as the grid failures in Texas in February 2021) could adversely affect economic conditions in our market. Our business continuity and disaster recovery plans may not be successful upon the occurrence of one of these scenarios, and a significant catastrophic event could materially adversely affect our operating results.

The Company or its third-party (or fourth-party) vendors, clients or counterparties may develop or incorporate AI technology in certain business processes, services, or products. The development and use of AI presents a number of risks and challenges to the Company's business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving, both in the U.S. and internationally, and includes regulatory schemes targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment, and other laws applicable to the use of AI. These evolving laws and regulations could require changes in the Company's implementation of AI technology and increase the Company's compliance costs and risk of non-compliance. AI models, particularly generative AI models, may produce output or take actions that is incorrect, that reflects biases included in the data on which they are trained, that results in the release of private, confidential, or proprietary information, that infringes on the intellectual property rights of others, or that is otherwise harmful. In addition, the complexity of many AI models makes it difficult to understand why they are generating particular opinions. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding, monitoring the capabilities of the AI models, reducing erroneous output, eliminating bias, and complying with regulations that require documentation or explanation of the basis on which decisions are made. Further, the Company may rely on AI models developed by third-parties, and, to that extent, would be dependent in part on the manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models and the effectiveness of the steps these third-parties have taken to limit the risks associated with the output of their models, matters over which the Company may have limited visibility. Any of these risks could expose the Company to liability or adverse legal or regulatory consequences and harm the Company's reputation and the public perception of its business or the effectiveness of its security measures.

Banking and other financial services companies, such as the Company, rely on technology companies to provide information technology products and services necessary to support their day-to-day operations. Technology companies frequently enter litigation based on allegations of patent infringement or other violations of intellectual property rights. The Company also uses trademarks and logos for marketing purposes, and third parties may allege that the Company's marketing, processes or systems may infringe their intellectual property rights. Competitors of the Company's vendors, or other individuals or companies, may from time to time claim to hold intellectual property sold to the Company. Such claims may increase in the future as the financial services sector becomes more reliant on information technology vendors. The plaintiffs in these actions frequently seek injunctions and substantial damages. Regardless of the scope or validity of such patents or other intellectual property rights, or the merits of any claims by potential or actual litigants, the Company may have to engage in protracted litigation that can be expensive, time-consuming, and disruptive to operations and distracting to management. In addition to litigation relating to intellectual property, the Company is regularly involved in litigation matters in the ordinary course of business. While the Company believes that these litigation matters should not have a material adverse impact on its business, financial condition, results of operations or future prospects, it may be unable to successfully defend or resolve any current or future litigation matters.

As a financial institution, we are susceptible to fraudulent activity, information security breaches and cybersecurity-related incidents that may be committed against us, our clients or third-parties with whom we interact and that may result in financial losses or increased costs to us or our clients, disclosure or misuse of confidential information belonging to us or personal or confidential information belonging to our clients or misappropriation of assets and litigation. The occurrence of any of these could lead to litigation, cause reputational harm or cause customers to lose confidence in the Company's ability to safeguard their information. Our industry has seen increases in electronic fraudulent activity, hacking, security breaches, sophisticated social engineering and cyber-attacks. Our business is highly dependent on the security and efficacy of our infrastructure, computer and data management systems, as well as those of third parties with whom we interact or on whom we rely. Our business relies on the secure processing, transmission, storage and retrieval of confidential, proprietary and other information in our computer and data management systems and networks and in the computer and data management systems and networks of third parties. In addition, to access our network,products and services, our customers and other third-parties may use personal mobile devices or computing devices that are outside of our network environment and are subject to their own cybersecurity risks. All of these factors increase our risks related to cyber-threats and electronic disruptions. While we invest in systems and processes that are designed to detect and prevent security breaches and cyber-attacks and we conduct periodic tests of our security systems and processes, we may not succeed in anticipating or adequately protecting against or preventing all security breaches and cyber-attacks from occurring. Even the most advanced internal control environment may be vulnerable to compromise. Targeted social engineering attacks are becoming more sophisticated and are extremely difficult to prevent. Additionally, the existence of cyber-attacks or security breaches at third-parties with access to our data, such as vendors, may not be disclosed to us in a timely manner. As cyber-threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities or incidents. As is the case with non-electronic fraudulent activity, cyber-attacks or other information or security breaches, whether directed at us or third-parties, may result in a material loss or have material consequences. Furthermore, the public perception that a cyber-attack on our systems has been successful, whether or not this perception is correct, may damage our reputation with customers and third parties with whom we do business. A successful penetration or circumvention of system security could cause negative consequences, including loss of customers and business opportunities, disruption to our operations and business, misappropriation or destruction of our confidential information and/or that of our customers, or damage to our customers' and/or third-parties' computers or systems, and could expose us to additional regulatory scrutiny and result in a violation of applicable privacy laws and other laws, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in our security measures, reputational damage, reimbursement or other compensatory costs, additional compliance costs.

We conduct our operations almost exclusively in the Houston and Beaumont MSAs. Many of our competitors offer the same, or a wider variety of, banking services within our market area. These competitors include banks with nationwide operations, regional banks and other community banks. The Company also faces competition from many other types of financial institutions, including savings banks, credit unions, finance companies, mutual funds, insurance companies, brokerage and investment banking firms, asset-based non-bank lenders, financial technology ("fintech") competitors and certain other non-financial entities, such as retail stores that may maintain their own credit programs and certain governmental organizations that may offer more favorable financing or deposit terms than the Company can. In addition, a number of out-of-state financial intermediaries have opened production offices, or otherwise solicit deposits, in our market area. The financial services industry could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. In particular, the activity of fintech companies has grown significantly over recent years and is expected to continue to grow. Some fintech companies are not subject to the same regulations as we are, which may allow them to be more competitive. Increased competition from fintech companies and the growth of digital banking may also lead to pricing pressures as competitors offer more low-fee and no-fee products. In addition, as customer preferences and expectations continue to evolve, technology has lowered barriers to entry and made it possible for banks to expand their geographic reach by providing services over the internet and for nonbanks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. Increased competition in our market may result in reduced loans and deposits, as well as reduced net interest margin, fee income and profitability. Ultimately, the Company may not be able to compete successfully against current and future competitors. If we are unable to attract and retain banking customers, we may be unable to continue to grow our loan and deposit portfolios, and our business, financial condition and results of operations could be adversely affected.

We conduct our operations almost exclusively in the Houston and Beaumont MSAs. A majority of the loans in our loan portfolio were made to borrowers who live and/or conduct business in these MSAs and a majority of our secured loans were secured by collateral located in these MSAs. The Company's success depends, to a significant extent, upon the economic activity and conditions in its market. Adverse economic conditions that impact the Company's market could reduce its growth rate, the ability of customers to repay their loans, the value of collateral underlying loans, the Company's ability to attract deposits and generally impact its business, financial condition, results of operations and future prospects. Due to the Company's geographic concentration, it may be less able than other larger regional or national financial institutions to diversify the Company's credit risks.

As a community bank, the Company's reputation within the communities served is critical to its success. The Company believes it has set itself apart from competitors by building strong personal and professional relationships with its customers and by being an active member of the communities it serves. The Company strives to enhance its reputation by recruiting, hiring and retaining employees who share the Company's core values of being an integral part of the communities it serves and delivering superior service to customers. Negative public opinion could result from the Company's actual or alleged conduct in any number of activities, including (1) lending practices, (2) expansion strategy, (3) product and service offerings, (4) corporate governance, (5) regulatory compliance, (6) mergers and acquisitions, (7) disclosure, (8) sharing or inadequate protection of customer information, (9) successful or attempted cyber-attacks against the Company, its customers or its third-party partners or vendors and (10) failure to discharge any publicly announced commitments to employees or environmental, social and governance initiatives or to respond adequately to social and sustainability concerns from the viewpoint of its stakeholders from actions taken by government regulators and community organizations in response to the Company's conduct. If the Company's reputation is negatively affected by the actions of its employees or otherwise, the Company may be less successful in attracting new talent and customers or may lose existing customers. Further, negative public opinion can expose the Company to litigation and regulatory action and could delay and impede efforts to implement its expansion strategy.