OP Bancorp (OPBK) Risk Analysis

Our modest size makes it more difficult for us to compete with other financial institutions which are generally larger and can more easily afford to invest in the marketing and technologies needed to attract and retain customers. Because our principal source of income is the net interest income we earn on our loans and investments after deducting interest paid on deposits and other sources of funds, our ability to generate the revenues needed to cover our expenses and finance such investments is limited by the size of our loan and investment portfolios. Accordingly, we are not always able to offer new products and services as quickly as our competitors. As a smaller institution, we are also disproportionately affected by the continually increasing costs of compliance with new banking and other regulations.

As a commercial bank, we provide services to a number of clients whose deposit levels vary considerably and have some seasonality. The loss of any combination of these depositors, or a significant decline in the deposit balances due to ordinary course fluctuations related to these customers' businesses, would adversely affect our liquidity and require us to raise deposit rates to attract new deposits, purchase federal funds or borrow funds on a short-term basis to replace such deposits. Depending on the interest rate environment and competitive factors, low cost deposits may need to be replaced with higher cost funding, resulting in a decrease in net interest income and net income. While these events could have a material impact on our results, we expect, in the ordinary course of business, that these deposits will fluctuate and believe we are capable of mitigating this risk, as well as the risk of losing one of these depositors, through additional liquidity, and business generation in the future. However, should a significant number of these customers leave, it could have a material adverse effect on our business, financial condition and results of operations.

Our marketing focuses primarily on the banking needs of small- and medium-sized businesses, professionals and residents in the Korean-American communities that we serve. This demographic concentration makes us more prone to circumstances that particularly affect this segment of the population. As a result, our financial condition and results of operations are subject to changes in the economic conditions affecting these communities. Our success depends upon the business activity, population, income levels, deposits and real estate activity in these communities. Although our customers' business and financial interests may extend well beyond these communities, adverse economic conditions that affect these communities could reduce our growth rate, affect the ability of our customers to repay their loans to us and generally affect our financial condition and results of operations. Because of our geographic concentration, we are less able than regional or national financial institutions to diversify our credit risks across multiple markets.

From time to time, we may implement or may acquire new lines of business or offer new products and services within existing lines of business. There are substantial risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and new products and services we may invest significant time and resources. We may not achieve target timetables for the introduction and development of new lines of business and new products or services and price and profitability targets may not prove feasible. External factors, such as regulatory compliance obligations, competitive alternatives, and shifting market preferences, may also impact the successful implementation of a new line of business or a new product or service. Furthermore, any new line of business and/or new product or service could have a significant impact on the effectiveness of our system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business or new products or services could have a material adverse effect on our business, financial condition and results of operations.

Our business is highly dependent on the collection, storage, transmittal, sharing, processing and retention of information about our customers and employees. To accomplish these activities, we rely heavily upon electronic infrastructure that we own or that we obtain via license or other contractual arrangements with third parties. These technologies affect, among other things, our customers' ability to access and transfer funds, initiate and pay loans and leases, communicate with our customer service teams, and engage in a variety of other activities that form the foundation of modern financial services businesses. Likewise, our employee data and related technologies allow us to communicate with our employees, compensate our staff, maintain timekeeping, payroll and benefits records, and comply with an increasingly complex web of labor and employment laws and regulations. Further, the increasing perpetration of cybersecurity attacks by nation-state actors and sponsored groups, coupled with the ongoing military conflict between the United States and Iran and by the United States against certain paramilitary or terrorist groups believed to be sponsored by Iran, may have the effect of increasing the risk, frequency or intensity of such incidents. The loss, interruption or disruption of these systems may damage our relationships with customers and correspondingly may harm our reputation. Compromises or interruptions in our employment-related systems may cause challenges in our relationships with our employees, upon whom we are heavily dependent in the conduct of our business and the development and maintenance of our relationships with customers and prospective customers, and in certain circumstances may expose us to liabilities under certain federal and state employment laws. Cybersecurity measures are, by their nature, largely reactive, and threats are constantly evolving. We expect that the development of AI-based technologies will accelerate both the number and the sophistication of these threats. We routinely experience attempts to exploit our networks and systems, and we must continue investing in increasingly advanced (and concomitantly expensive) technology to counteract these threats. Further, if our systems cannot timely detect and mitigate vulnerabilities, or cannot promptly respond to threats, we may experience damage to or interruptions in the availability of our computer networks, or we may experience a loss of data, unauthorized use or disclosure of customer information, or a loss of customer funds as a result of unauthorized access to customer accounts. Likewise, breaches of our payroll, benefits, and other employee-related systems may give rise to liability under employment and privacy laws and may damage our relationships with our employees. Further, we may have a limited ability to enforce warranties, indemnities or other remedies against the providers of these systems in the event we incur a loss. Disruptions or failures in the physical infrastructure, controls or operating systems that support our businesses and customers, failures of the third parties on which we rely to adequately or appropriately provide their services or perform their responsibilities, or our failure to effectively manage or oversee our third-party relationships, could result in business disruptions, loss of revenue or customers, legal or regulatory proceedings, remediation and other costs, violations of applicable privacy and other laws, reputational damage, customer harm, or other adverse consequences, any of which could materially adversely affect our results of operations or financial condition. Further, new and evolving SEC regulations, as well as federal and state banking and consumer privacy laws and regulations, could require us to provide notices of security breaches. Such disclosures could result in increased regulatory scrutiny, exacerbate our potential legal liability, and result in a loss of confidence in the security of our systems or an adverse perception of our products and services. The access by unauthorized persons to, or the improper disclosure by us or our third-party vendors of, confidential information regarding our customers or our own proprietary information, software, methodologies and business secrets, failures or disruptions in our communications, information and technology systems, or our failure to adequately address them, could negatively affect our customer relationship management, online banking, accounting or other systems. We cannot assure readers that such breaches, failures or interruptions will not occur or, if they do occur, that they will be adequately addressed by us or the third parties on which we rely. Accordingly, any failures or interruptions of our communications, information and technology systems could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on our business, financial condition or results of operations.

Our success depends, in large degree, on the skills of our management team and our ability to retain, recruit and motivate key officers and employees. Our senior management team has significant industry experience, and their knowledge and relationships would be difficult to replace. Further, we believe that our focus on particular aspects of our communities, including the Korean culture and language and our Christian leadership principles, would call for any replacements to embody these same traits, which may make it more difficult to replace management team members and other employees who leave the Company or who retire. We need to continue to attract and retain key employees and to recruit qualified individuals to succeed existing key personnel to ensure the continued growth and successful operation of our business. In addition, as a provider of relationship-based commercial banking services, we must attract and retain qualified banking personnel to continue to grow our business, and competition for such personnel can be intense. Our ability to compete effectively for senior executives and other qualified personnel by offering competitive compensation and benefit arrangements may be restricted by applicable banking laws and regulations. In addition, to attract and retain personnel with appropriate skills and knowledge to support our business, we may offer a variety of benefits, which could reduce our earnings. The loss of the services of any senior executive, or the inability to recruit and retain qualified personnel in the future, could have a material adverse effect on our business, financial condition and results of operations.

We depend to a significant extent on relationships with third-party service providers. Specifically, we utilize third-party core banking services and receive credit card and debit card services, branch capture services, Internet banking services and services complementary to our banking products from various third-party service providers. Certain of these third-party service providers may incorporate or rely on artificial intelligence ("AI"), machine learning, automated decision-making technologies or similar emerging technologies in the development or delivery of their products and services, including technologies that are evolving rapidly and for which regulatory expectations are continuing to develop. These third-party relationships are subject to increasingly demanding regulatory requirements that require us to maintain and continue to enhance our due diligence, contractual controls, and ongoing monitoring and oversight of our vendors, including with respect to their information security practices, data governance, model risk management, operational resilience and compliance with applicable laws and regulations. The use of AI by our third-party service providers may increase the complexity of these oversight obligations and may expose us to additional risks, including risks related to data privacy and security, model performance, bias or discrimination, explainability, intellectual property, and regulatory compliance. We may be required to renegotiate or modify our agreements to address these enhanced requirements or evolving supervisory expectations, which could increase our costs or may be impracticable. If our service providers experience operational difficulties, fail to perform in accordance with expectations, experience disruptions related to AI system failures or errors, suffer a cyberattack or other security breach, fail to comply with applicable laws or regulations, or terminate their services, and we are unable to replace them in a timely manner, our operations could be interrupted. It may be difficult for us to replace certain service providers promptly, particularly where the services involve specialized technologies or proprietary platforms, including AI-enabled systems, and replacement services may be available only at higher cost or on less favorable terms. In addition, many of our agreements with third-party service providers limit our ability to recover damages, even for negligent actions that may result in customer harm, regulatory scrutiny, or enforcement actions. Regulatory requirements generally apply directly to financial institutions rather than to their service providers, and we expect that our regulators would hold us responsible for deficiencies in or failures of our third-party relationships, including deficiencies related to the use of AI technologies by those providers. Such deficiencies could result in supervisory findings, enforcement actions, civil money penalties, litigation, customer remediation obligations, reputational harm, or other administrative or judicial penalties or fines, any of which could have a material adverse effect on our business, financial condition and results of operations.