First Northern Community Bancorp (FNRN) Risk Analysis

The Tax Cuts and Jobs Act ("TCJA"), signed into law on December 22, 2017, enacted sweeping changes to the U.S. federal tax laws generally effective January 1, 2018.  These changes have impacted our business and results of operations in a variety of ways, some of which are positive and others which are negative.  The TCJA reduced the corporate tax rate to 21% from 35%, which resulted in a net reduction in our annual income tax expense and which has also benefited many of our corporate and other small business borrowers.  However, our ability to utilize tax credits, such as those arising from low-income housing and alternative energy investments, is constrained by the lower tax rate.  There are presently pending in the U.S. Congress measures which would substantially increase the U.S. corporate tax rate.  If enacted, such measures could adversely impact our profitability and that of our business and commercial customers.

As discussed above in Part I under the caption "Business – Premiums for Deposit Insurance," in September, 2020, the FDIC board of directors voted to adopt a restoration plan for the Deposit Insurance Fund to ensure that the ratio of the fund's reserves to insured deposits reaches 1.35% within the next 8 years, as required by the Dodd-Frank Act.  This action was in response to the reserve ratio dropping to 1.30% primarily due to the inflow of more than $1 trillion in estimated insured deposits in the first six month of 2020 resulting mainly from the pandemic, monetary policy actions, direct government assistance and an overall reduction in business spending.  On October 18, 2022, the FDIC adopted a final rule, applicable to all insured depository institutions to increase the initial base deposit insurance assessment rate schedules uniformly by two basis points consistent with the Amended Restoration Plan approved by the FDIC on June 21, 2022. The FDIC indicated that it was taking this action in order to restore the DIF reserve ratio to the required statutory minimum of 1.35% by the statutory deadline of September 30, 2028.  Under the final rule, the increase in rates began with the first quarterly assessment period of 2023 and will remain in effect unless and until the reserve ratio meets or exceeds 2% in order to support growth in the DIF in progressing toward the FDIC's long-term goal of a 2% reserve ratio. On November 16, 2023, the FDIC issued a final rule to implement a special assessment to recover the loss to the DIF associated with protecting uninsured depositors following the closure of Silicon Valley Bank and Signature Bank. This special assessment did not apply to the Bank; however, there can be no assurance that the FDIC will not impose special assessments on, or increase annual assessments payable by, the Bank in the future. Any further increases in the deposit insurance assessments the Bank pays would further increase our costs.

Our operations rely on the secure processing, storage, transmission and reporting of personal, confidential and other sensitive information in our computer systems, networks and business applications. Although we take protective measures, our computer systems, as well as the systems of our third-party providers, may be vulnerable to breaches or attacks, unauthorized access, misuse, computer viruses or other malicious code, operational errors, including clerical or record-keeping errors or those resulting from faulty or disabled computer or telecommunications systems, and other events that could have significant negative consequences to us. Such events could result in interruptions or malfunctions in our or our customers' operations, interception, misuse or mishandling of personal or confidential information, or processing of unauthorized transactions or loss of funds. These events could result in litigation, regulatory enforcement actions, and financial losses that are either not insured against or not fully covered by our insurance, or result in regulatory consequences or reputational harm, any of which could harm our competitive position, operating results and financial condition. We maintain cyber insurance, but this insurance may not cover all costs associated with cyber incidents or the consequences of personal or confidential information being compromised.  These types of incidents can remain undetected for extended periods of time, thereby increasing the associated risks. We may also be required to expend significant resources to modify our protective measures or to investigate and remediate vulnerabilities or exposures arising from cybersecurity risks. We depend on the continued efficacy of our technical systems, operational infrastructure, relationships with third parties and our employees in our day-to-day and ongoing operations. Our increasing dependence upon automated systems to record and process transactions may further increase the risk that technical system flaws or employee tampering or manipulation of those systems will result in losses that are difficult to detect. With regard to the physical infrastructure that supports our operations, we have taken measures to implement backup systems and other safeguards, but our ability to conduct business may be adversely affected by any disruption to that infrastructure. Failures in our internal control or operational systems, security breaches or service interruptions could impair our ability to operate our business and result in potential liability to customers, reputational damage and regulatory intervention, any of which could harm our operating results and financial condition. We may also be subject to disruptions of our operating systems arising from other events that are wholly or partially beyond our control, such as outages related to electrical, internet or telecommunications, natural disasters (such as major seismic events), or unexpected difficulties with the implementation of our technology enhancement and replacement projects, which may give rise to disruption of service to customers and to financial loss or liability. Our business recovery plan may not work as intended or may not prevent significant interruptions of our operations. In recent years, it has been reported that several of the larger U.S. banking institutions have been the target of various denial-of-service or other cyberattacks (including attempts to inject malicious code and viruses into computer systems) that have, for limited periods, resulted in the disruption of various operations of the targeted banks. These cyber-attacks originate from a variety of sophisticated sources who may be involved with organized crime, linked to terrorist organizations or hostile countries and have extensive resources to disrupt the operations of the Bank or the financial system more generally. The potential for denial-of-service and other attacks requires substantial resources to defend and may affect customer satisfaction and behavior. To date we have not experienced any material losses relating to cyberattacks or other information security breaches, but there can be no assurance that we will not suffer such losses or information security breaches in the future. A successful cyber-attack could result in a material disruption of the Bank's operations, exposure of confidential information and financial loss to the Bank, its clients, customers and counterparties and could lead to significant exposure to litigation and regulatory fines, penalties and other sanctions as well as reputational damage. While we have a variety of cyber-security measures in place, the consequences to our business, if we were to become a target of such attacks, cannot be predicted with any certainty. In addition, there have been increasing efforts on the part of third parties to breach data security at financial institutions or with respect to financial transactions, including through the use of social engineering schemes such as "phishing." The ability of our customers to bank remotely, including online and though mobile devices, requires secure transmission of confidential information and increases the risk of data security breaches which would expose us to claims by customers or others and which could adversely affect our reputation and could lead to a material loss. We, and other banking institutions, are also at risk of increased losses from fraudulent conduct of criminals using increasingly sophisticated techniques which, in some cases, are part of larger criminal organizations which allow them to be more effective. This criminal activity is taking many forms, including information theft, debit/credit card fraud, check fraud, mechanical devices affixed to ATM's, social engineering, phishing attacks to obtain personal information, or impersonation of customers through falsified or stolen credentials, business email compromise, and other criminal endeavors. We, and other banking institutions are also at risk of fraudulent or criminal activities by employees, contractors, vendors and others with whom we do business. There is also the risk of errors by our employees and others responsible for the systems and controls on which we depend and any resulting failures of these systems and controls could significantly harm the Company, including customer remediation costs, regulatory fines and penalties, litigation or enforcement actions, or limitations on our business activities. Even if cyber-attacks and similar tactics are not directed specifically at the Bank, such attacks on other large financial institutions could disrupt the overall functioning of the financial system and undermine consumer confidence in banks generally, to the detriment of other financial institutions, including the Bank.  A data security breach at a large U.S. retailer resulted in the compromise of data related to credit and debit cards of large numbers of customers requiring many banks, including the Bank, to reissue credit and debit cards for affected customers and reimburse these customers for losses sustained. We maintain insurance which we believe provides sufficient coverage against these risks at a manageable expense for an institution of our size and scope with similar technological systems. However, we cannot assure that this insurance would be sufficient to cover all financial losses, damages, penalties, including lost revenues, should we experience any one or more of our or a third-party's systems failing or experiencing attack.

Advances and changes in technology can significantly impact the business and operations of the Company. The financial services industry is undergoing rapid technological change which regularly involves the introduction of new products and services based on new or enhanced technologies. Examples include cloud computing, artificial intelligence and machine learning, biometric authentication and data protection enhancements, as well as increased online and mobile device interaction with customers and increased demand for providing computer access to Bank accounts and the systems to perform banking transactions electronically.  The Company's merchant processing services require the use of advanced computer hardware and software technology and rapidly changing customer and regulatory requirements.  The Company's ability to compete effectively depends on its ability to continue to adapt its technology on a timely and cost-effective basis to meet these requirements. Our continued success and the maintenance of our competitive position depends, in part, upon our ability to meet the needs of our customers through the application of new technologies. If we fail to maintain or enhance our competitive position with regard to technology, whether because we fail to anticipate customer needs and expectations or because our technological initiatives fail to perform as desired or are not timely implemented, we may lose market share or incur additional expense.  Our ability to execute our core operations and to implement technology and other important initiatives may be adversely affected if our resources are insufficient or if we are unable to allocate available resources effectively. In addition, the Company's business and operations are susceptible to negative impacts from computer system failures, communication and power disruption, and unethical individuals with the technological ability to cause disruptions or failures of the Company's data processing systems.

In California generally, and in the Bank's primary market area specifically, major banks dominate the commercial banking industry.  By virtue of their larger capital bases, such institutions have substantially greater lending limits than those of the Bank.  Competition is likely to further intensify as a result of the recent and increasing level of consolidation of financial services companies, particularly in our market area resulting from various economic and market conditions.  In obtaining deposits and making loans, the Bank competes with these larger commercial banks and other financial institutions, such as savings and loan associations, credit unions and member institutions of the Farm Credit System, which offer many services that traditionally were offered only by banks.  Using the financial holding company structure, insurance companies and securities firms may compete more directly with banks and bank holding companies.  In addition, the Bank competes with other institutions such as mutual fund companies, brokerage firms, and even retail stores seeking to penetrate the financial services market.  Current federal law has also made it easier for out-of-state banks to enter and compete in the states in which we operate. Competition in our principal markets has further intensified as a result of the Dodd-Frank Act which, among other things, permitted out-of-state de novo branching by national banks, state banks and foreign banks from other states. We also experience competition, especially for deposits, from internet-based banking institutions and other financial companies, which do not always have a physical presence in our market footprint and have grown rapidly in recent years.  Also, technology and other changes increasingly allow parties to complete financial transactions electronically, and in many cases, without banks.  For example, consumers can pay bills and transfer funds over the internet and by telephone without banks.  Non-bank financial service providers may have lower overhead costs and are subject to fewer regulatory constraints.  If consumers do not use banks to complete their financial transactions, we could potentially lose fee income, deposits and income generated from those deposits.  During periods of declining interest rates, competitors with lower costs of capital may solicit the Bank's customers to refinance their loans.  Furthermore, during periods of economic slowdown or recession, the Bank's borrowers may face financial difficulties and be more receptive to offers from the Bank's competitors to refinance their loans.  No assurance can be given that the Bank will be able to compete with these lenders.  See "Business – Competition" above.

Reputational risk, or the risk to our earnings and capital from negative public opinion, is inherent in our business.  Negative public opinion can result from the actual or perceived manner in which we conduct our business activities, management of actual or potential conflicts of interest and ethical issues, lending practices, governmental enforcement actions, corporate governance deficiencies, use of social media, cyber-security breaches and our protection of confidential client information, the implementation of environmental, social and governance (ESG) practices, or from actions taken by regulators or community organizations in response to such actions.  Negative public opinion can adversely affect our ability to keep and attract customers and employees and can expose us to claims and litigation and regulatory action and increased liquidity risk and could have a material adverse effect on the price of our stock.