Metropolitan Bank Holding (MCB) Risk Analysis

The Company relies upon operational and information systems, some of which are managed by third parties, to process, transmit and store electronic information and to manage or support a variety of our business processes, activities and products. Additionally, we collect and store sensitive data, including the personally identifiable information of our customers and employees, in data centers and on information systems (including systems that may be controlled or maintained by third parties). The Company's business is dependent on its ability to process and monitor, on a daily basis, a large number of transactions, many of which are highly complex, across numerous and diverse markets. These transactions, as well as the information technology services provided to clients, often must adhere to client-specific guidelines, as well as legal and regulatory standards. Due to the breadth and geographical reach of the Company's client base, developing and maintaining its operational and information systems and infrastructure is challenging, particularly as a result of rapidly evolving legal and regulatory requirements and technological shifts. Although the Company continues to take protective measures to maintain the confidentiality, integrity and security of our operational and information systems and infrastructure, the techniques used in cyberattacks are becoming increasingly diverse and sophisticated. For example, the Company's operational and information systems or infrastructure, or those of our third-party providers, may be vulnerable to unauthorized access, loss or destruction of data (including confidential client information), account takeovers, disruptions of service, computer viruses or other malicious code, cyberattacks and other incidents that could create a cybersecurity event, any of which could remain undetected for an extended period of time. Furthermore, the Company may not be able to ensure that all of its clients, suppliers, counterparties and other third parties have appropriate controls in place to protect themselves from cyberattacks or to protect the confidentiality of the information that they exchange with us, particularly where such information is transmitted by electronic means. Although the Company engages third-party services on an ongoing basis to conduct independent audits of its information security and information technology risk management systems, these service providers may fail to identify cybersecurity strategies and processes the Company could implement in order to potentially be more consistent with industry best practices. Given the increasingly high volume of transactions, certain errors may be repeated or compounded before they can be discovered and rectified. In addition, the increasing reliance on information systems, and the occurrence and potential adverse impact of attacks on such systems, both generally and in the financial services industry, have encouraged increased government and regulatory scrutiny of the measures taken by companies to protect against cybersecurity threats and incidents. As these threats, incidents and government and regulatory oversight of associated risks continue to evolve, the Company may be required to expend additional resources to enhance or expand upon the security measures it currently maintains. Although the Company has developed, and continues to invest in, systems and processes that are reasonably designed to detect and prevent security breaches and cyberattacks, a breach of its systems could result in: losses to the Company and its customers; loss of business and/or customers; damage to its reputation; the incurrence of additional expenses (including the cost of notification to consumers, credit monitoring and forensics, and fees and fines imposed by the card networks); disruption to its business; an inability to grow its online services or other businesses; additional regulatory scrutiny or penalties; and/or exposure to civil litigation and possible financial liability - any of which could have a material adverse effect on the Company's business, financial condition and results of operations. We have not encountered cybersecurity threats or incidents that have materially and adversely affected, or are reasonably likely to materially and adversely affect, the Company's business, results of operations or financial condition; however, the impacts of such threats or incidents in the future may be material. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For information on our cybersecurity risk management, strategy and governance, see Part I, Item 1C., "Cybersecurity."

Employee errors and employee and customer misconduct could subject the Company to financial losses or regulatory sanctions and have a material adverse impact on its reputation. Misconduct by its employees could include concealing unauthorized activities, engaging in improper or unauthorized activities on behalf of customers or improper use of confidential information. It is not always possible to prevent employee errors and misconduct, and the precautions the Company takes to prevent and detect this activity may not be effective in all cases. Employee errors could also subject the Company to financial claims for negligence. The Company maintains a system of internal controls and insurance coverage to mitigate operational risks, including data processing system failures and errors and customer or employee fraud. If internal controls fail to prevent or detect an occurrence, or if any resulting loss is not insured or exceeds applicable insurance limits, it could have a material adverse impact on the Company's business, financial condition and results of operations.

The Company's success depends in large part on the performance of its key personnel, as well as on its ability to attract, motivate and retain highly qualified senior and middle management and other skilled employees. Competition for employees is intense, and the process of locating key personnel with the combination of skills and attributes required to execute its business plan may be lengthy. The Company may not be successful in retaining its key employees, and the unexpected loss of services of one or more of key personnel could have a material adverse effect on its business because of their skills, knowledge of primary markets, years of industry experience and the difficulty of promptly finding qualified replacement personnel. If the services of any key personnel should become unavailable for any reason, the Company may not be able to identify and hire qualified persons on acceptable terms, or at all, which could have a material adverse effect on the business, financial condition, results of operations and future prospects of the Company. In addition, departing personnel may, directly or indirectly, influence our customers' decisions to seek financial products and services from our competitors, which could have a material adverse effect on the business, financial condition, results of operations and future prospects of the Company. In an effort to prevent the departure of our employees, we may be required to increase current compensation levels to attract and retain employees, which could negatively impact our business, financial condition, and results of operations.

The Company's market area contains not only a large number of community and regional banks, but also a significant presence of the country's largest commercial banks and a growing presence of non-bank financial services companies. The Company competes with other state and large financial institutions, savings and loan associations, savings banks, credit unions and other companies offering financial services. Some of these competitors have a longer history of successful operations nationally and in the New York market area, greater ties to businesses, more expansive banking relationships, more established depositor bases, fewer regulatory constraints, better technology, and lower cost structures than the Company does. Competitors with greater resources may possess an advantage through their ability to maintain numerous banking locations in more convenient sites, conduct more extensive promotional and advertising campaigns, or operate a more developed technology platform. Due to their size, many competitors may offer a broader range of products and services, as well as better pricing for certain products and services than the Company can offer. Larger banks may also have more resilient operational and information technology infrastructure. Further, increased competition among financial services companies due to the continued consolidation of financial institutions may adversely affect the Company's ability to market its products and services. In addition, the Company's legally mandated lending limits are lower than those of certain of its competitors that have greater capital. Lower lending limits may discourage borrowers with lending needs that exceed these limits from doing business with the Company. The Company may try to serve such borrowers by selling loan participations to other financial institutions; however, this strategy may not succeed.