Sandy Spring Bancorp (SASR) Risk Factors

The banking industry is heavily regulated. Banking regulations are primarily intended to protect the federal deposit insurance fund and depositors, not shareholders. Sandy Spring Bank is subject to regulation and supervision by the Board of Governors of the Federal Reserve System and by Maryland banking authorities, as well as the CFPB. Sandy Spring Bancorp is subject to regulation and supervision by the Board of Governors of the Federal Reserve System. Federal and state laws and regulations govern numerous matters affecting us, including changes in the ownership or control of banks and bank holding companies, maintenance of adequate capital and sound financial condition, permissible types, amounts and terms of loans and investments, permissible non-banking activities, the level of reserves against deposits and restrictions on dividend payments. These and other restrictions limit the manner in which we conduct business and obtain financing. The laws, rules, regulations, and supervisory guidance and policies applicable to us are subject to regular modification and change. Such changes may, among other things, increase the cost of doing business, limit the types of financial services and products we offer, or affect the competitive balance between banks and other financial institutions. While we have developed policies and procedures designed to assist in compliance with these laws and regulations, no assurance is given that our compliance policies and procedures will be effective. Failure to comply (or to ensure that our agents and third-party service providers comply) with laws, regulations, or policies could result in enforcement actions or sanctions by regulatory agencies, civil money penalties, and/or reputational damage, which could have a material adverse effect on our business, financial condition, or results of operations. The burdens imposed by federal and state regulations put banks at a competitive disadvantage compared to less regulated competitors such as finance companies, mortgage banking companies, and leasing companies.

In the ordinary course of our business, we collect and store sensitive data in our third-party data centers and on our networks, including intellectual property, our proprietary business information and that of our customers, suppliers and business partners, and personally identifiable information of our customers and employees. The secure processing, maintenance and transmission of this information is critical to our operations and business strategy. Despite the security measures we have implemented to help ensure data security and compliance with applicable laws, rules and regulations, which include firewalls, regular penetration testing and other measures, our facilities and systems, and those of our third-party service providers and vendors, may be vulnerable to cyber-attacks, security breaches, ransomware, unauthorized activity and access, malicious code, acts of vandalism, computer viruses, theft of data, misplaced or lost data, fraud, misconduct or misuse, social engineering attacks and denial of service attacks, phishing attacks, programming or human errors, physical break-ins, or other disruptions, any of which could result in critical data becoming inaccessible or the loss or disclosure of confidential or personal client or employee information or our own proprietary information. Any such loss or disclosure of confidential information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, and regulatory penalties, disrupt our operations and the services we provide to customers, damage our reputation, and cause a loss of confidence in our products and services, which could adversely affect our business, revenues and competitive position. We are subject to laws regarding the privacy, information security and protection of personal information and any violation of these laws or another incident involving personal, confidential or proprietary information of individuals could damage our reputation and otherwise adversely affect our business, financial condition and earnings. Our business requires the collection and retention of large volumes of customer data, including personally identifiable information in various information systems that we maintain and in those maintained by third parties with whom we contract to provide data services. We also maintain important internal company data such as personally identifiable information about our employees and information relating to our operations. We are subject to complex and evolving laws and regulations governing the privacy and protection of personal information of individuals (including customers, employees, suppliers and other third parties). For example, our business is subject to the Gramm-Leach-Bliley Act which, among other things: (i) imposes certain limitations on our ability to share nonpublic personal information about our customers with non-affiliated third parties; (ii) requires that we provide certain disclosures to customers about our information collection, sharing and security practices and afford customers the right to "opt out" of any information sharing by us with non-affiliated third parties (with certain exceptions); and (iii) requires that we develop, implement and maintain a written comprehensive information security program containing appropriate safeguards based on our size and complexity, the nature and scope of our activities, and the sensitivity of customer information we process, as well as plans for responding to data security breaches. Various state and federal laws and regulations impose data security breach notification requirements with varying levels of individual, consumer, regulatory or law enforcement notification in certain circumstances in the event of a security breach. Ensuring that our collection, use, transfer and storage of personal information complies with all applicable laws and regulations can increase costs. Furthermore, we may not be able to ensure that all of our clients, suppliers, counterparties and other third parties have appropriate controls in place to protect the confidentiality of the information that they exchange with us, particularly where such information is transmitted by electronic means. If personal, confidential or proprietary information of customers or others were to be mishandled or misused (in situations where, for example, such information was erroneously provided to parties who are not permitted to have the information, or where such information was intercepted or otherwise compromised by third parties), we could be exposed to litigation or regulatory sanctions under personal information laws and regulations. Concerns regarding the effectiveness of our measures to safeguard personal information, or even the perception that such measures are inadequate, could cause us to lose customers or potential customers for our products and services and thereby reduce our revenues. Accordingly, any failure or perceived failure to comply with applicable privacy or data protection laws and regulations may subject us inquiries, examinations and investigations that could result in requirements to modify or cease certain operations or practices or in significant liabilities, fines or penalties, and could damage our reputation and otherwise adversely affect our business, financial condition and earnings.

The financial services industry is undergoing rapid technological change with frequent introductions of new technology-driven products and services. The effective use of technology increases efficiency and enables financial institutions to better serve customers and to reduce costs. Our future success depends, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements. We not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers. Failure to successfully keep pace with technological changes affecting the financial services industry could have a material adverse effect on our business, financial condition and results of operations.

Our business activities and earnings are affected by general business conditions in the United States and in our local market area. These conditions include short-term and long-term interest rates, inflation, unemployment levels, consumer confidence and spending, fluctuations in both debt and equity capital markets, and the strength of the economy in the United States generally and, in particular, our market area. A favorable business environment is generally characterized by, among other factors, economic growth, efficient capital markets, low inflation, low unemployment, high business and investor confidence, and strong business earnings. Unfavorable or uncertain economic and market conditions can be caused by declines in economic growth, business activity or investor or business confidence; limitations on the availability or increases in the cost of credit and capital; increases in inflation or interest rates; high unemployment; natural disasters; or a combination of these or other factors. Economic pressure on consumers and uncertainty regarding continuing economic improvement may result in changes in consumer and business spending, borrowing and savings habits. Elevated levels of unemployment, declines in the values of real estate, extended federal government shutdowns, or other events that affect household and/or corporate incomes could impair the ability of our borrowers to repay their loans in accordance with their terms and reduce demand for banking products and services.

We outsource certain key aspects of our data processing to certain third-party providers. While we have selected these third-party providers carefully, we cannot control their actions. If our third-party providers encounter difficulties, including those that result from their failure to provide services for any reason or their poor performance of services, or if we have difficulty in communicating with them, our ability to adequately process and account for customer transactions could be affected, and our business operations could be adversely impacted. Replacing these third-party providers could also entail significant delay and expense. Our third-party providers may experience unauthorized access, computer viruses, phishing schemes and other security breaches. Threats to information security also exist in the processing of customer information through various other third-party providers and their personnel. We may be required to expend significant additional resources to protect against the threat of such security breaches and computer viruses, or to alleviate problems caused by such security breaches or viruses. To the extent that the activities of our third-party providers or the activities of our customers involve the storage and transmission of confidential information, security breaches and viruses could expose us claims, regulatory scrutiny, litigation and other possible liabilities.