Equity Bancshares (EQBK) Risk Analysis

We are subject to supervision and regulation by federal and state banking agencies that periodically conduct examinations of our business, including compliance with laws and regulations – specifically, our subsidiary, Equity Bank, is subject to examination by the Federal Reserve and the OSBC and we are subject to examination by the Federal Reserve. Accommodating such examinations may require management to reallocate resources, which would otherwise be used in the day-to-day operation of other aspects of our business. If, as a result of an examination, any such banking agency was to determine that the financial condition, capital resources, allowance for credit losses, asset quality, earnings prospects, management, liquidity or other aspects of our operations had become unsatisfactory, or that we or our management were in violation of any law or regulation, such banking agency may take a number of different remedial actions as it deems appropriate. These actions include the power to enjoin "unsafe or unsound" practices, to require affirmative actions to correct any conditions resulting from any violation or practice, to issue an administrative order that can be judicially enforced, to direct an increase in our capital, to restrict our growth, to assess civil monetary penalties against us, our officers, or directors, to remove officers and directors and, if it is concluded that such conditions cannot be corrected or there is an imminent risk of loss to depositors, to terminate our deposit insurance. If we become subject to such a regulatory action, it could have a material adverse effect on our business, financial condition and results of operations.

Financial institutions have been the subject of significant legislative and regulatory changes and may be the subject of further significant legislation or regulation in the future, none of which is within our control. New proposals for legislation continue to be introduced in the United States Congress that could further substantially increase regulation of the bank and non-bank financial services industries, impose restrictions on the operations and general ability of firms within the industry to conduct business consistent with historical practices, including in the areas of compensation, interest rates, financial product offerings and disclosures and have an effect on bankruptcy proceedings with respect to consumer residential real estate mortgages, among other things. Federal and state regulatory agencies also frequently adopt changes to their regulations or change the manner in which existing regulations are applied. Changes to statutes, regulations or regulatory policies, including changes in their interpretation or implementation by regulators, could affect us in substantial and unpredictable ways. Such changes could, among other things, subject us to additional costs and lower revenues, limit the types of financial services and products that we may offer, ease restrictions on non-banks and thereby enhance their ability to offer competing financial services and products, increase compliance costs and require a significant amount of management's time and attention. Failure to comply with statutes, regulations or policies could result in sanctions by regulatory agencies, civil monetary penalties or reputational damage, each of which could have a material adverse effect on our business, financial condition and results of operations.

As a bank holding company, we are subject to federal regulation under the BHC Act, and the examination and reporting requirements of the Federal Reserve. Federal regulation of the banking industry, along with tax and accounting laws, regulations, rules and standards, may limit our operations significantly and control the methods by which we conduct business, as they limit those of other banking organizations. Banking regulations are primarily intended to protect depositors, deposit insurance funds and the banking system as a whole and not stockholders or other creditors. These regulations affect lending practices, capital structure, investment practices, dividend policy and overall growth, among other things. For example, federal and state consumer protection laws and regulations limit the manner in which we may offer and extend credit. In addition, the laws governing bankruptcy generally favor debtors, making it more expensive and more difficult to collect from customers who become subject to bankruptcy proceedings. We also may be required to invest significant management attention and resources to evaluate and make any changes necessary to comply with applicable laws and regulations, particularly as a result of regulations adopted under the Dodd-Frank Act. This allocation of resources, as well as any failure to comply with applicable requirements, may negatively impact our financial condition and results of operations.

We intend to complement and expand our business by pursuing strategic acquisitions of financial institutions and other complementary businesses. Generally, we must receive state and federal regulatory approval before we can acquire an FDIC-insured depository institution or related business. In determining whether to approve a proposed acquisition, federal banking regulators will consider, among other factors, the effect of the acquisition on competition, our financial condition, our future prospects and the impact of the proposal on U.S. financial stability. The regulators also review current and projected capital ratios and levels, the competence, experience and integrity of management and its record of compliance with laws and regulations, the convenience and needs of the communities to be served (including the acquiring institution's record of compliance under the CRA) and the effectiveness of the acquiring institution in combating money laundering activities. Such regulatory approvals may not be granted on terms that are acceptable to us, or at all. We may also be required to sell branches as a condition to receiving regulatory approval, which may not be acceptable to us or, if acceptable to us, may reduce the benefit of any acquisition.

The Bank Secrecy Act, the USA PATRIOT Act of 2001, or the Patriot Act, and other laws and regulations require financial institutions, among other duties, to institute and maintain an effective anti-money laundering program and file suspicious activity and currency transaction reports, when appropriate. In addition to other bank regulatory agencies, the federal Financial Crimes Enforcement Network of the U.S. Treasury, is authorized to impose significant civil money penalties for violations of those requirements and has recently engaged in coordinated enforcement efforts with the state and federal banking regulators, as well as the U.S. Department of Justice, Consumer Financial Protection Bureau, Drug Enforcement Administration and Internal Revenue Service, or the IRS. We are also subject to increased scrutiny of compliance with the rules enforced by the Office of Foreign Assets Control of the U.S. Treasury regarding, among other things, the prohibition of transacting business with and the need to freeze assets of, certain persons and organizations identified as a threat to the national security, foreign policy or economy of the United States. If our policies, procedures and systems are deemed deficient, we would be subject to liability, including fines and regulatory actions, which may include restrictions on our ability to pay dividends and the necessity to obtain regulatory approvals to proceed with certain aspects of our business plan, including our acquisition plans. Failure to maintain and implement adequate programs to combat money laundering and terrorist financing could also have serious reputational consequences for us. Any of these results could have a material adverse effect on our business, financial condition, results of operations and future prospects.

The Community Reinvestment Act, or CRA, the Equal Credit Opportunity Act, the Fair Housing Act and other fair lending laws and regulations impose nondiscriminatory lending requirements on financial institutions. The U.S. Department of Justice and other federal agencies are responsible for enforcing these laws and regulations. A successful regulatory challenge to an institution's performance under the CRA or fair lending laws and regulations could result in a wide variety of sanctions, including damages and civil money penalties, injunctive relief, restrictions on mergers and acquisitions activity, restrictions on expansion and restrictions on entering new business lines. Private parties may also have the ability to challenge an institution's performance under fair lending laws in private class action litigation. Such actions could have a material adverse effect on our business, financial condition, results of operations and future prospects.

Applicable regulations require us to maintain specific capital standards in relation to the respective credit risks of our assets and off-balance sheet exposures. Various components of these requirements are subject to qualitative judgments by regulators. We maintain a "well capitalized" status under the current regulatory framework. Our failure to maintain a "well capitalized" status could affect our customers' confidence in us, which could adversely affect our ability to do business. In addition, failure to maintain such status could also result in restrictions imposed by our regulators on our growth and other activities. Any such effect on customers or restrictions by our regulators could have a material adverse effect on our financial condition and results of operations.

From time to time, we may be subject to claims or legal action from customers, employees or others. Financial institutions like the Company are facing a growing number of significant class actions, including those based on the manner of calculation of interest on loans and the assessment of overdraft fees. Future litigation could include claims for substantial compensatory and/or punitive damages or claims for indeterminate amounts of damages. The Company is also involved from time to time in other reviews, investigations and proceedings (both formal and informal) by governmental and other agencies regarding its businesses. These matters also could result in adverse judgments, settlements, fines, penalties, injunctions or other relief. Like other financial institutions, we are also subject to risk from potential employee misconduct, including non-compliance with policies and improper use or disclosure of confidential information. Substantial legal liability or significant regulatory action against us could materially adversely affect its business, financial condition or results of operations and/or cause significant reputational harm to its business.

Because a significant portion of our loan portfolio is secured by real property, we may foreclose upon and take title to such property in the ordinary course of business. If hazardous substances are found on such property, we could be liable for remediation costs, as well as for personal injury and property damage. Environmental laws might require us to incur substantial expenses, materially reduce the property's value or limit our ability to use or sell the property. Although management has policies requiring environmental reviews before loans secured by real property are made and before foreclosure is commenced, it is still possible that environmental risks might not be detected and that the associated costs might have a material adverse effect on our financial condition and results of operations.

Our ability to retain and grow our loans, deposits and fee income depends upon the business generation capabilities, reputation and relationship management skills of our bankers. If we were to lose the services of any of our bankers, including successful bankers employed by banks that we may acquire, to a new or existing competitor or otherwise, we may not be able to retain valuable relationships and some of our customers could choose to use the services of a competitor instead of our services. Our growth strategy also relies on our ability to attract and retain additional profitable bankers. We may face difficulties in recruiting and retaining bankers of our desired caliber, including as a result of competition from other financial institutions. In particular, many of our competitors are significantly larger with greater financial resources and may be able to offer more attractive compensation packages and broader career opportunities. Additionally, we may incur significant expenses and expend significant time and resources on training, integration and business development before we are able to determine whether a new banker will be profitable or effective. If we are unable to attract and retain successful bankers, or if our bankers fail to meet our expectations in terms of customer relationships and profitability, we may be unable to execute our business strategy and our business, financial condition, results of operations and growth prospects may be adversely affected.

Information security risks for financial institutions have generally increased in recent years, in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions and the increased sophistication and activities of organized crime, hackers, terrorists, activists and other external parties. The financial services industry has seen increases in electronic fraudulent activity, hacking, security breaches, sophisticated social engineering and cyber-attacks, including in the commercial banking sector, as cyber criminals have been targeting commercial bank accounts on an increasing basis. We are under continuous threat of loss due to fraudulent activity, hacking and cyber-attacks, especially as we continue to expand customer capabilities to utilize internet and other remote channels to transact business. Our risk and exposure to these matters remains heightened because of the evolving nature and complexity of these threats from cyber criminals and hackers, our plans to continue to provide internet banking and mobile banking channels and our plans to develop additional remote connectivity solutions to serve our customers. Therefore, the secure processing, transmission and storage of information in connection with our online banking services are critical elements of our operations. However, our network is vulnerable to unauthorized access, computer viruses and other malware, phishing schemes or other security failures. In addition, our customers may use personal smartphones, tablet PCs or other mobile devices that are beyond our control systems in order to access our products and services. Our technologies, systems and networks and our customers' devices, may become the target of cyber-attacks, electronic fraud or information security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of our or our customers' confidential, proprietary and other information, or otherwise disrupt our or our customers' or other third parties' business operations. As cyber threats continue to evolve, we may be required to spend significant capital and other resources to protect against these threats or to alleviate or investigate problems caused by such threats. Our business relies on the secure processing, storage, transmission and retrieval of confidential customer information in our computer and data management systems and networks, and in the computer and data management systems and networks of third parties, and any breaches or unauthorized access to such information could present significant regulatory costs and expose us to litigation and other possible liabilities. Any inability to prevent these types of security threats could also cause existing customers to lose confidence in our systems and could adversely affect our reputation and ability to generate deposits. The occurrence of any cyber-attack or information security breach could result in financial losses or increased costs to us or our clients, disclosure or misuse of confidential information belonging to us or personal or confidential information belonging to our clients, misappropriation of assets, reputational damage, damage to our competitive position and the disruption of our operations, all of which could adversely affect our financial condition or results of operations. In recent periods, several governmental agencies and large corporations, including financial service organizations and retail companies, have suffered major data breaches, in some cases exposing not only their confidential and proprietary corporate information, but also sensitive financial and other personal information of their clients or clients and their employees or other third parties and subjecting those agencies and corporations to potential fraudulent activity and their clients, clients and other third parties to identity theft and fraudulent activity in their credit card and banking accounts. Therefore, security breaches and cyber-attacks can cause significant increases in operating costs, including the costs and capital expenditures required to correct the deficiencies and strengthen the security of data processing and storage systems. Unfortunately, it is not always possible to anticipate, detect, or recognize these threats to our systems, or to implement effective preventative measures against all breaches, whether those breaches are malicious or accidental. Cybersecurity risks for banking organizations have significantly increased in recent years and have been difficult to detect before they occur because, among other reasons: - the proliferation of new technologies and the use of the internet and telecommunications technologies to conduct financial transactions;- these threats arise from numerous sources, not all of which are in our control, including among others, human error, fraud or malice on the part of employees or third parties, accidental technological failure, electrical or telecommunication outages, failures of computer servers or other damage to our property or assets, natural disasters or severe weather conditions, health emergencies or pandemics, or outbreaks of hostilities or terrorist acts;- the techniques used in cyber-attacks change frequently and may not be recognized until launched or until well after the breach has occurred;- the increased sophistication and activities of organized crime groups, hackers, terrorist organizations, hostile foreign governments, disgruntled employees or vendors, activists and other external parties, including those involved in corporate espionage;- the vulnerability of systems to third parties seeking to gain access to such systems either directly or using equipment or security passwords belonging to employees, customers, third-party service providers or other users of our systems; and - our frequent transmission of sensitive information to, and storage of such information by, third parties, including our vendors and regulators, and possible weaknesses that go undetected in our data systems notwithstanding the testing we conduct of those systems. While we invest in systems and processes that are designed to detect and prevent security breaches and cyber-attacks and we conduct periodic tests of our security systems and processes, we may not succeed in anticipating or adequately protecting against or preventing all security breaches and cyber-attacks from occurring. Even the most advanced internal control environment may be vulnerable to compromise. Targeted social engineering attacks are becoming more sophisticated and are extremely difficult to prevent. Additionally, the existence of cyber-attacks or security breaches at third parties with access to our data, such as vendors, may not be disclosed to us in a timely manner. Further, we may not be able to insure against losses related to cyber threats. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities or incidents. As is the case with non-electronic fraudulent activity, cyber-attacks or other information or security breaches, whether directed at us or third parties, may result in a material loss or have material consequences. Furthermore, the public perception that a cyber-attack on our systems has been successful, whether or not this perception is correct, may damage our reputation with customers and third parties with whom we do business. A successful penetration or circumvention of system security could cause us negative consequences, including loss of customers and business opportunities, disruption to our operations and business, misappropriation or destruction of our confidential information and/or that of our customers, or damage to our customers' and/or third parties' computers or systems, and could expose us to additional regulatory scrutiny and result in a violation of applicable privacy laws and other laws, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in our security measures, reputational damage, reimbursement or other compensatory costs, additional compliance costs, and could adversely impact our results of operations, liquidity and financial condition.