Bank of NT Butterfield & Son (NTB) Risk Analysis

Regulators, investors and customers are increasingly focused on sustainability and environmental, social and governance issues. Certain of our regulators have proposed or adopted, or may propose or adopt, sustainability and environmental, social and governance-related rules or standards that could apply to our business, including requirements or expectations that would enhance or expand our reporting, diligence, and policies on these topics. Other stakeholders have also proposed or adopted sustainability and environmental, social and governance-related standards or policies, and may rate or otherwise, evaluate our business and other practices according to such requirements, standards and policies, which are continually evolving and often not clear. Unfavorable ratings of the Bank may adversely affect investor sentiment towards the Bank or the market price of our securities, see also " - Severe weather, natural disasters and potential impacts of climate change could disrupt our businesses and adversely affect our financial condition or results of operations." Environmental, social and governance regimes in different jurisdictions and environmental, social and governance standards used by different stakeholders may also impose different and potentially conflicting requirements, or reflect inconsistent or conflicting values or agendas. See also "- Our international business model exposes us to various and possibly conflicting regulatory regimes across multiple jurisdictions." We may need to incur significant costs in order to meet the requirements and expectations of our regulators and other stakeholders on environmental, social and governance issues. Our policies and processes to evaluate and manage environmental, social and governance standards in coordination with other business priorities may not prove completely effective or satisfy regulators, investors, customers, or other stakeholders. As a result, we could face adverse regulatory, investor, customer, media, or public scrutiny leading to business, reputational, or legal challenges.

The key markets in which we operate including Bermuda and the Cayman Islands, as well as our and our customers' business, operations and financial conditions, are subject to the risks associated with severe weather conditions (including among others tropical storms, hurricanes, floods and tornadoes), earthquakes, rising sea levels and other natural disasters, including downed telephone lines, flooded facilities, power outages, fuel shortages, damaged or destroyed property and equipment, and work interruptions. Although hurricanes in the Caribbean and Bermuda during 2023, 2024 and 2025 did not negatively impact the Bank's operations or cause any insurable losses, such severe weather conditions and natural disasters have in the past and may, in the future, negatively impact us and our clients and their ability to meet their financial obligations to us, including the repayment of loans. Climate change may also aggravate the impact and increase the incidence of severe weather conditions and natural disasters, which may include altered distribution and intensity of rainfall, prolonged droughts or flooding, rising sea levels, and a rising heat index. Such events may, among other impacts, adversely affect borrowers (including those in the insurance and reinsurance industries), including resulting in an impairment of the value of property or other collateral used to secure the loans that we extend, as well as significantly impacting the economies of the key markets in which we operate. The occurrence of any of these events could have a material adverse effect on our financial condition and results of operations. In addition, we cannot predict whether we will continue to be able to obtain insurance for natural disaster or climate change-related damages to our premises or, if obtainable and carried, whether this insurance will be adequate to cover our losses. Moreover, we expect any insurance of this nature to be subject to substantial deductibles and to provide for premium adjustments based on claims, and we do not carry insurance against all types of losses. For these reasons, costs and work interruptions resulting from such events (whether actual or anticipated) could have an adverse effect on our business, financial condition or results of operations. In addition, climate-related concerns have resulted in and may continue to drive changes in consumer, investor and other stakeholder preferences, additional regulatory requirements or taxes and additional counterparty or customer requirements, all of which could increase our expenses, expand our regulatory and operational risks and impact our financial condition. Further, our reputation and client relationships may be damaged as a result of our actual or perceived practices related to climate change,including our involvement, or our clients' involvement, in certain industries or projects associated with causing or exacerbating climate change, as well as decisions we make in response to considerations relating to climate change. We are also subject to risks relating to new or proposed climate change-related regulations or legislation as a result of governmental efforts around the world to mitigate climate change impacts, which could impact the Bank and its customers.

We are exposed to foreign currency risk as a result of our holdings of foreign currency denominated assets and liabilities, investments in foreign subsidiaries, and future foreign currency denominated revenues and expenses. Fluctuations in exchange rates may raise the potential for losses resulting from foreign currency trading positions, where aggregate obligations to purchase and sell a foreign currency do not offset each other or offset each other in different time periods. Exchange rate volatility may have negative impacts on our business, financial position and results of operations. For example, the GBP/USD volatility experienced in the latter half of 2022, 2023, 2024 and into 2025 significantly impacted the value of GBP-denominated loans and deposits recorded on our consolidated balance sheets. We also provide foreign exchange services to our clients, including trading on behalf of clients in all major currencies and providing hedging solutions to manage foreign exchange risk. Foreign currency volatility influences the level of client activity. Changes in client activity may result in reduced income from foreign exchange services. In addition, the Bermuda Dollar and the Cayman Islands Dollar are pegged to the US Dollar at exchange rates of 1 Bermuda Dollar to 1 US Dollar and 1 Cayman Islands Dollar to 1.20 US Dollars, respectively. However, we cannot make assurances that these pegs will be maintained. In the event that the Bermuda Dollar or Cayman Islands Dollar is de-pegged or the current ratios are changed, including as a result of changes in laws, regulations or policies in these jurisdictions, the value of our financial position or results of operations could be adversely affected. Moreover, our US Dollar deposits are used to fund mortgages in Bermuda Dollars and Cayman Islands Dollars. As the Bermuda Dollar and the Cayman Islands Dollar are pegged to the US Dollar, we do not engage in hedging activities to counteract this currency risk. If the Bermuda Dollar or Cayman Islands Dollar ceased to be pegged to the US Dollar at the current ratios, however, we could be exposed to significant currency risks.

The success of our strategy relies significantly on our reputation and the reputation of our senior management and the Board. In addition, our customers and key introducers must continue to associate our brand with meeting customer needs and delivering value to those customers. Adverse publicity (whether or not justified) relating to activities by our management, employees, agents or others with whom we do business, such as customer service mishaps or non-compliance with laws, could tarnish our reputation and reduce the value of our brand. With the increase in the use of social media outlets, adverse publicity can be disseminated quickly and broadly, making it increasingly difficult for us to effectively respond. Such unfavorable publicity could also require us to allocate significant resources to rebuild our reputation. As a bank operating in Bermuda, the Cayman Islands, the Channel Islands and other international financial centers, we are subject to increasing scrutiny with respect to potential or alleged legal and regulatory breaches and unethical behavior and associated reputational harms, including with respect to the general perception and reputation of financial institutions in those jurisdictions, which may in turn be affected by factors including the EU list of non-cooperative jurisdictions for tax purposes, and policies on controversial industries such as gaming and cryptocurrencies, among others. See " - Our business may be negatively impacted by the economic substance legislation and regulations in the jurisdictions in which we operate, including Bermuda, the Cayman Islands, and the Channel Islands." Any circumstance that causes real or perceived damage to our brand or reputation, or banking or wealth management generally in these jurisdictions, may negatively affect our relationships with our customers and key introducers, which would have an adverse effect on our business, financial condition or results of operations. Potential reputational issues include, but are not limited to: - breaching or facing allegations of having breached legal and regulatory requirements (including, but not limited to, conduct requirements, anti-money laundering requirements, anti-terrorism financing requirements, sanctions, laws against assisting in tax evasion, cybersecurity and data protection laws, bribery and corruption);- legacy issues we inherit from the businesses we acquire through a merger or acquisition;- acting or facing allegations of having acted unethically (including having adopted inappropriate sales and trading practices);- failing or facing allegations of having failed to maintain appropriate standards of customer privacy, customer service and record-keeping;- failing to meet the expectations of our regulators (including with respect to capital requirements, liquidity, risk oversight, governance and conduct);- failing to appropriately address potential conflicts of interest;- experiencing technology failures that impact customer services and accounts;- failing to properly identify legal, credit, liquidity and market risks or the risk of reputational harm inherent in products offered;- failing to meet evolving and diverging expectations from investors, customers, employees and regulators relating to environmental, social, governance and sustainability disclosures, standards and practices; and - changing the terms of our product offerings and pricing that may result in outcomes for customers that are unfair or perceived to be unfair. A failure to address the above or any other relevant issues appropriately could make customers unwilling to do business with us, which could have an adverse effect on our business, financial condition or results of operations and could damage our relationships with our employees and regulators.

From time to time, we may introduce new activities or new technology through new products and services within business entities. For example, we have introduced digital account applications, know-your-client processes and Google Pay in all our core banking jurisdictions, and Apple Pay in the Channel Islands. There may be substantial risks and uncertainties associated with these efforts. Insufficient planning may lead to an incomplete assessment and understanding of associated risks involved with new activities and may result in inadequate oversight and controls. New activities may increase strategic risk where not compatible with the bank's risk appetite or strategic plan or do not provide an adequate return on investment; engagement of new activities without adequate due diligence and failure to provide adequate resources, expertise and experience to properly implement and oversee new activities. This can damage our reputation and increase negative public opinion. Failure to successfully manage these risks in the development and implementation of new lines of business or new products or services could have a material adverse effect on our business, financial condition, and results of operations.

Competitors or other third parties may allege that we, or consultants or other third parties retained or indemnified by us, infringe on their intellectual property rights. Even in instances where we believe that claims and allegations of intellectual property infringement against us are without merit, defending against such claims is time consuming and expensive and could result in the diversion of time and attention of our management and employees. In addition, although in some cases a third party may have agreed to indemnify us for such costs, such indemnifying party may refuse, or be unable, to uphold its contractual obligations. Moreover, we rely on a variety of measures to protect our intellectual property and proprietary information, including copyrights, trademarks, and controls on access and distribution. These measures may not prevent misappropriation or infringement of our intellectual property or proprietary information and a resulting loss of competitive advantage. In any event, we may be required to litigate to protect our intellectual property and proprietary information from misappropriation or infringement by others, which is expensive and could cause a diversion of resources and may not be successful.

In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and store sensitive, proprietary or confidential data. The secure processing, storage, maintenance and transmission of this data is critical to our operations and reputation. We are under continuous threat from cyber-attacks, especially as we continue to expand customer capabilities to utilize the internet and other remote channels to transact business. If any of our data were mishandled, misused, improperly accessed, lost or stolen, or if our operations were disrupted, we could suffer significant financial, reputational or other damages. Two of the most significant cyber-attack risks that we face are e-fraud and loss of sensitive customer data. These risks may be more likely where third party vendors have access to or process data on our behalf. While such attacks are infrequent, they could present significant reputational, legal and regulatory costs to us if successful. In addition, the nature of cyber-attacks is constantly and rapidly evolving, and the use of AI by cybercriminals (including deepfake-enabled attacks) may increase the frequency and severity of cybersecurity attacks against us or our third-party vendors and clients. Attempts to infiltrate our systems may not be recognized until launched against us and in some cases are designed not to be detected. Although we make significant efforts to maintain the security and integrity of our information systems, there can be no assurances that our security measures will be effective. Third parties with whom we or our customers do business also present operational and information security risks to us, including security breaches or failures of their own systems. Cyber-attacks at third party service providers are also becoming increasingly common and, as a result, risks relating to cyber-attacks on our vendors have been increasing. We also face risks related to cyber-attacks and other security breaches in connection with credit card transactions that typically involve the transmission of sensitive information regarding our customers through various third parties, including merchant acquiring banks, payment processors, payment card networks (e.g., Visa or Mastercard), our processors, and clearing banks. Some of these parties have in the past been the target of security breaches and cyber-attacks, and because the transactions involve third parties and environments such as the point of sale that we do not control or secure, future security breaches or cyber-attacks affecting any of these third parties could impact us through no fault of our own, and in some cases we may have exposure and suffer losses for breaches or attacks relating to them, including from remediation costs, increased future protection costs, reputational harm, loss of customers and potential regulatory inquiries and/or civil litigation. We also rely on numerous other third-party service providers to conduct other aspects of our business operations and face similar risks relating to them. Our increased use of cloud and other technologies heighten our exposure to security weaknesses that may increase our risks to data breaches, data loss, data leakage, account hijacking, insecure application programming interfaces and other potential cyber-risk events. Many of our employees (and staff of service providers) work remotely or from other sites. These working arrangements could potentially provide increased opportunities for cyber threat actors to exploit. We cannot provide assurances that the safeguards we have put in place or may implement in the future will prevent all unauthorized infiltration or breach, or that we will not suffer material losses related to a security breach in the future. In recent years, U.S. regulators, including the FDIC, SEC, and the FINRA, have made statements concerning cybersecurity risk management, preparedness and resiliency for financial institutions such as us. These statements range from issues with respect to client account protections to business continuity, and represent the regulators' expectations for financial institutions to have more robust cybersecurity risk management and a preparedness and resiliency program for themselves and their service providers. A financial institution is also expected to develop processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution, or its critical service providers, fall victim to this type of cyber-attack. Any cyber incidents, such as those of our third party vendors, could result, among other things, in increased regulatory scrutiny and adverse regulatory or civil litigation consequences. The occurrence of a cyber-threat scenario could cause interruptions in our operations and result in the incurrence of significant costs, including those related to forensic analysis and legal counsel, each of which may be required to ascertain the extent of any potential harm to our customers, or employees, or damage to our information systems and any legal or regulatory obligations that may result therefrom. The SEC adopted rules that require us to publicly disclose information about a material cybersecurity incident, including the impact or reasonably likely impact. Disclosure may be required before the incident has been resolved or fully investigated. The occurrence of a cyber-threat may therefore have a material adverse effect on our reputation, financial condition and results of operations. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of internet banking, mobile banking and other technology-based products and services by us and our clients. Due to the increasing sophistication of such attacks, we may not be able to prevent denial-of-service or other cyber-attacks that could compromise our normal business operations or the normal business operations of our clients, or result in the unauthorized use or disclosure of clients' confidential and proprietary information. The occurrence of any failure, interruption or security breach of network and computer systems resulting from denial-of-service or other cyber-attacks or security incidents could impact our ability to operate and serve our clients, damage our reputation, result in a loss of client business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability, any of which could adversely affect our business, results of operations or financial condition.

We rely heavily on communications and information systems to conduct business. In particular, we rely on technology to provide key components of our information system infrastructure, including loan, deposit and general ledger processing, risk management information collection and processing for internal control purposes, internet connections and network access. Any disruption in service of these key components, for example due to system errors, a natural catastrophe, or the termination of any third-party software licenses upon which any of these systems is based, could adversely affect our ability to effectively deliver products and services to clients, to detect, assess and manage risk and otherwise to conduct operations. See "- We rely on third parties to provide services that are integral to our ordinary operations, and their failure to perform in a satisfactory manner could negatively affect us." Furthermore, any security breach, due to computer viruses, programming, malfeasance or human errors or other events or developments, of information systems or data, whether managed by us or third parties, could interrupt our business, harm our reputation or cause a decrease in the number of clients using our services. The financial services industry is continually undergoing rapid technological change with frequent introductions of new, and technology-driven products and services, including recent and rapid developments in A), including agentic AI. We face the risk of having to establish and maintain further improved technological capabilities, and our future success depends, in part, on our ability to recognize and implement new technologies to address our operational and internal control needs, operational efficiencies and to meet the demands of our clients. See "- Cyber-attacks, distributed denial of service attacks and other cybersecurity matters, if successful, could have an adverse effect on our business, financial condition or results of operations." The legal and regulatory environment for AI is uncertain and rapidly evolving, which could require changes in our implementation of AI technology and increase our compliance costs and the risks to us of non-compliance. AI models, particularly generative or agentic AI models, may produce outputs or take action that is incorrect, release confidential information, reflect biases, infringe intellectual property, or otherwise cause harm. Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation or the effectiveness of our security measures. The widespread adoption of new technologies, including cryptocurrencies, blockchain, machine learning and AI, have and could continue to require substantial expenditures to modify or adapt our existing products and services as we continue to grow our internet and mobile banking capabilities or other technological-based distribution channels. The persistence or acceleration of this shift in demand towards internet and mobile banking has and may continue to necessitate changes to our retail distribution strategy, which include restructuring our branches and work force. These actions could lead to losses on these assets and may lead to increased expenditures to reform our retail distribution channel. Many of our competitors have substantially greater resources to invest in technological improvements than we do. We may not be able to effectively implement new, technology-driven products and services or be successful in marketing these products and services to our customers. In addition, the implementation of technological changes and upgrades to maintain current systems and integrate new ones may also cause service interruptions, transaction processing errors and system conversion delays and may cause us to fail to comply with applicable laws. Failure to successfully keep pace with technological change affecting the financial services industry and avoid interruptions, errors and delays could have an adverse effect on our business, financial condition, results of operations, or competitive position.

Our ability to implement our strategic plan and our future success depends on our ability to continue to attract, retain and motivate highly skilled and qualified personnel, including our senior management and other key employees and directors, competitively with our peers. The marketplace for skilled personnel is competitive, which means the cost of hiring, incentivizing and retaining skilled personnel may continue to increase. For example, labor shortages and increased turnover in recent years has increased the cost of hiring, incentivizing and retaining skilled personnel. Increased turnover and the shortage of employees may put stress on internal control environments. While the Bank has previously experienced slightly higher turnover levels as compared to historical averages, these have stabilized and we do not consider them to be material or systemic in nature. The failure to attract or retain, including as a result of an untimely death or illness of key personnel, or replace a sufficient number of appropriately skilled and key personnel could place us at a significant competitive disadvantage and prevent us from successfully implementing our strategy or effectively managing our risk framework and business operations. This could impair our ability to implement our strategic plan successfully, achieve our performance targets and otherwise have an adverse effect on our business, financial condition or results of operations. We may also be unable to attract and retain staff due to our locations. Many of our employees are employed in Bermuda, the Cayman Islands, and the Channel Islands, which are small markets. Therefore, location may be an impediment to attracting and retaining experienced personnel. Further, immigration laws in small markets impose limitations on attracting experienced personnel. In addition, governmental scrutiny with respect to matters relating to compensation and other business practices in the financial services industry has increased dramatically in the past several years and has resulted in more aggressive and intense regulatory supervision in certain markets in which we operate or are regulated. Future legislation or regulation or government views on compensation may result in us altering compensation practices in ways that could adversely affect our ability to attract and retain talented employees.

We rely on third parties to provide services that are integral to our ordinary course operations, including providers of information technology, administrative or investment advisory services. These third party supported functions or operating systems may not function properly, become insufficient to support our evolving business needs or become defective or damaged as a result of a number of factors including events beyond our control. Enhancements and upgrades to third party supported infrastructure or operating systems entail significant time and costs, and create risks associated with implementing new systems and integrating them with existing ones. Due to the complexity of our systems, across multiple jurisdictions and product types, the process of enhancing our infrastructure and operating systems, including their security measures and controls, can create a risk of system disruptions and security issues. Similarly, we may not be able to timely recover critical business processes or operations that have been disrupted, which may further increase the associated costs and consequences of such disruptions. Although we have business continuity plans in place, as well as cybersecurity and other safeguards to help provide operational resiliency, our business operations may be adversely affected by significant and prolonged disruption to our operating systems that support our businesses and customers. Furthermore, third parties on which we rely, could also introduce operational risk to us, including from information breaches or loss, breakdowns, cyber incidents, disruptions or failures of their own systems or infrastructure, or any deficiencies in the performance of their responsibilities. A material breach of customer data may negatively impact our business reputation and cause a loss of customer business; may result in increased expense to contain the event and/or require that we provide credit monitoring services for affected customers; may result in regulatory fines and sanctions; and/or may result in litigation. We rely on our outsourced service providers to implement and maintain prudent cybersecurity controls. We have procedures in place designed to assess a vendor's cybersecurity controls prior to establishing a contractual relationship and to periodically review assessments of those control systems; however, these procedures are not infallible and a vendor's system can be breached despite the procedures we employ. In addition, outsourcing is subject to regulatory controls in certain jurisdictions in which we operate and we may not always be able to obtain approval to outsource on terms available or sought by us, which could adversely affect our ability to enter into outsourcing arrangements. In addition, BNYM and Wells Fargo act as clearing houses for all our US Dollar transactions and, if our relationships with BNYM and Wells Fargo are terminated, we could lose our ability to engage in US Dollar transactions. For more information see " - We could be negatively affected if the soundness of other financial institutions and counterparties deteriorates or if such counterparties, including clearing houses, are unwilling to do business with us, in particular in respect of US Dollar transactions."