OP Bancorp (OPBK) Risk Factors

We operate in a highly regulated environment and are subject to supervision and regulation by a number of governmental regulatory agencies, including the Federal Reserve, the FDIC and the DFPI. Regulations adopted by these agencies, which are generally intended to provide protection for depositors and customers rather than for the benefit of shareholders, govern a comprehensive range of matters relating to ownership and control of our shares, our acquisition of other companies and businesses, permissible activities, maintenance of adequate capital levels, and other aspects of our operations. These bank regulators possess broad authority to prevent or remedy unsafe or unsound practices or violations of law. The laws and regulations applicable to the banking industry could change at any time, and we cannot predict the effects of these changes on our business, profitability or growth strategy. Increased regulation could increase our cost of compliance and adversely affect profitability. Moreover, certain of these regulations contain significant punitive sanctions for violations, including monetary penalties and limitations on a bank's ability to implement components of its business plan, such as expansion through mergers and acquisitions or the opening of new branch offices. In addition, changes in regulatory requirements may add costs associated with compliance efforts. Furthermore, government policy and regulation, particularly as implemented through the Federal Reserve System, significantly affect credit conditions. Negative developments in the financial industry and the impact of new legislation and regulation in response to those developments could negatively impact our business operations and adversely impact our financial performance. In addition, adverse publicity and damage to our reputation arising from the failure or perceived failure to comply with legal, regulatory or contractual requirements could affect our ability to attract and retain customers.

Deferred tax assets and liabilities are the expected future tax amounts for the temporary differences between the carrying amounts and tax basis of assets and liabilities computed using enacted tax rates. We regularly assess available positive and negative evidence to determine whether it is more likely than not that our net deferred tax asset will be realized. Realization of a deferred tax asset requires us to apply significant judgment and is inherently speculative because it requires estimates that cannot be made with certainty. As of December 31, 2023 we had net deferred tax assets of $13.3 million. If we were to determine at some point in the future that we will not achieve sufficient future taxable income to realize our net deferred tax asset, we would be required, under U.S. generally accepted accounting principles, to establish a full or partial valuation allowance which would require us to incur a charge to operations for the period in which the determination was made.

In the course of our business, we may foreclose and take title to real estate, and could be subject to environmental liabilities with respect to these properties. We may be held liable to a governmental entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination, or may be required to investigate or clear up hazardous or toxic substances, or chemical releases at a property. The costs associated with investigation or remediation activities could be substantial. In addition, as the owner or former owner of any contaminated site, we may be subject to common law claims by third parties based on damages, and costs resulting from environmental contamination emanating from the property. If we ever become subject to significant environmental liabilities, our business, financial condition and results of operations could be materially and adversely affected.

From time to time, we may implement or may acquire new lines of business or offer new products and services within existing lines of business. There are substantial risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and new products and services we may invest significant time and resources. We may not achieve target timetables for the introduction and development of new lines of business and new products or services and price and profitability targets may not prove feasible. External factors, such as regulatory compliance obligations, competitive alternatives, and shifting market preferences, may also impact the successful implementation of a new line of business or a new product or service. Furthermore, any new line of business and/or new product or service could have a significant impact on the effectiveness of our system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business or new products or services could have a material adverse effect on our business, financial condition and results of operations.

Our business is highly dependent on the collection, storage, transmittal, sharing, processing and retention of information about our customers and employees. To accomplish these activities, we rely heavily upon electronic infrastructure that we own or that we obtain via license or other contractual arrangements with third parties. These technologies affect, among other things, our customers' ability to access and transfer funds, initiate and pay loans and leases, communicate with our customer service teams, and engage in a variety of other activities that form the foundation of modern financial services businesses. Likewise, our employee data and related technologies allow us to communicate with our employees about routine and extraordinary matters, compensate our staff, maintain timekeeping, payroll and benefits records, and comply with an increasingly complex web of labor and employment laws and regulations. The loss, interruption or disruption of these systems may damage our relationships with customers and correspondingly may harm our reputation. Compromises or interruptions in our employment-related systems may cause challenges in our relationships with our employees, upon whom we are heavily dependent in the conduct of our business and the development and maintenance of our relationships with customers and prospective customers. There have been a number of recent and well-publicized incidents involving various types of cybersecurity lapses, some of which have had substantial adverse impacts upon targeted businesses and on customers of even some of the world's most prominent cybersecurity and financial services firms. Similarly, extremely sophisticated criminal and nation-state organizations routinely target and exploit information technology networks, data systems, and other critical infrastructure. One of the most prominent recent events resulted in a widespread failure of a large cybersecurity platform, some of the consequences of which are not yet, and may not soon be, fully known or estimable. We devote significant resources and management focus to ensuring the integrity of our systems against cybercriminals and similar actors, as well as against threats from fires and other natural disasters; power or telecommunications failures; acts of terrorism or wars or other catastrophic events; breaches, physical break-ins or errors resulting in interruptions and unauthorized disclosure of confidential information, through information security and business continuity programs. Likewise, we have made, and we continue to make, substantial investments in systems that are intended to protect against these vulnerabilities, including real-time threat detection and warning, security programs and protocols, backup and alternative-access systems, virus and malware protection programs, and a wide variety of other protective measures. Notwithstanding these investments, cybersecurity measures are, by their nature, largely reactive, and threats are constantly evolving. We expect that the development of AI-based technologies will accelerate both the number and the sophistication of these threats. We routinely experience attempts to exploit our networks and systems, and we must continue investing in increasingly advanced (and concomitantly expensive) technology to counteract these threats. Further, if our systems cannot timely detect and mitigate vulnerabilities, or cannot promptly respond to threats, we may experience damage to or interruptions in the availability of our computer networks, or we may experience a loss of data, unauthorized use or disclosure of customer information, or a loss of customer funds as a result of unauthorized access to customer accounts. Likewise, breaches of our payroll, benefits, and other employee-related systems may give rise to liability under employment laws and may damage our relationships with our employees. Disruptions or failures in the physical infrastructure, controls or operating systems that support our businesses and customers, failures of the third parties on which we rely to adequately or appropriately provide their services or perform their responsibilities, or our failure to effectively manage or oversee our third-party relationships, could result in business disruptions, loss of revenue or customers, legal or regulatory proceedings, remediation and other costs, violations of applicable privacy and other laws, reputational damage, customer harm, or other adverse consequences, any of which could materially adversely affect our results of operations or financial condition. Further, new and evolving SEC regulations, as well as federal and state banking and consumer privacy laws and regulations, could require us to provide notices of security breaches. Such disclosures could result in increased regulatory scrutiny, exacerbate our potential legal liability, and result in a loss of confidence in the security of our systems or an adverse perception of our products and services. The access by unauthorized persons to, or the improper disclosure by us or our third-party vendors of, confidential information regarding our customers or our own proprietary information, software, methodologies and business secrets, failures or disruptions in our communications, information and technology systems, or our failure to adequately address them, could negatively affect our customer relationship management, online banking, accounting or other systems. We cannot assure readers that such breaches, failures or interruptions will not occur or, if they do occur, that they will be adequately addressed by us or the third parties on which we rely. Accordingly, any failures or interruptions of our communications, information and technology systems could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on our business, financial condition or results of operations.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services. The effective use of technology increases efficiency and enables financial institutions to better serve customers and to reduce costs. Our future success depends, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements than we do. We may not be able to effectively implement new, technology-driven products and services or be successful in marketing these products and services to our customers which would put us at a competitive disadvantage. In addition, the implementation of technological changes and upgrades to maintain current systems and integrate new ones may also cause service interruptions, transaction processing errors and system conversion delays and may cause us to fail to comply with applicable laws. Failure to successfully keep pace with technological change affecting the financial services industry and avoid interruptions, errors and delays could have a material adverse effect on our business, financial condition or results of operations. We expect that new technologies and business processes applicable to the consumer credit industry will continue to emerge, and these new technologies and business processes may be better than those we currently use. Because the pace of technological change is high and our industry is intensely competitive, we may not be able to sustain our investment in new technology as critical systems and applications become obsolete or as better ones become available. A failure to maintain current technology and business processes could cause disruptions in our operations or cause our products and services to be less competitive, all of which could have a material adverse effect on our business, financial condition and results of operations.

Any changes we make to the rates offered on our deposit products to remain competitive with other financial institutions may adversely affect our profitability and liquidity. Interest-bearing accounts earn interest at rates established by management based on competitive market factors. The demand for the deposit products we offer may also be reduced due to a variety of factors, such as demographic patterns, changes in customer preferences, reductions in consumers'disposable income, regulatory actions that decrease customer access to particular products, or the availability of competing products.

Our business and operations are sensitive to general business and economic conditions in the United States, generally, and particularly the state of California and the Los Angeles-Long Beach-Anaheim, California Metropolitan Statistical Areas. Unfavorable or uncertain economic and market conditions could lead to credit quality concerns related to borrower repayment ability and collateral protection as well as reduced demand for the products and services we offer. Geopolitical developments, such as existing and potential trade wars and other events beyond our control, can increase levels of political and economic unpredictability globally and increase the volatility of global financial markets. Concerns about the performance of international economies, especially in Europe and emerging markets, and economic conditions in Asia, particularly the economies of China, South Korea and Japan, can impact the economy and financial markets here in the United States. If the national, regional and local economies experience worsening economic conditions, including high levels of unemployment, our growth and profitability could be constrained. Weak economic conditions are characterized by, among other indicators, inflation, deflation, elevated levels of unemployment, fluctuations in debt and equity capital markets, increased delinquencies on mortgage, commercial and consumer loans, residential and commercial real estate price declines, and lower home sales and commercial activity. Economic pressure on consumers and uncertainty regarding continuing economic improvement may result in changes in consumer and business spending, borrowing and saving habits.

Severe weather, natural disasters (including fires and earthquakes), wide spread disease or pandemics (including the COVID-19 pandemic), acts of war or terrorism and other adverse external events could have a significant impact on our ability to conduct business. Such events could affect the stability of our deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue and/or cause us to incur additional expenses. For example, our primary market areas in Southern California are subject to earthquakes and fires. Operations in our market areas could be disrupted by both the evacuation of large portions of the population as well as damage to and/or lack of access to our banking and operation facilities. Although management has established disaster recovery policies and procedures, the occurrence of any such events could have a material adverse effect on our business, financial condition and results of operations.

We are vulnerable to reputational harm because we operate in an industry in which integrity and the confidence of our customers are of critical importance. Our employees could engage in fraudulent, illegal, wrongful or suspicious activities, and/or activities resulting in consumer harm that adversely affects our customers and/or our business. The precautions we take to detect and prevent such misconduct may not always be effective and regulatory sanctions and/or penalties, serious harm to our reputation, financial condition, customer relationships and ability to attract new customers. In addition, improper use or disclosure of confidential information by our employees, even if inadvertent, could result in serious harm to our reputation, financial condition and current and future business relationships. If our internal controls against operational risks fail to prevent or detect an occurrence of such employee error or misconduct, or if any resulting loss is not insured or exceeds applicable insurance limits, it could have a material adverse effect on our business, financial condition and results of operations.

As a smaller bank holding company and a small community bank, we lack the resources available to larger institutions to recruit, train and retain a large staff focused on data security. Instead, like most community banks, we rely heavily on third-party vendors and other service providers for these functions. As financial institutions and technology systems become more interconnected and more complex, any operational incident at a third party, such as a vendor or customer, may increase our operational risks, including from information breaches or loss, breakdowns, disruptions or failures of their own systems or infrastructure, or any deficiencies in the performance of their responsibilities. These risks are increased to the extent we rely on a single-source vendor or provider. If a third-party vendor or service provider is not fully effective in assisting us in protecting our data and systems, we may be held responsible for any resulting failures, and even a failure by a third party could damage or jeopardize our relationships with our customers. Further, a recent and well-publicized cybersecurity incident involving the failure of one of the world's most sophisticated security platforms resulted in extensive outages of that provider's customer systems, the effect of which was a cascading failure of several of that firm's clients' networks. Such interruptions, occurring as a result of the acts or omissions of one or more of our vendors, could result in liability to our customers, as well as reputational harm and a potential interruption of our business.