Columbia Banking System (COLB) Risk Factors

We or our third-party (or fourth-party) vendors, clients or counterparties may develop or incorporate AI technology in certain business processes, services, or products. The development and use of AI present a number of risks and challenges to our business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving, both in the U.S. and internationally, and includes regulatory schemes targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment, and other laws applicable to the use of AI. These evolving laws and regulations could require changes in our implementation of AI technology and increase our compliance costs and the risk of non-compliance. AI models, particularly generative AI models, may produce output or take action that is incorrect, that result in the release of private, confidential, or proprietary information, that reflect biases included in the data on which they are trained, infringe on the intellectual property rights of others, or that is otherwise harmful. In addition, the complexity of many AI models makes it challenging to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output, eliminating bias, and complying with regulations that require documentation or explanation of the basis on which decisions are made. Further, we may rely on AI models developed by third parties, and, to that extent, would be dependent in part on the manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models, and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which we may have limited visibility. Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures. In addition to our use of AI technologies, we are exposed to risks arising from the use of AI technologies by bad actors to commit fraud and misappropriate funds and to facilitate cyberattacks. AI, if used to perpetrate fraud or launch cyberattacks, could create panic at a particular financial institution or exchange, which could pose a threat to financial stability.

As a financial institution, our operations rely heavily on the secure processing, storage, and transmission of confidential and other information on our computer systems and networks. Any failure, interruption or breach in security or operational integrity of these systems could result in failures or disruptions in our online banking system, customer relationship management, general ledger, deposit and loan servicing and other systems. The security and integrity of our systems are susceptible to a variety of interruptions or information security breaches, including those caused by computer hacking, cyberattacks, electronic fraudulent activity or attempted theft of financial assets. We are not able to anticipate, detect, or implement effective preventative measures against all threats, particularly because the techniques used by cybercriminals change frequently, often are not recognized until launched and can be initiated from a variety of sources. We cannot assure you that we will be able to adequately address all such failures, interruptions or security breaches that may have a material adverse impact on our business, financial condition, results of operations and prospects. While we have certain protective policies and procedures in place, the nature and sophistication of the threats continue to evolve. We may be required to expend significant additional resources in the future to modify and enhance our protective measures. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our systems can itself create a risk of systems disruptions and security issues. Additionally, we face the risk of operational disruption, failure, termination, or capacity constraints of any of the third parties that facilitate our business activities, including exchanges, clearing agents, clearing houses or other financial intermediaries. Such parties can also be the source of an attack on, or breach of, our operational systems. Failures, interruptions or security breaches in our information systems could damage our reputation, result in a loss of customer business, result in a violation of privacy or other laws, or expose us to civil litigation, regulatory fines or losses not covered by insurance, all of which could have a material adverse impact on our business, financial condition, results of operations and prospects. Further, as an investigation into a cyberattack is inherently unpredictable, it may take a significant amount of time for us to fully uncover the scope of and damage related to a cyberattack and develop an effective mitigation plan. During such time, damage related to a cyberattack may continue and communications to the public, customers, regulators, and other stakeholders may not be timely or accurate. Potential new regulations may require us to publicly disclose information about a cyberattack before the incident has been resolved or fully investigated. The confidential information of our customers (including usernames and passwords) can also be jeopardized from the compromise of customers' personal electronic devices or as a result of a data security breach at an unrelated company. Losses due to unauthorized account activity could harm our reputation and may have a material adverse effect on our business, financial condition, results of operations and prospects. As previously disclosed in the Company's Current Report on Form 8-K filed on June 27, 2023 and discussed in greater detail in Note 18 - Commitments and Contingencies, on June 21, 2023, Umpqua Bank was informed by one of its technology service providers (the "Vendor") that a widely reported security incident involving MOVEit, a widely-used filesharing software, resulted in the unauthorized acquisition by a third party of the names and social security numbers or tax identification numbers of certain of Umpqua Bank's consumer and small business customers. Umpqua Bank notified potentially affected customers of this incident and has worked with the Vendor to provide formal notification to affected customers with additional information and resources.

The financial services industry is undergoing rapid technological changes with frequent introductions of new technology-driven products and services. The effective use of technology increases efficiency and enables financial institutions to better serve customers and to reduce costs. Many of our competitors have substantially greater resources to invest in technological improvements than we do. Our future success will depend, in part, upon our ability to address the needs of our clients by using technology to provide products and services that will satisfy client demands for convenience, as well as to create additional efficiencies in our operations. We may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers. In addition, the implementation of technological changes and upgrades to maintain current systems and integrate new ones may also cause service interruptions, transaction processing errors and system conversion delays and may cause us to fail to comply with applicable laws. There can be no assurance that we will be able to successfully manage the risks associated with our increased dependency on technology.

During the ordinary course of business, we foreclose on and take title to properties securing certain loans. In doing so, there is a risk that hazardous or toxic substances could be found on these properties. If previously unknown or undisclosed hazardous or toxic substances are discovered, we may be liable for remediation costs, as well as for personal injury and property damage. Environmental laws may require us to incur substantial expenses which may materially reduce the affected property's value or limit our ability to use or sell the affected property. In addition, future laws or more stringent interpretations or enforcement polices with respect to existing laws may increase our exposure to environmental liability. Although we have policies and procedures which require the performance of an environmental review at the time of underwriting a loan secured by real property, and also before initiating any foreclosure action on real property, these reviews may not be sufficient to detect all potential environmental hazards. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on our financial condition and results of operations.

Commercial banking is a highly competitive business. We compete with other commercial banks, savings and loan associations, credit unions and finance, insurance and other non-depository companies operating in our market areas. We also experience competition, especially for deposits, from Internet-based banking institutions, which have grown rapidly in recent years. We are subject to substantial competition for loans and deposits from other financial institutions. Some of our competitors are not subject to the same degree of regulation and restriction as we are and/or have greater financial resources than we do. Some of our competitors may have liquidity issues, which could impact the pricing of deposits, loans, and other financial products in our markets. Our inability to effectively compete in our market areas could have a material adverse impact on our business, financial condition, results of operations and prospects.