Hometrust Bancshares (HTB) Risk Analysis

As a bank, we are susceptible to fraudulent activity that may be committed against us or our clients, which may result in financial losses or increased costs to us or our clients, disclosure or misuse of our information or our client information, misappropriation of assets, privacy breaches against our clients, litigation or damage to our reputation. Such fraudulent activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering and other dishonest acts. Nationally, reported incidents of fraud and other financial crimes have increased. We have also experienced losses due to apparent fraud and other financial crimes. While we have policies and procedures designed to prevent or reduce the severity of such losses, there can be no assurance that such losses will not occur.

At December 31, 2025, municipal leases were $166.4 million, or 4.7% of our total loan portfolio. We offer ground and equipment lease financing to fire departments located throughout North Carolina and, to a lesser extent, South Carolina and Virginia. Repayment of our municipal leases is often dependent on the tax revenues collected by the county/municipality on behalf of the fire department. Although a municipal lease does not constitute a general obligation of the county/municipality for which the county/municipality's taxing power is pledged, a municipal lease is ordinarily backed by the county/municipality's covenant to budget for, appropriate and pay the tax revenues to the fire department. However, certain municipal leases contain "non-appropriation" clauses which provide that the municipality has no obligation to make lease or installment purchase payments in future years unless money is appropriated for that purpose on a yearly basis. In the case of a "non-appropriation" lease, our ability to recover under the lease in the event of non-appropriation or default will be limited solely to the repossession of the leased property, without recourse to the general credit of the lessee, and disposition or releasing of the property might prove difficult. At December 31, 2025, $30.6 million of our municipal leases contained a non-appropriation clause.

In recent years, companies have faced scrutiny from customers, regulators, investors and other stakeholders related to their environmental, social and governance ("ESG") practices and disclosures. Investor advocacy groups, investment funds and influential investors are also focused on these practices, especially as they relate to the environment, health and safety, diversity, labor conditions and human rights. ESG-related compliance costs could increase our overall operational costs. Failure to adapt to or comply with regulatory requirements or investor or stakeholder expectations and standards could negatively impact our reputation, ability to do business with certain partners and our stock price. Recent changes in the regulatory landscape and shifting federal priorities have moved toward a reduction in emphasis on certain ESG priorities, particularly around climate change and diversity, equity and inclusion ("DEI"). This shift has led to a rollback of regulations that mandate specific disclosures and operational practices in these areas. However, some stakeholder groups continue to demand greater transparency and action, resulting in a complex and potentially conflicting environment for companies. If regulatory enforcement of ESG-related policies becomes less stringent, companies may face reputational risks if their practices are seen as insufficient or inconsistent with broader societal expectations, especially related to DEI and environmental stewardship. As a result, navigating this evolving regulatory and public opinion landscape may require us to balance compliance with regulatory requirements against maintaining investor, customer, and stakeholder trust.

Severe weather and other natural disasters, acts of war or terrorism, public health issues or other adverse external events could have a significant impact on our ability to conduct business. Such events could harm our operations through interference with communications, including the interruption or loss of our computer systems, which could prevent or impede us from gathering deposits, originating loans and processing and controlling the flow of business, as well as through the destruction of our facilities and our operational, financial and management information systems. There is no assurance that our business continuity and disaster recovery program can adequately mitigate these risks. Such events could also affect the stability of our deposit base, cause significant property damage, adversely affect our employees, adversely impact the values of collateral securing our loans and/or interfere with our borrowers' abilities to repay their debt obligations to us.

The financial services market, including banking services, is undergoing rapid changes with frequent introductions of new technology-driven products and services. Our future success will depend, in part, on our ability to keep pace with technological changes and to use technology to satisfy and grow customer demand for our products and services and to create additional efficiencies in our operations. We expect that we will need to make substantial investments in our technology and information systems to compete effectively and to stay current with technological changes. Some of our competitors have substantially greater resources to invest in technological improvements and will be able to invest more heavily in developing and adopting new technologies, which may put us at a competitive disadvantage. We may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers. As a result, our ability to effectively compete to retain or acquire new business may be impaired, and our business, financial condition or results of operations may be adversely affected.

Our security measures may not be sufficient to mitigate the risk of a cyber attack. Communications and information systems are essential to the conduct of our business, as we use these systems to manage our customer relationships, our general ledger and virtually all other aspects of our business. Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Although we take protective measures and endeavor to modify them as circumstances warrant, the security of our computer systems, software and networks may be vulnerable to breaches, fraudulent or unauthorized access, denial or degradation of service attacks, misuse, computer viruses, malware or other malicious code and cyber-attacks that could have a security impact. If one or more of these events occur, this could jeopardize our or our customers' confidential and other information processed and stored in, and transmitted through, our computer systems and networks, or otherwise cause interruptions or malfunctions in our operations or the operations of our customers or counterparties. We may be required to expend significant additional resources to modify our protective measures or to investigate and remediate vulnerabilities or other exposures, and we may be subject to litigation and financial losses that are either not insured against or not fully covered through any insurance maintained by us. We could also suffer significant reputational damage. Further, our cardholders use their debit and credit cards to make purchases from third parties or through third-party processing services. As such, we are subject to risk from data breaches of a third party's information systems or their payment processors. Such a data security breach could compromise our account information. The payment methods that we offer also subject us to potential fraud and theft by criminals who are becoming increasingly more sophisticated, seeking to obtain unauthorized access to or exploit weaknesses that may exist in the payment systems. If we fail to comply with applicable rules or requirements for the payment methods we accept, or if payment-related data is compromised due to a breach or misuse of data, we may be liable for losses associated with reimbursing our clients for fraudulent transactions on clients' card accounts, as well as costs incurred by payment card issuing banks and other third-parties. We may also be subject to fines and higher transaction fees, and our ability to accept or facilitate certain types of payments may be impaired. In addition, we may incur other costs related to data security breaches, such as replacing cards associated with compromised card accounts. Our customers could also lose confidence in certain payment types, which may result in a shift to other payment types or potential changes to our payment systems that may result in higher costs. Breaches of information security also may occur through intentional or unintentional acts by those having access to our systems or our clients' or counterparties' confidential information, including employees. The Company is continuously working to install new, and upgrade its existing, information technology systems and provide employee awareness training around phishing, malware and other cyber risks to further protect the Company against such risks and security breaches. There continues to be a rise in electronic fraudulent activity, security breaches and cyber-attacks within the financial services industry, especially in the commercial banking sector, due to cyber criminals targeting commercial bank accounts. We are regularly the target of attempted cyber and other security threats and must continuously monitor and develop our information technology networks and infrastructure to prevent, detect, address and mitigate the risk of unauthorized access, misuse, computer viruses and other events that could have a security impact. Insider or employee cyber and security threats are increasingly a concern for companies, including ours. We are not aware that we have experienced any material misappropriation, loss or other unauthorized disclosure of confidential or personally identifiable information as a result of a cyber-security breach or other act; however, some of our clients may have been affected by these breaches, which could increase their risks of identity theft, credit card fraud and other fraudulent activity that could involve their accounts with us. Security breaches in our internet banking activities could further expose us to possible liability and damage our reputation. Increases in criminal activity levels and sophistication, advances in computer capabilities, new discoveries, vulnerabilities in third-party technologies (including browsers and operating systems) or other developments could result in a compromise or breach of the technology, processes and controls that we use to prevent fraudulent transactions and to protect data about us, our clients and underlying transactions. Any compromise of our security could deter customers from using our internet banking services that involve the transmission of confidential information. We rely on standard internet security systems to provide the security and authentication necessary to effect secure transmission of data. Although we have developed and continue to invest in systems and processes that are designed to detect and prevent security breaches and cyber-attacks and periodically test our security, these precautions may not protect our systems from compromises or breaches of our security measures, and could result in losses to us or our customers, our loss of business and/or customers, damage to our reputation, the incurrence of additional expenses, disruption to our business, our inability to grow our online services or other businesses, additional regulatory scrutiny or penalties or our exposure to civil litigation and possible financial liability, any of which could have a material adverse effect on our business, financial condition and results of operations. Our security measures may not protect us from system failures or interruptions of our own systems or those of our third-party vendors. While we have established policies and procedures to prevent or limit the impact of systems failures and interruptions, there can be no assurance that such events will not occur or that they will be adequately addressed if they do. In addition, we outsource certain aspects of our data processing and other operational functions to certain third-party providers. While the Company selects third-party vendors carefully, it does not control their actions. If our third-party providers encounter difficulties, including those resulting from breakdowns or other disruptions in communication services provided by a vendor, failure of a vendor to handle current or higher transaction volumes, cyber-attacks or security breaches or if we otherwise have difficulty in communicating with them, our ability to adequately process and account for transactions could be affected, and our ability to deliver products and services to our customers and otherwise conduct business operations could be adversely impacted. Replacing these third-party vendors could also entail significant delay and expense. Threats to information security also exist in the processing of customer information through various other vendors and their personnel. We cannot assure you that such breaches, failures or interruptions will not occur or, if they do occur, that they will be adequately addressed by us or the third-parties on which we rely. We may not be insured against all types of losses as a result of third-party failures, and insurance coverage may be inadequate to cover all losses resulting from breaches, system failures or other disruptions. If any of our third-party service providers experience financial, operational or technological difficulties, or if there is any other disruption in our relationships with them, we may be required to identify alternative sources of such services, and we cannot assure you that we could negotiate terms that are as favorable to us, or could obtain services with similar functionality as found in our existing systems without the need to expend substantial resources, if at all. Further, the occurrence of any systems failure or interruption could damage our reputation and result in a loss of customers and business, could subject us to additional regulatory scrutiny or could expose us to legal liability. Any of these occurrences could have a material adverse effect on our financial condition and results of operations. Our current and future use of artificial intelligence ("AI") and other emerging technologies may create additional risks. The increasing adoption of AI in financial services presents significant opportunities but also introduces a range of risks that could impact our operations, regulatory compliance and customer trust. AI introduces model risk, where flawed algorithms or biased data could result in inaccurate credit decisions, compliance violations or discriminatory outcomes in lending or customer service. Cybersecurity threats, such as data breaches, adversarial attacks and data poisoning, pose significant challenges, particularly as these systems handle large volumes of sensitive customer information. Additionally, the opaque nature of some AI models, often referred to as "black-box" systems, raises regulatory compliance concerns, as regulators increasingly require transparency and explainability in AI-driven decision-making. Operational risks also arise from potential system failures, over-reliance on AI and integration challenges with existing infrastructure. Disruptions in AI systems could impact critical functions such as fraud detection, transaction monitoring and customer support. Ethical and reputational risks, including unintended consequences or perceived unfairness in AI-driven decisions, may erode customer trust and expose us to regulatory scrutiny. To mitigate these risks requires a robust governance framework, regular testing and auditing of AI models, and strong human oversight. Investments in cybersecurity, data privacy protections and employee training are critical to manage these risks.

Competition for qualified employees and personnel in the banking industry is intense and there are a limited number of qualified persons with knowledge of, and experience in, the community banking industry where the Bank conducts its business. The process of recruiting personnel with the combination of skills and attributes required to carry out our strategies is often lengthy. Our success depends to a significant degree upon our ability to attract and retain qualified management, loan origination, finance, administrative, marketing and technical personnel and upon the continued contributions of our management and personnel. Our ability to retain and grow our loans, deposits and fee income depends upon the business generation capabilities, reputation and relationship management skills of our bankers. If we were to lose the services of any of our bankers, including successful bankers employed by banks that we may acquire, to a new or existing competitor, or otherwise, we may not be able to retain valuable relationships and some of our customers could choose to use the services of a competitor instead of our services. In addition, our success has been and continues to be highly dependent upon the services of our directors, several of whom have reached or are nearing the mandatory retirement age under our bylaws, and we may not be able to identify and attract suitable candidates to replace these directors.

We rely on numerous external vendors to provide us with products and services necessary to maintain our day-to-day operations. Accordingly, our operations are exposed to the risk that these vendors will not perform in accordance with the contracted arrangements under service level agreements. The failure of an external vendor to perform in accordance with the contracted arrangements under service level agreements because of changes in the vendor's organizational structure, financial condition, support for existing products and services or strategic focus or for any other reason, could be disruptive to our operations, which in turn could have a material negative impact on our financial condition and results of operations. We also could be adversely affected to the extent such an agreement is not renewed by the third-party vendor or is renewed on terms less favorable to us. Additionally, the bank regulatory agencies expect financial institutions to be responsible for all aspects of a vendor's performance, including aspects which the vendor delegates to third parties. Disruptions or failures in the physical infrastructure or operating systems that support our business and clients could result in client attrition, regulatory fines, penalties or intervention, reputational damage, reimbursement or other compensation costs and/or additional compliance costs, any of which could materially adversely affect our results of operations or financial condition.

Although we consider ourselves competitive in our market areas, we face intense competition in both making loans and attracting deposits. Price competition for loans and deposits might result in our earning less on our loans and paying more on our deposits, which reduces net interest income. Some of the institutions with which we compete have substantially greater resources than we have and may offer services that we do not provide. We expect competition to increase in the future as a result of legislative, regulatory and technological changes and the continuing trend of consolidation in the financial services industry. Our profitability will depend upon our continued ability to compete successfully in our market areas.

We are a community bank, and our reputation is one of the most valuable aspects of our business. A key component of our business strategy is to utilize our reputation for customer service and knowledge of local markets to expand our presence by capturing new business opportunities from existing and prospective customers in our current market and contiguous areas. As such, we strive to conduct our business in a manner that enhances our reputation. This is done, in part, by recruiting, hiring and retaining employees who share our core values of being an integral part of the communities we serve, delivering superior service to our customers and caring about our customers and associates. Threats to our reputation can come from many sources, including adverse sentiment about financial institutions generally, unethical practices, employee misconduct, failure to deliver minimum standards of service or quality, compliance deficiencies and questionable or fraudulent activities of our customers. We have policies and procedures in place to protect our reputation and promote ethical conduct, but these policies and procedures may not be fully effective. Negative publicity regarding our business, employees or customers, with or without merit, may result in the loss of customers, investors and employees, costly litigation, a decline in revenues and increased governmental regulation.