IF Bancorp (IROQ) Risk Analysis

The USA PATRIOT and Bank Secrecy Acts require financial institutions to develop programs to prevent financial institutions from being used for money laundering and terrorist activities. If such activities are suspected, financial institutions are obligated to file suspicious activity reports with the U.S. Treasury's Office of Financial Crimes Enforcement Network. These rules require financial institutions to establish procedures for identifying and verifying the identity of customers seeking to open new financial accounts. Failure to comply with these regulations could result in fines or sanctions, including restrictions on pursuing acquisitions or establishing new branches. The policies and procedures we have adopted that are designed to assist in compliance with these laws and regulations may not be effective in preventing violations of these laws and regulations. Furthermore, these rules and regulations continue to evolve and expand. We have not been subject to fines or other penalties, or have suffered business or reputational harm, as a result of money laundering activities in the past.

Local economic conditions have a significant impact on the ability of our borrowers to repay loans and the value of the collateral securing loans. A deterioration in economic conditions, especially local conditions, could have the following consequences, any of which could have a material adverse effect on our business, financial condition, liquidity and results of operations, and could more negatively affect us compare to a financial institution that operates with more geographic diversity: -   demand for our products and services may decline;-   loan delinquencies, problem assets and foreclosures may increase;-   collateral for loans, especially real estate, may decline in value, thereby reducing customers' future borrowing power, and reducing the value of assets and collateral associated with existing loans; and -   the net worth and liquidity of loan guarantors may decline, impairing their ability to honor commitments to us. Moreover, a significant decline in general economic conditions caused by inflation, recession, acts of terrorism, an outbreak of hostilities or other international or domestic calamities, an epidemic or pandemic, unemployment or other factors beyond our control could further impact these local economic conditions and could further negatively affect the financial results of our banking operations. In addition, deflationary pressures, while possibly lowering our operating costs, could have a significant negative effect on our borrowers, especially our business borrowers, and the values of underlying collateral securing loans, which could negatively affect our financial performance.

We regularly collect, process, transmit and store significant amounts of confidential information regarding our customers, employees and others and concerning our own business, operations, plans and strategies. In some cases, this confidential or proprietary information is collected, compiled, processed, transmitted or stored by third parties on our behalf. Information security risks have generally increased in recent years because of the proliferation of new technologies, the use of the Internet and telecommunications technologies to conduct financial and other transactions and the increased sophistication and activities of perpetrators of cyber-attacks and mobile phishing. Mobile phishing, a means for identity thieves to obtain sensitive personal information through fraudulent e-mail, text or voice mail, is an emerging threat targeting the customers of popular financial entities. A failure in or breach of our operational or information security systems, or those of our third-party service providers, as a result of cyber-attacks or information security breaches or due to employee error, malfeasance or other disruptions could adversely affect our business, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs and/or cause losses. If this confidential or proprietary information were to be mishandled, misused or lost, we could be exposed to significant regulatory consequences, reputational damage, civil litigation and financial loss. Although we employ a variety of physical, procedural and technological safeguards to protect this confidential and proprietary information from mishandling, misuse or loss, these safeguards do not provide absolute assurance that mishandling, misuse or loss of the information will not occur, and that if mishandling, misuse or loss of information does occur, those events will be promptly detected and addressed. Similarly, when confidential or proprietary information is collected, compiled, processed, transmitted or stored by third parties on our behalf, our policies and procedures require that the third party agree to maintain the confidentiality of the information, establish and maintain policies and procedures designed to preserve the confidentiality of the information, and permit us to confirm the third party's compliance with the terms of the agreement. As information security risks and cyber threats continue to evolve, we may be required to expend additional resources to continue to enhance our information security measures and/or to investigate and remediate any information security vulnerabilities.