Cass Information Systems (CASS) Risk Analysis

In the ordinary course of business, the Company depends on the reliable operation of its computer operations and network connections from its clients to its systems. Any failure, interruption, or breach in security of these systems would cause Cass to be unable to process transactions for its clients, resulting in decreased revenues. The Company also relies on electronic communications and information systems to store sensitive customer data. Any failure, interruption, breach in security or loss of data, whatever the cause, could reduce client satisfaction with the Company's products and services, cause reputational harm, and harm Cass' financial results. These types of threats may derive from human error, fraud or malice on the part of external or internal parties, or may result from accidental technological failure. Further, to access the Company's products and services, Cass' customers may use computers and mobile devices that are beyond the Company's security control systems. The Company's technologies, systems, networks and software, and those of other financial institutions have been, and are likely to continue to be, the target of cybersecurity threats and attacks, which may range from uncoordinated individual attempts to sophisticated and targeted measures directed at Cass. The risk of a security breach or disruption, particularly through cyber-attack or cyber intrusion, has increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. Criminals continuously adapt their methods to circumvent existing safeguards, and emerging technologies such as artificial intelligence may further enhance their ability to perpetrate fraud. A material security problem affecting Cass could damage its reputation, deter prospects from purchasing its products and services, deter customers from using its products and services or result in liability to Cass. Cloud technologies are also critical to the operation of the Company's systems, and reliance on cloud technologies is growing. Service disruptions in cloud technologies may lead to delays in accessing, or the loss of, data that is important to the Company's businesses and may hinder customers access to products and services. Although the Company makes significant efforts to maintain the security and integrity of Cass' information systems and has implemented various measures to manage the risk of a security breach or disruption, there can be no assurance that Cass' security efforts and measures will be effective or that attempted security breaches or disruptions would not be successful or damaging. Even the most well protected information, networks, systems and facilities remain potentially vulnerable because attempted security breaches, particularly cyber-attacks and intrusions, or disruptions will occur in the future, and because the techniques used in such attempts are constantly evolving and generally are not recognized until launched against a target, and in some cases are designed not to be detected and, in fact, may not be detected. Accordingly, the Company may be unable to anticipate these techniques or to implement adequate security barriers or other preventative measures, and thus it is virtually impossible to entirely mitigate this risk. While specific "cyber" insurance coverage is maintained, which would apply in the event of various breach scenarios, the amount of coverage may not be adequate in any particular case. Furthermore, because cyber threat scenarios are inherently difficult to predict and can take many forms, some breaches may not be covered under Cass' cyber insurance coverage. A security breach or other significant disruption of Cass' information systems or those related to customers, merchants and third-party vendors, including as a result of cyber-attacks, could (i) disrupt the proper functioning of Cass' networks and systems and therefore operations and/or those of certain customers; (ii) result in the unauthorized access to, and destruction, loss, theft, misappropriation or release of confidential, sensitive or otherwise valuable information of the Company or its customers; (iii) result in a violation of applicable privacy, data breach and other laws, subjecting the Company to additional regulatory scrutiny and expose Cass to civil litigation, governmental fines and possible financial liability; (iv) require significant management attention and resources to remedy the damages that result; or (v) harm Cass' reputation or cause a decrease in the number of customers that choose to do business with the Company. The occurrence of any of the foregoing could have a material adverse effect on Cass' business, financial condition and results of operations.

The Company is subject to various legal and regulatory proceedings. It is inherently difficult to assess the outcome of these matters, and there can be no assurance that the Company will prevail in any proceeding or litigation. Any such matter could result in substantial cost and diversion of Cass' efforts, which by itself could have a material adverse effect on Cass' financial condition and operating results. Further, adverse determinations in such matters could result in actions by Cass' regulators that could materially adversely affect Cass' business, financial condition or results of operations. Please refer to Item 3, "Legal Proceedings."

In the normal course of business, Cass and its affiliates are routinely subject to examinations and challenges from federal, state, and foreign tax authorities regarding the amount of taxes due in connection with investments it has made and the businesses in which it is engaged. The challenges made by tax authorities may result in adjustments to the timing or amount of taxable income or deductions or the allocation of income among tax jurisdictions. If any such challenges are made and are not resolved in the Company's favor, they could have an adverse effect on Cass' financial condition and results of operations.

The Company operates in a very competitive environment, which is characterized by competition from a number of other vendors and financial institutions in each market in which it operates. The Company competes with large payment processors and national and regional financial institutions and also smaller auditing companies and banks in terms of products and pricing. If the Company is unable to compete effectively in products and pricing in its markets, business could decline.

Cass' future operating results depend substantially upon the continued service of Cass' executive officers and key personnel. Cass' future operating results also depend in significant part upon Cass' ability to attract and retain qualified management, financial, technical (including with AI experience), marketing, sales, and support personnel. Competition for qualified personnel is intense, and the Company cannot ensure success in attracting or retaining qualified personnel. There may be only a limited number of persons with the requisite skills to serve in these positions, and it may be increasingly difficult for the Company to hire personnel over time. Cass' business, financial condition and results of operations could be materially adversely affected by the loss of any of its key employees, by the failure of any key employee to perform in his or her current position, or by Cass' inability to attract and retain skilled employees.

The Company's success depends, to a certain extent, upon local, national and global economic and political conditions, as well as governmental monetary policies. A favorable business environment is generally characterized by, among other factors, economic growth, efficient capital markets, low inflation, low unemployment, high business and investor confidence, and strong business earnings. Unfavorable or uncertain economic and market conditions can be caused by a decline in economic growth both in the U.S. and internationally; declines in business activity or investor or business confidence; limitations on the availability of or increases in the cost of credit and capital; increases in inflation or interest rates; high unemployment; oil price volatility; natural disasters; trade policies and tariffs; or a combination of these or other factors. In addition, financial markets and global supply chains may be adversely affected by the current or anticipated impact of global wars/military conflicts, terrorism or other geopolitical events. Current economic conditions are being heavily impacted by recent inflationary conditions and higher interest rates, the effects of which may impact the Company's profitability by negatively impacting its fixed costs and expenses. Economic and inflationary pressure on consumers and uncertainty regarding economic improvement could result in changes in consumer and business spending, borrowing and savings habits. Such conditions could have a material adverse effect on the credit quality of the Company's loans and its business, financial condition and results of operations. Federal budget deficit concerns and the potential for political conflict over legislation to fund U.S. government operations and raise the U.S. government's debt limit may increase the possibility of a default by the U.S. government on its debt obligations, related credit-rating downgrades, or an economic recession in the United States. Many of the Company's investment securities are issued by the U.S. government and government agencies and sponsored entities. As a result of uncertain domestic political conditions, including potential future federal government shutdowns, the possibility of the federal government defaulting on its obligations for a period of time due to debt ceiling limitations or other unresolved political issues, investments in financial instruments issued or guaranteed by the federal government pose liquidity risks. Most recently, in connection with successive failures by the U.S. government to reverse the trend of large annual fiscal deficits and growing interest costs, Moody's lowered its long-term issuer credit rating on the U.S. from Aaa to Aa1. A further downgrade, or downgrades by other rating agencies, as well as sovereign debt issues facing the governments of other countries, could have a material adverse impact on financial markets and economic conditions in the U.S. and worldwide.