Risk Factors Dashboard
Once a year, publicly traded companies issue a comprehensive report of their business, called a 10-K. A component mandated in the 10-K is the ‘Risk Factors’ section, where companies disclose any major potential risks that they may face. This dashboard highlights all major changes and additions in new 10K reports, allowing investors to quickly identify new potential risks and opportunities.
View risk factors by ticker
Search filings by term
Risk Factors - CARE
-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing
ITEM 1A. RISK FACTORS
The Company has developed and implemented a Cybersecurity program intended to ensure the confidentiality, integrity, and availability of the Company’s critical systems and information. The Company has designed this Cybersecurity program based in part on the National Institute of Standards and Technology Cybersecurity Framework (“NIST”). Use of the framework does not imply that the Company meets any particular technical standards, specifications, or requirements, but rather the NIST is used as a guide to help identify, assess, and manage cybersecurity risks relevant to the Company’s business.•utilization of a third party to monitor elements of our Cybersecurity and IT environment continuously. During the years ended December 31, 2024 and December 31, 2023, the Company had no cybersecurity incidents that had a material adverse effects on its business, financial condition or results of operations. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "Risks Related to Our Operations and Technology," which is incorporated by reference into this Item 1C.The Company’s management has created an Incident Response Team (“IRT”), that consists of the Chief Operations Officer, a network manager, an application delivery manager, an information security manager, the IT Steering Committee, the regulatory
risk management director and an internal auditor. Our COO holds multiple cybersecurity industry-recognized certifications and has gained extensive cybersecurity knowledge and skills through over 7 years of work experience on the IT security team at the Company . Our Information Security Manager, who also holds multiple cybersecurity industry-recognized certifications and is a member of the IT Steering Committee, has 20 years of experience working in IT and cybersecurity in various roles and industries throughout his career. Additionally, leaders in the Company’s IT function receive periodic training and education on cybersecurity related topics. The IRT is governed by policies and procedures and their proactive responsibilities include implementing awareness programs for the overall cybersecurity risk management plan and for the supervision of vulnerability and penetration testing.
Investments in the Company’s common stock involves risks. In addition to the other information set forth in this Annual Report on Form 10-K, including the information addressed above under “Important Note Regarding Forward-Looking Statements,” investors in the Company’s common stock should carefully consider the risk factors discussed below. The following discussion highlights the risks that we believe are material to the Company, but the following discussion does not necessarily include all risks that we may face, and an investor in the Company’s common stock should not interpret the disclosure of a risk in the following discussion to state or imply that the risk has not already materialized. These factors could materially and adversely affect the Company’s business, financial condition, liquidity, results of operations, and capital position, and could cause the Company’s actual results to differ materially from its historical results or the results contemplated by the forward-looking statements contained in this Annual Report on Form 10-K, in which case, the trading price of the Company’s common stock could decline.
Risks Related to Credit
Nonperforming assets can take significant time to resolve and may adversely affect the Company’s results of operations and financial condition, and could result in further losses in the future.
As of December 31, 2024, our nonperforming loans totaled $259.3 million, or 7.15%, of the Company’s loan portfolio. The Company’s policy is to place loans in nonaccrual status when collection of interest or principal is doubtful, or generally when interest or principal payments are 90 days or more past due based on contractual terms. While the Company generally seeks to reduce or resolve problem assets through, among other methods, loan workouts, restructurings, or sales of the loans or underlying collateral, decreases in the value of the underlying collateral, decreases in the respective borrowers’ financial condition, profitability, or operating performance, or efforts by the respective borrowers’ to delay or avoid legal processes may inhibit such reduction or resolution efforts which, in turn, could adversely impact the Company’s business, financial condition and results of operations.
The Company’s nonperforming assets adversely affect its business, financial condition and results of operations in various ways. The Company does not record interest income on nonaccrual loans or OREO; thus nonperforming assets adversely affect the Company’s net income and returns on assets and equity, increase the Company’s loan administration costs and adversely affects the Company’s results of operations and efficiency ratio. The resolution of nonperforming assets requires significant time commitments from management which can adversely impact the Company’s and Bank’s other strategic and operational priorities. If the Bank takes collateral in foreclosure and via a similar proceeding, the Bank is required to mark the collateral to its then-fair market value, which may result in a loss, and the Bank will incur legal and other expenses, which may be significant, in connection with the foreclosure and sale process. Nonperforming loans and OREO can also increase the Company’s and the Bank’s risk profile and the level of regulatory capital that their respective banking regulators believe is appropriate. Nonperforming loans and OREO also can adversely impact the Company’s liquidity available with secondary liquidity sources, as the Bank is not able to pledge nonperforming loans and OREO as collateral for borrowings from these sources. FDIC expense has increased significantly due to the deterioration in asset quality as a direct result of one large nonperforming loan relationship, which is a component used to determine the assessment.
The Company’s financial results continue to be significantly impacted by loans in the Bank's Other segment of the Company’s loan portfolio, the significant majority of which have been on nonaccrual status since the second quarter of 2023. These loans, now reduced to judgments, relate to various entities in which James C. Justice, II has an interest (collectively, the “Justice Entities”), remain the Bank's largest credit relationship and comprise the significant majority of the Other segment with an aggregate principal amount of $252.0 million as of December 31, 2024. Since the Company placed these loans on nonaccrual status, the Company has been unable to accrue approximately $65.1 million of interest income, in the aggregate through December 31, 2024.
The Company’s level of credit risk is elevated due to relationship exposure to the Company’s largest credit relationship.
As of December 31, 2024, the Company’s largest credit relationship operates in the hospitality, agriculture and energy sectors and had loans outstanding with an aggregate principal amount of $252.0 million. All such loans are classified in the Other segment of the Company’s loan portfolio. During the second quarter of 2023, the Company placed these loans on nonaccrual status due to loan maturities and failure to pay in full. This credit relationship comprises 96.9% of the Company’s
20
nonperforming assets and 97.2% of the Company’s nonperforming loans and 7.0% of total portfolio loans at December 31, 2024.
The Company believes it is well secured based on the net carrying value of the credit relationship and it has appropriately reserved for expected credit losses with respect to all such loans based on information currently available. The Company has agreed on a path of curtailment and payoff of such loans and during 2024 the Company received $49.9 million of curtailment payments. However, the Company cannot give any assurance as to the timing or amount of future payments or collections on such loans or that the Company will ultimately collect all amounts contractually due. The Company is closely monitoring all developments that may impact collateral values or potential recoveries on its nonperforming loans, including claims that may be asserted by other purported creditors.
Any deterioration of this credit relationship, including adverse changes in the financial condition of the respective borrowers or guarantors, potential claims by other creditors of the respective borrowers, further litigation with the respective borrowers or guarantors or adverse changes in the value of collateral that secures this credit relationship, could require the Company to increase its allowance for loan losses or result in significant losses to the Company, which could have a material adverse effect on the Company’s business, financial condition and results of operations.
A large percentage of the Company’s commercial loans are secured by real estate, and an adverse change in the real estate market or in economic conditions more generally may result in losses and adversely affect our profitability.
Approximately 94.1% of the Company’s commercial loan portfolio as of December 31, 2024, was comprised of loans secured by real estate. An adverse change in the economy affecting occupancy and/or rental rates in the investment real estate market areas we serve could increase the likelihood of defaults. Real estate collateral securing the Company's loans are a secondary source of repayment in the event of unremedied defaults. The value of the Company's collateral could be impaired by changes in demand, rental rates and capitalization rates and could be insufficient to recover outstanding principal and interest. As a result, the Company’s profitability and financial condition could be negatively impacted by an adverse change in the real estate market.
The Company’s CRE loan portfolio is concentrated predominantly in North Carolina, Virginia, South Carolina, West Virginia and Georgia within the retail/restaurant, warehouse, hospitality, multifamily, and office sectors. As a result of this concentration of the Company’s loan portfolio, it may be more sensitive, as compared to more diversified institutions, to future disruptions in and deterioration of this market.
The Company relies on independent appraisals to determine the value of the real estate which secures a significant portion of our loans, and the values indicated by such appraisals may not be realizable if foreclosure on such loans is forced.
A significant portion of the Company’s loan portfolio consists of loans secured by real estate. We rely on independent appraisers to provide professional opinions of the value of such real estate. We rely on independent appraisers to estimate the value of such real estate. Appraisals are only estimates of value and the independent appraisers may make mistakes of fact or judgment that adversely affect the reliability of their appraisals. In addition, events occurring after the initial appraisal may cause the value of the real estate to increase or decrease. As a result of any of these factors, the real estate securing some of the loans may be more or less valuable than anticipated at the time the loans were made. If a default occurs on a loan secured by real estate that is less valuable than originally estimated, the Company may not be able to recover the outstanding balance of the loan.
Appraisal valuations can be impacted by changes in the equilibrium between supply and demand, changes in occupancy, lease rates and capitalization rates. Appraisals can also be impacted by the information available to the appraiser, including age of industry, market or borrower information, by access to property that is the subject of the appraisal, and by changing economic, industry or market conditions. The bank updates appraisals in connection with defined extensions of credit, which includes but is not limited to requests for additional loan funding, material changes to the loan’s amortization or material extensions of the maturity date. Additionally, the bank will generally update appraisals when the loan is considered collateral dependent and is either subject to Individually Evaluated Loan status or prior to the completion of a foreclosure initiating a collection process.
21
The Company’s level of credit risk is elevated due to the concentration of commercial real estate loans and commercial real estate construction loans in its portfolio.
As of December 31, 2024, the Company’s exposure to loans secured by commercial purpose real estate, including investment real estate loans related to hospitality, retail and multifamily apartments (but excluding construction) equated to $2.0 billion, or 54.5% of its total loan portfolio. The average balance of these loans are generally larger and these loans generally involve a more complex degree of financial and credit risk than loans secured by residential real estate. Repayment of these loans is dependent on the success of the borrower’s underlying business and/or the borrower’s ability to generate leases in order to receive sufficient cash flow to service its debts. The financial and credit risk associated with these loans is a result of several factors, including, but not limited to, macroeconomic conditions affecting supply, demand and property valuations, as well as larger balances in a smaller population of loans. The financial and credit risk associated with these loans is a result of several factors, including macroeconomic conditions affecting supply, demand and property valuations, as well as larger balances in a smaller population of loans.
The Company’s exposure to hospitality at December 31, 2024 equated to approximately $354.7 million, or 9.8% of its total loan portfolio. These were mostly loans secured by upscale or top tier flagged hotels, which have historically exhibited low leverage and strong operating cash flows.
The Company’s exposure to commercial real estate construction loans at December 31, 2024 equated to approximately $505.2 million, or 13.9% of total portfolio loans. Construction loans are inherently risky. These risks include, but are not limited to, potential adverse changes in material costs resulting in cost overruns, and the potential that the general contractors develop financial stress and are unable to complete projects and the speculative nature of lease up risk. These risks include, but are not limited to, potential adverse changes in material costs resulting in cost overruns, the potential that the general contractors develop financial stress and are unable to complete projects and the speculative nature of lease up risk. A severe downturn in real estate could affect demand for leases, capitalization rates and property valuations, which could adversely affect our financial condition and results of operations.
Our allowance for credit losses may be insufficient.
The measure of our allowance for credit losses (“ACL”) is dependent on the interpretation and application of the Current Expected Credit Losses (“CECL”) methodology. The CECL methodology reflects expected credit losses and requires consideration of a broader range of reasonable and supportable information to inform credit loss estimates. The CECL model may create more volatility in the Company’s level of ACL if materially increased, could adversely affect our business, financial condition, and results of operations. The CECL model may create more volatility in the Company’s level of ACL, which, if materially increased, could adversely affect our business, financial condition, and results of operations. There is no guarantee that our ACL will be sufficient to address credit losses, particularly if the economic outlook deteriorates significantly and quickly, or if a specific segment of the Company’s loan or borrower portfolio is adversely impacted by changing market or other conditions. In such an event, we may need to increase our ACL, which would result in provisions for credit losses that would reduce our earnings.
We have and will continue to implement further enhancements or changes to our methodology, models and the underlying assumptions, estimates and assessments, as needed.We will implement further enhancements or changes to our methodology, models and the underlying assumptions, estimates and assessments, as needed. If the assumptions or estimates we use in applying CECL are incorrect or we need to change our underlying assumptions and estimates, there may be a material adverse impact on our results of operation and financial condition. If the assumptions or estimates we use in adopting the new standard are incorrect or we need to change our underlying assumptions and estimates, there may be a material adverse impact on our results of operation and financial condition. Also, we may fail to accurately identify the appropriate economic indicators, to accurately estimate the timing of future changes in economic or market conditions, or to estimate accurately the impacts of future changes in economic or market conditions on our borrowers. Any of these failures could significantly impact the accuracy of our loss forecasts and allowance estimates and the sufficiency of our ACL.
Management evaluates the appropriateness of the ACL for the “Other” segment through the projected discounted cash flow analysis with various assumptions and multiple scenarios. The ACL analysis for the “Other” segment models a number of potential outcomes and scenarios, which are weighted based on probabilities as estimated by management based on current information available to us. It is difficult to predict how loans in the “Other” segment will ultimately be resolved, and therefore the discounted cash flow analysis, when aggregated, may not appropriately estimate expected losses in this segment.
Our real estate lending business can result in increased costs associated with Other Real Estate Owned (“OREO”).
Because we originate loans secured by real estate, we may have to foreclose on the collateral property to protect our investment and may thereafter own and operate such property, in which case we are exposed to the risks inherent in the ownership of real estate. We use methods for valuing collateral for individually evaluated loans and OREO that are in compliance with Accounting Standards Codification (“ASC”) Topic 310 Receivables. We use methods for valuing collateral for impaired loans and OREO that are in compliance with Accounting Standards Codification (“ASC”) Topic 310 Receivables. The methods require the use of assumptions that are subject to change based on events impacting real estate values. The amount that we may realize after a default is dependent upon factors outside of our control, including, but not limited to, general or local economic conditions, environmental cleanup
22
liability, neighborhood values, interest rates, real estate tax rates, operating expenses of the mortgaged properties, and supply of and demand for properties. Certain expenditures associated with the ownership of income producing real estate, principally real estate taxes and maintenance costs, may adversely affect the net cash flows generated by the real estate. Therefore, the cost of operating income-producing real property may exceed the rental income earned from such property, and we may have to advance funds to protect our investment or we may be required to dispose of the real property at a loss.
Risks Related to Market Conditions, Interest Rates and Investments
The Company’s business is subject to interest rate risk and fluctuations in interest rates may adversely affect its earnings and capital levels.
The majority of our assets are monetary in nature and, as a result, we are subject to significant risk from changes in interest rates. Changes in interest rates can impact our net interest income as well as the valuation of our assets and liabilities. Also, our earnings are significantly dependent on net interest income, which is the difference between interest income on interest-earning assets, such as loans and securities, and interest expense on interest-bearing liabilities, such as deposits and borrowings. We expect we will experience “gaps” in the interest rate sensitivities of our assets and liabilities, meaning that either our interest-bearing liabilities will be more sensitive to changes in market interest rates than our interest-earning assets, or vice versa. In either event, if market interest rates should move contrary to our position, this “gap” will work against us and our earnings may be negatively affected.
To combat rising inflation, between March of 2022 and July of 2023, the Federal Reserve raised the federal funds benchmark rate by a total of 525 basis points. During 2024, the Federal Reserve decreased interest rates by a total of 100 basis points beginning in September 2024, and during January 2025 held the target federal funds rate unchanged at 4.25% to 4.50%. Low interest rates can limit our interest rate spread and may adversely affect our business forecasts, and declines in the general level of interest rates may lead to an increase in prepayments on loans and increased competition for deposits. Increases in the general level of interest rates may, among other things, result in a change in the mix of noninterest and interest-bearing accounts, reduce the demand for loans or increase the rate of default on existing loans. These and other changes in the general level of market interest rates may affect net yield on interest-earning assets, loan origination volume, loan portfolios, and funding costs which impact our overall results. Accordingly, changes in the general level of market interest rates may affect net yield on interest-earning assets, loan origination volume, loan portfolios, and funding costs which impact our overall results.
Although our asset-liability management strategy is designed to control our risk from changes in the general level of market interest rates, market interest rates will be affected by many factors outside of our control, including inflation, recession, changes in unemployment, other economic conditions, money supply and international disorder and instability in domestic and foreign financial markets. It is possible that significant or unexpected changes in interest rates may take place in the future, and we cannot always accurately predict the nature or magnitude of such changes or how such changes may affect our business or results of operations.
The value of our investment securities could decline.
Changes in interest rates could cause the value of our investment securities to decline. We hold available-for-sale investment securities, which are carried at fair value, the majority of which are high-quality, liquid fixed income securities. The determination of fair value for certain of these securities requires significant judgment of management. Therefore, the market price we receive for our investment securities could be less than the carrying value for such securities. Further, the value of our investment portfolio could decline for numerous reasons, many of which are outside our control, including general market conditions, volatility in the securities market, changes in market interest rates, and inflation rates or expectations of inflation.Our inability to maintain the operating effectiveness of the controls described above could result in a material misstatement to our financial statements or other disclosures, which could have an adverse effect on our business, financial condition or results of operations. For example, increases in interest rates or changes in interest rate spreads may negatively impact the fair value of our investment securities and may adversely affect accumulated other comprehensive income and, thus, our equity levels.
Changes in interest rates could adversely affect our income and cash flows and may result in higher defaults and lower collateral values in a rising rate environment.
Changes in interest rates influence the origination of loans, the prepayment of loans, the fair value of existing assets and liabilities, the purchase of investments, the retention and generation of deposits, the rates received on loans and investment securities, and the rates paid on deposits or other sources of funding. In general, periods of rising interest rates and other inflationary pressures can have a significant negative effect on our borrowers, and particularly on borrowers that operate businesses that generate revenue to pay principal and interest on commercial loans. Periods of rising interest rates and other
23
inflationary pressures could cause the values of collateral securing our loans to decline. If either our borrowers are negatively impacted by rising interest rates or other inflationary pressures, or if the value of collateral securing our loans declines, our financial performance may be negatively impacted.
Inflation could negatively impact our business, our profitability, and our stock price.
Volatility and uncertainty related to inflation and the effects of inflation, may lead to increased costs for businesses and consumers and potentially contribute to poor business and economic conditions. For example, higher inflation, or volatility and uncertainty related to inflation, could reduce demand for the Company’s products, which could affect the creditworthiness of the Company’s borrowers, result in lower values for the Company’s investment securities and other interest-earning assets and increase expense related to talent acquisition and retention. If significant inflation continues the Company could result in missed earnings and budgetary projections causing our stock price to suffer.
Risks Related to Our Operations, Cybersecurity and Technology
A failure in or breach of our operational or security systems or infrastructure, or those of third parties, could disrupt the Company’s businesses, and adversely impact our results of operations, liquidity and financial condition, as well as cause reputational harm.
The Company’s operational and security systems, infrastructure, including our computer systems, data management, and internal processes, as well as those of third parties, are integral to our business. We rely on our associates and third parties in our day-to-day and ongoing operations, who may, as a result of human error, misconduct or malfeasance, or failure or breach of third-party systems or infrastructure, expose us to risk. We have taken measures to implement backup systems and other safeguards to support our operations, but our ability to conduct business may be adversely affected by any significant disruptions to us or to third parties with whom we interact. In addition, our ability to implement backup systems and other safeguards with respect to third-party systems is more limited than with our own systems.
The Company handles a substantial volume of customer and other financial transactions every day. Our financial, accounting, data processing, check processing, electronic funds transfer, loan processing, online and mobile banking, backup or other operating or security systems and infrastructure may fail to operate properly or become disabled or damaged as a result of a number of factors including events that are wholly or partially beyond our control. This could adversely affect our ability to process these transactions or provide these services. There could be sudden increases in customer transaction volume, electrical, telecommunications or other major physical infrastructure outages, natural disasters, events arising from local or larger scale political or social matters, including terrorist acts, and cyber-attacks. We continuously update these systems to support our operations and growth. This updating entails significant costs and creates risk associated with implementing new systems and integrating them with existing ones. Operational risk exposures could adversely impact our results of operations, liquidity and financial condition, and cause reputational harm.
A cyber-attack, information or security breach, or a technology failure of ours or of a third-party could adversely affect the Company’s ability to conduct business or manage exposure to risk, resulting in the disclosure or misuse of confidential or proprietary information, increase costs to maintain and update our operational systems, security systems, and infrastructure, and adversely impact results of operations, liquidity and financial condition, as well as cause reputation harm.
The Company’s business is highly dependent on the security and efficacy of our infrastructure, computer and data management systems, as well as those of third parties with whom we interact and rely upon. Cyber security risks for financial institutions have significantly increased in recent years in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties, including foreign state actors. Our operations rely on the secure processing, transmission, storage and retrieval of confidential, proprietary and other information in our computer and data management systems and networks, and in the computer and data management systems and networks of third parties. We rely on digital technologies, computer, database and email systems, software, and networks to conduct our operations. In addition, to access our network, products and services, our customers and third parties may use personal mobile devices or computing devices that are outside of our network environment.
24
Financial services institutions have been subject to, and are likely to continue to be the target of, cyber-attacks, including computer viruses, malicious or destructive code, phishing attacks, denial of service or other security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary and other information of the institution, its associates or customers or of third parties, or otherwise materially disrupt network access or business operations. For example, denial of service attacks have been launched against a number of large financial institutions and several large retailers have disclosed substantial cyber security breaches affecting debit and credit card accounts of their customers. We have not experienced material cyber security incidents in the past, but there is no assurance that we will not experience an attack in the future. We have not experienced cyber security incidents in the past, but there is no assurance that we will not experience an attack in the future. Technology failures, cyber-attacks or other information or security breaches can cause material losses or other material consequences, and even with all reasonable security efforts, not every system or network breach can be prevented or even detected. Furthermore, because some of our employees are working remotely from their homes, there is an increased risk of disruption to our operations because our employees’ residential networks and infrastructure may not be as secure as our office environment.
In addition to external threats, insider threats also represent a risk to us. Insiders, having legitimate access to our systems and the information contained in them, have the opportunity to make inappropriate use of the systems and information. We have policies, procedures and controls in place designed to prevent or limit this risk, but we cannot guarantee that such policies, procedures and controls fully mitigate this risk.
As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify and enhance our protective measures or to investigate and remediate any information security vulnerabilities or incidents. Any of these matters could result in loss of customers and business opportunities, significant disruption to our operations and business, misappropriation or destruction of our confidential information and/or that of our customers, damage to computers or systems of our customers and/or third parties, violation of applicable privacy laws and other laws, litigation, costs associated with customer notification and credit monitoring services, increased insurance premiums, regulatory fines, penalties or intervention, loss of confidence in our security measures, reputational damage, reimbursement or other compensatory costs, and additional compliance costs. In addition, any of the matters described above could adversely impact our results of operations and financial condition.
The Company relies on third-party providers and other suppliers for a number of services that are important to our business. An interruption or cessation of an important service by any third-party could have a material adverse effect on our business.
The Company is dependent for the majority of our technology, including our core operating system, on third-party providers. If these companies were to discontinue providing services to us, we may experience significant disruptions to our business. In addition, each of these third parties faces the risk of a cyber-attack, information breach or loss, or technology failure and there is no assurance that they have not or will not experience a system or network breach. If any of our third-party service providers experience such difficulties, or if there is any other disruption in our relationships with them, we may be required to find alternative sources of such services, which may not be on comparable or commercially reasonable terms. We are dependent on these third-party providers securing their information systems, over which we have no control, and any failure to maintain performance, reliability and security of these systems could have a significant adverse effect on our financial condition or results of operations. A breach of our third-party providers’ information systems could adversely affect our ability to process transactions, service our clients or manage our exposure to risk and could result in the disclosure of sensitive, personal customer information, which could have a material adverse impact on our business through damage to our reputation, loss of customer business, remedial costs, additional regulatory scrutiny or exposure to civil litigation and possible financial liability. Assurance cannot be provided that we could negotiate terms with alternative service sources that are as favorable or could obtain services with similar functionality as found in our existing systems without the need to expend substantial resources, if at all, thereby resulting in a material adverse impact on our business and results of operations.
The Company is dependent on its management team, and the loss of any senior executive officers or other key personnel could impair its relationship with its customers and adversely affect its business and financial results.The Company is dependent on its management team, and the loss of its senior executive officers or other key associates could impair its relationship with its customers and adversely affect its business and financial results.
We believe that our growth and future success will depend in large part on the skills of our executive officers. We also depend upon the experience of the senior executive officers and other key personnel and their relationship with the communities they serve. We also depend upon the experience of the senior officers and other key personnel and their relationship with the communities they serve. The loss of the services of one or more of these officers or key personnel could have an adverse impact on the business of the Company because of their skills, knowledge of the market, years of industry experience and the difficulty promptly finding qualified replacement personnel.
25
The success of our business strategies depends on our ability to identify and recruit individuals with experience and relationships in our primary markets.
The successful implementation of our business strategy will require us to continue to attract, hire, motivate and retain skilled personnel to develop new customer relationships as well as new financial products and services. The market for qualified management personnel is competitive, which has contributed to salary and employee benefit costs that have risen and are expected to continue to rise, which may have an adverse effect on the Company’s net income (loss). In addition, the process of identifying and recruiting individuals with the combination of skills and attributes required to carry out our strategy is often lengthy, and we may not be able to effectively integrate these individuals into our operations. Our inability to identify, recruit and retain talented personnel to manage our operations effectively and in a timely manner could limit our growth or impair our ability to implement our business strategy effectively and efficiently, which could materially adversely affect our business.
Risks Related to Liquidity
Adverse developments affecting the financial services industry, such as actual events or concerns involving liquidity, defaults, or non-performance by financial institutions or transactional counterparties, may have a material adverse effect on our financial condition and results of operations.
Actual events involving limited liquidity, defaults, non-performance or other adverse developments that affect financial institutions, transactional counterparties or other companies in the financial services industry or the financial services industry generally, or concerns or rumors about any events of these kinds or other similar risks, which may be compounded by the reach and depth of media attention, including social media, have in the past and may in the future lead to market-wide liquidity problems. Liquidity is essential to the Company’s banking business, and the Company’s business strategies are largely based on access to funding from customer deposits and supplemental funding provided by secondary liquidity sources, including wholesale funding facilities.
Deposit levels may be impacted by industry factors, market interest rates, rates paid for deposits by other financial institutions and market interest rates generally, inflationary conditions, general economic conditions than can impact savings rates, and banking industry conditions that can impact customers’ perceptions of the safety and soundness of the banking industry generally or of specific financial institutions. The failures of Silicon Valley Bank, Signature Bank and First Republic Bank in the first quarter of 2023, and the resulting industry turmoil, have underscored the importance of maintaining diversified funding sources to ensure the safety and soundness of a financial institution. It is uncertain whether, during periods of turmoil in the banking industry, actions to stabilize the banking industry will be sufficient to ensure continued funding and liquidity, reduce the risk of deposit outflows, and particularly sudden outflows, from banks. Should any of these conditions materialize, our liquidity, financial condition and results of operations could be materially and adversely impacted.
The Company’s liquidity could be impaired by an inability to access short-term funding or the inability to monetize liquid assets.
If significant volatility or disruptions occur in the wholesale funding or investment securities markets, the Company’s ability to access short-term liquidity could be materially impaired. In addition, other factors outside of the Company’s control could limit the Company’s ability to access short-term funding or to monetize liquid assets, including by selling investment securities at an attractive price or at all, operational issues that impact third parties in the funding or securities markets or unforeseen significant deposit outflows. The Company’s inability to access short-term funding or inability to monetize liquid assets could impair the Company’s ability to make new loans or meet existing lending commitments, and could adversely impact the Company’s overall financial condition, liquidity and regulatory capital.
We rely substantially on deposits obtained from customers in our target markets to provide liquidity and support growth, and impairment of our access to funding may negatively affect our financial performance.
Our primary funding and liquidity source to support our business strategies is a stable customer deposit base. Deposit levels may be affected by a number of factors, including interest rates paid by competitors, general interest rate levels, returns available to customers on alternative investments and general economic conditions. If our deposit levels fall, we could lose a relatively low-cost source of funding and our interest expense would likely increase as we obtain alternative funding to replace lost deposits. If local customer deposits are not sufficient to fund our normal operations and growth, we will look to outside sources, such as fed funds lines with other financial institutions or borrowings with the FHLB and we have access to the
26
institutional CD market and the brokered deposit market. We may also seek to raise funds through the issuance of shares of our common stock, or other equity or equity-related securities, or debt securities including subordinated notes as additional sources of liquidity. A number of factors, many of which are outside the Company’s control, could make accessing such financing more difficult or more expensive, or could make such financing unavailable altogether, including the financial condition of the Company, rate disruptions in the capital markets, the attractiveness of investing in or lending to financial services companies generally, and competition for funding from other banks, holding companies or similar financial service companies, some of which could be substantially larger or have stronger credit ratings or profiles. If we are unable to access funding sufficient to support our business operations and growth strategies or are only able to access such funding on unattractive terms, we may not be able to implement our business strategies which may negatively affect our financial performance.
Our ability to meet contingency funding needs, in the event of a crisis that causes a disruption to our core deposit base, is dependent on access to wholesale markets, including funds provided by the FHLB of Atlanta.
Significant unanticipated deposit outflows have occurred at other financial institutions and may occur in the future, compounded by advances in technology that increase the speed at which deposits can be moved from bank to bank or outside the banking system, as well as the speed and reach with which information, concerns and rumors can spread through media. This may exacerbate funding or liquidity concerns and result in significant contingency funding needs. Our financial flexibility could be severely constrained if we were unable to maintain our access to funding or if adequate financing is not available at acceptable interest rates.
Our primary contingency funding source is borrowings from the FHLB of Atlanta. We own stock in the FHLB of Atlanta, in order to qualify for membership in the FHLB system, which enables us to borrow on our line of credit with the FHLB that is secured by a blanket lien on select commercial loans, multifamily loans, residential mortgages and investment securities available-for-sale. As of December 31, 2024, that line of credit is estimated to be equal to 25% of our assets approximating $[1.2] billion, with available borrowing capacity subject to the amount of eligible collateral pledged at any given time. Changes or disruptions to the FHLB or the FHLB system in general may materially impact our ability to meet short and long-term liquidity needs. Additionally, we cannot be assured that the FHLB will be able to provide funding to us when needed, nor can we be certain that the FHLB will provide funds specifically to us, should our financial condition and/or our regulators prevent access to our line of credit. The inability to access this source of funds could have a materially adverse effect on our ability to meet our customer’s needs.
Other wholesale market sources of liquidity include the Fed discount window, the brokered CD market, and our four fed funds lines totaling $95.0 million with correspondent banks. Additionally, we have a large bond portfolio that can be used for liquidity purposes, including pledging or outright sales. We may compete with other banks or other financial institutions for borrowing capacity from these wholesale market sources, which may increase our cost of funding or make it more difficult to access these funding sources.
We rely on dividends from our subsidiaries for most of our revenue.
The Company is a separate and distinct legal entity from the Bank. A substantial portion of the Company’s revenue comes from dividends from the Bank. Various federal and Virginia laws and regulations limit the amount of dividends that the Bank may pay to us. Also, in the event the Bank is unable to pay dividends to the Company, the Company may not be able to service any debt that is outstanding, pay obligations, or pay any future dividends on its common stock. The inability to receive dividends from the Bank could have a material adverse effect on our business, financial condition, and results of operations.
Risks Related to Our Business Strategy
Our profitability depends significantly on economic conditions.
Our success depends primarily on the general economic conditions of the geographic markets in which we operate, primarily in Virginia and North Carolina. The local economic conditions in the areas where we operate have a significant impact on our commercial, real estate and construction loans, the ability of our borrowers to repay their loans and the value of the collateral securing these loans and on customer demand for loans, deposits and other bank products. A significant decline in general economic conditions, including pandemics or significant health hazards (such as the COVID-19 pandemic), inflation, recession, acts of terrorism, outbreak of hostilities (including the military conflict between Russia and Ukraine) or other international or
27
domestic calamities, unemployment or other factors, all of which are beyond our control, could impact economic conditions and negatively affect our financial results.
We face strong competition from financial services companies and other companies that offer banking services which could negatively affect our business.
We conduct our banking operations primarily in Virginia and North Carolina, including Fredericksburg, Charlottesville, Lynchburg, Roanoke, Blacksburg, Martinsville, and Danville in Virginia, and Greensboro, Charlotte, Raleigh and Mooresville in North Carolina. Increased competition in these markets may result in reduced loans and deposits. Ultimately, we may not be able to compete successfully against current and future competitors. Many competitors offer the same banking services that we offer in our service area. These competitors include national banks, regional banks and other community banks. We also face competition from many other types of financial institutions, including without limitation, savings and loan institutions, finance companies, brokerage firms, insurance companies, credit unions, mortgage banks and other financial intermediaries. In particular, our competitors include several major financial companies whose greater resources may afford them a marketplace advantage by enabling them to maintain numerous banking locations and ATMs, conduct extensive promotional and advertising campaigns and offer a wider range of products, services and technologies.
Additionally, banks and other financial institutions with larger capitalization and financial intermediaries not subject to bank regulatory restrictions have larger lending limits and are thereby able to serve the credit needs of larger customers. Areas of competition include interest rates for loans and deposits, efforts to obtain deposits, and range and quality of products and services provided, including new technology-driven products and services. Technological innovation continues to contribute to greater competition in domestic and international financial services markets as technological advances enable more companies to provide financial services, products and services traditionally provided by banks, such as automatic transfer and automatic payment systems. Technological innovation continues to contribute to greater competition in domestic and international financial services markets as technological advances enable more companies to provide financial services. We also face competition from out-of-state financial intermediaries that have opened loan production offices or that solicit deposits in our market areas. We also face competition from out-of-state financial intermediaries that have opened loan 26Table of ContentsCARTER BANKSHARES, INC. If we are unable to attract and retain banking customers, we may be unable to continue to grow our loan and deposit portfolios or may be required to increase the rates we pay on deposits or lower the rates we offer on loans and results of operations and financial condition may otherwise be adversely affected.
Our customers may increasingly decide not to use the Bank to complete their financial transactions, which would have a material adverse impact on our financial condition and operations.
Technology and other changes are allowing parties to complete financial transactions through alternative methods that have historically involved banks. For example, customers can now maintain funds that would have historically been held as bank deposits in brokerage accounts, mutual funds, or general-purpose reloadable prepaid cards. Customers can also complete transactions such as paying bills and/or transferring funds directly without the assistance of banks. We face increasing competition from fintech companies, as trends toward digital financial transactions have accelerated since the COVID-19 pandemic. The process of eliminating banks as intermediaries, known as “disintermediation,” could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits. The loss of these revenue streams and the lower cost of deposits as a source of funds could have a material adverse effect on our financial condition and results of operations.
Risks Related to Regulatory Compliance and Legal Matters
We are subject to extensive government regulation and supervision.
Banking regulations are primarily intended to protect depositors’ funds, federal deposit insurance funds and the banking system as a whole, not security holders. These regulations affect our lending practices, capital structure, investment practices, dividend policy and growth, among other things. Congress and federal regulatory agencies continually review banking laws, regulations and policies for possible changes. Changes to statutes, regulations or regulatory policies, including changes in interpretation or implementation of statutes, regulations or policies, could affect us in substantial and unpredictable ways. Such changes could subject us to additional costs, limit the types of financial services and products we may offer and/or increase the ability of non-banks to offer competing financial services and products, among other things. For example, we currently derive a portion of our noninterest income from consumer overdraft fees, which have recently come under scrutiny by banking regulators and politicians. Such regulators or politicians could act to impose additional restrictions on overdraft fee programs which could reduce our noninterest income, increase our compliance costs, or increase our exposure to regulatory and legal claims related to our overdraft program. Failure to comply with laws, regulations, policies or supervisory guidance could result in enforcement
28
and other legal actions by Federal or state authorities, including criminal and civil penalties, the loss of FDIC insurance, the revocation of a banking charter, other sanctions by regulatory agencies, civil money penalties and/or reputational damage. In this regard, government authorities, including the bank regulatory agencies, are pursuing aggressive enforcement actions with respect to compliance and other legal matters involving financial activities, which heightens the risks associated with actual and perceived compliance failures. See “Supervision and Regulation” included in Item 1, Business, of this Annual Report on Form 10-K for a more detailed description of the certain regulatory requirements applicable to the Bank.
The financial services industry may be subject to new or changing legislation, regulation, and government policy, which could affect the banking industry and the broader economy.
At this time, it is difficult to predict the legislative and regulatory changes that will result from the combination of President Trump’s reelection and both Houses of Congress having majority memberships from the Republican party. It appears that the Trump administration will seek to implement a regulatory reform agenda that is significantly different than that of the Biden administration, impacting the rule-making, supervision, examination and enforcement priorities of the federal banking agencies. Furthermore, the change in presidential administration has, and is expected to continue to, result in certain changes in the leadership and senior staffs of the federal banking agencies. Such changes are likely to impact the rule-making, supervision, examination and enforcement priorities and policies of the agencies. In addition, changes in key personnel at the agencies that regulate such banking organizations, including the federal banking agencies, may result in differing interpretations of existing rules and guidelines and potentially different enforcement priorities. The potential impact of any changes in agency personnel, policies, priorities, regulations and interpretations on the financial services sector, including us, cannot be predicted.
The new presidential administration and Congress also may cause broader economic changes due to changes in governing ideology and governing style, as well as changes to the size, scope and operations of the federal government. These changes could have varied effects on the economy that are difficult to predict. For example, changes in trade and fiscal policy could affect broader patterns of trade and economic growth. Additionally, comprehensive changes to the federal government could be materially adverse to the regional and local economies where we conduct business and to our customers, which, in turn, could be materially adverse to our business, financial condition and results of operations.Our inability to maintain the operating effectiveness of the controls described above could result in a material misstatement to our financial statements or other disclosures, which could have an adverse effect on our business, financial condition or results of operations.
Regulatory capital standards may require the Company and the Bank to maintain higher levels of capital and liquidity, which could adversely affect its return on equity and otherwise affect its business.
The Company and the Bank are each subject to capital adequacy guidelines and other regulatory requirements specifying minimum amounts and types of capital, which each must maintain. From time to time, regulators implement changes to these regulatory capital adequacy guidelines. In addition, regulators may require the Company to maintain higher levels of regulatory capital based on the Company’s condition, risk profile, or growth plans or conditions in the banking industry or economy. The Basel III capital adequacy standards applicable to the Company and the Bank impose stricter capital requirements and leverage limits than the requirements to which the Company and the Bank were subject in the past. The capital adequacy standards applicable to the Company and the Bank impose stricter capital requirements and leverage limits than the requirements to which the Company and the Bank were subject in the past.
The application of more stringent capital requirements could, among other things, result in lower returns on equity, require the raising of additional capital, and result in regulatory actions if the Company were to be unable to comply with such requirements. Furthermore, the imposition of liquidity requirements in connection with the implementation of Basel III capital adequacy standards could result in the Company having to lengthen the term of its funding, restructure its business models, and/or increase its holdings of liquid assets. Furthermore, the imposition of liquidity requirements in connection with the implementation of Basel III could result in the Company having to lengthen the term of its funding, restructure its business models, and/or increase its holdings of liquid assets. Implementation of changes to asset risk weightings for risk-based capital calculations, items included or deducted in calculating regulatory capital and/or additional capital conservation buffers could result in management modifying its business strategy, and could limit the Company’s ability to make distributions, including paying out dividends or buying back shares. Implementation of changes to asset risk weightings for risk-based capital calculations, items included or deducted in calculating regulatory capital and/or additional capital conservation buffers could result in management modifying its 27Table of ContentsCARTER BANKSHARES, INC. If the Company and the Bank fail to meet these minimum capital guidelines and/or other regulatory requirements, the Company’s financial condition would be materially and adversely affected.
Failure to maintain effective systems of internal control over financial reporting and disclosure controls and procedures could have a material adverse effect on our results of operation and financial condition.
Effective internal controls over financial reporting and disclosure controls and procedures are necessary for us to provide reliable financial reports and effectively prevent fraud and to operate successfully as a public company. We are required to establish and maintain an adequate internal control structure over financial reporting. If we cannot provide reliable financial reports or prevent fraud, our reputation and operating results would be harmed. As part of our ongoing monitoring of internal control, we may discover material weaknesses or significant deficiencies in our internal control that require remediation. A
29
“material weakness” is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of a company’s annual or interim financial statements will not be prevented or detected on a timely basis.
Our inability to maintain the operating effectiveness of the controls described above could result in a material misstatement to our financial statements or other disclosures, which could have an adverse effect on our business, financial condition or results of operations. In addition, any failure to maintain effective controls or to timely effect any necessary improvement of our internal and disclosure controls could, among other things, require significant investments of management time, funds and other resources in remediation efforts, result in losses from fraud or error or harm to our reputation, or cause investors to lose confidence in our reported financial information, all of which could have a material adverse effect on our results of operation and financial condition.
Claims and litigation against the Company could result in significant expenses or losses or damage to our reputation, which may have a material adverse effect on its financial condition, results of operation or business.
The Company operates in a business, legal and regulatory environment that exposes the Company to potential significant litigation risk. The Company may be involved from time to time in a variety of litigation arising out of its business, and the outcome of litigation and other legal matters is frequently uncertain. Litigation and claims against the Company can arise from the Company’s lending activities, commercial agreements, compliance programs, and other general business matters. Such litigation and claims have involved and could involve large amounts in controversy and substantial legal costs necessary for the Company’s defense or to recover amounts owed to the Company, and substantial legal liability, which may or may not be insured, against the Company could materially and adversely impact the Company’s financial condition and results of operations. Even if the Company has insurance coverage for certain claims or legal or administrative actions against it, the Company’s insurance may not cover all claims that may be asserted against it in legal or administrative actions or costs that it may incur defending such actions, and any claims asserted against it, regardless of merit or eventual outcome, may harm the Company’s reputation which may harm the Company’s business. Should the ultimate judgments or settlements and/or costs incurred in any litigation exceed any applicable insurance coverage, they could have a material adverse effect on the Company’s financial condition and results of operation for any period. Litigation may also divert management resources, which may adversely impact the Company’s business and results of operations.
Our risk management framework may not be effective in mitigating risk and loss.
We maintain an enterprise risk management program that is designed to identify, quantify, monitor, report and control the risks we face. These risks include, but are not limited to, interest rate, credit, liquidity, operational, reputation, legal, compliance, economic and litigation risk. Although we assess our risk management program on an ongoing basis and make identified improvements to it, we can offer no assurances that this approach and risk management framework (including related controls) will effectively mitigate the risks listed above or limit losses that we may incur. If our risk management program has flaws or gaps, or if our risk management controls do not function effectively, our results of operations, financial condition or business may be adversely affected.
Our earnings are significantly affected by the fiscal and monetary policies of the federal government and its agencies.
The policies of the FRB affect us significantly. The FRB regulates the supply of money and credit in the United States. Its policies directly and indirectly influence the rate of interest earned on loans and paid on borrowings and interest-bearing deposits and can also affect the value of financial instruments we hold. Those policies determine, to a significant extent, our cost of funds for lending and investing, and can significantly impact the levels of inflation in the United States. Changes in those policies are beyond our control and are difficult to predict. FRB policies can also affect our borrowers, potentially increasing the risk that they may fail to repay their loans. For example, a tightening of the money supply by the FRB could reduce the demand for a borrower's products and services. This could adversely affect the borrower’s earnings and ability to repay a loan, which could have a material adverse effect on our financial condition and results of operations.
30
Increased scrutiny and evolving expectations from customers, regulators, investors, and other stakeholders with respect to environmental, social and governance (“ESG”) practices may impose additional costs on the Company or expose it to new or additional risks.
As a regulated financial institution and a publicly traded company, we are facing increasing scrutiny from customers, regulators, investors, and other stakeholders related to ESG practices and disclosure. Investor advocacy groups, investment funds, and influential investors are increasingly focused on these practices, especially as they relate to climate risk, hiring practices, the diversity of the work force, and racial and social justice issues. Failure to adapt to or comply with regulatory requirements or investor or stakeholder expectations and standards could negatively impact the Company’s reputation, ability to do business with certain partners, and stock price. Government regulations could also result in new or more stringent forms of ESG oversight and expanding mandatory and voluntary reporting, diligence, and disclosure. ESG-related costs, including with respect to compliance with any additional regulatory or disclosure requirements or expectations, could adversely impact our results of operations.
The development and use of Artificial Intelligence (“AI”) presents risks and challenges that may adversely impact our business.
We or our third-party vendors, clients or counterparties may develop or incorporate AI technology in certain business processes, services, or products. The development and use of AI presents several potential risks and challenges to our business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving in the U.S. and internationally, and includes regulatory schemes targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment, and other laws applicable to the use of AI. These evolving laws and regulations could require changes in our implementation of AI technology and increase our compliance costs and the risk of non-compliance. AI models, particularly generative AI models, may produce output or take action that is incorrect, that reflects biases included in the data on which they are trained, that results in the release of private, confidential, or proprietary information, that infringes on the intellectual property rights of others, or that is otherwise harmful. In addition, the complexity of many AI models makes it difficult to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output, eliminating bias, and complying with regulations that require documentation or explanation of the basis on which decisions are made. Further, we may rely on AI models developed by third parties, and, to that extent, would be dependent in part on the manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which we may have limited visibility. Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures.
Risks Related to Owning Our Stock
The market price of our common stock may fluctuate significantly in response to a number of factors.
Our operating results may fluctuate due to a variety of factors, many of which are outside of our control, including the changing U.S. economic environment and changes in the commercial and residential real estate market, any of which may cause our stock price to fluctuate. If our operating results fall below the expectation of investors or securities analysts, the price of our common stock could decline substantially.
Our stock price can fluctuate significantly in response to a variety of factors including, among other things:
•volatility of stock market prices and volumes in general;
•changes in market valuations of similar companies;
•changes in the conditions of credit markets;
•changes in accounting policies or procedures as required by the Financial Accounting Standards Board, or other regulatory agencies;
•legislative and regulatory actions, including the impact of the Dodd-Frank Act and related regulations, that may subject us to additional regulatory oversight which may result in increased compliance costs and/or require us to change our business model;
31
•government intervention in the U.S. financial system and the effects of and changes in trade and monetary and fiscal policies and laws, including the interest rate policies of the FRB;
•additions or departures of key members of management;
•fluctuations in our quarterly or annual operating results; and
•changes in analysts’ estimates of financial performance.
Future issuances of the Company’s common stock could adversely affect the market price of the common stock and could be dilutive.
The Company is not restricted from issuing additional shares of common stock, and may issue securities that are convertible into or exchangeable for, or that represent the right to receive, shares of common stock. Issuances of a substantial number of shares of common stock, or the expectation that such issuances might occur, including in connection with acquisitions by the Company, could materially adversely affect the market price of the shares of common stock and could be dilutive to shareholders. Because the Company’s decision to issue equity securities in the future will depend on market conditions and other factors, it cannot predict or estimate the amount, timing, or nature of possible future stock issuances. Accordingly, the Company’s shareholders bear the risk that future stock issuances will reduce market prices and dilute their stock holdings in the Company.
Common stock is equity and is subordinate to the Company’s existing and future indebtedness and effectively subordinated to all the indebtedness and other non-equity claims against the Bank.
Shares of the Company’s common stock are equity interests and do not constitute indebtedness. As such, shares of the common stock will rank junior to all of the Company’s indebtedness and to other non-equity claims against the Company and its assets available to satisfy claims against it, including in the event of the Company’s liquidation. The Company is permitted to incur additional debt. Upon liquidation, lenders and holders of the Company’s debt securities would receive distributions of the Company’s available assets prior to holders of the Company’s common stock. Furthermore, the Company’s right to participate in a distribution of assets upon the Bank’s liquidation or reorganization is subject to the prior claims of the Bank’s creditors, including holders of any depositors of the Bank or any debt issued by the Bank.
32
CARTER BANKSHARES, INC. AND SUBSIDIARIES
ITEM 1B. UNRESOLVED STAFF COMMENTS
Not applicable.
ITEM 1C.ITEM 1A. CYBERSECURITY
Cybersecurity Risk Management and Strategy
The Cybersecurity and Information Technology programs are aligned to the Company’s business strategy. They share common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk management, including legal, compliance, strategic, operational, and financial risk. In the event of a material or potentially material cybersecurity event, senior members of management, which includes the Chief Financial Officer, are promptly informed of the event and status update, response, and disclosure efforts following the terms of a documented incident response plan. Key elements of the Cybersecurity and Information Technology programs include:
•risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader information technology (“IT”) environment;
•an incident response team principally responsible for managing cybersecurity risk assessment processes, security controls, and responses to cybersecurity incidents;
•the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;
•training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls;
•a cybersecurity and IT incident response plan that includes procedures for responding to cybersecurity incidents;
•utilization of independent third parties to perform penetration testing of the Company’s environment; and
Cybersecurity Governance
Management’s Role
33
CARTER BANKSHARES, INC. AND SUBSIDIARIES
The Company’s IRT serves as the central point for all cybersecurity incidents and reporting, including incidents that directly target associates, customers or the Company’s internal information systems and incidents originating from third parties. The IRT evaluates each incident in terms of its impact on the Company’s operations, ability to conduct business with customers, reputational risk to the Company, reduce legal risk and the speed and degree to which the incident has been contained. The IRT is also responsible for assessing the nature and scope of the incident, and engaging third-party service providers where appropriate to support the Company through the resolution of the incident. The COO escalates incidents to the Company’s IT Steering Committee, who is responsible for cybersecurity risk oversight, and also reports to the Board on a monthly basis.
Our information security team and members of IT monitor the effectiveness of preventative measures, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with law enforcement, regulators, external consultants, and reports produced by security tools we have deployed in our IT environment.
Board of Director’s Role
The Company’s Board of Directors recognizes the importance of cybersecurity in safeguarding the Company’s sensitive data, including with respect to its associates and customers. The Board is responsible for the consideration and oversight of risk facing the Company and is also responsible for ensuring that material risks are identified and managed appropriately, including cybersecurity risks. The COO gives a monthly report to the Company’s IT Steering Committee and Board on various information security issues. The Company has created and designated a separate committee of its Board as the Audit Committee consisting of four independent directors. The Audit Committee meets quarterly and reviews the Company’s major financial risk exposures, including cybersecurity risks, and reviews the steps management is taking to monitor and control such exposures, including results of internal and external audits.
Recently Filed
Click on a ticker to see risk factors
| Ticker * | File Date |
|---|---|
| CPPTL | 1 day, 16 hours ago |
| TUSK | 1 day, 17 hours ago |
| EQBK | 1 day, 17 hours ago |
| FSUN | 1 day, 17 hours ago |
| UBX | 1 day, 17 hours ago |
| BSTT | 1 day, 17 hours ago |
| NDLS | 1 day, 17 hours ago |
| FNRN | 1 day, 17 hours ago |
| SNBR | 1 day, 17 hours ago |
| FCBC | 1 day, 17 hours ago |
| MYFW | 1 day, 17 hours ago |
| BRDG | 1 day, 17 hours ago |
| AIMD | 1 day, 17 hours ago |
| GRND | 1 day, 17 hours ago |
| SPFI | 1 day, 17 hours ago |
| ATRA | 1 day, 17 hours ago |
| SGHT | 1 day, 17 hours ago |
| CMCT | 1 day, 17 hours ago |
| OB | 1 day, 17 hours ago |
| NABL | 1 day, 17 hours ago |
| NODK | 1 day, 17 hours ago |
| RGTI | 1 day, 17 hours ago |
| UNTY | 1 day, 17 hours ago |
| HBT | 1 day, 17 hours ago |
| ZCSH | 1 day, 17 hours ago |
| ETCG | 1 day, 17 hours ago |
| LXRX | 1 day, 17 hours ago |
| EBTC | 1 day, 17 hours ago |
| GSBC | 1 day, 18 hours ago |
| CCFN | 1 day, 19 hours ago |
| GPLB | 1 day, 19 hours ago |
| BCBP | 1 day, 19 hours ago |
| SBFG | 1 day, 19 hours ago |
| HMST | 1 day, 19 hours ago |
| CAC | 1 day, 19 hours ago |
| BMNM | 1 day, 20 hours ago |
| OFLX | 1 day, 20 hours ago |
| FSTR | 1 day, 20 hours ago |
| CARE | 1 day, 21 hours ago |
| IBCP | 1 day, 21 hours ago |
| BFST | 1 day, 22 hours ago |
| LFWD | 1 day, 22 hours ago |
| FNLC | 1 day, 23 hours ago |
| COOK | 2 days ago |
| ESPR | 2 days ago |
| FORR | 2 days, 1 hour ago |
| MASS | 2 days, 1 hour ago |
| ADV | 2 days, 1 hour ago |
| NBBK | 2 days, 1 hour ago |
| WHF | 2 days, 2 hours ago |
