Provident Financial Services (PFS) Risk Analysis

We are required to comply with anti-money laundering, anti-terrorism and other laws and regulations in the United States. These laws and regulations require us, among other things, to adopt and enforce "know-your-customer" policies and procedures and to report suspicious and large transactions to applicable regulatory authorities. These laws and regulations have become increasingly complex and detailed, require improved systems and sophisticated monitoring and compliance personnel and have become the subject of enhanced government supervision. While we have adopted policies, procedures and systems aimed at detecting and preventing the use of our banking network for money laundering and related activities, those policies and procedures may not completely eliminate instances in which we may be used by customers to engage in money laundering and other illegal or improper activities. To the extent we fail to fully comply with applicable laws and regulations, the FDIC, along with other banking agencies, has the authority to impose fines and other penalties and sanctions on us, including restricting our ability to grow through acquisition. In addition, our business and reputation could suffer if customers use our banking network for money laundering or illegal or improper purposes.

The effects of climate change continue to create a level of concern for the state of the global environment. State legislatures and federal and state regulatory agencies have proposed, and may propose in the future, initiatives, legislation, and regulations to supplement the global effort to combat climate change. Similar and even more expansive initiatives are expected, including potentially increasing supervisory expectations with respect to banks' risk management practices, accounting for the effects of climate change in stress testing scenarios and systemic risk assessments, revising expectations for credit portfolio concentrations based on climate-related factors, and encouraging investment by banks in climate-related initiatives and lending to communities disproportionately impacted by the effects of climate change. The lack of empirical data surrounding the credit and other financial risks posed by climate change render it impossible to predict specifically how climate change may impact the financial condition and operations of the Company; however, the physical effects of climate change may also directly impact the Company. Specifically, unpredictable and more frequent weather disasters may adversely impact the value of real property securing certain loans in our portfolios. Further, the effects of climate change may negatively impact regional and local economic activity, which could lead to an adverse effect on our customers and impact our ability to raise and invest capital in potentially impacted communities. The effects of changing strategies, policies, and investments as the global community transitions to a lower-carbon economy will impose additional operational and compliance burdens, and may result in market trends that alter business opportunities. Compliance with any additional disclosure rules will require additional resources. Overall, climate change, its effects, and the resulting unknown impact could have a material adverse impact on our financial condition and results of operations.

Our business is highly dependent on the security and efficacy of our infrastructure, computer and data management systems to provide secure processing, transmission, storage and retrieval of confidential and proprietary information. Cyber security risks for financial institutions have significantly increased in recent years in part because of the proliferation of new technologies, including artificial intelligence, the use of technologies to conduct financial transactions, and coordinated efforts by nation-states to use cyber-attacks to obtain information or disrupt financial institutions in rival states. Financial institutions have been subject to, and are likely to continue to be the target of, cyber-attacks and supply chain attacks which could materially disrupt network access or business operations or create regulatory compliance risks. We have experienced cyber security events in the past, although not material, and we anticipate that, as a larger bank, we could experience further events. We have implemented and are continuing to develop countermeasures against potential cyber-attacks, including through internal cybersecurity policies, restrictions on information sharing, attribution techniques (including research and development on forensic capabilities, digital forensics provided by a security operations center, and obtaining threat intelligence), developing cyber deterrence and security norms, and spreading education and awareness to employees, customers, and third parties. Nevertheless, there can be no assurance that we will not suffer material losses or other material adverse consequences relating to technology failure, cyber-attacks or other information or security breaches. In addition, there have been instances where financial institutions have been victims of fraudulent activity in which criminals pose as customers to initiate wire and automated clearinghouse transactions from customer accounts. Although we have policies and procedures in place to verify the authenticity of our customers, there can be no assurance that such policies and procedures will prevent all fraudulent transfers. Such activity could result in financial liability and harm to our reputation. Misuse of our technology by our employees could also result in fraudulent, improper or unauthorized activities on behalf of customers or improper use of confidential information. We may not be able to prevent employee errors or misconduct, and the precautions we take to detect these types of activity might not be effective in all cases. Employee errors or misconduct could subject us to civil claims for negligence or regulatory enforcement actions, including fines and restrictions on our business. As cyber threats and other fraudulent activity continues to evolve, we may be required to expend significant additional resources to continue to modify and enhance our protective measures, or to investigate and remediate any information security vulnerabilities or incidents. Any of these matters could result in our loss of customers and business opportunities, significant disruption to our operations and business, misappropriation or destruction of our confidential information and/or that of our customers, or damage to our customers' computers or systems, and could result in a violation of applicable privacy laws and other laws, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in our security measures, reputational damage, reimbursement or other compensatory costs, and additional compliance costs. In addition, any of the matters described above could adversely impact our results of operations and financial condition. For information on our cybersecurity risk management, strategy and governance, see Item 1C – Cybersecurity.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services. The effective use of technology increases efficiency and enables financial institutions to better serve customers, reduce costs and create capacity. For instance, as private and state-sponsored hackers and malicious actors increasingly leverage the power of artificial intelligence to conduct cyber-attacks and other fraudulent activity, financial institutions can adopt and learn to use the same technology in order to detect attempts and defend themselves. Adaptation to the current cybersecurity landscape requires resilience, flexibility, and collaboration in the face of increased threats enabled by technological advances. Our future success depends, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers, or attract sufficient human capital to engage in rapid implementation and marketing. Failure to successfully keep pace with technological change affecting the financial services industry and sustain a robust information security program through talent and human capital could have a material adverse impact on our business and, in turn, our financial condition and results of operations.

The success of the merger will depend in part on the combined company's ability to manage its human capital and retain the talent and dedication of key employees. It is possible that these employees may decide not to remain with the Company going forward. If the Company is unable to retain key employees, including management, who are critical to the successful integration and future operations of the Company, the Company could face disruptions in its operations, loss of existing customers, loss of key information, expertise or know-how and unanticipated additional recruitment costs. In addition, if key employees terminate their employment, the Company's human capital and business activities may be adversely affected, and management's attention may be diverted from successfully hiring suitable replacements, all of which may cause the Company's business to suffer. The Company also may not be able to locate or retain suitable replacements for any key employees who leave.

We are dependent for most of our technology, including our core operating system, on third-party providers. The Bank collects, processes and stores sensitive consumer data by utilizing computer systems and telecommunications networks operated by third-party service providers, which are integral to our business. We handle a substantial volume of customer and other financial transactions every day. Our financial, accounting, data processing, check processing, electronic funds transfer, loan processing, online and mobile banking, automated teller machines, or ATMs, backup or other operating or security systems and infrastructure may fail to operate properly or become disabled or damaged because of a number of factors including events that are wholly or partially beyond our control. We have taken measures to implement data backups of our systems and other safeguards to support our operations, but our ability to conduct business may be adversely affected by any significant disruptions to third-parties with whom we interact.  In addition, our ability to implement backup systems and other safeguards with respect to third-party systems is more limited than with our own systems. If these third-parties were to discontinue providing services to us, we may experience significant disruption to our business. In addition, each of these third-parties faces the risk of cyber-attack, information breach or loss, or technology failure. If any of our third-party service providers experience such difficulties, or if there is any other disruption in our relationships with them, we may be required to find alternative sources of such services. If any of our third-party service providers experience a breach or cyber-attack of their information systems, it could adversely affect our ability to process transactions, service our clients or manage our exposure to risk and could result in the disclosure of sensitive, personal customer information, which could have a material adverse impact on our business through damage to our reputation, loss of business, remedial costs, additional regulatory scrutiny or exposure to civil litigation and possible financial liability. Assurance cannot be provided that we could negotiate terms with alternative service sources that are as favorable or could obtain services with similar functionality as found in existing systems without the need to expend substantial resources, if at all, thereby resulting in a material adverse impact on our business and results of operations. We continuously update these systems to support our operations and growth. This updating entails significant costs and creates risks associated with implementing new systems and integrating them with existing ones. Operational risk exposures could adversely impact our results of operations, liquidity, and financial condition, and cause reputational harm. Insurance coverage may not be available for such losses, or where available, such losses may exceed insurance limits. This risk of loss also includes the potential legal actions that could arise because of an operational deficiency or because of noncompliance with applicable regulatory standards, adverse business decisions or their implementation, and customer attrition due to potential negative publicity. While we maintain a risk management program that is designed to minimize risk, we could suffer losses, face regulatory action, and suffer damage to our reputation because of our failure to properly anticipate and manage these risks.

Competition in the banking and financial services industry is intense and increasing with entrants into our market providing new and innovative technology-driven financial solutions. Our profitability depends upon our continued ability to successfully compete in our market area. We compete with commercial banks, savings institutions, mortgage banking firms, credit unions, finance companies, investment advisers, wealth managers, mutual funds, insurance companies, online lenders, large non-bank participants, and brokerage and investment banking firms operating both locally and elsewhere. Over the past decade, our local markets have experienced the effects of substantial banking consolidation, and large out-of-state competitors have grown significantly. Many of these competitors have substantially greater resources and lending limits than we do, and may offer certain deposit and loan pricing, services or credit criteria that we do not or cannot provide. There are also a number of strong, locally-based competitors with large capital positions in our market who may deploy aggressive strategies to drive growth, acquire our customers and win market share. Furthermore, key components of the financial services value chain have been replicated by digital innovation. As customer preferences and expectations continue to evolve, technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. In addition, some of the largest technology firms are engaging in joint ventures with the largest banks to provide and or expand financial service offerings with a technological sophistication and breadth of marketing that smaller institutions do not have. Many of our competitors have fewer regulatory constraints and may have lower cost structures. Additionally, due to their size, many competitors may be able to achieve economies of scale and, as a result, may offer a broader range of products and services as well as better pricing for those products and services than we can. The adoption of these Fintech solutions within our market area may cause greater and faster disruption to our business model if we are unable to keep pace with, or invest wisely in, these enabling technologies.