Wilson Bank Holding Company (WBHC) Risk Analysis

The Company is from time to time subject to certain litigation in the ordinary course of its business. The Company may also be subject to claims related to its loan servicing programs, particularly those involving servicing of commercial real estate loans, and the fees it charges deposit customers who overdraw their accounts or have insufficient funds in their accounts to cover items when items are presented for payment. These and other claims and legal actions, as well as supervisory and enforcement actions by the Company's regulators, including those with oversight of its loan servicing programs, could involve large monetary claims, capital directives, agreements with federal regulators, cease and desist penalties and orders and significant defense costs. The outcome of any such cases or actions is uncertain. Substantial legal liability or significant regulatory action against the Company could have material adverse financial effects or cause significant reputational harm to the Company, which in turn could seriously harm its business prospects. In accordance with GAAP, for matters where a loss is not probable or the amount of the loss cannot be estimated, no accrual is established. For matters where it is probable the Company will incur a loss and the amount can be reasonably estimated, the Company establishes an accrual for the loss. Once established, the accrual is adjusted periodically to reflect any relevant developments. The actual cost of any outstanding legal proceedings or threatened claims, however, may turn out to be substantially higher than the amount accrued. Further, the Company's insurance may not cover all litigation, other proceedings or claims, or the costs of defense. Future developments could result in an unfavorable outcome for any existing or new lawsuits or investigations in which the Company is, or may become, involved, which may have a material adverse effect on its business and its results of operations.

The market value of real estate can fluctuate significantly in a short period of time, including as a result of market conditions in the geographic area in which the real estate is located. If the value of the real estate serving as collateral for the Company's loan portfolio were to decline materially, a significant part of the Company's loan portfolio could become under-collateralized. If the loans that are collateralized by real estate become troubled during a time when market conditions are declining or have declined, the Company may not be able to realize the value of the security anticipated when it originated the loan, which in turn could have an adverse effect on the Company's allowance and provision for credit losses and its financial condition, results of operations and liquidity.. Most of the Company's foreclosed assets have historically been comprised of real estate properties. The Company carries these properties, if any, at their estimated fair values less estimated selling costs. While the Company believes the carrying values for such assets are reasonable and appropriately reflect current market conditions, there can be no assurance that the values of such assets will not further decline prior to sale or that the amount of proceeds realized upon disposition of foreclosed assets will approximate the carrying value of such assets. If the proceeds from any such dispositions are less than the carrying value of foreclosed assets, the Company will record a loss on the disposition of such assets, which in turn could have an adverse effect on the Company's results of operations.

The Company's financial performance is highly dependent on the business environment in the markets where it operates and in the U.S. as a whole. Unfavorable or uncertain economic and market conditions can be caused by declines in economic growth, business activity, investor or business confidence, consumer sentiment, limitations on the availability or increases in the cost of credit and capital, increases in inflation or interest rates, natural disasters, international trade disputes and retaliatory tariffs, supply-chain disruptions, labor shortages, terrorist attacks, global pandemics, acts of war, or a combination of these or other factors. Inflation rose sharply at the end of 2021 and continued at heightened levels throughout 2023, and, while inflation started to ease at the end of 2023, prices are currently expected to remain elevated for many goods and services in the near term. The Company and its customers experienced an uncertain and volatile economic environment during 2023, and economic growth and activity began to show signs of decline in the second half of 2023 due to issues of national security, inflation, and the pressure of sustained high levels of short-term interest rates. The Company believes that it is possible it and its customers will continue to experience an uneven or declining economic environment in 2024 for many of the same reasons. A worsening of business and economic conditions (including as a result of escalating geopolitical tensions around the world, including hostilities in the Middle East), or persistent inflationary pressures, and actions taken by the Federal Reserve in response thereto, or supply chain disruptions or labor shortages, generally or specifically in the principal markets in which the Company conducts business could have adverse effects, including the following: - a decrease in deposit balances or the demand for loans and other products and services the Company offers;- an increase in the number of borrowers who become delinquent, file for protection under bankruptcy laws or default on their loans or other obligations to the Company, which could lead to higher levels of nonperforming assets, net charge-offs and provisions for credit losses;- a decrease in the value of loans and other assets secured by real estate;- a decrease in net interest income from the Company's lending and deposit gathering activities; and - an increase in competition resulting from financial services companies. There can be no assurance that economic conditions will improve in the near term or that conditions will not worsen. Such conditions could adversely affect the Company's business, financial condition, and results of operations. In addition, over the last several years, the federal government has shut down several times, in some cases for prolonged periods. It is possible that the federal government may shut down again in the future, particularly in light of the evenly divided United States Congress. If a prolonged government shutdown occurs, it could significantly impact business and economic conditions generally or specifically in the Company's markets, which could have a material adverse effect on the Company's results of operations and financial condition.

The Company is dependent upon information technologies, computer systems and networks, including those the Company maintains and those maintained and provided to the Company by third parties, to conduct operations and is reliant on technology to help increase efficiency in its business. These systems could become unavailable or impaired due to a variety of causes, including storms and other natural disasters, terrorist attacks, fires, phishing schemes, social engineering, utility outages, internal or external theft or fraud, design defects, human error, misconduct or complications or failures encountered as existing systems are maintained, replaced or upgraded. For example, the Company's financial, accounting, data processing, or other operating or security systems or infrastructure or those of third parties upon which it relies may fail to operate properly or become compromised, disabled or damaged, which could adversely affect the Company's ability to process transactions or provide services. In the event that backup systems are utilized, they may not process data as quickly as the Company's primary systems and the Company may experience data losses in the course of such recovery. The Company continuously updates the systems on which it relies to support its operations and growth and to remain compliant with all applicable laws, rules and regulations. This updating entails significant costs and creates risks associated with implementing new systems and integrating them with existing ones, including business interruptions that may occur in the course of such implementation challenges. The Company maintains a system of internal controls and security to mitigate the risks of many of these occurrences and maintains insurance coverage for certain risks; however, should an event, including a cyberattack (including a ransomware attack), occur that is not prevented or detected by the Company's internal controls, causes an interruption, degradation or outage in service, causes the Company to pay a ransom fee or is uninsured against or in excess of applicable insurance limits, such occurrence could have an adverse effect on the Company's business and its reputation, which, in turn, could have a material adverse effect on its financial condition, results of operations and liquidity. The Company's operations rely on the secure processing, storage and transmission of confidential, proprietary, personal and other information in its computer systems and networks. Although the Company takes protective measures and endeavors to modify these systems as circumstances warrant, the security of its computer systems, software and networks may be vulnerable to breaches, unauthorized access, misuse, computer viruses or other malicious code and other events that could have a security impact. The Company provides its customers the ability to bank remotely, including over the Internet or through their mobile device. The secure transmission of confidential information is a critical element of remote and mobile banking. The Company's network, and the systems of parties with whom it contracts or on which it relies, as well as those of its customers and regulators, could be vulnerable to unauthorized access, computer viruses, phishing schemes, social engineering, spam attacks, ransomware attacks, human error, natural disasters, power loss and other security breaches. Sources of attacks vary and may include hackers, disgruntled employees or vendors, organized crime, terrorists, foreign governments, corporate espionage and activists. In recent periods, there continues to be a rise in electronic fraudulent activity (including wire fraud), security breaches and cyber-attacks within the financial services industry, especially in the commercial banking sector due to cyber criminals targeting commercial bank accounts or seeking to infiltrate legitimate transactions. The Company believes these types of efforts will continue to increase in frequency and in their level of sophistication. The Company has established policies, processes, and procedures to identify, measure, monitor, mitigate, report, and analyze risks associated with fraud, and continue to invest in systems, resources, and controls to detect and prevent it. There are inherent limitations, however, to the Company's risk management strategies, systems, and controls as they may exist, or develop in the future. The Company may not appropriately anticipate, monitor, or identify these risks. If the Company's risk management framework proves ineffective in connection with any fraudulent activity, it could suffer unexpected losses, it may have to expend resources detecting and correcting the failure in its systems, and it may be subject to potential claims from third parties and government agencies. The Company may also suffer reputational damage. Any of these consequences could adversely affect the Company's business, financial condition, or results of operations. Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, and the use of the Internet and telecommunications technologies to conduct financial transactions. For example, cybersecurity risks may increase in the future as the Company continues to increase its mobile-payment and other Internet-based product offerings and expand its internal use of cloud-based products and applications. Even the most advanced internal control environment may be vulnerable to compromise. Targeted social engineering attacks are becoming more prevalent and sophisticated, and are extremely difficult to prevent. Generative artificial intelligence is further increasing risks in this area, including by making fraud detection more difficult, particularly with detection devices that use voice recognition or authentication. The techniques used by bad actors change frequently, may not be recognized until launched and may not be recognized until well after a breach has occurred. Additionally, the existence of cyber-attacks or security breaches at third parties with access to the Company's data, such as vendors, may not be disclosed to the Company in a timely manner. Consistent with industry trends, the Company remains at risk for attempted electronic fraudulent activity, as well as attempts at security breaches and cybersecurity-related incidents. The Company spends significant capital and other resources to protect against the threat of security breaches and computer viruses, and may be required to spend significant capital and other resources to alleviate problems caused by security breaches or viruses. To the extent that the Company's activities or the activities of its vendors, regulators or customers involve the storage and transmission of confidential information, security breaches (including breaches of security of customer, vendor or regulatory systems and networks) and viruses could expose the Company to claims, litigation and other possible liabilities. Any inability to prevent or promptly detect security breaches or computer viruses could also cause existing customers to lose confidence in the Company's systems and could adversely affect its reputation, results of operations and ability to attract and retain customers and businesses. In addition, a security breach could also subject the Company to additional regulatory scrutiny, expose it to civil litigation and possible financial liability and cause reputational damage. The Company contracts with third-party vendors to provide software or services for many of its major systems, such as data processing, loan servicing and deposit processing system. The failure of these systems, or the termination of a third-party software license or service agreement on which any of these systems is based, could interrupt the Company's operations. Because the Company's information technology and telecommunications systems interface with and depend on third-party systems, the Company could experience service denials if demand for such services exceeds capacity or such third-party systems fail or experience interruptions, including as a result of viruses or other attacks. If sustained or repeated, a system failure or service denial could result in a deterioration of the Company's ability to process new and renewal loans, gather deposits and provide customer service, compromise its ability to operate effectively, damage its reputation, result in a loss of customer business and/or subject it to additional regulatory scrutiny and possible financial liability, any of which could have a material adverse effect on the Company's financial condition, results of operations and liquidity. The Company also faces the risk of operational disruption, failure, termination, or capacity constraints of any of the third parties that facilitate its business activities, including vendors, exchanges, and other financial intermediaries. Such parties could also be the source or cause of an attack on, or breach of, the Company's operational systems, data or infrastructure, and could disclose such attack or breach to the Company in a delayed manner or not at all. In addition, the Company may be at risk of an operational failure with respect to its customers' systems. The Company's risk and exposure to these matters remains heightened because of, among other things, the evolving nature of these threats and the continued uncertain global economic environment. As cybersecurity threats continue to evolve, the Company will likely expend significant additional resources to continue to modify or enhance its protective measures, investigate and remediate any information security vulnerabilities, or respond to any changes to state or federal regulations, policy statements or laws concerning information systems or security. Any failure to maintain adequate security over its information systems, its technology-driven products and services or its customers' personal and transactional information could negatively affect the Company's business and its reputation and result in fines, penalties, or other costs, including litigation expense and/or additional compliance costs, all of which could have a material adverse effect on its financial condition, results of operations and liquidity. Furthermore, the public perception that a cyber-attack on the Company's systems has been successful, whether or not this perception is correct, may damage the Company's reputation with customers and third parties with whom it does business. A successful penetration or circumvention of system security could result in negative consequences for the Company, including loss of customers and business opportunities, disruption to the Company's operations and business, misappropriation or destruction of the Company's confidential information and/or that of its customers, or damage to its customers' and/or third parties' computers or systems, and could result in a violation of applicable privacy laws and other laws, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in the Company's security measures, reputational damage, reimbursement or other compensatory costs, additional compliance costs, and could adversely impact the Company's financial condition, results of operations and liquidity.