Park National (PRK) Risk Analysis

Park National Bank ("Park") is subject to a Consent Order with the U.S. Department of Justice ("DOJ"), approved on March 2, 2023, by the U.S. District Court for the Southern District of Ohio. This Consent Order resolved allegations regarding Park's mortgage lending practices within the Columbus, Ohio Metropolitan Statistical Area ("Columbus Lending Area"). Park is in full compliance with all obligations to date and intends to fully comply with the remaining terms of the Consent Order through its expiration in 2028. Under the terms of the Consent Order, Park committed to the following over a five-year period: an investment of at least $7.75 million to increase credit opportunities in majority-black and Hispanic census tracts within the Columbus Lending Area; a minimum of $500,000 for community development partnerships and $750,000 for advertising and consumer education; and to maintain one new full-service branch, one mortgage loan production office, and four specialized mortgage lenders focused on community lending. While Park remains on track to meet these requirements, ongoing compliance requires management attention and the allocation of resources, which may impact financial performance or necessitate changes to business operations and risk management practices.

A significant portion of our loan portfolio is secured by real property. During the ordinary course of business, we foreclose on and take title to properties securing certain loans. In doing so, there is a risk that hazardous or toxic substances could be found on these properties. If hazardous or toxic substances are found, we may be liable for remediation costs, as well as for personal injury and property damage. Environmental laws and evolving regulation may require us to incur substantial expenses and may materially reduce the affected property's value or limit our ability to use or sell the affected property. In addition, future laws and regulations or more stringent interpretations or enforcement policies with respect to existing laws or regulations may increase our exposure to environmental liability. Environmental reviews of real property before initiating foreclosure actions may not be sufficient to detect all potential environmental hazards. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on our business, financial condition and results of operations.

Criminals are committing fraud at an increasing rate and are using more sophisticated techniques. In some cases, these individuals are part of larger criminal rings, which allow them to be more effective. Such fraudulent activity has taken many forms, ranging from wire fraud, debit card fraud, check fraud, mechanical devices attached to ATM machines, social engineering and phishing attacks to obtain personal information, or impersonation of clients through the use of falsified or stolen credentials. Additionally, an individual or business entity may properly identify itself, yet seek to establish a business relationship for the purpose of perpetrating fraud. An emerging type of fraud even involves the creation of synthetic identification in which fraudsters "create" individuals for the purpose of perpetrating fraud. In addition to fraud committed directly against us, we may suffer losses as a result of fraudulent activity committed against third parties. Increased deployment of technologies, such as chip card technology, defray and reduce certain aspects of fraud; however, criminals are turning to other sources to steal personally identifiable information, such as unaffiliated healthcare providers and government entities, in order to impersonate consumers and thereby commit fraud.

We collect, process and store sensitive consumer data by utilizing computer systems and telecommunications networks operated by both us and third-party service providers. Our dependence upon automated systems to record and process our transactions poses the risk that technical system flaws, employee errors, tampering or manipulation of those systems, or attacks by third parties will result in losses and may be difficult to detect. We have security and backup and recovery systems in place, as well as a business continuity plan, to ensure the computer systems will not become inoperable, to the extent possible. We also routinely review documentation of such controls and backups related to third-party service providers. Our inability to use or access these information systems at critical points in time could unfavorably impact the timeliness and efficiency of our business operations. In recent years, several banks have experienced denial of service attacks in which individuals or organizations flood the bank's website with extraordinarily high volumes of traffic, with the goal and effect of disrupting the ability of the bank to process transactions. Other businesses have been victims of ransomware attacks in which the business becomes unable to access its own information and is presented with a demand to pay a ransom in order to once again have access to its information. We could be adversely affected if one of our employees or a third-party service provider causes a significant operational break-down or failure, either as a result of human error or where the individual purposefully sabotages or fraudulently manipulates our operations or systems. We may not be able to prevent employee or third-party errors or misconduct, and the precautions we take to detect this type of activity might prove ineffective. We are further exposed to the risk that the third-party service providers may be unable to fulfill their contractual obligations (or will be subject to the same risks that we are). These disruptions may interfere with service to our customers, cause additional regulatory scrutiny and result in a financial loss or liability. We are also at risk of the impact of natural disasters, terrorism and international hostilities on our systems or for the effects of outages or other failures involving power or communications systems operated by others. In addition, there have been instances where financial institutions have been victims of fraudulent activity in which criminals pose as customers to initiate wire and automated clearinghouse transactions out of customer accounts. Although we have policies and procedures in place to verify the authenticity of our customers, we cannot assure that such policies and procedures will prevent all fraudulent transfers. We have implemented security controls to prevent unauthorized access to our computer systems, and we require that our third-party service providers maintain similar controls. However, Park's management cannot be certain that these measures will be successful. A security breach of the computer systems and loss of confidential information, such as customer account numbers and related information, could result in a loss of customers' confidence and, thus, loss of business. We could also lose revenue if competitors gain access to confidential information about our business operations and use it to compete with us. While we maintain specific "cybersecurity" insurance coverage, which would apply in the event of various breach scenarios, the amount of coverage may not be adequate in any particular case. Furthermore, because cybersecurity threat scenarios are inherently difficult to predict and can take many forms, some breaches may not be covered under our cybersecurity insurance coverage. Further, we may be affected by data breaches at retailers and other third parties who participate in data interchanges with us and our customers that involve the theft of customer credit and debit card data, which may include the theft of our debit card PIN numbers and commercial card information used to make purchases at such retailers and other third parties. Such data breaches could result in us incurring significant expenses to reissue debit cards and cover losses, which could result in a material adverse effect on our results of operations. All of the types of cybersecurity incidents discussed above could result in damage to our reputation, loss of customer business, increased costs of incentives to customers or business partners in order to maintain their relationships, litigation, increased regulatory scrutiny and potential enforcement actions, repairs of system damage, increased investments in cybersecurity (such as obtaining additional technology, making organizational changes, deploying additional personnel, training personnel and engaging consultants), increased insurance premiums, and loss of investor confidence and a reduction in the price of our common shares, all of which could result in financial loss and material adverse effects on our results of operations and financial condition.

In deciding whether to extend credit or enter into other transactions with customers and counterparties, we may rely on information provided to us by customers and counterparties, including financial statements and other financial information. We may also rely on representations of customers and counterparties as to the accuracy and completeness of that information and, with respect to financial statements, on reports of independent auditors. For example, in deciding whether to extend credit to a business, we may assume that the customer's audited financial statements conform with U.S. GAAP and present fairly, in all material respects, the financial condition, results of operations and cash flows of the customer. We may also rely on the audit report covering those financial statements. Our financial condition, results of operations and cash flows could be negatively impacted to the extent that we rely on financial statements that do not comply with U.S. GAAP or on financial statements and other financial information that are materially misleading.

Our success depends, to a certain extent, upon local and national economic and political conditions, as well as governmental fiscal and monetary policies. Conditions such as inflation, recession, unemployment, changes in interest rates, fiscal and monetary policy, an increasing U.S. federal government budget deficit, the failure of the U.S federal government to raise the federal debt ceiling, slowing gross domestic product, tariffs, a U.S. withdrawal from or significant renegotiation of trade agreements, trade wars, and other factors beyond our control may adversely affect our deposit levels and composition, the quality of our assets including investment securities available for purchase and the demand for loans, which, in turn, may adversely affect our earnings and capital. Recent political developments, such as military conflicts in Ukraine, the Middle East, and Venezuela have resulted in substantial changes in economic and political conditions for the U.S. and the remainder of the world. In addition, disruptions in U.S. and global financial markets and changes in oil production in the Middle East affect the economy and stock prices in the U.S., which can affect our earnings and our capital, as well as the ability of our customers to repay loans. Because we have a significant number of real estate loans, decreases in real estate values could adversely affect the value of property used as collateral and our ability to sell the collateral upon foreclosure. Adverse changes in the economy, including those resulting from pandemics, rising inflation, and increases in interest rates, may also have a negative effect on the ability of our borrowers to make timely repayments of their loans, which would have an adverse impact on our earnings and cash flows.