Bar Harbor Bankshares (BHB) Risk Analysis

In the course of business, we may own or foreclose and take title to real estate that may be subject to environmental liabilities with respect to subject property. As a result, we may be held liable for property damage, personal injury, investigation and restoration costs. The cost associated with investigation or restoration activities could be substantial. In addition, as the owner or former owner of a contaminated site, we may be subject to common law claims by third parties based on damages and costs resulting from environmental contamination emanating from the property.

Future pandemics, severe weather, natural disasters, acts of war or terrorism, and other adverse external events could have a significant impact on our ability to conduct business. Such events could affect the stability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue and/or cause us to incur additional expenses. In particular, such events may have a particularly negative impact upon the business of customers who are engaged in the hospitality industry in our markets, which could have a direct negative impact on our business and results of operations. Further, work-from-home and other modified business practices may introduce additional operational risks, including cybersecurity and execution risks, which may result in inefficiencies or delays, and may affect our ability to, or the manner in which we, conduct our business activities.

We are exposed to many types of operational risks, including reputational risk, legal and compliance risk, the risk of fraud or theft by employees or outsiders, and unauthorized transactions by employees or operational errors, including clerical or record-keeping errors or those resulting from faulty or disabled computer or telecommunications systems. If personal, non-public, confidential, or proprietary information of customers in our possession were to be mishandled or misused, we could suffer significant regulatory consequences, reputational damage, and financial loss. Because the nature of the financial services business involves a high volume of transactions, certain errors may be repeated or compounded before they are discovered and successfully rectified. Our necessary dependence upon automated systems to record and process transactions and its large transaction volume may further increase the risk that technical flaws or employee tampering or manipulation of those systems will result in losses that are difficult to detect. We may also be subject to disruptions of our operating systems arising from events that are wholly or partially beyond our control (e.g., computer viruses or electrical or telecommunications outages, natural disaster, pandemics, or other damage to property or physical assets), which may give rise to disruption of service to customers and to financial loss or liability. We are further exposed to the risk that our external vendors may be unable to fulfill their contractual obligations (or will be subject to the same risk of fraud or operational errors by their respective employees) and to the risk that our vendors' business continuity and data security systems prove to be inadequate. The occurrence of any of these risks could result in a diminished ability to operate (e.g., by requiring us to expend significant resources to correct the defect), as well as potential liability to customers, reputational damage, and regulatory intervention. In addition, we are dependent on our reputation within our market area, as a trusted and responsible financial company, for all aspects of our relationships with customers, employees, vendors, third-party service providers and others with whom we conduct business or potential future business, particularly because our business is primarily concentrated in Northern New England. Our actual or perceived failure, including, to (i) identify and address potential conflicts of interest, ethical issues, money-laundering, or privacy issues; (ii) meet legal and regulatory requirements applicable to the Bank and to the Company; (iii) maintain the privacy of customer and accompanying personal information; (iv) maintain adequate record keeping; (v) engage in proper sales and trading practices; and (vi) identify the legal, reputational, credit, liquidity and market risks inherent in our products; or any action of one of our employees that results in actual or perceived misconduct or error, among other things, could give rise to reputational risk that could cause harm to the Bank and our business prospects. If we fail to address any of these issues in an appropriate manner, we could be subject to additional legal risks, which, in turn, could increase the size and number of litigation claims and damages asserted or subject us to enforcement actions, fines and penalties and cause us to incur related costs and expenses. Because we primarily serve individuals and businesses located in Northern New England, any negative impact resulting from reputational harm, including any impact on our ability to attract and retain customers and employees, likely would be greater than if our business were more geographically diverse.

Our operations are dependent on the use of certain outside vendors for its day-to-day operations. Vendors may not perform in accordance with established performance standards required in their agreements for any number of reasons including a change in the vendor's senior management, financial condition, product line or mix and how they support existing customers, or simply change their strategic focus putting us at risk. While we have comprehensive policies and procedures in place to mitigate risk in all phases of vendor management from selection to performance monitoring, the failure of a vendor to perform in accordance with contractual agreements could be disruptive to our business, which could have a material adverse effect on our financial condition and results of operations.

In the ordinary course of business, we rely on electronic communications and information systems to conduct its businesses and to store sensitive data, including financial information regarding its customers. The integrity of information systems is under significant threat from cyberattacks by third parties, including through coordinated attacks sponsored by foreign nations and criminal organizations to disrupt business operations and other compromises to data and systems for political or criminal purposes. We employ an in-depth, layered, defense approach that leverages people, processes and technology to manage and maintain cybersecurity controls. Notwithstanding the strength of defensive measures, the threat from cyberattacks is severe, attacks are sophisticated and attackers respond rapidly to changes in defensive measures. Cybersecurity risks may also occur with our third-party service providers, and may interfere with their ability to fulfill their contractual obligations to us, with additional potential for financial loss or liability that could adversely affect our financial condition or results of operations. We offer our customers the ability to bank remotely and provide other technology-based products and services, which services include the secure transmission of confidential information over the Internet and other remote channels. To the extent that our customers' systems are not secure or are otherwise compromised, our network could be vulnerable to unauthorized access, malicious software, phishing schemes and other security breaches. To the extent that our activities or the activities of its customers or third-party service providers involve the storage and transmission of confidential information, security breaches and malicious software could expose us to claims, regulatory scrutiny, litigation and other possible liabilities. Information security risks have generally increased in recent years, and continue to increase, in part because of the proliferation of new technologies, the implementation of work-from-home arrangements, the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, activists, and other external parties, some of which may be linked to terrorist organizations or hostile foreign governments. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our systems or to investigate and remediate vulnerabilities. System enhancements and updates may also create risks associated with implementing and integrating new systems. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our systems can itself create a risk of systems disruptions and security issues. While to date we believe that we have not experienced a significant compromise, significant data loss or material financial losses related to cybersecurity attacks, our systems and those of our customers and third-party service providers, are under constant threat and may experience a significant event in the future. We may suffer material financial losses related to these risks or be subject to liability for compromises to its customers or third-party providers. Any such losses or liabilities could adversely affect our financial condition or results of operations, and could expose us to reputation risk, the loss of client business, increased operational costs, as well as additional regulatory scrutiny, possible litigation, and related financial liability. These risks also include possible business interruption, including the inability to access critical information and systems.

The financial services industry undergoes rapid technological changes with frequent introductions of new technology-driven products and services, including developments in artificial intelligence. In addition to serving clients better, the effective use of technology increases efficiency and enables financial institutions to reduce costs. Our future success will depend, at least in part, upon our ability to address the needs of our clients by using technology to provide products and services that will satisfy client demands for convenience, as well as to create additional efficiencies in our operations as we continue to grow and expand our products and service offerings. We offer electronic banking services for consumer and business customers via our website, including Internet banking and electronic bill payment, as well as mobile banking. We also offer debit cards, ATM cards, and automatic and ACH transfers. We may experience operational challenges as we implement these new technology enhancements or products, which could impair our ability to realize the anticipated benefits from such new technology or require us to incur significant costs to remedy any such challenges in a timely manner. Many of our larger competitors have substantially greater resources to invest in technological improvements. Third parties upon which we rely for our technology needs may not be able to develop on a cost-effective basis the systems that will enable us to keep pace with such developments. As a result, competitors may be able to offer additional or superior products compared to those that we will be able to provide, which would put us at a competitive disadvantage. We may lose clients seeking new technology-driven products and services to the extent we are unable to provide such products and services. Accordingly, the ability to keep pace with technological change is important and the failure to do so could adversely affect our business, financial condition and results of operations.

We compete with an ever-increasing array of financial service providers. See the section entitled "Competition" in Part I.  Item 1, "Business" of this Annual Report for additional competitor information. Competition from nationwide banks, as well as local institutions, continues to mount in our markets. To compete, we focus on quality customer service, making decisions at the local level, maintaining long-term customer relationships, building customer loyalty, and providing products and services designed to address the specific needs of customers. Failure to perform in any of these areas could significantly weaken our competitive position, which could adversely affect growth and profitability.

Channels for servicing our customers are evolving rapidly, with less reliance on traditional branch facilities, increased use of e-commerce channels, and demand for universal bankers and other relationship managers who can service multiple product lines. We have an ongoing process for evaluating the profitability of its branch system and other office and operational facilities. The identification of unprofitable operations and facilities can lead to restructuring charges and introduce the risk of disruptions to revenues and customer relationships. We compete with larger financial institutions who are rapidly evolving their service channels and escalating the costs of evolving the service process.