Burke & Herbert Bank & Company (BHRB) Risk Analysis

In deciding whether to extend credit or enter into other transactions with clients and counterparties, and the terms of any such transaction, we may rely on information furnished by, or on behalf of, clients and counterparties, including financial statements, property appraisals, title information, employment and income documentation, account information, and other financial information. We may also rely on representations of clients and counterparties as to the accuracy and completeness of that information and, with respect to financial statements, on reports of independent auditors. Any such misrepresentation or incorrect or incomplete information, whether fraudulent or inadvertent, may not be detected prior to funding. In addition, one or more of our employees or vendors could cause a significant operational breakdown or failure, either as a result of human error or where an individual purposefully sabotages or fraudulently manipulates our loan documentation, operations, or systems. Whether a misrepresentation is made by the applicant or another third-party, we generally bear the risk of loss associated with the misrepresentation. A loan subject to a material misrepresentation is typically unsellable or subject to repurchase if it is sold prior to detection of the misrepresentation. The sources of the misrepresentations may also be difficult to locate, and we may be unable to recover any of the monetary losses we may suffer as a result of the misrepresentations. Any of these developments could have an adverse effect on our business, financial condition, and results of operations.

The financial services industry is undergoing rapid technological changes with frequent introductions of new technology-driven products and services, and we anticipate that new technologies will continue to emerge. The effective use of technology increases efficiency and enables financial institutions to better serve customers and reduce costs. Our future success will depend, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands for convenience, as well as to create additional efficiencies in our operations. Developing or acquiring access to new technologies and incorporating those technologies into our products and services, or using them to expand our products and services, may require significant investments, may take considerable time to complete, and ultimately, may not be successful. If we fail to maintain or enhance our competitive position with respect to technology, whether because of a failure to anticipate customer expectations, substantially fewer resources to invest in technological improvements than our larger competitors, or because our technological developments fail to perform as desired or are not rolled out in a timely manner, we may lose market share or incur additional expense. In addition, any future implementation of technological changes and upgrades to maintain current systems may cause operational and customer challenges upon implementation and for some time afterwards. Key challenges include service interruptions, transaction processing errors and system conversion delays, which may cause us to lose customers or fail to comply with applicable laws, and may cause us to incur additional expenses, which may be substantial and could have a material adverse effect on our business, financial condition, results of operations, and future prospects. Recently, the financial services industry has experienced rapid developments in artificial intelligence, including agentic artificial intelligence. The use of artificial intelligence models developed by third parties introduces risks related to how those models are developed, trained, and deployed, including unauthorized material in training data and limited visibility into risk mitigation steps. The legal and regulatory environment for artificial intelligence is uncertain and rapidly evolving, potentially increasing compliance costs and risks of noncompliance. We may be exposed to the risk that generative artificial intelligence models may produce incorrect outputs, release confidential information, reflect biases, or otherwise cause harm. Their complexity may make it challenging to understand all outputs and comply with documentation or explanation requirements. Any of these risks could adversely affect our business, expose us to liability or other adverse legal or regulatory consequences, or otherwise adversely affect our financial results.

Banking and other financial services companies, such as ours, rely on technology companies to provide information technology products and services necessary to support their day-to-day operations. Technology companies frequently enter into litigation based on allegations of patent infringement or other violations of intellectual property rights. In addition, patent holding companies seek to monetize patents they have purchased or otherwise obtained. Competitors of our vendors, or other individuals or companies, may from time to time claim to hold intellectual property sold to us by our vendors. Such claims may increase in the future as the financial services sector becomes more reliant on information technology vendors. The plaintiffs in these actions frequently seek injunctions and substantial damages. Regardless of the scope or validity of such patents or other intellectual property rights, or the merits of any claims by potential or actual litigants, we may have to engage in protracted litigation. Such litigation is often expensive, time-consuming, disruptive to our operations, and distracting to management. If we are found to infringe one or more patents or other intellectual property rights, we may be required to pay substantial damages or royalties to a third-party. In certain cases, we may consider entering into licensing agreements for disputed intellectual property, although no assurance can be given that such licenses can be obtained on acceptable terms or that litigation will not occur. These licenses may also significantly increase our operating expenses. If legal matters related to intellectual property claims were resolved against us or settled, we could be required to make payments in amounts that could have an adverse effect on our business, financial condition, and results of operations.

The computer systems and network infrastructure we use, as well as those of third parties on which we are highly dependent, may be vulnerable to physical theft, fire, power loss, telecommunications failure, or a similar catastrophic event, as well as security breaches, denial of service attacks, viruses, worms, and other disruptive problems caused by hackers or malicious actors. Any damage or failure that causes breakdowns or disruptions in our customer relationship management, general ledger, deposit, loan, and other systems could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny for failure to comply with required information security standards, or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on us. Computer break-ins, phishing, and other disruptions could also jeopardize the security of information stored in and transmitted through our computer systems and network infrastructure. Information security risks have generally increased in recent years in part because of the proliferation of new technologies, the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, activists, and other external parties. Our operations rely on the secure processing, transmission, and storage of confidential information in our computer systems and networks and the computer systems and networks of third parties. In addition, to access our products and services, our customers may use devices that are beyond our control systems. Although we believe we have robust information security procedures and controls, our technologies, systems, networks, and our customers' devices have been subject to, and are likely to continue to be, the target of cyber-attacks or information security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss, or destruction of the Bank's or our customers' confidential, proprietary, and other information, or otherwise disrupt the Bank's or our customers' or other third parties' business operations. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. The Bank is under continuous threat of loss due to hacking and cyber-attacks, especially as we continue to expand customer capabilities to utilize internet and other remote channels to transact business. Two of the most significant cyber-attack risks that we face are e-fraud and loss of sensitive customer data. Loss from e-fraud occurs when cybercriminals extract funds directly from our customer accounts. Attempts to breach sensitive customer data, such as account numbers and social security numbers, present significant reputational, legal, and/or regulatory costs to us, if successful. Our risk and exposure to these matters remains heightened because of the evolving nature and complexity of these threats from cybercriminals and hackers, our plans to continue to provide internet banking and mobile banking channels, and our plans to develop additional remote connectivity solutions to serve our customers. We cannot assure that we will not be the victim of a material hacking or cyberattack that could cause us to suffer material losses or other harms. The occurrence of any cyber-attack or information security breach could result in potential liability to customers, reputational damage, and the disruption of our operations, and regulatory concerns, all of which could adversely affect our business, financial condition, or results of operations. In addition, one or more of our third-party service providers may become subject to cyber-attacks or information security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of our or our customers' confidential, proprietary and other information, or otherwise disrupt our or our customers' or other third parties' business operations. We do not control such service providers' day-to-day operations and a successful attack or security breach at one or more of such third-party service providers is not within our control. The occurrence of any such breaches, disruption in services provided by such third parties or other failures could damage our reputation, result in a loss of customer business, and expose us to additional regulatory scrutiny, civil litigation, and possible financial liability, any of which could have a material adverse effect on our financial condition and results of operations.

Our ability to grow and compete is dependent on the Bank's ability to build or acquire the necessary operational and technological infrastructure and to manage the cost of that infrastructure as we expand. In our case, operational risk can manifest itself in many ways, such as errors related to failed or inadequate processes, faulty or disabled computer systems, fraud by employees or outside persons, which may take many forms including check fraud, electronic fraud, wire fraud, social engineering, phishing and other dishonest acts, and exposure to external events. As discussed below, we are dependent on our operational infrastructure to help manage these risks. In addition, we are heavily dependent on the strength and capability of the technology systems that the Bank uses both to interface with customers and to manage internal financial and other systems. Our ability to develop and deliver new products that meet the needs of our existing customers and attract new ones depends on the functionality of our technology systems. Additionally, our ability to run our business in compliance with applicable laws and regulations depends on these systems. We continuously monitor our operational and technological capabilities and make modifications and improvements as circumstances warrant. In some instances, the Bank may build and maintain these capabilities itself; however, we outsource many of these functions to third parties. These third parties may experience errors or disruptions, including cyber-attacks, that could adversely impact the Bank and over which the Bank may have limited control. We also face risk from the integration of new infrastructure platforms, including in connection with acquisitions, such as the LNKB Merger, and/or new third-party providers of such platforms into the Bank's existing businesses. Many of our larger competitors have substantially greater resources to invest in technological improvements. As a result, they may be able to offer additional or superior technologies or services compared to those that we provide, which could put us at a competitive disadvantage. Accordingly, we may lose customers seeking new technology-driven products and services to the extent we are unable to compete effectively.

Third parties provide key components of our business infrastructure such as data processing, internet connections, network access, core application processing, statement production, and account analysis. Our business depends on the successful and uninterrupted functioning of our information technology and telecommunications systems and third-party servicers. The failure of these systems, or the termination of a third-party software license or service agreement on which any of these systems is based, could interrupt our operations. Because our information technology and telecommunications systems interface with and depend on third-party systems, we could experience service denials if demand for such services exceeds capacity, or such third-party systems fail or experience interruptions. Replacing vendors or addressing other issues with our third-party service providers could entail significant delay and expense. If we are unable to efficiently replace ineffective service providers, or if we experience a significant, sustained, or repeated system failure or service denial, it could compromise our ability to operate effectively, damage our reputation, result in a loss of customer business, and subject us to additional regulatory scrutiny and possible financial liability, any of which could have an adverse effect on our business, financial condition, and results of operations.

A substantial portion of our loans are secured by real estate. These concentrations expose us to the risk that adverse developments in the real estate market, or in the general economic conditions in the areas where such real estate is located, or the continuation of such adverse developments, could increase the levels of non-performing loans and charge-offs, and reduce loan demand and deposit growth. In that event, we would likely experience lower earnings or losses. Additionally, if economic conditions in our market area deteriorate, or there is volatility or weakness in the economy or any significant sector of the economy in our markets, our ability to develop our business relationships may be diminished, the quality and collectability of our loans may be adversely affected, our provision for credit losses may increase, the value of collateral may decline, and loan demand may be reduced.

We are subject to the growing risk of climate change. Among the risks associated with climate change are more frequent severe weather events. Severe weather events such as hurricanes, tropical storms, tornados, winter storms, freezes, flooding and other large-scale weather catastrophes in our markets subject us to significant risks, and more frequent severe weather events magnify those risks. Large-scale weather catastrophes, or other significant climate change effects that either damage or destroy residential or multifamily real estate underlying mortgage loans or real estate collateral, could decrease the value of our real estate collateral or increase our delinquency rates in the affected areas and thus diminish the value of our loan portfolio. In addition, the effects of climate change may have a significant effect on our geographic markets and could disrupt our operations or the operations of our customers, third-party service providers, or supply chains, more generally. Those disruptions could result in declines in economic conditions in our geographic markets or industries in which our borrowers operate and impact their ability to repay loans or maintain deposits. Climate change could also impact our assets or employees directly or lead to changes in customer preferences that could negatively affect our growth or business strategies. In addition, our reputation and customer relationships could be damaged due to our practices related to climate change, including our or our customers' involvement in certain industries or projects. Moreover, over the past few years, federal banking regulators increasingly focused on the physical and financial risks to financial institutions associated with climate change; although, expectations with respect to these matters has been changing, and it is difficult to predict changes in priorities and requirements with respect to these matters, including any changes in compliance costs relating to such changes. Additionally, some states have been, and may continue to be, active in climate-related regulation.

Liquidity is essential to our business. An inability to maintain sufficient deposits or raise funds through additional deposits, borrowings, the sale of loans, and other sources could have a substantial negative effect on our liquidity. Our access to funding sources in amounts adequate to finance our activities, or on terms that are acceptable to us, could be impaired by factors that affect us specifically, the financial services industry, or the economy, in general. Factors that could detrimentally affect our access to liquidity sources may be beyond our control and include, among other things, market disruptions, changes in our credit ratings, lack of sufficient qualifying collateral to support borrowings, competitive dynamics, reputational damage, the confidence of depositors in us or the financial-services industry, generally, a decrease in the level of our business activity as a result of a downturn in the markets in which our loans are concentrated, and an adverse regulatory action against us. Our ability to borrow could also be impaired by factors that are not specific to us, such as a disruption in the financial markets, increased inflation, tariffs or other disruptions to global trade, trade agreements or supply chains, geopolitical conflicts or tensions, rising interest rates, the state of the regulatory environment and monetary and fiscal policies, the possibility of the U.S. government defaulting on its debt, or negative views and expectations about the prospects for the financial services industry or the global economy more broadly. If a large number of our depositors or depositors with a high concentration of deposits sought to withdraw their deposits suddenly, we could encounter difficulty meeting such a significant deposit outflow, which could negatively impact our profitability, reputation and liquidity. Significant unanticipated deposit outflows have occurred at other financial institutions, and may occur in the future, compounded by advances in technology that increase the speed at which deposits can be moved from bank to bank or outside the banking system, as well as the speed and reach with which information, concerns and rumors can spread through media, in each case potentially exacerbating liquidity concerns. While we believe our funding sources are adequate to meet any significant unanticipated deposit withdrawal, we may not be able to manage the risk of deposit volatility effectively, which could have a material adverse effect on our liquidity, business, financial condition and results of operations. Actual events involving limited liquidity, defaults, non-performance, or other adverse developments that affect financial institutions, transactional counterparties, or other companies in the financial services industry or the financial services industry, generally, or concerns or rumors about any events of these kinds or other similar risks, have in the past, and may in the future, lead to market-wide liquidity problems. Among other sources of funds, we rely heavily on deposits for funds to make loans and provide for our other liquidity needs. Core deposits are generally a low-cost and stable source of funding. However, loan demand may exceed the rate at which we are able to build core deposits for which there is substantial competition from a variety of different competitors, so we may rely on more interest-sensitive deposits, including brokered deposits, as sources of funds. Those deposits may not be as stable as other types of deposits, and in the future, depositors may not renew those deposits when they mature, or we may have to pay a higher rate of interest to attract or retain them or to replace them with other deposits or with funds from other sources. Not being able to attract deposits, or to retain or replace them as they mature, would adversely affect our liquidity. Funding costs may increase if we lose core deposits and are forced to replace them with more expensive sources. Depending on the interest rate environment and competitive factors, low-cost deposits may need to be replaced with higher cost funding, resulting in a decrease in net interest income and net income. As of December 31, 2025, approximately 32.1% of our deposits were uninsured and we rely on these deposits for liquidity.

We operate in a competitive market for financial services and face intense competition from other financial institutions in making loans and attracting deposits, which can greatly affect pricing for our products and services and could adversely affect our cost of funds. Our principal competitors are commercial and community banks, credit unions, savings and loan associations, mortgage banking firms, online mortgage lenders, and consumer finance companies, including large national financial institutions that operate in our market. Many of these competitors are larger than us, have significantly more resources, greater brand recognition, more extensive and established branch networks or geographic footprints than we do, and may be able to attract customers more effectively than we can. Because of their scale, many of these competitors can be more aggressive than we can on loan and deposit pricing, and may better afford and make broader use of media advertising, support services, and electronic technology than we do. Also, many of our non-bank competitors have fewer regulatory constraints and may have lower cost structures. As a result, some of our competitors can offer products and services that we are unable to offer or to offer such products and services at more competitive rates. We expect competition to continue to increase as a result of legislative, regulatory, and technological changes, the continuing trend of consolidation in the financial services industry, and the continued emergence of alternative banking sources. Our profitability in large part depends upon our continued ability to compete successfully with traditional and new financial services providers, some of which maintain a physical presence in our market and others of which maintain only a virtual presence. Increased competition could require us to increase the rates we pay on deposits or lower the rates that we offer on loans, which could reduce our profitability.

There can be no assurance that our business and corresponding financial performance will not be adversely affected by general economic or consumer trends or events, including those affecting the financial services industry. Over the past few years, global markets have seen extensive volatility owing to a variety of factors, including high inflation, trade policies and tariffs, volatility in the capital markets, the failure of financial institutions, volatility in the housing market, interest and currency rate fluctuations, labor availability, supply chain disruptions, global pandemics and public health crises and the responses thereto, weather catastrophes and geopolitical instability, including shutdowns and threats of shutdowns of the U.S. federal government, growing geopolitical tensions and conflicts, and acts of terrorism. These events have created, and may continue to create, significant disruption of the global economy and financial and labor markets. If such conditions continue, recur or worsen, this may have a material adverse effect on the Company's business, financial condition, and results of operations. Furthermore, such economic conditions have produced downward pressure on share prices and on the availability of credit for financial institutions and corporations, while also driving up interest rates, further complicating borrowing and lending activities. If current levels of market disruption and volatility continue or increase, the Company might experience reductions in business activity, increases in funding costs, decreases in asset values, additional write-downs and impairment charges, and lower profitability.