Simmons 1st Nat'l (SFNC) Risk Factors

Our ability to attract and retain customers, employees, and acquisition partners is influenced by our reputation. A negative opinion of our business can develop in connection with a variety of circumstances, including issues with our lending practices, legal and regulatory compliance, risk management, corporate governance, customer service, community involvement, integration of acquired institutions, and third-party service providers. Our reputation could also be harmed through regulatory proceedings by governmental authorities, litigation, or cybersecurity events. Reputational damage could also impact our relationships with investors, our credit ratings and our ability to access capital markets.

From time to time, we are subject to litigation. Litigation and claims can arise in various contexts, including, among others, our lending activities, deposit activities, employment practices, commercial agreements, fiduciary responsibilities, compliance programs, anti-money laundering programs and other general business matters. These claims and legal actions, including supervisory actions by our regulators, could involve large amounts in controversy, significant fines or penalties, and substantial legal costs necessary for our defense. The outcome of litigation and regulatory matters, as well as the timing associated with resolving these matters, are inherently hard to predict. Substantial legal liability, which may not be insured, and significant regulatory actions against us could materially and adversely impact our business operations, including our ability to engage in mergers and acquisitions, our results of operations and our financial condition.

A significant portion of our loan portfolio is secured by real estate. In the course of our business, we may own or foreclose and take title to real estate and could become subject to environmental liabilities with respect to these properties. We may become responsible to a governmental agency or third parties for property damage, personal injury, investigation and clean-up costs incurred by those parties in connection with environmental contamination, or may be required to investigate or clean-up hazardous or toxic substances, or chemical releases at a property. The costs associated with environmental investigation or remediation activities could be substantial. If we were to become subject to significant environmental liabilities, it could have a material adverse effect on our results of operations and financial condition.

We provide a variety of commercial and consumer banking, as well as other financial, products and services designed to meet a broad range of needs. While many of these products and services are traditional both in their characteristics and their delivery channels, advancements in technology, changes in the regulatory environment, and evolving customer preferences require that we continuously evaluate the terms under which we provide our existing products and services (including, among other things, interest rates and loan covenants), the methods by which we deliver them (including the use of online and mobile banking), whether to partner with a FinTech company or other third-party vendor to provide products and services, and the potential for new products and services in order to remain competitive. These efforts, though, could require substantial investments, and we can provide no assurance that we will develop new products and services, or adequately adapt our existing products and services, in a timely or successful manner. Our inability to do so could harm our business and adversely affect our results of operations and reputation. Furthermore, any new line of business and/or new product or service could require the establishment of new key and other controls and have a significant impact on our existing system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business and/or new products or services could have a material adverse effect on our business and, in turn, our financial condition and results of operations.

Our competition, or other third parties, may allege that we have violated their intellectual property rights. For example, we may unintentionally infringe upon the rights of third parties through the use of infringing software or other types of content provided by vendors. Alternatively, failure to effectively protect our own intellectual property through trade secret, copyright, patents, and other legal means may result in it being used to the benefit of others and to the detriment of our business. A successful claim of infringement could subject us to money damages, require significant license or royalty fees, or result in restrictions preventing us from using certain software or technology, thereby impeding our delivery of products or services. Even if ultimately unsuccessful, the financial cost of a legal defense and the diversion of management's attention from our business may prove costly.

Our businesses are dependent on our ability and the ability of our third-party service providers to process, record and monitor a large number of transactions. If the financial, accounting, data processing or other operating systems and facilities fail to operate properly, become disabled, experience security breaches or have other significant shortcomings, our results of operations could be materially, adversely affected. Although we and our third party service providers devote significant resources to maintain and regularly upgrade our systems and processes that are designed to protect the security of computer systems, software, networks and other technology assets and the confidentiality, integrity and availability of information belonging to us and our customers, there is no assurance that our security systems and those of our third-party service providers will provide absolute security. Financial services institutions and companies engaged in data processing have reported breaches in the security of their websites or other systems, some of which have involved sophisticated and targeted attacks intended to obtain unauthorized access to confidential information, destroy data, disable or degrade service, or sabotage systems, often through the introduction of computer viruses or malware, cyber-attacks and other means. Certain financial institutions in the United States have also experienced attacks from technically sophisticated and well-resourced third parties that were intended to disrupt normal business activities by making internet banking systems inaccessible to customers for extended periods. These "denial-of-service" attacks have not breached our data security systems, but require substantial resources to defend, and may affect customer satisfaction and behavior. Despite our efforts and those of our third party service providers to ensure the integrity of our systems, it is possible that we may not be able to anticipate or to implement effective preventive measures against all security breaches of these types, especially because the techniques used change frequently or are not recognized until launched, and because security attacks can originate from a wide variety of sources, including persons who are involved with organized crime or associated with external service providers or who may be linked to terrorist organizations or hostile foreign governments. Those parties may also attempt to fraudulently induce employees, customers or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or clients. These risks may increase in the future as we continue to increase our mobile payments and other internet-based product offerings and expand our internal usage of web-based products and applications. Furthermore, because certain of our employees are working, or may work, remotely, there is an increased risk of disruption to our systems because remote networks and infrastructure may not be as secure as in our office environment. If our security systems were penetrated or circumvented, it could cause serious negative consequences for us, including significant disruption of our operations, misappropriation of our confidential information or that of our customers, or damage our computers or systems and those of our customers and counterparties, and could result in violations of applicable privacy and other laws, financial loss to us or to our customers, loss of confidence in our security measures, customer dissatisfaction, significant litigation exposure, and harm to our reputation, all of which could have a material adverse effect on us.

We have operations in the mid-south and certain great plains states, areas susceptible to tornados and severe weather events. In addition, our operations and a significant number of our branches are located in the New Madrid Seismic Zone. While we have in place a business continuity plan, such events could potentially disrupt our operations or result in physical damage to our branch office locations. Severe weather events or earthquakes could also impact the value of any collateral we hold, or significantly disrupt the local economies in the markets that we serve, manifesting in a decline in loan originations, as well as an increase in the risk of delinquencies, defaults, and foreclosures.

A critical component of our success is the ability to attract, develop and retain highly qualified, skilled lending, operations, information technology, and other employees, as well as managers who are experienced and effective at leading their respective departments. We have an experienced group of senior management and other key personnel that our board of directors believes is capable of managing and growing our business. In many areas of the financial services industry, competition for key personnel is fierce, and the departure of those individuals from our business presents risk that we will be unable to attract, develop and retain suitable successors, which could have a material, adverse impact on our competitive position in the marketplace.

We rely on a large number of vendors to provide products and services that we need for our day-to-day operations, particularly in the areas of loan and deposit operations, information technology, and security. This reliance exposes us to the risk that the vendors will not perform in accordance with the applicable contractual arrangements or service level agreements, as well as risks resulting from defective products, poor performance of services, disruption in a product or service, vendor contracts, or loss of a product or service if a vendor ceases doing business because of its own financial or operational difficulties. These risks, if realized, could result in significant disruptions to our business, which could have a material adverse impact on our financial condition and results of operations. While we maintain a vendor management program designed to assist in the oversight and monitoring of our third-party service providers, there can be no assurance that we will not experience service-related issues associated with our vendors.