First Hawaiian (FHB) Risk Analysis

As a financial institution, we are susceptible to fraudulent activity, information security breaches and cybersecurity-related incidents that may be committed against us or our clients, which may result in financial losses or increased costs to us or our clients, disclosure, loss or misuse of our information or our client information, misappropriation of assets, privacy breaches against our clients, litigation or damage to our reputation. Such fraudulent activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering and other dishonest acts. Information security breaches and cybersecurity-related incidents may include fraudulent or unauthorized access to systems used by us or our clients, denial or degradation of service attacks, and malware or other cyberattacks. These types of threats may derive from human error, fraud or malice on the part of external or internal parties or may result from accidental technological failure. In recent periods, several large corporations, including financial institutions and retail companies, have suffered major data breaches, in some cases exposing not only confidential and proprietary corporate information, but also sensitive financial and other personal information of their customers and employees and subjecting them to potentially fraudulent activity. Some of our clients may have been affected by these breaches, which increase their risks of identity theft, credit card fraud and other fraudulent activity that could involve their accounts with us. We are regularly the target of attempted electronic fraudulent activity, security breaches and cybersecurity-related attacks. Consistent with industry trends, we may face an increasing number of attempted cyberattacks as we expand our mobile and other internet-based products and services, and we provide more of these services to a greater number of individual customers. The increased use of mobile and cloud technologies can heighten these and other operational risks. Further, the use of artificial intelligence ("AI") by cybercriminals may increase the frequency and severity of cybersecurity attacks against us or our service providers and others on whom we rely. We also face risks related to cyberattacks and other security breaches in connection with credit card transactions that typically involve the transmission of sensitive information regarding our customers through various third parties, including merchant acquiring banks, payment processors, payment card networks and our processors. Some of these parties have in the past been the target of security breaches and cyberattacks, and because the transactions involve third parties and environments such as the point of sale that we do not control or secure, future security breaches or cyberattacks affecting any of these third parties could impact us through no fault of our own, and in some cases we may have exposure and suffer losses for breaches or attacks relating to them. Information pertaining to us and our customers is maintained, and transactions are executed, on networks and systems maintained by us, our customers and certain of our third-party partners, such as our online banking or reporting systems. The secure maintenance and transmission of confidential information, as well as execution of transactions over these systems, are essential to protect us and our customers against fraud and security breaches and to maintain our customers' confidence. Breaches of information security also may occur, and in infrequent cases, have occurred through intentional or unintentional acts by those having access to our systems or our customers' or counterparties' confidential information, including employees. In addition, increases in criminal activity levels and sophistication, advances in computer capabilities, new discoveries, vulnerabilities in third-party technologies (including browsers and operating systems) or other developments could result in a compromise or breach of the technology, processes and controls that we use to prevent fraudulent transactions and to protect data about us, our customers and underlying transactions, as well as the technology used by our customers to access our systems. Although we have developed, and continue to invest in, systems and processes that are designed to detect and prevent security breaches and cyberattacks and periodically test our security, our inability to anticipate, or failure to adequately mitigate, breaches of security could result in: losses to us or our customers; our loss of business and/or customers; damage to our reputation; the incurrence of additional expenses; disruption to our business; our inability to grow our online services or other businesses; additional regulatory scrutiny or penalties; or our exposure to civil litigation and possible financial liability - any of which could have a material adverse effect on our business, financial condition or results of operations. Additionally, we may not be able to ensure that our third-party vendors have appropriate controls in place to protect the confidentiality of the information they receive from us and our business, financial condition or results of operations could be adversely affected by a material breach of, or disruption to, the security of any of our or our vendors' systems. Because the investigation of any information security breach is inherently unpredictable and would require substantial time to complete, the Company may not be able to quickly remediate the consequences of any breach, which may increase the costs, and enhance the negative consequences associated with a breach. In addition, to the extent the Company's insurance covers aspects of any breach, such insurance may not be sufficient to cover all of the Company's losses.

We operate in the highly competitive financial services industry and face significant competition for customers from financial institutions located both within and beyond our principal markets. We compete with commercial banks, savings banks, credit unions, non-bank financial services companies and other financial institutions operating within or near the areas we serve. Additionally, certain large banks headquartered on the U.S. mainland and large community banking institutions target the same customers we do. In addition, as customer preferences and expectations continue to evolve, technology has lowered barriers to entry and made it possible for banks to expand their geographic reach by providing services over the Internet and for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. The emergence, adoption and evolution of new technologies that do not require intermediation, including distributed ledgers such as digital assets and blockchain, as well as advances in robotic process automation or AI, could significantly affect the competition for financial services. The banking industry is experiencing rapid changes in technology, and, as a result, our future success will depend in part on our ability to address our customers' needs by using technology. Customer loyalty can be influenced by a competitor's new products, especially offerings that could provide cost savings or a higher return to the customer. We continue to face increased competitive pressures on loan rates and terms for high-quality credits. We may not be able to compete successfully with other financial institutions in our markets, and we may have to pay higher interest rates to attract deposits, accept lower yields to attract loans and pay higher wages for new employees, resulting in lower net interest margins and reduced profitability. Many of our non-bank competitors are not subject to the same extensive regulations that govern our activities and may have greater flexibility in competing for business. The financial services industry could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. In addition, some of our current commercial banking customers may seek alternative banking sources as they develop needs for credit facilities larger than we may be able to accommodate. Our inability to compete successfully in the markets in which we operate could have a material adverse effect on our business, financial condition or results of operations.

As the parent company of Hawaii's oldest and largest bank, we rely in part on our bank's reputation for superior financial services to retain our customer relationships. Damage to our reputation could undermine the confidence of our current and potential customers in our ability to provide high-quality financial services. Such damage could also impair the confidence of our counterparties and vendors and ultimately affect our ability to effect transactions. Maintenance of our reputation depends not only on our success in maintaining our service-focused culture and controlling and mitigating the various risks described in this Form 10-K, but also on our success in identifying and appropriately addressing issues that may arise in areas such as potential conflicts of interest, anti-money laundering, customer personal information and privacy issues, customer and other third party fraud, record-keeping, regulatory investigations, any litigation that may arise from any failure or perceived failure on our part to comply with legal and regulatory requirements and ESG matters, including climate risk, hiring practices, the diversity of our work force, and racial and social justice issues involving our personnel, customers and third parties with whom we otherwise do business. Maintaining our reputation also depends on our ability to successfully prevent third parties from infringing on the "First Hawaiian Bank" brand and associated trademarks and our other intellectual property. Defense of our reputation, trademarks and other intellectual property, including through litigation, could result in costs that could have a material adverse effect on our business, financial condition or results of operations.

We depend, to a significant extent, on relationships with third-party service providers that provide services, primarily information technology services, that are critical to our operations. We utilize third-party core banking services and receive credit card and debit card services, Internet banking services, various information services and services complementary to our banking products from various third-party service providers. We are also exposed to the risk that a cyberattack, security breach or other information technology incident at a common vendor to our third-party service providers could impede their ability to provide services to us. We may not be able to effectively monitor or mitigate operational risks relating to the use of common vendors by third-party service providers. If any of our third-party service providers experience difficulties or terminate their services and we are unable to replace our service providers with other service providers, our operations could be interrupted. It may be difficult for us to replace some of our third-party vendors, particularly vendors providing our core banking, credit card and debit card services and information services, in a timely manner if they are unwilling or unable to provide us with these services in the future for any reason. If an interruption were to continue for a significant period of time, it could have a material adverse effect on our business, financial condition or results of operations. Even if we are able to replace them, it may be at higher cost to us, which could have a material adverse effect on our business, financial condition or results of operations. In addition, if a third-party provider fails to provide the services we require, fails to meet contractual requirements, such as compliance with applicable laws and regulations, or suffers a cyberattack or other security breach, our business could suffer economic and reputational harm that could have a material adverse effect on our business, financial condition or results of operations.

Our bank's deposits are insured by the FDIC up to legal limits and, accordingly, our bank is subject to FDIC deposit insurance assessments. We generally cannot control the amount of premiums our bank will be required to pay for FDIC insurance. Beginning in the first quarterly assessment period of 2023, the FDIC increased the initial base deposit insurance assessment rate schedules by 2 basis points, and the FDIC may in the future further increase assessment rates to meet the FDIC's designated reserve ratio, which is currently maintained at 2% of insured deposits. Future increases of FDIC insurance premiums or special assessments could have a material adverse effect on our business, financial condition or results of operations. See "Item 1. Business - Supervision and Regulation - Deposit Insurance."