FIRST BUSEY CORP NV

Busey’s framework for managing risks may not be effective in mitigating risk and loss.

Busey’s risk management framework seeks to mitigate risk and loss. It has established processes and procedures intended to identify, measure, monitor, report, and analyze the types of risk to which it is subject, compliance risk and reputational risk, among others. However, as with any risk management framework, there are inherent limitations. Risks may exist, or emerge in the future, that have not been appropriately identified or anticipated. As it continues to grow, Busey’s ability to successfully identify and manage the risks it faces is an important factor that can significantly impact results. If its risk management framework is not commensurate with its risk profile, Busey could suffer unexpected losses and could be materially adversely affected.

First Busey Corporation | 2023 — 45

Busey relies on the integrity of its operating systems and employees, and those of third-parties, and certain failures of such systems or error by employees or customers could materially and adversely affect Busey’s operations.

Communications and information systems are essential to conduct Busey’s business, as it uses such systems to manage customer transactions and relationships; the general ledger; and deposits, loans, and investments. However, the computer systems and network infrastructure Busey uses could be vulnerable to unforeseen problems as operations are dependent upon the protection of computer equipment against damage from physical theft, fire, power loss, telecommunications failure, or a similar catastrophic event, as well as from security events.

In addition, Busey outsources certain processing functions to third-party providers introducing additional layers of risk when these providers, in turn, outsource to fourth or fifth parties. This cascading outsourcing structure can heighten the complexity and potential challenges in communication, coordination, and risk management. If downstream providers encounter difficulties, or if Busey faces challenges in communicating with them, it may impact the ability to adequately process and account for customer transactions, adversely affecting business operations. Moreover, downstream providers could introduce specific risks related to compliance. Involvement of downstream parties in regions subject to sanctions or dealing with entities on prohibited lists poses an additional layer of regulatory risk.

Risks associated with multi-layered outsourcing arrangements include compliance concerns, potential disruptions, system or processing failures, and increased difficulty in overseeing and controlling actions of distant parties. While Busey implements due diligence procedures in reviewing and vetting its third-parties, the indirect risks arising from subsequent outsourcing levels are inherently more challenging to control or cannot be controlled.

Although Busey has established procedures to prevent or mitigate the effects of potential problems, technology-related disruptions, failures, and cybersecurity risks remain constant threats. Involvement of downstream parties further amplifies these risks, as Busey cannot guarantee the success of measures to prevent security breaches and disruptions. Any failure, interruption, or breach in the security of computer systems and network infrastructure, including those of downstream parties, could have a material adverse effect on Busey’s financial condition and results of operations.

Similarly, Busey is reliant upon its employees. Such dependencies create risks for potential losses resulting from employee errors, breakdowns in process or control, failures to properly execute change management, negligence, or a number of other factors outside Busey’s control. Busey maintains a system of internal controls and insurance coverage to mitigate operational risks, including data processing system failures and errors, customer or employee fraud, and other disruptions which might impact its business. Further, Busey’s Internal Audit department routinely reviews operations and high-risk areas for error, deficient controls, and failure to adhere to policy.

Potential legal actions, fines, and civil money penalties could arise as results of an operational deficiency or as a result of noncompliance with applicable regulatory standards, adverse business decisions or their implementation, and customer attrition due to potential negative publicity.

A breach in the security of Busey’s systems could disrupt its businesses, result in the disclosure of confidential information, damage its reputation, and create significant financial and legal exposure for Busey.

Although Busey devotes significant resources to maintain and regularly upgrade systems and processes designed to protect the security of its computer systems, software, networks, and other technology assets, these measures do not provide absolute security for the Company’s websites or other systems, some of which have been targeted with sophisticated intended to obtain unauthorized access to confidential information, destroy data, disable or degrade service, or sabotage systems, often through the introduction of computer viruses or malware, cyber-attacks, and other means. In addition, cyber attackers have persistently employed sophisticated campaigns to leverage individuals' fears and uncertainties. They capitalize on the increased

First Busey Corporation | 2023 — 46 volume of transactions occurring on digital channels, employing social engineering techniques to manipulate human psychology and perpetuate security breaches. Implementation of remote working arrangements that use virtual private networks, virtual conferencing services, and telecommunication technologies can increase insider risk, cybersecurity vulnerabilities, and other operational exposures. Industry trends in ransomware, phishing, and other intrusion methods have increased significantly and will continue to pose increased risk.

Threats to security also exist in the processing of customer information through various other third-parties, their personnel, and their use of subcontractors. Advances in computer capabilities, new discoveries in the field of cryptography, or other developments could result in a compromise or breach of the algorithms Busey and its third-party service providers use to encrypt and protect customer transaction data. Such cyber incidents may go undetected for a period of time. An inability by our third-party providers, and their third-party providers, to anticipate, detect, or adequately mitigate, breaches of security, known as “supply chain risk,” could result in a number of negative events, including losses to us or our clients, loss of business or clients, damage to our reputation, the incurrence of additional expenses, additional regulatory scrutiny or penalties, or exposure to civil litigation and possible financial liability, any of which could have a material adverse effect on our business, financial condition, results of operations, and growth prospects.

Busey also faces risks related to cyber-attacks and other security breaches in connection with credit card, debit card, and other payment-related transactions that typically involve the transmission of sensitive information regarding Busey’s customers through various third-parties, including merchant acquiring banks, payment processors, payment card networks, and processors. Cyber-attacks or other breaches, whether affecting Busey or others, could intensify consumer concern and regulatory focus and result in breach and fraud-related losses as well as increased costs, all of which could have a material adverse effect on Busey’s business.

Penetration or circumvention of Busey’s security systems could result in serious negative consequences for the Company, including significant disruption of Busey’s operations, misappropriation of Busey’s confidential information or that of its customers or employees, or damage to Busey’s computers or systems and those of its customers and counterparties. Such events could result in violations of applicable privacy and other laws, financial loss to Busey or its customers, loss of confidence in Busey’s security measures, customer dissatisfaction, significant litigation exposure, and harm to Busey’s reputation, all of which would adversely affect the Company.

These risks have increased for all financial institutions globally as new technologies, the use of the Internet and telecommunications technologies, including mobile devices, to conduct financial and other business transactions, and the sophistication and activities of malicious individuals and organizations have increased substantially. Despite Busey’s significant investment in security resources and its continued efforts to prevent or limit the effects of potential threats, it is possible that Busey may not be able to anticipate or implement effective preventative measures against all security incidents.

Customer or employee misconduct or fraud may affect operations, result in significant financial loss, and have an adverse impact on Busey’s reputation.

Misconduct by employees and customers could include hiding unauthorized activities, conducting improper or unauthorized activities, or improper use of confidential information. Customer or other outsiders may also attempt to perpetuate fraud or scams in the form of identity theft, money laundering, fraudulent or altered deposits, or use of counterfeit instruments, as a few examples. Busey also faces fraud risk associated with the origination of loans, including the intentional misstatement of information in property appraisals or other underwriting documentation provided to it by customers or by third-parties. Customers may expose Busey to certain fraud risks associated with the compromise of their computing systems or accounts, as well.

First Busey Corporation | 2023 — 47

Both the number and sophistication level of attempted fraudulent transactions are increasing. Should our internal controls fail to prevent or detect an occurrence of fraud, or if any resulting loss is not insured or exceeds applicable insurance limits, it could have a material adverse effect on Busey’s business, results of operations, and financial condition.

Busey’s ability to attract and retain key personnel may affect future growth and earnings.

Busey's leadership landscape recently underwent changes as Busey and Robin N. Elliott, the President and Chief Executive Officer of Busey Bank, who also served as Chairman of the Board and Chief Executive Officer of FirsTech, mutually agreed upon the decision to part ways. In connection with this transition, Van A. Dukeman, the Chairman, President, and Chief Executive Officer of First Busey Corporation has taken on the additional role of President and Chief Executive Officer of Busey Bank. Busey’s ability to attract and retain management experienced in banking and financial services, including its current executive officers, management teams, lending and retail banking officers, and administrative staff of its subsidiaries, is crucial for the successful implementation of its strategy. Additionally, Busey's ability to retain key personnel at acquired financial institutions is vital for its growth strategy through mergers and acquisitions. Equally critical is Busey’s commitment to attracting and retaining diverse and qualified staff with the appropriate level of experience and knowledge about its market areas, essential for implementing its community-based operating strategy. The unexpected loss of services of key personnel or the inability to recruit and retain qualified personnel in the future could have an adverse effect on Busey’s business, financial condition, and results of operation.

Damage resulting from negative publicity could harm Busey’s reputation and adversely impact its business and financial condition.

Busey’s ability to attract and retain customers, investors, and employees is contingent upon maintaining trust. Negative public opinion could result from the Company’s actual or alleged conduct in a number of activities, including, but not limited to, employee misconduct, a failure or perceived failure to deliver appropriate standards of service and quality or to treat customers fairly, faulty lending practices, compliance failures, security breaches, corporate governance, sharing or inadequate protection of customer information, failure to comply with laws or regulations, and actions taken by government regulators and community organizations in response to that conduct. The results of such actual or alleged misconduct could include customer dissatisfaction, inability to attract potential acquisition prospects, litigation, and heightened regulatory scrutiny, all of which could lead to lost revenue, higher operating costs, and harm to Busey’s reputation. No assurance can be made, despite the cost or efforts made by the Company to address the issues arising from reputational harm, that results could not adversely affect Busey’s business, financial condition, and results of operations.

Emerging risks associated with Generative Artificial Intelligence and other Large Language Models are dynamic and evolving rapidly as the technology advances and regulatory frameworks develop.

While our current operational framework excludes the use of GAI in our internal processes, the usage of such technologies introduces a spectrum of risks across various dimensions:

•Fraud and Security– Advanced social engineering capabilities for phishing and vishing attacks, as well as the ability to generate impersonation attacks using so called “deep fakes” leading to impacts including, but not limited to, unauthorized access, fraudulent transactions, and data breach.

•Intellectual Property and Copyright Concerns– Risks stemming from unclear legal disputes and potential financial liabilities due to the unauthorized use of copyrighted materials leading to legal challenges.

•Potential Opacity and Bias in Models– Challenges related to the interpretability of models and potential biases, presenting risks of model misinterpretation and unintended consequences.

First Busey Corporation | 2023 — 48

•Data Privacy– Unauthorized use of company or customer data in the training of GAI models.

•Compliance Challenges– The potential inability to quickly adapt to, or the high costs associated with adapting to, regulatory changes, leading to compliance gaps and associated penalties.

Moreover, an additional concern with GAI pertains to the utilization of voice-enabled AI for communicating promotional messages to our customer base. As we proactively assess and address these emerging risks, our commitment to robust risk management remains integral to sustaining operational resilience.