Peoples Bancorp (PEBO) Risk Analysis

Peoples and its subsidiaries may be involved from time to time in a variety of litigation arising out of each entity's respective business. The risk of litigation increases in times of increased troubled loan collection activity. Peoples' insurance may not cover all claims that may be asserted against Peoples and its subsidiaries, and any claims asserted against them, regardless of merit or eventual outcome, may harm their respective reputations. Should the ultimate judgments or settlements in any litigation exceed the applicable insurance coverage, they could have a material adverse effect on Peoples' financial condition, results of operations and cash flows. In addition, Peoples or one of its subsidiaries may not be able to obtain appropriate types or levels of insurance in the future or to obtain adequate replacement policies with acceptable terms.

Peoples experiences significant competition in originating loans, obtaining deposits, and maintaining and growing insurance and trust customers, principally from other commercial banks, savings associations, credit unions, trust and brokerage companies, insurance agencies, fintechs and online service providers. Several of Peoples' competitors have greater resources, larger branch systems and wider arrays of banking and non-banking services. This competition could reduce Peoples' net income by decreasing the number and size of loans that Peoples originates and the interest rates it can charge on these loans. Moreover, technology and other changes are allowing businesses and individuals to utilize alternative methods to complete financial transactions that historically have involved banks. For example, consumers can now maintain funds that have historically been held as bank deposits in brokerage accounts, mutual funds, or high yield savings accounts with online banks. Consumers can also complete transactions such as paying bills and/or transferring funds directly without the assistance of banks. Digital or cryptocurrencies, blockchain, and other "fintech" technologies are designed to enhance transactional security and have the potential to disrupt the financial industry, change the way banks do business, and reduce the need for banks as financial deposit-keepers and intermediaries. The process of eliminating the use of banks to complete financial transactions could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits. The loss of these revenue streams and lower cost deposits as a source of funding could have a material adverse effect on Peoples' financial condition and results of operations. If Peoples is unable to compete effectively, Peoples will lose market share, which could reduce income generated from deposits, loans and other products. In July 2025, President Trump signed into law the GENIUS Act, which establishes a regulatory framework for "payment stablecoins" and their issuers. Consumers and businesses may view payment stablecoins as a substitute for traditional bank deposits, resulting in deposit withdrawals. Depending on consumer and business interest in payment stablecoins, and the characteristics and utility of payment stablecoins, the passage of the GENIUS Act could result in increased competition with respect to Peoples' deposit products. However, the GENIUS Act requires the U.S. Treasury Department and federal and state regulators to issue regulations on numerous topics to interpret and implement the statute, so the effect of the GENIUS Act will depend on what those regulations provide. For a more complete discussion of Peoples' competitive environment, see the section captioned "Competition" in "ITEM 1 BUSINESS" of this Form 10-K.

Peoples collects, processes and stores sensitive consumer data by utilizing computer systems and telecommunications networks operated by both Peoples and third-party service providers. Peoples' dependence upon automated systems to record and process Peoples' transactions poses the risk that technical system flaws, employee errors, tampering or manipulation of those systems, or attacks by third parties will result in losses and may be difficult to detect. Peoples has security and backup and recovery systems in place, as well as a business continuity plan, designed to ensure the computer systems will not become inoperable, to the extent possible. Peoples also routinely reviews documentation of such controls and backups related to third-party service providers. Peoples' inability to use or access these information systems at critical points in time could unfavorably impact the timeliness and efficiency of Peoples' business operations. Information security risks have increased due to the sophistication and activities of organized crime, hackers, terrorists and other external parties and the use of online, telephone, and mobile banking channels by clients. In recent years, several banks have experienced denial of service attacks in which individuals or organizations flood the bank's website with extraordinarily high volumes of traffic, with the goal and effect of disrupting the ability of the bank to process transactions. Other businesses have been victims of ransomware attacks in which the business becomes unable to access the business' own information and is presented with a demand to pay a ransom in order to once again have access to the business' information. Peoples could be adversely affected if one of its employees or a third-party service provider causes a significant operational break-down or failure, either as a result of human error or where an individual purposefully sabotages or fraudulently manipulates Peoples' operations or systems. Peoples may not be able to prevent employee or third-party errors or misconduct, and the precautions Peoples takes to detect this type of activity might prove ineffective. Peoples is further exposed to the risk that the third-party service providers may be unable to fulfill their contractual obligations (or will be subject to the same risks as Peoples is). These disruptions may interfere with service to Peoples' customers, cause additional regulatory scrutiny and result in a financial loss or liability. Any compromise to Peoples' information security could impair Peoples' reputation and deter Peoples' clients from using Peoples' banking services. Information security breaches can also disrupt the operation of information systems on which Peoples and its customers depend, adversely affecting business operations. Such events can result in costly remediation measures and litigation or governmental investigation and responding to security breaches can place unanticipated demands on the time and attention of management. Peoples relies on security systems to provide the protection and authentication necessary to secure transmission of data against damage by theft, fire, power loss, telecommunications failure or similar catastrophic event, as well as from security breaches, ransomware, denial of service attacks, viruses, worms, and other disruptive problems caused by hackers. Computer break-ins, phishing and other disruptions of customer or vendor systems could also jeopardize the security of information stored in and transmitted through Peoples' computer systems and network infrastructure. Peoples' associates also confront the risk of being compromised by emails sent by perpetrators posing as company executives or vendors in order to dupe Peoples' personnel into sending large sums of money to accounts controlled by the perpetrators. Peoples requires all employees to complete annual information security awareness training to increase their awareness of these risks and to engage them in Peoples' mitigation efforts. If these precautions are not sufficient to protect Peoples' systems from data breaches or compromises, Peoples' reputation and business could be adversely affected. In addition, there have been instances where financial institutions have been victims of fraudulent activity in which criminals pose as customers to initiate wire and automated clearinghouse transactions out of customer accounts. Although Peoples has policies and procedures in place to verify the authenticity of its customers, Peoples cannot ensure that such policies and procedures will prevent all fraudulent transfers. Peoples depends on the services of a variety of third-party vendors to meet data processing and communication needs, and Peoples has contracted with third parties to run their proprietary software on Peoples' behalf. While Peoples performs reviews of security controls instituted by the vendor in accordance with industry standards and institutes Peoples' own internal security controls, Peoples relies on continued maintenance of the controls by the outside party to safeguard customer data. Additionally, Peoples issues debit cards which are susceptible to compromise at the point of sale via the physical terminal through which transactions are processed and by other means of hacking. The security and integrity of these transactions are dependent upon the retailers' vigilance and willingness to invest in technology and upgrades. Issuing debit cards to Peoples' clients exposes Peoples to potential losses which, in the event of a data breach at one or more major retailers may adversely affect Peoples' business, financial condition, and results of operations. Peoples is also at risk of the impact of natural disasters, terrorism and international hostilities on Peoples' systems or from the effects of outages or other failures involving power or communications systems operated by others. Peoples has implemented security controls to prevent unauthorized access to its computer systems, and Peoples requires that its third-party service providers maintain similar controls. However, Peoples' management cannot be certain that these measures will be successful. A security breach of the computer systems and loss of confidential information, such as customer account numbers and related information, could result in a loss of customers' confidence and, thus, loss of business. Peoples could also lose revenue if competitors gain access to confidential information about Peoples' business operations and use such confidential information to compete with Peoples. While Peoples maintains specific "cyber" insurance coverage, which would apply in the event of various breach scenarios, the amount of coverage may not be adequate in any particular case. Furthermore, because cyber threat scenarios are inherently difficult to predict and can take many forms, some breaches may not be covered under Peoples' cyber insurance coverage. Further, Peoples may be affected by data breaches at retailers and other third parties who participate in data interchanges with Peoples and its customers that involve the theft of customer credit and debit card data, which may include the theft of Peoples' consumer and business debit card PIN numbers and commercial card information used to make purchases at such retailers and other third parties. Such data breaches could result in Peoples incurring significant expenses to reissue debit cards and cover losses, which could result in a material adverse effect on Peoples' operations. All of the types of cybersecurity incidents discussed above could result in damage to Peoples' reputation, loss of customer business, increased costs of incentives to customers or business partners in order to maintain their relationships, litigation, increased regulatory scrutiny and potential enforcement actions, repairs of system damage, increased investments in cybersecurity (such as obtaining additional technology, making organizational changes, deploying additional personnel, training personnel and engaging consultants), increased insurance premiums, and loss of investor confidence and a reduction in the price of Peoples' common shares, all of which could result in financial loss and material adverse effects on Peoples' results of operations and financial condition.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services, including artificial intelligence. The effective use of technology increases efficiency and enables financial institutions to better serve customers while reducing costs. Peoples' future success depends, in part, upon its ability to address customer needs by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in its operations. This could include the development, implementation, and adaptation of digital or cryptocurrency, blockchain, and other "fintech" technology. Peoples may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to Peoples' customers. Failure to successfully keep pace with technological changes affecting the financial services industry could negatively affect Peoples' growth, revenue and net income.

Peoples' success depends, in large part, on its ability to attract, retain, motivate and develop key employees. Competition for key employees is ongoing and Peoples may not be able to attract, retain or hire the key employees who are wanted or needed, which may also negatively impact Peoples' ability to execute identified business strategies. Many of Peoples' offices are located in rural areas, resulting in the possible need for Peoples to offer higher compensation equal to or greater than what is offered in metropolitan areas to attract or retain key employees, which may adversely affect salaries and employee benefit costs. Various restrictions on the compensation which may be paid to certain executive officers were imposed under the Dodd-Frank Act and other legislation and regulations. In addition, Peoples' incentive compensation structure is subject to review by regulators, who may identify deficiencies in the structure or issue additional guidance on Peoples' compensation practices, causing Peoples to make changes that may affect its ability to offer competitive compensation to these individuals or that place Peoples at a disadvantage to non-financial service competitors. Peoples' ability to attract and retain talented employees may be affected by these restrictions, or any new executive compensation limits or regulations.

Peoples Bank has limited ability to control the amount of premiums it is required to pay for FDIC insurance. The DIF is funded by fees assessed on insured depository institutions, such as Peoples Bank. If the costs of future bank failures increase, deposit insurance premiums may also increase. Increases in FDIC insurance premiums may have a material adverse effect on Peoples' results of operations and ability to continue to pay dividends on its common shares at the current rate or at all. The FDIC Board adopted a final rule which implemented a special assessment to recover the losses to the DIF arising from the failures of Silicon Valley Bank and Signature Bank. This special assessment was based on total uninsured deposits, which the value of such deposits held by Peoples was below the threshold set by the assessment, and thus Peoples was not subject to the assessment. However, there can be no assurance that assessments may not be changed in the future and/or that additional special assessments may not be imposed in the future by the FDIC, either in response to additional bank failures or otherwise, that could increase the amount of premiums required to be paid to the FDIC by Peoples Bank. Federal deposit insurance is described in more detail in the section captioned "Supervision and Regulation" in "ITEM 1 BUSINESS" of this Form 10-K.