Heritage Commerce (HTBK) Risk Analysis

We are and will continue to be involved from time to time in a variety of litigation, regulatory actions, investigations or similar matters arising out of our business. These matters may include supervisory or enforcement actions by our regulators, criminal proceedings by prosecutorial authorities, claims by clients or by former and current employees, including class, collective and representative actions, or environmental lawsuits stemming from property that we may hold as OREO following a foreclosure action in the course of our business.  It is inherently difficult to assess the outcome of these matters, and we may not prevail in any proceedings or litigation. Any such matters could be time-consuming and expensive to resolve, involve regulatory sanctions, civil money penalties or fines, divert management attention from executing our business plan, and lead to attempts on the part of other parties to pursue similar claims.  Any proceedings or claims asserted against us, regardless of merit or eventual outcome may harm our reputation.  To mitigate the cost of some of these matters, we maintain insurance coverage in amounts and with deductibles that we believe are appropriate for our operations. However, our insurance coverage does not cover any civil monetary penalties, punitive damages or fines imposed by government authorities and may not cover all other claims that might be brought against us, including certain wage and hour class, collective and representative actions brought by clients, team members or former team members, and ponzi schemes. In addition, such insurance coverage may not continue to be available to us at a reasonable cost or at all. As a result, we may be exposed to substantial uninsured liabilities, reputational harm, regulatory sanctions or other effects which could adversely affect our business, prospects, financial condition, results of operations and capital position.

Deferred tax assets and liabilities are the expected future tax amounts for the temporary differences between the carrying amounts and tax basis of assets and liabilities computed using enacted tax rates. We regularly assess available positive and negative evidence to determine whether it is more likely than not that our net deferred tax assets will be realized. Realization of a deferred tax asset requires us to apply significant judgment and is inherently speculative because it requires estimates that cannot be made with certainty. At December 31, 2024, we had a net deferred tax asset of $27.8 million. If we were to determine at some point in the future that we will not achieve sufficient future taxable income to realize our net deferred tax asset, we would be required, under generally accepted accounting principles, to establish a full or partial valuation allowance which would require us to incur a charge to income for the period in which the determination was made.

We depend to a significant extent on relationships with third-party service providers. Specifically, we utilize third party core banking services and receive credit card and debit card services, branch capture services, Internet banking services and services complementary to our banking products from various third party service providers. These types of third-party relationships are subject to increasingly demanding regulatory requirements that require us to maintain and continue to enhance our due diligence and ongoing monitoring and control over our third-party vendors. We may be required to renegotiate our agreements to meet these enhanced requirements, which could increase our costs or which may be impracticable. If our service providers experience difficulties or terminate their services and we are unable to replace them, our operations could be interrupted. It may be difficult for us to timely replace some of our service providers, which may be at a higher cost due to the unique services they provide. A third-party provider may fail to provide the services we require, or meet contractual requirements, comply with applicable laws and regulations, or suffer a cyberattack or other security breach. We expect that our regulators would hold us responsible for deficiencies of our third-party relationships which could result in enforcement actions, including civil money penalties or other administrative or judicial penalties or fines, or client remediation, any of which could have a material adverse effect on our business, financial condition and results of operations.

At December 31, 2024, land and construction loans, (including land acquisition and development loans) totaled $127.8 million or 4% of our portfolio. Of these loans, 18% were comprised of owner occupied and 82% non-owner occupied land and construction loans. These loans involve additional risks because funds are advanced upon the security of the project, which is of uncertain value prior to its completion, and costs may exceed realizable values in declining real estate markets. Because of the uncertainties inherent in estimating construction costs and the realizable market value of the completed project and the effects of governmental regulation of real property, it is relatively difficult to evaluate accurately the total funds required to complete a project and the related loan-to-value ratio. As a result, construction loans often involve the disbursement of substantial funds with repayment dependent, in part, on the success of the ultimate project and the ability of the borrower to sell or lease the property, rather than the ability of the borrower or guarantor to repay principal and interest. If our appraisal of the value of the completed project proves to be overstated or market values or rental rates decline, we may have inadequate security for the repayment of the loan upon completion of project construction. If we are forced to foreclose on a project prior to or at completion due to a default, we may not be able to recover all of the unpaid balance of, and accrued interest on, the loan as well as related foreclosure and holding costs. In addition, we may be required to fund additional amounts to complete the project and may have to hold the property for an unspecified period of time while we attempt to dispose of it.

Severe weather, natural disasters (including fires, earthquakes, and floods), wide spread disease or pandemics, such as the COVID-19 pandemic, acts of war or terrorism, social unrest and other adverse external events have had in the past and could have in the future a significant impact on our ability to conduct business and create significant volatility and disruption in global and U.S. economies. Such events could affect the financial markets, reduce access to liquidity,impair our client's financial condition, affect the stability of our deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue and/or cause us to incur additional expenses. The majority of our branches are located in the San Jose, San Francisco, Oakland areas, which in the past have experienced both severe earthquakes and wildfires. We do not carry earthquake insurance on our properties. Earthquakes, wildfires or other natural disasters could severely disrupt our operations. Operations in our market could be disrupted by both the evacuation of large portions of the population as well as damage to and/or lack of access to our banking and operation facilities. Although management has established disaster recovery policies and procedures, the occurrence of any such events could have a material adverse effect on our business, financial condition and results of operations.

From time to time, we may implement or may acquire new lines of business or offer new products and services within existing lines of business. There are substantial risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and new products and services we may invest significant time and resources. We may not achieve target timetables for the introduction and development of new lines of business and new products or services and price and profitability targets may not prove feasible. External factors, such as regulatory compliance obligations, competitive alternatives, and shifting market preferences, may also impact the successful implementation of a new line of business or a new product or service. Furthermore, any new line of business and/or new product or service could have a significant impact on the effectiveness of our system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business or new products or services could have a material adverse effect on our business, financial condition and results of operations.

In the normal course of business, we (directly or through third parties) collect, store, share, process and retain sensitive and confidential information regarding our clients. We also rely heavily upon electronic infrastructure that we own or that we obtain via license or other contractual arrangements with third parties. This infrastructure is essential in the conduct of our business, including for allowing our clients to access and transfer funds, initiate and pay loans and leases, communicating with our client service teams, and a variety of other activities that form the foundation of modern financial services businesses. There have been a number of recent and well-publicized incidents involving various types of cybersecurity lapses, and many of these have had substantial impacts upon targeted businesses and on clients of even some of the world's most prominent cybersecurity firms. One of the most recent events resulted in a widespread failure of a large cybersecurity platform, some of the consequences of which are ongoing and may not be fully known or estimable. Similarly, extremely sophisticated criminal and nation-state organizations routinely target and exploit information technology networks, data systems, and other critical infrastructure. We devote significant financial and management resources to ensure the integrity of our systems against cybercriminals and similar actors, as well as against threats from fires and other natural disasters; power or telecommunications failures; acts of terrorism or wars or other catastrophic events; breaches, physical break-ins or errors resulting in interruptions and unauthorized disclosure of confidential information, through information security and business continuity programs. Notwithstanding these efforts, cybersecurity measures are, by their nature, largely reactive, and threats are constantly evolving. We expect that the development of AI-based technology will cause a rapid expansion in both the number and the sophistication of these threats. While we believe we maintain state-of-the-art defensive measures, we routinely experience attempts to exploit our networks and systems, and we must continue investing in increasingly sophisticated (and concomitantly expensive) technology to counteract these threats. Further, if our systems cannot timely detect and mitigate vulnerabilities, or cannot promptly respond to threats, we may experience damage to or interruptions in the availability of our computer networks, or we may experience a loss of data, unauthorized use or disclosure of client information, or a loss of client funds as a result of unauthorized access to client accounts. Additionally, as financial institutions and technology systems become more interconnected and more complex, any operational incident at a third party, such as a vendor or client, may increase our operational risks, including from information breaches or loss, breakdowns, disruptions or failures of their own systems or infrastructure, or any deficiencies in the performance of their responsibilities. These risks are increased to the extent we rely on a single-source vendor or provider. The access by unauthorized persons to, or the improper disclosure by us or our third-party vendors of, confidential information regarding our clients or our own proprietary information, software, methodologies and business secrets, failures or disruptions in our communications, information and technology systems, or our failure to adequately address them, could negatively affect our client relationship management, online banking, accounting or other systems. We cannot assure readers that such breaches, failures or interruptions will not occur or, if they do occur, that they will be adequately addressed by us or the third parties on which we rely. Our insurance may not fully cover all types of losses. Accordingly, any failures or interruptions of our communications, information and technology systems could damage our reputation, result in a loss of client business, subject us to additional regulatory scrutiny or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on our business, financial condition or results of operations.

In deciding whether to extend credit or to enter into other transactions with clients and counterparties, we may rely on information furnished to us by or on behalf of clients and counterparties, including financial statements and other financial information. Some of the information regarding clients provided to us is also used in our proprietary credit decision making and scoring models, which we use to determine whether to do business with clients, Further, the risk profiles of such clients may subsequently be utilized by counterparties who may lend us capital to fund our operations. We may also rely on representations of clients and counterparties as to the accuracy and completeness of that information. In deciding whether to extend credit, we may rely upon our clients' representations that their financial statements conform to stated accounting principles and present fairly, in all material respects, the financial condition, results of operations and cash flows of the client. We also may rely on client representations and certifications, or other audit or accountants' reports, with respect to the business and financial condition of our clients. Whether a misrepresentation is made by the applicant, another third party or one of our team members, we generally bear the risk of loss associated with the misrepresentation. We may not detect all misrepresented information in our originations or from service providers we engage to assist in the approval process. Any such misrepresented information could have a material adverse effect on our business, financial condition and results of operations.

We are a community bank, and our reputation is one of the most valuable components of our business. Threats to our reputation can come from many sources, including adverse sentiment about financial institutions generally, unethical practices, team member misconduct, cybersecurity failures or disruptions, failure to deliver minimum standards of service or quality, compliance deficiencies, and questionable or fraudulent activities of our clients or third parties. Negative publicity regarding our business, team members, or clients, with or without merit, may result in the loss of clients, investors and team members, costly litigation, a decline in revenues and increased governmental regulation and have a material adverse effect on business, financial condition and results of operations.