Triumph Financial (TFIN) Risk Analysis

Our primary transportation factoring clients are small-to-mid-sized owner-operators and trucking fleets. Recently implemented federal regulations, and regulations proposed to be implemented in the future, may significantly increase the costs and expenses or reduce the ability to generate revenue associated with owning or operating a trucking fleet. These regulations include rule making proposed by the Federal Motor Carrier Safety Administration of the United States Department of Transportation ("FMCSA") under the Compliance, Safety, Accountability initiative, maximum hours of service limitations imposed by the FMCSA, electronic log requirements, and regulations proposed by the federal Food and Drug Administration ("FDA") requiring increased labeling and monitoring by Carriers of any commodity transported that is regulated by the FDA. Additionally, the transportation industry faces increased insurance coverage requirements and labor law requirements. The costs and burdens of compliance with these requirements will have a disproportionate impact on the small-to-mid-sized trucking businesses that comprise our client base and may force some or all of these businesses out of the market. Such an occurrence could impact the returns we realize on our factoring activity or result in a decrease in the overall amount of our factoring activity and could have an adverse effect on our business, financial condition and results of operations.

We expect the competitive landscape in the transportation technology industry will continue to change in a variety of ways, including: - rapid and significant changes in technology, resulting in new and innovative payment methods and programs, that could place us at a competitive disadvantage and reduce the use of our platform and services;- competitors, including third-party processors and integrated payment providers, customers, governments, and/or other industry participants may develop products and services that compete with or replace our platform and services;- competitors may also elect to focus exclusively on one segment of the transportation industry and develop product offerings uniquely tailored to that segment, which could impact our addressable market and reduce the use of our platform and services;- participants in the financial services, payments, and payment technology industries may merge, create joint ventures, or form other business alliances that may strengthen their existing business services or create new payment services that compete with our platform and services; and - new services and technologies that we develop may be impacted by industry-wide solutions and standards related to migration to chip technology, tokenization, and other safety and security technologies. Certain competitors could use strong or dominant positions in one or more markets to gain a competitive advantage against us, such as by integrating competing platforms or features into products they control, including search engines, web browsers, mobile device operating systems, or social networks; by making acquisitions; or by making access to our platform more difficult. Failure to compete effectively against any of these or other competitive threats could adversely affect our business, financial condition, or results of operations.

We operate in many different businesses in diverse markets and rely on the ability of our employees and systems to process transactions. Operational risk is the risk of loss resulting from our operations, including, but not limited to, the risk of fraud by employees or persons outside the Company, the execution of unauthorized transactions, errors relating to transaction processing and technology, breaches of our internal control systems, compliance failures, business continuation and disaster recovery issues and other external events. Insurance coverage may not be available for such losses, or where available, such losses may exceed insurance limits. This risk of loss also includes the potential legal actions that could arise as a result of an operational deficiency or as a result of noncompliance with applicable regulatory standards, adverse business decisions or their implementation and customer attrition due to potential negative publicity. In the event of a breakdown in the internal control system, improper operation of systems or improper employee actions, we could suffer financial loss, face regulatory action and suffer damage to our reputation.

Our registered or unregistered trademarks or trade names may be challenged, infringed, or determined to be infringing on other marks. Competitors may have adopted or may adopt trade names or trademarks similar to ours, thereby impeding our ability to build brand identity and possibly leading to market confusion. In addition, there could be potential trade name or trademark infringement claims brought by owners of other registered trademarks or trademarks that incorporate variations of our registered or unregistered trademarks or trade names. Additionally, our efforts to enforce or protect our proprietary rights related to trademarks, trade secrets, domain names, copyrights or other intellectual property may be ineffective and could result in substantial costs and diversion of resources. Each of the foregoing could adversely impact our financial condition or results of operations.

We, our customers, our partners, and other third parties, including third-party vendors, and cloud service providers, obtain and process large amounts of sensitive information, including information related to our customers and their transactions. We face risks, including to our reputation as a trusted brand, in the handling and protection of this information, and these risks will increase as our business continues to expand to include new products and technologies. Our operations involve the storage, transmission, and processing of our customers' proprietary information, including contact information, payment information, payment histories, and invoice data. Cyber incidents have been increasing in sophistication and frequency and can include third parties gaining access information using stolen or inferred credentials, computer malware, viruses, spamming, phishing attacks, ransomware, and other deliberate attacks and attempts to gain unauthorized access. In addition, these incidents can originate on our vendors' websites or systems, which can then be leveraged to access our website or systems, hampering our ability to successfully identify and mitigate the attack. As a result, unauthorized access to, security breaches of, or denial-of-service attacks against our network platform could result in the unauthorized access to or use of, and/or loss of, such data, as well as loss of intellectual property, customer information, employee data, trade secrets, or other confidential or proprietary information. We have administrative, technical, and physical security measures in place and proactively employ multiple security measures at different layers of our systems to defend against intrusion and attack and to protect our information. However, because the techniques used to obtain unauthorized access to or to sabotage systems change frequently and generally are not identified until they are launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures that will be sufficient to counter all current and emerging technology threats. In addition, any security breaches that occur may remain undetected for extended periods of time. While we also have and will continue to make significant efforts to address any IT security issues with respect to acquisitions we make, we may still inherit such risks when we integrate these companies. We also have policies and procedures in place to contractually require third parties to which we transfer data to implement and maintain appropriate security measures. Sensitive information is processed and stored by our customers, software and financial institution partners and third-party service providers to whom we outsource certain functions. Threats to third-party systems can originate from human error, fraud, or malice on the part of employees or third parties, or simply from accidental technological failure, and/or computer viruses and other malware that can be distributed and infiltrate systems of third parties on whom we rely. While we select third parties to which we transfer data carefully, we do not control their actions, and these third parties may experience security breaches that result in unauthorized access of data and information stored with them despite these contractual requirements and the security measures these third parties employ. If any security breach involving our systems or the systems of third parties that store or process our data or significant denial-of-service or other cyber-attack occurs or is believed to have occurred, our reputation and brand could be damaged, we could be required to expend significant capital and other resources to alleviate problems caused by such actual or perceived breaches or attacks and remediate our systems. In addition, we could be exposed to a risk of loss, litigation, or regulatory action and possible liability, some or all of which may not be covered by insurance, and our ability to operate our business may be impaired. Unauthorized parties may in the future gain access, to systems or facilities used in our payments business through various means, including gaining unauthorized access into our systems or facilities or those of customers, attempting to fraudulently induce our employees, customers, or others into disclosing user names, passwords, payment information, or other sensitive information, which may in turn be used to access our IT systems or fraudulently transfer funds to bad actors. If new or existing customers believe that our platform does not provide adequate security for the storage of personal or sensitive information or its transmission over the Internet, they may not adopt our platform or may choose not to renew their use of our platform, which could harm our business. Additionally, actual, potential, or anticipated attacks may cause us to incur increasing costs, including costs to deploy additional personnel and protection technologies, train employees, and engage third-party experts and consultants. Our insurance policies covering certain security and privacy damages and claim expenses may not be sufficient to compensate for all potential liability. Although we maintain cyber liability insurance, we cannot be certain that coverage will be adequate for liabilities actually incurred or that insurance will continue to be available to us on economically reasonable terms, or at all. Further, because data security is a critical competitive factor in our industry, we may make statements in our privacy statements and notices and in our marketing materials describing the security of our network platform, including descriptions of certain security measures we employ or security features embedded within our products. Should any of these statements be untrue, become untrue, or be perceived to be untrue, even if through circumstances beyond our reasonable control, we may face claims, including claims of unfair or deceptive trade practices, brought by the U.S. Federal Trade Commission, state, local, or private litigants. Although our terms of service generally allocate to our customers the risk of loss resulting from our customers' errors, omissions, employee fraud, or other fraudulent activity related to their systems, some of our customers may be able to negotiate changes to this position or in some instances we may cover such losses for efficiency or to prevent damage to our reputation, irrespective of fault or our terms of service. Although we maintain insurance to cover losses resulting from our errors and omissions, there can be no assurance that our insurance will cover all losses or our coverage will be sufficient to cover our losses. If we suffer significant losses or reputational harm as a result, our business, operating results, and financial condition could be adversely affected.

We have integrations with various third parties, both within and outside the transportation ecosystem, including third party Broker and Factor management systems. Third-party applications, products, and services are constantly evolving, and we may not be able to maintain or modify our platform to ensure its compatibility with third-party offerings. In addition, some of our competitors or customers on our platform may take actions that disrupt the interoperability of our platform with their own products or services, or they may exert strong business influence on our ability to, and the terms on which we operate and distribute our platform. As our platform evolves, we expect the types and levels of competition we face to increase. Should any of our competitors or customers on our platform modify their technologies, standards, or terms of use in a manner that degrades the functionality or performance of our platform or is otherwise unsatisfactory to us or gives preferential treatment to our competitors' products or services, our platform, business, financial condition, and results of operations could be adversely affected.

The deposits of our bank subsidiary are insured by the FDIC up to legal limits and, accordingly, subject our bank subsidiary to the payment of FDIC deposit insurance assessments. The bank's regular assessments are based on our bank subsidiary's average consolidated total assets minus average tangible equity as well as by risk classification, which includes regulatory capital levels and the level of supervisory concern. In order to maintain a strong funding position and restore the reserve ratios of the DIF, the FDIC has, in the past, increased deposit insurance assessment rates and charged a special assessment to all FDIC-insured financial institutions. Further increases in assessment rates or special assessments may occur in the future, especially if there are significant financial institution failures. Any future special assessments, increases in assessment rates or required prepayments in FDIC insurance premiums could reduce our profitability or limit our ability to pursue certain business opportunities, which could have an adverse effect on our business, financial condition and results of operations.

A significant element of our business strategy involves offering our commercial finance products to small-to-mid-sized businesses. These small-to-mid-sized businesses frequently have smaller market share than their competition, may be more vulnerable to economic downturns, often need substantial additional capital to expand or compete and may experience significant volatility in operating results. Any one or more of these factors may impair the borrower's ability to repay a loan. In addition, the success of a small-to-mid-sized business often depends on the management talents and efforts of one or two persons or a small group of persons and the death, disability or resignation of one or more of these persons could have a material adverse impact on the business and its ability to repay a loan. Economic downturns and other events that negatively impact our market areas could cause us to incur substantial credit losses that could have an adverse effect on our business, financial condition and results of operations.