Hanover Bancorp Inc (HNVR) Risk Analysis

We have been and may in the future become involved in legal and regulatory proceedings. We consider most of our historical proceedings to be in the normal course of our business or typical for the industry; however, it is difficult to assess the outcome of these matters, and we may not prevail in any current or future proceedings or litigation. There could be substantial costs and management diversion in such litigation and proceedings, and any adverse determination could have a materially adverse effect on our business, brand or reputation, or our financial condition and results of our operations.

We operate in an environment that imposes income taxes on our operations at both the federal and state levels to varying degrees and we try to minimize the impact of these taxes. Any change in tax laws or regulations, or new interpretation of an existing law or regulation, could significantly alter the tax impact on our financial results.

In the course of our business, we may foreclose on and take title to real estate or otherwise be deemed to be in control of property that serves as collateral on loans we make. As a result, we could be subject to environmental liabilities with respect to those properties. We may be held liable to a governmental entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination, or we may be required to investigate or clean up hazardous or toxic substances or chemical releases at a property. The costs associated with investigation or remediation activities could be substantial. In addition, if we are the owner or former owner of a contaminated site, we may be subject to common law claims by third parties based on damages and costs resulting from environmental contamination emanating from the property. The cost of removal or abatement may substantially exceed the value of the affected properties or the loans secured by those properties, we may not have adequate remedies against the prior owners or other responsible parties and we may not be able to resell the affected properties either before or after completion of any such removal or abatement procedures. If material environmental problems are discovered before foreclosure, we generally will not foreclose on the related collateral or will transfer ownership of the loan to a subsidiary. It should be noted, however, that the transfer of the property or loans to a subsidiary may not protect us from environmental liability. Furthermore, despite these actions on our part, the value of the property as collateral will generally be substantially reduced or we may elect not to foreclose on the property and, as a result, we may suffer a loss upon collection of the loan. Any significant environmental liabilities could have an adverse effect on our business, financial condition and results of operations.

We rely on the ability of our employees and systems to process a high number of transactions. Operational risk is the risk of loss resulting from our operations, including but not limited to, the risk of fraud by employees or persons outside our company, the execution of unauthorized transactions by employees, errors relating to transaction processing and technology, breaches of our internal control systems and compliance requirements. Insurance coverage may not be available for such losses, or where available, such losses may exceed insurance limits. This risk of loss also includes the potential legal actions that could arise as a result of operational deficiencies or as a result of non-compliance with applicable regulatory standards, adverse business decisions or their implementation, or customer attrition due to potential negative publicity. In the event of a breakdown in our internal control systems, improper operation of systems or improper employee actions, we could suffer financial loss, face regulatory action, and/or suffer damage to our reputation.

We outsource some of our operational activities and accordingly depend on a number of relationships with third-party service providers. Specifically, we rely on third parties for certain services, including, but not limited to, our core banking, web hosting and other processing services. Our business depends on the successful and uninterrupted functioning of our third-party servicers. The failure of these systems, a cybersecurity breach involving any of our third-party service providers or the termination or change in terms of a third-party software license or service agreement on which any of these systems is based could interrupt our operations. Because our information technology and telecommunications systems interface with and depend on third- party systems, we could experience service denials if demand for such services exceeds capacity or such third-party systems fail or experience interruptions. Replacing vendors or addressing other issues with our third-party service providers could entail significant delay, expense and disruption of service. If an interruption were to continue for a significant period of time, our business, financial condition and results of operations could be adversely affected. Even if we are able to replace third-party service providers, it may be at a higher cost to us, which could adversely affect our business, financial condition and results of operations. In addition, the Bank's primary federal regulator, the FDIC, has issued guidance outlining the expectations for third-party service provider oversight and monitoring by financial institutions. The federal banking agencies, including the FDIC, have also issued enforcement actions against financial institutions for failure in oversight of third-party providers and violations of federal banking law by such providers when performing services for financial institutions. Accordingly, our operations could be interrupted if any of our third-party service providers experience difficulty, are subject to cybersecurity breaches, terminate their services or fail to comply with banking regulations, which could adversely affect our business, financial condition and results of operations. In addition, our failure to adequately oversee the actions of our third-party service providers could result in regulatory actions against the Bank, which could adversely affect our business, financial condition and results of operations.

The deposits of our bank are insured by the FDIC up to legal limits and, accordingly, subject it to the payment of FDIC deposit insurance assessments as determined according to the calculation described in "Supervision and Regulation-Deposit Insurance." In addition, the FDIC has the ability to assess special assessments against insured depository institutions if required to recapitalize the DIF. Increases in assessment rates or special assessments may occur in the future, especially if there are significant additional financial institution failures. Any future special assessments, increases in assessment rates or required prepayments in FDIC insurance premiums could reduce our profitability or limit our ability to pursue certain business opportunities, which could have a material adverse effect on our business, financial condition and results of operations.

Our success in the competitive environment in which we operate requires consistent investment of capital and human resources in innovation, particularly in light of the current "FinTech" environment, in which financial institutions are investing significantly in new technologies, such as artificial intelligence, machine learning, blockchain and other distributed ledger technologies, and developing potentially industry-changing new products, services and industry standards in order to attract clients. Our investment is directed at meeting the needs of our clients, adapting existing products and services to the evolving standards and demands of the marketplace, and maintaining the security of our systems and building a platform for future innovation and competitive advantage that is scalable. Among other things, investing in innovation helps keep us relevant and client-focused while maintaining acceptable margins. Our investment also focuses on enhancing the delivery of our products and services, such as our recent implementation of digital payment channels, such as mobile wallets, contactless debit cards and Zelle. Falling significantly behind our competition in this area could adversely affect our business opportunities, growth and earnings. There are substantial risks and uncertainties associated with innovation efforts, including an increased risk that new and emerging technologies may expose us to increased cybersecurity and other information technology vulnerability and threats. Expected timetables for the introduction and development of new products or services may not be achieved, and price and profitability targets may not be met. Further, our revenues and costs may fluctuate because new products and services generally require start-up costs while corresponding revenues take time to develop or may not develop at all.

We regularly collect, process, transmit and store significant amounts of confidential information regarding our customers, employees and others and concerning our business, operations, plans and strategies. In some cases, this confidential or proprietary information is collected, compiled, processed, transmitted or stored by third parties on our behalf. Information security risks have generally increased in recent years because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial and other transactions and the increased sophistication and activities of perpetrators of cyber-attacks and mobile phishing. Mobile phishing, a means for identity thieves to obtain sensitive personal information through fraudulent e-mail, text or voice mail, is an emerging threat targeting the customers of financial entities. A failure in or breach of our operational or information security systems, or those of our third-party service providers, as a result of cyber-attacks or information security breaches or due to employee error, malfeasance or other disruptions could adversely affect our business, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs and/or cause losses. If this confidential or proprietary information were to be mishandled, misused or lost, we could be exposed to significant regulatory consequences, reputational damage, civil litigation and financial loss. In recent years, several financial services firms suffered successful cyber-attacks launched both domestically and from abroad, resulting in the disruption of services to clients, loss or misappropriation of sensitive or private information, and reputational harm. Further, information security risks for financial institutions like us are significant in part because of the evolving proliferation of new technologies, the use of the internet, mobile devices, and cloud technologies to conduct financial transactions and the increased sophistication and activities of hackers, terrorists, organized crime and other external parties, including foreign state actors. In addition, our clients often use their own devices, such as computers, smart phones and tablets, to manage their accounts, which may heighten the risk of system failures, interruptions or security breaches. If we fail to continue to upgrade our technology infrastructure and monitor our vendors to ensure effective information security relative to the type, size and complexity of our operations, we could become more vulnerable to cyber-attack and, consequently, subject to significant regulatory penalties. Although we employ a variety of physical, procedural and technological safeguards to protect this confidential and proprietary information from mishandling, misuse or loss, these safeguards do not provide absolute assurance that mishandling, misuse or loss of the information will not occur, and that if mishandling, misuse or loss of information does occur, those events will be promptly detected and addressed. Similarly, when confidential or proprietary information is collected, compiled, processed, transmitted or stored by third parties on our behalf, our policies and procedures require that the third party agree to maintain the confidentiality of the information, establish and maintain policies and procedures designed to preserve the confidentiality of the information, and permit us to confirm the third party's compliance with the terms of the agreement. However, these safeguards do not provide absolute assurance that mishandling, misuse or loss of the information will not occur, and that if mishandling, misuse or loss of information does occur, those events will be promptly detected and addressed. As information security risks and cyber threats continue to evolve, we may be required to expend additional resources to continue to enhance our information security measures and/or to investigate and remediate any information security vulnerabilities.

We operate in a highly competitive banking market and face substantial competition in originating loans. This competition currently comes principally from other banks, savings institutions, mortgage banking companies, credit unions and other lenders. Many of our competitors enjoy advantages, including greater financial resources and higher lending limits, a wider geographic presence, more accessible branch office locations, the ability to offer a wider array of services or more favorable pricing alternatives, as well as lower origination and operating costs. This competition could reduce our net income by decreasing the number and size of loans that we originate and the interest rates we may charge on these loans. In attracting deposits, we face substantial competition from other insured depository institutions such as banks, savings institutions and credit unions, as well as institutions offering uninsured investment alternatives, including money market funds. Many of our competitors enjoy advantages, including greater financial resources, more aggressive marketing campaigns, better brand recognition and more branch locations. These competitors may offer higher interest rates than we do, which could decrease the deposits that we attract or require us to increase our rates to retain existing deposits or attract new deposits. Increased deposit competition could adversely affect our ability to generate the funds necessary for lending operations, which may increase our cost of funds or negatively impact our liquidity. We also compete with non-bank providers of financial services, such as brokerage firms, consumer finance companies, insurance companies and governmental organizations, which may offer more favorable terms. Some of our non-bank competitors are not subject to the same extensive regulations that govern our operations. As a result, such non-bank competitors may have advantages over us in providing certain products and services. This competition may reduce or limit our margins on banking services, reduce our market share and adversely affect our earnings and financial condition. The financial services industry could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. Our inability to compete successfully in the markets in which we operate could have an adverse effect on our business, financial condition or results of operations.

A significant portion of our lending activity is related to certain niche lending products, such as loans secured by investor owned, non-owner occupied one- to four-family properties and loans without third-party income verifications, which are considered non-qualified mortgage loans and which may expose us to greater risk of credit loss than that associated with more traditional lending products. Non-qualified mortgage loans are considered to have a higher degree of risk and are less liquid than qualified mortgage loans. For the years ended December 31, 2025 and 2024, we originated $246.4 million and $130.4 million in non-qualified mortgage loans, respectively. During the years ended December 31, 2025 and 2024 we sold into the secondary market $92.3 million and $37.6 million, respectively of our non-qualified mortgages. Although we have developed underwriting standards and procedures designed to reduce the risk of loss, we can provide no assurance that these standards and procedures will be effective in reducing losses. Should we incur credit losses, it could adversely affect our results of operations.

Our reputation is one of the most valuable assets of our business. A key component of our business strategy is to rely on our reputation for customer service and knowledge of local markets to expand our presence by capturing new business opportunities from existing and prospective customers in our market area and contiguous areas. As such, we strive to conduct our business in a manner that enhances our reputation. This is done, in part, by recruiting, hiring and retaining employees who share our core values of being an integral part of the communities we serve, delivering superior service to our customers and caring about our customers and associates. If our reputation is negatively affected, by the actions of our employees or otherwise, our business and, therefore, our operating results may be materially adversely affected.