Wsfs Financial (WSFS) Risk Analysis

Our deferred tax assets are subject to an evaluation of whether it is more likely than not that they will be realized for financial statement purposes. In making this determination, we consider all positive and negative evidence available, including the impact of recent operating results, as well as potential carryback of tax to prior years' taxable income, changes in statutory tax rates, reversals of existing taxable temporary differences, tax planning strategies and projected earnings within the statutory tax loss carryover period. If we conclude in the future that a significant portion of our deferred tax assets are not more likely than not to be realized, we will record a valuation allowance, which could adversely affect our financial position, results of operations and regulatory capital ratios.

Our Associates are our most important resource and, in many areas of the financial services industry, competition for qualified personnel is intense. We invest significantly in recruitment, training, development and talent management as our Associates are the cornerstone of our model. If we were unable to continue to attract and retain qualified key associates to support the various functions of our businesses, our performance, including our competitive position, could be adversely affected. As economic conditions improve, we may face increased difficulty in retaining top performers and critical skilled associates. If key personnel were to leave us and equally knowledgeable or skilled personnel are unavailable within WSFS or could not be sourced in the market, our ability to manage our business may be hindered or impaired.

Our use of third-party service providers exposes us to the risk of failures in their operations and their risk and control environments. We outsource certain key functions to external parties, including some that are critical to financial reporting (including our use of hedge accounting), valuations, our mortgage-related investment activity, loan underwriting, and loan servicing. We may enter into other key outsourcing relationships in the future and continue to expand our existing reliance on third-party service providers. If one or more of these key external parties were not able to perform their functions for a period of time, perform them at an acceptable service level or handle increased volumes, or if one of them experiences a disruption in its own business or technology from any cause, our business operations could be constrained, disrupted, or otherwise negatively affected. Our use of third-party service providers also exposes us to the risk of losing intellectual property or confidential information and to other harm, including to our reputation. Our ability to monitor the activities or performance of third-party service providers may be constrained, which may make it difficult for us to assess and manage the risks associated with these relationships.

Our nonperforming assets, which consist of non-accrual loans, assets acquired through foreclosure, and restructured loans adversely affect our net income in various ways. We do not record interest income on nonaccrual loans and assets acquired through foreclosure. We must establish an allowance for credit losses which reserves for losses inherent in the loan and lease portfolio that are both probable and reasonably estimable. From time to time, we also write down the value of properties in our portfolio of assets acquired through foreclosure to reflect changing market values. Additionally, there are legal fees associated with the resolution of problem assets as well as carrying costs such as taxes, insurance and maintenance related to assets acquired through foreclosure. The resolution of nonperforming assets requires the active involvement of management, which can distract management from daily operations and other income producing activities. Finally, if our estimate of the allowance for credit losses is inadequate, we will have to increase the allowance for credit losses accordingly, which will have an adverse effect on our earnings. Significant increases in the level of our nonperforming assets from the current level, or greater than anticipated costs to resolve these credits, will have an adverse effect on our earnings.

Our operations are dependent upon our ability to protect our computer equipment against damage from fire, power loss, telecommunications failure or a similar catastrophic event. Any damage or failure that causes an interruption in our operations could have an adverse effect on our business, financial condition and results of operations. In addition, our operations are dependent upon our ability to protect the computer systems, software and networks utilized by us, including our Internet banking activities, against damage from physical break-ins, cyber-attacks, cybersecurity breaches and other disruptive problems. Failures in, or breaches of, our computer systems, software and networks, or those of our third-party vendors or other service providers, including as a result of cyber-attacks, cybersecurity breaches and other disruptions, could disrupt our business or operations or those of our Customers and counterparties, result in the disclosure or misuse of confidential or proprietary information, result in supervisory liability or regulatory enforcement action, damage our reputation, result in a loss of Customers and business, result in a loss of confidence in the security of our systems, products and services, increase our costs and cause losses to us. Our security measures, including firewalls and penetration testing, as well as Board oversight and management's assessment, identification and management of cybersecurity risks, may not prevent or detect future potential losses or liabilities from system failures or breaches or cyber-attacks, cybersecurity breaches, or other disruptions. We seek to continuously monitor for and nimbly react to any and all such malicious cyber activity, and we develop our systems to protect our technology infrastructure and data from misuse, misappropriation or corruption. Senior management gives a quarterly update on cybersecurity to the Risk Committee of our Board of Directors and an annual update to our full Board of Directors. Although we devote significant resources and Board oversight and management focus to ensuring the integrity of our systems through information security and business continuity programs, our computer systems, software and networks, and those of our third-party service providers, are vulnerable to external or internal security breaches, acts of vandalism, computer viruses or malware, misplaced or lost data, denial-of-service attacks, programming or human errors, or other similar events. We also experience large volumes of phishing and other forms of social engineering attempted for the purpose of perpetrating fraud against us, our Associates, or our Customers. In addition to cyber-attacks or other security breaches involving the theft of sensitive and confidential information, hackers recently have engaged in attacks against large financial institutions that are designed to disrupt key business services, such as consumer-facing web sites. We and our third-party vendors or other service providers have experienced all of these events and expect to continue to experience them in the future. Any of these occurrences could have an adverse effect on our business, financial condition and results of operations. Although the impact to date from these events has not had an adverse effect on us, we cannot be sure this will be the case in the future. We are not able to anticipate or implement effective preventive measures against all security breaches of these types, especially because attacks are increasingly sophisticated, change frequently, often not recognized until launched, and can originate from a wide variety of sources. Our early detection and response mechanisms could fail to detect, mitigate or remediate these risks in a timely manner. Despite our implementation of protective measures and endeavoring to modify them as circumstances warrant, our computer systems, software and networks may be vulnerable to human error, equipment failure, natural disasters, power loss, unauthorized access, supply chain attacks, distributed denial of service attacks, computer viruses and other malicious code, and other events that could result in significant liability and damage to our reputation, and have an ongoing impact on the security and stability of our operations. In addition, although we maintain insurance coverage that may, subject to terms and conditions, cover certain aspects of cyber and information security risks, such insurance coverage may be insufficient to cover all losses, such as litigation costs or financial losses that exceed our policy limits or are not covered under any of our current insurance policies. Information security risks for financial institutions like us have increased recently in part because of new technologies, the use of the internet, cloud, and telecommunications technologies (including mobile devices) to conduct financial and other business transactions and the increased sophistication and activities of organized crime, perpetrators of fraud, hackers, terrorists and others. Additionally, like many large enterprises, we have introduced more remote work arrangements for our Associates. The increase in remote work arrangements over the past few years has introduced potential new vulnerabilities to cyber threats. We also face increased cybersecurity risk as we deploy additional technologies and digital solutions, including our website and personalized messaging app. We may also face increased cybersecurity risk for a period of time after acquisitions as we transition the acquired entity's historical systems and networks to our standards. Moreover, any cyber-attack or other security breach may persist for an extended period of time without detection. We endeavor to design and implement policies and procedures to identify such cyber-attacks or breaches as quickly as possible; however, we expect that any investigation of a cyber-attack or breach would take substantial amounts of time, and that there may be extensive delays before we obtain full and reliable information. During such time we would not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, all of which would further increase the costs and consequences of such an attack or breach. The SEC recently enacted rules, effective as of December 18, 2023, requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on annual basis material information regarding their cybersecurity risk management, strategy, and governance. If we fail to comply with these new requirements we could incur regulatory fines in addition to other adverse consequences to our reputation, business, financial condition and results of operations. We may also be subject to liability under various data protection laws. In the normal course of business, we collect, process, and retain sensitive and confidential information regarding our Customers and Associates, including personal data. As a result, we are subject to numerous laws and regulations designed to protect this information, such as U.S. federal, state and international laws governing the protection of personally identifiable information. These laws and regulations are increasing in complexity and number. If any person, including any of our associates, negligently disregards or intentionally breaches our established controls with respect to client or employee data, or otherwise mismanages or misappropriates such data, we could be subject to significant monetary damages, regulatory enforcement actions, fines and/or criminal prosecution. In addition, unauthorized disclosure of sensitive or confidential client or employee data, whether through system failure, employee negligence, fraud or misappropriation, could damage our reputation and cause us to lose clients and related revenue. Potential liability in the event of a security breach of client data could be significant. Depending on the circumstances giving rise to the breach, this liability may not be subject to a contractual limit or an exclusion of consequential or indirect damages.

Our operations depend upon the use of computer programs, algorithms, and other analytical tools. If such technology is ineffective at its intended purposes or includes errors in computer code, unintended bias, bad data, misuse of data, or fraud, it may adversely affect our operations. Additionally, as societal norms, legal requirements, businesses and markets evolve, our technology may not accurately reflect this evolution. There may also be technology-related issues that exist, or that develop in the future, that we have not anticipated, identified or mitigated, including when processes are changed or new products and services are introduced. In particular, the implementations of new technologies and digital solutions may cause business disruptions that affect our ability to maintain relationships with clients, customers, depositor and employees. If our risk management framework does not effectively identify and control such risks, we could suffer unexpected losses or be adversely affected, and that could have an adverse effect on our business, results of operations and financial condition.

We compete with regional and national financial institutions and other non-bank companies, some of which may have larger client bases, operate with greater resources, and offer lending terms and services that we do not or cannot offer. Some of these competitors may have other advantages, such as the favorable tax treatments available to credit unions. The financial services industry continues to consolidate due to the benefits of operating at a larger scale and is undergoing rapid technological development that may require us to further develop and invest in our digital capabilities. This competition can affect the pricing for our products and services and if the Company cannot compete effectively, we may lose market share and income resulting in an adverse effect on our business, results of operations and financial condition.

Our ability to attract and retain customers, clients, investors, and highly-skilled management and Associates is affected by our reputation and the reputation of the financial services industry as a whole. Adverse developments may result in additional scrutiny or new litigation against us and potential sources of reputational damage are discussed throughout these risk factors. Although we monitor developments for areas of potential risk to our reputation and brand, negative perceptions or publicity could adversely impact our business, financial condition and results of operations. Significant harm to our reputation can arise from sources, including economic changes, regulatory scrutiny, employee misconduct, actual or perceived unethical behavior, litigation or regulatory outcomes, failing to deliver minimum or required standards of service and quality, compliance failures, disclosure of confidential information, significant or numerous failures, interruptions or breaches of our information systems, and the activities of our clients, customers and counterparties, including vendors. In particular, the success of our Wealth Management segment is highly dependent on reputation. Our Wealth Management segment derives the majority of its revenue from noninterest income which consists of trust, investment and other servicing fees, and our ability to attract trust and wealth management clients is highly dependent upon external perceptions of this segment's level of service, trustworthiness, business practices and financial condition. Negative perceptions or publicity regarding these matters could damage the division's and our reputation among existing customers and corporate clients, which could make it difficult for the Wealth Management segment to attract new clients and maintain existing ones. We could also suffer significant harm to our reputation if we fail to properly identify and manage potential conflicts of interest. Management of potential conflicts of interests has become increasingly complex as we expand our business activities through more numerous transactions, obligations and interests with and among our clients. The actual or perceived failure to adequately address conflicts of interest could affect the willingness of clients to deal with us, which could adversely affect our businesses, financial condition and results of operations