Bank Of Hawaii (BOH) Risk Factors

Our business and earnings are closely tied to the economies of Hawaii and the Pacific Islands. These local economies rely heavily on tourism, the U.S. military, real estate, construction, government, and other service-based industries. Lower visitor arrivals or spending, real or threatened acts of war or terrorism, public unrest, increases in energy costs, inflation, the availability of affordable air transportation, climate change, natural disasters and adverse weather, public health issues including the COVID-19 pandemic, and federal, State of Hawaii and local government budget issues may impact consumer and corporate spending. Additionally, financial markets may be adversely affected by the current or anticipated impact of military conflict, including continuing military conflict between Israel and Hamas, Russia and Ukraine, terrorism or other geopolitical events. There has been significant improvement in tourism and general economic conditions in Hawaii since the beginning of the COVID-19 pandemic. However, in August 2023, wildfires broke out in West Maui destroying the historic town of Lahaina as well as structures and farmland in Upcountry Maui and North Kihei. Roughly 2,200 structures were lost in the fire, 86% of which were homes. Although hotels have reopened, Maui's visitor industry will continue to be impacted in the coming years. Deterioration of economic conditions, locally, nationally, and internationally could adversely affect the quality of our assets, credit losses, and the demand for our products and services, which could lead to lower revenues, higher expenses, and lower earnings. The level of domestic and international visitor arrivals and spending, housing prices, and unemployment rates are some of the metrics that we continually monitor. We also monitor the value of collateral, such as real estate, that secures the loans we have made. The borrowing power of our customers could also be negatively impacted by a decline in the value of collateral. A prolonged period of inflation may impact our profitability by negatively impacting our fixed costs and expenses. Economic and inflationary pressure on consumers and uncertainty regarding the economic improvement could result in changes in consumer and commercial spending, borrowing and savings habits. Such conditions could have a material adverse effect on the credit quality of our loans and our business, financial condition and results of operations.

The impacts of climate change, such as extreme weather conditions, natural disasters and rising sea levels, could impact the Bank's operations as well as those of its customers and third party vendors upon which it relies. Such events could also result in market volatility or negatively impact our customers' ability to pay outstanding loans, or result in the deterioration of the value of our collateral causing a material adverse effect on the Bank's financial condition and results of operation. Furthermore, increasing regulation related to climate change could have an adverse effect on the business and financial condition of the Bank and its customers, including our credit portfolio. Further legislation and regulatory requirements could increase the operating expenses of, or otherwise adversely impact, the Bank or its customers. To the extent that the Bank or its customers experience increases in costs, reductions in the value of assets, constraints on operations or similar concerns driven by changes in regulation relating to climate change, the Bank's business and results of operations may be adversely affected.

We are, from time-to-time, involved in various legal proceedings arising from our normal business activities. These claims and legal actions, including supervisory actions by our regulators, could involve large monetary claims and significant defense costs. The outcome of these cases is uncertain. Substantial legal liability or significant regulatory action against us could have material financial effects or cause significant reputational harm to us, which in turn could seriously harm our business prospects. In recent years, regulatory enforcement and fines have increased across the banking and financial services sector. There is no assurance that those actions will not result in regulatory settlements or other enforcement actions against the Company or the Bank. Furthermore, a single event involving a potential violation of law or regulation may give rise to numerous and overlapping investigations and proceedings by multiple federal and state agencies and officials. In addition, if one or more financial institutions are found to have violated a law or regulation relating to certain business activities, this could lead to investigations by regulators or other governmental agencies of the same or similar activities by other financial institutions, including the Company, and large fines and remedial measures that may have been imposed in resolving earlier investigations for the same or similar activities at other financial institutions may be used as the basis for future settlements. We may be exposed to substantial uninsured liabilities, which could materially affect our results of operations and financial condition. Based on information currently available, we believe that the eventual outcome of known actions against us will not be materially in excess of such amounts accrued by us. However, in the event of unexpected future developments, it is possible that the ultimate resolution of those matters may be material to our financial results for any particular period. See the Contingencies section of Note 20 to the Consolidated Financial Statements for more information.

Our business requires the collection and retention of large volumes of customer data, including payment card numbers and other personally identifiable information in various information systems that we maintain and in those maintained by third parties with whom we contract to provide data services. We also maintain important internal company data such as personally identifiable information about our employees and information relating to our operations. The integrity and protection of that customer and company data is important to us. As customer, public, legislative and regulatory expectations and requirements regarding operational and information security have increased, our operating systems and infrastructure must continue to be safeguarded and monitored for potential failures, disruptions and breakdowns. Our technologies, systems, networks and software, and those of other financial institutions have been, and are likely to continue to be, the target of cybersecurity threats and attacks, which may range from uncoordinated individual attempts to sophisticated and targeted measures directed at us. These cybersecurity threats and attacks may include, but are not limited to, attempts to access information, including customer and company information, malicious code, computer viruses and denial of service attacks that could result in unauthorized access, misuse, loss or destruction of data (including confidential customer information), account takeovers, unavailability of service or other events. These types of threats may result from human error, fraud or malice on the part of external or internal parties, intelligence-gathering by foreign governments, or from accidental technological failure internally or by our vendors. Further, to access our products and services our customers may use computers and mobile devices that are beyond our security control systems. The risk of a security breach or disruption, particularly through cyber-attack or cyber intrusion, including by computer hackers, has increased as the number, intensity and sophistication of attempted attacks and intrusions around the world have increased. Our customers and employees have been, and will continue to be, targeted by parties using fraudulent emails and other communications in attempts to misappropriate passwords, payment card numbers, bank account information or other personal information or to introduce viruses or other malware through "trojan horse" programs to our customers' devices. These communications may appear to be legitimate messages sent by the Bank or other businesses, but direct recipients to fake websites operated by the sender of the email or request that the recipient send a password or other confidential information via email or download a program. Despite our efforts to mitigate these threats through product improvements, use of encryption and authentication technology to secure online transmission of confidential consumer information, and customer and employee education, such attempted frauds against us or our merchants and our third party service providers remain a serious issue. The pervasiveness of cyber security incidents in general and the risks of cyber-crime are complex and continue to evolve. In light of several recent high-profile data breaches involving other companies' losses of customer personal and financial information, we believe this risk could cause customer and/or Bank losses, damage to our brand, and increase our costs through the ongoing cost of technology investments to improve security, as well as the potential financial and reputational impact of a cyber security incident involving the Company. Although we make significant efforts to maintain the security and integrity of our information systems and have implemented various measures to manage the risk of a security breach or disruption, there can be no assurance that our security efforts and measures will be effective or that attempted security breaches or disruptions would not be successful or damaging. Even the most well-protected information, networks, systems and facilities remain potentially vulnerable because attempted security breaches, particularly cyber-attacks and intrusions, or disruptions will occur in the future, and because the techniques used in such attempts are constantly evolving and generally are not recognized until launched against a target, in some cases are designed not to be detected and, in fact, may not be detected. Accordingly, we may be unable to anticipate these techniques or to implement adequate security barriers or other preventative measures, and thus making it virtually impossible for us to entirely mitigate this risk. A security breach or other significant disruption could: 1) disrupt the proper functioning of our networks and systems and therefore our operations and/or those of certain of our customers; 2) result in the unauthorized access to, and destruction, loss, theft, misappropriation or release of confidential, sensitive or otherwise valuable information of ours or our customers, including account numbers and other financial and personal information; 3) result in a violation of applicable privacy, data breach and other laws, subjecting the Bank to additional regulatory scrutiny and exposing the Bank to civil litigation, governmental fines and possible financial liability; 4) require significant management attention and resources to remedy the damages that result; or 5) harm our reputation or cause a decrease in the number of customers that choose to do business with us or reduce the level of business that our customers do with us. The occurrence of any such failures, disruptions or security breaches could have a negative impact on our results of operations, financial condition, and cash flows as well as damage our brand and reputation.