Trustmark (TRMK) Risk Analysis

Trustmark has been named from time to time as a defendant in litigation relating to its businesses and activities. Litigation may include claims for substantial compensatory or punitive damages or claims for indeterminate amounts of damages. In recent years, a number of judicial decisions have upheld the right of borrowers to sue lending institutions on the basis of various evolving legal theories, collectively termed "lender liability." Generally, lender liability is founded on the premise that a lender has either violated a duty, whether implied or contractual, of good faith and fair dealing owed to the borrower or has assumed a degree of control over the borrower resulting in the creation of a fiduciary duty owed to the borrower or its other creditors or shareholders. Substantial legal liability against Trustmark, including its subsidiaries, could materially adversely affect Trustmark's business, financial condition or results of operations, or cause significant harm to its reputation.

Stakeholders' expectations regarding ESG practices, as well as climate-related legislative and regulatory initiatives, continue to evolve. Institutional investors, and investor advocacy groups, in particular, are increasingly focused on these matters and expectations in many of these areas can vary widely. In addition, increased ESG related compliance costs could result in increases to Trustmark's overall operational costs. Failure to adapt to or comply with regulatory requirements or investor or stakeholder expectations and standards, and fluctuations in these standards, could negatively impact Trustmark's reputation, ability to do business with certain partners and its stock price. New government regulations (including at the state level) could also result in new or more stringent forms of ESG oversight and expanding mandatory and voluntary reporting, diligence and disclosure. Consumers and businesses also may change their behavior on their own as a result of these concerns. It is not possible to predict how climate change may impact Trustmark's financial condition and operations; however, Trustmark operates in areas where its business and the activities of its customers could be impacted by the effects of climate change. The effects of climate change may include increased frequency or severity of weather-related events, such as severe storms, hurricanes, flooding and droughts and rising sea levels. These effects can disrupt business operations, damage property, devalue assets and change customer and business preferences, which may adversely affect borrowers, increase credit risk and reduce demand for Trustmark's products and services. Trustmark and its customers may need to respond to new laws and regulations as well as consumer and business preferences resulting from climate change concerns. Trustmark and its customers may face cost increases, asset value reductions, operating process changes and the like. The impact to Trustmark's customers will likely vary depending on their specific attributes, including reliance on or role in carbon intensive activities. In addition, Trustmark could face reductions in creditworthiness on the part of some customers or in the value of assets securing loans. Trustmark's efforts to take these risks into account may not be effective in protecting it from the negative impact of regulatory initiatives or changes in consumer or business behavior and could have a material adverse effect on Trustmark's financial condition and results of operations.

The performance of a bank under the CRA in meeting the credit needs of its community is a factor that must be taken into consideration when the federal banking agencies evaluate applications related to mergers and acquisitions, as well as branch opening and relocations. As of its last examination, TB received a CRA rating of "Outstanding," which represented an improvement from its previous CRA rating of "Needs to Improve." TB's failure to maintain at least a "Satisfactory" CRA rating in the future could adversely affect its ability to complete the acquisition of another financial institution or open a new branch. If TB were to receive an overall CRA rating of less than "Satisfactory" in the future, the FRB would not re-evaluate the CRA rating until TB's next CRA examination, which may not occur for several years. It is possible that a low CRA rating would not improve in the future.

Trustmark is dependent upon communications and information systems to conduct business as such systems are used to manage virtually all aspects of Trustmark's business. Trustmark's operations rely on the secure processing, storage and transmission of confidential and other information within its computer systems and networks. Any failure, interruption or breach in security of these systems could result in significant disruption to Trustmark's operations. Trustmark has taken protective measures, which are continuously monitored and modified as warranted; however, Trustmark's computer systems, software and networks may fail to operate properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond Trustmark's control. There could be sudden increases in customer transaction volume; electrical, telecommunications or other major physical infrastructure outages; natural disasters; and events arising from local or larger scale political or social matters, including terrorist acts. Further, Trustmark's operational and security systems and infrastructure may be vulnerable to breaches and cybersecurity-related incidents including, but not limited to, attempts to access information, including customer and company information, malicious code, computer viruses and denial of service attacks that could result in unauthorized access, theft, misuse, loss, release or destruction of data (including confidential customer information), account takeovers, unavailability of service or other events. These types of threats may derive from human error, fraud or malice on the part of external or internal parties, or may result from accidental technological failure. If one or more of these events were to occur, Trustmark's or its customers' confidential and other information would be jeopardized, or such an event could cause interruptions or malfunctions in Trustmark's or its customers' or counterparties' operations. Any failures related to upgrades and maintenance of Trustmark's technology and information systems could further increase its information and system security risk. Trustmark's increased use of cloud and other technologies, such as remote work technologies, also increases its risk of being subject to a cyber-attack. The risk of a security breach or disruption, particularly through cyber-attack or cyber intrusion, has increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. Trustmark may be required to expend significant additional resources to modify its protective measures or to investigate and remediate vulnerabilities or other exposures in its computer systems and networks, and Trustmark may be subject to litigation and financial losses that are either not insured against or not fully covered through any insurance maintained by Trustmark. Any such losses, which may be difficult to detect, could adversely affect Trustmark's financial condition or results of operations. In addition, the occurrence of such a loss could expose Trustmark to reputational risk, the loss of customer business and additional regulatory scrutiny. Security breaches in Trustmark's internet and mobile banking activities (myTrustmark) could further expose Trustmark to possible liability and reputational risk. Any compromise in security could deter customers from using Trustmark's internet and mobile banking services that involve the transmission of confidential information. Trustmark relies on standard internet security systems to provide the security and authentication necessary to effect secure transmission of data. However, these precautions may not protect Trustmark's systems from compromise or breaches of security, which could result in significant legal liability and significant damage to Trustmark's reputation and business. Trustmark relies upon certain third-party vendors to provide products and services necessary to maintain day-to-day operations. Accordingly, Trustmark's operations are exposed to the risk that these vendors might not perform in accordance with applicable contractual arrangements or service level agreements or that the security of the third-party vendors' computer systems, software and networks may be vulnerable to compromises that could impact information system security. Trustmark maintains a system of policies and procedures designed to monitor vendor risks. While Trustmark believes these policies and procedures effectively mitigate risk, the failure of an external vendor to perform in accordance with applicable contractual arrangements or service level agreements or any compromise in the security of an external vendor's information systems could be disruptive to Trustmark's operations, which could have a material adverse effect on its financial condition or results of operations. As of the date of this Annual Report on Form 10-K, Trustmark has seen no material adverse impact on its business or operations from cyber-attacks or events. Trustmark's customers, employees and third parties that it does business with have been, and will continue to be, targeted by parties using fraudulent e-mails and other communications in attempts to misappropriate passwords, bank account information or other personal information or to introduce viruses or other malware programs to its information systems, the information systems of its merchants or third-party service providers and/or its customers' personal devices, which are beyond Trustmark's security control systems. Though Trustmark endeavors to mitigate these threats through product improvements, use of encryption and authentication technology and customer and employee education, such cyber-attacks against Trustmark, its merchants, third-party service providers and customers remain a serious issue and have been successful in the past. Although Trustmark makes significant efforts to maintain the security and integrity of its information systems and has implemented various measures to manage the risks of a security breach or disruption, there can be no assurance that its security efforts and measures will be effective or that attempted security breaches or disruptions would not be successful or damaging. Even well protected information, networks, systems and facilities remain potentially vulnerable to attempted security breaches or disruptions because the techniques used in such attempts are constantly evolving and generally are not recognized until launched against a target, and in some cases are designed not to be detected and, in fact, may not be detected. Accordingly, Trustmark may be unable to anticipate these techniques or to implement adequate security barriers or other preventative measures, and thus it is virtually impossible for Trustmark to entirely mitigate this risk. Furthermore, in the event of a cyber-attack, Trustmark may be delayed in identifying or responding to the attack, which could increase the negative impact of the cyber-attack on its business, financial condition and results of operations. A security breach or other significant disruption of Trustmark's information systems or those related to its customers, merchants or third-party vendors, including as a result of cyber-attacks, could (i) disrupt the proper functioning of its networks and systems and therefore its operations and/or those of its customers; (ii) result in the unauthorized access to, and destruction, loss, theft, misappropriation or release of confidential, sensitive or otherwise valuable information of Trustmark or its customers; (iii) result in a violation of applicable privacy, data breach and other laws, subjecting Trustmark to additional regulatory scrutiny and exposing it to civil litigation, enforcement actions, governmental fines and possible financial liability; (iv) require significant management attention and resources to remedy the damages that result; or (v) harm Trustmark's reputation or cause a decrease in the number of customers that choose to do business with Trustmark. The occurrence of any of the foregoing could have a material adverse effect on Trustmark's business, financial condition and results of operations.

Trustmark faces substantial competition in all areas of its operations from a variety of different competitors, many of which are larger and may have greater financial resources. Such competitors primarily include banks, as well as community banks operating nationwide and regionally within the various markets in which Trustmark operates. Trustmark also faces competition from many other types of financial institutions, including savings and loans, credit unions, finance companies, brokerage firms, factoring companies and other financial intermediaries. Additionally, fintech developments, such as blockchain and other distributed ledger technologies, have the potential to disrupt the financial industry and change the way banks do business. The financial services industry could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. Some of Trustmark's competitors have fewer regulatory constraints and may have lower cost structures. Additionally, due to their size, many of Trustmark's larger competitors may be able to achieve economies of scale and, as a result, may offer a broader range of products and services as well as better pricing for those products and services than Trustmark. Trustmark's ability to compete successfully depends on a number of factors, including: the ability to develop, maintain and build upon long-term customer relationships based on top quality service, high ethical standards and safe, sound assets; the ability to continue to expand Trustmark's market position through organic growth and acquisitions; the scope, relevance and pricing of products and services offered to meet customer needs and demands; the rate at which Trustmark introduces new products and services relative to its competitors; and industry and general economic trends. Failure to perform in any of these areas could significantly weaken Trustmark's competitive position, which could adversely affect Trustmark's financial condition or results of operations.

Trustmark has significant investments in bank premises and equipment for its branch network. Advances in technology such as ecommerce, telephone, internet and mobile banking, and in-branch self-service technologies including interactive teller machines (ITMs) and other equipment, as well as an increasing customer preference for these other methods of accessing Trustmark's products and services, could decrease the value of its branch network, technology, or other retail distribution physical assets and may cause Trustmark to change its retail distribution strategy, close and/or sell certain branches or parcels of land held for development and restructure or reduce its remaining branches and work force. These actions could lead to losses on these assets or could adversely impact the carrying value of any long-lived assets and may lead to increased expenditures to renovate, reconfigure or close a number of Trustmark's remaining branches or to otherwise reform its retail distribution channel.

Trustmark's ability to attract and retain customers, clients, investors, and highly-skilled management and employees is affected by its reputation. Significant harm to Trustmark's reputation can also arise from other sources, including employee misconduct, actual or perceived unethical or illegal behavior, litigation or regulatory outcomes, failing to deliver minimum or required standards of service and quality, compliance failures, disclosure of confidential information, significant or numerous failures, interruptions or breaches of its information systems and the activities of its clients, customers and counterparties, including vendors. Actions by the financial services industry generally or by certain members or individuals in the industry may have a significant adverse effect on Trustmark's reputation. Trustmark could also suffer significant reputational harm if it fails to properly identify and manage potential conflicts of interest. Management of potential conflicts of interests has become increasingly complex as Trustmark expands its business activities through more numerous transactions, obligations and interests with and among its clients. The actual or perceived failure to adequately address conflicts of interest could affect the willingness of clients to deal with Trustmark, which could adversely affect Trustmark's businesses.

Economic activity improved slightly during 2025, but was characterized by mixed signals, notably, strong equity market performance, continued consumer spending and FRB rate cuts, but also a softening labor market and persistent inflationary pressures, driven partly by new tariffs. United States stocks performed strongly during the second half of 2025, supported by optimistic sentiment around lower interest rates, better-than-expected corporate earnings and strong performance in the technology and AI sectors. However, economic concerns remain as a result of the cumulative weight of uncertainty regarding the potential economic impact of geopolitical developments, such as the conflicts in Ukraine and the Middle East, the current United States presidential administration's policies, inflationary and broader pricing pressures and other economic and industry volatility. Concerns surrounding the direction of global markets and the potential impact on the United States economy are expected to persist for the near term. While Trustmark's customer base is wholly domestic, international economic conditions affect domestic economic conditions, and thus may have an impact upon Trustmark's financial condition or results of operations. Strategic risk, including threats to business models from increasing pressures on net interest margins and modest economic growth, remains high. Management's ability to plan, prioritize and allocate resources in this environment will be critical to Trustmark's ability to sustain earnings that will attract capital. Because of the complexities presented by current economic conditions, Management will continue to be challenged in identifying alternative sources of revenue, prudently diversifying assets, liabilities and revenue and effectively managing the costs of compliance. Trustmark is intently monitoring the impact of tariffs and other administrative policies on its customer base, interest rates and credit-related issues. Economic uncertainty or disruptions in the marketplace as a result of such policies could reduce loan demand or increase loan nonperformance. It is not possible to predict the timing or magnitude of changes to policies by the current United States presidential administration, if any, or the impact any such policy changes could have on Trustmark's customer base, credit quality or results of operations. Trustmark does not assume that current uncertain conditions in the economy will improve significantly in the near future. A weakened economy could affect Trustmark in a variety of substantial and unpredictable ways. In particular, Trustmark may face the following risks in connection with these events: - Market developments and the resulting economic pressure on consumers may affect consumer confidence levels and may cause increases in delinquencies and default rates, which, among other effects, could further affect Trustmark's charge-offs and provision for credit losses. - Loan performance could experience a significantly extended deterioration or loan default levels could accelerate, foreclosure activity could significantly increase, or Trustmark's assets (including loans and investment securities) could materially decline in value, any one of which, or any combination of more than one of which, could have a material adverse effect on Trustmark's financial condition or results of operations. - Management's ability to measure the fair value of Trustmark's assets could be adversely affected by market disruptions that could make valuation of assets more difficult and subjective. If Management determines that a significant portion of its assets have values that are significantly below their recorded carrying value, Trustmark could recognize a material charge to earnings in the quarter during which such determination was made, Trustmark's capital ratios would be adversely affected by any such charge, and a rating agency might downgrade Trustmark's credit rating or put Trustmark on credit watch. While the banking industry has stabilized since the disruptions associated with bank failures in Spring 2023, there remains heightened awareness around liquidity, uninsured deposits, deposit composition, unrecognized investment losses and capital among counterparties, customers and regulators. It is difficult to predict the extent to which these conditions will persist or whether recent progress in the economic recovery will instead shift to the potential for further decline. If the economy does weaken in the future, it is uncertain how Trustmark's business would be affected and whether Trustmark would be able to successfully mitigate any such effects on its business. Accordingly, these factors in the United States (and, indirectly, global) economy could have a material adverse effect on Trustmark's financial condition and results of operations.

Many of Trustmark's loans are secured by property or are made to businesses in or near the Gulf Coast regions of Alabama, Florida, Mississippi and Texas, which are often in the path of seasonal hurricanes. Natural disasters, such as hurricanes, could have a significant negative impact on the stability of Trustmark's deposit base, the ability of borrowers to repay outstanding loans and the value of collateral securing loans, and could cause Trustmark to incur material additional expenses. Although Management has established disaster recovery policies and procedures, the occurrence of a natural disaster, especially if any applicable insurance coverage is not adequate to enable Trustmark's borrowers to recover from the effects of the event, could have a material adverse effect on Trustmark's financial condition or results of operations.

Trustmark's success depends substantially on its ability to attract and retain skilled, experienced personnel. Competition for qualified candidates in the activities and markets that Trustmark serves is intense. While Trustmark invests significantly in the training and development of its employees, it is possible that Trustmark may not be able to retain key employees. If Trustmark were unable to retain its most qualified employees, its performance and competitive positioning could be materially adversely affected.