Camden National (CAC) Risk Analysis

A substantial portion of income from fiduciary services is dependent on the market value of wealth management assets under management, which are primarily marketable securities. Changes in domestic and foreign economic conditions, volatility in financial markets, and general trends in business and finance, all of which are beyond our control, could adversely impact the market value of these assets and the fee revenues derived from the management of these assets.

Acts of terrorism, war or other international hostilities, civil unrest, violence or pandemics could cause disruptions to our business or the economy as a whole, such as the disruptions experienced during the COVID-19 pandemic. Any of these events could affect us directly (for example, by interrupting our systems, causing significant damage to our facilities or otherwise preventing us from conducting our ordinary business) or indirectly as a result of effects on our borrowers and other customers or third-party vendors (for example, by damaging property pledged as collateral for our loans). The Company has suffered, and could in the future suffer, adverse consequences to the extent that pandemics, terrorist activities, civil unrest, international hostilities, or other external events affect the financial markets or the economy in general or in any region in which the Company, or third parties on which the Company relies, operate. Depending on the impact of external events on general economic and market conditions, there is a risk that adverse conditions could occur or worsen, including supply chain disruptions; higher inflation; decreased demand for our products and services or those of our borrowers, which could increase credit risk; challenges related to maintaining sufficient qualified personnel due to labor shortages, talent attrition, employee illness, or willingness to return to work; and disruptions to our business operations or those of our counterparties, vendors and other service providers. Our ability to mitigate the adverse consequences of these occurrences is in part dependent on the quality of our resiliency planning, and our ability, if any, to anticipate the nature of any such event that occurs. The adverse effects of pandemics, terrorist activities, civil unrest, international hostilities or other external events also could be increased to the extent that there is a lack of preparedness on the part of national or regional emergency responders or on the part of other organizations and businesses that we transact with, particularly those that we depend upon, but have no control over.

Our profitability depends to a large extent upon our net interest income, which is the difference between interest income earned from loans and investments and the interest expense paid on deposits and borrowings. Net interest income is our largest source of revenue and can be affected significantly by changes in market interest rates, including in the shape of the yield curve or in spreads between different market interest rates, as well as by changes related to inflation. In particular, changes in relative interest rates may reduce our net interest income as the difference between interest income and interest expense decreases. As a result, we have adopted asset and liability management policies to minimize the potential adverse effects of changes in interest rates on net interest income, primarily by altering the mix and maturity of loans, investments and funding sources. See Item 7. "Management's Discussion and Analysis-Risk Management Policies-Interest Rate Risk" for additional information regarding the Company's asset and liability management policies and practices, as well as its interest rate risk position, including assumptions used in determining such, as of December 31, 2024. There is risk that any change in interest rates could negatively affect our results of operations or financial condition. Because market interest rates may change by differing magnitudes and at different times, significant changes in interest rates over an extended period of time could reduce overall net interest income. In response to inflation, the Federal Reserve raised targeted Effective Federal Funds Rate throughout 2022 and 2023, and in 2024 began to lower interest rates. The Federal Reserve Board may continue to lower short-term interest rates during 2025 in response to economic conditions. Longer-term interest rates, while volatile, have remained elevated. Volatility in interest rates can result in customer deposits flowing away from financial institutions into direct investments, and a prolonged high-interest rate environment may cause the Bank to experience increased deposit migration. This may cause the Bank to lose some of its low-cost deposit funding or could adversely affect the Bank's operations and liquidity. Customers may also continue to move non-interest-bearing deposits into interest-bearing accounts, thereby increasing our overall deposit costs. Higher funding costs may continue to reduce our net interest margin and net interest income. Volatility in interest rates can also result in customer deposits flowing away from financial institutions into direct investments. Direct investments, such as U.S. government and corporate securities and other investment vehicles (including money market mutual funds), generally pay higher rates of return than financial institutions because of the absence of federal insurance premiums, and a prolonged high-interest rate environment may cause the Bank to experience increased deposit migration. This may cause the Bank to lose some of its low-cost deposit funding or could adversely affect the Bank's operations and liquidity. Customers may also continue to move non-interest-bearing deposits into interest-bearing accounts, thereby increasing our overall deposit costs. Higher funding costs may continue to reduce our net interest margin and net interest income.

We are subject to regulation and supervision by the FRB, and the Bank is subject to regulation and supervision by the OCC and the FDIC, as well as regulations issued by the CFPB. Federal laws and regulations govern numerous matters affecting us, including changes in the ownership or control of banks and bank holding companies, maintenance of adequate capital and the financial condition of a financial institution, permissible types, amounts and terms of extensions of credit and investments, permissible non-banking activities, the level of reserves against deposits and restrictions on dividend payments. The OCC possesses the power to issue cease and desist orders to prevent or remedy unsafe or unsound practices or violations of law by banks subject to their regulation, and the FRB possesses similar powers with respect to bank holding companies. These and other restrictions limit the manner in which we may conduct business and obtain financing. Our business is highly regulated and the laws, rules, regulations, and supervisory guidance and policies applicable to us are subject to regular modification and change, and there have been significant revisions to the laws and regulations applicable to banks and bank holding companies that have been enacted or proposed in recent years. We expect that we will remain subject to extensive regulation and supervision, and that the level of regulatory scrutiny may fluctuate over time, based on numerous factors, including changes in the U.S. presidential administration or one or both houses of Congress and public sentiment regarding financial institutions (which can be influenced by scandals and other incidents that involve participants in the industry). In particular, recent changes in national political leadership have introduced uncertainty into the direction and timing of any future regulation. Although an overall reduction in the regulation of the financial services sector could result in some operational and cost benefits, any potential new regulations or changes to existing regulations and supervisory expectations may necessitate changes to our existing regulatory compliance and risk management programs. New regulations and changes to existing regulations and supervisory expectations have increased, and may in the future increase, our costs over time. In addition, changes to statutes, regulations or regulatory policies, or their interpretation or implementation, and/or regulatory practices, requirements or expectations, could affect us in substantial and unpredictable ways. In particular, the potential effects of a number of proposed regulations on us remain uncertain due to legal challenges and the recent changes in the U.S. presidential administration and control of the U.S. Senate, which could result in changing federal or state regulatory priorities. We are unable to predict the form or nature of any future changes to statutes or regulation, including the interpretation or implementation thereof. Changes to statutes, regulations, or regulatory policies, including changes in interpretation or implementation of statutes, regulations, or policies, have and could in the future subject us to additional costs, limit the types of financial services and products we may offer, and/or increase the ability of non-banks to offer competing financial services and products, among other things. Failure to comply with laws, regulations, policies or supervisory guidance could result in enforcement and other legal actions by federal or state authorities, including criminal and civil penalties, the loss of FDIC insurance, revocation of a banking charter, other sanctions by regulatory agencies, civil money penalties, and/or reputational damage, which could have a material adverse effect on our business, financial condition, and results of operations. See Item 1., "Business-Supervision and Regulation."

The financial services industry is subject to intense scrutiny from bank supervisors in the examination process and aggressive enforcement of federal and state regulations, particularly with respect to mortgage-related practices and other consumer compliance matters, and compliance with AML, BSA and OFAC regulations, and economic sanctions against certain foreign countries and nationals. Enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices. In addition, some legal/regulatory frameworks provide for the imposition of fines or penalties for noncompliance even though the noncompliance was inadvertent or unintentional and even though there were systems and procedures designed to ensure compliance in place at the time. There have been a number of significant enforcement actions in recent years by regulators, state attorneys general and the Department of Justice against banks and other non-bank financial institutions with respect to AML and sanctions laws, and some have resulted in substantial penalties including criminal pleas. Although the Company and the Bank have adopted policies and procedures designed to comply with these laws, any failure to comply with these laws and other regulations, or to maintain an adequate compliance program, could result in significant fines, penalties, lawsuits, regulatory sanctions, reputational damage, or restrictions on our business.

In pursuing acquisition opportunities, we may be in competition with other companies having similar growth strategies, including banks, bank holding companies, mutual banks and mutual holding companies. In addition, economic conditions may impede our ability to identify or acquire acquisition candidates. In particular, current market conditions have resulted in large unrealized losses in the investment portfolios at many banking organizations. If we were to acquire such an organization, any such losses would be recognized, thereby impeding our ability to complete an acquisition on acceptable terms. Furthermore, a number of banks in our markets or neighboring markets are organized as mutual banks and may not be interested in a transaction with a counterparty that is not organized in the same manner, such as the Company. These and other economic factors or competition for these acquisitions could result in increased acquisition prices and a lack of attractive acquisition opportunities. As a result, we may not be able to identify or acquire acquisition candidates. In addition, we generally must receive federal regulatory approval before we can acquire a bank or bank holding company. Our ability to pursue or complete an attractive acquisition could be negatively affected by regulatory delay or other regulatory issues. We cannot be certain when or if, or on what terms and conditions, any required regulatory approvals will be granted. If we commit certain regulatory violations, including those that result in a downgrade in certain of our bank regulatory ratings, we may not be able to pursue future acquisitions for a period of time, or governmental authorities could preclude us from doing so even if we were otherwise able.

Information security risks for financial institutions such as the Company and the Bank are significant due to the use of online, telephone and mobile banking channels by customers and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties. Third parties with whom we or our customers do business also present operational and information security risks to us. We see an increasing trend of cyberattacks targeting providers in the financial services industry, as well as increased security breaches or failures of their own systems. Our operations rely on the secure processing, transmission and storage of confidential information in our computer systems and networks. Our businesses rely on our digital technologies, computer and email systems, software, and networks to conduct their operations. As our reliance on technology systems increases, the potential risks of technology-related interruptions in our operations or the occurrence of cyber incidents also increases. Our technologies, systems, networks and our customers' devices are periodically the target of cyberattacks, and may be the target of future cyberattacks, including through the introduction of computer viruses, and/or malicious code, or by means of phishing attacks, social engineering or other information security breaches. Malicious actors may also attempt to fraudulently induce employees, customers or other users of our systems to disclose sensitive information, including passwords and other identifying information, in order to gain access to data or our systems. In recent years, there have been several well-publicized attacks on various companies, including in the financial services industry, and personal, proprietary, and public e-mail systems in which the perpetrators gained unauthorized access to confidential information and customer data, often through the introduction of computer viruses or malware, cyberattacks, phishing, social engineering or other means. Even if not directed at the Company or the Bank specifically, attacks on other entities with whom we do business or on whom we otherwise rely or attacks on financial or other institutions important to the overall functioning of the financial system could adversely affect, directly or indirectly, aspects of our business. Information security risks continue to increase, in part because of the proliferation of new technologies, including artificial intelligence ("AI"), ongoing work-from-home arrangements, the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, activists, and other external parties, some of which may be linked to terrorist organizations or hostile foreign governments. We have expended substantial resources to protect our systems and, as cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our systems or to investigate and remediate vulnerabilities. System enhancements and updates may also create risks associated with implementing and integrating new systems. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our systems can itself create a risk of systems disruptions and security issues. Failure to properly utilize system enhancements that are implemented in the future could result in impairment charges and could result in significant costs to remediate or replace the defective components. In addition, we may incur significant training, licensing, maintenance, consulting and amortization expenses during and after systems implementations, and any such costs may continue for an extended period of time. We may not be able to anticipate, detect, or implement effective preventative measures against all potential threats, particularly because the techniques used by cyber criminals change frequently, often are not recognized until launched and can be initiated from a variety of sources. In addition, a cybersecurity breach or cyberattack could persist for an extended period before being detected, which could exacerbate the harmful effects of a successful cyberattack. If one or more of the events described above occurs, this could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of our or our customers' confidential, proprietary and other information, the theft of customer assets through fraudulent transactions or disruption of our or our customers' or other third parties' business operations, which could result in legal or regulatory action, significant losses, increased compliance costs or reputational damage, any of which could adversely affect our business, financial condition or results of operations. Because the investigation of any information security breach is inherently unpredictable and would require substantial time to complete, the Company may not be able to quickly remediate the consequences of any breach, which may increase the costs, and enhance the negative consequences associated with a breach. In addition, to the extent the Company's insurance covers aspects of any breach, such insurance may not be sufficient to cover all of the Company's losses. As cybersecurity and data privacy risks for banking organizations and other financial institutions have significantly increased in recent years, cybersecurity and data privacy issues have become the subject of increasing legislative and regulatory focus. We could be adversely affected if new legislation or regulations are adopted or if existing legislation or regulations are modified such that we are required to alter our systems or are required to change our business practices or privacy policies. If cybersecurity, data privacy, data protection, data transfer or data retention laws are implemented, interpreted or applied in a manner inconsistent with our current practices, we may be subject to fines, litigation or regulatory enforcement actions or ordered to change our business practices, policies or systems in a manner that adversely affects our results of operations.