Item 1. Business
Item 1. Business
General
Meridian Corporation is a bank holding company engaged in banking activities through its wholly-owned subsidiary, Meridian Bank (the “Bank”), a full-service, state-chartered commercial bank with offices in the Delaware Valley tri-state market, which includes Pennsylvania, New Jersey and Delaware, as well as in the Central Maryland market. We have a financial services business model with significant non-interest income streams from mortgage lending, small business (“SBA”) lending and wealth management services. We provide services to small and middle market businesses, professionals and retail customers throughout our market area. We have a modern, progressive, consultative approach to creating innovative solutions for our customers. We are technology driven, with a culture that incorporates significant use of customer preferred alternative deliver y channel s, such as mobile banking, remote deposit capture and bank-to-bank ACH. Our ‘Meridian everywhere’ philosophy of community presence, along with our strategic business footprint, allows us to provide the high degree of service, convenience and products our customers need to achieve their financial objectives. We provide this service through three principal business line distribution channels, described further below.
Corporate Structure and Business Lines
The Corporation is the parent to the Bank. The Bank is the parent to four wholly-owned subsidiaries: Meridian Land Settlement Services, LLC, which provides title insurance services; Apex Realty, LLC, a real estate holding company; Meridian Wealth Partners, LLC, a registered investment advisory firm, (“Meridian Wealth”); and Meridian Equipment Finance, LLC, an equipment leasing company. With these subsidiaries, the Corporation is organized into the following three lines of business.
Commercial Banking
The first line of business is our traditional banking operations, serving both commercial and consumer customers via deposits and treasury management, commercial and industrial lending and leasing, commercial real estate lending, small business lending, consumer and home equity lending, private banking, merchant services, and title and land settlement services.
We have a strong credit culture that promotes diversity of lending products with a focus on commercial businesses. We have no particular credit concentration. Our commercial loans have been proactively managed in an effort to achieve a balanced portfolio with no unusual exposure to one industry.
Our commercial and industrial lending department supports our small business and middle market borrowers with a comprehensive selection of loan products including financing solutions for wholesalers, manufacturers, distributors, service providers, importers and exporters, among others. Our portfolio includes business lines of credit, term loans, small business lending (“SBA”), lease financing and shared national credits (“SNCs”).
Our SBA team and their alliances with local economic development councils provide SBA 504 and 7(a) financing options to help grow local businesses, create and retain jobs and stimulate our local economy. In addition, Meridian understands that connections with the local professional industries benefit us, not only with these individuals as customers or investors, but also given the proven potential for business referrals.
The commercial real estate division offers permanent financing for owner-occupied commercial real estate loans and land development and construction loans for residential and commercial projects. Our approach is to apply disciplined and integrated standards to underwriting, credit and portfolio management. The extensive backgrounds of our commercial real
2
Table of Contents
estate lending team, not only in banking, but also directly in the builder/developer fields, bring a unique perspective and ability to communicate and consider all elements of a project and related risk from the clients’ viewpoint as well as ours.
Mortgage Banking
The second line of business is mortgage banking. Our mortgage consultants guide our clients through the complex process of obtaining a loan to meet consumer needs. Originations consist of consumer for-sale mortgage loans, loans to be held within our portfolio, and wholesale mortgage loans. Clients include homeowners and smaller scale investors. The mortgage division operates and originates mortgage loans in the Delaware Valley tri-state market, and Maryland markets, most typically for 1-4 family dwellings, with the intention of selling substantially all of these loans in the secondary market to qualified investors, while retaining the servicing rights on these loans. Mortgages are originated through sales and marketing initiatives, as well as realtor, builder, bank, advertising and customer referral resources. The mortgage division performs origination, processing, underwriting, closing and post-closing functions both from our Blue Bell mortgage headquarters with 8 other production/processing offices in the Delaware Valley tri-state market, and from Maryland through our expanded footprint of 7 other production/processing offices in the state.
Wealth Management and Advisory Services
Meridian Wealth, a registered investment advisor and wholly-owned subsidiary of the Bank, provides a comprehensive array of wealth management services and products and the trusted guidance to help its clients and our banking customers prepare for the future. Such clients include professionals, higher net worth individuals, companies seeking to provide benefits plans for their employees, and more. Acquiring and sustaining wealth is a gradual progression, one that requires a considerable amount of thought and planning. Our process takes a comprehensive approach to financial planning and encompasses all aspects of retirement, with an emphasis on sustainability. Meridian Wealth offers a significant enhancement to both our capacity and the variety of tools we can use to help bring effective financial planning and wealth management services to a broad segment of customers.
Market Area
Meridian is headquartered in Malvern, PA and has six full-service branches in Philadelphia and surrounding counties. Its main branch, in Paoli, serves the Main Line. The West Chester and Media branches serve Chester and Delaware counties, respectively, while the Doylestown and Blue Bell branches serve Bucks and Montgomery counties, respectively. Our sixth branch is in Philadelphia. These branches provide “Relationship Hubs” for our regional lending groups and allow Meridian to proceed in its plan for serving markets in each of the central (at or near the county seat) townships of the counties in and surrounding Philadelphia.
In addition to our deposit taking branches, there are currently 19 other locations, including Corporate headquarters, that serve as loan production offices primarily for our mortgage division. These offices extend from the Philadelphia market area to Central Maryland.
Demographic information for the five county Philadelphia metropolitan area (Philadelphia County, Chester County, Delaware County, Montgomery County, Bucks County) shows our primary market to be stable, with moderate population growth. According to the U.S. Census Bureau – 2020, the median household income in this area is $80,261 compared to the national average of $62,843, while the total population in this market was 4,218,131. Demographic information for the five county Baltimore metropolitan area (Baltimore County, Howard County, Montgomery County, Anne Arundel County, Prince George’s County) also shows that this secondary market is stable. According to the U.S. Census Bureau – 2020, the median household income in the Baltimore metropolitan area is $98,513 compared to the national average of $62,843, while the total population in this market was 3,804,375.
United States
Pennsylvania
Maryland
Population (1)
308,449,281
13,002,700
6,177,224
Median household income (1)
$ 62,843
$ 61,744
$ 84,805
Unemployment rate (2)
3.9%
4.0%
4.0%
3
Table of Contents
Philadelphia Metropolitan Area Counties
Bucks County
Montgomery County
Delaware County
Chester County
Philadelphia County
Total
Population (1)
646,538
856,553
576,830
534,413
1,603,797
4,218,131
Median household income (1)
$ 89,139
$ 91,546
$ 74,477
$ 100,214
$ 45,927
$ 80,261
Unemployment rate (2)
3.3%
3.0%
3.9%
2.5%
5.8%
Baltimore Metropolitan Area Counties
Howard County
Montgomery County
Anne Arundel County
Prince George's County
Baltimore County
Total
Population (1)
332,317
1,062,061
588,261
967,201
854,535
3,804,375
Median household income (1)
$ 121,160
$ 108,820
$ 100,798
$ 84,920
$ 76,866
$ 98,513
Unemployment rate (2)
3.0%
3.6%
3.3%
5.0%
3.9%
(1) – Source: U.S. Census Data – 2020
(2) – Source: U.S. Bureau of Labor Statistics – December 2021
Competition
Overall, the banking business in our market area is highly competitive. Meridian Bank faces substantial competition both in attracting deposits and in originating loans. Meridian Bank competes with local, regional and national commercial banks, savings banks, and savings and loan associations. Other competitors include non-bank fintech and finance companies, money market mutual funds, mortgage bankers, insurance companies, securities brokerage firms, regulated small loan companies, credit unions, and issuers of commercial paper and other securities.
Meridian Bank seeks to compete for business principally on the basis of high quality, personal service to customers, customer access to our decision-makers, and customer preferred electronic delivery channels while providing an attractive banking platform and competitive interest rates and fees.
Human Capital Resources
At December 31, 2021, we employed 413 individuals, nearly all of whom are full-time and of which 48% are women. Women make up 32% of all officers throughout the Meridian organization. None of these employees are covered by collective bargaining agreements, and Meridian believes it enjoys good relations with its personnel. In December of 2020, the Bank was named by the Independent Community Bankers of American (“ICBA”) as one of their ‘Best Community Banks to Work For’. As an integrated full-service financial institution, approximately 36% of our employees are employed through our banking segment, 62% through our mortgage segment, and 2% for our wealth segment.
The safety of our employees has been our top priority over the last two years due to the COVID-19 pandemic. A portion of our workforce continues to work remotely and we have occasionally closed lobbies to appointment-only during times of heightened transmission of COVID-19 to protect the health of our employees. We will continue to follow all of the appropriate guidance and engage our staff members as needed to deal with new challenges.
Meridian is committed to giving back to our communities. In 2021 we donated $486 thousand to nearly 100 organizations throughout the various communities that we serve in Pennsylvania, New Jersey, Delaware, and Maryland. Meridian also sponsors individual / group service days and provides time off to employees to participate.
In order to compete effectively and continue to provide excellent service to our clients, we must attract, retain, and motivate qualified professionals. During the hiring process Meridian looks to bring onboard well-qualified individuals, without bias to race or gender. As we are currently in a very competitive hiring market, we utilize various methods to find well-qualified talent including third party search firms, social media, internal candidates already in our organization and on campus recruiting at local universities.
.
4
Table of Contents
During 2021 we hired 84 professionals, 46% of which were women, and 21% of which were ethnically diverse. For 2021 our turnover rate was approximately 1.5%, which makes our overall retention rate very high compared to peers. We believe our culture, our effort to maintain a meritocracy in terms of opportunity and our continued evolution and growth contribute to our success in attracting and retaining strong talent.
Our benefits are designed to attract and retain employees by providing employees and their families with health and wellness programs (medical, dental, vision), retirement wealth accumulation, paid time off, income replacement (paid sick and disability leaves and life insurance) and family oriented benefits (parental leaves and child care assistance).
We aim to continually build on the expertise of our workforce. At entry levels, we have implemented trainee and internship programs. During 2021 Meridian invested throughout the organization in terms of in-house and external training programs to help our employees develop leadership skills, stay current on professional development topic in their area of focus, as well as to keep up to date on cybersecurity, and risk & compliance matters that impact the organization overall.
Our Current Capital Stock Structure
As of December 31, 2021 Meridian had 6,534,587 shares of common stock, $1 par value, issued and 6,107,894 shares outstanding. There is no preferred stock outstanding.
Implications of Being an Emerging Growth Company
We qualify as an “emerging growth company” as defined by the Jumpstart Our Business Startups Act of 2012 (“JOBS Act”). An emerging growth company may take advantage of reduced reporting requirements and is relieved of certain other significant requirements that are otherwise generally applicable to public companies. As an emerging growth company,
● we may present only two years of audited financial statements and only two years of related management discussion and analysis of financial condition and results of operations;
● we are permitted to provide less extensive disclosure about our executive compensation arrangements; and
● we are not required to give our shareholders non-binding advisory votes on executive compensation or golden parachute arrangements.
We have elected to take advantage of the scaled disclosure requirements and other relief described above and may take advantage of these exemptions for so long as we remain an emerging growth company. We will remain an emerging growth company until December 31, 2022, the end of the fiscal year following the fifth anniversary of the completion of our initial public offering.
In addition to scaled disclosure and the other relief described above, the JOBS Act permits us an extended transition period for complying with new or revised accounting standards affecting public companies. We have elected to take advantage of this extended transition period, which means that the financial statements included herein, as well as any financial statements that we file in the future, will not be subject to all new or revised accounting standards generally applicable to public companies for the transition period for so long as we remain an emerging growth company or until we affirmatively and irrevocably opt out of the extended transition period under the JOBS Act. If we do so, we will prominently disclose this decision in the first periodic report following our decision, and such decision is irrevocable.
Information about Meridian
Our executive offices are located at 9 Old Lincoln Highway, Malvern, PA 19355 and our telephone number is (484) 568-5000. Our Internet website is www.meridianbanker.com and our investor relations page can be found at investor.meridianbanker.com. Our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q and Current Reports on Form 8-K, and all amendments thereto, from November 7, 2017 through August 18, 2018 have been filed with the FDIC. Since August 19, 2018, all reports on Form 8-K, and Form 10-Q along with this Annual Report on Form 10-K have been filed with the SEC. Also on our website are our Audit Committee and Compensation Committee Charters. The information contained in our website or in any websites linked by our website, is not part of this Annual Report on Form 10-K. The Corporation’s filings with the SEC can also be accessed at the SEC’s internet website: http://www.sec.gov.
5
Table of Contents
Investors can obtain copies of Meridian’s annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and any amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended, on Meridian’s website (accessible under “Investor Relations” – “SEC Filings”) as soon as reasonably practicable after Meridian has filed such materials with, or furnished them to, the SEC. Meridian will also furnish a paper copy of such filings free of charge upon request.
Reports of the Bank’s condition and income, known as “Call Reports,” are filed with the FDIC and the Parent Company Only Financial Statement for Small Holding Companies known as the “FR Y-9SP” with the Federal Reserve. These reports are available on the FFIEC Central Data Repository’s Public Data Distribution website at cdr.ffiec.gov/public.
SUPERVISION AND REGULATION
Meridian and its subsidiaries are subject to extensive regulation under federal and state banking laws that establish a comprehensive framework for our operations. This framework may materially affect our growth potential and financial performance and is intended primarily for the protection of depositors, customers, federal deposit insurance funds and the banking system as a whole, not for the protection of our shareholders and creditors. The following discussion summarizes certain laws, regulations and policies to which Corporation and the Bank are subject. It does not address all applicable laws, regulations and policies that affect us currently or might affect us in the future. This discussion is qualified in its entirety by reference to the full texts of the laws, regulations and policies described.
The Bank is an FDIC-insured commercial bank chartered under the laws of Pennsylvania with regulatory oversight from the FDIC and the Pennsylvania Department of Banking and Securities (“PDBS”). The holding company, Meridian Corporation, is subject to supervision and examination by, and the regulations and reporting requirements of, the Board of Governors of the Federal Reserve System, and is subject to the disclosure and regulatory requirements of the Exchange Act. In order to adhere to regulatory expectations on an ongoing basis and to successfully prepare for the normal examination processes, Meridian maintains numerous internal controls including policies and programs appropriate to maintain the Bank’s safety and soundness, under such key areas as lending, compliance, BSA-AML, information security, human resources, deposit and cash management products, enterprise risk, merchant services, finance, title services, branch security and wealth management. As a public company, the Corporation also files reports with the SEC and is subject to its regulatory authority, as well as the disclosure and regulatory requirements of the Securities Act, as amended, and the Exchange Act, as amended, with respect to the Corporation’s securities, financial reporting and certain governance matters. Because the Corporation’s securities are listed on the NASDAQ Stock Market, we are subject to NASDAQ's rules for listed companies, including rules relating to corporate governance.
Permissible Activities for Bank Holding Companies
The Corporation is a registered bank holding company under the Bank Holding Company Act of 1956 (“BHC Act”). In general, the BHC Act limits the business of bank holding companies to banking, managing or controlling banks and other activities that the Federal Reserve has determined to be so closely related to banking as to be a proper incident thereto, which include certain activities relating to extending credit or acting as an investment or financial advisor.
Bank holding companies that qualify and elect to be treated as “financial holding companies” may engage in a broader range of additional activities than bank holding companies that are not financial holding companies. In particular, financial holding companies may engage in activities that are (i) financial in nature or incidental to such financial activities or (ii) complementary to a financial activity and do not pose a substantial risk to the safety and soundness of depository institutions or the financial system generally. These activities include securities underwriting and dealing, insurance underwriting and making merchant banking investments. As of this filing, we have not elected to be treated as a financial holding company.
The Federal Reserve has the power to order any bank holding company or any of its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the Federal Reserve has reasonable grounds to believe that continuing such activity, ownership or control constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company.
6
Table of Contents
Permissible Activities for Banks
As a Pennsylvania-chartered commercial bank, our business is subject to extensive supervision and regulation by state and federal bank regulatory agencies. Our business is generally limited to activities permitted by Pennsylvania law and any applicable federal laws. Under the Pennsylvania Banking Code of 1965 (the “Pennsylvania Banking Code”), the Bank may generally engage in all usual banking activities, including, among other things, accepting deposits; lending money on personal and real estate security; issuing letters of credit; buying, discounting, and negotiating promissory notes and other forms of indebtedness; buying and selling foreign currency and, subject to certain limitations, certain investment securities; engaging in certain insurance activities and management services providing cash.
The FDIC has adopted regulations pertaining to the other activity restrictions imposed upon insured state banks and their subsidiaries. Pursuant to such regulations, insured state banks engaging in impermissible activities may seek approval from the FDIC to continue such activities. State banks not engaging in such activities but that desire to engage in otherwise impermissible activities either directly or through a subsidiary may apply for approval from the FDIC to do so; however, if such bank fails to meet the minimum capital requirements or the activities present a significant risk to the Deposit Insurance Fund, such application will not be approved by the FDIC. Pursuant to this authority, the FDIC has determined that investments in certain majority-owned subsidiaries of insured state banks do not represent a significant risk to the deposit insurance funds. Investments permitted under that authority include real estate activities and securities activities.
Meridian currently conducts certain non-banking activities through certain of the Bank’s non-bank subsidiaries. Meridian Bank currently operates four wholly-owned subsidiaries: Meridian Land Settlement Services, which provides title insurance services; Apex Realty, a real estate holding company; Meridian Wealth, a registered investment advisory firm, and Meridian Equipment Finance, an equipment leasing company.
Pennsylvania law also imposes restrictions on Meridian Bank’s activities intended to ensure the safety and soundness of the Bank. For example, Meridian Bank is restricted under the Pennsylvania Banking Code from investing in certain types of investment securities and is generally limited in the amount of money it can lend to a single borrower or invest in securities issued by a single issuer.
Acquisitions by Bank Holding Companies
Control Acquisitions. The Change in Bank Control Act (“CBCA”) prohibits a person or group of persons from acquiring “control” of a bank holding company unless the Federal Reserve has been notified and has not objected to the transaction. Under a rebuttable presumption established by the Federal Reserve, the acquisition of 10% or more of a class of voting stock of a bank holding company with a class of securities registered under Section 12 of the Exchange Act, such as Meridian Corporation, would, under the circumstances set forth in the presumption, constitute acquisition of control of Meridian Corporation.
In addition, the CBCA prohibits any entity from acquiring 25% (the BHC Act has a lower limit for acquirers that are existing bank holding companies) or more of a bank holding company’s or bank’s voting securities, or otherwise obtaining control or a controlling influence over a bank holding company or bank without the approval of the Federal Reserve. On January 31, 2020, the Federal Reserve Board approved the issuance of a final rule (which became effective April 1, 2020) that clarifies and codifies the Federal Reserve’s standards for determining whether one company has control over another. The final rule establishes four categories of tiered presumptions of non-control that are based on the percentage of voting shares held by the investor (less than 5%, 5-9.9%, 10-14.9% and 15-24.9%) and the presence of other indicia of control. As the percentage of ownership increases, fewer indicia of control are permitted without falling outside of the presumption of non-control. These indicia of control include nonvoting equity ownership, director representation, management interlocks, business relationship and restrictive contractual covenants. Under the final rule, investors can hold up to 24.9% of the voting securities and up to 33% of the total equity of a company without necessarily having a controlling influence.
7
Table of Contents
Dividends
Meridian is a legal entity separate and distinct from the Bank and the wholly-owned subsidiaries of the Bank. As a Pennsylvania banking institution, the Bank is subject to certain restrictions on its ability to pay dividends under applicable banking laws and regulations.
Federal banking regulators are authorized to determine under certain circumstances relating to the financial condition of a bank holding company or a bank that the payment of dividends would be an unsafe or unsound practice and to prohibit payment thereof. In particular, federal banking regulators have stated that paying dividends that deplete a banking organization’s capital base to an inadequate level would be an unsafe and unsound banking practice and that banking organizations should generally pay dividends only out of current operating earnings. In addition, in the current financial and economic environment, the federal banking regulators have indicated that banks should carefully review their dividend policy and have discouraged payment ratios that are at maximum allowable levels unless both asset quality and capital are very strong. Under the Capital Rules, institutions that seek to pay dividends must maintain 2.5% in Common Equity Tier 1 capital attributable to the capital conservation buffer, which was phased in over a three-year period that began on January 1, 2016. See “—Regulatory Capital Requirements”.
Our principal source of cash flow and income is dividends from our subsidiaries, which is also the component of our liquidity. In addition to the restrictions discussed above, the Bank is subject to limitations under Pennsylvania law regarding the level of dividends that it may pay to our shareholders. Under the Pennsylvania Banking Code, the Bank generally may not pay dividends in excess of its net profits.
Parity Regulation
A Pennsylvania banking institution may, in accordance with Pennsylvania law and regulations issued by the PDBS, exercise any power and engage in any activity that has been authorized for national banks, federal thrifts or state banks in a state other than Pennsylvania, provided that the activity is permissible under applicable federal law and not specifically prohibited by Pennsylvania law. Such powers and activities must be subject to the same limitations and restrictions imposed on the national bank, federal thrift or out-of-state bank that exercised the power or activity, subject to a required notice to the PDBS. The FDIA, however, prohibits state-chartered banks from making new investments, loans, or becoming involved in activities as principal and equity investments which are not permitted for national banks unless (1) the FDIC determines the activity or investment does not pose a significant risk of loss to the Deposit Insurance Fund and (2) the Bank meets all applicable capital requirements. Accordingly, the additional operating authority provided to the Bank by the Pennsylvania Banking Code is restricted by the FDIA.
Transactions with Affiliates and Insiders
Transactions between our subsidiaries, or between the Corporation and our subsidiaries, are regulated under Sections 23A and 23B of the Federal Reserve Act. The Federal Reserve Act imposes quantitative and qualitative requirements and collateral requirements on covered transactions by the Bank with, or for the benefit of, its affiliates. Generally, the Federal Reserve Act limits the extent to which a bank or its subsidiaries may engage in “covered transactions” with any one affiliate to an amount equal to 10% of a bank’s capital stock and surplus, limits the aggregate amount of all such transactions with all affiliates to an amount equal to 20% of such capital stock and surplus, and requires those transactions to be on terms at least as favorable to a bank as if the transaction were conducted with an unaffiliated third party. Covered transactions are defined by statute to include a loan or extension of credit, as well as a purchase of securities issued by an affiliate, a purchase of assets (unless otherwise exempted by the Federal Reserve) from the affiliate, certain derivative transactions with an affiliate, the acceptance of securities issued by the affiliate as collateral for a loan, and the issuance of a guarantee, acceptance or letter of credit on behalf of an affiliate. In addition, any credit transactions with any affiliate, must be secured by designated amounts of specified collateral.
Federal law also limits a bank’s authority to extend credit to its directors, executive officers and 10% shareholders, as well as to entities controlled by such persons. Among other things, extensions of credit to insiders are required to be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with unaffiliated persons. Also, the terms of such extensions of credit may not
8
Table of Contents
involve more than the normal risk of non-repayment or present other unfavorable features and may not exceed certain limitations on the amount of credit extended to such persons individually and in the aggregate.
Source of Strength
Federal Reserve policy and federal law require bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. Under this requirement, Meridian is expected to commit resources to support the Bank, including at times when it may not be in a financial position to provide such resources, and it may not be in our, or our shareholders’ or creditors’, best interests to do so. In addition, any capital loans Meridian makes to the Bank are subordinate in right of payment to depositors and to certain other indebtedness of the Bank. In the event of our bankruptcy, any commitment by us to a federal banking regulatory agency to maintain the capital of the Bank will be assumed by the bankruptcy trustee and entitled to priority of payment.
Regulatory Capital Requirements
The Federal Reserve monitors the capital adequacy of the holding company on a consolidated basis, and the FDIC and the PDBS monitor the capital adequacy of the Bank. The banking regulators use a combination of risk-based guidelines and a leverage ratio to evaluate capital adequacy. The risk-based capital guidelines applicable to us are based on the Basel Committee’s December 2010 final capital framework, known as Basel III, as implemented by the federal banking regulators. The risk-based guidelines are intended to make regulatory capital requirements sensitive to differences in credit and market risk profiles among banks and bank holding companies, to account for off-balance sheet exposure and to minimize disincentives for holding liquid assets.
Basel III and the Capital Rules. In July 2013, the federal banking regulators approved final rules, or the Capital Rules, implementing the Basel Committee’s December 2010 final capital framework for strengthening international capital standards, known as Basel III, and various provisions of the Dodd-Frank Act. The Capital Rules substantially revise the risk-based capital requirements applicable to bank holding companies and banks, including us, compared to the previous risk-based capital rules. The Capital Rules revise the components of capital and address other issues affecting the numerator in regulatory capital ratio calculations. The Capital Rules, among other things, (i) include a new capital measure called “Common Equity Tier 1” (“CET1”), (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting certain revised requirements, (iii) define CET1 narrowly by requiring that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital, and (iv) expand the scope of the deductions/adjustments to capital as compared to prior regulations.
Under the Basel III Capital Rules, the minimum capital ratios are (i) 4.5% CET1 to risk-weighted assets, (ii) 6% Tier 1 capital (that is, CET1 plus Additional Tier 1 capital) to risk-weighted assets, (iii) 8% total capital (that is, Tier 1 capital plus Tier 2 capital) to risk-weighted assets and (iv) 4% Tier 1 capital to average consolidated assets as reported on consolidated financial statements (known as the “leverage ratio”).
The current Capital Rules also include a capital conservation buffer designed to absorb losses during periods of economic stress. The capital conservation buffer is composed entirely of CET1, on top of these minimum risk-weighted asset ratios.
The Capital Rules require us to maintain an additional capital conservation buffer of 2.5% of CET1, effectively resulting in minimum ratios of (i) 7% CET1 to risk-weighted assets, (ii) 8.5% Tier 1 capital to risk-weighted assets, (iii) 10.5% total capital to risk-weighted assets and (iv) a minimum leverage ratio of 4%. The Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, certain deferred tax assets and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. Implementation of the deductions and other adjustments to CET1 began on January 1, 2016 and was phased in over a four-year period, until it became fully implemented on January 1, 2019. In addition, the Capital Rules provide for a countercyclical capital buffer applicable only to certain covered institutions. We do not expect the countercyclical capital buffer to be applicable to us. Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the capital conservation buffer (or below the combined capital conservation buffer and countercyclical capital
9
Table of Contents
buffer, when the latter is applied) will face constraints on dividends, equity repurchases and compensation based on the amount of the shortfall.
In addition, under the general risk-based Capital Rules, the effects of accumulated other comprehensive income items included in capital were excluded for the purposes of determining regulatory capital ratios. Under the Capital Rules, the effects of certain accumulated other comprehensive income items are not excluded; however, non-advanced approaches banking organizations, including the Bank, were able to make a one-time permanent election to continue to exclude these items. The Bank made this election.
The Capital Rules also prescribed a new standardized approach for risk weightings that expanded the risk-weighting categories from the current four Basel I-derived categories (0%, 20%, 50% and 100%) to a much larger and more risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0%, for U.S. government and agency securities, to 600%, for certain equity exposures, and resulting in higher risk weights for a variety of asset categories.
Community banks have long raised concerns with bank regulators about the regulatory burden, complexity, and costs associated with certain provisions of the Basel III Rule. In response, Congress provided an “off-ramp” for institutions, like us, with total consolidated assets of less than $10 billion. Section 201 of the Regulatory Relief Act instructed the federal banking regulators to establish a single "Community Bank Leverage Ratio" (“CBLR”) of between 8 and 10%. Under the final rule, a community banking organization is eligible to elect the new framework if it has: less than $10 billion in total consolidated assets, limited amounts of certain assets and off-balance sheet exposures, and a CBLR greater than 9%.The bank regulatory agencies temporarily lowered the CBLR to 8% as a result of the COVID-19 pandemic. During the first quarter of 2020, the Bank adopted the community bank leverage ratio framework as its primary regulatory capital ratio.
With respect to the Bank, the Capital Rules also revised the prompt corrective action regulations pursuant to Section 38 of the FDIA. See “—Prompt Corrective Action Framework” below.
Prompt Corrective Action Framework
The Federal Deposit Insurance Act, as amended (“FDIA”), requires among other things, that the federal banking agencies take “prompt corrective action” with respect to banks that do not meet minimum capital requirements. The FDIA sets forth the following five capital tiers for purposes of implementing the PCA regulations: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” and “critically undercapitalized.”
Liquidity Regulations
Historically, the regulation and monitoring of bank and bank holding company liquidity has been addressed as a supervisory matter, without required formulaic measures. The Basel III final framework requires banks and bank holding companies to measure their liquidity against specific liquidity tests that, although similar in some respects to liquidity measures historically applied by banks and regulators for management and supervisory purposes, going forward would be required by regulation. One test, referred to as the liquidity coverage ratio, or LCR, is designed to ensure that the banking entity maintains an adequate level of unencumbered high-quality liquid assets equal to the entity’s expected net cash outflow for a 30-day time horizon (or, if greater, 25% of its expected total cash outflow) under an acute liquidity stress scenario. The other test, referred to as the net stable funding ratio, or NSFR, is designed to promote more medium- and long-term funding of the assets and activities of banking entities over a one-year time horizon. These requirements will incentivize banking entities to increase their holdings of U.S. Treasury securities and other sovereign debt as a component of assets and increase the use of long-term debt as a funding source.
Safety and Soundness Standards
The FDIA requires the federal banking agencies to prescribe standards, by regulations or guidelines, relating to internal controls, information systems and internal audit systems, loan documentation, credit underwriting, interest rate risk exposure, asset growth, asset quality, earnings, stock valuation and compensation, fees and benefits, and such other operational and managerial standards as the agencies deem appropriate. The federal banking agencies have adopted the
10
Table of Contents
Interagency Guidelines for Establishing Standards for Safety and Soundness. The guidelines establish general standards relating to internal controls and information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, asset quality, earnings and compensation, fees and benefits. In general, these guidelines require, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines. These guidelines also prohibit excessive compensation as an unsafe and unsound practice and describe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal shareholder. In addition, the agencies adopted regulations that authorize, but do not require, an agency to order an institution that has been given notice by an agency that it is not satisfying all safety and soundness standards to submit a compliance plan. If, after being so notified, an institution fails to submit an acceptable compliance plan or fails in any material respect to implement an acceptable compliance plan, the banking regulator must issue an order directing action to correct the deficiency and may issue an order directing other actions of the types to which an undercapitalized institution may be subject under the FDIA. See “—Prompt Corrective Action Framework”. If an institution fails to comply with such an order, the banking regulator may seek to enforce such order in judicial proceedings and to impose civil money penalties.
Deposit Insurance
FDIC insurance assessments
As an FDIC-insured bank, the Bank must pay deposit insurance assessments to the FDIC based on its average total assets minus its average tangible equity. Deposits are insured up to applicable limits by the FDIC and such insurance is backed by the full faith and credit of the United States Government.
As an institution with less than $10 billion in assets, the Bank’s assessment rates are based on the level of risk it poses to the FDIC’s deposit insurance fund (“DIF”). Pursuant to changes adopted by the FDIC that were effective July 1, 2016, the initial base rate for deposit insurance is between three and 30 basis points. Total base assessment after possible adjustments now ranges between 1.5 and 40 basis points. For established smaller institutions, like the Bank, supervisory ratings are used along with (i) an initial base assessment rate, (ii) an unsecured debt adjustment (which can be positive or negative), and (iii) a brokered deposit adjustment, to calculate a total base assessment rate.
Under the Dodd-Frank Act, the limit on FDIC deposit insurance was increased to $250 thousand. The coverage limit is per depositor, per insured depository institution for each account ownership category. The Dodd-Frank Act also set a new minimum DIF reserve ratio at 1.35% of estimated insured deposits. In October 2010, the FDIC adopted a new DIF restoration plan to ensure that the fund reserve ratio reaches 1.35% by September 30, 2020, as required by the Dodd-Frank Act. In December 2018, the FDIC announced that the DIF reserve ratio had surpassed this benchmark.
The FDIC adopted a final rule effective June 26, 2020, and applied as of April 1, 2020, to mitigate the effect on deposit insurance assessments of a bank’s participation in the Paycheck Protection Program, the Paycheck Protection Program Liquidity Facility and the Money Market Mutual Fund Liquidity Facility in connection with the COVID-19 pandemic.
Under the FDIA, the FDIC may terminate deposit insurance upon a finding that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC.
Other assessments
In addition, the Deposit Insurance Funds Act of 1996 authorized the Financing Corporation (“FICO”) to impose assessments on certain deposits in order to service the interest on the FICO’s bond obligations from deposit insurance fund assessments. The amount assessed on individual institutions is in addition to the amount, if any, paid for deposit insurance according to the FDIC’s risk-related assessment rate schedules. Assessment rates may be adjusted quarterly to reflect changes in the assessment base.
11
Table of Contents
Depositor Preference
The FDIA provides that, in the event of the “liquidation or other resolution” of an insured depository institution, the claims of deposits of the institution, including the claims of the FDIC as subrogate of insured depositors, and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution. If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors, including depositors whose deposits are payable only outside of the United States and the parent bank holding company, with respect to any extensions of credit they have made to such insured depository institution.
Interstate Branching
Pennsylvania banking laws authorize banks in Pennsylvania to acquire existing branches or branch de novo in other states, and also permits out-of-state banks to acquire existing branches or branch de novo in Pennsylvania.
Federal law permits state and national banks to merge with banks in other states subject to: (i) regulatory approval; (ii) federal and state deposit concentration limits; and (iii) any state law limitations requiring the merging bank to have been in existence for a minimum period of time (not to exceed five years) prior to the merger. The establishment of new interstate branches or the acquisition of individual branches of a bank in another state (rather than the acquisition of an out-of-state bank in its entirety) has historically been permitted only in those states the laws of which expressly authorize such expansion. However, the Dodd-Frank Act permits well-capitalized and well-managed banks to establish new branches across state lines without these impediments.
Consumer Financial Protection
We are subject to a number of federal and state consumer protection laws that extensively govern our relationship with our customers. These laws include the Equal Credit Opportunity Act (“ECOA”), the Fair Credit Reporting Act, the Truth in Lending Act (“TILA”), the Truth in Savings Act, the Electronic Fund Transfer Act, the Expedited Funds Availability Act, the Home Mortgage Disclosure Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Fair Debt Collection Practices Act, Fair Credit Reporting Act, the Service Members Civil Relief Act, the Right to Financial Privacy Act, Telephone Consumer Protection Act, CAN-SPAM Act, and these laws’ respective state-law counterparts, as well as state usury laws and laws regarding unfair and deceptive acts and practices. These and other federal laws, among other things, require disclosures of the cost of credit and terms of deposit accounts, provide substantive consumer rights, prohibit discrimination in credit transactions, regulate the use of credit report information, provide financial privacy protections, restrict our ability to raise interest rates on extensions of credit and subject us to substantial regulatory oversight. Violations of applicable consumer protection laws can result in significant potential liability from litigation brought by customers, including actual damages, restitution and attorneys’ fees. Federal banking regulators, state attorneys general and state and local consumer protection agencies may also seek to enforce consumer protection requirements and obtain these and other remedies, including regulatory sanctions, customer rescission rights, action by the state and local attorneys general in each jurisdiction in which we operate and civil money penalties. Failure to comply with consumer protection requirements may also result in our failure to obtain any required bank regulatory approval for merger or acquisition transactions we may wish to pursue or our prohibition from engaging in such transactions even if approval is not required.
The Consumer Financial Protection Bureau (“CFPB”), has broad rulemaking, supervisory and enforcement powers under various federal consumer financial protection laws with respect to certain consumer financial products and services, including the ability to require reimbursements and other payments to customers for alleged legal violations. The CFPB has the authority to impose significant penalties, as well as injunctive relief that prohibits lenders from engaging in allegedly unlawful practices. The CFPB is also authorized to engage in consumer financial education, track consumer complaints, request data and promote the availability of financial services to underserved consumers and communities. Although all institutions are subject to rules adopted by the CFPB and examination by the CFPB in conjunction with examinations by the institution’s primary federal regulator, the CFPB has primary examination and enforcement authority over institutions with assets of $10 billion or more. The FDIC has primary responsibility for examination of the Bank and enforcement with respect to various federal consumer protection laws so long as the Bank has total consolidated assets of less than $10 billion, and state authorities are responsible for monitoring our compliance with all state consumer laws. The
12
Table of Contents
CFPB also has the authority to require reports from institutions with less than $10 billion in assets, such as the Bank, to support the CFPB in implementing federal consumer protection laws, supporting examination activities, and assessing and detecting risks to consumers and financial markets.
The consumer protection provisions of the Dodd-Frank Act and the examination, supervision and enforcement of those laws and implementing regulations by the CFPB have created a more intense and complex environment for consumer finance regulation. The CFPB has significant authority to implement and enforce federal consumer finance laws, including the TILA, the ECOA and new requirements for financial services products provided for in the Dodd-Frank Act.
The CFPB has broad rulemaking authority for a wide range of consumer financial laws that apply to all banks including, among other things, the authority to prohibit “unfair, deceptive, or abusive” acts and practices. Abusive acts or practices are defined in the Dodd-Frank Act as those that (1) materially interfere with a consumer’s ability to understand a term or condition of a consumer financial product or service, or (2) take unreasonable advantage of a consumer’s (a) lack of financial savvy, (b) inability to protect herself or himself in the selection or use of consumer financial products or services, or (c) reasonable reliance on a covered entity to act in the consumer’s interests. The review of products and practices to prevent such acts and practices is a continuing focus of the CFPB, and of banking regulators more broadly. The ultimate impact of this heightened scrutiny is uncertain but it could result in changes to pricing, practices, products and procedures. It could also result in increased costs related to regulatory oversight, supervision and examination, additional remediation efforts and possible penalties. The Dodd-Frank Act does not prevent states from adopting stricter consumer protection standards. State regulation of financial products and potential enforcement actions could also adversely affect our business, financial condition or results of operations.
Federal Home Loan Bank Membership
The Bank is a member of the Federal Home Loan Bank of Pittsburgh (“FHLB”), which serves as a central credit facility for its members. The FHLB is funded primarily from proceeds from the sale of obligations of the FHLB system. It makes loans to member banks in the form of FHLB advances. All advances from the FHLB are required to be fully collateralized as determined by the FHLB.
Ability-To-Pay Rules and Qualified Mortgages
As required by the Dodd-Frank Act, the CFPB issued a series of final rules in January 2013 amending Regulation Z, implementing TILA, which requires mortgage lenders to make a reasonable and good faith determination, based on verified and documented information, that a consumer applying for a residential mortgage loan has a reasonable ability to repay the loan according to its terms. These final rules prohibit creditors, such as the Bank, from extending residential mortgage loans without regard for the consumer’s ability to repay and add restrictions and requirements to residential mortgage origination and servicing practices. In addition, these rules restrict the imposition of prepayment penalties and restrict compensation practices relating to residential mortgage loan origination. Mortgage lenders are required to determine consumers’ ability to repay in one of two ways. The first alternative requires the mortgage lender to consider eight underwriting factors when making the credit decision. Alternatively, the mortgage lender can originate “qualified mortgages”, which are entitled to a presumption that the creditor making the loan satisfied the ability-to-repay requirements. In general, a qualified mortgage is a residential mortgage loan that does not have certain high risk features, such as negative amortization, interest-only payments, balloon payments, or a term exceeding 30 years. In addition, to be a qualified mortgage, the points and fees paid by a consumer cannot exceed 3% of the total loan amount and the borrower’s total debt-to-income ratio must be no higher than 43% (subject to certain limited exceptions for loans eligible for purchase, guarantee or insurance by a government sponsored enterprise or a federal agency).
Commercial Real Estate Guidance
In December 2015, the federal banking regulators released a statement entitled “Interagency Statement on Prudent Risk Management for Commercial Real Estate Lending” (the “CRE Guidance”). In the CRE Guidance, the federal banking regulators (i) expressed concerns with institutions that ease commercial real estate underwriting standards, (ii) directed financial institutions to maintain underwriting discipline and exercise risk management practices to identify, measure and monitor lending risks, and (iii) indicated that they will continue to pay special attention to commercial real estate lending
13
Table of Contents
activities and concentrations going forward. The federal banking regulators previously issued guidance in December 2006, entitled “Interagency Guidance on Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices”, which stated that an institution is potentially exposed to significant commercial real estate concentration risk, and should employ enhanced risk management practices, where (1) total commercial real estate loans represent 300% or more of its total capital and (2) the outstanding balance of such institution’s commercial real estate loan portfolio has increased by 50% or more during the prior 36 months.
Leveraged Lending Guidance
In March 2013, the federal banking regulators jointly issued guidance on leveraged lending that updates and replaces the guidance for leveraged finance activities issued by the federal banking regulators in April 2001. The revised leveraged lending guidance describes regulatory expectations for the sound risk management of leveraged lending activities, including the importance for institutions to maintain, among other things, (i) a credit limit and concentration framework consistent with the institution’s risk appetite, (ii) underwriting standards that define acceptable leverage levels, (iii) strong pipeline management policies and procedures and (iv) guidelines for conducting periodic portfolio and pipeline stress tests.
Community Reinvestment Act of 1977
Under the CRA, the Bank has an obligation, consistent with safe and sound operations, to help meet the credit needs of the market areas where it operates, which includes providing credit to low- and moderate-income individuals and communities. In connection with its examination of the Bank, the FDIC is required to assess our compliance with the CRA. Our bank’s failure to comply with the CRA could, among other things, result in the denial or delay in certain corporate applications filed by us, including applications for branch openings or relocations and applications to acquire, merge or consolidate with another banking institution or holding company. Our bank received a rating of “Satisfactory” in its most recently completed CRA examination in 2020 that was as of February 11, 2020.
Financial Privacy
The federal banking regulators have adopted rules limiting the ability of banks and other financial institutions to disclose non-public information about consumers to unaffiliated third parties. These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to an unaffiliated third party. These regulations affect how consumer information is transmitted through diversified financial companies and conveyed to outside vendors.
Anti-Money Laundering and the USA PATRIOT ACT
The USA PATRIOT Act of 2001, which was enacted in the wake of the September 11, 2001 attacks, includes provisions designed to combat international money laundering and advance the U.S. government’s war against terrorism. The USA PATRIOT Act and the regulations which implement it contain many obligations which must be satisfied by financial institutions, including the Bank. Those regulations impose obligations on financial institutions, such as the Bank, to maintain appropriate policies, procedures and controls to detect, prevent and report money laundering and terrorist financing and to verify the identity of their customers. The failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing could have serious legal and reputational consequences for the financial institution.
Office of Foreign Assets Control Regulation
The U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”) administers and enforces economic and trade sanctions against targeted foreign countries and regimes, under authority of various laws, including designated foreign countries, nationals and others. OFAC publishes lists of specially designated targets and countries. We are responsible for, among other things, blocking accounts of, and transactions with, such targets and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence. Failure to comply with these sanctions could have serious legal and reputational consequences and could result in civil money penalties imposed on the institution by OFAC. Failure to comply with these sanctions could also cause applicable bank regulatory authorities not to
14
Table of Contents
approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required.
Incentive Compensation
The Federal Reserve will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as us, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.
During the second quarter of 2016, certain U.S. regulators, including the Federal Reserve, the FDIC and the SEC, proposed revised rules on incentive-based payment arrangements at specified regulated entities having at least $1 billion in total assets (which would not include the Bank). The proposed revised rules would establish general qualitative requirements applicable to all covered entities, which would include: (i) prohibiting incentive arrangements that encourage inappropriate risks by providing excessive compensation; (ii) prohibiting incentive arrangements that encourage inappropriate risks that could lead to a material financial loss; (iii) establishing requirements for performance measures to appropriately balance risk and reward; (iv) requiring board of director oversight of incentive arrangements; and (v) mandating appropriate record-keeping.
Pursuant to rules adopted by the stock exchanges and approved by the SEC in January 2013 under the Dodd-Frank Act, public company compensation committee members must meet heightened independence requirements and consider the independence of compensation consultants, legal counsel and other advisors to the compensation committee. A compensation committee must have the authority to hire advisors and to have the public company fund reasonable compensation of such advisors.
Public companies will be required, once stock exchanges impose additional listing requirements under the Dodd-Frank Act, to implement “clawback” procedures for incentive compensation payments and to disclose the details of the procedures which allow recovery of incentive compensation that was paid on the basis of erroneous financial information necessitating a restatement due to material noncompliance with financial reporting requirements. This clawback policy is intended to apply to compensation paid within a three-year look-back window of the restatement and would cover all executives who received incentive awards.
Cybersecurity
In March 2015, federal regulators issued two related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyberattack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyberattack. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.
In June 2016, federal regulators also issued a joint statement on cybersecurity of interbank messaging and wholesale payment networks. This statement highlights that cyberattacks have targeted interbank messaging and wholesale payment networks, resulting in large-dollar fraud at several foreign institutions. The statement notes that financial institutions
15
Table of Contents
should review their risk management practices and controls over information technology and wholesale payment systems networks, including authentication, authorization, fraud detection, and response management systems and processes.
An increasing number of state laws and regulations have been enacted in recent years to implement privacy and cybersecurity standards and regulations, including data breach notification and data privacy requirements. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs that meet specified requirements. This trend of activity is expected to continue to expand, requiring continual monitoring of developments in the states and nations in which our customers are located and ongoing investments in our information systems and compliance capabilities.
In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. We employ an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of our defensive measures, the threat from cyberattacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date, we have not experienced a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our customers and third party service providers are under constant threat and it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our customers.
Future Legislation and Regulation
Congress may enact legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of the proposed legislation could affect the regulatory structure under which we operate and may significantly increase our costs, impede the efficiency of our internal business processes, require us to increase our regulatory capital or modify our business strategy, or limit our ability to pursue business opportunities in an efficient manner. Our business, financial condition, results of operations or prospects may be adversely affected, perhaps materially, as a result.