SouthState Corporation (SSB) Risk Analysis

Many aspects of the banking business involve a substantial risk of legal liability. The Company and the Bank have been named or threatened to be named as defendants in various lawsuits arising from our business activities (and in some cases from the activities of companies that we have acquired). In addition, from time to time, we are, or may become, the subject of information-gathering requests, reviews, investigations and proceedings, and other forms of regulatory inquiry, including by bank regulatory agencies, the SEC, self-regulatory organizations and law enforcement authorities. The results of such proceedings could lead to significant civil or criminal penalties, including monetary penalties, damages, adverse judgments, settlements, fines, injunctions, restrictions on the way the Company and the Bank conduct their business, or reputational harm.

We compute our income tax provision based on enacted tax rates in the jurisdictions in which we operate. Any change in enacted tax laws, rules or regulatory or judicial interpretations, or any change in the pronouncements relating to accounting for income taxes could adversely affect our effective tax rate, tax payments and results of operations. The taxing authorities in the jurisdictions in which we operate may challenge our tax positions, which could increase our effective tax rate and harm our financial position and results of operations. We are subject to audit and review by U.S. federal and state tax authorities. Any adverse outcome of such a review or audit could have a negative effect on our financial position and results of operations. In addition, changes in enacted tax laws, such as adoption of a lower income tax rate in any of the jurisdictions in which we operate, could impact our ability to obtain the future tax benefits represented by our deferred tax assets. In addition, the determination of our provision for income taxes and other liabilities requires significant judgment by management. Although we believe that our estimates are reasonable, the ultimate tax outcome may differ from the amounts recorded in our financial statements and could have a material adverse effect on our financial results in the period or periods for which such determination is made.

The capital and credit markets have experienced volatility and disruption from time to time during the past several years. In some cases, the markets have produced downward pressure on stock prices and credit availability for certain issuers without regard to those issuers' underlying financial condition or performance. If these periodic market disruptions and volatility continue or worsen, we may experience adverse effects, which may be material, on our ability to maintain or access capital and on our business, financial condition and results of operations.

We continuously evaluate our service offerings and may implement new lines of business or offer new products and services within existing lines of business in new sales channels such as online and mobile banking in the future. There are substantial risks and uncertainties associated with these efforts. In developing and marketing new lines of business and/or new products and services, we undergo a new product process to assess the risks of, and resources needed for, the initiative and invest significant time and resources to build internal controls, policies and procedures to mitigate those risks, including hiring experienced management to oversee the implementation of the initiative. Initial timetables for the introduction and development of new lines of business and/or new products or services and/or new sales channels may not be achieved, and price and profitability targets may not prove feasible. External factors, such as compliance with regulations, competitive alternatives, and shifting market preferences, may also impact the successful implementation of a new line of business and/or a new product or service and/or sales channels. Furthermore, any new line of business and/or new product or service could require the establishment of new key and other controls and have a significant impact on our existing system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business and/or new products or services could have a material adverse effect on our business and, in turn, our financial condition and results of operations.

Our computer systems and network infrastructure and those of third parties, on which we are highly dependent, are subject to cybersecurity risks and could be susceptible to cyber-attacks, information security breaches and other similar incidents. Our business relies on the secure processing, transmission, storage, retrieval and other processing of confidential, proprietary, personal and other information in our computer and data management systems and networks, and in the computer and data management systems and networks of third parties. In addition, to access our network, products and services, our customers and other third parties may use personal mobile devices or computing devices that are outside of our network environment and are subject to their own cybersecurity risks. We, our customers, regulators and other third parties, including other financial services institutions and companies engaged in data processing, have been subject to, and are likely to continue to be the target of, cyber-attacks, information security breaches, and other similar incidents. These may include hacking, terrorist activities, identity theft, computer viruses, malicious or destructive code, phishing attacks, denial of service attacks, ransomware, improper access by employees or third parties, social engineering, attacks on personal email of employees, or other information security breaches or similar incidents that could result in the unauthorized release, gathering, monitoring, misuse, misappropriation, loss, disclosure or destruction of confidential, proprietary, personal and other information of ours, our employees, our customers or of third parties, damage our systems or otherwise materially disrupt our or our customers' or other third parties' network access or business operations. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any cyber-attacks, information security breaches or vulnerabilities or other similar incidents. Despite efforts to ensure the integrity of our systems and implement controls, processes, policies and other protective measures, we may not be able to anticipate or detect all cyber-attacks, information security breaches or other similar incidents, nor may we be able to implement guaranteed preventive measures against such security breaches. Cyber threats are increasing and rapidly evolving, and we may not be able to anticipate or prevent all such attacks and could be held liable for any security breach or loss. Cybersecurity risks for banking organizations have significantly increased in recent years, in part because of the proliferation of new technologies and the use of the internet and telecommunications technologies to conduct financial transactions. For example, cybersecurity risks may increase in the future as we continue to increase our mobile payment and other internet-based product offerings and expand our internal usage of web-based products and applications and as artificial intelligence tools are increasingly used for purposes of cyber-attacks, information security breaches, and other similar incidents, including for targeted social engineering attacks. In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of organized crime affiliates, terrorist organizations, hostile foreign governments, disgruntled employees, service providers, activists and other external parties, including those involved in corporate espionage. Even the most advanced internal control environment may be vulnerable to compromise. For example, targeted social engineering attacks and "spear phishing" attacks are becoming more sophisticated and are extremely difficult to prevent. In such an attack, an attacker will attempt to fraudulently induce colleagues, customers or other users of our systems to disclose sensitive information in order to gain access to its data or that of its clients. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cyber criminals change frequently and may not be recognized until launched or until well after a breach has occurred. The risk of a security breach caused by a cyber-attack at a service provider or by unauthorized service provider access has also increased in recent years. Additionally, the existence of cyber-attacks, information security breaches, or other similar incidents at third-party service providers with access to our confidential, proprietary, personal and other information may not be disclosed to us in a timely manner. While we have processes in place to monitor our third-party service providers' data and information security safeguards, we do not control such service providers' day to day operations and a successful cyber-attack, information security breach, or other similar incident at one or more of such third-party service providers is not within our control. The occurrence of any such cyber-attacks, information security breaches, or other incidents could damage our reputation, result in a loss of customer business, and expose us to additional regulatory scrutiny, civil litigation, and possible financial liability, any of which could have a material adverse effect on our financial condition and results of operations. Further, in some instances we may be responsible for the failure of such third parties to comply with government regulations. We also face indirect technology, cybersecurity and operational risks relating to the customers, clients and other third parties with whom we do business or upon whom we rely to facilitate or enable our business activities, including, for example, financial counterparties, regulators, and providers of critical infrastructure such as internet access and electrical power. As a result of increasing consolidation, interdependence and complexity of financial entities and technology systems, a technology failure, cyber-attack, information security breach or other similar incident that significantly degrades, deletes or compromises the systems or data of one or more financial entities could have a material impact on counterparties or other market participants, including us. This consolidation, interconnectivity and complexity increases the risk of operational failure, on both individual and industry-wide bases, as disparate systems need to be integrated, often on an accelerated basis. Any third-party technology failure, cyber-attack, information security breach, or other similar incident could, among other things, adversely affect our ability to effect transactions, service our clients, manage our exposure to risk or expand our business. In addition, we, our employees, and our customers are increasingly transitioning our and their computing infrastructure to cloud-based computing, storage, data processing, networking and other services, which may increase our cybersecurity risk. Cyber-attacks, information security breaches, and other similar incidents, whether directed at us or third parties, may result in a material loss or have material consequences. Furthermore, the public perception that a cyber-attack on our systems has been successful, whether or not this perception is correct, may damage our reputation with customers and third parties with whom we do business. Hacking or other unauthorized disclosure of personal information and identity theft risks, in particular, could cause serious reputational harm. A successful penetration or circumvention of system security could cause us serious negative consequences, including our loss of customers and business opportunities, significant business disruption to our operations and business, misappropriation or destruction of our confidential, proprietary, personal or other information and/or that of our customers or other third parties, or damage to our or our customers' and/or third parties' computers or systems, and could result in a violation of applicable data privacy and cybersecurity laws and other laws, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in our security measures, reputational damage, reimbursement or other compensatory costs, additional compliance costs, and could adversely impact our results of operations, liquidity and financial condition. We may not be insured against all types of losses as a result of cyber-attacks, information security breaches and other similar incidents, and our insurer may deny coverage as to any future claim or insurance coverage may not be available on reasonable terms, or at all, or may be inadequate to cover all losses resulting from such incidents. Although to date we have not experienced any material losses related to cyber-attacks, information security breaches, or other similar incidents, there can be no assurance that we will not suffer such losses in the future.

The FDIC insures deposits at FDIC-insured depository institutions, such as our subsidiary Bank, up to applicable limits. The amount of a particular institution's deposit insurance assessment is based on that institution's risk classification under an FDIC risk-based assessment system. The assessment base on which the Bank's deposit insurance premiums is paid to the FDIC has been calculated based on its average consolidated total assets less its average equity. However, effective January 1, 2019, which was following the fourth consecutive quarter where the Bank's total consolidated assets exceeded $10 billion, the FDIC started to use a performance score and loss-severity score to calculate the Bank's initial FDIC assessment rate. An institution's risk classification is assigned based on its capital levels and the level of supervisory concern the institution poses to its regulators. While our risk management processes are designed to reduce risk by maintaining capital levels and mitigating any supervisory concerns, we may be unable to control the amount of premiums that we are required to pay for FDIC insurance in the event of a new economic downturn and an increase in financial institution failures. For example, we incurred a special assessment of $26 million by the FDIC to help recoup losses to the Deposit Insurance Fund resulting from the bank failures 2023. Any future increases in assessments or required prepayments in FDIC insurance premiums may materially adversely affect results of operations, including by reducing our profitability or limiting our ability to pursue business opportunities.

The banking business is highly competitive and we experience competition in our markets from many other financial institutions. We compete with commercial banks, credit unions, mortgage banking firms, consumer finance companies, securities brokerage firms, insurance companies, money market funds, and other mutual funds, as well as other super-regional, national and international financial institutions and fintech or e-commerce companies that operate in our primary market areas and elsewhere. Some of these competitors may have a long history of successful operation in our markets, greater ties to local businesses and more expansive banking relationships, as well as better established depositor bases. Competitors with greater resources or more advanced technology may possess an advantage by being capable of maintaining numerous and more convenient banking locations, easy to use and available mobile and computer apps or Internet platforms, operating more ATMs and conducting extensive promotional and advertising campaigns. We compete with these institutions both in attracting deposits and in making loans. In addition, we have to attract our customer base from other existing financial institutions and from new residents. Many of our competitors are well-established, larger financial institutions and credit unions. While we believe we can and do successfully compete with these other financial institutions in our primary markets, we may face a competitive disadvantage as a result of our smaller size, lack of geographic diversification, sophisticated online or mobile applications, and inability to spread our marketing costs across a broader market. Although we compete by concentrating our marketing efforts in our primary markets with local advertisements, personal contacts, and greater flexibility and responsiveness in working with local customers, we can give no assurance this strategy will be successful.

Our adoption of artificial intelligence, including generative artificial intelligence, machine learning, and similar tools and technologies that collect, aggregate, analyze or generate data or other materials or content (collectively, "AI"), for limited internal use has increased our efficiency, and we expect to continue to adopt such tools as appropriate. In addition, we expect our third-party vendors and service providers to increasingly develop and incorporate AI into their product offerings faster than we are able to do so independently. There are significant risks involved in utilizing AI and no assurance can be provided that our or our third-party vendors' or service providers' use of AI will enhance our or our third-party vendors' or service providers' products or services or produce the intended results. The adoption and incorporation of such tools can lead to concerns around safety and soundness, fair access to financial services, fair treatment of consumers, and compliance with applicable laws and regulations. Such risk can result from models being poorly designed or faulty data being used, inadequate model testing or validation, narrow or limited human oversight, inadequate planning or due diligence, inappropriate or controversial data practices by developers or end-users, and other factors adversely affecting public opinion of AI and the acceptance of AI solutions. We have implemented an AI governance function and risk management framework that includes a risk assessment of internal and vendor AI solutions, due diligence, model validation, and controls. However, given the pace of rapid adoption of such tools by vendors and service providers, we may not be aware of the addition of AI solutions prior to such tools being introduced into our environment. Failure to adequately manage AI risks can result in erroneous results and decisions made by misinformation, unwanted forms of bias, unauthorized access to sensitive, confidential, proprietary or personal information, and violations of applicable laws and regulations, leading to operational inefficiencies, competitive harm, reputational harm, ethical challenges, legal liability, losses, fines, and other adverse impacts on our business and financial results. If we do not have sufficient rights to use the data or other material or content on which the AI tools we use rely, or to use the output of such AI tools, we also may incur liability through the violation of applicable laws and regulations, third-party intellectual property, privacy or other rights, or contracts to which we are a party. In addition, regulation of AI is rapidly evolving as legislators and regulators are increasingly focused on these powerful emerging technologies. The technologies underlying AI and its uses are subject to a variety of laws and regulations, including intellectual property, data privacy and cybersecurity, consumer protection, competition, equal opportunity, and fair lending laws, and are expected to be subject to increased regulation and new laws or new applications of existing laws and regulations. AI is the subject of ongoing review by various U.S. governmental and regulatory agencies, and various U.S. states are applying, or are considering applying, existing laws and regulations to AI or are considering general legal frameworks for AI. We may not be able to anticipate how to respond to these rapidly evolving frameworks, and we may need to expend resources to adjust our operations or offerings in certain jurisdictions if the legal frameworks are inconsistent across jurisdictions. Furthermore, because AI technology itself is highly complex and rapidly developing, it is not possible to predict all of the legal, operational or technological risks that may arise relating to the use of AI.

Our reputation is one of the most valuable components of our business. As such, we strive to conduct our business in a manner that enhances our reputation. This is done, in part, by recruiting, hiring, and retaining and providing growth opportunities for employees who share our core values of being an integral part of the communities we serve, delivering superior service to our customers, and caring about our customers and employees. If our reputation is negatively affected by the actions of our employees or otherwise, including as a result of a successful cyber-attack, information security breach or other similar incident we experience or any other unauthorized release or loss of customer information (including personal information), our business and, therefore, our operating results, may be materially adversely affected. Actions by the financial service industry generally or by institutions or individuals in the industry can adversely affect our reputation indirectly by association. The proliferation of social media may increase the likelihood that negative public opinion from any of the real or perceived events in the financial services industry could impact our reputation and business. Negative public opinion could adversely affect the Company's ability to attract and retain clients and teammates and can result in litigation and regulatory actions. All of these could adversely affect our growth, results of operation, and financial conditions.