Bank7 (BSVN) Risk Factors

Our business is primarily affected by the economies of Oklahoma, Texas and to a smaller degree the State of Kansas. Our success depends to a significant extent upon the business activity, population, income levels, employment trends, deposits and real estate activity in these markets. As of December 31, 2023, the substantial majority of the loans in our loan portfolio were made to borrowers who live and/or conduct business in our markets and the substantial majority of our secured loans were secured by collateral located in our markets.  Accordingly, we are exposed to risks associated with a lack of geographic diversification as any regional or local economic downturn that affects our markets, our existing or prospective borrowers, or property values in our markets may affect us and our profitability more significantly and more adversely than our competitors whose operations are less geographically focused. In addition, market developments may affect consumer confidence levels and may cause adverse changes in payment patterns, causing increases in delinquencies and default rates, which could impact our charge-offs and provision for credit losses. Adverse changes in economic conditions in these markets could reduce our growth in loans and deposits, impair our ability to collect our loans, increase our problem loans and charge-offs and otherwise negatively affect our performance and financial condition.

As a part of their regulatory oversight, the federal regulators have issued guidance on Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices, or the CRE Concentration Guidance, with respect to a financial institution's concentrations in CRE lending activities. The CRE Concentration Guidance identifies certain concentration levels that, if exceeded, will expose the institution to additional supervisory analysis with regard to the institution's CRE concentration risk. The CRE Concentration Guidance is designed to promote appropriate levels of capital and sound loan and risk management practices for institutions with a concentration of CRE loans. In general, the CRE Concentration Guidance establishes the following supervisory criteria as preliminary indications of possible CRE concentration risk: (1) the institution's total construction, land development and other land loans represent 100% or more of total capital; or (2) total CRE loans as defined in this guidance, or Regulatory CRE, represent 300% or more of total capital, and the institution's Regulatory CRE has increased by 50% or more during the prior 36-month period. Pursuant to the CRE Concentration Guidance, loans secured by owner occupied CRE are not included for purposes of the CRE concentration calculation. As of December 31, 2023, our Regulatory CRE represented 290.69% of our total Bank capital and our construction, land development and other land loans represented 73.97% of our total Bank capital, as compared to 304.72% and 101.20% as of December 31, 2022, respectively. During the prior 36-month period, our Regulatory CRE has decreased 53.10%. We are actively working to manage our Regulatory CRE concentration, and we believe that our underwriting policies, management information systems, independent credit administration process, and monitoring of real estate loan concentrations are currently sufficient to address the CRE Concentration Guidance. We utilize enhanced CRE monitoring techniques as expected by banking regulators as our concentrations have approached or exceeded the regulatory guidance. Nevertheless, the Federal Reserve could become concerned about our CRE loan concentrations, and it could limit our ability to grow by restricting its approvals for the establishment or acquisition of branches, or approvals of mergers or other acquisition opportunities, or by requiring us to raise additional capital, reduce our loan concentrations or undertake other remedial actions.

We are subject to various privacy, information security and data protection laws, including requirements concerning security breach notification, and we could be negatively impacted by these laws. For example, our business is subject to the Gramm-Leach-Bliley Act which, among other things: (i) imposes certain limitations on our ability to share non-public personal information about our customers with non-affiliated third parties; (ii) requires that we provide certain disclosures to customers about our information collection, sharing and security practices and afford customers the right to "opt out" of any information sharing by us with non-affiliated third parties (with certain exceptions) and (iii) requires we develop, implement and maintain a written comprehensive information security program containing safeguards appropriate based on our size and complexity, the nature and scope of our activities and the sensitivity of customer information we process, as well as plans for responding to data security breaches. Various state and federal banking regulators and states have also enacted data security breach notification requirements with varying levels of individual, consumer, regulatory or law enforcement notification in certain circumstances in the event of a security breach. Moreover, legislators and regulators in the United States are increasingly adopting or revising privacy, information security and data protection laws that potentially could have a significant impact on our current and planned privacy, data protection and information security-related practices, our collection, use, sharing, retention and safeguarding of consumer or employee information, and some of our current or planned business activities. Bank are required to notify their regulators within 36 hours of a "computer-security incident" that rises to the level of a "notification incident." This could increase our costs of compliance and business operations and could reduce income from certain business initiatives. This includes increased privacy-related enforcement activity at the federal level by the Federal Trade Commission, as well as at the state level. We rely on third parties, and in some cases subcontractors, to provide information technology and data services. Although we provide for appropriate protections through our contracts and perform information security risk assessments of its third-party service providers and business associates, we still have limited control over their actions and practices. In addition, despite the security measures that we have in place to ensure compliance with applicable laws and rules, our facilities and systems, and those of our third-party providers may be vulnerable to security breaches, acts of vandalism or theft, computer viruses, misplaced or lost data, programming and/or human errors or other similar events. In such cases, notification to affected individuals, state and federal regulators, state attorneys general and media may be required, depending upon the number of affected individuals and whether personal information including financial data was subject to unauthorized access. Compliance with current or future privacy, data protection and information security laws (including those regarding security breach notification) affecting customer or employee data to which we are subject could result in higher compliance and technology costs and could restrict our ability to provide certain products and services, which could have a material adverse effect on our business, financial conditions or results of operations. Our failure to comply with privacy, data protection and information security laws could result in potentially significant regulatory or governmental investigations or actions, litigation, fines, sanctions and damage to our reputation, which could have a material adverse effect on our business, financial condition or results of operations.