Cass Information Systems (CASS) Risk Analysis

The Company is subject to various legal and regulatory proceedings. It is inherently difficult to assess the outcome of these matters, and there can be no assurance that the Company will prevail in any proceeding or litigation. Any such matter could result in substantial cost and diversion of Cass' efforts, which by itself could have a material adverse effect on Cass' financial condition and operating results. Further, adverse determinations in such matters could result in actions by Cass' regulators that could materially adversely affect Cass' business, financial condition or results of operations. Please refer to Item 3, "Legal Proceedings."

In the normal course of business, Cass and its affiliates are routinely subject to examinations and challenges from federal and state tax authorities regarding the amount of taxes due in connection with investments it has made and the businesses in which it is engaged. Recently, federal and state taxing authorities have become increasingly aggressive in challenging tax positions taken by financial institutions. These tax positions may relate to tax compliance, sales and use, franchise, gross receipts, payroll, property and income tax issues, including tax base, apportionment and tax credit planning. The challenges made by tax authorities may result in adjustments to the timing or amount of taxable income or deductions or the allocation of income among tax jurisdictions. If any such challenges are made and are not resolved in the Company's favor, they could have an adverse effect on Cass' financial condition and results of operations.

The Company is subject to a variety of risks arising from ESG matters. ESG matters include climate risk, hiring practices, the diversity of the work force, and racial and social justice issues involving the Company's personnel, customers and third parties with whom it otherwise does business. Risks arising from ESG matters may adversely affect, among other things, reputation and the market price of the Company's securities. Further, the Company may be exposed to negative publicity based on the identity and activities of those to whom it lends and with which it otherwise does business and the public's view of the approach and performance of its customers and business partners with respect to ESG matters. Any such negative publicity could arise from adverse news coverage in traditional media and could also spread through the use of social media platforms. The Company's relationships and reputation with its existing and prospective customers and third parties with which it does business could be damaged if it were to become the subject of any such negative publicity. This, in turn, could have an adverse effect on the Company's ability to attract and retain customers and employees and could have a negative impact on the market price for securities. Investors have begun to consider the steps taken and resources allocated by financial institutions and other commercial organizations to address ESG matters when making investment and operational decisions. Certain investors are beginning to incorporate the business risks of climate change and the adequacy of companies' responses to the risks posed by climate change and other ESG matters into their investment theses. These shifts in investing priorities may result in adverse effects on the market price of the Company's securities to the extent that investors determine that the Company has not made sufficient progress on ESG matters.

In the ordinary course of business, the Company depends on the reliable operation of its computer operations and network connections from its clients to its systems. Any failure, interruption, or breach in security of these systems would cause Cass to be unable to process transactions for its clients, resulting in decreased revenues. The Company also relies on electronic communications and information systems to store sensitive customer data. Any failure, interruption, breach in security or loss of data, whatever the cause, could reduce client satisfaction with the Company's products and services and harm Cass' financial results. These types of threats may derive from human error, fraud or malice on the part of external or internal parties, or may result from accidental technological failure. Further, to access the Company's products and services, Cass' customers may use computers and mobile devices that are beyond the Company's security control systems. The Company's technologies, systems, networks and software, and those of other financial institutions have been, and are likely to continue to be, the target of cybersecurity threats and attacks, which may range from uncoordinated individual attempts to sophisticated and targeted measures directed at Cass. The risk of a security breach or disruption, particularly through cyber-attack or cyber intrusion, has increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. A material security problem affecting Cass could damage its reputation, deter prospects from purchasing its products and services, deter customers from using its products and services or result in liability to Cass. Cloud technologies are also critical to the operation of the Company's systems, and reliance on cloud technologies is growing. Service disruptions in cloud technologies may lead to delays in accessing, or the loss of, data that is important to the Company's businesses and may hinder customers access to products and services. Although the Company makes significant efforts to maintain the security and integrity of Cass' information systems and have implemented various measures to manage the risk of a security breach or disruption, there can be no assurance that Cass' security efforts and measures will be effective or that attempted security breaches or disruptions would not be successful or damaging. Even the most well protected information, networks, systems and facilities remain potentially vulnerable because attempted security breaches, particularly cyber-attacks and intrusions, or disruptions will occur in the future, and because the techniques used in such attempts are constantly evolving and generally are not recognized until launched against a target, and in some cases are designed not to be detected and, in fact, may not be detected. Accordingly, the Company may be unable to anticipate these techniques or to implement adequate security barriers or other preventative measures, and thus it is virtually impossible to entirely mitigate this risk. While specific "cyber" insurance coverage is maintained, which would apply in the event of various breach scenarios, the amount of coverage may not be adequate in any particular case. Furthermore, because cyber threat scenarios are inherently difficult to predict and can take many forms, some breaches may not be covered under Cass' cyber insurance coverage. A security breach or other significant disruption of Cass' information systems or those related to customers, merchants and third-party vendors, including as a result of cyber-attacks, could i) disrupt the proper functioning of Cass' networks and systems and therefore operations and/or those of certain customers; ii) result in the unauthorized access to, and destruction, loss, theft, misappropriation or release of confidential, sensitive or otherwise valuable information of the Company or its customers; iii) result in a violation of applicable privacy, data breach and other laws, subjecting the Company to additional regulatory scrutiny and expose Cass to civil litigation, governmental fines and possible financial liability; iv) require significant management attention and resources to remedy the damages that result; or v) harm Cass' reputation or cause a decrease in the number of customers that choose to do business with the Company. The occurrence of any of the foregoing could have a material adverse effect on Cass' business, financial condition and results of operations.

If competitors introduce new products and services embodying new technologies, or if new industry standards and practices emerge, the Company's existing product and service offerings, technology and systems may become obsolete. Further, if Cass fails to adopt or develop new technologies or to adapt its products and services to emerging industry standards, Cass may lose current and future customers. Finally, Cass' ability to adopt these technologies can also be inhibited by intellectual property rights of third parties. Any of these could have a material adverse effect on its business, financial condition and results of operations. The payment processing and financial services industries are changing rapidly and in order to remain competitive, Cass must continue to enhance and improve the functionality and features of its products, services and technologies. These changes may be more difficult or expensive than the Company anticipates.

The Company operates in a very competitive environment, which is characterized by competition from a number of other vendors and financial institutions in each market in which it operates. The Company competes with large payment processors and national and regional financial institutions and also smaller auditing companies and banks in terms of products and pricing. If the Company is unable to compete effectively in products and pricing in its markets, business could decline.

The recent high-profile bank failures have generated significant market volatility among publicly traded bank holding companies. These market developments have negatively impacted customer confidence in the safety and soundness of regional banks. As a result, customers may choose to maintain deposits with larger financial institutions or invest in higher yielding short-term fixed income securities, all of which could materially adversely impact the Company's liquidity, loan funding capacity, net interest margin, capital and results of operations. While the Department of the Treasury, the Federal Reserve, and the FDIC have made statements ensuring that depositors of these recently failed banks would have access to their deposits, including uninsured deposit accounts, there is no guarantee that such actions will be successful in restoring customer confidence in regional banks and the banking system more broadly.

Cass' future operating results depend substantially upon the continued service of Cass' executive officers and key personnel. Cass' future operating results also depend in significant part upon Cass' ability to attract and retain qualified management, financial, technical, marketing, sales, and support personnel. Competition for qualified personnel is intense, and the Company cannot ensure success in attracting or retaining qualified personnel. There may be only a limited number of persons with the requisite skills to serve in these positions, and it may be increasingly difficult for the Company to hire personnel over time. Cass' business, financial condition and results of operations could be materially adversely affected by the loss of any of its key employees, by the failure of any key employee to perform in his or her current position, or by Cass' inability to attract and retain skilled employees.