National Bank Holdings (NBHC) Risk Factors

We operate in multiple jurisdictions, and we are subject to tax laws and regulations of the U.S. federal, state and local governments. From time to time, legislative initiatives may be adopted, which may impact our effective tax rate and could adversely affect our deferred tax assets, tax positions and/or our tax liabilities. In addition, U.S. federal, state and local tax laws and regulations are extremely complex and subject to varying interpretations. There can be no assurance that our historical tax positions will not be challenged by relevant tax authorities or that we would be successful in defending our positions in connection with any such challenge.

Severe weather, natural disasters, climate change and other adverse external events could have a significant impact on our ability to conduct business. Such events could affect the stability of our deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue and/or cause us to incur additional expenses. Although management has established disaster recovery policies and procedures, there can be no guarantee of the effectiveness of such policies and procedures, and the occurrence of any such event could have a material adverse effect on our business, financial condition and results of operations. Additionally, concerns over the long term impacts of climate change have led and will continue to lead to governmental efforts to mitigate those impacts. We and our clients may face cost increases, asset value reductions, and operating process changes as a result. A significant portion of our loan portfolio is secured by real property, and we could become subject to environmental liabilities with respect to one or more of these properties. During the ordinary course of business, we may foreclose on and take title to properties securing defaulted loans. There is a risk that hazardous or toxic substances could be found on these properties, and we may be liable for remediation costs, as well as for personal injury and property damage, civil fines and criminal penalties regardless of when the hazardous conditions or toxic substances first affected any particular property. Environmental laws may require us to incur substantial expenses to address unknown liabilities and may materially reduce the affected property's value or limit our ability to use or sell the affected property. In addition, future laws or more stringent interpretations or enforcement policies with respect to existing laws may increase our exposure to environmental liability. Although we have policies and procedures to perform an environmental review before initiating any foreclosure action on nonresidential real property, these reviews may not be sufficient to detect all potential environmental hazards. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on us.

We provide our clients with the ability to bank remotely, including via online, mobile and phone. The secure transmission of confidential information over the internet and other remote channels is a critical element of remote banking. Our systems and network are subject to ongoing cyber incidents such as unauthorized access, loss or destruction of data, account takeovers, unavailability of service, computer viruses or other malicious code, phishing schemes, ransomware and other similar events. Third parties with whom we do business may also be sources of cybersecurity risks. We may be required to spend significant capital and other resources to protect against the threat of security breaches and computer viruses, or to alleviate problems caused by security breaches or viruses. Given the increasingly high volume of our transactions, certain errors may be repeated or compounded before they can be discovered and rectified. To the extent that our activities or the activities of our clients involve the storage and transmission of confidential information, security breaches and viruses could cause serious negative consequences, including reputational damage, litigation exposure and, regulatory scrutiny, and could result in a violation of applicable privacy and data protection laws or other breach reporting obligations. Any inability to prevent security breaches or computer viruses could also cause existing clients to lose confidence in our systems and could materially and adversely affect us. Our risk and exposure to these matters remains heightened because of the evolving nature and complexity of the threats from organized cybercriminals and hackers, and our plans to continue to provide digital banking products and services to our clients. Information security risks for financial institutions like us have increased recently in part because of new technologies, the use of the internet and telecommunications technologies (including mobile devices) to conduct financial and other business transactions and the increased sophistication and activities of organized crime, perpetrators of fraud, hackers, terrorists and others. In addition to cyberattacks or other security breaches involving the theft of sensitive and confidential information, hackers have engaged in attacks against large financial institutions, particularly denial of service or ransomware attacks are designed to disrupt key business services, such as client-facing web sites. We are not able to anticipate or implement preventive measures against all security breaches of these types, especially because the techniques used change frequently and can originate from a wide variety of sources. We employ detection and response mechanisms designed to contain and mitigate security incidents, but early detection may be thwarted by sophisticated attacks and malware designed to avoid detection. We also face risks related to cyberattacks and other security breaches in connection with credit or debit card, including ATM-related, transactions that typically involve the transmission of sensitive information regarding our clients through various third parties, including merchant acquiring banks, payment processors, payment card networks (e.g., Visa, MasterCard) and our third-party processors. Some of these parties have in the past been the target of security breaches and cyberattacks, and because the transactions involve third parties and environments such as the point of sale that we do not control or secure, future security breaches or cyberattacks affecting any of these third parties could impact us through no fault of our own, and in some cases we may have exposure and suffer losses for breaches or attacks relating to them. We also rely significantly on numerous other third party service providers to conduct other aspects of our business operations and face similar risks relating to them. While many of our agreements with third parties contain indemnification provisions, we may not be able to recover sufficiently, or at all, under the provisions to offset any losses we may incur from third-party cyber incidents.

Our business is highly dependent on the increasing use of the internet, mobile devices and cloud technologies. Further, we have and will continue to be subject to an increasing risk of operational disruption and information security incidents as a result. These events can arise from a variety of sources, many of which are not under our control because of our reliance on third party technology systems and outsourcing services for key processes including data processing, loan servicing and deposit processing; and for key services including internet, and mobile technology. Potential causes for incidents may include human error, electrical or telecommunication outages, hardware failures, and malicious activity. Any of these events could cause interruption to the Company's operations, as well as the operations of our clients. If significant, sustained or repeated, these events could compromise our ability to operate effectively, damage our reputation, result in a loss of client business, and/or subject us to additional regulatory scrutiny and possible financial liability, any of which could have a material adverse effect on us.

The execution of our strategy depends in large part on the skills of our executive management team and our ability to motivate and retain these and other key personnel, including key personnel added through mergers and acquisitions. Accordingly, the loss of service of one or more of our executive officers or key personnel could reduce our ability to successfully implement our growth strategy and materially and adversely affect us. Our success also depends on the experience of our banking center managers and relationship managers and on their relationships with the clients and communities they serve. The loss of these key personnel could negatively impact our banking operations. Surges in illnesses, or outbreaks, may increase the risk of maintaining adequate staffing in our banking centers and other key areas.

The FDIC insures deposits at FDIC-insured depository institutions, such as our subsidiary bank, up to applicable limits. The amount of a particular institution's deposit insurance assessment is based on that institution's risk classification under an FDIC risk-based assessment system. An institution's risk classification is assigned based on its capital levels and the level of supervisory concern the institution poses to its regulators. If current assessments imposed by the FDIC are insufficient for the DIF to meet its funding requirements, there may need to be further special assessments or increases in deposit insurance premiums. We are generally unable to control the amount of premiums that we are required to pay for FDIC insurance. Any future additional assessments, increases or required prepayments in FDIC insurance premiums may materially and adversely affect us, including by reducing our profitability or limiting our ability to pursue certain business opportunities. The significant losses incurred by the Deposit Insurance Fund managed by the FDIC, in connection with recent developments are required by law to be recovered through one or more special assessments on depository institutions and, potentially, their holding companies. On November 29, 2023, the FDIC published the final rule for a special assessment to recoup the losses suffered by the Deposit Insurance Fund. Under the rule, the FDIC imposed a special assessment on financial institutions with more than $5 billion in total uninsured deposits as of December 31, 2022, to be paid in eight quarterly assessments over the period of two years, beginning on April 1, 2024. While we are not subject to this assessment, in the event the FDIC does not completely recover the losses suffered by the Deposit Insurance Fund, the FDIC may impose additional special assessments in the future that may increase our costs.

Our business and operations are sensitive to general business and economic conditions in the United States and in our core markets of Colorado, the greater Kansas City region, Utah, Wyoming, Texas, New Mexico, and Idaho. If the economies in our core markets, or the U.S. economy more generally, experience worsening economic conditions, including industry-specific conditions, we could be materially and adversely affected. Weak economic conditions may be characterized by inflation, fluctuations in debt and equity capital markets, including a lack of liquidity and/or depressed prices in the secondary market for mortgage loans, increased delinquencies on loans, residential and commercial real estate price declines, lower home sales and commercial activity, further or prolonged pressure on energy prices, high unemployment, and the economic effects of natural disasters, severe weather conditions, health emergencies or pandemics, cyberattacks, outbreaks of hostilities, terrorism or other geopolitical instabilities. All of these factors would be detrimental to our business. Our business is significantly affected by monetary and related policies of the U.S. federal government, its agencies and government-sponsored entities. Changes in any of these policies are influenced by macroeconomic conditions and other factors that are beyond our control and could have a material adverse effect on us.

We have historically taken a conservative investment strategy with our securities portfolio, with concentrations of securities that are primarily backed by government sponsored enterprises ("GSE"). A portion of our non-marketable securities portfolio is comprised of non-liquid fund investments and direct investments in our fintech partners. We may seek to increase yields through different strategies, which may include a greater percentage of corporate securities and structured credit products. Factors beyond our control can significantly influence the fair value of securities in our portfolio and can cause potential adverse changes to the fair value of these securities. These factors include, but are not limited to, rating agency actions in respect of the securities, defaults by the issuer or with respect to the underlying securities, and changes in market interest rates and instability in the capital markets or an inability of our partners to successfully execute on their strategies. These factors, among others, could cause other-than-temporary impairments and realized and/or unrealized losses in future periods and declines in other comprehensive income, which could have a material adverse effect on us. The process for determining whether impairment of a security is other-than-temporary usually requires complex, subjective judgments about the future financial performance and liquidity of the issuer and any collateral underlying the security in order to assess the probability of receiving all contractual principal and interest payments on the security.

Consumer and commercial banking is highly competitive. Our markets contain a large number of community and regional banks as well as a significant presence of the country's largest commercial banks. We compete with other state and national financial institutions, including savings and loan associations, savings banks and credit unions, for deposits and loans. In addition, we compete with financial intermediaries, such as consumer finance companies, mortgage banking companies, insurance companies, securities firms, mutual funds and several government agencies, as well as major retailers, in providing various types of loans and other financial services. Some of these competitors have a long history of successful operations in our markets, greater ties to local businesses and more expansive banking relationships, as well as better established depositor bases. Some of our competitors also have greater resources and access to capital and possess an advantage by being capable of maintaining numerous banking locations in more convenient sites, operating more ATMs and conducting extensive promotional and advertising campaigns or operating a more developed online banking platform. Competitors may also exhibit a greater tolerance for risk and behave more aggressively with respect to pricing in order to increase their market share. In addition, the effects of disintermediation can also impact the banking business because of the fast growing body of fintech companies that use software to deliver mortgage lending, payment services and other financial services. Our ability to compete successfully depends on a number of factors, including, among others: ???-     the ability to develop, maintain and build upon long-term client relationships based on quality service, effective and efficient products and services, high ethical standards and safe and sound assets;-     the scope, relevance and pricing of products and services offered to meet client needs and demands;-     the rate at which we introduce new products and services, including internet-based or other digital services, relative to our competitors;-     the ability to attract and retain highly qualified associates to operate our business;-     the ability to expand our market position;-     client satisfaction with our level of service;- ?the ability to invest in new technologies, including relative to our digital banking platform;-     the ability to operate our business effectively and efficiently; and-     industry and general economic trends. Failure to perform in any of these areas could significantly weaken our competitive position, which could materially and adversely affect us.