National Bank Holdings (NBHC) Risk Analysis

We provide our clients with the ability to bank remotely, including via online, mobile and phone. The secure transmission of confidential information over the internet and other remote channels is a critical element of remote banking. Our systems and network are subject to ongoing cyber incidents such as unauthorized access, loss or destruction of data, account takeovers, unavailability of service, computer viruses or other malicious code, phishing schemes, ransomware and other similar events. Third parties with whom we do business are also sources of cybersecurity risks. We have spent and may be required to spend additional significant capital and other resources to protect against the threat of security breaches and computer viruses, or to alleviate problems caused by potential security breaches or viruses. Given the increasingly high volume of our transactions, certain errors may be repeated or compounded before they can be discovered and rectified. To the extent that our activities or the activities of our clients involve the storage and transmission of confidential information, security breaches and viruses could cause serious negative consequences, including reputational damage, litigation exposure and regulatory scrutiny, and could result in a violation of applicable privacy and data protection laws or other breach reporting obligations. Any inability to prevent security breaches or computer viruses could also cause prospective and existing clients to lose confidence in our systems and could materially and adversely affect us. Our risk and exposure to these matters remains heightened because of the evolving nature and complexity of the threats from organized cybercriminals and hackers, and our plans to continue to provide digital banking products and services to our clients. Information security risks for financial institutions like us have increased recently in part because of new technologies such as artificial intelligence, the use of the internet and telecommunications technologies (including mobile devices) to conduct financial and other business transactions and the increased sophistication and activities of organized crime, perpetrators of fraud, hackers, terrorists and others. In addition to cyberattacks or other security breaches involving the theft of sensitive and confidential information, hackers have engaged in attacks against large financial institutions, particularly denial of service or ransomware attacks are designed to disrupt key business services, such as client-facing web sites. We are not able to anticipate or implement preventive measures against all security breaches of these types, especially because the techniques used change frequently and can originate from a wide variety of sources. We employ detection and response mechanisms designed to contain and mitigate security incidents, but early detection may be thwarted by sophisticated attacks and malware designed to avoid detection. We also face risks related to cyberattacks and other security breaches in connection with credit or debit card, including ATM-related, transactions that typically involve the transmission of sensitive information regarding our clients through various third parties, including merchant acquiring banks, payment processors, payment card networks (e.g., Visa, MasterCard) and our third-party processors. Some of these parties have in the past been the target of security breaches and cyberattacks, and because the transactions involve third parties and environments such as the point of sale that we do not control or secure, future security breaches or cyberattacks affecting any of these third parties could impact us through no fault of our own, and in some cases we may have exposure and suffer losses for breaches or attacks relating to them. We also rely significantly on numerous other third party service providers to conduct other aspects of our business operations and face similar risks relating to them. While many of our agreements with third parties contain indemnification provisions, we may not be able to recover sufficiently, or at all, under the provisions to offset any losses we may incur from third-party cyber incidents.

Our business is highly dependent on the increasing use of the internet, mobile devices and cloud technologies. Further, we have and will continue to be subject to an increasing risk of operational disruption and information security incidents as a result. These events can arise from a variety of sources, many of which are not under our control because of our reliance on third party vendors and technology systems and outsourcing services for key processes including data processing, loan servicing and deposit processing; and for key services including internet, and mobile technology. Potential causes for incidents may include human error, electrical or telecommunication outages, hardware failures, and malicious activity. Any of these events could cause interruption to the Company's operations, as well as the operations of our clients. If significant, sustained or repeated, these events could compromise our ability to operate effectively, damage our reputation, result in a loss of client business, and/or subject us to additional regulatory scrutiny and possible financial liability, any of which could have a material adverse effect on our results of operations or financial condition.

The execution of our strategy depends in large part on the skills of our executive management team and our ability to motivate and retain these and other key personnel, including key personnel added through mergers and acquisitions. Accordingly, the loss of service of one or more of our executive officers or key personnel could reduce our ability to successfully implement our growth strategy and materially and adversely affect us. Our success also depends on the experience of our banking center managers and relationship managers and on their relationships with the clients and communities they serve. The loss of these key personnel could negatively impact our banking operations. Surges in illnesses, or outbreaks, may increase the risk of maintaining adequate staffing in our banking centers and other key areas.

The FDIC insures deposits at FDIC-insured depository institutions, such as our subsidiary bank, up to applicable limits. The amount of a particular institution's deposit insurance assessment is based on that institution's risk classification under an FDIC risk-based assessment system. An institution's risk classification is assigned based on its capital levels and the level of supervisory concern the institution poses to its regulators. If current assessments imposed by the FDIC are insufficient for the DIF to meet its funding requirements, there may need to be further special assessments or increases in deposit insurance premiums. We are generally unable to control the amount of premiums that we are required to pay for FDIC insurance. Any future additional assessments, increases or required prepayments in FDIC insurance premiums may materially and adversely affect us, including by reducing our profitability or limiting our ability to pursue certain business opportunities.

Our business and operations are sensitive to general business and economic conditions in the United States and in our core markets of Colorado, the greater Kansas City region, Utah, Wyoming, Texas, New Mexico, and Idaho. If the economies in our core markets, or the U.S. economy more generally, experience worsening economic conditions, including industry-specific conditions, we could be materially and adversely affected. Weak economic conditions may be characterized by inflation, fluctuations in debt and equity capital markets, including a lack of liquidity and/or depressed prices in the secondary market for mortgage loans, increased delinquencies on loans, residential and commercial real estate price declines, lower home sales and commercial activity, further or prolonged pressure on energy prices, and high unemployment. The U.S. and our core markets may experience these weak or worsening economic conditions due to the adverse economic effects of natural disasters, severe weather conditions, health emergencies or pandemics, cyberattacks, changes in international trade policies, tariffs, outbreaks of hostilities, terrorism or other geopolitical instabilities. All of these factors would be detrimental to our business. Our business is significantly affected by monetary and related policies of the U.S. federal government, its agencies and government-sponsored entities. Changes in any of these policies are influenced by macroeconomic conditions and other factors that are beyond our control and could have a material adverse effect on our financial condition and results of operations.

We have historically taken a conservative investment strategy with our securities portfolio, with concentrations of securities that are primarily backed by government sponsored enterprises ("GSE"). A portion of our non-marketable securities portfolio is comprised of non-liquid fund investments and direct investments in our fintech partners. Non-marketable securities also include direct investments in convertible preferred stock. As the convertible preferred stock does not have a readily determinable fair value, it is carried at cost. We periodically evaluate our non-marketable securities investments for impairment. The results of testing our investments for potential impairment may be adversely affected by a variety of factors, including market conditions, regulatory expectations, general economic conditions and unfavorable changes in the businesses underlying the investments, which may lead to a partial or full impairment of our fintech investments. Impairments or write-downs of these assets may result in charges that adversely affect our results of operations. We may seek to increase yields through different strategies, which may include a greater percentage of corporate securities and structured credit products. Factors beyond our control can significantly influence the fair value of securities in our portfolio and can cause potential adverse changes to the fair value of these securities. These factors include, but are not limited to, rating agency actions in respect of the securities, defaults by the issuer or with respect to the underlying securities, and changes in market interest rates and instability in the capital markets or an inability of our partners to successfully execute on their strategies. These factors, among others, could cause impairments and realized and/or unrealized losses in future periods and declines in other comprehensive income, which could have a material adverse effect on our results of operations. The process for determining whether a security is impaired usually requires complex, subjective judgments about the future financial performance and liquidity of the issuer and any collateral underlying the security in order to assess the probability of receiving all contractual principal and interest payments on the security.

Consumer and commercial banking is highly competitive. Our markets contain a large number of community and regional banks as well as a significant presence of the country's largest commercial banks. We compete with other state and national financial institutions, including savings and loan associations, savings banks and credit unions, for deposits and loans. In addition, we compete with financial intermediaries, such as consumer finance companies, mortgage banking companies, insurance companies, securities firms, trust companies, mutual funds and several government agencies, as well as major retailers, in providing various types of loans and other financial services. Some of these competitors have a long history of successful operations in our markets, greater ties to local businesses and more expansive banking relationships, as well as better established depositor bases. Some of our competitors also have greater resources and access to capital and possess an advantage by being capable of maintaining numerous banking locations in more convenient sites, operating more ATMs and conducting extensive promotional and advertising campaigns or operating a more developed online banking platform. Competitors may also exhibit a greater tolerance for risk and behave more aggressively with respect to pricing in order to increase their market share. In addition, the effects of disintermediation can also impact the banking business because of the fast growing body of fintech companies that use software to deliver mortgage lending, payment services and other financial services. We expect competition to intensify due to financial institution consolidation, technological changes, and the emergence of alternative banking services and service providers. Our ability to compete successfully depends on a number of factors, including, among others: ???-     the ability to develop, maintain and build upon long-term client relationships based on quality service, effective and efficient products and services, high ethical standards and safe and sound assets;-     the scope, relevance and pricing of products and services offered to meet client needs and demands;-     the rate at which we introduce new products and services, including internet-based or other digital services, relative to our competitors;-     the ability to attract and retain highly qualified associates to operate our business;-     the ability to expand our market position;-     client satisfaction with our level of service;- ?the ability to invest in or leverage new technologies such as artificial intelligence and those relative to our digital banking platform;-     the ability to operate our business effectively and efficiently; and-     industry and general economic trends.