Camden National (CAC) Risk Analysis

The Community Reinvestment Act, the Equal Credit Opportunity Act, the Fair Housing Act and other fair lending laws and regulations impose community investment and nondiscriminatory lending requirements on financial institutions. The FRB, OCC, CFPB, the Department of Justice and other federal agencies are responsible for enforcing these laws and regulations. A successful regulatory challenge to an institution's performance under the Community Reinvestment Act, the Equal Credit Opportunity Act, the Fair Housing Act or other fair lending laws and regulations could result in a wide variety of sanctions, including damages and civil money penalties, injunctive relief, restrictions on mergers and acquisitions, restrictions on expansion and restrictions on entering new business lines. Private parties may also have the ability to challenge an institution's performance under fair lending laws in private class action litigation. Such actions could have a material adverse effect on our business, financial condition and results of operations.

The financial services industry is subject to intense scrutiny from bank supervisors in the examination process and aggressive enforcement of federal and state regulations, particularly with respect to mortgage-related practices and other consumer compliance matters, and compliance with AML, BSA and OFAC regulations, and economic sanctions against certain foreign countries and nationals. Enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices. In addition, some legal/regulatory frameworks provide for the imposition of fines or penalties for noncompliance even though the noncompliance was inadvertent or unintentional and even though there were systems and procedures designed to ensure compliance in place at the time. There have been a number of significant enforcement actions in recent years by regulators, state attorneys general and the Department of Justice against banks and other non-bank financial institutions with respect to AML and sanctions laws, and some have resulted in substantial penalties including criminal pleas. Although the Company and the Bank have adopted policies and procedures designed to comply with these laws, any failure to comply with these laws and other regulations, or to maintain an adequate compliance program, could result in significant fines, penalties, lawsuits, regulatory sanctions, reputational damage, or restrictions on our business.

We have been, and in the future may be, affected by general business and economic conditions in the U.S. and, to a lesser extent, abroad. These conditions include short-term and long-term interest rates, inflation, money supply, political issues, legislative and regulatory changes, fluctuations in both debt and equity capital markets, broad trends in industry and finance, unemployment, investor confidence and customer deposit behavior, all of which are beyond our control. These conditions can change suddenly and negatively. For example, economic concerns were heightened during the COVID-19 pandemic from early 2020 through 2022. In addition, bank failures in March and April of 2023 prompted by sudden and significant withdrawals of deposits at the failing banks resulted in significant volatility in the stock prices of certain financial services institutions. Volatility due to failures of other banks or general uncertainty regarding the health of banks may affect customer deposit behavior and cause deposit withdrawals. Other future changes in any of these conditions, including as a result of the COVID-19 pandemic, the war in Ukraine, conflict in the Middle East, the threat or occurrence of a U.S. sovereign default or government shutdown, a downgrade, or perceived future downgrade, in the U.S. sovereign credit rating or outlook, disruptions in the financial services industry or other future events that we are unable to predict, could result in increases in loan delinquencies and non-performing assets, decreases in loan collateral values, the value of our investment portfolio and demand for our products and services or otherwise adversely affect our financial condition or results of operations. In addition, volatility and uncertainty related to inflation and its effects, which could potentially contribute to poor economic conditions, may contribute to or enhance some of the risks described in this section. For example, higher inflation could reduce demand for our products, adversely affect the creditworthiness of our borrowers or result in lower values for our interest-earning assets and investment securities. Higher inflation could also lead to higher interest rates, which could negatively affect our performance. See "Fluctuations in market interest rates have in the past adversely affected, and may in the future adversely affect, our performance" below. Any of these effects, or others that we are not able to predict, could adversely affect our financial condition or results of operations.

Acts of terrorism, war or other international hostilities, civil unrest, violence or pandemics could cause disruptions to our business or the economy as a whole, such as the disruptions experienced during the COVID-19 pandemic. Any of these events could affect us directly (for example, by interrupting our systems, causing significant damage to our facilities or otherwise preventing us from conducting our ordinary business) or indirectly as a result of effects on our borrowers and other customers or third-party vendors (for example, by damaging property pledged as collateral for our loans). The Company has suffered, and could in the future suffer, adverse consequences to the extent that pandemics, such as the COVID-19 pandemic, terrorist activities, civil unrest, international hostilities, including Russia's invasion of Ukraine and conflict in the Middle East, or other external events affect the financial markets or the economy in general or in any region in which the Company, or third parties on which the Company relies, operate. For example, the COVID-19 pandemic created economic and financial disruptions that have adversely affected, and may in the future adversely affect, the Company's business, financial condition, capital and results of operations. During the COVID-19 pandemic, the Company experienced significant disruptions to its normal operations, including the temporary closing of branches and a sudden increase in the volume of work-from-home arrangements. In addition, the Company was indirectly negatively affected by the pandemic's effects on the Company's borrowers and other customers, and by its effects on global financial markets. The COVID-19 pandemic caused, and any future pandemics, terrorist activities, civil unrest or international hostilities, may cause, an increase in delinquencies, bankruptcies or defaults that could result in the Company experiencing higher levels of nonperforming assets, net charge-offs and provisions for credit losses. Depending on the impact of current international hostilities on general economic and market conditions, there is a risk that adverse conditions could occur or worsen, including supply chain disruptions; higher inflation; decreased demand for the Company's products and services or those of its borrowers, which could increase credit risk; challenges related to maintaining sufficient qualified personnel due to labor shortages, talent attrition, employee illness, or willingness to return to work; and disruptions to business operations at the Company and at counterparties, vendors and other service providers. In addition, the escalation or continuation of international hostilities, including the war between Russia and Ukraine and conflict in the Middle East, could result in, among other things, further increased risk of cyberattacks, supply chain disruptions, higher inflation, lower consumer demand and increased volatility in commodity, currency and other financial markets. The Company's ability to mitigate the adverse consequences of these occurrences is in part dependent on the quality of the Company's resiliency planning, and the Company's ability, if any, to anticipate the nature of any such event that occurs. The adverse effects of pandemics, terrorist activities, civil unrest, international hostilities or other external events also could be increased to the extent that there is a lack of preparedness on the part of national or regional emergency responders or on the part of other organizations and businesses that the Company transacts with, particularly those that it depends upon, but has no control over.

Channels for servicing our customers are evolving rapidly, with less reliance on traditional branches, more use of online and mobile banking, and increased demand for universal bankers and other relationship managers who can service multiple product lines. We compete with larger providers that are rapidly evolving their service offerings, thereby escalating the costs of evolving the Bank's efforts to keep pace. We have a process for evaluating the profitability of our branches and other office and operational facilities. The identification of unprofitable operations and facilities can lead to restructuring charges and introduce the risk of disruptions to revenues and customer relationships. In addition, our success depends, in part, on our ability to adapt products and services to changing industry standards. There is increasing pressure to provide products and services at lower prices. Lower prices can reduce our net interest margin and revenues from fee-based products and services. The adoption of new or emerging technologies, such as blockchain and artificial intelligence, or further developments in current technologies may require us to make substantial expenditures to modify or adapt our existing products and services to remain competitive. These and other capital investments in our businesses may not produce expected growth in earnings anticipated at the time of the expenditure. We might not be successful in developing or introducing new products and services, adapting to changing customer preferences and spending and saving habits (which may be altered significantly and suddenly), achieving market acceptance of our products and services, or sufficiently developing and maintaining loyal customer relationships.

Competition in the banking and financial services industry is strong. In our market areas, we compete for loans, deposits and other financial products and services with large financial companies, local independent banks, thrift institutions, savings institutions, mortgage brokerage firms, credit unions, finance companies, mutual funds, insurance companies, brokerage and investment banking firms, and other financial intermediaries that offer similar services. Some of these competitors have substantially greater resources and lending limits than those of the Bank and may offer services that the Bank does not or cannot provide. Some of our non-bank competitors are not subject to the same extensive regulations we are, and, as a result, may be able to compete more effectively for business. In particular, the activity of non-bank lenders and other financial technology companies ("fintechs") has grown significantly over recent years and is expected to continue to grow. Fintechs have offered and may continue to offer bank or bank-like products. For example, a number of fintechs have applied for, and in some cases received, bank or industrial loan charters. In addition, other fintechs have partnered with existing banks to allow them to offer deposit and loan products to their customers. Regulatory changes may also make it easier for fintechs to partner with banks and offer deposit products. Other regulation has raised the asset thresholds at which more onerous regulatory requirements apply, which could cause certain large bank holding companies with less than $250 billion in total consolidated assets, which were previously subject to more stringent enhanced prudential standards, to become more competitive or to pursue expansion more aggressively. There is also increased competition by out-of-market competitors through online and mobile channels. Our long-term success depends on our ability to compete successfully with other financial institutions and fintechs. Because we maintain a smaller staff and have fewer financial and other resources than larger institutions with which we compete, we may be limited in our ability to attract customers. If we are unable to attract and retain customers, we may be unable to achieve growth in the loan and core deposit portfolios, and our results of operations and financial condition may be negatively affected. In addition, return on shareholders' equity and other measures of profitability, which affect the market price of our common stock, depend in part on continued growth and expansion. The ability to generate internal growth is affected by the competitive factors described herein as well as by the primarily rural characteristics and related demographic features of the markets we serve. If we are unable to compete or grow effectively in our markets, it could adversely affect our business and the price of our common stock.

Information security risks for financial institutions such as the Company and the Bank are significant due to the use of online, telephone and mobile banking channels by customers and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties. Third parties with whom we or our customers do business also present operational and information security risks to us. We see an increasing trend of cyberattacks targeting providers in the financial services industry, as well as increased security breaches or failures of their own systems. Our operations rely on the secure processing, transmission and storage of confidential information in our computer systems and networks. Our businesses rely on our digital technologies, computer and email systems, software, and networks to conduct their operations. As our reliance on technology systems increases, the potential risks of technology-related interruptions in our operations or the occurrence of cyber incidents also increases. Our technologies, systems, networks and our customers' devices are periodically the target of cyberattacks, and may be the target of future cyberattacks, including through the introduction of computer viruses, and/or malicious code, or by means of phishing attacks, social engineering or other information security breaches. Malicious actors may also attempt to fraudulently induce employees, customers or other users of our systems to disclose sensitive information, including passwords and other identifying information, in order to gain access to data or our systems. In recent years, there have been several well-publicized attacks on various companies, including in the financial services industry, and personal, proprietary, and public e-mail systems in which the perpetrators gained unauthorized access to confidential information and customer data, often through the introduction of computer viruses or malware, cyberattacks, phishing, social engineering or other means. Even if not directed at the Company or the Bank specifically, attacks on other entities with whom we do business or on whom we otherwise rely or attacks on financial or other institutions important to the overall functioning of the financial system could adversely affect, directly or indirectly, aspects of our business. Information security risks continue to increase, in part because of the proliferation of new technologies, ongoing work-from-home arrangements, the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, activists, and other external parties, some of which may be linked to terrorist organizations or hostile foreign governments. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our systems or to investigate and remediate vulnerabilities. System enhancements and updates may also create risks associated with implementing and integrating new systems. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our systems can itself create a risk of systems disruptions and security issues. Although we believe we have appropriate information security controls and procedures, we may not be able to anticipate, detect, or implement effective preventative measures against all potential threats, particularly because the techniques used by cyber criminals change frequently, often are not recognized until launched and can be initiated from a variety of sources. In addition, a cybersecurity breach or cyberattack could persist for an extended period before being detected, which could exacerbate the harmful effects of a successful cyberattack. If one or more of the events described above occurs, this could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of our or our customers' confidential, proprietary and other information, the theft of customer assets through fraudulent transactions or disruption of our or our customers' or other third parties' business operations, which could result in legal or regulatory action, significant losses, increased compliance costs or reputational damage, any of which could adversely affect our business, financial condition or results of operations. Because the investigation of any information security breach is inherently unpredictable and would require substantial time to complete, the Company may not be able to quickly remediate the consequences of any breach, which may increase the costs, and enhance the negative consequences associated with a breach. In addition, to the extent the Company's insurance covers aspects of any breach, such insurance may not be sufficient to cover all of the Company's losses. As cybersecurity and data privacy risks for banking organizations and other financial institutions have significantly increased in recent years, cybersecurity and data privacy issues have become the subject of increasing legislative and regulatory focus. We could be adversely affected if new legislation or regulations are adopted or if existing legislation or regulations are modified such that we are required to alter our systems or are required to change our business practices or privacy policies. If cybersecurity, data privacy, data protection, data transfer or data retention laws are implemented, interpreted or applied in a manner inconsistent with our current practices, we may be subject to fines, litigation or regulatory enforcement actions or ordered to change our business practices, policies or systems in a manner that adversely affects our results of operations.