Risk Factors Dashboard

Once a year, publicly traded companies issue a comprehensive report of their business, called a 10-K. A component mandated in the 10-K is the ‘Risk Factors’ section, where companies disclose any major potential risks that they may face. This dashboard highlights all major changes and additions in new 10K reports, allowing investors to quickly identify new potential risks and opportunities.

Risk Factors - FUNC

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

ITEM 1A. RISK FACTORS

The significant risks and uncertainties related to us, our business and our securities of which we are aware are discussed below. Investors and shareholders should carefully consider these risks and uncertainties before making investment decisions with respect to the Corporation’s securities. Any of these factors could materially and adversely affect our business, financial condition, operating results and prospects and could negatively impact the market price of the Corporation’s securities. Any of these factors could materially and adversely 15​ Table of Contents​affect our business, financial condition, operating results and prospects and could negatively impact the market price of the Corporation’s securities. If any of these risks materialize, the holders of the Corporation’s securities could lose all or part of their investments in the Corporation. Additional risks and uncertainties that we do not yet know of, or that we

15

currently think are immaterial, may also impair our business operations. Investors and shareholders should also consider the other information contained in this annual report, including our financial statements and the related notes, before making investment decisions with respect to the Corporation’s securities.

Risks Relating to First United Corporation and its Affiliates

First United Corporation’s future success depends on the successful growth of its subsidiaries.

The Corporation’s primary business activity for the foreseeable future will be to act as the holding company of the Bank and its other direct and indirect subsidiaries. Therefore, the Corporation’s future profitability will depend on the success and growth of these subsidiaries.

The Bank’s funding sources may prove insufficient to replace deposits and support our future growth.

The Bank relies on customer deposits, advances from the FHLB, lines of credit at other financial institutions, the Federal Reserve Discount Window, and brokered funds to fund our operations. Although the Bank has historically been able to replace maturing deposits and advances if desired, no assurance can be given that the Bank would be able to replace such funds in the future if our financial condition or the financial condition of the FHLB or market conditions were to change. Our financial flexibility could be severely constrained and/or our cost of funds could increase if we are unable to maintain our access to funding or if financing necessary to accommodate future growth is not available at favorable interest rates. If we are required to rely more heavily on more expensive funding sources to support future growth, then our revenues may not increase proportionately to cover our costs. In that case, our profitability would be adversely affected.

We may need to raise capital in the future, and such capital may not be available when needed or at all.

We may need to raise capital in the future to provide it with sufficient capital resources and liquidity to meet our commitments and business needs including complying with new regulatory capital rules, particularly if our asset quality or earnings were to deteriorate significantly. Our ability to raise capital, if needed, will depend on, among other things, conditions in the capital markets at that time, which are outside of our control, and our financial condition. Economic conditions and the loss of confidence in financial institutions may limit access to certain customary sources of capital and increase our cost of raising capital. No assurance can be given that such capital will be available on acceptable terms or at all. Any occurrence that may limit our access to the capital markets, such as a decline in the confidence of depositors, investors or counterparties participating in the capital markets may adversely affect our capital costs and our ability to raise capital and, in turn, our liquidity. Moreover, if we need to raise capital in the future, we may have to do so when many other financial institutions are also seeking to raise capital and would have to compete with those institutions for investors. An inability to raise additional capital on acceptable terms as and when needed could have a materially adverse effect on our business, financial condition and results of operations.

Our inability to generate liquidity in a timely manner may adversely impact our ability to satisfy obligations associated with our financing, our operations and other components of our business.

Timely access to liquidity is essential to our business, and being able to meet obligations as they come due and pay deposits when they are withdrawn is critical to ongoing operations. If we are unable to meet our payment obligations on a daily basis, we may be subject to being placed into receivership, regardless of our capital levels. Our primary sources of liquidity consist of cash and cash balances due from correspondent banks, excess reserves at the Federal Reserve, loan repayments, federal funds sold and other short-term investments, maturities and monetization of investment securities, cash provided by operating activities and new core deposits into the Bank. Our ability to obtain or liquidate these primary sources of liquidity may be impacted by adverse economic conditions resulting from dynamic, complex, and other foreseen and unforeseen inter-related factors and events in the economic environment. If we were to rely on sales proceeds from the sale of investment securities within our portfolio in order to satisfy our obligations, we may be adversely impacted by our ability to transact and settle such sales. If we were to rely on sales proceeds from 16​ Table of Contents​the sale of investment securities within our portfolio in order to satisfy our obligations, we may be adversely impacted by our ability to transact and settle such sales. Sales of investment securities in an unrealized loss position would negatively affect our earnings and regulatory capital. In addition, in order to monetize our held-to-maturity (“HTM”) securities, we

16

expect to rely on pledging those securities for secured funding, and our liquidity may be impaired if we are unable to timely pledge those or any other securities due to lack of available funding, operational impediments or otherwise. Our industry is susceptible to the negative impact of limited access to short-term and/or long-term sources of funds, which could result in a liquidity shortfall and/or impact our liquidity coverage ratio and could have an adverse effect on our operations, financial condition and earnings.

Our inability to access sources of financing at terms that are favorable to us may result in an adverse effect on our business, financial condition, and results of operations.

Our liquidity could be adversely affected by any inability to access the debt or equity capital markets, liquidity or volatility in those capital markets, the decrease in value of eligible collateral or increased collateral requirements (including as a result of credit concerns for short-term borrowings), changes to our relationships with our funding providers based on real or perceived changes in our risk profile, prolonged federal government shutdowns or changes in regulations. Additionally, our liquidity may be negatively impacted by the unwillingness or inability of the Federal Reserve to act as a lender of last resort.

Our ability to raise additional financing depends on conditions in the capital markets, economic conditions and a number of other factors, including investor perceptions regarding the banking industry, market conditions and governmental activities and on our financial condition and performance. Accordingly, we may be unable to raise additional financing if needed or on acceptable terms.

The value of real estate collateral may fluctuate significantly resulting in an under-collateralized loan portfolio.

The market value of real estate, particularly real estate held for investment, can fluctuate significantly in a short period of time as a result of market conditions in the geographic area in which the real estate is located. If the value of the real estate serving as collateral for the Corporation’s loan portfolio were to decline materially, a significant part of the Corporation’s loan portfolio could become under-collateralized. If the loans that are collateralized by real estate become troubled during a time when market conditions are declining or have declined, then, in the event of foreclosure, we may not be able to realize the amount of collateral that we anticipated at the time of originating the loan. This could have a material adverse effect on the Corporation’s provision for credit losses and the Corporation’s operating results and financial condition.

17

The Corporation is subject to lending risk, and the impacts of interest rate changes could adversely impact the Corporation.

There are inherent risks associated with the Corporation’s lending activities. These risks include, among other things, the impact of changes in interest rates and changes in the economic conditions in the markets where the Corporation operates. Increases in interest rates and/or weakening economic conditions could adversely impact the ability of borrowers to repay outstanding loans or the value of the collateral securing these loans.

Our success depends, to a certain extent, upon local, national and global economic and political conditions, as well as governmental monetary policies. Our financial performance generally, and in particular the ability of borrowers to pay interest on and repay principal of outstanding loans and the value of collateral securing the loans, as well as demand for loans and other products and services we offer, is highly dependent upon the business environment in the markets where we operate and the United States as a whole. A favorable business environment is generally characterized by, among other factors, economic growth, efficient capital markets, low inflation, low unemployment, high business and investor confidence, and strong business earnings. Unfavorable or uncertain economic and market conditions can be caused by a decline in economic growth both in the United States and internationally, declines in business activity or investor or business confidence, limitations on the availability of or increases to the cost of credit and capital, increases in inflation or interest rates, high unemployment, natural disasters, trade policies and tariffs, or a combination of these factors. Current economic conditions are being heavily impacted by recent inflationary conditions and higher interest rates, the effects of which may impact our profitability by negatively impacting our fixed costs and expenses. Economic and inflationary pressure on consumers and uncertainty regarding economic improvement could result in changes in consumer and business spending, borrowing, and savings habits. Such conditions could have a material adverse effect on the credit quality of our loans and our business, financial condition, and results of operations. Any such failure in our analytical or forecasting models could have a material adverse effect on our business, financial condition and results of operations.

A substantial portion of the Corporation’s loan portfolio is comprised of residential and commercial real estate loans. The Corporation’s concentration of real estate loans may subject the Corporation to additional risk, as fluctuations in market value of collateral and difficulty monitoring income-producing property serving as a source of repayment and collateral. Any of these or other risks relating to real estate loans could adversely affect the collection by the Corporation of the outstanding loan balances.

Interest rates and other economic conditions will impact our results of operations.

Our net income depends primarily upon our net interest income. Net interest income is the difference between interest income earned on loans, investments and other interest-earning assets and the interest expense incurred on deposits and borrowed funds. The level of net interest income is primarily a function of the average balance of our interest-earning assets, the average balance of our interest-bearing liabilities, and the spread between the yield on such assets and the cost of such liabilities. These factors are influenced by both the pricing and mix of our interest-earning assets and our interest-bearing liabilities which, in turn, are impacted by such external factors as the local economy, competition for loans and deposits, the monetary policy of the Federal Open Market Committee of the FRB, and market interest rates.

Different types of assets and liabilities may react differently, and at different times, to changes in market interest rates. We expect that we will periodically experience gaps in the interest rate sensitivities of our assets and liabilities. That means either our interest-bearing liabilities will be more sensitive to changes in market interest rates than our interest-earning assets, or vice versa. When interest-bearing liabilities mature or re-price more quickly than interest-earning assets, an increase in market rates of interest could reduce our net interest income. Likewise, when interest-earning assets mature or re-price more quickly than interest-bearing liabilities, falling interest rates could reduce our net interest income. We are unable to predict changes in market interest rates, which are affected by many factors beyond our control, including inflation, deflation, recession, unemployment, money supply, domestic and international events and changes in the United States and other financial markets.

18

We also attempt to manage risk from changes in market interest rates, in part, by controlling the mix of interest rate sensitive assets and interest rate sensitive liabilities. However, interest rate risk management techniques are not exact. A rapid increase or decrease in interest rates could adversely affect our results of operations and financial performance.

The majority of our business is concentrated in Maryland and West Virginia, much of which involves real estate lending, so a decline in the real estate and credit markets could materially and adversely impact our financial condition and results of operations.

Most of the Bank’s loans are made to borrowers located in Maryland and West Virginia and many of these loans, including construction and land development loans, are secured by real estate. Accordingly, a decline in local economic conditions would likely have an adverse impact on our financial condition and results of operations, and the impact on us would likely be greater than the impact felt by larger financial institutions whose loan portfolios are geographically diverse. We cannot guarantee that any risk management practices we implement to address our geographic and loan concentrations will be effective to prevent losses relating to our loan portfolio.

The Bank’s concentrations of commercial real estate loans could subject it to increased regulatory scrutiny and directives, which could force us to preserve or raise capital and/or limit future commercial lending activities.

The federal banking regulators believe that institutions that have particularly high concentrations of commercial real estate loans within their lending portfolios face a heightened risk of financial difficulties in the event of adverse changes in the economy and commercial real estate markets. Accordingly, through published guidance, these regulators have directed institutions whose concentrations exceed certain percentages of capital to implement heightened risk management practices appropriate to their concentration risk. The guidance provides that banking regulators may require such institutions to reduce their concentrations and/or maintain higher capital ratios than institutions with lower concentrations in commercial real estate. At December 31, 2025, our commercial real estate concentrations were below the heightened risk management thresholds set forth in this guidance.

The Bank may experience loan losses in excess of its allowance for credit losses, which would reduce our earnings.

The risk of credit losses on loans varies with, among other things, general economic conditions, the type of loans being made, the creditworthiness of the borrowers over the term of the loans and, in the case of collateralized loans, the value and marketability of the collateral for the loans. Management of the Bank maintains an ACL based upon, among other things, historical experience, an evaluation of economic conditions and regular reviews of delinquencies and loan portfolio quality. Based upon such factors, management makes various assumptions and judgments about the ultimate collectability of the loan portfolio and provides the ACL based upon a percentage of the outstanding balances and for specific loans when their ultimate collectability is considered questionable. If management’s assumptions and judgments prove to be incorrect and the ACL is inadequate to absorb future losses, or if the bank regulatory authorities require us to increase the ACL as a part of its examination process, our earnings and capital could be significantly and adversely affected. If management’s assumptions and judgments 18​ Table of Contents​prove to be incorrect and the ACL is inadequate to absorb future losses, or if the bank regulatory authorities require us to increase the ACL as a part of its examination process, our earnings and capital could be significantly and adversely affected. Although management continually monitors our loan portfolio and makes determinations with respect to the ACL, future adjustments may be necessary if economic conditions differ substantially from the assumptions used or adverse developments arise with respect to our non-performing or performing loans. Material additions to the ACL could result in a material decrease in our net income and capital; and could have a material adverse effect on our financial condition.

We depend on the accuracy and completeness of information about customers and counterparties, and inaccurate, incomplete or misleading information provided to us by these persons could cause us to suffer losses.

In deciding whether to extend credit or enter into other transactions, we rely on information furnished by or on behalf of customers and counterparties, including financial statements, credit reports and other financial information. We also rely on representations of those customers, counterparties or other third parties, such as independent auditors, as to the accuracy and completeness of that information. Reliance on inaccurate or misleading financial statements, credit

19

reports or other financial information could have a material adverse impact on our business, financial condition and results of operations.

Our accounting estimates and risk management processes rely on analytical and forecasting models, the inadequacy of which could have a material adverse effect on our financial condition and/or results of operations.

The processes we use to estimate our ACL and to measure the fair value of financial instruments, as well as the processes used to estimate the effects of changing interest rates and other market measures on our financial condition and results of operations, depends upon the use of analytical and forecasting models. These models reflect assumptions that may not be accurate, particularly in times of market stress or other unforeseen circumstances. Even if these assumptions are adequate, the models may prove to be inadequate or inaccurate because of other flaws in their design or their implementation, including flaws caused by failures in controls, data management, human error or from the reliance on technology. If the models we use for interest rate risk and asset-liability management are inadequate, we may incur increased or unexpected losses upon changes in market interest rates or other market measures. If the models we use for estimating our expected credit losses are inadequate, the ACL may not be sufficient to support future charge-offs. If the models we use to measure the fair value of financial instruments are inadequate, the fair value of such financial instruments may fluctuate unexpectedly or may not accurately reflect what we could realize upon sale or settlement of such financial instruments. Any such failure in our analytical or forecasting models could have a material adverse effect on our business, financial condition and results of operations.

The Bank’s lending activities subject the Bank to the risk of environmental liabilities.

A significant portion of the Bank’s loan portfolio is secured by real property. During the ordinary course of business, the Bank may foreclose on and take title to properties securing certain loans. In doing so, there is a risk that hazardous or toxic substances could be found on these properties. If hazardous or toxic substances are found, the Bank may be liable for remediation costs, as well as for personal injury and property damage. Environmental laws may require the Bank to incur substantial expenses and may materially reduce the affected property’s value or limit the Bank’s ability to use or sell the affected property. In addition, future laws or more stringent interpretations or enforcement policies with respect to existing laws may increase the Bank’s exposure to environmental liability. Although the Bank has policies and procedures to perform an environmental review before initiating any foreclosure action on real property, these reviews may not be sufficient to detect all potential environmental hazards. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on our financial condition and results of operations.

Our investment securities are subject to market risk and credit risk that may have an adverse impact on our financial condition and results of operation.

At December 31, 2025, investment securities in our investment portfolio having a cost basis of $123.9 million and a market value of $107.1 million were classified as available-for-sale pursuant to FASB Accounting Standards Codification (“ASC”) Topic 320, Investments – Debt and Equity Securities, relating to accounting for investments. Topic 320 requires that unrealized gains and losses in the estimated value of the available-for-sale portfolio be “marked to market” and reflected as a separate item in shareholders’ equity (net of tax) as accumulated other comprehensive loss. There can be no assurance that future market performance of our investment portfolio will enable us to realize income from sales of securities. Shareholders’ equity will continue to reflect the unrealized gains and losses (net of tax) of these investments. Moreover, there can be no assurance that the market value of our investment portfolio will not decline, causing a corresponding decline in shareholders’ equity.

Several factors could affect the market value of our investment portfolio. These include, but are not limited to, changes in interest rates or expectations of changes, the degree of volatility in the securities markets, inflation rates or expectations of inflation and the slope of the interest rate yield curve (the yield curve refers to the differences between shorter-term and longer-term interest rates; a positively sloped yield curve means shorter-term rates are lower than longer-term rates). Also, the passage of time will affect the market values of our investment securities, in that the closer they are

20

to maturing, the closer the market price should be to par value. These and other factors may impact specific categories of the portfolio differently, and management cannot predict the effect these factors may have on any specific category.

Our investment securities portfolio as a whole is exposed to credit risk associated with rating agency downgrades and defaults of the issuers of those securities. We measure expected credit losses on our investment portfolio through our current expected credit loss (“CECL”) estimate. We measure expected credit losses on our investment portfolio through our CECL estimate. Increases to the provision for credit losses would have a negative impact on our results of operations and regulatory capital ratios. Additionally, an insufficient CECL provision may result in additional losses that would have an adverse impact on our results of operations. The investment portfolio’s performance, including the existence of unrealized and unrecognized losses in the portfolio, also may create reputational risk for us, particularly in conjunction with the conditions of the banking industry generally, that could result in deposit outflows or reduced access to funding, or negatively impact our ability to attract and retain prospective customers.

Impairment of goodwill and other intangible assets or deferred tax assets could require charges to earnings, which could result in a negative impact on our results of operations.

Under current accounting standards, goodwill and other intangible assets are subject to impairment tests on at least an annual basis or more frequently if a triggering event occurs or circumstances change that reduce the fair value of a reporting unit below its carrying amount. A decline in the price of the shares of Common Stock or occurrence of a triggering event following any of our quarterly earnings releases and prior to the filing of the periodic report for that period could, under certain circumstances, cause us to perform a goodwill impairment test and result in an impairment charge being recorded for that period which was not reflected in such earnings release. In the event that we conclude that all or a portion of our goodwill and other intangible assets may be impaired, a non-cash charge for the amount of such impairment would be recorded to earnings. Such a charge would have no impact on tangible capital. At December 31, 2025, we had recorded goodwill and other intangible assets of $11.4 million, representing approximately 5.6% of shareholders’ equity. At December 31, 2024, we had recorded goodwill and other intangible assets of $11.8 million, representing approximately 6.6% of shareholders’ equity.

At December 31, 2025, our net deferred tax assets were valued at $8.7 million. Included in that total is $2.6 million of state net operating loss carryforwards (“NOLs”) associated with separate company tax filings of the Corporation, which we do not expect to use and, thus, we have established a $2.6 million valuation allowance. A deferred tax asset is reduced by a valuation allowance if, based on the weight of the evidence available, both negative and positive, including the recent trend of quarterly earnings, the Corporation determines that it is more likely than not that some portion or all of the total deferred tax asset will not be realized. Moreover, our ability to utilize our net operating loss carryforwards to offset future taxable income may be significantly limited if we experience an “ownership change,” as determined under Section 382 of the Internal Revenue Code of 1986, as amended (“the Code”). If an ownership change were to occur, the limitations imposed by Section 382 of the Code could result in a portion of our net operating loss carryforwards expiring unused, thereby impairing their value. Section 382’s provisions are complex, and we cannot predict any circumstances surrounding the future ownership of the Common Stock. Accordingly, we cannot provide any assurance that we will not experience an ownership change in the future.

The impact of each of these impairment matters could have a material adverse effect on our business, results of operations, and financial condition.

Adverse developments affecting the financial services industry, such as actual events or concerns involving liquidity, defaults, or non-performance by financial institutions or transactional counterparties, could adversely affect our financial condition and results of operations.

Financial services institutions are interrelated as a result of trading, clearing, counterparty or other relationships, and we routinely execute transactions with counterparties in the financial industry. Actual events involving limited liquidity, defaults, non-performance or other adverse developments that affect financial institutions, transactional counterparties or other companies in the financial services industry or the financial services industry generally, or concerns or rumors about any events of these kinds or other similar risks, have in the past and may in the future lead to market-wide liquidity problems.

21

In addition to the risk that occurrence of such events could adversely impact our ability to engage in routine funding transactions, they could also lead to losses or defaults by us or by other institutions, either of which could have a material adverse effect on our business, results of operations and financial condition.

Increases in FDIC insurance premiums may have a material adverse effect on our results of operations.

In general, we are unable to control the amount of premiums that are required to be paid for FDIC insurance. In October 2022, the FDIC finalized a rule to increase the assessment rate by two basis points beginning in the first quarter of 2023. The increase in the assessment rate for banks is intended to increase the Deposit Insurance Fund (“DIF)” reserve ratio to 1.35%. In early March 2023, the FDIC was appointed receiver for two banks, in each case due primarily to liquidity concerns at those institutions. Promptly following these events, the federal banking regulators announced that the FDIC will use funds from the DIF to ensure that all depositors of the two failed institutions are made whole, at no cost to taxpayers. In November 2023, the FDIC issued a final rule to implement a special assessment to recover losses to the DIF as a result of bank failures that year and the FDIC’s use of the systemic risk exception to cover certain deposits that were otherwise uninsured. In June 2024, due to the increased estimate of losses, the FDIC announced that it projects that the special assessment will be collected for an additional two quarters beyond the initial eight-quarter collection period at a lower rate. The special estimate was based on estimated uninsured deposits at December 31, 2022 (excluding the first $5.0 billion). The Bank was exempt from this special assessment as its total uninsured deposits were below $5.0 billion; however, future increases or required repayments in FDIC insurance premiums may materially adversely affect our results of operations.

We operate in a competitive environment, and our inability to effectively compete could adversely and materially impact our financial condition and results of operations.

We operate in a competitive environment, competing for loans, deposits, and customers with commercial banks, savings associations and other financial entities. Competition for deposits comes primarily from other commercial banks, savings associations, credit unions, money market and mutual funds and other investment alternatives. Competition for loans comes primarily from other commercial banks, savings associations, mortgage banking firms, credit unions and other financial intermediaries. Competition for other products, such as securities products, comes from other banks, securities and brokerage companies, and other non-bank financial service providers in our market area. Many of these competitors are much larger in terms of total assets and capitalization, have greater access to capital markets, and/or offer a broader range of financial services than those that we offer. In addition, banks with a larger capitalization and financial intermediaries not subject to bank regulatory restrictions have larger lending limits and are thereby able to serve the needs of larger customers.

In addition, changes to the banking laws over the last several years have facilitated interstate branching, merger and expanded activities by banks and holding companies. For example, the federal Gramm-Leach-Bliley Act (the “GLB Act”) revised the BHC Act and repealed the affiliation provisions of the Glass-Steagall Act of 1933, which, taken together, limited the securities and other non-banking activities of any company that controls an FDIC insured financial institution. As a result, the ability of financial institutions to branch across state lines and the ability of these institutions to engage in previously-prohibited activities are now accepted elements of competition in the banking industry. These changes may bring us into competition with more and a wider array of institutions, which may reduce our ability to attract or retain customers. Management cannot predict the extent to which we will face such additional competition or the degree to which such competition will impact our financial conditions or results of operations.

The banking industry is heavily regulated; significant regulatory changes could adversely affect our operations.

Our operations will be impacted by current and future legislation and by the policies established from time to time by various federal and state regulatory authorities. The Corporation is subject to supervision by the FRB. The Bank is subject to supervision and periodic examination by the Maryland Office of Financial Regulation, the West Virginia Division of Banking, and the FDIC. Banking regulations, designed primarily for the safety of depositors, may limit a financial institution’s growth and the return to its investors by restricting such activities as the payment of dividends,

22

mergers with or acquisitions by other institutions, investments, loans and interest rates, interest rates paid on deposits, expansion of branch offices, and the offering of securities or trust services. The Corporation and the Bank are also subject to capitalization guidelines established by federal law and could be subject to enforcement actions to the extent that either is found by regulatory examiners to be undercapitalized. It is not possible to predict what changes, if any, will be made to existing federal and state legislation and regulations or the effect that such changes may have on our future business and earnings prospects. Management also cannot predict the nature or the extent of the effect on our business and earnings of future fiscal or monetary policies, economic controls, or new federal or state legislation. Further, the cost of compliance with regulatory requirements may adversely affect our ability to operate profitably.

The Consumer Financial Protection Bureau may continue to reshape the consumer financial laws through rulemaking and enforcement of the prohibitions against unfair, deceptive and abusive business practices. Compliance with any such change may impact our business operations.

The Consumer Financial Protection Bureau (“CFPB”) has broad rulemaking authority to administer and carry out the provisions of the Dodd-Frank Act with respect to financial institutions that offer covered financial products and services to consumers. The CFPB has also been directed to adopt rules identifying practices or acts that are unfair, deceptive or abusive in connection with any transaction with a consumer for a consumer financial product or service, or the offering of a consumer financial product or service. The concept of what may be considered to be an “abusive” practice is fluid and can change based on politically-appointed leadership at the CFPB. We have been required to dedicate significant personnel resources to address the compliance burdens imposed by the CFBP’s adoption of various rules, and the adoption of additional rules in the future would likely require us to dedicate even more resources.

Compliance with ever-evolving federal and state laws relating to the handling of information about individuals involves significant expenditure and resources, and any failure by us or our vendors to comply may result in significant liability, negative publicity, and/or an erosion of trust, which could materially adversely affect our business, results of operations, and financial condition.

We are subject to a number of U.S. federal, state, local and foreign laws and regulations relating to consumer privacy and data protection. Under privacy protection provisions of the GLBA and its implementing regulations and guidance, we are limited in our ability to disclose certain non-public information about consumers to nonaffiliated third parties. The GLBA regulates, among other things, the use of certain information about individuals (“non-public personal information”) in the context of the provision of financial services, including by banks and other financial institutions. The GLBA includes both a “Privacy Rule”, which imposes obligations on financial institutions relating to the use or disclosure of non-public personal information, and a “Safeguards Rule”, which imposes obligations on financial institutions and, indirectly, their service providers to implement and maintain physical, administrative and technological measures to protect the security of non-public personal financial information. The GLBA includes both a “Privacy Rule”, which imposes obligations on financial institutions relating to the use or disclosure of non-public personal information, and a “Safeguards Rule”, which imposes obligations on financial institutions and, 22​ Table of Contents​indirectly, their service providers to implement and maintain physical, administrative and technological measures to protect the security of non-public personal financial information. Any failure to comply with the GLBA could result in substantial financial penalties and significant reputational harm. Multiple states have recently enacted, or are expected to enact, stringent privacy laws, not all of which exempt financial institutions categorically. Many other states are currently reviewing or proposing the need for greater regulation of the collection, sharing, use and other processing of information related to individuals for marketing purposes or otherwise, and there remains increased interest at the federal level as well. Further, to comply with the varying state laws around data breaches, we must maintain adequate security measures, which require significant investments in resources and ongoing attention.

Additionally, laws, regulations, and standards covering marketing, advertising, and other activities conducted by telephone, email, mobile devices, and the internet are or may become applicable to our business, such as the Telephone Consumer Protection Act, the CAN-SPAM Act, and similar state consumer protection and communication privacy laws. We occasionally make telephone calls and/or send SMS text messages to customers. The actual or perceived improper calling of customer phones and/or sending of text messages may subject us to potential risks, including liabilities or claims relating to consumer protection laws such as the Telephone Consumer Protection Act. Numerous class-action suits under federal and state laws have been filed in recent years against companies who conduct telemarketing and/or SMS texting programs, with many resulting in multi-million-dollar settlements to the plaintiffs. Any future such litigation against us could be costly and time-consuming to defend. In particular, the Telephone Consumer Protection Act imposes significant

23

restrictions on the ability to make telephone calls or send text messages to mobile telephone numbers without the prior consent of the person being contacted. Federal or state regulatory authorities or private litigants may claim that the notices and disclosures we provide, form of consents we obtain, or our outreach practices are not adequate or violate applicable law. This may in the future result in civil claims against us. Claims that we have violated the Telephone Consumer Protection Act could be costly to litigate, whether or not they have merit, and could expose us to substantial statutory damages or costly settlements.

We also send marketing messages via email and are subject to the CAN-SPAM Act. The CAN-SPAM Act imposes certain obligations regarding the content of emails and providing opt-outs (with the corresponding requirement to honor such opt-outs promptly). While we strive to ensure that all of our marketing communications comply with the requirements set forth in the CAN-SPAM Act, any violations could result in the FTC seeking civil penalties against us.

Moreover, we are considered a “user” of consumer reports provided by consumer reporting agencies under the Fair Credit Reporting Act (“FCRA”), as amended by the Fair and Accurate Credit Transactions Act. FCRA regulates and protects consumer information collected by consumer reporting agencies and imposes specific obligations on “users” of consumer reports. Such obligations may include restricting the sharing of information contained in a consumer report, notifying consumers when such reports are used to make an adverse decision, and, in the context of completing employee background checks, providing a notice containing certain disclosures to the consumer and obtaining their consent.

Bank regulators and other regulations, including the Basel III Capital Rules, may require higher capital levels, impacting our ability to pay dividends or repurchase our stock.

The capital standards to which we are subject, including the standards created by the Basel III Capital Rules, may materially limit our ability to use our capital resources and/or could require us to raise additional capital by issuing additional shares of Common Stock or other equity securities. In addition, we could experience increases in deposits and assets as a result of other depository institutions’ difficulties or failures, which would increase the capital that we are required to maintain to support such growth. The issuance of additional equity securities to fund our capital needs could dilute existing stockholders.

A material weakness in our disclosure or internal controls could have an adverse effect on us.

The Corporation is required by the Sarbanes-Oxley Act of 2002 to establish and maintain disclosure controls and procedures and internal control over financial reporting. These control systems are intended to provide reasonable assurance that material information relating to the Corporation is made known to our management and reported as required by the Exchange Act, to provide reasonable assurance regarding the reliability and preparation of our financial statements, and to provide reasonable assurance that fraud and other unauthorized uses of our assets are detected and prevented. These control systems are intended to provide reasonable assurance that material information relating to the Corporation is made known to our management and reported as required 23​ Table of Contents​by the Exchange Act, to provide reasonable assurance regarding the reliability and preparation of our financial statements, and to provide reasonable assurance that fraud and other unauthorized uses of our assets are detected and prevented. We may not be able to maintain controls and procedures that are effective at the reasonable assurance level. If that were to happen, our ability to provide timely and accurate information about the Corporation, including financial information, to investors could be compromised and our results of operations could be harmed. Moreover, if the Corporation or its independent registered public accounting firm were to identify a material weakness in any of those control systems, our reputation could be harmed and investors could lose confidence in us, which could cause the market price of the Corporation’s stock to decline and/or limit the trading market for the shares of the Common Stock.

We may not be able to keep pace with developments in technology.

We use various technologies in conducting our businesses, including telecommunication, data processing, computers, automation, internet-based banking, and debit cards. The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services. Our future success depends, in part, on our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology driven products and services or be successful in marketing these products and services to our customers.

24

In addition, our implementation of certain new technologies, such as those related to artificial intelligence, automation and algorithms, in our business processes may have unintended consequences due to their limitations or our failure to use them effectively. In addition, cloud technologies are also critical to the operation of our systems, and our reliance on cloud technologies is growing. Failure to successfully keep pace with technological change affecting the financial services industry could have a material adverse effect on our business, financial condition and results of operations.

Our operational or communications systems or infrastructure may fail or may be the subject of a breach or cyber-attack that, if successful, could adversely affect our business or disrupt business continuity.

Our business depends heavily on the use of computer systems, the Internet and other means of electronic communication and recordkeeping to process, record, and monitor client transactions and to communicate with clients and other institutions on a continuous basis. As client, industry, public, and regulatory expectations regarding operational and information security have increased, our operational systems and infrastructure continue to be safeguarded and monitored for potential failures, disruptions, and breakdowns, whether as a result of events beyond our control or otherwise.

Our business, financial, accounting, data processing, or other operating systems and facilities may stop operating properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control. For example, there could be sudden increases in client transaction volume; electrical or telecommunications outages; natural disasters such as earthquakes, tornadoes, floods, and hurricanes; disease pandemics; events arising from local or larger scale political or social matters, including terrorist acts; occurrences of employee error, fraud, theft, or malfeasance; disruptions caused by technology implementation, including hardware deployment and software updates; and, as described below, cyber-attacks.

Although we have business continuity plans and other safeguards in place, our operations and communications may be adversely affected by significant and widespread disruption to our systems and infrastructure that support our businesses, clients, and teammates. While we continue to evolve and modify our business continuity plans, there can be no assurance in an escalating threat environment that they will be effective in avoiding disruption and business impacts. Our insurance may not be adequate to compensate us for all resulting losses, and the cost to obtain adequate coverage may increase for us or the industry.

Security risks for financial institutions such as ours have dramatically increased in recent years in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication, resources, and activities of hackers, terrorists, activists, industrial spies, insider bad actors, organized crime, and other external parties, including nation state actors. In addition, to access our products and services, clients may use devices and/or software that are beyond our control environment, which may provide additional avenues for attackers to gain access to confidential information. In addition, to access our 24​ Table of Contents​products and services, clients may use devices and/or software that are beyond our control environment, which may provide additional avenues for attackers to gain access to confidential information. Although we have information security procedures and controls in place, our technologies, systems, networks, and clients' devices and software may become the target of cyber-attacks, information security breaches, business email compromise, or information theft that could result in the unauthorized release, gathering, monitoring, misuse, loss, change, or destruction of our or our clients' or teammates' confidential, proprietary, or other information (including personal identifying information of individuals), or otherwise disrupt our or our clients' or our third parties' business operations. U.S. financial institutions and financial service companies have reported breaches in the security of their websites or other systems, including attempts to shut down access to their networks and/or systems in an attempt to extract compensation from them to regain control. Financial institutions, including the Bank, have experienced distributed denial-of-service attacks, a sophisticated and targeted attack intended to disable or degrade internet service or to sabotage systems.

We and others in our industry are regularly the subject of attempts by attackers to gain unauthorized access to our networks, systems, and data, or to obtain, change, or destroy confidential data (including personal identifying information of individuals) through a variety of means, including computer viruses, malware, business email compromise, and phishing. These attacks may result in unauthorized individuals obtaining access to our confidential information or that of our clients or teammates, or otherwise accessing, compromising, damaging, or disrupting our systems or infrastructure.

25

We are continuously developing and enhancing our controls, processes, and practices designed to protect our systems, computers, software, data, and networks from attack, damage, or unauthorized access. This continued development and enhancement will require us to expend additional resources, including resources to investigate and remediate any information security vulnerabilities that may be detected. Despite our ongoing investments in security resources, talent, and business practices, we are unable to assure that any security measures will be effective.

If our systems and infrastructure were to be breached, compromised, damaged, or disrupted, or if we were to experience a loss of our confidential information or that of our clients or teammates, we could be subject to serious negative consequences, including disruption of our operations, damage to our reputation, a loss of trust in us on the part of our clients, vendors or other counterparties, client or teammate attrition, reimbursement or other costs, increased compliance costs, significant litigation exposure and legal liability, or regulatory fines, penalties or intervention. Any of these could materially and adversely affect our results of operations, our financial condition, and/or our share price.

A disruption, breach, or failure in the operational systems or infrastructure of our third-party vendors or other service providers, including as a result of cyber-attacks, could adversely affect our business.

Third parties perform significant operational services on our behalf. These third parties with whom we do business or that facilitate our business activities, including exchanges, clearing houses, central clearing counterparties, financial intermediaries, or vendors that provide services or security solutions for our operations, could also be sources of operational and information security risk to us, including from breakdowns or failures of their own systems or capacity constraints. In particular, operating our business requires us to provide access to client, teammate, and other sensitive Company information to our contractors, consultants, and other third parties and authorized entities. Controls and oversight mechanisms are in place that are designed to limit access to this information and protect it from unauthorized disclosure, theft, and disruption. However, control systems and policies pertaining to system access are subject to errors in design, oversight failure, software failure, human error, intentional subversion, or other compromise resulting in theft, error, loss, or inappropriate use of information or systems to commit fraud, cause embarrassment to us or our executives or to gain competitive advantage. In addition, regulators expect financial institutions to be responsible for all aspects of their performance, including aspects which they delegate to third parties. If a disruption, breach, or failure in the system or infrastructure of any third party with whom we do business occurred, then our business may be materially and adversely affected in a manner similar to if our own systems or infrastructure had been compromised. As has been the case in other major system events in the U.S., our systems and infrastructure may also be attacked, compromised, or damaged as a result of, or as the intended target of, any disruption, breach, or failure in the systems or infrastructure of any third party with whom we do business.

We may be subject to claims and the costs of defensive actions, and such claims and costs could materially and adversely impact our financial condition and results of operations.

Our customers may sue us for losses due to alleged breaches of fiduciary duties, errors and omissions of employees, officers and agents, incomplete documentation, our failure to comply with applicable laws and regulations, or many other reasons. Also, our employees may knowingly or unknowingly violate laws and regulations. Management may not be aware of any violations until after their occurrence. This lack of knowledge may not insulate us from liability. Claims and legal actions will result in legal expenses and could subject us to liabilities that may reduce our profitability and hurt our financial condition.

The loss of key personnel could disrupt our operations and result in reduced earnings.

Our growth and profitability will depend upon our ability to attract and retain skilled managerial, marketing and technical personnel. Competition for qualified personnel in the financial services industry is intense, and there can be no assurance that we will be successful in attracting and retaining such personnel. Our current executive officers provide valuable services based on their many years of experience and in-depth knowledge of the banking industry and the market areas we serve. Due to the intense competition for financial professionals, these key personnel would be difficult to

26

replace, and an unexpected loss of their services could result in a disruption to the continuity of operations and a possible reduction in earnings.

We are a community banking organization and our ability to maintain our reputation is critical to the success of our business.

We are a community banking organization, and our reputation is one of the most valuable components of our business. A key component of our business strategy is to rely on our reputation for customer service and knowledge of local markets to expand our presence by capturing new business opportunities from existing and prospective customers in our current market and contiguous areas. As such, we strive to conduct our business in a manner that enhances our reputation. This is done, in part, by recruiting, hiring and retaining employees who share our core values of being an integral part of the communities we serve, delivering superior service to our customers and caring about our customers and associates. If our reputation is negatively affected by the actions of our employees, by our inability to conduct our operations in a manner that is appealing to current or prospective customers, or otherwise, our business and, therefore, our operating results may be materially adversely affected.

We could be adversely affected by risks associated with future acquisitions and expansions.

Although our core growth strategy is focused around organic growth, we may from time to time consider acquisition and expansion opportunities involving a bank or other entity operating in the financial services industry. We cannot predict if or when we will engage in such a strategic transaction, or the nature or terms of any such transaction. To the extent that we grow through an acquisition, we cannot assure investors that we will be able to adequately and profitably manage that growth or that an acquired business will be integrated into our existing businesses as efficiently or as timely as we may anticipate. Acquiring another business would generally involve risks commonly associated with acquisitions, including:

increased capital needs;
increased and new regulatory and compliance requirements;
implementation or remediation of controls, procedures and policies with respect to the acquired business;
diversion of management time and focus from operation of our then-existing business to acquisition-integration challenges;
coordination of product, sales, marketing and program and systems management functions;
transition of the acquired business’s users and customers onto our systems;
retention of employees from the acquired business;
integration of employees from the acquired business into our organization;
integration of the acquired business’s accounting, information management, human resources and other administrative systems and operations with ours;
potential liability for activities of the acquired business prior to the acquisition, including violations of law, commercial disputes and tax and other known and unknown liabilities;
potential increased litigation or other claims in connection with the acquired business, including claims brought by regulators, terminated employees, customers, former stockholders, vendors, or other third parties; and
potential goodwill impairment.

Our failure to execute our acquisition strategy could adversely affect our business, results of operations, financial condition and future prospects risks of unknown or contingent liabilities.

New lines of business, products or services may subject us to additional risks.

From time to time, we implement new lines of business or offer new products and services within existing lines of business. There are substantial risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and/or new products and services we

27

invest significant time and resources. Initial timetables for the introduction and development of new lines of business and/or new products or services may not be achieved, and price and profitability targets may not prove feasible. External factors, such as compliance with regulations, competitive alternatives, and shifting market preferences, may also impact the successful implementation of a new line of business or a new product or service. Furthermore, any new line of business, new product or service and/or new technology could have a significant impact on the effectiveness of our system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business, new products or services and/or new technologies could have a material adverse effect on our business, financial condition and results of operations.

Increasing scrutiny and evolving expectations from customers, regulators, investors, and other stakeholders with respect to our sustainability practices may impose additional costs on us or expose us to new or additional risks.

Many companies are facing increasing scrutiny from customers, regulators, investors, and other stakeholders related to their sustainability practices and disclosure. Investor advocacy groups, investment funds and influential investors are also increasingly focused on these practices, especially as they relate to the environment, health and safety, diversity, labor conditions and human rights. Increased sustainability-related compliance costs could result in increases to our overall operational costs. Failure to adapt to or comply with regulatory requirements or investor or stakeholder expectations and standards could negatively impact our reputation, ability to do business with certain partners, and our stock price. New government regulations could also result in new or more stringent forms of sustainability oversight and expanding mandatory and voluntary reporting, diligence, and disclosure. Due to divergent stakeholder views on these matters, we are at increased risk that any action, or lack thereof, concerning these matters will be perceived negatively by some stakeholders, which could negatively affect our business and reputation.

Risks Relating to First United Corporation’s Securities

The shares of Common Stock are not insured.

The shares of the Common Stock are not deposits and are not insured against loss by the FDIC or any other governmental or private agency.

The shares of Common Stock are not heavily traded.

Shares of the Common Stock are listed on the NASDAQ Global Select Market but are not heavily traded. Securities that are not heavily traded can be more volatile than stock trading in an active public market. Factors such as our financial results, the introduction of new products and services by us or our competitors, changes in the financial estimates by securities analysts, market conditions within the banking industry, the general state of the securities market, general economic condition, and investor speculation as to our future plans and strategies could have a significant impact on the market price and trading volume of the shares of Common Stock. Factors 27​ Table of Contents​such as our financial results, the introduction of new products and services by us or our competitors, changes in the financial estimates by securities analysts, market conditions within the banking industry, the general state of the securities market, general economic condition, and investor speculation as to our future plans and strategies could have a significant impact on the market price and trading volume of the shares of Common Stock. Likewise, events that are unrelated to the Corporation but that affect the equity markets generally, such as national or international health crises, wars, political instability, the loss of investor or depositor confidence due to the failure of one or more financial institutions, and similar factors, could also have a significant impact on the market price and trading volume of the shares of Common Stock. Management cannot predict the extent to which an active public market for shares of Common Stock will develop or be sustained in the future. Accordingly, shareholders may not be able to sell their shares at the volumes, prices, or times that they desire.

Significant sales of shares of Common Stock, or the perception that significant sales may occur in the future, could adversely affect the market price of shares of Common Stock.

The sale of a substantial number of shares of the Common Stock could adversely affect the market price of such shares. The availability of shares for future sale could adversely affect the prevailing market price of shares of Common Stock and could cause the market price of such shares to remain low for a substantial amount of time. In addition, the Corporation may grant equity awards under its equity compensation plans from time to time in effect, including fully-

28

vested shares of Common Stock. It is possible that if a significant percentage of such available shares were attempted to be sold within a short period of time, the market for the shares would be adversely affected. Management cannot predict whether the market for shares of Common Stock could absorb a large number of attempted sales in a short period of time, regardless of the price at which they might be offered. Even if a substantial number of sales do not occur within a short period of time, the mere existence of this “market overhang” could have a negative impact on the market for the common stock and our ability to raise capital in the future.

The Corporation’s ability to pay dividends on the common stock is subject to the terms of the outstanding TPS Debentures, which prohibit the Corporation from paying dividends during an interest deferral period.

In March 2004, the Corporation issued approximately $30.9 million, in the aggregate, of junior subordinated debentures (“TPS Debentures”) to the Trusts in connection with the Trusts’ sales to third party investors of $30.0 million, in the aggregate, in mandatorily redeemable preferred capital securities. The terms of the TPS Debentures require the Corporation to make quarterly payments of interest to the Trusts, as the holders of the TPS Debentures, although the Corporation has the right to defer payments of interest for up to 20 consecutive quarterly periods, and the Corporation has exercised this deferral right in the past. An election to defer interest payments does not constitute an event of default under the terms of the TPS Debentures. The terms of the TPS Debentures prohibit the Corporation from declaring or paying any dividends or making other distributions on, or from repurchasing, redeeming or otherwise acquiring, any shares of its capital securities, including the common stock, if the Corporation elects to defer quarterly interest payments under the TPS Debentures. In addition, a deferral election will require the Trusts to likewise defer the payment of quarterly dividends on their related trust preferred securities.

Applicable banking and Maryland laws impose additional restrictions on the ability of the Corporation and the Bank to pay dividends and make other distributions on their capital securities, and, in any event, the payment of dividends is at the discretion of the boards of directors of the Corporation and the Bank.

In the past, the Corporation has funded dividends on its capital securities using cash received from the Bank, and this will likely be the case for the foreseeable future. No assurance can be given that the Bank will be able to pay dividends to the Corporation for these purposes at times and/or in amounts requested by the Corporation. Both federal and state laws impose restrictions on the ability of the Bank to pay dividends. Under Maryland law, a state-chartered commercial bank may pay dividends only out of undivided profits or, with the prior approval of the Maryland Commissioner, from surplus in excess of 100% of required capital stock. If, however, the surplus of a Maryland bank is less than 100% of its required capital stock, cash dividends may not be paid in excess of 90% of net earnings. In addition to these specific restrictions, bank regulatory agencies have the ability to prohibit proposed dividends by a financial institution which would otherwise be permitted under applicable regulations if the regulatory body determines that such distribution would constitute an unsafe or unsound practice. In addition to these specific restrictions, bank regulatory agencies have the ability to prohibit proposed dividends by a financial institution which would otherwise 28​ Table of Contents​be permitted under applicable regulations if the regulatory body determines that such distribution would constitute an unsafe or unsound practice. Banks that are considered “troubled institution” are prohibited by federal law from paying dividends altogether. Notwithstanding the foregoing, shareholders must understand that the declaration and payment of dividends and the amounts thereof are at the discretion of the Corporation’s Board of Directors. Thus, even at times when the Corporation is not prohibited from paying cash dividends on its capital securities, neither the payment of such dividends nor the amounts thereof can be guaranteed.

The Corporation’s charter and bylaws and Maryland law may discourage a corporate takeover.

The Corporation’s charter and its bylaws (the “Bylaws”) contain certain provisions designed to enhance the ability of the Corporation’s Board of Directors to deal with attempts to acquire control of the Corporation. First, the Board of Directors is a declassified board structure. Each director serves for a one-year term, and no director may be removed except for cause, and then only by the affirmative vote of either a majority of the entire Board of Directors or a majority of the outstanding voting stock. Second, the Board has the authority to classify and reclassify unissued shares of stock of any class or series of stock by setting, fixing, eliminating, or altering in any one or more respects the preferences, rights, voting powers, restrictions and qualifications of, dividends on, and redemption, conversion, exchange, and other rights of, such securities. The Board could use this authority, along with its authority to authorize the issuance of securities of any class or series, to issue shares having terms favorable to management or to a person or persons affiliated with or otherwise

29

friendly to management. In addition, the Bylaws require any shareholder who desires to nominate a director to abide by strict notice requirements.

Maryland laws include provisions that could discourage a sale or takeover of the Corporation. The Maryland Business Combination Act generally prohibits, subject to certain limited exceptions, corporations from being involved in any “business combination” (defined as a variety of transactions, including a merger, consolidation, share exchange, asset transfer or issuance or reclassification of equity securities) with any “interested shareholder” for a period of five years following the most recent date on which the interested shareholder became an interested shareholder. An interested shareholder is defined generally as a person who is the beneficial owner of 10% or more of the voting power of the outstanding voting stock of the corporation after the date on which the corporation had 100 or more beneficial owners of its stock or who is an affiliate or associate of the corporation and was the beneficial owner, directly or indirectly, of 10% percent or more of the voting power of the then outstanding stock of the corporation at any time within the two-year period immediately prior to the date in question and after the date on which the corporation had 100 or more beneficial owners of its stock. The Maryland Control Share Acquisition Act applies to acquisitions of “control shares”, which, subject to certain exceptions, are shares the acquisition of which entitle the holder, directly or indirectly, to exercise or direct the exercise of the voting power of shares of stock of the corporation in the election of directors within any of the following ranges of voting power: one-tenth or more, but less than one-third of all voting power; one-third or more, but less than a majority of all voting power or a majority or more of all voting power. Control shares have limited voting rights. Maryland banking laws provide that the Maryland Commissioner must approve certain acquisitions of the common stock of the Corporation and/or the Bank, and these laws impose penalties on persons who effect such acquisitions without approval, including a five-year voting prohibition.

Although these provisions do not preclude a sale or takeover, they may have the effect of discouraging, delaying or deferring a sale, tender offer, or takeover attempt that a shareholder might consider in his or her best interest, including those attempts that might result in a premium over the market price for the common stock. Such provisions will also render the removal of the Board of Directors and of management more difficult and, therefore, may serve to perpetuate current management. These provisions could potentially adversely affect the market prices of the Corporation’s securities.

ITEM 1B. UNRESOLVED STAFF COMMENTS

None.

ITEM 1C. CYBERSECURITY

Risk Management Strategy

Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Corporation, including financial, operational, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Cyber Security Initiative (“CSI”) committee led by our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management committee. The Information Security Officer reports directly to the Managing Director of Operations and, as discussed below, regularly to the Risk and Compliance Committee of our board of directors.

Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the Cyber Risk Institute’s cybersecurity profile designed specifically for the financial services industry, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer, along with key members of our risk management committee, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. Our Information Security Officer, along with key members of our risk team, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The

30

information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

We employ an in-depth, layered, defensive strategy that embraces a “never trust, always verify” philosophy when designing new products, services, and technology.We employe an in-depth, layered, defensive strategy that embraces a “trust by design” philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employe a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts, external penetration testers, and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We have optimized our vulnerability management program that scans devices every four hours, and we have strict key performance metrics to ensure vulnerabilities are remediated quickly. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and the Risk and Compliance Committee of our board of directors. The Incident Response Plan is coordinated through the Chief Operating Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our Company. For further discussion of risks from cybersecurity threats, see the section captioned “A disruption, breach, or failure in the operational systems or infrastructure of our third-party vendors or other service providers, including as a result of cyber-attacks, could adversely affect our business” in Item 1A. Risk Factors.

Governance

Our Information Security Officer and Director of Information Technology is accountable for managing our enterprise information security processes and procedures and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, incident response and business resilience, vulnerability assessment, threat intelligence, identity access governance, enterprise risk management, and third-party risk management. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the CSI Committee, provides guidance, oversight, monitoring, and challenge of the first line’s activities. The Committee as a whole, consists of information security professionals with varying degrees of education and experience as well as information technology professionals, and audit and fraud professionals. Individuals within the Committee are generally subject to professional education and certification requirements. In particular, our Information Security Officer has the necessary relevant expertise and formal training in the areas of information security and cybersecurity risk management.

Our board of directors has approved management committees including the CSI Committee, which focuses on technology impact, and the Risk Management Committee, which focuses on business impact. These committees provide oversight and governance of the technology program and the information security program. There are also three technology steering committees that plan and guide technology projects in alignment with the Corporation’s strategic plan.

31

These committees are chaired by managers and experts within the Corporation and include the Chief Operating Officer, as well as his direct reports and other key departmental managers from throughout the entire company. These committees meet regularly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation to facilitate timely information and monitoring efforts. These committees generally meet regularly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation to facilitate timely information and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Risk and Compliance Committee of our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).

The Risk and Compliance Committee of our board of directors is responsible for overseeing our information security and technology programs, including management’s actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our CSI Committee provides quarterly reports to the Risk and Compliance Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Risk and Compliance Committee of our board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk and Compliance Committee of our board of directors reviews our cyber security risk profile on a regular basis. The Risk and Compliance Committee our board of directors provides a report of their activities to the full board of directors at board meetings.

Recently Filed
Click on a ticker to see risk factors
Ticker * File Date
TZOO an hour ago
PEBK an hour ago
TH 2 hours ago
PKBK 2 hours ago
MG 2 hours ago
BWEN 2 hours ago
PGC 3 hours ago
INRE 4 hours ago
SSSS 7 hours ago
RCKY 9 hours ago
TG 9 hours ago
VRCA 9 hours ago
NERV 9 hours ago
KPLT 9 hours ago
SGMT 9 hours ago
ATEK 10 hours ago
LAFA 20 hours ago
GBLI 23 hours ago
WLFC 1 day ago
BRRR 1 day ago
VOYG 1 day ago
WEST 1 day ago
MNOV 1 day ago
NATR 1 day ago
URG 1 day ago
LUNG 1 day ago
VACH 1 day ago
LFMD 1 day ago
ESPR 1 day ago
CVGI 1 day ago
SIGA 1 day ago
INR 1 day ago
IPAR 1 day ago
BODI 1 day ago
UP 1 day ago
NEWT 1 day ago
ADCT 1 day ago
VTVT 1 day ago
ROLR 1 day ago
SI 1 day, 1 hour ago
CDRE 1 day, 1 hour ago
VHI 1 day, 1 hour ago
EZRA 1 day, 1 hour ago
GRPN 1 day, 1 hour ago
FUNC 1 day, 1 hour ago
MSGM 1 day, 1 hour ago
CMT 1 day, 1 hour ago
ARTV 1 day, 1 hour ago
EVLV 1 day, 1 hour ago
WNEB 1 day, 1 hour ago

OTHER DATASETS

House Trading

Dashboard

Corporate Flights

Dashboard

App Ratings

Dashboard