City Holding Company (CHCO) Risk Analysis

Changes in tax laws, or changes in the interpretation of existing tax laws, could materially adversely affect the Company's operations. Similarly, new accounting standards, changes to existing accounting standards, and changes to the methods of preparing financial statements could impact the Company's reported financial condition and results of operations. These factors are outside the Company's control and it is impossible to predict changes that may occur and the effect of such changes.

The Company's business is highly dependent on third party vendors, especially with respect to information technology and telecommunication systems, payment processing system, and mobile and online banking systems. Our operations rely heavily on the secure processing, storage, transmission, and monitoring of information and transactions, and many of these services are outsourced to third party vendors. The failure of these systems or the inability of a third party vendor to continue providing these services on a reliable basis could adversely affect our operations. In addition, the failure of third parties to comply with applicable laws and regulations, or fraud or misconduct on the part of any of these third parties, could disrupt our operations and adversely affect our reputation. It may be difficult for us to replace some of our critical third party vendors, particularly vendors providing our core banking, debit card services and information services, in a timely manner and on terms that are favorable or acceptable to us. Any of these events could increase our expenses and have a material adverse effect on our business, financial condition, and results of operations. Financial services institutions are interrelated with one another as a result of trading, clearing, counterparty, and other relationships. The Company has exposure to many different industries and counterparties, and routinely executes transactions with counterparties in the financial services industry, including commercial banks, brokers and dealers, investment banks, and other institutional clients. Many of these transactions expose the Company to credit risk in the event of a default by a counterparty or client. In addition, the Company's credit risk may be exacerbated when the collateral held by the Company cannot be realized upon or is liquidated at prices not sufficient to recover the full amount of the credit or derivative exposure due to the Company. Any such losses could have a material adverse effect on the Company's business, financial condition and results of operations. Further, as a result of financial entities and technology systems becoming more interdependent and complex, a cybersecurity incident, information breach or loss, or technology failure that comprises the systems or data of one financial entity could have a material impact on counterparties or other market participants, including the Company.

A significant portion of the Company's loan portfolio is secured by real property. In the ordinary course of the Company's business, it sometimes takes title to real property collateral through foreclosure after a borrower defaults on the loan for which the real property is collateral. There is a risk that hazardous or toxic substances could be present on properties that the Company acquires by way of foreclosure. Though the Company conducts regular remediation evaluations in the ordinary course of business, the Company may be liable for remediation costs, as well as for personal injury and property damage relating to any hazardous or toxic substances present on the properties it acquires in foreclosure. Environmental laws may require the Company to incur substantial expenses and may materially reduce the affected property's value or limit the Company's ability to use or sell the affected property. Furthermore, remediation costs and financial and other liabilities associated with an environmental hazard could have a material adverse effect on the Company's financial condition and results of operations.

The Company's business is concentrated in West Virginia, Kentucky, Virginia and southeastern Ohio. As a result, the Company's results of operation, cash flows and financial condition are affected by local and regional economic conditions. A downturn in the economies within the Company's market areas, or in any one of them, could negatively impact the Company's results of operation and financial condition. Some examples of economic deterioration include declines in economic growth, declines in consumer and business confidence, prolonged increases in inflation, increases in the cost of capital and credit, and limitations in the availability of credit. The Company's financial performance generally, and the ability of its customers to pay interest on and repay principal of outstanding loans to City National, is highly dependent on the strength of the economic and business environment in the market areas where the Company operates and in the United States as a whole. Additionally, the value of collateral securing loans made and held by City National is impacted by the strength of the economy. Deteriorating economic conditions in the Company's market areas could cause declines in the overall quality of the loan portfolio requiring charge-off of a greater percentage of loans and/or an increase in the allowance for credit losses, which could negatively impact the Company's results of operations and financial condition. While the economic and business environments in West Virginia, Kentucky, Virginia and southeastern Ohio have shown resilience during the recovery from the COVID-19 pandemic, and have shown improvement since the brief recession of 2020, there can be no assurance that such resilience and improvement will continue or that the economies in the Company's market areas, or the United States as a whole, will not slip into another recession. A lack of continued economic improvement or economic recession could adversely affect the Company's results of operation and financial condition. An economic slowdown could have the following consequences: - Loan delinquencies may increase;- Problem assets and foreclosures may increase;- Demand for City National's products and services may decline; and - Collateral (including real estate) that secures loans made by City National may decline in value, in turn reducing customers' borrowing power and making existing loans less secure. The oil, natural gas and coal industries, and businesses ancillary thereto, play an important role in the economies of West Virginia, Kentucky, Virginia and southeastern Ohio. Ongoing volatility in oil and gas prices since 2014 has negatively impacted oil and gas and other businesses in the Company's market areas. Additionally, the coal industry continues to be in decline as a result of increased environmental and safety regulatory burden, increased competition from alternative energy sources and a decline in demand for coal. The Company has limited direct exposure to coal industry specific loans. Prolonged low oil and gas prices, and continued decline in the coal industry, could result in downward pressure on businesses in the Company's market area which could negatively affect City National's customers (both individuals and businesses). As a result, the Company's operating results and financial condition could be negatively impacted.

The computer systems and network infrastructure that the Company uses could be vulnerable to unforeseen hardware and cybersecurity issues, including "hacking" and "identity theft." The Company's operations are dependent upon its ability to protect its computer equipment against damage from fire, power loss, telecommunications failure or a similar catastrophic event. Any damage or failure that causes an interruption in the Company's operations could have an adverse effect on its financial condition and results of operations. In addition, the Company's operations are dependent upon its ability to protect the computer systems and network infrastructure utilized by the Company, including its mobile and Internet banking activities, against damage from physical break-ins, cybersecurity breaches, acts of vandalism, computer viruses, theft of information, misplaced or lost data, programming and/or human errors, and other disruptive problems. The Company is further exposed to the risk that its third-party service providers may be unable to fulfill their contractual obligations with respect to managing the Company's information and systems. Any cybersecurity breach or other disruptions, whether by the Company or its third-party vendors, would jeopardize the security of information stored in and transmitted through the Company's computer systems and network infrastructure, which may result in significant liability to the Company, damage its reputation and inhibit current and potential customers from its using Internet banking services. The Company could incur substantial costs and suffer other negative consequences, such as: remediation costs, such as liability for stolen assets or information, repairs of system damage, and incentives to customers in an effort to maintain relationships after an attack; increased cybersecurity protection costs, such as organizational changes, deploying additional personnel and protection technologies, training employees, and engaging third party experts and consultants; and damage to the Company's competitiveness, stock price, and long-term shareholder values. Despite efforts to ensure the integrity of the Company's systems, the Company will not be able to anticipate all security breaches of these types, nor will it be able to implement guaranteed preventive measures against such security breaches. Persistent attackers may succeed in penetrating defenses given enough resources, time and motive. The techniques used by cyber criminals change frequently, may not be recognized until launched, and can originate from a wide variety of sources, including outside groups such as external service providers, organized crime affiliates, terrorist organizations or hostile foreign governments. These risks may increase in the future as the Company continues to increase its mobile payment and other Internet-based product offerings and expand its internal usage of web-based products and applications. A successful attack to the Company's system security or the system security of one of its critical third-party vendors could cause it serious negative consequences, including significant disruption of operations, misappropriation of confidential information, and damage to its computers or systems or those of its customers and counterparties. A successful security breach could result in violations of applicable privacy and other laws, financial loss to the Company or to its customers, loss of confidence in its security measures, significant litigation exposure, and harm to its reputation, all of which could have a material adverse effect on the Company. Criminals are committing fraud at an increasing rate and are using more sophisticated techniques, including through use of artificial intelligence technologies. The Company faces risk of fraudulent activity in many forms, including online payment transfer fraud, debit card fraud, check fraud, mechanical devices attached to ATMs or ITMs, phishing attacks to obtain personal information, email-related frauds and the impersonation of Company executives or vendors, and impersonation of clients through the use of falsified or stolen credentials. The Company may suffer losses as a result of fraudulent activity committed against it, its customers, and other counterparties. The Company could be adversely affected if one of its employees causes a significant operational breakdown or failure, either as a result of human error or where an individual purposefully sabotages or fraudulently manipulates the Company's operations or systems. Misconduct by employees could include fraudulent, improper or unauthorized activities on behalf of customers or improper use of confidential information. Employee errors or misconduct could subject the Company to regulatory enforcement action, legal action, reputational damage, and other losses. For more information on how the Company manages cybersecurity risk, please refer to Item 1C. Cybersecurity.

The Company relies on information provided to us by or on behalf of customers and other third parties, including financial statements, credit reports, and other financial information, in deciding whether to extend credit or enter into other transactions and in evaluating and monitoring our loan portfolio. The Company also relies on representations from our customers, counterparties, and other third parties, such as independent auditors, as to the accuracy and completeness of that information. Reliance on inaccurate, incomplete, fraudulent or misleading financial or business information could result in credit losses, reputational damage, or other effects that could have a material adverse effect on our financial condition and results of operation.

The Company faces substantial and intense competition in all areas of its operation, including interest rates and other terms for loans and deposits and the range and quality of services provided. Competition comes from a variety of different competitors, many of which have competitive advantages over the Company. The Company faces competition from: - local, regional and national banks;- savings and loans associations;- Internet banks;- credit unions;- mutual funds;- mortgage banking firms;- finance companies;- financial technology ("fin-tech") companies;- brokerage firms;- investment advisory and wealth management firms;- investment banking firms; and - other entities. In particular, many of City National's competitors are larger banks and financial institutions whose greater resources may afford them a marketplace advantage by enabling them to maintain numerous banking locations and mount extensive promotional and advertising campaigns. Additionally, the Company's competitors may have products and services not offered by the Company, which may cause current and potential customers to choose those institutions over the Company. The financial services industry could become even more competitive as a result of legislative, regulatory, and technological changes and the continued consolidation within the banking industry. Consumer preferences and expectations continue to evolve, and technology and regulatory changes have lowered barriers to entry and made it possible for banks to expand their geographic reach by providing services over the internet and for non-banks to offer products and services typically provided by banks. Many of our non-bank competitors have fewer regulatory constraints and expenses associated with regulatory compliance and may have lower cost structures, such as credit unions that are not subject to federal income tax. The Company's ability to compete successfully depends on a number of factors, including our ability to develop, maintain, and build long-term customer relationships; our ability to expand our market area and range of services and products offered; our ability to keep up-to-date with technological advancements, both with respect to new and existing products and with respect to cybersecurity; customer satisfaction with our products and services; and general industry and economic trends. Failure to perform successfully in any of these areas could significantly weaken our competitive position. If the Company is unable to attract new customers and retain current customers, loan and deposit growth could decrease, causing the Company's results of operations and financial condition to be negatively impacted.

The Company faces threats to its reputation from many sources, including adverse sentiment about financial institutions generally, unethical practices, employee misconduct, failure to deliver expected standards of service or quality, regulatory compliance deficiencies, and questionable or fraudulent activities of the Company's employees and customers. Negative publicity may arise regarding the Company's business, employees, or customers, with or without merit, and could result in the loss of customers, investors and employees, costly litigation, a decline in revenue, and increased regulatory oversight.