First Bancorp (FNLC) Risk Analysis

In June 2013 the Federal Reserve Board finalized rules that substantially amended the regulatory risk-based capital rules applicable to us. These rules implement the Basel III regulatory capital reforms and changes required by the Dodd-Frank Act. Phase-in of the rules started in 2015 and was completed in 2019. The Company and Bank complied with the fully phased requirements well in advance of the completion date and continued to do so as of December 31, 2023. In July 2023 US bank regulators jointly published proposed rulemaking for Basel III Finalization, also referred to as Basel III Endgame or B3E. The proposal significantly alters the regulatory capital regime for US banks, generally increasing required capital levels for banks with $100 billion or more in assets. Implementation of B3E could have unintended consequences on regional and community banks whose total assets are below threshold, such as the Bank, and result in lower returns on equity, require additional capital, limit lending activities, or limit distributions such as dividends. In addition, in a weak economic environment, bank regulators may impose capital requirements that are more stringent than those required by applicable existing regulations. The application of more stringent capital requirements could result in lower returns on equity, require the raising of more capital, or result in adverse regulatory actions or other consequences if we are unable to comply with such requirements. Implementation of changes to asset risk weightings for risk-based capital calculations, items included or deducted in calculating regulatory capital, or additional capital conservation buffers could result in management modifying our business strategy and could limit our ability to make distributions, including paying dividends or repurchasing our shares, or to grow the Bank's business.

Most of the Bank's lending is in Mid-Coast and Eastern Maine. As a result of this geographic concentration, a significant broad-based deterioration in economic conditions in this area of Northern New England could have a material adverse impact on the quality of the Bank's loan portfolio, and could result in a decline in the demand for our products and services and, accordingly, could negatively impact our results of operations. Such a decline in economic conditions could impair borrowers' ability to pay outstanding principal and interest on loans when due and, consequently, adversely affect the cash flows of our business. The Bank's loan portfolio is largely secured by real estate collateral. A substantial portion of the real and personal property securing the loans in the Bank's portfolio is located in Mid-Coast and Eastern Maine. Conditions in the real estate market in which the collateral for the Bank's loans is located strongly influence the level of the Bank's non-performing loans, the potential or actual amounts realized from real estate collateral in the event of default, and ultimately the results of operations.

We rely heavily on communications, information systems (both internal and provided by third parties) and the internet to conduct our business. Our business is dependent on our ability to process and monitor large numbers of daily transactions in compliance with legal, regulatory and internal standards and specifications. In addition, a significant portion of our operations relies heavily on the secure processing, storage and transmission of personal and confidential information, such as the personal information of our customers and clients. Our use of and reliance on, and the risks associated with, such operations are likely to increase in the future as we continue to increase mobile capabilities and other internet-based product offerings and expand our internal usage of web-based products and third-party hosted applications. In the event of a failure, interruption or breach of our information systems and business operations, we may be unable to avoid impact to our customers and business. Other U.S. financial service institutions and companies have reported breaches in the security of their websites or other systems and have experienced significant distributed denial-of-service attacks, some of which involved sophisticated and targeted attacks intended to disable or degrade service, or sabotage systems. Other potential attacks have attempted to obtain unauthorized access to confidential information or destroy data, often through the introduction of computer viruses or malware, cyberattacks and other means. To date, none of these efforts has had a material adverse effect on our business or operations. However, our costs of preventing, detecting, and addressing such threats or attacks continue to increase. Such security attacks can originate from a wide variety of sources, including persons who are involved with organized crime or who may be linked to terrorist organizations or hostile foreign governments. Those same parties may also attempt to fraudulently induce employees, customers or other users of our systems to disclose sensitive information in order to gain access to our data or funds or those of our customers or clients. The Bank regularly works with a third party information security consultant to review and test various systems, and has an ongoing information security training program for employees. Despite these efforts our security systems may not be able to protect our information systems from similar attacks due to the rapid evolution and creation of sophisticated cyberattacks. We are also subject to the risk that our employees, without authorization, may intercept and transmit confidential or proprietary information. An interception, misuse or mishandling of personal, confidential or proprietary information being sent to or received from a customer or third party could result in legal liability, remediation costs, regulatory action and reputational harm. We also have risk related to data or security breaches affecting other companies. Under Federal banking regulations, if a consumer's debit card is compromised, the liability for unauthorized transactions falls primarily on the issuing financial institution, not on the consumer or the company which experienced the data or security breach. Since the introduction of EMV or Chip cards, we have had the ability to charge back fraudulent transactions to the acquiring merchant if that merchant does not have an EMV capable terminal.  In the normal course of business the Bank issues EMV/Chip debit cards to its customers to keep this risk as low as possible.  However fraud can still occur online or using fallback transactions, creating potential risk for this type of liability.

The financial services industry is continually undergoing technological change with frequent introductions of new technology-driven products and services. The effective use of technology increases efficiency and enables financial institutions to better serve customers and to reduce costs. Our future success depends, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Our largest competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers. Failure to successfully keep pace with technological change affecting the financial services industry, and increased costs due to efforts to keep pace with change, could have a material adverse effect on us. To date, there has been no material adverse effect on our business or operations due to failure of keeping pace with technological change.