Riverview Bancorp (RVSB) Risk Analysis

The FDIC, the Federal Reserve and the OCC have promulgated joint guidance on sound risk management practices for financial institutions with concentrations in commercial real estate lending. Under this guidance, a financial institution that, like us, is actively involved in commercial real estate lending should perform a risk assessment to identify concentrations. A financial institution may have a concentration in commercial real estate lending if, among other factors (i) total reported loans for construction, land development, and other land represent 100% or more of total capital, or (ii) total reported loans secured by multi-family and non-farm residential properties, loans for construction, land development and other land, and loans otherwise sensitive to the general commercial real estate market, including loans to commercial real estate related entities, represent 300% or more of total capital. Based on these criteria, the Bank has a concentration in commercial real estate lending as total loans for multifamily, non-farm/non-residential, construction, land development and other land represented 321% of total risk-based capital at March 31, 2025. The particular focus of the guidance is on exposure to commercial real estate loans that are dependent on the cash flow from the real estate held as collateral and that are likely to be at greater risk to conditions in the commercial real estate market (as opposed to real estate collateral held as a secondary source of repayment or as an abundance of caution). The purpose of the guidance is to guide banks in developing risk management practices and capital levels commensurate with the level and nature of real estate concentrations. The guidance states that management should employ heightened risk management practices including board and management oversight and strategic planning, development of underwriting standards, risk assessment and monitoring through market analysis and stress testing. While we believe we have implemented policies and procedures with respect to our commercial real estate loan portfolio consistent with this guidance, bank regulators could require us to implement additional policies and procedures consistent with their interpretation of the guidance that may result in additional costs to us.

Substantially all of our loans are to businesses and individuals in southwest Washington and northwest Oregon, particularly within Clark, Klickitat, Skamania, Multnomah, Washington, Marion, and Clackamas counties, including the Portland, Oregon-Vancouver metropolitan area. As a result, our financial performance is closely tied to the economic conditions in this region. A downturn in local or regional economic conditions, due to inflation, rising interest rates, unemployment, recessions, natural disasters, or other adverse events, could materially affect our business, financial condition, and results of operations. Further, global geopolitical tensions, including international conflicts, sanctions, trade disputes, and tariffs, could disrupt key industries within our market, such as manufacturing, agriculture, and transportation. These developments may lead to increased costs, reduced business investment, supply chain delays, or reduced demand for credit, adversely affecting our borrowers and, by extension, our asset quality and loan growth. Additionally, geopolitical instability may heighten cybersecurity threats, including from state-sponsored actors, increasing operational risk and reputational exposure. A downturn in economic conditions in our market areas or global economic disruptions could have a material adverse impact on our business, financial condition, liquidity and results of operations, including but not limited to: - Higher loan delinquencies, problematic assets, and foreclosures - An increase in our ACL for loans - Reduced demand for our products and services, potentially leading to a decline in our overall loans or assets. - Depreciation in collateral values linked to our loans, thereby diminishing borrowing capacities and asset values tied to existing loans. - Reduced net worth and liquidity of loan guarantors, possibly impairing their ability to meet commitments to us - Reductions in our low-cost or noninterest-bearing deposits. A significant portion of the loans in our portfolio are secured by real estate. A downturn in local economic conditions could have a greater impact on our earnings and capital compared to larger financial institutions with more geographically diversified real estate loan portfolios. Any deterioration in the real estate markets associated with the collateral securing mortgage loans may significantly impact borrowers' repayment capabilities and the value of the collateral. Real estate values are affected by a range of factors, including changes in economic conditions, regulatory changes, natural disasters (such as earthquakes, flooding, and tornadoes), and trade-related challenges that may impact construction costs or the availability of materials. If it is necessary to liquidate a significant amount of collateral during a period of reduced real estate values, our financial condition and profitability could be adversely affected.

Our security measures may not be sufficient to mitigate the risk of a cyber-attack. Communications and information systems are essential to the conduct of our business, as we use such systems to manage our client relationships, our general ledger and virtually all other aspects of our business. Our operations rely on the secure processing, storage, and transmission of confidential and other information in our computer systems and networks. Although we take protective measures and endeavor to modify them as circumstances warrant, the security of our computer systems, software, and networks may be vulnerable to breaches, fraudulent or unauthorized access, denial or degradation of service attacks, misuse, computer viruses, malware or other malicious code and cyber-attacks that could have a security impact. If one or more of these events occur, this could jeopardize our or our clients' confidential and other information processed and stored in, and transmitted through, our computer systems and networks, or otherwise cause interruptions or malfunctions in our operations or the operations of our clients or counterparties. We may be required to expend significant additional resources to modify our protective measures or to investigate and remediate vulnerabilities or other exposures, and we may be subject to litigation and financial losses that are either not insured against or not fully covered through any insurance maintained by us. We could also suffer significant reputational damage. Additionally, as our cardholders use debit and credit cards for transactions with third parties or through third-party processing services, we face additional risks from data breaches in their systems or payment processors. Such breaches could expose our account information, leading to liabilities for fraudulent transactions, fines, and higher transaction fees. Breaches may also erode client trust, prompting shifts in payment methods and potential changes to our payment systems, which could incur higher costs. Despite ongoing efforts to enhance our information technology systems and provide employee awareness training, cyber threats remain pervasive, particularly in the financial services industry. We must continuously monitor and fortify our networks and infrastructure to prevent, detect, and address unauthorized access, misuses, computer viruses, and other security risks. While we have not experienced significant breaches, some of our clients may have been affected by third-party breaches, potentially increasing their risks of identity theft and fraud involving their accounts with us. Security breaches in our internet banking activities could further expose us to possible liability and damage our reputation. Increases in criminal activity levels and sophistication, advances in computer capabilities, new discoveries, vulnerabilities in third-party technologies (including browsers and operating systems) or other developments could result in a compromise or breach of the technology, processes and controls that we use to prevent fraudulent transactions and to protect data about us, our clients and underlying transactions. Any compromise of our security could deter clients from using our internet banking services that involve the transmission of confidential information. Although we have developed and continue to invest in systems and processes that are designed to detect and prevent security breaches and cyber-attacks and periodically test our security, these precautions may not protect our systems from compromises or breaches of our security measures, and could result in losses to us or our clients, our loss of business and/or clients, damage to our reputation, the incurrence of additional expenses, disruption to our business, our inability to grow our online services or other businesses, additional regulatory scrutiny or penalties, or our exposure to civil litigation and possible financial liability, any of which could have a material adverse effect on our business, financial condition and results of operations. Our security measures may not protect us from system failures or interruptions. While we have established policies and procedures to prevent or limit the impact of systems failures and interruptions, there can be no assurance that such events will not occur or that they will be adequately addressed if they do. In addition, we outsource certain aspects of our data processing and other operational functions to certain third-party providers. While the Company selects third-party vendors carefully, it does not control their actions. If our third-party providers encounter difficulties, including those resulting from breakdowns or other disruptions in communication services provided by a vendor, failure of a vendor to handle current or higher transaction volumes, cyber-attacks and security breaches or if we otherwise have difficulty in communicating with them, our ability to adequately process and account for transactions could be affected, and our ability to deliver products and services to our clients and otherwise conduct our business operations could be adversely impacted. Replacing these third-party vendors could also entail significant delay and expense. Threats to information security also exist in the processing of client information through various other vendors and their personnel. We cannot assure you that such breaches, failures or interruptions will not occur or, if they do occur, that they will be adequately addressed by us or the third parties on which we rely. We may not be insured against all types of losses as a result of third-party failures and insurance coverage may be inadequate to cover all losses resulting from breaches, system failures or other disruptions. If any of our third-party service providers experience financial, operational or technological difficulties, or if there is any other disruption in our relationships with them, we may be required to identify alternative sources of such services, and we cannot assure that we could negotiate terms that are as favorable to us, or could obtain services with similar functionality as found in our existing systems without the need to expend substantial resources, if at all. Further, the occurrence of any systems failure or interruption could damage our reputation and result in a loss of clients and business, could subject us to additional regulatory scrutiny, or could expose us to legal liability. Any of these occurrences could have a materially adverse effect on our financial condition and results of operations. The board of directors oversees the risk management process, including the risk of cybersecurity, and engages with management on cybersecurity issues.