Union Bankshares (UNB) Risk Factors

The Dodd-Frank Act comprehensively reformed the regulation of financial institutions, products and services. Among other things, the Dodd-Frank Act established the CFPB as an independent government bureau which derives its funding from the FRB. The CFPB has the authority to prescribe rules for all depository institutions governing the provision of consumer financial products and services, which may result in rules and regulations that reduce the profitability of such products and services or impose greater costs and restrictions on us and our subsidiaries. The Dodd-Frank Act also established new minimum mortgage underwriting standards for residential mortgages, and the regulatory agencies have focused on the examination and supervision of mortgage lending and servicing activities. The CFPB's qualified mortgage rule, or "QM Rule," became effective on January 10, 2014. The QM Rule requires mortgage lenders, prior to originating most residential mortgage loans, to make a determination of a borrower's ability to repay the loan and establishes protections from liability under this requirement for so-called "qualified mortgages" that meet certain heightened criteria. If a mortgage lender does not appropriately establish a borrower's ability to repay the loan, the borrower may be able to assert against the originator of the loan or any subsequent transferee, as a defense to foreclosure by way of recoupment or setoff, a violation of the ability-to-repay requirement. Loans that meet the definition of "qualified mortgage" will be presumed to have complied with the ability-to-repay standard. Although amendments to the QM Rule adopted by the CFPB in March 2021 will make it less challenging for a loan to meet the definition, the QM Rule and related ability-to-repay requirements and similar rules could nevertheless still limit Union's ability to make certain types of loans or loans to certain borrowers, or could make it more expensive and time-consuming to make these loans, which could limit the Bank's growth or profitability. Current and future legal and regulatory requirements, restrictions, and regulations, including those imposed under the Dodd-Frank Act, may adversely impact our profitability and may have a material and adverse effect on our business, financial condition, or results of operations; may require us to invest significant management attention and resources to evaluate and make any changes required by the legislation and related regulations; and may make it more difficult for us to attract and retain qualified executive officers and employees.

Our businesses and operations are subject to increasing regulatory oversight and scrutiny, which could lead to regulatory investigations or enforcement actions. These and other initiatives from federal and state officials could result in judgments, settlements, fines or penalties, or require us to restructure our operations and activities, all of which could lead to reputational damage, or higher operational costs, or both, thereby reducing our revenue. From time to time we are named as a defendant or are otherwise involved in various legal proceedings. There is no assurance that litigation with private parties will not increase in the future. Future actions against us may result in judgments, settlements, fines, penalties or other results adverse to us, which could materially adversely affect our business, financial condition or results of operations, or cause serious reputational harm to us. As a participant in the financial services industry, we are exposed to a high level of litigation related to our businesses and operations. Although we maintain insurance, the scope of this coverage may not provide us with full, or even partial, coverage in any particular case. As a result, a judgment against us in any such litigation could have a material adverse effect on our financial condition and results of operation.

Some investors have begun to consider how corporations, such as the Company, are addressing environmental, social, and governance matters, commonly referred to as "ESG" matters, when making investment decisions. Investor advocacy groups, investment funds and influential investors are also increasingly focused on these practices, especially as they relate to the environment, health and safety, diversity, labor conditions, and human rights. Specific examples of matters being evaluated as part of the investment decision or recommendation by certain investors include the business risks of climate change and the adequacy of companies' responses to climate change, diversity of a company's management and/or board of directors, community involvement and charitable giving, and the inclusion of ESG factors in the determination of the executive compensation. These shifts in investing priorities may result in adverse effects on the trading price of the Company's common stock if investors determine, whether real or perceived, that the Company's ESG actions are not satisfactory. In addition, new government regulations could also result in new or more stringent forms of ESG oversight and expanding mandatory and voluntary reporting, diligence, and disclosure. Increased ESG related compliance costs could result in increases to our overall operational costs.

Our technologies, systems, networks and software, and those of other financial institutions have been, and are likely to continue to be, the target of cybersecurity threats and attacks, which may range from uncoordinated individual attempts to sophisticated and targeted measures directed at us. These cybersecurity threats and attacks may include, but are not limited to, attempts to access information, including customer and company information, malicious code, computer viruses and denial of service attacks that could result in unauthorized access, misuse, loss or destruction of data (including confidential customer information), account takeovers, unavailability of service, ransomware attacks or other events. These types of threats may result from human error, fraud or malice on the part of external or internal parties, or from accidental technological failure. Further, to access our products and services our customers may use computers and mobile devices that are beyond our security control systems. The risk of a security breach or disruption, particularly through cyber-attack or cyber intrusion, including by computer hackers, has increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. Our business requires the collection and retention of large volumes of customer data, including payment card numbers and other personally identifiable information in various information systems that we maintain and in those maintained by third parties with whom we contract to provide data services. We also maintain important internal company data such as personally identifiable information about our employees and information relating to our operations. The integrity and protection of that customer and company data is important to us. As customer, public, legislative and regulatory expectations and requirements regarding operational and information security have increased, our operations systems and infrastructure must be continually safeguarded and monitored for potential failures, disruptions and breakdowns. Our customers and employees have been, and will continue to be, targeted by parties using fraudulent e-mails and other communications in attempts to misappropriate passwords, payment card numbers, bank account information or other personal information or to introduce viruses to our customers' computers. These communications may appear to be legitimate messages sent by the Bank or other businesses, but direct recipients to fake websites operated by the sender of the e-mail or request that the recipient send a password or other confidential information via e-mail or download a program. Despite our efforts to mitigate these threats through product improvements, use of encryption and authentication technology to secure online transmission of confidential consumer information, and customer and employee education, such attempted frauds against us or our merchants and our third party service providers remain a serious issue. The pervasiveness of cyber security incidents in general and the risks of cyber-crime are complex and will continue to evolve. Although we make significant efforts to maintain the security and integrity of our information systems and have implemented various measures to manage the risk of a security breach or disruption, there can be no assurance that our security efforts and measures will be effective or that attempted security breaches or disruptions would not be successful or damaging. Even the most well-protected information, networks, systems and facilities remain potentially vulnerable because attempted security breaches, particularly cyber-attacks and intrusions, or disruptions will occur in the future, and because the techniques used in such attempts are constantly evolving and generally are not recognized until launched against a target, and in some cases are designed not to be detected and, in fact, may not be detected. Accordingly, we may be unable to anticipate these techniques or to implement adequate security barriers or other preventative measures, and thus it is virtually impossible for us to entirely mitigate this risk. A security breach or other significant disruption could: (i) disrupt the proper functioning of our networks and systems and therefore our operations and/or those of certain of our customers; (ii) result in the unauthorized access to, and destruction, loss, theft, misappropriation or release of confidential, sensitive or otherwise valuable information of ours or our customers, including account numbers and other financial information; (iii) result in a violation of applicable privacy, data breach and other laws, subjecting the Bank to additional regulatory scrutiny and exposing the Bank to civil litigation, governmental fines and possible financial liability; (iv) require significant management attention and resources to remedy the damages that result; or (v) harm our reputation or cause a decrease in the number of customers that choose to do business with us or reduce the level of business that our customers do with us. The occurrence of any such failures, disruptions or security breaches could have a negative impact on our results of operations, financial condition, and cash flows as well as damage our brand and reputation. Although we maintain an insurance policy covering certain cybersecurity risks which we believe provides appropriate coverage for a financial institution of our size and business and technology profile, we cannot provide any assurance that such policy would be sufficient to cover all financial losses or damages we might suffer in the event that we or one of our third party vendors experiences a system failure or suffers a system intrusion or other cyberattack.

We operate in a highly competitive environment that includes financial and non-financial services firms, including traditional banks, online banks, financial technology companies, wealth management companies and others. These companies compete on the basis of, among other factors, size, quality and type of products and services offered, price, technology and reputation. Emerging technologies have the potential to intensify competition and accelerate disruption in the financial services industry. In recent years, non-financial services firms, such as financial technology companies, have begun to offer services traditionally provided by financial institutions. These firms attempt to use technology and mobile platforms to enhance the ability of companies and individuals to borrow money, save and invest. Our ability to compete successfully depends on a number of factors, including our ability to develop and execute strategic plans and initiatives; to develop competitive products and technologies; and to attract, retain and develop a highly skilled employee workforce. If we are not able to compete successfully, we could be placed at a competitive disadvantage, which could result in the loss of customers and market share, and our business, results of operations and financial condition could suffer.

We have been, and continue to be, impacted by general business and economic conditions in the United States and, to a lesser extent, abroad.  These conditions include short-term and long-term interest rates, inflation, money supply, political issues, legislative and regulatory changes, fluctuations in both debt and equity capital markets, broad trends in industry and finance, unemployment and the condition of the U.S. economy and the local economies in which we operate, all of which are beyond our control. Deterioration or continued weakness in any of these factors could result in increases in loan delinquencies and nonperforming assets, decreases in loan collateral values, the value of our investment portfolio and demand for our products and services.