FIRST BUSEY CORP NV

Busey’s framework for managing risks may not be fully effective in mitigating risk and loss.

Busey’s risk management framework is designed to identify, measure, monitor, and analyze a broad spectrum of risks, including compliance, operational, and reputational risks. However, as with any framework, inherent limitations exist, particularly as new risks emerge or previously unidentified vulnerabilities become apparent.

The effectiveness of this framework depends on its alignment with Busey’s evolving risk profile, especially in light of the planned CrossFirst merger. As the organization grows in complexity, risks related to integration, system coordination, and operational oversight may challenge the framework's capacity to adapt. Failures to effectively manage these risks could adversely impact Busey’s financial condition, regulatory standing, and overall operational stability.

To address these challenges, Busey continuously refines its processes, leveraging advanced risk assessment tools and seeking alignment with industry best practices. Despite these efforts, no risk management framework is foolproof, and unforeseen losses or disruptions remain a possibility.

Technological investments drive efficiency but introduce cybersecurity risks.

Busey’s ongoing investments in technology infrastructure have strengthened operational efficiency, enhanced client service delivery, and supported the scaling of key business functions. Initiatives such as enterprise-wide automation, cloud integration, and enhanced data analytics capabilities have positioned Busey as a forward-thinking financial institution. However, these advancements introduce vulnerabilities, including the risk of cyber-attacks and operational disruptions.

The Federal Reserve’s November 2024 Financial Stability Report has emphasized growing threats posed by sophisticated cyber-attacks. These threats not only compromise data integrity but also pose significant reputational and financial risks. For example:

First Busey Corporation(BUSE) | 2024 —44

•Supply Chain Risk Amplification: Third-party vendors and their subcontractors introduce multi-layered risks, complicating oversight and heightening the likelihood of service interruptions or compliance breaches.

•Advanced Cyber Threats: As bad actors deploy increasingly sophisticated tactics, including artificial intelligence-driven impersonation and malware, the effectiveness of traditional cybersecurity defenses is diminished.

To mitigate these risks, Busey has implemented robust cybersecurity protocols, regular system audits, and incident response plans. The use of artificial intelligence-powered tools, such as Verafin, provide additional layers of fraud detection, enabling proactive threat management. However, as cybersecurity threats evolve, the possibility of system penetration persists even with robust security protocols in place.

Outsourcing dependencies could disrupt operations and increase compliance risks.

Busey’s reliance on secure and resilient systems to manage customer relationships, transactions, and data underscores the critical importance of operational stability. Outsourcing arrangements introduce risks tied to service disruptions, compliance violations, and vulnerabilities stemming from subcontractors in downstream supply chains.

This cascading outsourcing structure adds complexity to communication and coordination, particularly when vendors operate in regions with varying regulatory standards. Risks are further amplified by geopolitical tensions, trade restrictions, or cyberattacks targeting these external partners.

Failures or breaches in these systems could disrupt Busey’s operations, damage its reputation, or result in significant legal exposure. While Busey conducts rigorous due diligence when selecting third-party providers, residual risks from subsequent outsourcing tiers remain challenging to eliminate entirely.

Fraudulent activities could erode financial stability and customer trust.

The rising sophistication of fraudulent schemes poses a persistent challenge for financial institutions, with Busey being no exception. Fraudulent activities, such as identity theft, phishing, and unauthorized transactions, could result in financial losses, regulatory penalties, and erosion of customer trust.

Busey employs a multi-layered approach to fraud prevention, including internal controls, insurance coverage, and advanced fraud detection tools, like Verafin. However, even robust frameworks may not fully eliminate risks, particularly as threat actors adapt their tactics to exploit emerging vulnerabilities.

Busey’s ability to attract and retain key personnel may affect future growth and earnings.

Busey’s ability to attract and retain experienced management and qualified personnel is critical to sustaining growth and executing its strategic objectives. The leadership transitions associated with the CrossFirst merger highlight the importance of talent management in preserving operational continuity.

In addition to retaining key leaders, Busey’s ability to build a diverse and skilled workforce is essential to implementing its community-based strategy effectively. The unexpected departure of high-performing employees or difficulty in recruiting specialized talent could disrupt operations, delay strategic initiatives, or increase costs associated with workforce realignment.

First Busey Corporation(BUSE) | 2024 —45

Damage resulting from negative publicity could harm Busey’s reputation and adversely impact its business and financial condition.

Busey’s ability to attract and retain customers, investors, and employees is contingent upon maintaining trust. Negative public opinion could result from the Company’s actual or alleged conduct in a number of activities, including, but not limited to, employee misconduct, failure or perceived failure to deliver appropriate standards of service and quality, faulty lending practices, compliance failures, security breaches, corporate governance, sharing or inadequate protection of customer information, failure to comply with laws or regulations, and actions taken by government regulators and community organizations in response to that conduct.

The CrossFirst merger further underscores the importance of preserving a positive reputation during this period of transformation. Mergers often attract heightened scrutiny from regulators, investors, and the public, amplifying the potential for reputational risks. Missteps in integration, such as service disruptions, a perceived decline in quality, or employee dissatisfaction could adversely impact public perception.

The results of such actual or alleged misconduct or missteps could include customer dissatisfaction, inability to attract potential acquisition prospects, litigation, and heightened regulatory scrutiny. These outcomes may lead to lost revenue, higher operating costs, and harm to Busey’s reputation. Despite the cost or efforts made by the Company to address issues arising from reputational harm, there is no assurance that these efforts could fully mitigate adverse impacts on Busey’s business, financial condition, and results of operations.

Rapid adoption of generative artificial intelligence technologies introduces operational vulnerabilities.

The rapid adoption of generative artificial intelligence technologies introduces a range of operational risks, including intellectual property disputes, compliance challenges, and data privacy concerns. The use of artificial intelligence in fraud schemes, such as impersonation attacks and social engineering, underscores the urgency of proactive governance.

Busey remains committed to addressing these risks through advanced technological tools, regular assessments, and collaboration with industry peers to stay ahead of evolving threats.