Texas Capital Bancshares (TCBI) Risk Analysis

Competition among providers of financial services in markets, in Texas, regionally and nationally, is intense. The Company competes with other financial and bank holding companies, state and national commercial banks, savings and loan associations, consumer finance companies, credit unions, securities brokerages, insurance companies, mortgage banking companies, money market mutual funds, asset-based non-bank lenders, government sponsored or subsidized lenders, financial technology companies and other financial services providers. Many of these competitors have substantially greater financial resources, lending limits and technological resources and larger branch networks than the Company does and are able to offer a broader range of products and services than the Company can. Many competitors offer lower interest rates and more liberal loan terms that appeal to borrowers but adversely affect net interest margin and assurance of repayment. The Company is increasingly faced with competition in many of its products and services by non-bank providers who may have competitive advantages of size, access to potential customers and fewer regulatory requirements. Failure to compete effectively for deposit, loan and other banking customers in any of the lines of business could cause the Company to lose market share, slow or reverse growth rate or suffer adverse effects on financial condition, results of operations or profitability. See the discussion above in Item 1. Business – Competition for additional discussion of the Company's competition.

The Company's future profitability depends, to a significant extent, upon revenue it receives from commercial business customers, and their ability to continue to meet their loan obligations. Adverse economic conditions or other factors affecting this market segment, and the Company's failure to timely identify and react to unexpected economic downturns, may have a greater adverse effect than other financial institutions that have a more diversified customer base. Additionally, the Company's inability to grow its commercial business customer base in a highly competitive market could affect its future growth and profitability.

Customers and other parties the Company engage with may, on a regular basis, assert claims and take legal action against the Company and the Company regularly takes legal action to collect unpaid borrowers' obligations, realize on collateral and assert rights in commercial and other contexts. These actions frequently result in counter claims against the Company. Litigation arises in a variety of contexts, including lending activities, employment practices, commercial agreements, fiduciary responsibility related to wealth management services, intellectual property rights and other general business and banking matters. Claims and legal actions may result in significant legal costs to defend or assert rights and may result in reputational damage that adversely affects existing and future customer relationships. If claims and legal actions are not resolved in a favorable manner, the Company may suffer significant financial liability or adverse effects on its reputation, which could have a material adverse effect on the business, financial condition, results of operations or profitability. See Legal Proceedings below for additional disclosures regarding legal proceedings. The Company purchases insurance coverage to mitigate a wide range of risks. There is no assurance that insurance will be adequate to protect the Company against material losses in excess of coverage limits or that insurers will perform their obligations under policies without attempting to limit or exclude coverage. The Company could be required to pursue legal actions against insurers to obtain payment of amounts owed, and there is no assurance that such actions, if pursued, would be successful. Other Risks Affecting the Business

A significant portion of the loan portfolio is secured by real property. During the ordinary course of business, the Company may foreclose on and take title to properties securing certain loans. There is a risk that hazardous or toxic substances could be found on these properties, and that the Company may be liable for remediation costs, including personal injury and property damage. Environmental laws may require incurring substantial expenses and may materially reduce the affected property's value by limiting the ability to use or sell it. Although the Company has policies and procedures requiring environmental review before initiating any foreclosure action on real property, these reviews may not be sufficient to detect all potential environmental hazards. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on financial condition, results of operations and profitability. Future laws or regulations or more stringent interpretations or enforcement policies with respect to existing laws and regulations may increase the Company's exposure to environmental liability.

The Company and similar financial institutions are subject to continuous threats from cyber attacks on its computer systems, software, networks and other technology from various actors, including groups acting on behalf of hostile countries, cyber-criminals, "hacktivists" (i.e., individuals or groups that use technology to promote a political agenda or social change) and others. These cyber attacks can take many forms, including attempts to introduce computer viruses or malicious code, which are commonly referred to as "malware," into the Company's systems. These attacks are often designed to: obtain unauthorized access to confidential information belonging to the Company or its clients, customers, counterparties or employees, manipulate data, destroy data or systems with the aim of rendering services unavailable, disrupt, sabotage or degrade service on the Company's systems, steal money, or extort money through the use of so-called "ransomware." The Company has experienced security breaches and cyber attacks in the past, and it is inevitable that additional breaches and attacks will occur in the future. While such breaches and attacks have not materially impacted the Company to date, future security breaches and cyber attacks could result in serious and harmful consequences for the Company or its clients and customers. A principal reason that the Company cannot provide absolute security against cyber attacks is that it may not always be possible to anticipate, detect or recognize threats to the Company's systems, or to implement effective preventive measures against all breaches because: the techniques used in cyber attacks evolve frequently and are increasingly sophisticated, and therefore may not be recognized until launched, cyber attacks can originate from a wide variety of sources, including the Company's own employees, cyber-criminals, hacktivists, groups linked to terrorist organizations or hostile countries, or third parties whose objective is to disrupt the operations of financial institutions more generally, the Company does not have control over the cybersecurity of the systems of the large number of clients, customers, counterparties and third-party service providers with which it does business, and it is possible that a third party, after establishing a foothold on an internal network without being detected, might obtain access to other networks and systems. The risk of a security breach due to a cyber attack could increase in the future due to factors such as: the Company's ongoing expansion of its mobile and digital banking and other internet-based product offerings and its internal use of internet-based products and applications and the increased use of remote access to facilitate remote arrangements for employees, vendors and other third parties. In addition, a third party could misappropriate confidential information obtained by intercepting signals or communications from mobile devices used by the Company's employees. A successful penetration or circumvention of the security of the Company's systems or the systems of a vendor, governmental body or another market participant could cause serious negative consequences, including: significant disruption of the Company's operations and those of its clients, customers and counterparties, including losing access to operational systems, misappropriation of confidential information of the Company or that of its clients, customers, counterparties, employees or regulators, disruption of or damage to the Company's systems and those of its clients, customers and counterparties, the inability, or extended delays in the ability, to fully recover and restore data that has been stolen, manipulated or destroyed, or the inability to prevent systems from processing fraudulent transactions, allegations or violations by the Company of applicable privacy and other laws, financial loss to the Company or to its clients, customers, counterparties or employees, loss of confidence in the Company's cybersecurity and business resiliency measures, dissatisfaction among the Company's clients, customers or counterparties, significant exposure to litigation and regulatory fines, penalties or other sanctions, and harm to the Company's reputation. The extent of a particular cyber attack and the steps that the Company may need to take to investigate the attack may not be immediately clear, and it may take a significant amount of time before such an investigation or determination, judicial or otherwise, can be completed. While such an investigation is ongoing, the Company may not necessarily know the full extent of the harm caused by the cyber attack, and that damage may continue to spread. These factors may inhibit the Company's ability to provide rapid, full and reliable information about the cyber attack to its clients, customers, counterparties and regulators, and the public. Furthermore, it may not be clear how best to contain and remediate the harm caused by the cyber attack, and certain errors or actions could be repeated or compounded before they are discovered and remediated. Any or all of these factors could further increase the costs and consequences of a cyber attack.

The Company, its vendors and customers all rely heavily on communications and information systems to conduct their respective businesses, store sensitive data and work effectively together. The financial services industry is undergoing rapid technological changes with frequent introductions of new technology-driven products and services. The Company's ability to compete successfully depends in part upon its ability to use technology to provide products and services that will satisfy customer demands. Many of the Company's larger competitors invest substantially greater resources in technological capabilities than the Company does. The Company may not be able to effectively protect, develop and manage mission critical systems and IT infrastructure to support strategic business initiatives, which could impair its ability to achieve financial, operational, compliance and strategic objectives and negatively affect the business, results of operations, financial condition or profitability. Communications and information systems and those of the Company's vendors and customers remain vulnerable to unexpected disruptions, failures and cyber-attacks. Any disruptions, failures or breaches in security of these systems could result in significant disruption to the Company's operations. Information security breaches and cyber-security-related incidents include, but are not limited to, attempts to access information, theft of information, credentials or other intellectual property, including customer and company information, malicious code, computer viruses and denial of service attacks that could result in unauthorized access, data breaches resulting in misuse, loss or destruction of data (including confidential customer and employee information), ransomware attacks, account takeovers, unavailability of service or other events. These types of threats may derive from human error, fraud or malice on the part of external or internal parties or may result from accidental technological failure. The risk, frequency and intensity of such attacks is escalating, including as a result of remote working arrangements, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication of these threats. Material failures or interruptions of these systems could impair the Company's ability to serve customers and to operate the business and could damage the Company's reputation, result in a loss of business, subject the Company or the Bank to additional regulatory scrutiny or enforcement or exposure to civil litigation, criminal penalties or financial liability. While the Company has developed extensive recovery plans, the Company cannot assure that those plans will be effective to prevent adverse effects resulting from system failures. The use of the Company's cloud technologies is also critical to the operation of systems, and its reliance on cloud technologies is growing. Service disruptions in cloud technologies may lead to delays in accessing, or the loss of, data that is important to the businesses and may hinder clients' access to products and services. The Company collects and stores sensitive data, including personally identifiable information of its customers and employees and in the ordinary course of business must allow certain vendors access to that data. Breaches of the systems or vendors' or customers' systems, thefts of data and other breaches and criminal activity may result in significant costs to respond or remediate losses if the Company or its vendors are at fault, damage to the Company's customer relationships, regulatory scrutiny and enforcement and loss of future business opportunities due to reputational damage. Even the most well-protected information, networks, systems and facilities remain potentially vulnerable because attempted security breaches, particularly cyber-attacks and intrusions, or disruptions will occur in the future, and because the techniques used in such attempts are rapidly and constantly evolving and generally are not recognized until launched against a target, and in some cases are designed not to be detected and, in fact, may not be detected for a period of time or at all. Accordingly, the Company may be unable to anticipate or be prepared for these techniques or to implement adequate security barriers or other preventative measures, and thus it is impossible for the Company to entirely mitigate this risk. Breaches can be perpetrated by unknown third parties, but could also be facilitated by employees either inadvertently or by consciously attempting to create disruption or certain acts of fraud. The Company's customers and employees have been, and will continue to be, targeted by parties using fraudulent e-mails and other communications in attempts to misappropriate passwords, bank account information or other personal information or to introduce viruses or other malware through "Trojan horse" programs to the Company's information systems, the information systems of merchants or third-party service providers and/or customers' computers. Although the Company, with the help of third-party service providers, will continue to implement information security technology solutions and establish operational procedures to protect sensitive data, there can be no assurance that these measures will be effective. The Company advises, or alerts and provides some guidance to customers and evaluates and imposes security requirements on vendors regarding protection of their respective information systems, but there is no assurance that these actions will have the intended positive effects or will be effective to prevent losses or attacks. Successful cyber-attacks on the Company, vendors or customers may affect the Company's reputation, and failure to meet customer expectations could have a material impact on the Company's ability to attract and retain deposits as a primary source of funding. A security breach or other significant disruption of information systems or those related to customers, merchants and third-party vendors, including as a result of cyber-attacks, could (i) disrupt the proper functioning of networks and systems and therefore the operations and/or those of certain customers; (ii) result in the unauthorized access to, and destruction, loss, theft, misappropriation or release of confidential, sensitive or otherwise valuable information; (iii) result in a violation of applicable privacy, data breach and other laws, subjecting the Company to additional regulatory scrutiny and exposure to civil litigation, criminal penalties, governmental fines or financial liability; (iv) require significant management attention and resources to respond, remediate or remedy the damages that result; or (v) harm the reputation or cause a decrease in the number of customers that choose to do business with the Company. The occurrence of any of the foregoing could have a material adverse effect on the business, financial condition, results of operations or profitability.

The Company's success depends to a significant extent upon its ability to attract, develop and retain experienced personnel in each of its lines of business and markets including managers in operational areas, compliance and other support areas to build and maintain the infrastructure and controls required to support continuing growth. Competition for the best people in the industry can be intense, and there is no assurance that the Company will continue to attract or retain talent or develop personnel. Factors that affect its ability to attract, develop and retain key employees include compensation and benefits programs, profitability, ability to establish appropriate succession plans for key talent, reputation for rewarding and promoting qualified employees and market competition for employees with certain skills, including information systems development and security. The cost of employee compensation is a significant portion of operating expenses and can materially impact results of operations or profitability, especially during periods of wage inflation. The unanticipated loss of the services of key personnel could have an adverse effect on the business.

Severe weather, earthquakes, other natural disasters, pandemics, climate change, acts of war or terrorism and other adverse external events could have a significant impact on the Company's ability to conduct business. Such events could affect the stability of its deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue, cause us to incur additional expenses or disrupt the Company's operations. In recent years, hurricanes have caused extensive flooding and destruction along the coastal areas of Texas and in other areas in the U.S., including communities where the Company conducts business. Climate change has the potential to increase to frequency and severity of these severe weather events in the future. Although management has established disaster recovery policies and procedures, the occurrence of any such events could have a material adverse effect on the business, financial condition, results of operations or profitability. Furthermore, legislative and regulatory initiatives related to climate change have the potential to disrupt the business and result in operational changes and expenditures that could significantly impact the business and the operations and creditworthiness of the Company's clients and also increase the compliance burden on the Company.