Hancock Whitney (HWC) Risk Factors

Changes to tax laws could significantly impact our business in the form of greater than expected income tax expense and taxes payable. Such changes may also negatively impact the financial condition of our customers and/or overall economic conditions. Further, future regulatory reforms that could include a heightened focus and scrutiny on BSA/AML-related compliance, expansion of consumer protections, the regulation of loan portfolios and credit concentrations to borrowers impacted by climate change, increased capital and liquidity requirements and limitations or additional taxes on share repurchases and dividends, could increase our costs and impact our business. On August 16, 2022, the Inflation Reduction Act was signed into law in the United States. The Inflation Reduction Act includes various tax provisions, including a nondeductible 1% excise tax on the fair value of certain stock repurchases and a corporate alternative minimum tax that generally applies to U.S. corporations with average adjusted financial statement income over a three-year period in excess of $1 billion. Based on the information available to-date, we do not expect the provisions of the Inflation Reduction Act to have a material impact on our financial results, including on our annual estimated effective tax rate or on our liquidity, absent any further changes in law.

Our business faces increasing public, investor, activist, legislative and regulatory scrutiny related to ESG and "anti-ESG" developments. We risk damage to our brand and reputation in certain sectors if we fail to act in response to ESG concerns, such as diversity, equity and inclusion, environmental stewardship, human capital management, support for our local communities, corporate governance and transparency, or fail to consider ESG factors in our business operations. Concerns over the long-term impacts of climate change have led and will continue to lead to global governmental efforts to mitigate those impacts. Consumers and businesses also may change their behavior and operations as a result of these concerns. The Company and its customers will need to respond to new laws and regulations as well as consumer and business preferences resulting from climate change concerns. We and our customers may face cost increases, asset value reductions and operating process changes. The impact on our customers will likely vary depending on their specific circumstances, including a significant presence in areas that are vulnerable to natural and man-made disasters that may be exacerbated by climate change, or reliance upon or a role in carbon intensive activities. Among the impacts to the Company could be a drop in demand for our products and services, particularly in certain sectors. In addition, we could face reductions in creditworthiness on the part of some customers or in the value of assets securing loans. Our efforts to take these risks into account may not be effective in protecting us from the negative impact of new laws and regulations or changes in consumer or business behavior. Furthermore, as a result of our diverse base of clients and business partners, we may face potential negative publicity based on the identity of our clients or business partners and the public's (or certain segments of the public's) view of those entities. Such publicity may arise from traditional media sources or from social media and may increase rapidly in size and scope. If our client or business partner relationships were exposed to negative publicity, our ability to attract and retain clients, business partners, and employees may be negatively impacted, and our stock price may also be negatively impacted. Additionally, we may face pressure to not do business in certain industries that are viewed as harmful to the environment or are otherwise negatively perceived, which could impact our growth. Certain investors and shareholder advocates are placing increasing emphasis on how corporations address ESG issues in their business strategy when making investment decisions and when developing their investment strategies and proxy recommendations. We may incur increased costs with respect to our ESG efforts and if such efforts are negatively perceived, our reputation and stock price may suffer. In response to ESG developments, there are increasing instances of "anti-ESG" legislation, regulation, and litigation that could have unintended impacts on ordinary banking operations and increase litigation risk related to actions we choose to take. If legislatures in the states in which we operate adopt legislation intended to protect certain industries by limiting or prohibiting consideration of business and industry factors in lending activities, certain portions of our lending operations may be impacted.

Our market areas are often impacted by hurricanes and flooding. Natural disasters, such as hurricanes, flooding, tornados, freezes and other natural and man-made disasters, such as oil spills in the Gulf of Mexico, can disrupt our operations, result in significant damage to our properties or properties and businesses of our borrowers, including property pledged as collateral, interrupt our ability to conduct business, negatively affect the local economies in which we operate, and increase circumstances leading to litigation. We cannot predict whether or to what extent damage caused by future hurricanes and other disasters will affect our operations or the economies in our market areas, but such events could cause a decline in loan originations, a decline in the value or destruction of properties securing the loans and an increase in the risk of delinquencies, foreclosures, loan losses and litigation. Climate change may increase the nature, severity and frequency of adverse weather conditions in our footprint, making the impact from these types of natural disasters on us or our customers worse. We and our customers rely on the existence of, and ability of private and public insurance programs to provide coverage for these types of events. Cost for insurance coverage under these programs has and may continue to increase, negatively impacting our business costs and our customers' levels of liquidity and the ability to service their debt. The unavailability of these types of coverage or the inability of these entities to perform could also have a materially adverse impact on our operations.

We continuously evaluate our service offerings and may implement new lines of business or offer new products and services within existing lines of business in the future. There are substantial risks and uncertainties associated with these efforts. The development of new lines of business or new products and services often requires the commitment of significant resources that may not be recouped if not successful. Variables beyond our control or that we do not foresee may prevent the successful implementation of new lines of business, products or services. Initial timetables for the introduction and development of new lines of business and/or new products or services may not be achieved, and price and profitability targets may not prove feasible. External factors, such as compliance with regulations, competitive alternatives, and shifting market preferences, may also impact the successful implementation of a new line of business and/or a new product or service. Furthermore, any new line of business and/or new product or service could require the establishment of new key and other controls and have a significant impact on our existing system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business and/or new products or services could have a material adverse effect on our business and, in turn, our financial condition and results of operations.

Competitors or other third parties have in the past alleged, and in the future may allege that we, or consultants or other third parties retained or indemnified by us or from whom we license critical information technology systems, infringe on their intellectual property rights. Given the complex, rapidly changing and competitive technological and business environment in which we operate, and the potential risks and uncertainties of intellectual property-related litigation, an assertion of an infringement claim against us or our vendors may cause us to spend significant amounts to defend the claim (even if we ultimately prevail); to pay significant money damages; to lose significant revenues; to be prohibited from using the relevant systems, processes, technologies or other intellectual property; to cease offering certain products or services or to incur significant license, royalty or technology development expenses. Moreover, it has become common in recent years for individuals and groups to purchase intellectual property assets for the sole purpose of making claims of infringement and attempting to extract settlements from companies like ours. Even in instances where we believe that claims and allegations of intellectual property infringement against us are without merit, defending against such claims is time consuming and expensive and could result in the diversion of time and attention of our management and employees. In addition, although in some cases a third party may have agreed to indemnify us for such costs, such indemnifying party may refuse, or be unable, to uphold its contractual obligations.

We depend on our ability to process, record and monitor a large number of client transactions and to communicate with clients and other institutions on a continuous basis. Our clients depend on us for access to their assets and account information. Our online, business, financial, accounting, data processing, or other operating systems and facilities may stop operating properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control. For example, there could be sudden increases in client transaction volume; electrical or telecommunications outages; natural disasters such as earthquakes, tornadoes, floods, and hurricanes; pandemics; events arising from local or larger scale political or social matters, including terrorist acts; occurrences of employee error, fraud, or malfeasance; and, as described below, cyber-attacks. Furthermore, for most financial institutions, transitioning from existing systems and software (or transitioning legacy systems and software) to a new provider is a significant and expensive undertaking and includes a number of risks, including crashes and system downtime, transition costs, decreased productivity, security risk, and legal and regulatory compliance risks. Although we have response plans, business continuity plans and other safeguards in place, our operations and communications may be adversely affected by significant and widespread disruption to our systems and infrastructure that support our businesses and clients. While we continue to evolve and modify our response and business continuity plans, there can be no assurance in an escalating threat environment that they will be effective in avoiding disruption and business impacts. Our insurance may not be adequate to compensate us for all resulting losses, and the cost to obtain adequate coverage may continue to increase for us or the industry. Security risks for financial institutions such as ours have dramatically increased in recent years, in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication, resources and activities of hackers, terrorists, activists, organized crime, and other external parties, including nation state actors. In addition, clients may use devices or software to access our products and services that are beyond our control environment, which may provide additional avenues for attackers to gain access to confidential information. Although we have information security procedures and controls in place, certain of our technologies, systems, networks, and clients' devices and software have in the past and in the future likely will continue to be the target of cyber-attacks or information security breaches that could result in the unauthorized release, gathering, monitoring, use, loss, change or destruction of our or our clients' confidential, proprietary and other information (including personal identifying information of individuals), or otherwise disrupt our or our clients' or other third parties' business operations. From time to time, we, like other financial institutions, become aware of information security vulnerabilities in software emanating from outside vendors and must take active steps to mitigate and prevent the potential exploitation of such vulnerabilities. Further, U.S. financial institutions and financial services companies will continue to face breaches in security of their websites or other systems, including attempts to shut down access to their networks and systems in an attempt to extract compensation from them to regain control. Financial institutions have also experienced, and will continue to be the target of, distributed denial-of-service attacks, a sophisticated and targeted attack intended to disable or degrade internet service or to sabotage systems. We and others in our industry are, and will continue to be, regularly the subject of attempts by attackers to gain unauthorized access to our networks, systems, data and other infrastructure, or to obtain, change, or destroy confidential data (including personal identifying information of individuals) through a variety of means, including computer hacking, acts of vandalism or theft, malware, computer viruses or other malicious codes, phishing, employee error or malfeasance, catastrophes, unforeseen events or other cyber-attacks. In the future, these attacks may result in unauthorized individuals obtaining material access to our confidential information or that of our clients, or otherwise materially accessing, damaging, or disrupting our systems or infrastructure. To date, we have seen no material adverse impact on our business or operations from cyber-attacks or events. Any future significant compromise or breach of our data security, whether external or internal, or misuse of customer, associate, supplier or Company data, could result in significant disruption of our operations, reimbursement and other costs, lost sales, fines, lawsuits and other legal exposure, a loss of trust in us on the part of our clients, vendors or other counterparties, client attrition and damage to our reputation. Any of these could materially and adversely affect our results of operations, our financial condition, and/or our share price. However, the ever-evolving threats mean we and our third-party service providers and vendors must continually evaluate and adapt our respective systems and processes and overall security environment, as well as those of any companies we acquire. We are continuously enhancing our controls, processes and practices designed to protect our networks, systems, data and other infrastructure from attack, damage or unauthorized access. This continued enhancement will require us to expend additional resources, including to investigate and remediate any information security vulnerabilities that may be detected. Despite our ongoing investments in security resources, talent, and business practices, there is no guarantee that these measures will be adequate to safeguard against all data security breaches, system compromises or misuses of data.

We rely on certain third parties to provide products and services necessary to maintain day-to-day operations, such as back office support, data processing and storage, recording and monitoring transactions, online banking interfaces and services, Internet connections, telecommunications, and network access. The failure of a third party to perform in accordance with the contracted arrangements under service level agreements as a result of changes in the third party's organizational structure, financial condition, support for existing products and services, strategic focus, system interruption or breaches, or for any other reason, could be disruptive to our operations, which could have a material adverse effect on our business, financial condition and results of operations. Our third-party applications may include confidential and proprietary data provided by vendors and by us, including personal employee and/or customer data. While we conduct due diligence prior to engaging with third party vendors and perform ongoing monitoring of vendor controls, we do not control their operations. Further, while our vendor management policies and practices are designed to comply with current regulations, these policies and practices cannot eliminate this risk. Replacing these third parties could also create significant delays and expense. Accordingly, use of such third parties creates an inherent risk to our business operations.

Our profitability depends on our ability to compete successfully in a highly competitive market for banking and financial services, and we expect such challenges to continue. Certain of our competitors are larger, have more resources than we do and may be perceived as better than regional banks at safeguarding deposits in excess of federally insured limits. We face competition in our regional market areas from other commercial banks, savings associations, credit unions, mortgage banking firms, securities brokerage firms, mutual funds and insurance companies, and other financial institutions that offer similar services. Some of our nonbank competitors are not subject to the same extensive supervision and regulation to which we or the Bank are subject, and may accordingly have greater flexibility in competing for business. Over time, certain sectors of the financial services industry have become more concentrated, as institutions involved in a broad range of financial services have been acquired by other firms. These developments could result in our competitors gaining greater capital and other resources, or being able to offer a broader range of products and services with more geographic range. Our loan and deposit pricing may be negatively impacted by our competitive environment. If our fee structures are deemed less favorable than other financial services providers, we may be at a competitive disadvantage in attracting customers for certain fee producing products. Further, we may choose to implement changes to remain competitive that could adversely affect our operating results. Another competitive factor is that the financial services market, including banking services, is undergoing rapid changes with frequent introductions of new technology-driven products and services, primarily as a result of the increased digitization of banking services. We compete with many forms of payments offered by both bank and non-bank providers, including a variety of new and evolving alternative payment mechanisms, systems and products, such as aggregators and web-based and wireless payment platforms or technologies, digital or "crypto" currencies, prepaid systems and payment services targeting users of social networks, communications platforms and online gaming. Our future success may depend, in part, on our ability to use technology competitively to offer products and services that provide convenience to customers and create additional efficiencies in our operations. The widespread adoption of new technologies has and will continue to require us to make substantial capital expenditures to modify or adapt our systems to remain competitive and offer new products and services. Our ability to effectively implement new technologies to improve our operations and systems will impact our competitive position in the financial services industry. Furthermore, we may not be successful in introducing new products and services in response to industry trends or developments in technology, or those new products may not be accepted by customers. If we are unable to successfully compete with traditional competitors as well as the evolving landscape of fintech companies and other nontraditional competitors to attract and retain customers, our business, financial condition or results of operations may also be adversely affected, perhaps materially. In particular, if we experience an outflow of deposits as a result of our customers desiring to do business with our competitors, we may be forced to rely more heavily on borrowings and other sources of funding to operate our business and meet withdrawal demands, thereby adversely affecting our net interest margin.

We have significant investments in bank premises and equipment for our branch network. Advances in technology such as e-commerce, telephone, internet and mobile banking, and in-branch self-service technologies including automated teller machines and other equipment, as well as an increasing customer preference for these other methods of accessing our products and services, could decrease the value of our branch network, technology, or other retail distribution physical assets. Such advances may also cause us to change our retail distribution strategy, close and/or sell certain branches or parcels of land held for development and restructure or reduce our remaining branches and work force. Such actions in the future could lead to losses on disposition of such assets or could adversely impact the carrying value of any long-lived assets and may lead to increased expenditures to renovate, reconfigure or close a number of our remaining branches or to otherwise reform our retail distribution channel.