Mid-Southern Bancorp (MSVB) Risk Analysis

The USA PATRIOT and Bank Secrecy Acts and related regulations require financial institutions to develop programs to prevent financial institutions from being used for money laundering and terrorist activities. If such activities are detected, financial institutions are obligated to file suspicious activity reports with the U.S. Treasury's Office of Financial Crimes Enforcement Network. These rules require financial institutions to establish procedures for identifying and verifying the identity of customers seeking to open new financial accounts. Failure to comply with these regulations could result in fines or sanctions, including restrictions on pursuing acquisitions or establishing new branches. The policies and procedures we have adopted that are designed to assist in compliance with these laws and regulations may not be effective in preventing violations of these laws and regulations.

As a bank, we are susceptible to fraudulent activity that may be committed against us or our customers which may result in financial losses or increased costs to us or our customers, disclosure or misuse of our information or our customers' information, misappropriation of assets, privacy breaches against our customers, litigation or damage to our reputation. Such fraudulent activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering and other dishonest acts. Nationally, reported incidents of fraud and other financial crimes have increased. In the normal course of business, we have also experienced losses due to apparent fraud and other financial crimes. While we have policies and procedures designed to prevent such losses, there can be no assurance that such losses will not occur.

A significant portion of our loan portfolio is secured by real estate, and we could become subject to environmental liabilities with respect to one or more of these properties, or with respect to properties that we own in operating our business. During the ordinary course of business, we may foreclose on and take title to properties securing defaulted loans. In doing so, there is a risk that hazardous or toxic substances could be found on these properties. If hazardous conditions or toxic substances are found on these properties, we may be liable for remediation costs, as well as for personal injury and property damage, civil fines and criminal penalties regardless of when the hazardous conditions or toxic substances first affected any particular property. Environmental laws may require us to incur substantial expenses to address unknown liabilities and may materially reduce the affected property's value or limit our ability to use or sell the affected property. In addition, future laws or more stringent interpretations or enforcement policies with respect to existing laws may increase our exposure to environmental liability. Our policies, which require us to perform an environmental review before initiating any foreclosure action on non-residential real property, may not be sufficient to detect all potential environmental hazards. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on us.

We rely heavily on our senior executive officers. The loss of any one of these officers could have an adverse effect on us because, as a small community bank, each of these officers has more responsibilities than would be typical at a larger financial institution with more employees. In addition, as a small community bank, we have fewer management level personnel who are in a position to assume the responsibilities of such officers' positions with us should we need to find replacements for any of these senior members of management.

We rely on numerous external vendors to provide us with products and services necessary to maintain our day-to-day operations. Accordingly, our operations are exposed to risk that these vendors will not perform in accordance with the contracted arrangements under service level agreements. The failure of an external vendor to perform in accordance with the contracted arrangements under service level agreements because of changes in the vendor's organizational structure, financial condition, support for existing products and services or strategic focus or for any other reason, could be disruptive to our operations, which in turn could have a material negative impact on our financial condition and results of operations. We also could be adversely affected to the extent such an agreement is not renewed by the third-party vendor or is renewed on terms less favorable to us. Additionally, the bank regulatory agencies expect financial institutions to be responsible for all aspects of our vendors' performance, including aspects which they delegate to third parties. Disruptions or failures in the physical infrastructure or operating systems that support our business and customers, or cyber-attacks or security breaches of the networks, systems or devices that our customers use to access our products and services could result in client attrition, regulatory fines, penalties or intervention, reputational damage, reimbursement or other compensation costs, and/or additional compliance costs, any of which could materially adversely affect our results of operations or financial condition.

The deposits of the Bank are insured by the FDIC up to legal limits and, accordingly, subject to the payment of FDIC deposit insurance assessments. The Bank's regular assessments are determined by its risk classification, which is based on a number of factors, including regulatory capital levels, asset growth and asset quality. Promptly following the recent failures of two banks in March 2023, the federal banking regulators announced that the FDIC will use funds from the DIF to ensure that all depositors in the two failed banks are made whole, at no cost to taxpayers. We anticipate that the FDIC will impose special assessments on all banks in order to replenish the DIF. We generally are unable to control the amount of premiums or special assessments that we are required to pay for FDIC insurance. Any special assessments or future changes in the calculation or assessment of FDIC insurance premiums may have a material adverse effect on the results of our operations and financial condition.

As of December 31, 2022, approximately $130.8 million, or 89.5%, of our total loans were to individuals and/or secured by properties located in our primary market area of the Louisville-Jefferson County MSA, plus Lawrence and Orange counties in Indiana. As a result, our revenues and profitability are subject to prevailing economic, regulatory, demographic and other conditions in our market area. Because our business is concentrated in this area, adverse economic, regulatory, demographic or other developments that are limited to this area may have a disproportionately greater effect on us than they would have if we did business in markets outside that particular geographic area. Local economic conditions have a significant impact on the ability of our borrowers to repay loans and the value of the collateral securing loans.

The financial services industry continues to undergo rapid technological changes, with frequent introductions of new technology-driven products and services. In addition to serving customers better, the effective use of technology increases efficiency and enables financial institutions to reduce costs. Our future success may depend, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands for convenience, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements. We cannot assure you that we will be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers.

Our security measures may not be sufficient to mitigate the risk of a cyber-attack. Communications and information systems are essential to the conduct of our business, as we use such systems to manage our customer relationships, our general ledger and virtually all other aspects of our business. Our operations rely on the secure processing, storage, and transmission of confidential and other information in our computer systems and networks. Although we take protective measures and endeavor to modify them as circumstances warrant, the security of our computer systems, software, and networks may be vulnerable to breaches, fraudulent or unauthorized access, denial or degradation of service attacks, misuse, computer viruses, malware or other malicious code and cyber-attacks that could have a security impact. If one or more of these events occur, this could jeopardize our or our customers' confidential and other information processed and stored in, and transmitted through, our computer systems and networks, or otherwise cause interruptions or malfunctions in our operations or the operations of our customers or counterparties. We may be required to expend significant additional resources to modify our protective measures or to investigate and remediate vulnerabilities or other exposures, and we may be subject to litigation and financial losses that are either not insured against or not fully covered through any insurance maintained by us. We could also suffer significant reputational damage. Security breaches in our internet banking activities could further expose us to possible liability and damage our reputation. Increases in criminal activity levels and sophistication, advances in computer capabilities, new discoveries, vulnerabilities in third party technologies (including browsers and operating systems) or other developments could result in a compromise or breach of the technology, processes and controls that we use to prevent fraudulent transactions and to protect data about us, our customers and underlying transactions. Any compromise of our security could deter customers from using our internet banking services that involve the transmission of confidential information. We rely on standard internet security systems to provide the security and authentication necessary to effect secure transmission of data. Although we have developed and continue to invest in systems and processes that are designed to detect and prevent security breaches and cyber-attacks and periodically test our security, these precautions may not protect our systems from compromises or breaches of our security measures, and could result in losses to us or our customers, our loss of business and/or customers, damage to our reputation, the incurrence of additional expenses, disruption to our business, our inability to grow our online services or other businesses, additional regulatory scrutiny or penalties, or our exposure to civil litigation and possible financial liability, any of which could have a material adverse effect on our business, financial condition and results of operations. Our security measures may not protect us from system failures or interruptions. While we have established policies and procedures to prevent or limit the impact of systems failures and interruptions, there can be no assurance that such events will not occur or that they will be adequately addressed if they do. In addition, we outsource certain aspects of our data processing and other operational functions to certain third-party providers. While we select third-party vendors carefully, we do not control their actions. If our third-party providers encounter difficulties including those resulting from breakdowns or other disruptions in communication services provided by a vendor, failure of a vendor to handle current or higher transaction volumes, cyber-attacks and security breaches or if we otherwise have difficulty in communicating with them, our ability to adequately process and account for transactions could be affected, and our ability to deliver products and services to our customers and otherwise conduct business operations could be adversely impacted. Replacing these third-party vendors could also entail significant delay and expense. Threats to information security also exist in the processing of customer information through various other vendors and their personnel. We cannot assure you that such breaches, failures or interruptions will not occur or, if they do occur, that they will be adequately addressed by us or the third parties on which we rely. We may not be insured against all types of losses as a result of third-party failures and insurance coverage may be inadequate to cover all losses resulting from breaches, system failures or other disruptions. If any of our third-party service providers experience financial, operational or technological difficulties, or if there is any other disruption in our relationships with them, we may be required to identify alternative sources of such services, and we cannot assure you that we could negotiate terms that are as favorable to us, or could obtain services with similar functionality as found in our existing systems without the need to expend substantial resources, if at all. Further, the occurrence of any systems failure or interruption could damage our reputation and result in a loss of customers and business, could subject us to additional regulatory scrutiny, or could expose us to legal liability. Any of these occurrences could have a material adverse effect on our financial condition and results of operations. The board of directors oversees the risk management process, including the risk of cybersecurity, and engages with management on cybersecurity issues.