First Bancorp Puerto Rico (FBP) Risk Analysis

We are subject to regulatory capital adequacy guidelines, and, if we fail to meet these guidelines, our business and financial

constraints, and increased regulatory requirements and costs. The closure and placement into receivership with the FDIC of certain large U.S. regional banks with assets over $100 billion in March and May 2023, and adverse developments affecting other banks, resulted in heightened levels of market volatility and consequently negatively impacted customer confidence in the safety and soundness of financial institutions. These developments resulted in certain regional banks experiencing higher than normal deposit outflows and an elevated level of competition for available deposits in the market. The impact of market volatility from adverse developments in the banking industry such as this one are highly uncertain and difficult to predict. In the aftermath of these bank failures, the banking agencies have increased regulatory requirements and costs that may impact capital ratios or the FDIC deposit insurance premium. For example, in 2023, the FDIC issued a final rule to impose a special assessment to recover certain estimated losses to the Deposit Insurance Fund ("DIF") arising from the closures of Silicon Valley Bank and Signature Bank. The estimated losses will be recovered through quarterly special assessments collected from certain insured depository institutions, including the Bank, and collection began during the quarter ended June 30, 2024. As of December 31, 2025, the Corporation's total estimated FDIC special assessment amounted to $6.3 million, of which $5.5 million has been paid. The Corporation continues to monitor the FDIC's estimated loss to the DIF, which could affect the amount of its accrued liability.

We are subject to certain regulatory restrictions that may adversely affect our operations. We are subject to supervision and regulation by the Federal Reserve Board and the FDIC. We are a bank holding company and a financial holding company under the Bank Holding Company Act of 1956, as amended. The Bank is also subject to supervision and regulation by OCIF. Under federal law, financial holding companies are permitted to engage in a broader range of "financial" activities than those permitted to bank holding companies that are not financial holding companies. A financial holding company that ceases to meet certain standards is subject to a variety of restrictions, depending on the circumstances, including the prohibition from undertaking new activities or acquiring shares or control of other companies. If we fail to comply with the requirements from our regulators, we may become subject to regulatory enforcement action and other adverse regulatory actions that might have a material and adverse effect on our operations. The FDIC insures deposits at FDIC-insured depository institutions up to certain limits (currently, $250,000 per depositor at same depository institution). The FDIC charges insured depository institutions premiums to maintain the DIF. In the event of a bank failure,the FDIC takes control of a failed bank and, if necessary, pays all insured deposits up to the statutory deposit insurance limits using the resources of the DIF. The FDIC is required by law to maintain adequate funding of the DIF, and the FDIC may increase premium assessments to maintain such funding. The Dodd-Frank Wall Street Reform and Consumer Protection Act (the "Dodd-Frank Act")requires the FDIC to increase the DIF's reserves against future losses, which will require institutions with assets greater than $10 billion, such as FirstBank, to bear an increased responsibility for funding the prescribed reserve to support the DIF. The FDIC may further increase FirstBank's premiums or impose additional assessments or prepayment requirements in the future. The Dodd-Frank Act removed the statutory cap for the reserve ratio, leaving the FDIC free to set this cap going forward.

State, federal, and foreign governments are increasingly enacting laws and regulations governing the collection, use, retention,sharing, transfer, and security of personally identifiable information and data. A variety of federal, state, local, and foreign laws and regulations, orders, rules, codes, regulatory guidance, and certain industry standards regarding privacy, data protection, consumer protection, information security, and the processing of personal information and other data apply to our business. State laws are changing rapidly, and new legislation proposed or enacted in a number of other states imposes, or has the potential to impose,additional obligations on companies that process confidential, sensitive and personal information, and will continue to shape the data privacy environment nationally. The U.S. federal government is also focused on privacy matters. Any failure by us or our business partners to comply with applicable laws, rules, and regulations could result in investigations or actions against us by governmental entities, private claims and litigation, fines, penalties or other liabilities. Such outcomes could increase our expenses, expose us to liabilities, and harm our reputation, and have a material adverse effect on our business. While we aim to comply with applicable data protection laws and obligations in all material respects, there is no assurance that we will not be subject to claims that we have violated such laws and obligations, will be able to successfully defend against such claims, or will not be subject to significant fines and penalties in the event of non-compliance. Additionally, to the extent multiple state-level laws are introduced in the U.S. with inconsistent or conflicting standards and there is no federal law to preempt such laws, compliance with such laws could be difficult and costly, or impossible, to achieve, and we could be subject to fines and penalties in the event of non -compliance. In addition, the U.S. regulatory environment for financial services remains subject to change. Legislative, regulatory, or administrative actions may result in amendments to existing banking and consumer protection laws, modifications to prior rulemaking or guidance, or changes to the structure, authority, or enforcement priorities of federal regulatory agencies. The scope, timing, and impact of any such changes are uncertain.

statutes and regulations. The Bank Secrecy Act, the USA PATRIOT Act, and related regulations require us to maintain an effective anti-money laundering program and file suspicious activity and currency transaction reports as appropriate, among other duties. Enforcement agencies,including the Financial Crimes Enforcement Network, federal banking regulators, and the U.S. Department of Justice, have significantly increased coordination and enforcement activity in this area. We are also subject to increased scrutiny of compliance with economic and trade sanctions administered by OFAC. If our AML, sanctions, or related compliance programs are deemed inadequate,we could be subject to liability, including fines and regulatory actions, which may include restrictions on our ability to pay dividends and the necessity to obtain regulatory approvals to proceed with certain aspects of our business plan, including our acquisition plans. Any such outcome could materially and adversely affect our business, financial condition, and results of operations.

We face a risk of noncompliance and enforcement action related to the Bank Secrecy Act and other anti-money laundering

laws, and failure to comply with these laws could lead to a wide variety of sanctions. The Community Reinvestment Act, the Equal Credit Opportunity Act, the Fair Housing Act, and other fair lending laws and regulations impose nondiscriminatory lending requirements on financial institutions. These laws are enforced by the U.S. Department of Justice and other federal agencies A successful regulatory challenge related to our compliance with these requirements could result in a wide variety of sanctions, including damages and civil money penalties, injunctive relief, and restrictions on mergers and acquisitions, expansion, or entry into new business lines. Private parties may also have the ability to challenge an institution's performance under fair lending laws in private class action litigation. Such actions could have a material adverse effect on our business, financial condition, and results of operations.

We are subject to numerous laws designed to protect consumers, including the Community Reinvestment Act and fair lending

tax obligations, and effective tax rate. Significant judgment is required in determining the Corporation's effective tax rate and in evaluating its tax positions. The Corporation provides for uncertain tax positions when such tax positions do not meet the recognition thresholds or measurement criteria prescribed by applicable generally accepted accounting principles in the United States ("GAAP"). Fluctuations in federal, state, local, and foreign taxes or a change to uncertain tax positions, including related interest and penalties,may impact the Corporation's effective tax rate. When particular tax matters arise, a number of years may elapse before such matters are audited and finally resolved. In addition, the Puerto Rico Department of Treasury ("PRTD"), the U.S. Internal Revenue Service ("IRS"), and the tax authorities in the jurisdictions in which we operate may challenge our tax positions and we may estimate and provide for potential liabilities that may arise out of tax audits to the extent that uncertain tax positions fail to meet the recognition standard under applicable GAAP. Unfavorable resolution of any tax matter could increase the effective tax rate and could result in a material increase in our tax expense. Resolution of a tax issue may require the use of cash in the year of resolution. First BanCorp. is subject to Puerto Rico income tax on its income from all sources. FirstBank is treated as a foreign corporation for U.S. and USVI income tax purposes and is generally subject to U.S. and USVI income tax only on its income from sources within the U.S. and USVI or income effectively connected with the conduct of a trade or business in those jurisdictions. The USVI jurisdiction imposes income taxes based on the U.S. Internal Revenue Code under the "mirror system" established by the Naval Service Appropriations Act of 1922. However, the USVI jurisdiction also imposes an additional 10% surtax on the USVI tax liability, if any. These tax laws are complex and subject to different interpretations. We must make judgments and interpretations about the application of these inherently complex tax laws when determining our provision for income taxes, our deferred tax assets and liabilities, and our valuation allowance. In addition, legislative changes, particularly changes in tax laws, could adversely impact our results of operations. Changes in applicable tax laws in Puerto Rico, the U.S., or other jurisdictions or tax authorities' new interpretations could result in increases in our overall taxes and the Corporation's financial condition or results of operations may be adversely impacted.

Corporation's earnings and cash flow, and changes in the tax laws of multiple jurisdictions can materially affect our operations,

The Corporation's judgments regarding tax accounting policies and the resolution of potential tax disputes may impact the

The Corporation is subject to stringent and changing privacy laws, regulations, and standards as well as policies, contracts, and

government or the PROMESA oversight board to address the ongoing fiscal and economic challenges in Puerto Rico. A significant portion of our business activities and credit exposure is concentrated in Puerto Rico, which has faced prolonged economic and fiscal challenges. Although the Puerto Rico Planning Board ("PRPB") reported in its preliminary estimates that real gross national product ("GNP") grew 0.4% in fiscal year 2025, marking the fifth consecutive year of positive economic growth, future economic prospects remain uncertain. However, according to the PROMESA oversight board, the fiscal year 2026 budget prepares the Puerto Rico government for potential further declines in federal funding over the fiscal year that began on July 1, 2025. As of December 31, 2025, the Corporation had $297.8 million of direct exposure to the Puerto Rico government, its municipalities and public corporations. As of December 31, 2025, approximately $211.3 million of the exposure consisted of loans and obligations of municipalities in Puerto Rico that are supported by assigned property tax revenues and for which, in most cases, the good faith, credit and unlimited taxing power of the applicable municipality have been pledged to their repayment, and $42.2 million consisted of loans and obligations which are supported by one or more specific sources of municipal revenues. The municipalities are required by law to levy special property taxes in such amounts as are required for the payment of all of their respective general obligation bonds and notes. In addition to municipalities, the total direct exposure also included $8.7 million in a loan extended to an affiliate of PREPA,$32.9 million in loans to a public corporation of the Puerto Rico government, and an obligation of the Puerto Rico government,specifically a residential pass-through MBS issued by the PR Housing Finance Authority ("PRHFA"), at an amortized cost of $2.7 million as part of its available-for-sale debt securities portfolio (fair value of $1.6 million as of December 31, 2025). Also, as of December 31, 2025, the outstanding balance of construction loans funded through conduit financing structures to support the federal programs of Low-Income Housing Tax Credit ("LIHTC") combined with Community Development Block Grant- Disaster Recovery ("CDBG-DR") funding amounted to $92.4 million. The main objective of these programs is to spur development in new or rehabilitated and affordable rental housing. PRHFA, as program subrecipient and conduct issuer, issues tax-exempt obligations which are acquired by private financial institutions and are required to co-underwrite with PRHFA a mirror construction loan agreement for the specific project loan to which the Corporation will serve as ultimate lender, but where the PRHFA will be the lender of record. In addition, as of December 31, 2025, the Corporation had $67.1 million in exposure to residential mortgage loans guaranteed by the PRHFA. The Corporation operates in various jurisdictions highly dependent on federal funding programs. On January 27, 2025, the Office of Management and Budget ("OMB") issued Memorandum M-25-13 entitled "Temporary Pause of Agency Grant, Loan, and Other Financial Assistance Programs." The Memo directed every federal agency to "temporarily pause all activities related to obligation or disbursement of all federal financial assistance, and other relevant agency activities that may be implicated by executive orders,including, but not limited to, financial assistance for foreign aid, nongovernmental organizations, DEI, woke gender ideology, and the green new deal." Lawsuits challenging the pause were immediately filed and on January 28, 2025, the U.S. District Court for the District of Columbia enjoined the Trump administration from implementing OMB Memorandum M-25-13 for disbursements under open awards. On January 29, 2025, OMB rescinded the Memo, however, the administration has continued to pursue agency-by-agency reviews of federal financial assistance programs and to implement targeted funding pauses, terminations, or additional compliance requirements consistent with its policy priorities, subject to applicable legal constraints. It remains uncertain whether the administration will issue new directives, executive orders, or guidance affecting federal grants, loans, or other financial assistance in the future, or how courts may rule on ongoing or future challenges; however, any such action by the administration or ruling by the courts that limit such grants or financial assistance could have a negative effect on our business. Instability in economic conditions, delays in the receipt of disaster relief funds allocated to Puerto Rico or any temporary or permanent pause on any federal funds, and the potential impact on asset values resulting from past or future natural disaster events,when added to Puerto Rico's ongoing fiscal challenges, could materially adversely affect our business, financial condition, liquidity,results of operations and capital position.

may be, adversely affected by Puerto Rico's economic condition, and may be affected by actions taken by the Puerto Rico

Climate change, and efforts to mitigate its long-term effects, may materially adversely affect the Corporation's business and

Natural disasters, whose nature and severity may be impacted by climate change, such as hurricanes, floods, extreme cold events and other adverse weather conditions; public health crises; political crises, such as terrorist attacks, war, labor unrest, other political instability, trade policies, tariffs and sanctions, including the ongoing conflict in Ukraine, the conflict in the Middle East, recent conflicts in South America, and the possible expansion of such conflicts in surrounding areas and potential geopolitical consequences;negative global climate patterns, especially in water stressed regions; or other catastrophic events, such as fires or other disasters occurring at our locations, whether occurring in Puerto Rico, the U.S., or internationally, could cause a significant adverse effect on the economy and disrupt our operations. Certain areas in which our business is concentrated, including Puerto Rico and the USVI, are particularly susceptible to earthquakes, hurricanes, and major storms. Further, climate change may increase both the frequency and severity of extreme weather conditions and natural disasters, which may affect our business operations, either in a particular region or globally, as well as the activities of our customers. The Corporation is also not able to predict the positive or negative effects that future events or changes to the U.S. or global economy, financial markets, or regulatory and business environment could have on our operations.

Our results of operations could be adversely affected by natural disasters, public health crises, political crises, negative global

operational risks could adversely affect our consolidated results of operations. We may fail to identify and manage risks related to a variety of aspects of our business, including, but not limited to, liquidity risk;interest rate risk; market risk; credit risk; operational risk; legal, regulatory and compliance risk; reputational risk; model risk; capital risk; strategic risk; and information technology and cybersecurity risk. We have adopted and periodically improve various controls,procedures, policies and systems to monitor and manage risk. Any improvements to our controls, procedures, policies and systems,however, may not be adequate to identify and manage the risks in our various businesses. If our risk framework is ineffective, either because it fails to keep pace with changes in the financial markets or our businesses or for other reasons, we could incur losses, suffer reputational damage, or find ourselves out of compliance with applicable regulatory mandates or expectations. We may also be subject to disruptions from external events, such as natural disasters and cyber-attacks, which could cause delays or disruptions to operational functions, including information processing and financial market settlement functions. In addition, our customers, vendors and counterparties could suffer from such events. Should these events affect us, or the customers, vendors or counterparties with which we conduct business, our consolidated results of operations could be negatively affected. When we record balance sheet reserves for probable loss contingencies related to operational losses, we may be unable to accurately estimate our potential exposure, and any reserves we establish to cover operational losses may not be sufficient to cover our actual financial exposure, which may have a material impact on our consolidated results of operations or financial condition for the periods in which we recognize the losses.

security systems and infrastructure, and present significant reputational, legal and regulatory costs. Our business is highly dependent on the security, reliability, and effectiveness of our technology infrastructure and data management systems, as well as those of our customers, vendors, and other third parties. Employees, customers, and other third parties increasingly access our systems and services through personal or external devices and networks that are outside our direct control and subject to their own cybersecurity risks. Our business relies on effective access controls and the secure collection,processing, transmission, storage and retrieval of confidential, proprietary, personal and other information across our systems and those of third parties. Cybersecurity risks facing financial institutions have increased significantly due to the growing sophistication and frequency of cyber threats, as well as our continued expansion of digital and online services. These risks may arise from deliberate attacks,misconduct, human error, or system failures. Cyber incidents, such as malware infections, phishing attacks, denial-of-service attacks,ransomware, or other security breaches, could result in unauthorized access to or loss, misuse, or destruction of sensitive information,damages to systems, disruption of operations, or impairment of customer access to our services. While we maintain a CISP that continuously monitors cyber-related risks and ultimately ensures protection for the processing,transmission, and storage of confidential, proprietary, and other information in our computer systems and networks, as well as a Vendor Management Program to oversee third party and vendor risks, there is no guarantee that we will not be exposed to or be affected by a cybersecurity incident. Cyber threats are rapidly changing, and future attacks or breaches could lead to other security breaches of the networks, systems, or devices that our customers use to access our integrated products and services, which, in turn, could result in unauthorized disclosure,release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary, and other information (including account data information) or data security compromises. As cyber threats continue to evolve, we may be required to expend significant additional resources to modify or enhance our protective measures, investigate, and remediate any information security vulnerabilities or incidents and develop our capabilities to respond and recover. The scope and impact of a particular cyberattack may not be immediately clear, which could delay remediation efforts and limit our ability to provide complete and accurate information to customers, third-party vendors, regulators, and the public. A successful penetration or circumvention of our system security, or the systems of our customers, suppliers, and other third parties,could cause us serious negative consequences, including significant operational, reputational, legal, and regulatory costs and concerns. Any of these adverse consequences could adversely impact our results of operations, liquidity, and financial condition. In addition, our insurance policies may be insufficient to cover all losses associated with a significant cybersecurity incident, may become more costly,or may be unavailable on economically reasonable terms in the future or at all Any of these results could harm our growth prospects,financial condition, business, and reputation.