Pacific Premier Bancorp (PPBI) Risk Factors

We are subject to a dynamic regulatory landscape with evolving laws and regulations governing privacy, information security, and data protection, including the Gramm-Leach-Bliley Act. Compliance with these requirements includes, among other things, privacy disclosure processes, maintenance of a robust information security program with stringent controls. The intricate nature of these laws and their constant evolution introduces the potential for change, which could lead us to incur substantial costs and have a significant impact on our current and planned privacy, data protection, and information security-related practices. In addition to the risks from the collection, use, retention, security, and transfer of data, we are also subject to specific obligations relating to information considered sensitive under applicable laws, such as the California Consumer Privacy Act of 2018, which came into effect on January 1, 2020, and bolstered by amendments contained in the California Privacy Act effective January 1, 2023. The original California Consumer Privacy Act, as enlarged and amended, provides businesses, employees, and consumers privacy rights regarding the use and sharing practices associated with their collected data, allows consumers to opt out of certain data sharing with third parties, and allows consumers to pursue litigation for certain non-compliance activities. Our regulators also hold us responsible for privacy and data protection obligations performed by our third-party service providers while providing services to us, as well as disclosures and notifications during a cyber or information security incident. The introduction of new laws or modification of existing laws not only increase our costs of compliance but also present challenges to our privacy-related enforcement activities and business operations. This may be in the form of increased technology costs, potential income reduction and could restrict our ability to provide certain products and services. Our failure to comply with privacy, data protection, and information security laws could trigger significant regulatory or governmental investigations and we can be liable for associated investigatory expense, litigation costs, fines, sanctions, and damage to our reputation. Such outcomes could have material adverse effects on our business, financial condition, and results of operations.

We collect and store sensitive data, including our proprietary business information and that of our customers, suppliers, business partners, and personally identifiable information of our customers and employees in the ordinary course of our business. The Company is continuously enhancing and expanding our digital products and services, which often include storing, transmitting, and processing confidential client, employee, monetary, and business information. Despite instituted safeguards and monitoring our information systems, our network, digital platforms, or third-party services could be vulnerable to unauthorized access, cyber-attacks by hackers, or breaches due to employee error or misconduct, or other disruptions such as computer viruses, malicious software, ransomware, phishing schemes, fraud activities, and hardware or software failures.. We have robust preventive, detective, and administrative safeguards and security controls to help protect, identify, and mitigate against the disruptions of our operations, the intentional and unintentional misappropriation or corruption of our information systems and information, and a material event. However, the legal, regulatory, and threat landscape regarding information security, cybersecurity, and data privacy is dynamic, increasingly demanding, and challenging. Cybersecurity and the continued development and enhancement of controls, processes, and practices designed to protect systems, computers, software, data, client information, and networks against the threat of security breaches, fraud, cyber-attacks, ransomware, social engineering, and computer malware attacks, damage, or unauthorized access remain a priority for the Company. As risks associated with cybersecurity threats constantly evolve and become more sophisticated generally, we may be required to incur significant costs to enhance, modify, and refine our protective measures against these evolving threats and to respond to such threats. Our risk and exposure to cyber threats to our information systems, as well as those of our third-party vendors, remain heightened because of, among other things, the evolving nature of these threats, the continuation of a remote work environment for our employees and service providers, and our plans to continue to implement and expand digital banking services, expand operations, and use third-party information systems that include cloud-based infrastructure, platforms, and software. The measures that we implement to reduce and mitigate these risks may not be effective, and there can be no assurance that our efforts will prevent breakdowns, intrusions, incidents, or breaches of our or our third-party vendors' information systems. Security breaches, cybersecurity incidents, or loss of information may result in business interruptions, exposure of proprietary or confidential information, data corruption, fines and penalties, potential liabilities from regulatory or third-party investigations, litigation costs, remediation costs, diversion of management attention, and the negative impact on our reputation and loss of clients' confidence. During 2023, we experienced a compromise to our data in the custody of a third-party vendor we use for certain tax and regulatory compliance services. The incident did not impact our own information systems. For further information regarding this incident, please see our Current Report on Form 8-K filed on July 25, 2023. Client disclosure and notification and credit monitoring expenses resulting from the incident were borne by the third party. We incurred other expenses related to the incident, including fees of advisors, which in the aggregate were not material. In addition, the Company's clients and vendors rely on technology and systems unmanaged by the Company, such as networking devices, server infrastructure, personal computers, smartphones, tablets, and other mobile devices, to contact and conduct business with the Company. If the devices of the Company's clients or vendors become the target of a cyber-attack, or security breach, it may result in business interruptions or unauthorized access to, misuse of, or loss of confidential client, employee, monetary, or business information. Threat actors using improperly obtained personal or financial information of consumers can attempt to obtain loans, lines of credit, or other financial products from the Company, or attempt to fraudulently persuade the Company's employees, clients, or other users of the Company's systems to disclose confidential information in order to gain improper access to the Company's information and information systems. We also face additional costs when our customers become the victims of cyber-attacks. For example, various retailers have reported that they have been the victims of a cyber-attack in which large amounts of their clients' data, including debit and credit card information, is obtained. Our clients may be the victims of phishing scams, providing cybercriminals access to their accounts, or credit or debit card information. In these situations, we incur costs to replace compromised cards and address fraudulent transaction activities affecting our clients. Both internal and external fraud and theft are risks. If confidential client, employee, monetary, or business information were to be mishandled or misused, we could suffer significant regulatory consequences, reputational damage, and financial loss. Such mishandling or misuse could include, for example, if such information were erroneously provided to parties who are not permitted to have the information, either by fault of our systems, employees, or counterparties, or if such information were to be intercepted or otherwise inappropriately taken by third parties, or if our own employees abused their access to financial systems to commit fraud against our clients and the Company. These activities can occur in connection with the origination of loans and lines of credit, ACH transactions, wire transactions, ATM transactions, and checking transactions, and result in financial losses, as well as reputational damage. In addition, the growing reliance on artificial intelligence ("AI") technologies by vendors, business partners, and technology solutions or applications introduces additional risks, including but not limited to: Algorithmic Bias that may result in unintended discriminatory outcomes and harm our reputation, loss of proprietary and confidential information through use of AI technologies, unauthorized access or breaches of data could compromise the integrity of our systems with AI dependency, evolving regulations and legal frameworks surrounding AI may pose challenges leading to legal and financial consequences for non-compliance, and protecting the intellectual property associated with AI technologies may be challenging, and unauthorized use or infringement by third parties could bring harm to our competitive position or reputation. The occurrence of any of the foregoing risks could result in a reduced ability to operate our business, additional costs, potential liability to clients, and reputational harm, any of which could adversely affect our business, financial condition, and results of operations.

The financial services industry experiences continuous technological change with frequent introductions of new technology-driven products and services. The effective use of technology increases efficiency and enables financial institutions to better serve customers and to reduce costs. Our future success depends, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Many of our competitors, however, have substantially greater resources to invest in technological improvements or are technology focused start-ups with internally developed cloud-native systems that offer improved user interfaces and experiences. We may not be able to effectively bring to market new technology-driven products and services at the same speed as certain competitors or fintech firms, or be as successful in marketing these products and services to our customers. In addition, we depend on internal and outsourced technology to support all aspects of our business operations. Interruption or failure of these systems creates a risk of business loss as a result of adverse customer experiences and possible diminishing of our reputation, damage claims, or civil fines. Failure to successfully keep pace with technological change affecting the financial services industry or to successfully implement core processing strategies could have a material adverse impact on our business and, in turn, our financial condition and results of operations. Changes in the legal and regulatory framework under which we operate require us to update our information systems to ensure compliance. Our need to review and evaluate the impact of ongoing rule proposals, final rules and implementation guidance from regulators further complicates the development and implementation of new information systems for our business. Also, recent regulatory guidance has focused on the need for financial institutions to perform increased due diligence and ongoing monitoring of third-party vendor relationships, thus increasing the scope of management involvement and decreasing the efficiency otherwise resulting from our relationships with third-party technology providers. Given the significant number of ongoing regulatory reform initiatives, it is possible that we incur higher than expected information technology costs in order to comply with current and impending regulations.

Our employees are our most important resource. Competition for qualified personnel is intense in many areas of the financial services industry. We endeavor to attract talented and diverse new employees and retain and motivate our existing employees to assist in executing our growth, acquisition, and business strategies. We also seek to retain proven, experienced senior employees with superior talent, augmented from time to time by external hires, to provide continuity of succession of our executive management team. Losses of or changes in our current executive officers or other key personnel, or the inability to recruit and retain qualified personnel in the future, could materially and adversely affect our financial condition and results of operations. The Company's ability to continue to compete effectively also depends in large part on our ability to attract new employees and retain and motivate existing employees, while managing compensation and other costs.

We rely on certain third parties to provide products and services necessary to maintain day-to-day operations, such as data processing and storage, recording and monitoring transactions, online banking interfaces and services, internet connections, telecommunications, and network access. Even though we have a vendor risk management program to help us carefully select and monitor the performance of third parties, we do not control their actions. The failure of a third-party to perform in accordance with the contracted arrangements for any reason could be disruptive to our operations, which could have a material adverse effect on our business, financial condition, and results of operations. Replacing these third parties could also create significant delays and expense. Accordingly, use of such third parties introduces additional risks to our business operations.

The financial services industry has become even more competitive as a result of legislative, regulatory, and technological changes and continued banking consolidation, which may increase in connection with current economic, market, and political conditions. We face substantial competition in all phases of our operations from a variety of competitors, including national banks, regional banks, community banks, and financial technology (or "fintech") companies. We also face a growing risk associated with disintermediation, as more clients and prospective clients invest directly in U.S. Treasury securities, which carry high rates of return in the current environment and are considered as safe if not safer than FDIC-insured deposits. In addition, we compete against institutions that offer money market mutual funds, including funds that maintain a large percentage of their holdings in U.S. Treasury securities, offering relative safety at higher interest rates to customers. With the rise of U.S. Treasury rates, we have been competing directly with U.S. Treasury securities and the investment funds that emphasize them. Many of our competitors offer the same banking services that we offer, and our success depends on our ability to adapt our products and services to evolving industry standards. In addition to product and service offerings, we compete on a number of other factors, including financial and other terms, underwriting standards, technological capabilities, brand, and reputation. Increased competition in our market may result in reduced new loan production and/or decreased deposit balances or less favorable terms on loans and leases and/or deposit accounts. We also face competition from many other types of financial institutions, including without limitation, nonbank specialty lenders, insurance companies, private investment funds, investment banks, and other financial intermediaries, some with significantly greater resources, more locations, and longer operating histories. In addition,competition has increased in recent years from institutions not subject to the same regulatory restrictions as domestic banks and bank holding companies. As competition in the financial services industry intensifies, our ability to market our products and services may be adversely affected. If we are unable to attract and retain banking customers, we may be unable to grow or maintain the levels of our loans and deposits and our results of operations and financial condition may be adversely affected as a result. Ultimately, we may not be able to compete successfully against current and future competitors.

The high-profile bank failures in the first half of 2023 generated significant market volatility among publicly-traded bank holding companies and, in particular, regional banks like Pacific Premier. The industry has stabilized since these failures and the customer confidence in the safety and soundness of smaller regional banks has improved considerably. Nevertheless, risks remain that customers may choose to invest in higher yielding and higher-rated short-term fixed income securities or maintain deposits with larger more systematically important financial institutions, all of which could materially and adversely impact our liquidity, loan funding capacity, net interest margin, capital, and results of operations. In addition, the banking operating environments and public trading prices of banking institutions can be highly correlated, in particular during times of stress, which could adversely impact the trading prices of our common stock and potentially, our results of operations. Separately, banking regulators have announced a more stringent supervisory posture after the bank failures.