Financial Institutions (FISI) Risk Analysis

We have been, and may in the future be, subject to various legal and regulatory proceedings, including class action litigation. It is inherently difficult to assess the outcome of these matters, and there can be no assurance that we will prevail in any proceeding or litigation. Legal and regulatory matters of any degree of significance could result in substantial cost and diversion of our efforts, which by itself could have a material adverse effect on our financial condition and operating results. We establish reserves for legal claims when payments associated with the claims become probable and the costs can be reasonably estimated. We may still incur legal costs for a matter even if we have not established a reserve. In addition, due to the inherent subjectivity of the assessments and unpredictability of the outcome of legal proceedings, the actual cost of resolving a legal claim may be substantially higher than any amounts reserved for that matter. The ultimate resolution of a pending legal proceeding, depending on the remedy sought and granted, could adversely affect our results of operations and financial condition. For more information with respect to our legal proceedings, please refer to Note 12, Commitments and Contingencies, of the notes to the consolidated financial statements included in Part II, Item 8, of this Annual Report on Form 10-K.

Our tax strategies are dependent upon our ability to generate taxable income in future periods. Our tax strategies will be less effective in the event we fail to generate taxable income. Our deferred tax assets are subject to an evaluation of whether it is more likely than not that they will be realized for financial statement purposes. In making this determination, we consider all positive and negative evidence available including the impact of recent operating results, reversals of existing taxable temporary differences, tax planning strategies and projected earnings within the statutory tax loss carryover period. If we were to conclude that a significant portion of our deferred tax assets were not more likely than not to be realized, the required valuation allowance could adversely affect our financial position, results of operations and regulatory capital ratios. In addition, the value of our deferred tax assets could be adversely affected by a change in statutory rates.

Third-party vendors provide key components of our business infrastructure, such as infrastructure service delivery, application delivery, and a growing volume of managed service functions. While we select these third-party vendors carefully, we relinquish many aspects of control and rely on oversight processes to minimize risk. Issues induced by these third parties, including a service disruption or poor service performance, could adversely affect our ability to deliver products and services to our customers or otherwise conduct our business efficiently, effectively, and in accordance with the expectations of our customers and regulators. Replacing these third-party providers could also entail significant time and expense, further emphasizing the need for stringent vendor due diligence processes. Each year, more third-party service providers perform significant operational services on our behalf. These third-party vendors are subject to similar risks as us relating to cybersecurity, technology infrastructure, processes and talent. One or more of our vendors may experience a cybersecurity event or operational disruption and, if any such event does occur, it may not be adequately addressed, either operationally or financially, by the third-party vendor causing direct impact to our business. And, with the increased volume of cloud computing, our business could be directly impacted if similar disruptions are experienced by fourth-party vendors, which has been a growing trend in recent years. Some of our vendors may have limited indemnification obligations or may not have the financial capacity to satisfy their indemnification obligations. Financial or operational difficulties of a vendor could also impair our operations if those difficulties interfere with the vendor's ability to serve us. If a critical vendor is unable to meet our needs in a timely manner or if the services or products provided by such a vendor are terminated or otherwise delayed and if we are not able to develop alternative sources for these services and products quickly and cost-effectively, it could have a material adverse effect on our business. Due to significant levels of dependency, critical services may require redundant service providers to reduce vendor risk, although this inherently increases financial risk a third-party risk with the redundant vendor and cost.

Our financial performance generally, and in particular the ability of borrowers to pay interest on and repay principal of outstanding loans and the value of collateral securing those loans, as well as demand for loans and other products and services we offer, is highly dependent on the business environment in the markets where we operate, in the State of New York and in the United States as a whole. Additionally, international conflict may create unfavorable or uncertain economic conditions. A favorable business environment is generally characterized by, among other factors, economic growth, efficient capital markets, low inflation, low unemployment, high business and investor confidence, and strong business earnings. Unfavorable or uncertain economic and market conditions can be caused by declines in economic growth, business activity or investor or business confidence; political instability; limitations on the availability or increases in the cost of credit and capital; increases in inflation or interest rates; tariffs and trade wars; high unemployment, natural disasters; or a combination of these or other factors. The occurrence of any of these conditions could have a material adverse effect on our financial condition and results of operations.

We must maintain sufficient cash flow and liquid assets to satisfy current and future financial obligations, including demand for loans and deposit withdrawals, funding operating costs, and for other corporate purposes, as well as meeting regulatory requirements and supervisory expectations. We rely on customer deposits to be a reasonable cost and stable source of funding for the loans we make and the operations of our business. Customer deposits, which include noninterest-bearing deposits, interest-bearing transaction accounts, savings deposits and time deposits of $250,000 or less, have historically provided us with a sizeable source of stable and low-cost funds. In addition to customer deposits, sources of liquidity include brokered deposits and borrowings from securities dealers, the FHLBNY and the FRB of New York, as well as the debt and equity capital markets. If we are unable to continue to fund assets through customer bank deposits or access funding sources on reasonable terms or if we suffer an increase in borrowing costs or otherwise fail to manage liquidity effectively, our liquidity, operating margins, financial condition and results of operations may be materially adversely affected. Reduced liquidity may arise due to circumstances that we may be unable to control, such as a general market disruption or an operational problem that affects third parties or us. Our efforts to monitor and manage liquidity risk may not be successful or sufficient to deal with dramatic or unanticipated reductions in our liquidity. In such events, our cost of funds may increase, thereby reducing our net interest income, or we may need to sell a portion of our investment and/or loan portfolio, which, depending upon market conditions, could result in us realizing a loss.

We rely heavily on communications, information technology (both on-premises and via service providers) and internet service to conduct our business. Our business depends on our ability to process and monitor a large volume of daily transactions in compliance with legal, regulatory, and internal standards and specifications. In addition, a significant portion of our operations relies heavily on the secure processing, retention, disposal, and transmission of personal and confidential information of our customers and clients. These risks have increased as our customers have adopted digital banking solutions, and we have migrated many former on-premises services and technology to hosted third-party service providers. The dependency on these services, provided on-premises or in hosted environments, are threatened daily by ever-evolving cyber criminals, system failures, natural disasters, and other uncontrollable events such as a global pandemic. Uncontrollable events test the operational resiliency of companies across the world, every year. Whether it be hurricanes, tornados, or wildfires, companies risk the loss of facilities, technical infrastructure and even the lives of irreplaceable talent, and the lack of quality business continuity and disaster recovery plans heightens the risk impact. The risk of failing to train and test these plans could challenge the ability to recover. Similarly, cyber-attacks also challenge our preparedness to respond and recover. The volume and impact of cyber-attacks continue to grow and regardless of security controls, every company is susceptible to a compromise, making the existence of an incident response plan critical. Failure to train and test the plan periodically is a critical risk to any company. Modern cyber-attacks attempt to obtain unauthorized access to directly access financial assets or indirectly benefit by accessing confidential data for future gains. Cyber-attacks may be executed in multiple stages but generally begin with social engineering attacks which pose a significant risk to employees and customers. Such security attacks can originate from a wide variety of sources, including people who are involved with organized crime or rogue attackers taking advantage of modern schemes and services that have become readily available. Those same parties initiate social engineering attacks to fraudulently induce employees, customers or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or clients. We are also subject to the risk that our employees may intercept and transmit unauthorized confidential or proprietary information. An interception, misuse or mishandling of personal, confidential or proprietary information being sent to or received from a customer or third party could result in legal liability, remediation costs, regulatory action and reputational harm, any of which could adversely affect operations and financial condition. The failure to train and periodically test for possible threats, greatly increases the risk of compromise and impact. As the threat of cyber-attacks continue to evolve, we may be required to increase the resources dedicated to minimize and respond to these risks. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our systems can itself create a risk of systems disruptions and security issues.

We face substantial competition in all areas of our operations from a variety of different competitors, many of which are larger and may have more financial resources than us. Such competitors primarily include national, regional and internet banks within the markets in which we operate. We also face competition from many other types of financial institutions, including, without limitation, savings and loan associations, credit unions, finance companies, brokerage firms, insurance companies and other financial intermediaries. The financial services industry could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. Banks, securities firms and insurance companies can merge under the umbrella of an FHC, which can offer virtually any type of financial service, including banking, securities underwriting, insurance (both agency and underwriting), and merchant banking. Technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. More recently, peer to peer lending has emerged as an alternative borrowing source for our customers and many other non-banks offer lending and payment services, such as consumer credit through buy now–pay later offerings, in competition with banks. Many of these competitors have fewer regulatory constraints and may have lower cost structures. Additionally, due to their size, many of our larger competitors may be able to achieve economies of scale and, as a result, may offer a broader range of products and services than we can at competitive prices or with low or no fees. Our ability to compete successfully depends on a number of factors, including, among other things: - the ability to develop, maintain and build upon long-term customer relationships based on top quality service, high ethical standards and safe, sound assets;- the ability to expand our market position;- the scope, relevance and pricing of products and services offered to meet customer needs and demands;- the rate at which we introduce new products and services relative to our competitors;- customer satisfaction with our level of service; and - industry and general economic trends. Failure to perform in any of these areas could significantly weaken our competitive position, which could adversely affect our growth and profitability, which, in turn, could have a material adverse effect on our financial condition and results of operations.

As a financial institution, our earnings and capital are subject to risk associated with negative public opinion. Negative public opinion could result from our actual or alleged conduct in any number of activities, including lending practices, the failure of any of our products or services to meet our clients' expectations or applicable regulatory requirements, corporate governance and acquisitions, social media and other marketing activities, the implementation of environmental, social and governance practices or actions taken by government regulators and community organizations in response to any of the foregoing. Negative public opinion could affect our ability to attract and/or retain clients, could expose us to litigation and regulatory action, and could have a material adverse effect on our stock price or result in heightened volatility. Negative public opinion could also affect our ability to borrow funds in the unsecured wholesale debt markets.