United Bankshares (UBSI) Risk Analysis

The CFPB has broad rulemaking authority to administer and carry out the provisions of the Dodd-Frank Act with respect to financial institutions that offer covered financial products and services to consumers. The CFPB has also been directed to write rules identifying practices or acts that are unfair, deceptive or abusive in connection with any transaction with a consumer for a consumer financial product or service, or the offering of a consumer financial product or service. The concept of what may be considered to be an "abusive" practice is relatively new under the law. Moreover, United Bank is supervised and examined by the CFPB for compliance with the CFPB's regulations and policies. The costs and limitations related to this additional regulatory reporting regimen have yet to be fully determined, although they may be material and the limitations and restrictions that will be placed upon United Bank with respect to its consumer product offering and services may produce significant, material effects on United Bank (and United's) profitability.

United's success depends, to a certain extent, upon local and national economic and political conditions, as well as governmental monetary policies. Conditions such as an economic recession, rising unemployment, changes in interest rates, money supply reductions in government spending or the size of the government workforce, concerns relating to the U.S. debt ceiling, the imposition of tariffs and retaliatory responses, changes in trade or immigration policy and other factors beyond its control may adversely affect United's and United Bank's asset quality, deposit levels and loan demand and, therefore, its earnings. Because United has a significant amount of real estate loans, decreases in real estate values could adversely affect the value of property used as collateral. Adverse changes in the economy may also have a negative effect on the ability of our borrowers to make timely repayments of their loans, which could have an adverse impact on our earnings. Consequently, declines in the economy in our market area could have a material adverse effect on our financial condition and results of operations. In addition, economic and inflationary pressure on consumers and uncertainty regarding the economy could result in changes in consumer and business spending, borrowing and savings habits. Such conditions could also have a material adverse effect on the credit quality of our loans and our business, financial condition and results of operations. Concern regarding the ability of Congress to reach agreement on federal budgetary matters (including the debt ceiling), or total or partial governmental shutdowns, also can adversely affect the economy and increase the risk of economic instability or market volatility, which could have adverse consequences on United's business, financial condition, liquidity and results of operations.

We may be subject to physical and transition risks from climate change. Both physical and transition risks from climate change may have negative impacts on the financial condition or creditworthiness of our customers and may negatively affect our business and result of operations. Physical risks refer to the harm arising from acute, climate-related events, such as hurricanes, wildfires, floods, and heatwaves, and chronic shifts in climate, including higher average temperatures, changes in precipitation patterns, sea level rise, and ocean acidification. Specifically, unpredictable and more frequent weather disasters may adversely impact the value of our properties and the value of real property securing the loans in our portfolios. Additionally, if insurance obtained by our borrowers is insufficient to cover any losses sustained to the collateral, or if insurance coverage is otherwise unavailable to our borrowers, the collateral securing our loans may be negatively impacted by climate change, which could impact our financial condition and results of operations. Further, the effects of climate change may negatively impact regional and local economic activity, which could lead to an adverse effect on our customers and impact the communities in which we operate. Climate change also exposes us and our customers to transition risks associated with the transition to a less carbon-dependent economy. Transition risks may result from changes in policies; laws and regulations; technologies; and/or market preferences to address climate change. Such changes could materially, negatively impact our business, results of operations, financial condition and/or our reputation, in addition to having a similar impact on our customers. We have customers who operate in carbon-intensive industries like oil and gas that are exposed to climate risks, such as those risks related to the transition to a less carbon-dependent economy, as well as customers who operate in low-carbon industries that may be subject to risks associated with new technologies. In addition, ongoing legislative or regulatory uncertainties and changes regarding climate risk management and practices, including the shifting sentiment against climate and sustainability initiatives, may subject us to different and potentially conflicting requirements and result in higher regulatory, compliance, credit and reputational risks and costs. We may also be subject to reputational risk and negative public opinion from shareholder concerns about our, actual or perceived, action, or inaction, in response to climate change, our carbon footprint and our business relationships with customers who operate in carbon-intensive industries. Our business, reputation and ability to retract and retain employees may be harmed due to stakeholder views and perceptions of our response to climate change. Item?1B. UNRESOLVED STAFF COMMENTS None   Item?1C. CYBERSECURITY Risk Management and Strategy In the ordinary course of business, United relies on electronic communications and information systems to conduct its operations and to store sensitive data. United employs an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. United employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of its defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date, United and United Bank have not experienced a material compromise, material data loss or any material financial losses related to cybersecurity attacks, United's systems and those of its customers and third-party service providers are under constant threat and it is possible that United could experience a significant event in the future. United recognizes the critical importance of cybersecurity in our business operations. Our cybersecurity processes are fully integrated into our overall risk management system and processes. We believe that effective management of cybersecurity risks is integral to the protection of our assets, reputation, and the trust of our stakeholders. Our proactive approach to cybersecurity involves numerous processes including, regular risk assessments, employee training, incident response planning and testing, and continuous improvement in our cybersecurity practices. To ensure the robustness of our cybersecurity processes, we engage qualified assessors, consultants, and auditors on a periodic   28 basis. These experts evaluate the effectiveness of our cybersecurity controls, identify vulnerabilities, and recommend improvements. We maintain ongoing relationships with reputable third-party firms specializing in cybersecurity to assess our systems, conduct penetration testing, and audit our processes for compliance with industry standards and regulations.United recognizes the inherent cybersecurity risks associated with third-party service providers. To manage these risks, we have implemented processes to oversee and identify material risks from cybersecurity threats linked to our use of third-party service providers. These processes include due diligence assessments, contractual provisions, and ongoing monitoring of our service providers' cybersecurity practices. We continually assess the cybersecurity measures of our service providers to ensure they align with our own security standards and requirements. We do not currently believe that any current cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, United, including its business strategy, results of operations or financial condition. However, risks and exposures related to cybersecurity attacks, including litigation and enforcement risks, are expected to be elevated for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by United and its customers. See Item 1A. Risk Factors for a further discussion of risk related to cybersecurity. Governance The Board of Directors' risk management oversight is provided primarily by the Board Risk Committee. The Risk Committee oversees the Company's Enterprise Risk Management Program and the processes established identify, measure, manage and monitor United's significant financial and other risk exposures. In particular, the Risk Committee is responsible for oversight of information security, including cybersecurity, vendor management, and business continuity planning. The Risk Committee periodically reviews management's strategies and policies for assessing and managing risk, including, but not limited to, the approval of the overall risk appetite and review of the risk management structure. At the management level, the responsibility for oversight of the risk management function lies with the Chief Risk & Information Officer. The Chief Risk & Information Officer ("CIRO") is an executive officer of the Company who reports directly to the Chief Executive Officer. The CIRO provides regular risk management reports to the Risk Committee and the full Board of Directors, as well as at meetings of the independent directors. The management of the Company's cybersecurity team has over a 100 years of industry experience combined, holds numerous certifications, and is regularly trained through continuing professional education. Information security, and specifically cyber security, is formally discussed quarterly at the Governance Steering Committee ("GSC"). The GSC is comprised of executive management, IT internal audit, digital banking leadership, and United's Chief Information Security Officer ("CISO"). The activities of the GSC are reported quarterly to the Board Risk Committee. The CISO is responsible for leading and coordinating our daily cybersecurity efforts, including leading a team of qualified individuals with significant relevant experience and certifications. In addition, United's CISO has served in various roles in Operations, Physical Security, Fraud Investigations, and Information Security for over 24 years with United. The CISO holds a Bachelor of Science in Criminal Justice and has led the Information Security department since 2014. The Information Security and IT Security teams stay up to date on industry best practices, participate in industry threat intelligence feeds, and maintain multiple professional certifications in the areas of privacy and security. The Information Security department is integrated with vendor management, business continuity planning, disaster recovery, and incident response. Additionally, we have a formal cybersecurity program based on the NIST CSF ("National Institute of Standards and Technology Cybersecurity Framework") and the CIS ("Center for Internet Security") Benchmarks that identifies and assesses cybersecurity risks. We deploy a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity. All employees have a responsibility to report suspected or verified incidents to the Information Security department and/or the CISO, and all employees are trained annually regarding the identification and reporting of incidents. The CISO maintains a centralized record all incidents and reports on these quarterly to the GSC and the Board Risk Committee. The CIRO is also immediately notified of any incident that exceeds pre-defined thresholds.   29

United relies heavily on communications and information systems to conduct its business. Any failure, interruption or breach in security of these systems, whether due to severe weather, natural disasters, cyber-attack, acts of war or terrorism, criminal activity or other factors, could result in failures or disruptions in general ledger, deposit, loan, customer relationship management and other systems. While United has disaster recovery and other policies and procedures designed to prevent or limit the effect of the failure, interruption or security breach of its information systems, there can be no assurance that any such failures, interruptions or security breaches will not occur or, if they do occur, that they will be adequately addressed. The occurrence of any failures, interruptions or security breaches of United's information systems could damage its reputation, result in a loss of customer business, subject it to additional regulatory scrutiny or expose it to civil litigation and possible financial liability, any of which could have a material adverse effect on results of operations.