Evans Bancorp (EVBN) Risk Factors

In 2006, the federal bank regulatory agencies issued joint guidance entitled "Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices" (the "CRE Guidance"). Although the CRE Guidance did not establish specific lending limits, it provides that a bank's commercial real estate lending exposure may receive increased supervisory scrutiny where total non-owner occupied commercial real estate loans, including loans secured by apartment buildings, investor commercial real estate and construction and land loans, represent 300% or more of an institution's total risk-based capital and the outstanding balance of the commercial real estate loan portfolio has increased by 50% or more during the preceding 36 months. The Bank's non-owner occupied commercial real estate level equaled 309% of total risk-based capital at December 31, 2023. Including owner-occupied commercial real estate, the ratio of commercial real estate loans to total risk-based capital ratio would be 375% at December 31, 2023. If the Bank's regulators were to impose restrictions on the amount of commercial real estate loans it can hold in its portfolio, or require higher capital ratios as a result of the level of commercial real estate loans held, the Company's earnings would be adversely affected. ??

The Company's tax strategies depend on the ability to generate taxable income in future periods. The Company's tax strategies will be less effective in the event the Company fails to generate anticipated amounts of taxable income. The value of the Company's deferred tax assets is subject to an evaluation of whether it is more likely than not that they will be realized for financial statement purposes. In making this determination, management considers all positive and negative evidence available, including the Company's historical levels of taxable income, the opportunity for net operating loss carrybacks, and projections for future taxable income over the statutory tax loss carryover period. If the Company were to conclude that a significant portion of deferred tax assets were not more likely than not to be realized, the required valuation allowance could adversely affect the Company's financial position, results of operations and regulatory capital ratios. In addition, the value of the Company's deferred tax assets could be adversely affected by a change in statutory tax rates.

Competition in the banking and financial services industry is intense. The Company competes with commercial banks, savings institutions, mortgage brokerage firms, credit unions, finance companies, mutual funds, brokerage and investment banking firms, and financial technology companies operating locally within the Company's market area and elsewhere. Many of these competitors (whether regional or national institutions) have substantially greater resources and lending limits than the Company does, and may offer certain services that the Company does not or cannot provide. The Company's profitability depends upon its continued ability to successfully compete in this market area.

The Company cannot assure that the opening of new branches will be accretive to earnings or that it will be accretive to earnings within a reasonable period of time. Numerous factors contribute to the performance of a new branch, such as suitable location, qualified personnel, and an effective marketing strategy. Additionally, it takes time for a new branch to gather sufficient loans and deposits to generate income sufficient to cover its operating expenses. Difficulties the Bank experiences in opening new branches may have a material adverse effect on the Company's financial condition and results of operations. The Company cannot assure that the closing of branches will not be dilutive to earnings.

The Company's business reputation is important to its success. The ability to attract and retain customers, investors, employees and advisors may depend upon external perceptions of the Company. Damage to the Company's reputation could cause significant harm to its business and prospects and may arise from numerous sources, including litigation or regulatory actions, failing to deliver minimum standards of service and quality, compliance failures, unethical behavior and the misconduct of employees, advisors and counterparties. Negative perceptions or publicity regarding these matters could damage the Company's reputation among existing and potential customers, investors, employees and advisors. Adverse developments with respect to the financial services industry may also, by association, negatively impact the Company's reputation or result in greater regulatory or legislative scrutiny or litigation against the Company. Preserving and enhancing the Company's reputation also depends on maintaining systems and procedures that address known risks and regulatory requirements, as well as its ability to identify and mitigate additional risks that arise due to changes in businesses and the marketplaces in which the Company operates, the regulatory environment and client expectations. If any of these developments has a material effect on the Company's reputation, its business could suffer. Furthermore, shareholders and other stakeholders have begun to consider how corporations are addressing environmental, social and governance ("ESG") issues. Governments, investors, customers and the general public are increasingly focused on ESG practices and disclosures, and views about ESG are diverse and rapidly changing. These shifts in investing priorities may result in adverse effects on the trading price of the Company's common stock if investors determine that the Company has not made sufficient progress on ESG matters. The Company could also face potential negative ESG-related publicity in traditional media or social media if shareholders or other stakeholders determine that we have not adequately considered or addressed ESG matters. If the Company, or our relationships with certain customers, vendors or suppliers became the subject of negative publicity, our ability to attract and retain customers and employees, and our financial condition and results of operations, could be adversely impacted.

The Company's success depends, in large part, on its ability to attract and retain skilled people. The Company's business is primarily relationship-driven in that many of the key employees of the Bank have extensive customer relationships. Loss of a key employee with such customer relationships may lead to the loss of business if the customers were to follow that employee to a competitor. While management believes that the Company's relationships with its key business producers are good, the Company cannot guarantee that all of its key personnel will remain with the organization. Further, competition for highly talented people can be intense, and we may not be able to hire sufficiently skilled people or retain them. Loss of such key personnel, particularly if they enter into an employment relationship with one of the Company's competitors, could result in the loss of some of the Company's customers. Such losses could have a material adverse effect on the Company's business, financial condition and results of operations.

The Company is generally unable to control the amount of premiums that it is required to pay for FDIC insurance. The FDIC increased initial base insurance deposit assessment rates by 2 basis points effective January 1, 2023. If there are additional bank or financial institution failures or other similar occurrences, the FDIC may again increase the premiums assessed upon insured institutions. Such increases and any future increases or required prepayments of FDIC insurance premiums may adversely impact the Company's results of operations.

The Company relies heavily on communications and information systems to conduct its business. As a financial institution, we process a significant number of customer transactions and possess a significant amount of sensitive customer information. As technology advances, the ability to initiate transactions and access data has become more widely distributed among mobile phones, personal computers, automated teller machines, remote deposit capture sites and similar access points. Any failure, interruption, or breach in security or operational integrity of our communications and information systems, or the systems of third parties on which we rely to process transactions, could result in failures or disruptions in the Company's customer relationship management, general ledger, deposit, loan, and other systems. There can be no assurance that failures, interruptions, or security breaches of the Company's information systems will not occur or, if they do occur, that they will be adequately addressed. Unauthorized third parties regularly seek to gain access to nonpublic, private and other information through computer systems. If customers' personal, nonpublic, confidential, or proprietary information in the Company's possession were to be mishandled or misused, we could suffer significant regulatory consequences, reputational damage, and financial loss. Such mishandling or misuse could include, for example, if such information were erroneously provided to parties who are not permitted to have the information, either by fault of the Company's systems, employees or counterparties, or where such information is intercepted or otherwise inappropriately taken by third parties. The occurrence of any failures, interruptions, or security breaches of the Company's information systems could, among other consequences, damage the Company's reputation, result in a loss of customer business, subject the Company to additional regulatory scrutiny, result in increased insurance premiums, or expose the Company to civil litigation and possible financial liability, any of which could have a material adverse effect on the Company's financial condition and results of operations. In addition, as cybersecurity and data privacy risks for banking organizations and the broader financial system have significantly increased in recent years, cybersecurity and data privacy issues have become the subject of increasing legislative and regulatory focus. The federal bank regulatory agencies have proposed enhanced cyber risk management standards, which would apply to a wide range of large financial institutions and their third-party service providers, and would focus on cyber risk governance and management, management of internal and external dependencies, and incident response, cyber resilience and situational awareness. We may become subject to new legislation or regulation concerning cybersecurity or the privacy of personally identifiable information and personal financial information or of any other information we may store or maintain. We could be adversely affected if new legislation or regulations are adopted or if existing legislation or regulations are modified such that we are required to alter our systems or require changes to our business practices or privacy policies. If cybersecurity, data privacy, data protection, data transfer or data retention laws are implemented, interpreted or applied in a manner inconsistent with our current practices, we may be subject to fines, litigation or regulatory enforcement actions or ordered to change our business practices, policies or systems in a manner that adversely impacts our operating results In addition, increased cost of compliance with cybersecurity regulations, at the federal and state level, could have a material adverse effect on the Company's financial condition and results of operations.