1St Source (SRCE) Risk Analysis

- Federal and state legislatures and regulatory agencies continue to propose and advance numerous legislative and regulatory initiatives seeking to mitigate the effects of climate change. As a financial institution, it is unclear how future governmental regulations and shifts in business trends resulting from increased concern about climate change will affect our operations, however, natural or man-made disasters and severe weather events may cause operational disruptions and damage to both our properties and properties securing our loans. Losses resulting from these disasters and severe weather events may make it more difficult for borrowers to timely repay their loans. Additionally, our customers who finance vehicles and equipment reliant on fossil fuels could face cost increases, asset value reductions, operating process changes, and the like. If these events occur, we may experience a decrease in the value of our loan and lease portfolio and our revenue, and may incur additional operational expenses, each of which could have a material adverse effect on our financial condition and results of operations.

- The banking and financial services business is highly competitive. We face competition in making loans and leases, attracting deposits and providing insurance, investment, trust and wealth advisory, and other financial services. Increased competition in the banking and financial services businesses may reduce our market share, impair our growth or cause the prices we charge for our services to decline. Our results of operations may be adversely impacted in future periods depending upon the level and nature of competition we encounter in our various market areas.

- As a financial institution, we are susceptible to fraudulent activity rendered against us or our customers that may result in financial loss, increased costs, privacy breaches, misappropriation of assets, litigation, or damage to our reputation. These acts may take many forms including check fraud, wire fraud, phishing, social engineering, and other dishonest proceedings. There have been instances where banks have been victims of fraudulent activity in which criminals pose as customers to initiate wire and automated clearinghouse transactions out of customer accounts. Although we have policies and procedures in place to verify the authenticity of our customers, we cannot assure that such policies and procedures will prevent all fraudulent transfers.

- Threats to our reputation can come from many sources, including adverse sentiment about financial institutions generally, unethical practices, employee misconduct, failure to deliver minimum standards of service or quality, data security failures, compliance deficiencies, and questionable or fraudulent activities of our customers. We have policies and procedures in place that seek to protect our reputation and promote ethical conduct. Nonetheless, negative publicity may arise regarding our business, employees, or customers, with or without merit, and could result in the loss of customers, investors, or employees, costly litigation, a decline in revenues, increased government regulation, and could adversely affect the trading price of our shares.

- Information security risks have increased due to the sophistication and activities of organized crime, hackers, terrorists and other external parties and the use of online, telephone, and mobile banking channels by clients. Any compromise of our security could impair our reputation and deter our clients from using our banking services. Information security breaches can also disrupt the operation of information systems on which we depend, adversely affecting our business operations. Such events can result in costly remediation measures and litigation or governmental investigation and responding to security breaches can place unanticipated demands on the time and attention of management. We rely on security systems to provide the protection and authentication necessary to secure transmission of data against damage by theft, fire, power loss, telecommunications failure or a similar catastrophic event, as well as from security breaches, ransomware, denial of service attacks, viruses, worms, use of artificial intelligence (AI) and other disruptive problems caused by hackers. Computer break-ins, phishing and other disruptions of customer or vendor systems could also jeopardize the security of information stored in and transmitted through our computer systems and network infrastructure. We maintain a cyber insurance policy that is designed to cover a majority of loss resulting from cyber security breaches, but there is no assurance such coverage or other protective measures we employ will be adequate to address all potential material adverse impacts. We also confront the risk of being compromised by emails sent by perpetrators posing as company executives or vendors in order to dupe company personnel into sending large sums of money to accounts controlled by the perpetrators. We require all our employees to complete annual information security awareness training to increase their awareness of these risks and to engage them in our mitigation efforts. If these precautions are not sufficient to protect our systems from data breaches or compromises, our reputation and business could be adversely affected. We depend on the services of a variety of third-party vendors to meet data processing and communication needs and we have contracted with third parties to run their proprietary software on our behalf. While we perform reviews of security controls instituted by the vendor in accordance with industry standards and institute our own internal security controls, we rely on continued maintenance of the controls by the outside party to safeguard our customer data. Additionally, we issue debit cards which are susceptible to compromise at the point of sale via the physical terminal through which transactions are processed and by other means of hacking. The security and integrity of these transactions are dependent upon the retailers' vigilance and willingness to invest in technology and upgrades. Issuing debit cards to our clients exposes us to potential losses which, in the event of a data breach at one or more major retailers may adversely affect our business, financial condition, and results of operations. Furthermore, there continues to be heightened legislative and regulatory focus on privacy, data protection and information security. New or revised laws and regulations may significantly impact our current and planned privacy, data protection and information security-related practices, the collection, use, sharing, retention and safeguarding of consumer and employee information, and current or planned business activities. Compliance with current or future privacy, data protection and information security laws could result in higher compliance and technology costs and could restrict our ability to provide certain products and services, which could have an adverse effect on our business, financial condition and results of operations.

- The financial services industry is constantly undergoing rapid technological change with frequent introductions of new technology-driven products and services, including innovative ways that customers can make payments or manage their accounts, such as through the use of mobile payments, digital wallets or digital currencies. In recent years, competition has increased from institutions not subject to the same regulatory restrictions as domestic banks and holding companies, including financial technology companies, or ‘fintechs,' which may offer bank-like products or services that compete directly with the Company's products and services. Our future success depends, in part, upon our ability to address the needs of our clients competitively by using technology to provide products and services that will satisfy client demands, as well as create additional efficiencies within our operations. Many of our large competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology-driven products and services quickly or be successful in marketing these products and services to our clients. In addition, our implementation of certain new technologies, such as those related to AI, automation and algorithms, in our business processes may have unintended consequences due to their limitations or our failure to use them effectively. Failure to successfully keep pace with technological change affecting the financial services industry could have a material adverse impact on our business and, in turn, our financial condition and results of operations. We are in the early stages of incorporating AI into our business activities to increase employee productivity. We have not yet deployed AI-driven systems in critical decision-making or client-facing processes. Our vendors or third parties may develop or incorporate AI technology in certain business processes, services, or products. Any reliance on AI presents a number of risks and challenges to our business. Furthermore, the legal and regulatory landscape impacting new technologies such as AI is evolving rapidly, and the inability to predict how this regulation will take shape and the absence of a uniform regulatory framework for AI may present unforeseen challenges in applying and relying on existing compliance systems. Complying with existing and new AI and data usage laws, and inconsistencies in regulation from jurisdiction to jurisdiction, could increase expenses and exposure to legal or regulatory proceedings.

- Our future success and profitability is substantially dependent upon our management and the banking acumen of our senior executives and other key personnel. We believe that our future results will also depend in part upon our ability to attract and retain highly skilled and qualified management. We are especially dependent on a limited number of key management personnel, many of whom do not have employment agreements with us. The loss of the chief executive officer and other senior management and key personnel could have a material adverse impact on our operations because other officers may not have the experience and expertise to readily replace these individuals. Many of these senior officers have primary contact with our clients and are important in maintaining personal relationships with our client base. The unexpected loss of services of one or more of these key employees could have a material adverse effect on our operations and possibly result in reduced revenues if we were unable to find suitable replacements promptly. Competition for senior personnel is intense, and we may not be successful in attracting and retaining such personnel. Changes in key personnel and their responsibilities may be disruptive to our businesses and could have a material adverse effect on our businesses, financial condition, and results of operations.