First United (FUNC) Risk Factors

In the past, the Corporation has funded dividends on its capital securities using cash received from the Bank, and this will likely be the case for the foreseeable future.  No assurance can be given that the Bank will be able to pay dividends to the Corporation for these purposes at times and/or in amounts requested by the Corporation.  Both federal and state laws impose restrictions on the ability of the Bank to pay dividends.  Under Maryland law, a state-chartered commercial bank may pay dividends only out of undivided profits or, with the prior approval of the Maryland Commissioner, from surplus in excess of 100% of required capital stock.  If, however, the surplus of a Maryland bank is less than 100% of its required capital stock, cash dividends may not be paid in excess of 90% of net earnings.  In addition to these specific restrictions, bank regulatory agencies have the ability to prohibit proposed dividends by a financial institution which would otherwise be permitted under applicable regulations if the regulatory body determines that such distribution would constitute an unsafe or unsound practice.  Banks that are considered "troubled institution" are prohibited by federal law from paying dividends altogether.  Notwithstanding the foregoing, shareholders must understand that the declaration and payment of dividends and the amounts thereof are at the discretion of the Corporation's Board of Directors.  Thus, even at times when the Corporation is not prohibited from paying cash dividends on its capital securities, neither the payment of such dividends nor the amounts thereof can be guaranteed.

We are subject to a number of U.S. federal, state, local and foreign laws and regulations relating to consumer privacy and data protection. Under privacy protection provisions of the GLBA and its implementing regulations and guidance, we are limited in our ability to disclose certain non-public information about consumers to nonaffiliated third parties. The GLBA regulates, among other things, the use of certain information about individuals ("non-public personal information") in the context of the provision of financial services, including by banks and other financial institutions. The GLBA includes both a "Privacy Rule",  which imposes obligations on financial institutions relating to the use or disclosure of non-public personal information, and a "Safeguards Rule", which imposes obligations on financial institutions and, indirectly, their service providers to implement and maintain physical, administrative and technological measures to protect the security of non-public personal financial information. Any failure to comply with the GLBA could result in substantial financial penalties and significant reputational harm.  Multiple states have recently enacted, or are expected to enact, stringent privacy laws, not all of which exempt financial institutions categorically. Many other states are currently reviewing or proposing the need for greater regulation of the collection, sharing, use and other processing of information related to individuals for marketing purposes or otherwise, and there remains increased interest at the federal level as well. Further, to comply with the varying state laws around data breaches, we must maintain adequate security measures, which require significant investments in resources and ongoing attention. Additionally, laws, regulations, and standards covering marketing, advertising, and other activities conducted by telephone, email, mobile devices, and the internet are or may become applicable to our business, such as the Telephone Consumer Protection Act, the CAN-SPAM Act, and similar state consumer protection and communication privacy laws.  We occasionally make telephone calls and/or send SMS text messages to customers. The actual or perceived improper calling of customer phones and/or sending of text messages may subject us to potential risks, including liabilities or claims relating to consumer protection laws such as the Telephone Consumer Protection Act. Numerous class-action suits under federal and state laws have been filed in recent years against companies who conduct telemarketing and/or SMS texting programs, with many resulting in multi-million-dollar settlements to the plaintiffs. Any future such litigation against us could be costly and time-consuming to defend. In particular, the Telephone Consumer Protection Act imposes significant restrictions on the ability to make telephone calls or send text messages to mobile telephone numbers without the prior consent of the person being contacted. Federal or state regulatory authorities or private litigants may claim that the notices and disclosures we provide, form of consents we obtain or our outreach practices are not adequate or violate applicable law. This may in the future result in civil claims against us. Claims that we have violated the Telephone Consumer Protection Act could be costly to litigate, whether or not they have merit, and could expose us to substantial statutory damages or costly settlements. We also send marketing messages via email and are subject to the CAN-SPAM Act. The CAN-SPAM Act imposes certain obligations regarding the content of emails and providing opt-outs (with the corresponding requirement to honor such opt-outs promptly). While we strive to ensure that all of our marketing communications comply with the requirements set forth in the CAN-SPAM Act, any violations could result in the FTC seeking civil penalties against us. Moreover, we are considered a "user" of consumer reports provided by consumer reporting agencies under the FCRA, as amended by the Fair and Accurate Credit Transactions Act.  FCRA regulates and protects consumer information collected by consumer reporting agencies and imposes specific obligations on "users" of consumer reports. Such obligations may include restricting the sharing of information contained in a consumer report, notifying consumers when such reports are used to make an adverse decision, and, in the context of completing employee background checks, providing a notice containing certain disclosures to the consumer and obtaining their consent.

Our business depends heavily on the use of computer systems, the Internet and other means of electronic communication and recordkeeping to process, record, and monitor client transactions and to communicate with clients and other institutions on a continuous basis.  As client, industry, public, and regulatory expectations regarding operational and information security have increased, our operational systems and infrastructure continue to be safeguarded and monitored for potential failures, disruptions, and breakdowns, whether as a result of events beyond our control or otherwise. Our business, financial, accounting, data processing, or other operating systems and facilities may stop operating properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control. For example, there could be sudden increases in client transaction volume; electrical or telecommunications outages; natural disasters such as earthquakes, tornadoes, floods, and hurricanes; disease pandemics; events arising from local or larger scale political or social matters, including terrorist acts; occurrences of employee error, fraud, theft, or malfeasance; disruptions caused by technology implementation, including hardware deployment and software updates; and, as described below, cyber-attacks. Although we have business continuity plans and other safeguards in place, our operations and communications may be adversely affected by significant and widespread disruption to our systems and infrastructure that support our businesses, clients, and teammates. While we continue to evolve and modify our business continuity plans, there can be no assurance in an escalating threat environment that they will be effective in avoiding disruption and business impacts. Our insurance may not be adequate to compensate us for all resulting losses, and the cost to obtain adequate coverage may increase for us or the industry. Security risks for financial institutions such as ours have dramatically increased in recent years in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication, resources, and activities of hackers, terrorists, activists, industrial spies, insider bad actors, organized crime, and other external parties, including nation state actors. In addition, to access our products and services, clients may use devices and/or software that are beyond our control environment, which may provide additional avenues for attackers to gain access to confidential information. Although we have information security procedures and controls in place, our technologies, systems, networks, and clients' devices and software may become the target of cyber-attacks, information security breaches, business email compromise, or information theft that could result in the unauthorized release, gathering, monitoring, misuse, loss, change, or destruction of our or our clients' or teammates' confidential, proprietary, or other information (including personal identifying information of individuals), or otherwise disrupt our or our clients' or our third parties' business operations. U.S. financial institutions and financial service companies have reported breaches in the security of their websites or other systems, including attempts to shut down access to their networks and/or systems in an attempt to extract compensation from them to regain control. Financial institutions, including the Bank, have experienced distributed denial-of-service attacks, a sophisticated and targeted attack intended to disable or degrade internet service or to sabotage systems. We and others in our industry are regularly the subject of attempts by attackers to gain unauthorized access to our networks, systems, and data, or to obtain, change, or destroy confidential data (including personal identifying information of individuals) through a variety of means, including computer viruses, malware, business email compromise, and phishing. These attacks may result in unauthorized individuals obtaining access to our confidential information or that of our clients or teammates, or otherwise accessing, compromising, damaging, or disrupting our systems or infrastructure. We are continuously developing and enhancing our controls, processes, and practices designed to protect our systems, computers, software, data, and networks from attack, damage, or unauthorized access. This continued development and enhancement will require us to expend additional resources, including resources to investigate and remediate any information security vulnerabilities that may be detected. Despite our ongoing investments in security resources, talent, and business practices, we are unable to assure that any security measures will be effective. If our systems and infrastructure were to be breached, compromised, damaged, or disrupted, or if we were to experience a loss of our confidential information or that of our clients or teammates, we could be subject to serious negative consequences, including disruption of our operations, damage to our reputation, a loss of trust in us on the part of our clients, vendors or other counterparties, client or teammate attrition, reimbursement or other costs, increased compliance costs, significant litigation exposure and legal liability, or regulatory fines, penalties or intervention. Any of these could materially and adversely affect our results of operations, our financial condition, and/or our share price.

In deciding whether to extend credit or enter into other transactions, we rely on information furnished by or on behalf of customers and counterparties, including financial statements, credit reports and other financial information. We also rely on representations of those customers, counterparties or other third parties, such as independent auditors, as to the accuracy and completeness of that information. Reliance on inaccurate or misleading financial statements, credit reports or other financial information could have a material adverse impact on our business, financial condition and results of operations.

In general, we are unable to control the amount of premiums that are required to be paid for FDIC insurance.  In October 2022, the FDIC finalized a rule to increase the assessment rate by two basis points beginning in the first quarter of 2023.  The increase in the assessment rate for banks is intended to increase the Deposit Insurance Fund ("DIF)" reserve ratio to 1.35%.  In early March 2023, the FDIC was appointed receiver for two banks, in each case due primarily to liquidity concerns at those institutions.  Promptly following these events, the federal banking regulators announced that the FDIC will use funds from the DIF to ensure that all depositors of the two failed institutions are made whole, at no cost to taxpayers.  We anticipate that the FDIC will impose special assessments on all banks to replenish the DIF.  As a result of these and/or other financial institution failures, we may be required to pay significantly higher premiums than the levels currently imposed, as well as additional special assessments or taxes, which could adversely affect earnings.  Any future increases or required repayments in FDIC insurance premiums may materially adversely affect our results of operations.