Texas Capital Bancshares (TCBI) Risk Analysis

Reputational risk, or the risk to earnings and capital from negative public opinion, is inherent in the business. Negative public opinion can result from the actual or perceived manner in which the Company conducts its business activities; management of actual or potential conflicts of interest and ethical issues; protection of confidential client information; and public scrutiny related to environmental, social and governance issues. The Company's brand and reputation may also be harmed by actions taken by third parties that it contracts with to provide services to the extent such parties fail to meet their contractual, legal and regulatory obligations or act in a manner that is harmful to clients. If the Company fails to supervise these relationships effectively, it could also be subject to regulatory enforcement, including fines and penalties. Negative public opinion can adversely affect the Company's ability to keep and attract clients and can expose it to litigation and regulatory action. The Company takes steps to minimize reputation risk, but its efforts may not be sufficient.

Customers and other parties the Company engage with may, on a regular basis, assert claims and take legal action against the Company and the Company regularly takes legal action to collect unpaid borrowers' obligations, realize on collateral and assert rights in commercial and other contexts. These actions frequently result in counter claims against the Company. Litigation arises in a variety of contexts, including lending activities, employment practices, commercial agreements, fiduciary responsibility related to wealth management services, intellectual property rights and other general business and banking matters. Claims and legal actions may result in significant legal costs to defend or assert rights and may result in reputational damage that adversely affects existing and future customer relationships. If claims and legal actions are not resolved in a favorable manner, the Company may suffer significant financial liability or adverse effects on its reputation, which could have a material adverse effect on the business, financial condition, results of operations or profitability. See Legal Proceedings below for additional disclosures regarding legal proceedings. The Company purchases insurance coverage to mitigate a wide range of risks. There is no assurance that insurance will be adequate to protect the Company against material losses in excess of coverage limits or that insurers will perform their obligations under policies without attempting to limit or exclude coverage. The Company could be required to pursue legal actions against insurers to obtain payment of amounts owed, and there is no assurance that such actions, if pursued, would be successful.

A significant portion of the loan portfolio is secured by real property. During the ordinary course of business, the Company may foreclose on and take title to properties securing certain loans. There is a risk that hazardous or toxic substances could be found on these properties, and that the Company may be liable for remediation costs, including personal injury and property damage. Environmental laws may require incurring substantial expenses and may materially reduce the affected property's value by limiting the ability to use or sell it. Although the Company has policies and procedures requiring environmental review before initiating any foreclosure action on real property, these reviews may not be sufficient to detect all potential environmental hazards. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on financial condition, results of operations and profitability. Future laws or regulations or more stringent interpretations or enforcement policies with respect to existing laws and regulations may increase the Company's exposure to environmental liability.

The Company's success depends to a significant extent upon its ability to attract, develop and retain experienced personnel in each of its lines of business and markets including managers in operational areas, compliance and other support areas to build and maintain the infrastructure and controls required to support continuing growth. Competition for the best people in the industry can be intense, and there is no assurance that the Company will continue to attract or retain talent or develop personnel. Factors that affect its ability to attract, develop and retain key employees include compensation and benefits programs, profitability, ability to establish appropriate succession plans for key talent, reputation for rewarding and promoting qualified employees and market competition for employees with certain skills, including information systems development and security. The cost of employee compensation is a significant portion of operating expenses and can materially impact results of operations or profitability, especially during periods of wage inflation. The unanticipated loss of the services of key personnel could have an adverse effect on the business.

The DIF is funded by fees assessed on insured depository institutions including the Bank. Future deposit premiums paid by the Bank depend on FDIC rules, which are subject to change, the level of the DIF and the magnitude and cost of future bank failures. The FDIC may further increase the assessment rates or impose additional special assessments in the future, which may require the Bank to pay significantly higher FDIC premiums. Other Risks Affecting the Business

The Company, its vendors and customers all rely heavily on communications and information systems to conduct their respective businesses, store sensitive data and work effectively together. The financial services industry is undergoing rapid technological changes with frequent introductions of new technology-driven products and services, which in turn create further dependencies on critical third-party service providers and vendors. Communications and information systems and those of the Company's vendors and customers remain vulnerable to unexpected disruptions, failures and cyber-attacks. Any disruptions, failures or breaches in security of these systems could result in significant disruption to the Company's operations. Information security breaches and cyber-security-related incidents include, but are not limited to, attempts to access information, theft of information, credentials or other intellectual property, including customer and company information, malicious code, computer viruses and denial of service attacks that could result in unauthorized access, data breaches resulting in misuse, loss or destruction of data (including confidential customer and employee information), ransomware attacks, account takeovers, unavailability of service or other events. These types of threats may derive from human error, fraud or malice on the part of external or internal parties or may result from accidental technological failure. The risk, frequency and intensity of such attacks is escalating, including as a result of remote working arrangements, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication of these threats. Material failures or interruptions of these systems could impair the Company's ability to serve customers and to operate the business and could damage the Company's reputation, result in a loss of business, subject the Company or the Bank to additional regulatory scrutiny or enforcement or exposure to civil litigation, criminal penalties or financial liability. While the Company has developed extensive recovery plans, the Company cannot assure that those plans will be effective to prevent adverse effects resulting from system failures. The use of the Company's cloud technologies is also critical to the operation of systems, and its reliance on cloud technologies is growing. Service disruptions in cloud technologies may lead to delays in accessing, or the loss of, data that is important to the businesses and may hinder clients' access to products and services. The Company collects and stores sensitive data, including personally identifiable information of its customers and employees and in the ordinary course of business must allow certain vendors access to that data. Breaches of the systems or vendors' or customers' systems, thefts of data and other breaches and criminal activity result in significant costs to respond or remediate losses if the Company or its vendors are at fault, damage to the Company's customer relationships, regulatory scrutiny and enforcement and loss of future business opportunities due to reputational damage. Even the most well-protected information, networks, systems and facilities remain potentially vulnerable because attempted security breaches, particularly cyber-attacks and intrusions, or disruptions have occurred and will occur in the future, and because the techniques used in such attempts are rapidly and constantly evolving and may not be recognized until launched, can originate from a wide variety of sources, including the Company's own employees, cyber-criminals, "hacktivists" (i.e., individuals or groups that use technology to promote a political agenda or social change), groups linked to terrorist organizations or hostile countries, or third parties whose objective is to disrupt the operations of financial institutions more generally, and in some cases are designed not to be detected and, in fact, may not be detected for a period of time or at all. The Company does not have control over the cybersecurity of the systems of the large number of clients, customers, counterparties and third-party service providers with which it does business, and it is possible that a third party, after establishing a foothold on an internal network without being detected, might obtain access to other networks and systems. Accordingly, the Company may be unable to anticipate or be prepared for these techniques or to implement adequate security barriers or other preventative measures, and thus it is impossible for the Company to entirely mitigate this risk. Breaches are generally perpetrated by unknown third parties, but could also be facilitated by employees either inadvertently or by consciously attempting to create disruption or certain acts of fraud. The Company's customers and employees have been, and will continue to be, targeted by parties using fraudulent e-mails and other communications in attempts to misappropriate passwords, bank account information or other personal information or to introduce viruses or other malware through "Trojan horse" programs to the Company's information systems, the information systems of merchants or third-party service providers and/or customers' computers. Although the Company, with the help of third-party service providers, will continue to implement information security technology solutions and establish operational procedures to address such attacks and breaches, and protect sensitive data, there can be no assurance that these measures will be effective. The Company advises, or alerts and provides some guidance to customers and evaluates and imposes security requirements on vendors regarding protection of their respective information systems, but there is no assurance that these actions have had or will have the intended positive effects or will be effective to prevent losses or attacks. Successful cyber-attacks on the Company, vendors or customers may affect the Company's reputation, and failure to meet customer expectations could have a material impact on the Company's ability to attract and retain deposits as a primary source of funding. A security breach or other significant disruption of information systems or those related to customers, merchants and third-party vendors, including as a result of cyber-attacks, could (i) disrupt the proper functioning of networks and systems and therefore the operations and/or those of certain customers; (ii) result in the unauthorized access to, and destruction, loss, theft, misappropriation or release of confidential, sensitive or otherwise valuable information; (iii) result in a violation of applicable privacy, data breach and other laws, subjecting the Company to additional regulatory scrutiny and exposure to civil litigation, criminal penalties, governmental fines or financial liability; (iv) require significant management attention and resources to respond, remediate or remedy the damages that result; or (v) harm the reputation or cause a decrease in the number of customers that choose to do business with the Company. The risk of a security breach due to a cyber-attack could increase in the future due to factors such as: the Company's ongoing expansion of its mobile and digital banking and other internet-based product offerings and its internal use of internet-based products and applications and the increased use of remote access to facilitate remote arrangements for employees, vendors and other third parties. In addition, a third party could misappropriate confidential information obtained by intercepting signals or communications from mobile devices used by the Company's employees. A successful penetration or circumvention of the security of the Company's systems or the systems of a vendor, governmental body or another market participant could cause serious negative consequences, including: significant disruption of the Company's operations and those of its clients, customers and counterparties, including losing access to operational systems, misappropriation of confidential information of the Company or that of its clients, customers, counterparties, employees or regulators, disruption of or damage to the Company's systems and those of its clients, customers and counterparties, the inability, or extended delays in the ability, to fully recover and restore data that has been stolen, manipulated or destroyed, or the inability to prevent systems from processing fraudulent transactions, allegations or violations by the Company of applicable privacy and other laws, financial loss to the Company or to its clients, customers, counterparties or employees, loss of confidence in the Company's cybersecurity and business resiliency measures, dissatisfaction among the Company's clients, customers or counterparties, significant exposure to litigation and regulatory fines, penalties or other sanctions, and harm to the Company's reputation. The extent of a particular cyber-attack and the steps that the Company may need to take to investigate the attack may not be immediately clear, and it may take a significant amount of time before such an investigation or determination, judicial or otherwise, can be completed. While such an investigation is ongoing, the Company may not necessarily know the full extent of the harm caused by the cyber-attack, and that damage may continue to spread. These factors may inhibit the Company's ability to provide rapid, full and reliable information about the cyber-attack to its clients, customers, counterparties and regulators, and the public. Furthermore, it may not be clear how best to contain and remediate the harm caused by the cyber-attack, and certain errors or actions could be repeated or compounded before they are discovered and remediated. Any or all of these factors could further increase the costs and consequences of a cyber-attack. The occurrence of any of the foregoing could have a material adverse effect on the business, financial condition, results of operations or profitability.

Severe weather, earthquakes, other natural disasters, pandemics, climate change, acts of war or terrorism and other adverse external events could have a significant impact on the Company's ability to conduct business. Such events could affect the stability of its deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue, cause us to incur additional expenses or disrupt the Company's operations. In recent years, hurricanes have caused extensive flooding and destruction along the coastal areas of Texas and in other areas in the U.S., including communities where the Company conducts business. Climate change has the potential to increase the frequency and severity of these severe weather events in the future. Although management has established disaster recovery policies and procedures, the occurrence of any such events could have a material adverse effect on the business, financial condition, results of operations or profitability. Furthermore, legislative and regulatory initiatives related to climate change have the potential to disrupt the business and result in operational changes and expenditures that could significantly impact the business and the operations and creditworthiness of the Company's clients and also increase the compliance burden on the Company.