First Merchants (FRME) Risk Analysis

The tax laws applicable to our business activities, including the laws of the United States and the State governments where the Corporation has tax nexus, are subject to interpretation and may change over time. From time to time, legislative initiatives, such as corporate tax rate changes, which may impact our effective tax rate and could adversely affect our deferred tax assets or our tax positions or liabilities, may be enacted. The taxing authorities in the jurisdictions in which we operate may challenge our tax positions, which could increase our effective tax rate and harm our financial position and results of operations. In addition, our future income taxes could be adversely affected by earnings being higher than anticipated in jurisdictions that have higher statutory tax rates or by changes in tax laws, regulations or accounting principles. We are subject to audit and review by U.S. federal and state tax authorities. Any adverse outcome of such a review or audit could have a negative effect on our financial position and results of operations. In addition, the determination of our provision for income taxes and other liabilities requires significant judgment by management. Although we believe that our estimates are reasonable, the ultimate tax outcome may differ from the amounts recorded in our financial statements and could have a material adverse effect on our financial results in the period or periods for which such determination is made.

The Corporation's business activities and earnings are affected by general business conditions in the United States and abroad. These conditions include short-term and long-term interest rates, inflation, monetary supply, fluctuations in both debt and equity capital markets, and the strength of the United States economy and the state and local economies in which the Corporation operates. The Corporation's offices are primarily located in Indiana, Ohio and Michigan. Worsening economic conditions in our market areas could negatively impact the financial condition, results of operations and stock price of the Corporation. For example, a prolonged economic downturn, increases in unemployment, or other events that affect household and/or corporate incomes could result in deterioration of credit quality, an increase in the allowances for credit losses, or reduced demand for loan or fee-based products and services. Changes in the financial performance and condition of the Corporation's borrowers could negatively affect repayment of those borrowers' loans. In addition, changes in securities market conditions and monetary fluctuations could adversely affect the availability and terms of funding necessary to meet the Corporation's liquidity needs.

The increased use of, and dependence on, information management systems in order to engage with customers and conduct business necessarily creates cyber risk. Despite the significant resources and security measures used by the Corporation, the incentives for threat actors to obtain financial payment information and customer non-public information, or to conduct ransomware will continue to exist. Cyber breach statistics over the past several years evidence the targeting of numerous banking institutions and credit bureaus. Phishing attempts have also significantly increased and political conflict also presents cyber threats by nation states. Operational risk is inherent in the Corporation's activities and can present itself in numerous ways, including internal or external fraud, business disruptions or failures, noncompliance with applicable laws and regulations, cyber breach, or failure of third parties, among other events. The result of these could be reputational harm, financial losses, or litigation and regulatory fines for the Bank. The Corporation operates in a fashion that allows operational risk to be in line with its risk appetite. To govern, monitor and control operational risk, the Corporation maintains an Enterprise Risk Management ("ERM") Program, which sets thresholds for risk appetite by key risk areas, such as strategic risk and operational risk. These thresholds are monitored by the Compliance and Internal Audit Departments and key metrics are reported to management and Board committees. Use of third-party software and services also exposes the Corporation to cybersecurity risk as numerous service providers host critical data or have direct contact with our bank customers. Although the Corporation adheres to industry standard practices in conducting thorough due diligence of vendors and contract management, should a vendor experience a breach, similar to the MOVEit breach in 2023 which impacted a vendor utilized by the Bank, the Bank could still suffer reputational harm, and potentially financial losses. Expanded use of cloud-based technologies and providing our customers more internet-based product offerings to continue to remain competitive will serve to increase these potential risks. The Corporation's third-party management program helps to mitigate risks posed by reliance on third and fourth parties. To combat these ever-present cyber risks, the Corporation maintains a comprehensive Information Security Program, which includes annual risk assessments, an Incident Response Plan, and a layered control environment meant to detect, prevent, and limit unauthorized or harmful actions across our information technology environment. Standards over information security are Board-approved and various types of control testing is conducted throughout the year, both by internal parties and external ones. Findings are actioned on throughout the year and reported to various committees. The Corporation has adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework for the management and development of cyber-security controls and is an active participant in the financial sector information sharing organization structure, known as the Financial Services Information Sharing and Analysis Center. Each year the Information Security Department conducts a cyber incident tabletop exercise for the bank's incident response teams. The bank's executive management team participates in the exercise every two years. The purpose of these tabletops is to simulate a cyber event and work through the event using our Incident Response Plan. This allows our incident response team to become familiar with the logistics of the plan, as well as provide feedback to improve the process and plan. External subject matter experts, such as Bank legal counsel, forensic advisors, marketing agency and insurance broker participate in these exercises. Management has established an Information Security Committee in order to assist executive management and the Board of Directors of the Bank in fulfilling their oversight responsibilities related to information security. The Committee reports its activities, key conclusions and recommendations to the Enterprise Risk Management Committee and the Board's Risk and Credit Policy Committee of the Board on a quarterly basis. At the Information Security Committee, security-related policies and standards are reviewed and approved, annual risk assessment results and action plans are noted, annual penetration test reports shared, current security incidents discussed, and relevant cyber risks and trends are presented. The Corporation's Board of Directors has delegated primary responsibility for oversight of cybersecurity risk to its Risk and Credit Policy Committee, with its Audit Committee also considering cyber risk as part of financial oversight. The Information Security Department provides an annual update to the Risk and Credit Policy Committee of the Board on the state of the Information Security Program. This cybersecurity "deep dive" includes review of key security incidents and review of the Information Security Policy, Information Security Program, the Incident Response Plan, and the Acceptable Use Policy. The Board is then presented with the update by the Chair of the Risk and Credit Policy Committee. The Board considers cybersecurity risks in business strategy by getting updates on the Bank's cybersecurity risk assessment. It assesses the experience of management personnel responsible for preventing, mitigating, detecting and remediating any cyber incidents, including the Chief Information Security Officer. In 2022, the Board appointed Jason Sondhi to its Board of Directors. Mr. Sondhi is the Board's cybersecurity expert. Mr. Sondhi has experience managing companies who provide endpoint detection and incident response, vulnerability scans, security information and event management, security employee training and vCISO services.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services. The effective use of technology increases efficiency and enables the financial institutions to better serve customers to reduce costs. The Corporation's future success depends, in part, upon its ability to address customer needs by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in the Corporation's operations. The Corporation may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to its customers. Failure to successfully keep pace with technological changes affecting the financial services industry could negatively affect the Corporation's growth, revenue and profit. In addition, the Corporation relies upon the expertise and support of third-party service providers to help implement, maintain and/or service certain of its core technology solutions. If the Corporation cannot effectively manage these service providers, the service parties fail to materially perform, or the Corporation was to falter in any of the other noted areas, its business or performance could be negatively impacted.

The Corporation operates in a highly competitive industry that could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. The Corporation competes with other banks, savings and loan associations, mutual savings banks, finance companies, mortgage banking companies, credit unions and investment companies. In addition, technology has lowered barriers to entry and made it possible for non-bank, financial technology companies to offer products and services traditionally provided by banks. Many of the Corporation's competitors have fewer regulatory constraints, greater resources and lower cost structures allowing them to aggressively price their products. Such competitive pressures make it more difficult for the Corporation to attract and retain customers across its business lines. Also, the demands of adapting to industry changes in technology and systems, on which the Corporation and financial services industry are highly dependent, could present operational issues and require capital spending. Additionally, our success depends, in large part, on our ability to attract and retain key people. Competition for the best people in many activities for which the Corporation is engaged is intense and we may not be able to hire people and retain them. The unexpected loss of services of key personnel could have a material adverse impact on our business, financial condition and results of operations because of their customer relationships, skills, knowledge of our markets, years of industry experience and the difficulty of promptly finding qualified replacement personnel. In addition, the scope and content of U.S. banking regulators' policies on incentive compensation, as well as changes to these policies, could adversely affect our ability to hire, retain and motivate our key employees.

Reputation risk, or the risk to the Corporation's earnings and capital from negative publicity, is inherent in the Corporation's business. Negative publicity can result from the Corporation's actual or alleged conduct in any number of activities, including lending practices, corporate governance and acquisitions, and actions taken by government regulators and community organizations in response to those activities. Negative publicity can adversely affect the Corporation's ability to keep and attract customers and can expose the Corporation to litigation and regulatory action. Although the Corporation takes steps to minimize reputation risk in dealing with customers and other constituencies, the Corporation is inherently exposed to this risk.

Since the Deposit Insurance Fund is funded by premiums and assessments paid by insured banks, our FDIC insurance premium could increase in future years depending upon the FDIC's actual loss experience, changes in the Bank's financial condition or capital strength, and future conditions in the banking industry. See the "Deposit Insurance" section of "REGULATION AND SUPERVISION OF FIRST MERCHANTS CORPORATION AND SUBSIDIARIES" in Item 1: Business of this Annual Report on Form 10-K for additional information.