First Bancorp (FBNC) Risk Analysis

The success of our business is highly dependent on the talents and efforts of our employees. Additionally, relationships between our key employees and the customers with whom they maintain relationships contribute to our success. Therefore, our success depends on our ability to attract and retain skilled people. Competition for the best people can be intense, and we may not be able to hire or retain sufficiently qualified people. The unexpected loss of services of one or more of our key personnel could have a material adverse impact on our business because of their skills, knowledge of our markets, years of industry experience, and/or the difficulty of promptly finding qualified replacement personnel. The loss of business if the customers were to follow that employee to a competitor or otherwise choose to transition to another financial services provider could adversely impact our business. While we believe we have strong relationships with our key personnel, there is no guarantee that all of our key personnel will remain with our organization.

We are reliant upon certain external vendors to provide products and services necessary to maintain our day-to-day operations. We outsource the processing of our core data system, as well as other systems such as online banking, to third party vendors. Accordingly, our operations are exposed to risk that these vendors will not perform in accordance with applicable contractual arrangements or service level agreements. We maintain a system of policies and procedures designed to monitor vendor risks including, among other things, changes in the vendor's organizational structure, financial condition, and support for existing products and services. While we believe these policies and procedures help to mitigate risk, and our vendors are not the sole source of service, the failure of an external vendor to perform in accordance with applicable contractual arrangements or the service level agreements could be disruptive to our operations, which could have a material adverse impact on our business and its financial condition and results of operations. Additionally, if our third party vendors encounter difficulties or if we have difficulty in communicating with such third party, it will significantly affect our ability to adequately process and account for customer transactions, which would significantly affect our business operations.

We are exposed to many types of operational risk, including the risk of fraud by employees and third parties, clerical recordkeeping errors, and transactional errors. Our business is dependent on our employees as well as third-party service providers to process a large number of increasingly complex transactions. We could be materially and adversely affected if employees, clients, counterparties, or other third parties caused an operational breakdown or failure, either as a result of human error, fraudulent manipulation, or purposeful damage to any of our operations or systems. In deciding whether to extend credit or to enter into other transactions with clients and counterparties, we may rely on information furnished to us by or on behalf of clients and counterparties, including financial statements and other financial information, which we do not independently verify. We also may rely on representations of clients and counterparties as to the accuracy and completeness of that information and, with respect to financial statements, on reports of independent auditors. Our financial condition and results of operations could be negatively affected to the extent we rely on financial statements that do not comply with GAAP or are materially misleading, any of which could be caused by errors, omissions, or fraudulent behavior by our employees, clients, counterparties, or other third parties.

Reputation risk, or the risk to our business, earnings, and capital from negative public opinion regarding our Company and the financial services industry in general, is inherent in our business. Negative public opinion can result from actual or alleged conduct in any number of activities, including lending practices, corporate governance and acquisitions, and from actions taken by government regulators and community organizations in response to those activities. Negative public opinion can adversely affect our ability to keep and attract clients and employees and can expose us to litigation and regulatory action. Although we have taken steps to minimize reputation risk in dealing with our clients and communities, this risk always will be present given the nature of our business. In addition, the financial stability of other financial institutions could adversely impact our ability to engage in routine funding transactions. Defaults by, or even rumors or questions about one or more financials institutions can lead to market-wide liquidity challenges and could lead to losses or defaults by us or by other institutions.

Our success is impacted, to a certain extent by global, domestic and local economic and political conditions, as well as governmental monetary policies. More specifically, the local economic conditions of the Carolinas and the specific markets in which we operate have a significant impact on the demand for our products and services, as well as the ability of our customers to repay loans to us. Conditions such as changes in interest rates, money supply, levels of employment and other factors beyond our control may have a negative impact on economic activity. A deterioration in economic conditions, including an economic recession, may adversely affect our asset quality, deposit levels and loan demand and, therefore, our earnings. In particular, interest rates are highly sensitive to many factors that are beyond our control, including global, domestic and local economic conditions and the policies of various governmental and regulatory agencies and, specifically, the Federal Reserve. Throughout 2022 and 2023, the FOMC raised the target range for the federal funds rate on eleven separate occasions. Beginning in September 2024, the FOMC began to lower the target range for the federal funds rate. As of December 31, 2024, the target range was 4.25% to 4.50%. In January 2025, the FOMC maintained the target range for the federal funds rate. Although economic forecasts vary, the FOMC has indicated an expectation of two 25 basis point rate cuts during 2025. Some economists are projecting that, due to changes in fiscal and economic policies, including tariffs, US economic activity may slow or decrease in 2025. Economic weakness or persistent inflation could lead to decreased business and consumer confidence and weaker-than-anticipated spending, thereby leading to possible adverse impacts to our business including asset quality, deposit levels, loan demand and results of operations. We also face credit risk arising from economic and geopolitical conditions, among other forms of risk. As we have a significant amount of real estate loans, decreases in real estate values could adversely affect the value of property used as collateral, which, in turn, can adversely affect the value of our loan and investment portfolios. CRE values continue to fluctuate and the outlook for CRE remains dependent on the broader economic environment and, specifically, how major subsectors respond to ongoing economic and behavioral developments. Some economic indicators suggest that CRE prices remain high relative to fundamentals and US market delinquency rates are elevated. Credit performance over is susceptible to economic and market forces. Instability and uncertainty in the commercial and residential real estate markets, as well as in the broader commercial and retail credit markets, could have a material adverse effect on our financial condition and results of operations. Additionally, inflation risk can have an adverse impact on our customers ability to repay their loans. Our customers may be affected by inflation pressures and the rising costs of goods and services used in their households and businesses, which could have a negative impact on their cash flows and their ability to repay their loans to us.

Global cybersecurity threats and incidents can range from uncoordinated individual attempts to gain unauthorized access to information technology systems to sophisticated and targeted measures, known as advanced persistent threats, directed at us and/or our third party service providers. While we have experienced, and expect to continue to experience, these types of threats and incidents, none of them to date have been material to the Company. Although we employ comprehensive measures to prevent, detect, address, and mitigate these threats (including access controls, employee training, data encryption, vulnerability assessments, continuous monitoring of our networks and systems and maintenance of backup and protective systems), cybersecurity incidents, depending on their nature and scope, could potentially result in the misappropriation, destruction, corruption or unavailability of critical data and confidential or proprietary information (our own or that of third parties) and the disruption of our business operations. Any successful cyberattack may subject us to regulatory investigations, litigation (including class action litigation) or enforcement, or require the payment of regulatory fines or penalties or undertaking costly remediation efforts with respect to third parties affected by a cybersecurity incident, all or any of which could adversely affect our business, financial condition or results of operations and damage our reputation. In addition, we cannot guarantee that any costs and liabilities incurred in relation to an attack or incident will be covered by our existing insurance policies or that applicable insurance will be available to us in the future on economically reasonable terms or at all. We rely heavily on communications and information systems to conduct our business. Our daily operations depend on the operational effectiveness of our technology. Any failure, interruption, or breach in security of our computer systems or outside vendor technology could result in failures or disruptions in general ledger, deposit, loan, customer relationship management, and other systems leading to inaccurate financial records. While we have disaster recovery and other policies and procedures designed to prevent or limit the effect of any failure, interruption, or security breach of our information systems, there can be no assurance that any such failures, interruptions, or security breaches will not occur or, if they do occur, that they will be adequately addressed. The occurrence of any failures, interruptions, or security breaches of our information systems could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on our results of operations. In addition, the Bank provides its customers the ability to bank online and through mobile banking. The secure transmission of confidential information over the internet is a critical element of online and mobile banking. While we use qualified third party vendors to test and audit our network, our network could become vulnerable to unauthorized access, computer viruses, phishing schemes, and other security issues. The Bank may be required to spend significant capital and other resources to alleviate problems caused by security breaches or computer viruses. To the extent that the Bank's activities or the activities of its customers involve the storage and transmission of confidential information, security breaches and viruses could expose the Bank to claims, litigation, and other potential liabilities. Any inability to prevent security breaches or computer viruses could also cause existing customers to lose confidence in the Bank's systems and could adversely affect its reputation and its ability to generate deposits.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services. The effective use of technology increases efficiency and enables financial institutions to better serve customers and to reduce costs. Our future success depends, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers. Failure to successfully keep pace with technological change affecting the financial services industry could have a material adverse impact on our business and, in turn, our financial condition and results of operations.

The Bank is subject to extensive regulation and supervision by the Commissioner and the Federal Reserve. This regulation and supervision is intended primarily to enhance the safe and sound operation of the Bank and for the protection of the DIF and our depositors and borrowers, rather than for holders of our equity securities and creditors. In the past, our business has been materially affected by these regulations. This trend is likely to continue in the future. Regulatory authorities have extensive discretion in their supervisory and enforcement activities, including the imposition of restrictions on operations, the classification of our assets, and the determination of the level of ACL. Changes in the regulations that apply to us, or changes in our compliance with regulations, could have a material impact on our operations. The BSA, the Patriot Act, and other laws and regulations require financial institutions, among other duties, to institute and maintain effective anti-money laundering programs and file suspicious activity and currency transaction reports as appropriate. The FINCEN, established by the Treasury to administer the BSA, is authorized to impose significant civil money penalties for violations of those requirements and has recently engaged in coordinated enforcement efforts with the individual federal banking regulators, as well as with the U.S. Department of Justice, Drug Enforcement Administration, and Internal Revenue Service. There is also increased scrutiny of compliance with the rules enforced by the OFAC. Federal and state bank regulators also focus on compliance with BSA and AML regulations. If our policies, procedures, and systems are deemed deficient or the policies, procedures, and systems of the financial institutions that we have already acquired or may acquire in the future are deficient, we would be subject to liability, including fines and regulatory actions such as restrictions on our ability to pay dividends and the necessity to obtain regulatory approvals to proceed with certain aspects of our business plan, including our acquisition plans, which would negatively impact our business, financial condition, and results of operations. Failure to maintain and implement adequate programs to combat money laundering and terrorist financing also could have serious reputational consequences for us. Federal and state fair lending laws and regulations, such as the Equal Credit Opportunity Act and the Fair Housing Act, impose nondiscriminatory lending requirements on financial institutions. The Department of Justice, the CFPB, and other federal and state agencies are responsible for enforcing these laws and regulations. Private parties may also have the ability to challenge an institution's performance under fair lending laws in private class action litigation. A successful challenge to our performance under the fair lending laws and regulations could adversely impact our CRA rating and result in a wide variety of sanctions, including the required payment of damages and civil money penalties, injunctive relief, imposition of restrictions on or delays in approving merger and acquisition activity, and restrictions on expansion activity, which could negatively impact our reputation, business, financial condition, and results of operations.

We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business. Operational risk related to cyberattacks is increasing as cyberattacks evolve and have a greater and more pervasive economic impact. In addition to cyberattacks or other security breaches involving the theft of sensitive and confidential information, hackers have engaged in attacks against financial institutions designed to disrupt key business services, such as customer-facing web sites. Critical infrastructure sectors, including financial services, increasingly have been the targets of cyberattacks, including attacks emanating from foreign countries. Cyberattacks involving financial institutions, including distributed denial of service attacks designed to disrupt external customer-facing services, nation state cyberattacks and ransomware attacks designed to deny organizations access to key internal resources or systems or other critical data, as well as targeted social engineering and phishing email and text message attacks designed to allow unauthorized persons to obtain access to an institution's information systems and data or that of its customers, are becoming more common and increasingly sophisticated. Further, threat actors are increasingly seeking to target vulnerabilities in software systems (including bugs, vulnerabilities in third-party systems or software and technical misconfigurations in hardware and software) and weak authentication controls used by large numbers of banking organizations in order to conduct malicious cyber activities. These types of attacks have resulted in increased supply chain and third-party risk. Because the methods of cyberattacks change frequently or, in some cases, are not recognized until launch, we are not able to anticipate or implement effective preventive measures against all possible security breaches and the probability of a successful attack cannot be predicted. Although we employ detection and response mechanisms designed to contain and mitigate security incidents, early detection may be thwarted by persistent sophisticated attacks and malware designed to avoid detection. Our inability to prevent, detect, and respond to cyberattacks may lead to reputational damage, litigation with third parties, and increased cybersecurity protection and remediation costs, which in turn could materially adversely affect our results of operations.