Provident Financial Holdings (PROV) Risk Analysis

We recognize deferred tax assets and liabilities based on differences between the financial statement carrying amounts and the tax basis of assets and liabilities. At June 30, 2025, the net deferred tax liability was approximately $832,000, as opposed to the net deferred tax asset of $606,000 at the prior fiscal year end. The net deferred tax asset or liability results primarily from (1) deferred loan costs, (2) provision for credit losses recorded for financial reporting purposes, which were in the past significantly larger than net loan charge-offs deducted for tax reporting purposes and (3) deferred compensation, among others. We regularly review our deferred tax assets for recoverability based on our history of earnings, expectations for future earnings and expected timing of reversals of temporary differences. Realization of deferred tax assets ultimately depends on the existence of sufficient taxable income, including taxable income in prior carryback years, as well as future taxable income. We believe the recorded net deferred tax liability at June 30, 2025 is fully realizable based on our expected future earnings; however, expected future earnings may not be realized, which could impact the deductibility of our deferred tax assets.

The effects of climate change continue to raise significant concerns about the state of the environment. However, under the current administration, federal policy has shifted to reduce emphasis on climate change initiatives and environmental regulations. This includes scaling back federal involvement in international agreements like the Paris Agreement and easing regulatory pressures on businesses, including banks, to address climate-related risks. Legislative and regulatory proposals aimed at combating climate change may face increased scrutiny or reduced priority under this administration. The lack of empirical data regarding the financial and credit risks posed by climate change still makes it difficult to predict its specific impact on our financial condition and results of operations. However, the physical effects of climate change,such as more frequent and severe weather disasters, could directly affect us. For instance, such events may damage real property securing loans in our portfolios or reduce the value of that collateral. If our borrowers' insurance is insufficient to cover these losses or if insurance becomes unavailable, the value of the collateral securing our loans could be negatively affected, potentially impacting our financial condition and results of operations. Moreover, climate change may adversely affect regional and local economic activity, harming our customers and the communities in which we operate. Regardless of changes in federal policy, the effects of climate change and their unknown long-term impacts could still have a material adverse effect on our financial condition and results of operations.

Since our geographic concentration is in California, we are subject to earthquakes, fires, mudslides, droughts and other natural disasters. A major earthquake or other natural disaster may disrupt our business operations for an indefinite period of time and could result in material losses, although we have not experienced any losses in many years as a result of earthquake damage or other natural disaster. Although we are in an earthquake prone area, we and other lenders in the market area may not require earthquake insurance as a condition of making a loan. In addition to possibly sustaining damage to our own properties, if there is a major earthquake, fire, mudslide, or other natural disaster, we face the risk that many of our borrowers may experience uninsured property losses, or sustained job interruption and/or loss which may materially impair their ability to meet the terms of their loan obligations.

The financial services market is undergoing rapid changes with frequent introductions of new technology-driven products and services. Our future success will depend, in part, on our ability to keep pace with the technological changes and to use technology to satisfy and grow customer demand for our products and services and to create additional efficiencies in our operations. We expect that we will need to make substantial investments in our technology and information systems to compete effectively and to stay current with technological changes. Some of our competitors have substantially greater resources to invest in technological improvements and will be able to invest more heavily in developing and adopting new technologies, which may put us at a competitive disadvantage. We may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers. As a result, our ability to effectively compete to retain or acquire new business may be impaired, and our business, financial condition or results of operations may be adversely affected.

Our security measures may not be sufficient to mitigate the risk of a cyber attack. Communications and information systems are essential to the conduct of our business, as we use such systems to manage our customer relationships, our general ledger and virtually all other aspects of our business. Our operations rely on the secure processing, storage, and transmission of confidential and other information in our computer systems and networks. Although we take protective measures and endeavor to modify them as circumstances warrant, the security of our computer systems, software, and networks may be vulnerable to breaches, fraudulent or unauthorized access, denial or degradation of service attacks, misuse, computer viruses, malware or other malicious code and cyber-attacks that could have a security impact. We may be required to expend significant additional resources to modify our protective measures or to investigate and remediate vulnerabilities or other exposures, and we may be subject to litigation and financial losses that are either not insured against or not fully covered through any insurance maintained by us. We could also suffer significant reputational damage. Further, our cardholders use their debit and credit cards to make purchases from third parties or through third party processing services. As such, we are subject to risk from data breaches of such third party's information systems or their payment processors. Such a data security breach could compromise our customer's account information. The payment methods that we offer also subject us to potential fraud and theft by criminals, who are becoming increasingly more sophisticated, seeking to obtain unauthorized access to or exploit weaknesses that may exist in the payment systems. If we fail to comply with applicable rules or requirements for the payment methods we accept, or if payment-related data is compromised due to a breach or misuse of data, we may be liable for losses associated with reimbursing our customers for such fraudulent transactions on customers' card accounts, as well as costs incurred by payment card issuing banks and other third parties or may be subject to fines and higher transaction fees, or our ability to accept or facilitate certain types of payments may be impaired. We may also incur other costs related to data security breaches, such as replacing cards associated with compromised card accounts or credit monitoring services. In addition, our customers could lose confidence in certain payment types, which may result in a shift to other payment types or potential changes to our payment systems that may result in higher costs. Breaches of information security may also occur through intentional or unintentional acts by those having access to our systems, our customers' or counterparties' confidential information, including employees. We are continuously working to install new, and upgrade our existing, information technology systems and provide employee awareness training around ransomware, phishing, malware, and other cyber risks to further protect the Corporation against cyber risks and security breaches. There continues to be a rise in electronic fraudulent activity, security breaches and cyber-attacks within the financial services industry, especially in the commercial banking sector due to cyber criminals targeting commercial bank accounts. We are regularly the target of attempted cyber and other security threats and must continuously monitor and develop our information technology networks and infrastructure to prevent, detect, address and mitigate the risk of unauthorized access, misuse, computer viruses and other events that could have a security impact. Insider or employee cyber and security threats are increasingly a concern for companies, including ours. We are not aware that we have experienced any material misappropriation, loss or other unauthorized disclosure of confidential or personally identifiable information as a result of a cyber-security breach or other act, however, some of our customers may have been affected by these breaches, which could increase their risks of identity theft, debit and card fraud and other fraudulent activity that could involve their accounts with us. Security breaches in our internet banking activities could further expose us to possible liability and damage our reputation. Increases in criminal activity levels and sophistication, advances in computer capabilities, new discoveries, vulnerabilities in third party technologies (including browsers and operating systems) or other developments could result in a compromise or breach of the technology, processes and controls that we use to prevent fraudulent transactions and to protect data about us, our customers and underlying transactions. Any compromise of our security could deter customers from using our internet banking services that involve the transmission of confidential information. We rely on internet security systems to provide the security and authentication necessary to effect secure transmission of data. Although we have developed and continue to invest in systems and processes that are designed to detect and prevent security breaches and cyber-attacks and periodically test our security, these precautions may not protect our systems from compromises or breaches of our security measures, and could result in losses to us or our customers, our loss of business and/or customers, damage to our reputation, the incurrence of additional expenses, disruption to our business, our inability to grow our online services or other businesses, additional regulatory scrutiny or penalties, or our exposure to civil litigation and possible financial liability, any of which could have a material adverse effect on our business, financial condition and results of operations. Our security measures may not protect us from system failures or interruptions. While we have established policies and procedures to prevent or limit the impact of systems failures and interruptions, there can be no assurance that such events will not occur or that they will be adequately addressed if they do. In addition, we outsource certain aspects of our data processing and other operational functions to certain third-party providers. While we select our third-party vendors carefully, we do not control their actions. If our third-party providers encounter difficulties including those resulting from breakdowns or other disruptions in communication services provided by a vendor, failure of a vendor to handle current or higher transaction volumes, cyber-attacks and security breaches or if we otherwise have difficulty in communicating with them, our ability to adequately process and account for transactions could be affected, and our ability to deliver products and services to our customers and otherwise conduct business operations could be adversely impacted. Replacing these third-party vendors could also entail significant delays and expense. Threats to information security also exist in the processing of customer information through various other vendors and their personnel. We cannot ensure that such breaches, failures or interruptions will not occur or, if they do occur, that they will be adequately addressed by us or the third parties on which we rely. We may not be insured against all types of losses as a result of third party failures and insurance coverage may be inadequate to cover all losses resulting from breaches, system failures or other disruptions. If any of our third-party service providers experience financial, operational or technological difficulties, or if there is any other disruption in our relationships with them, we may be required to identify alternative sources of such services, and we cannot assure that we could negotiate terms that are as favorable to us, or could obtain services with similar functionality as found in our existing systems without the need to expend substantial resources, if at all. Further, the occurrence of any systems failure or interruption could damage our reputation and result in a loss of customers and business, could subject us to additional regulatory scrutiny, or could expose us to legal liability. Any of these occurrences could have a material adverse effect on our financial condition and results of operations.

We rely on numerous external vendors to provide products and services necessary for our day-to-day operations. Accordingly, our operations are exposed to risk that these vendors will not perform in accordance with the contracted arrangements under service level agreements. If a vendor fails to meet its contractual obligations due to changes in its organizational structure, financial condition, support for existing products and services, strategic focus, or any other reason, our operations could be disrupted, potentially causing a material adverse impact on our financial condition and results of operations. Furthermore, we could be adversely affected if a vendor agreement is not renewed or is renewed on terms less favorable to us. Regulatory agencies also require financial institutions to remain accountable for all aspects of vendor performance, including activities delegated to third parties. Additionally, disruptions or failures in the physical infrastructure or operating systems supporting our business and customers, or cyber-attacks or security breaches involving networks, systems, or devices used by our customers to access our products and services, could result in customer attrition, regulatory fines or penalties, reputational damage, reimbursement or compensation costs, and increased compliance expenses. Any of these outcomes could materially and adversely affect our financial condition and results of operations.

Threats to our reputation can come from many sources, including adverse sentiment about financial institutions generally, unethical practices, employee misconduct, failure to deliver minimum standards of service or quality, compliance deficiencies, and questionable or fraudulent activities of our customers. We have policies and procedures in place to protect our reputation and promote ethical conduct, but these policies and procedures may not be fully effective. Negative publicity regarding our business, employees, or customers, with or without merit, may result in the loss of customers, investors and employees, costly litigation, a decline in revenues and increased governmental regulation.