Trico Bancshares (TCBK) Risk Factors

We are subject to extensive regulation, supervision and examination by the DFPI, FDIC, and the FRB as well as regulations and policies of the CFPB. See "Item 1. Business - Regulation and Supervision" of this report for information on the regulation and supervision which governs our activities. Regulatory authorities have extensive discretion in their supervisory and enforcement activities, including the imposition of restrictions on our operations, the classification of our assets and determination of the level of our allowance for credit losses. Banking regulations or the actions of our banking regulators may limit our growth, earnings and the return to our shareholders by restricting certain of our activities, such as: - the payment of dividends to our shareholders,- possible mergers with or acquisitions of or by other institutions,- desired investments,- loans and interest rates on loans,- interest rates paid on deposits,- service charges on deposit account transactions,- the possible expansion or reduction of branch offices, and - the ability to provide new products or services. We also are subject to regulatory capital requirements. We could be subject to regulatory enforcement actions if any of our regulators determines for example, that we have violated a law or regulation, engaged in unsafe or unsound banking practice or lack adequate capital. Federal and state governments and regulators could pass legislation and adopt policies responsive to current credit conditions that would have an adverse effect on us and our financial performance. We cannot predict what changes, if any, will be made to existing federal and state legislation and regulations or the effect that such changes may have on our future business and earnings prospects. Any change in such regulation and oversight, whether in the form of regulatory policy, regulations, legislation or supervisory action, may have a material adverse impact on our operations, including the cost to conduct business. Furthermore, The evolving landscape of legislative and regulatory actions, influenced by election cycles, introduces an additional layer of uncertainty for our operations. Elections can precipitate changes in government policies and regulations across various industries, potentially impacting our business. Uncertainty regarding potential changes in regulations or policies related to our industry may lead to increased costs of doing business and operational challenges. Economic conditions, including interest rates, inflation, and consumer spending, may be influenced by shifts in government leadership and policies, affecting our ability to maintain historical growth rates. Furthermore, the election process often introduces market volatility, impacting financial markets, currency exchange rates, and commodity prices. This volatility may pose risks to our financial performance, cost of capital, and access to funding. The outcomes of elections may directly affect our industry, influencing regulatory frameworks and industry dynamics. Shifts in political power may shape the competitive landscape, impacting market share and pricing strategies. Unfavorable changes in industry-specific regulations could result in increased compliance costs and operational challenges. Political events, including elections, can influence consumer and investor sentiment, affecting demand for our products and services and impacting investor confidence, which may influence our stock price and access to capital.

In the course of our business, we may foreclose and take title to real estate and could be subject to environmental liabilities with respect to these properties. We may be held liable to a governmental entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination, or may be required to investigate or clean-up hazardous or toxic substances, or chemical releases at a property. The costs associated with investigation or remediation activities could be substantial. In addition, if we are the owner or former owner of a contaminated site, we may be subject to common law or contractual claims by third parties based on damages and costs resulting from environmental contamination emanating from the property. When applicable, we establish contingent liability reserves for this purpose based on future reasonable and estimable costs developed by qualified soil and chemical engineering consultants. If we become subject to significant environmental liabilities or if our contingency reserve estimates are incorrect, our business, financial condition and results of operations could be materially adversely affected.

From time to time, we implement new lines of business or offer new products and services within existing lines of business. There are substantial risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and/or new products and services we invest significant time and resources. Initial timetables for the introduction and development of new lines of business and/or new products or services may not be achieved, and price and profitability targets may not prove feasible. External factors, such as compliance with regulations, competitive alternatives, and shifting market preferences, may also impact the successful implementation of a new line of business or a new product or service. The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services. Our future success depends, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology driven products and services or be successful in marketing these products and services to our customers. In addition, our implementation of certain new technologies, such as those related to artificial intelligence ("AI"), automation and algorithms, in our business processes may have unintended consequences due to their limitations or our failure to use them effectively. In addition, the growing reliance on AI technologies by vendors, business partners, and technology solutions or applications introduces additional risks, including but not limited to: Algorithmic Bias that may result in unintended discriminatory outcomes and harm our reputation, loss of proprietary and confidential information through use of AI technologies, unauthorized access or breaches of data could compromise the integrity of our systems with AI dependency, evolving regulations and legal frameworks surrounding AI may pose challenges leading to legal and financial consequences for non-compliance, and protecting the intellectual property associated with AI technologies may be challenging, and unauthorized use or infringement by third parties could bring harm to our competitive position or reputation. Furthermore, cloud technologies are also critical to the operation of our systems, and our reliance on cloud technologies is growing. Failure to successfully keep pace with technological change affecting the financial services industry could have a material adverse effect on our business, financial condition and results of operations. Furthermore, any new line of business, new product or service and/or new technology could have a significant impact on the effectiveness of our system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business, new products or services and/or new technologies could have a material adverse effect on our business, financial condition and results of operations.

As previously disclosed in the Current Report on Form 8-K we filed on February 14, 2023, the Bank experienced a cybersecurity incident in February 2023. After detecting unusual network activity, we shut down networked systems by taking them offline, which prevented access to internal systems, data and telephones for a limited period of time. We immediately launched an investigation and notified law enforcement and banking regulators. A digital forensics firm was engaged to help determine the scope of the incident and identify potentially impacted data. We received a demand for ransom from a party claiming responsibility for the incident. The Bank's core banking systems, including those that facilitate loan and deposit related transactions, were not affected and the Bank's resumed customer facing operations within two days. However, the Bank's internal system/server access as well as communication capabilities, including e-mail correspondence and telephones, required approximately one week of time for the restoration process to be completed in a safe and secure environment. The Company restored its systems without paying ransom. The Bank worked with third-party forensic investigators to understand the nature and scope of the incident and to determine what and how much information was impacted. The Bank determined that its internal computer network had been infected with malware which prevented access to certain files on the network. Through its investigation, the Bank determined that an unauthorized actor illegally accessed and acquired data from certain systems, including the personal information of approximately 86,000 individuals, including certain current and former customers, individuals related to current and former customers, current and former employees and their dependents, and others. While the information impacted varied by individual, the types of information that were impacted included name, social security number, driver's license number, state identification number, financial account information, medical information, health insurance information, date of birth, passport number, digital/electronic signature, tax identification number, access credentials, and mother's maiden name. The Bank notified and will continue to notify impacted individuals consistent with state and federal requirements and the Bank is offering impacted individuals credit restoration services and 24 months of credit monitoring services at no cost. The Bank issued a press release regarding this event and posted notice of this event on its website. As a result of the 2023 cyberattack, we have incurred and may continue to incur significant costs or experience other material financial impacts, which may not be covered by, or may exceed the coverage limits of, our cyber liability insurance, and such costs and impacts may have a material adverse effect on our business, reputation, financial condition and operating results. These risks may stem from litigation or governmental inquiries litigation to which we currently are or may become subject in connection with this incident, and the extent of remediation and other additional costs that may be incurred by us. We face numerous lawsuits related to the 2023 cyberattack, including three purported class action lawsuits that have been filed in California Superior Court for the Counties of Contra Costa and Butte, seeking unspecified monetary damages, equitable relief, costs and attorneys' fees. The lawsuits allege breach of contract, negligence, violations of various privacy laws and a variety of other legal causes of action. We are currently unable to predict the potential outcome of any of this litigation or whether we may be subject to further private litigation. In addition, the Company has received inquiries from various government authorities related to the 2023 cyberattack, which could result in sanctions, fines or penalties. We are responding to these inquiries and cooperating fully. However, we cannot predict the timing or outcome of any of these inquiries, or whether we may be subject to further governmental inquiries. Given the uncertainties about any further impacts of the incident, including the inherent uncertainties involved in litigation, contractual obligations, government investigations and regulatory enforcement decisions, we face the risk that outcomes from these risks could have a material adverse effect on our reputation, business and/or financial condition. In addition, litigation, government interventions, and negative media reports and any resulting damage to our reputation or loss of confidence in the security of our systems could adversely affect our business. It is possible that we could incur losses associated with these proceedings and inquiries, and the Company will continue to evaluate information as it becomes known and will record an estimate for losses at the time or times when it is both probable that a loss has been incurred and the amount of the loss is reasonably estimable. Ongoing legal and other costs related to these proceedings and inquiries, as well as any potential future proceedings and inquiries, may be substantial, and losses associated with any adverse judgments, settlements, penalties or other resolutions of such proceedings and inquiries could be material to our business, reputation, financial condition and operating results.

Our business involves storing and processing sensitive consumer and business customer data. We depend on internal systems, third party service providers, cloud services and outsourced technology to support these data storage and processing operations. Despite our efforts to ensure the security and integrity of our systems, we may not be able to anticipate, detect or recognize threats to our systems or those of third-party service providers or to implement effective preventive measures against all cybersecurity breaches. Cyberattack techniques change regularly and can originate from a wide variety of sources, including third parties who are or may be involved in organized crime or linked to terrorist organizations or hostile foreign governments, and such third parties may seek to gain access to systems directly or using equipment or security passwords belonging to employees, customers, third-party service providers or other users of our systems. These risks may increase in the future as we continue to increase our mobile, digital and other internet-based product offerings and expands our internal usage of web-based products and applications. A cybersecurity breach or cyberattack could persist for a long time before being detected and could result in theft of sensitive data or disruption of our transaction processing systems. Our inability to use or access these information systems at critical points in time could unfavorably impact the timeliness and efficiency of our business operations. A breach of customer data security such as the breach of customer data in connection with the February 2023 cyberattack discussed above, may negatively impact our business reputation and cause a loss of customers. This event has resulted in increased expenses to contain the event, to notify impacted individuals and provide them with credit monitoring services, and to defend / respond to litigation. Cybersecurity risk management programs are expensive to maintain and will not protect us from all risks associated with maintaining the security of customer data and our proprietary data from external and internal intrusions, disaster recovery and failures in the controls used by our vendors.

We conduct most of our business in California. As a result of this geographic concentration, our financial results may be impacted by economic conditions in California. Deterioration in the economic conditions in California could result in the following consequences, any of which could have a material adverse effect on our business, financial condition, results of operations and cash flows: - problem assets and foreclosures may increase,- demand for our products and services may decline,- low cost or non-interest bearing deposits may continue to decrease, and - collateral for loans made by us, especially real estate, may decline in value, in turn reducing customers' borrowing power, and reducing the value of assets and collateral associated with our existing loans. In view of the concentration of our operations and the collateral securing our loan portfolio in California, we may be particularly susceptible to the adverse effects of any of these consequences, any of which could have a material adverse effect on our business, financial condition, results of operations and cash flows.

Our business, as well as the operations and activities of our clients, could be negatively impacted by climate change. Climate change presents both immediate and long-term risks to us and our clients, and these risks are expected to increase over time. Climate change presents multi-faceted risks, including: operational risk from the physical effects of climate events on the us and our clients' facilities and other assets; credit risk from borrowers with significant exposure to climate risk; transition risks associated with the transition to a less carbon-dependent economy; and reputational risk from stakeholder concerns about our practices related to climate change, our carbon footprint, and our business relationships with clients who operate in carbon-intensive industries. The risks associated with climate change are rapidly changing and evolving in an escalating fashion, making them difficult to assess due to limited data and other uncertainties. We could experience increased expenses resulting from strategic planning, litigation, and technology and market changes, and reputational harm as a result of negative public sentiment, regulatory scrutiny, and reduced investor and stakeholder confidence due to our response to climate change and our climate change strategy, which, in turn, could have a material negative impact on our business, results of operations, and financial condition. In addition, ongoing legislative or regulatory uncertainties and changes regarding climate risk management and practices may result in higher regulatory, compliance, credit, and reputational risks and costs.

The Company's business exposes it to fraud risk from loan and deposit customers, the parties they do business with, as well as from employees, contractors and vendors. The Company relies on financial and other data from new and existing customers which could turn out to be fraudulent when accepting such customers, executing their financial transactions and making and purchasing loans and other financial assets. In times of increased economic stress the Company is at increased risk of fraud losses. The Company believes it has underwriting and operational controls in place to prevent or detect such fraud, but cannot provide assurance that these controls will be effective in detecting fraud or that the Company will not experience fraud losses or incur costs or other damage related to such fraud, at levels that adversely affect financial results or reputation. The Company's lending customers may also experience fraud in their businesses which could adversely affect their ability to repay their loans or make use of services. The Company's and its customers' exposure to fraud may increase the Company's financial risk and reputation risk as it may result in unexpected loan losses that exceed those that have been provided for in the allowance for credit losses. In addition, the Company is subject to risk from the conduct of its employees, including the negative impact that can result from employee misconduct or failure by employees to conduct themselves in accordance with the Company's policies, all of which could damage the Company's reputation and result in loss of customers or other financial loss or expose the Company to increased regulatory or other risk.