Princeton Bancorp, Inc.

Current report

realize income from the spread between the interest we earn on loans, securities and other interest earning assets, and the interest we pay on deposits, and borrowings (when applicable). The net interest spread is affected by the differences between the maturity and repricing characteristics of our interest earning assets and interest-bearing liabilities. Our interest-earning assets may not reprice as slowly or rapidly as our interest-bearing liabilities.

Current report

Instability in global economic conditions and geopolitical matters could have a material adverse effect on our results of operations and financial condition.

Current report

Instability in global economic conditions and geopolitical matters could have a material adverse effect on our results of operations and financial condition. The macroeconomic environment in the U.S. is susceptible to global events and volatility in financial markets. For example, global conflicts (including the continuing conflicts involving Ukraine and the Russian Federation and those in the Middle East) or other similar events, as well as government actions of other restrictions in connection with such events, and trade negotiations between the U.S. and other nations could adversely impact economic and market conditions for the Company and its clients and counterparties. In addition, global supply chain disruptions may cause prolonged inflation, adversely impact consumer and business confidence, and adversely affect the economy as well as our financial condition and results.

Current report

We use AI in connection with our business and operations, which exposes us to inherent risks that may expose us to material harm.

Current report

AI in the banking industry refers to the use of advanced algorithms, machine learning, and automation to enhance operational efficiency, improve customer experiences, strengthen security, and optimize financial decision-making. Banks leverage AI for fraud detection, risk assessment, predictive analytics, chatbots for customer service, personalized financial recommendations, and automated regulatory compliance. By analyzing vast amounts of data in real time, AI helps institutions reduce costs, mitigate risks, detect anomalies, and deliver more efficient and secure banking services.

Current report

The Bank does not utilize AI for decision-making processes or internal bot usage as any automation within the Bank is driven by macros and predefined rule-based workflows rather than AI-driven models. AI technology, however, is employed within select third-party solutions integrated into our operations. These include SentinelOne for advanced cybersecurity threat detection and response, Verafin for fraud detection and AML compliance, the Glia Chatbot for enhancing customer service interactions, and CATO Networks for AI-driven network security and optimization. These third-party tools that utilize a limited AI model support security, risk management, and operational efficiency but do not influence credit, lending, or other decision-making functions within the Bank. We do not believe that these products pose a material risk on the company’s business or financial results.

Current report

AI is complex and rapidly evolving, and the introduction of AI, a relatively new and emerging technology in the early stages of commercial use, into our business and operations may subject us to new or heightened legal, regulatory, ethical, operational, reputational, or other risks. The models underlying AI may be incorrectly or inadequately designed or implemented and trained on, or otherwise use, data or algorithms that are, and output that may be, incomplete, inadequate, misleading, biased, poor-quality or otherwise flawed, any of which may not be easily detectable. Further, inappropriate or controversial data practices by developers andend-users or other factors adversely affecting public opinion of AI could impair the acceptance of AI, including those incorporated in our business and operations. If the AI that we use is deficient, inaccurate or controversial, we could incur operational inefficiencies, competitive harm, legal and regulatory action, brand or reputational harm, or other adverse impacts on our business and financial results. Further, there can be no assurance that our use of AI will be successful in enhancing our business or operations or otherwise result in our intended outcomes, and our competitors may incorporate AI into their businesses or operations more quickly or more successfully than us.

Current report

AI and the use thereof is also subject to a variety of existing laws and regulations, including fair lending, consumer protection, intellectual property, cybersecurity, data privacy, and equal opportunity, and is expected to be subject to new laws and regulations or new applications of existing laws and regulations. AI is the subject of evolving review by various governmental and regulatory agencies, and changes in laws and regulations governing AI may adversely affect our ability to use AI. Additionally, various federal, state and foreign governments and regulators have implemented, or are considering implementing, general legal and regulatory frameworks for the appropriate use of AI. It is possible that we will not be able to anticipate how to respond to these rapidly developing laws and regulations. Further, if we do not have sufficient rights to use the data or algorithms on which our AI solutions rely or the output generated thereby, we also may incur liability through the violation of applicable laws and regulations, such as fair lending laws and regulations, third-party intellectual property, privacy or other rights, or contracts to which we are a party. We may not be able to sufficiently mitigate or detect any of the foregoing risks or concerns given our and other market participants’ lack of experience with using AI, the pace of technological change, and rapid adoption of AI by our business partners and competitors. Any actual or perceived failure to address risks or concerns relating to the use of AI, whether unfounded or not, could adversely affect our business and operations.

Current report

We face risks from cyber-attacks and other information or security breaches, including denial of service attacks, hacking, social engineering attacks targeting our colleagues, contractors, and customers, malware intrusion or data corruption attempts, and identity theft that could result in the disclosure of confidential, proprietary, personal and other information, any of which could adversely affect our business or reputation, and create significant legal and financial exposure.

Current report

Our computer and data management systems and network infrastructure, and those of third parties on which we are highly dependent, are subject to cybersecurity risks and could be susceptible to cyber-attacks or other information or security breaches. Our business relies on the secure processing, transmission, storage, and retrieval of confidential, proprietary, personal, and other information in our computer and data management systems and network infrastructure, and in the computer and data management systems and network infrastructure of third parties. In addition, to access our network, products, and services, our customers and other third parties may use personal mobile devices or computing devices that are outside of our network environment and are subject to their own cybersecurity risks.

Current report

We, our customers, regulators, and other third parties, including other financial services institutions and companies engaged in data processing, have been subject to, and are likely to continue to be the target of, cyber-attacks or other information or security breaches. These cyber-attacks or other information or security breaches include computer viruses, denial of service attacks, hacking, social engineering attacks (including phishing and smishing attacks) targeting our colleagues, contractors, and customers, malware intrusion or data corruption attempts, ransomware, improper access by employees or contractors, identity theft, and other security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss, destruction, or other processing of confidential, proprietary, personal, and other information of ours, our employees, our customers, or of third parties, damage our systems and infrastructure or otherwise materially disrupt our, our customers’, or other third parties’ network access or business operations. As cyber-attacks or other information or security breaches continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any cybersecurity vulnerabilities or cyber-attacks or other information or security breaches. Despite efforts to ensure the integrity of our systems and implement controls, processes, policies, and other protective measures, we may not be able to anticipate all security breaches, nor may we be able to implement sufficient preventive measures against such cyber-attacks or other information or security breaches, which may result in material losses or consequences for us.

Current report

Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, including AI, and the use of the internet and telecommunications technologies to conduct financial transactions. For example, cybersecurity risks may increase in the future as we continue to increase our mobile-payment and other internet-based product offerings and expand our internal usage ofweb-based products and applications. In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of cyber threat actors, such as organized crime affiliates, terrorist organizations, state-sponsored actors, hostile foreign governments, disgruntled employees or vendors, activists, and other external parties, including those involved in corporate espionage, any of whom may enhance their efforts through the use of AI. Even the most advanced internal control environment may be vulnerable to compromise. Due to increasing geopolitical tensions, nation state cyber-attacks and ransomware are both increasing in sophistication and prevalence. Targeted social engineering and email attacks (i.e., “spear phishing” attacks) are becoming more sophisticated and are extremely difficult to prevent. In such an attack, an attacker will attempt to fraudulently induce colleagues, contractors, customers, clients, or other users of our systems and infrastructure to disclose sensitive information in order to gain access to our, our customers’, or our clients’ systems and infrastructure, or the confidential, proprietary, personal, or other information stored or processed thereon. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cyber threat actors change frequently, may not be recognized until launched, and may not be recognized until well after a cyber-attack or other information or security breach has occurred. The speed at which new vulnerabilities are discovered and exploited, often before security patches are published, continues to rise. Remote work further increases the risk that we may experience cyber-attack or other information or security breaches as a result of our employees, colleagues, contractors, and other third parties with which we do business or upon which we rely working remotely on less secure systems and environments.

Current report

The risk of a security breach caused by a cyber-attack or other information security breach at a third party with which we do business or upon which we rely, or by unauthorized access by such third party, has also increased in recent years. Additionally, the existence of cyber-attacks or other information or security breaches at such third parties with access to our confidential, proprietary, personal, and other information may not be disclosed to us in a timely manner. Further, our ability to monitor such third parties’ cybersecurity practices is limited. Although we generally have agreements relating to cybersecurity and data privacy in place with third parties, we cannot guarantee that such agreements will prevent a cyber-attack or other information or security breach impacting our confidential, proprietary, personal, or other information, or enable us to obtain adequate or any reimbursement from such third parties in the event we should suffer any disruption, compromise, failure, liability, reputational harm, or other cost or expense. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber-attacks or other information or security breaches attributed to such third parties as they relate to the information we share with them.

Current report

Cyber-attacks or other information or security breaches, whether directed at us or third parties, may result in a material loss or have material consequences. Furthermore, the public perception that a cyber-attack or other information or security breach on our systems or infrastructure has been successful, whether or not this perception is correct, may damage our reputation with customers, clients, and third parties with which we do business. Hacking of confidential, proprietary, personal, and other information and identity theft risks, in particular, could cause serious reputational harm. A successful penetration or circumvention of our cybersecurity measures could cause us serious negative consequences, including: loss of customers, clients, and business opportunities; costs associated with maintaining business relationships after a cyber-attack or other information or security breach; significant business disruption to our operations and business, misappropriation, exposure, or destruction of our confidential, proprietary, personal, and other information, intellectual property, funds, and/or those of our customers or clients; or damage to our, our customers’, our clients’, and/or third parties’ systems or infrastructure. The occurrence of any of these events could result in a violation of applicable data privacy laws and regulations and other laws and regulations, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in our cybersecurity measures, reputational damage, reimbursement or other compensatory costs, additional compliance costs, and could adversely impact our results of operations, liquidity, and financial condition. In addition, we may not have adequate insurance coverage to compensate for losses from a major cyber-attack or other information or security breach. We also cannot be sure that our existing insurance coverage will continue to be available on acceptable terms or at all or that our insurers will not deny coverage to any future claim.

Current report

We depend on our executive officers and key personnel to continue the implementation of our long-term business strategy and could be harmed by the loss of their services.

Current report

We believe that our continued growth and future success will depend in large part on the skills of our management team and our ability to motivate and retain these individuals and other key personnel. The loss of service of one or more of our executive officers or key personnel could reduce our ability to successfully implement our long-term business strategy, our business could suffer, and the value of our stock could be materially adversely affected. Leadership changes will occur from time to time, and we cannot predict whether significant resignations will occur or whether we will be able to recruit additional qualified personnel. We believe our management team possesses valuable knowledge about the banking industry and that their knowledge and relationships would be very difficult to replicate. Our success also depends on the experience of our branch managers and lending officers and on their relationships with the customers and communities they serve. The loss of these key personnel could negatively impact our banking operations. The loss of key personnel could have an adverse effect on our business, financial condition, or operating results.

Current report

Our goodwill could become impaired in the future. If goodwill were to become impaired, it could limit the ability of the Bank to pay dividends to the Company, adversely impacting the Company’s liquidity and ability to pay dividends or repay debt. Assumptions affecting our goodwill impairment evaluation include earnings projections, the discount rates used in the income approach to measure fair value, and observed peer multiples used in estimating the fair value under the market approach. We are required to test goodwill for impairment at least annually or when impairment indicators are present. If an impairment determination is made in a future reporting period, our earnings and book value of goodwill will be reduced by the amount of the impairment. If an impairment loss is recorded, it will have little or no impact on the tangible book value of our common stock, or our regulatory capital levels, but such an impairment loss could significantly reduce the Bank’s earnings and thereby restrict the Bank’s ability to make dividend payments to us without prior regulatory approval, which in turn could impact our ability to pay dividends. At December 31, 2024, the book value of our goodwill was $14.4 million, all of which was recorded at the Bank. Any such write down of goodwill or other acquisition related intangibles will reduce the Company’s earnings, as well.

Previous report

• Risks Related to the Pending Acquisition of Cornerstone

Previous report

RISKS RELATED TO THE COMPANY’S PENDING ACQUISITION OF CORNERSTONE

Previous report

Regulatory approvals may not be received, may take longer than expected or may impose conditions that are not presently anticipated or that could have an adverse effect on the Company following the transaction.

Previous report

In connection with the Company’s pending acquisition of Cornerstone (See Item 1. Business – General), before the acquisition can be completed, the Company and the Bank must obtain approval of the acquisition from the FDIC, the New Jersey Department of Banking and Insurance and the Federal Reserve. In determining whether to grant these approvals, the regulators consider a variety of factors, including the regulatory standing of the Company, the Bank and Cornerstone, and other factors. An adverse development in either party’s regulatory standing or these factors could result in an inability to obtain approval or a delay in their receipt. These regulators may impose conditions on the completion of the acquisition or require changes to the terms of the Merger Agreement. Such conditions or changes could have the effect of delaying or preventing completion of the acquisition or imposing additional costs on or limiting the revenues of the Company following the completion of the acquisition, any of which might have an adverse effect on the Company following the acquisition.

Previous report

The acquisition may be more difficult, costly or time-consuming than expected and the anticipated benefits of the transaction may not be realized.

Previous report

The success of the acquisition, including anticipated benefits, will depend, in part, on the Company’s ability to successfully combine and integrate Cornerstone into the Company in a manner that permits growth opportunities and does not materially disrupt the existing customer relations nor result in decreased revenues due to loss of customers. It is possible that the integration process could result in the loss of key employees, the disruption of the Bank’s ongoing business or inconsistencies in standards, controls, procedures and policies that adversely affect the Bank’s ability to maintain relationships with clients, customers, depositors, employees and other constituents or to achieve the anticipated benefits of the transaction. The loss of key employees could adversely affect the Bank’s ability to successfully conduct its business, which could have an adverse effect on the Company’s financial results and the value of its common stock. If the Bank experiences difficulties with the integration process, the anticipated benefits of the acquisition may not be realized fully or at all or may take longer to realize than expected. As with any acquisition, there also may be business disruptions that cause the Bank to lose customers or cause customers to remove their accounts from the Bank and move their business to competing financial institutions. Integration efforts by the Bank will also divert management’s attention and resources. These integration matters could have an adverse effect on the Bank during the transition period and for an undetermined period after completion of the acquisition.

Previous report

The Merger Agreement may be terminated in accordance with its terms, and the acquisition may not be completed.

Previous report

The Merger Agreement is subject to a number of customary closing conditions that must be satisfied or waived in order to complete the acquisition, including the receipt of the requisite regulatory approvals. These conditions to the closing of the acquisition may not be satisfied or waived in a timely manner or at all, and, accordingly, the acquisition may be delayed or may not be completed. In addition, Cornerstone or the Company may elect to terminate the Merger Agreement in certain other circumstances.

Previous report

Termination of the Merger Agreement could negatively impact the Company.

Previous report

If the Merger Agreement is terminated, there may be various consequences. For example, the Bank’s business may have been impacted adversely by the failure to pursue other opportunities due to management’s focus on the acquisition, without realizing any of the anticipated benefits of completing the acquisition. Additionally, if the Merger Agreement is terminated, the market price of the Company’s common stock could decline to the extent that the current market prices reflect a market assumption that the Cornerstone acquisition will be completed.

Previous report

Furthermore, the Company has incurred and will incur substantial expenses in connection with the completion of the transactions contemplated by the Merger Agreement. If the acquisition is not completed, the Company would have to recognize these expenses without realizing the expected benefits of the acquisition.

Previous report

We may be vulnerable to cyberattacks or other security breaches affecting our electronic data and product delivery systems.

Previous report

The financial services industry has experienced an increase in both the number and severity of reported cyberattacks aimed at gaining unauthorized systems access as a way to misappropriate assets and sensitive information, corrupt and destroy data, or cause operational disruptions. Cybercrime risks have increased as electronic and mobile banking activities have increased. We are increasingly dependent on technology systems to run our core operations and to be a delivery channel to provide products and services to our customers. We also rely on the integrity and security of a variety of third-party processors, payment, clearing and settlement systems, as well as the various participants involved in these systems, many of which have no direct relationship with us. Failure by these participants or their systems to protect our customers’ transaction data may put us at risk for possible losses due to fraud or operational disruption. In many cases, in order for these systems to function, they must be connected to the internet, directly or indirectly. These connections open our systems to potential attacks by third parties seeking to steal our data, our customers’ information or to disable our systems. A successful attack on our systems could adversely affect our results of operations by, among other things, harming our reputation among current and potential customers if their information is stolen, disrupting our operations if our systems are impaired, the loss of assets which could be stolen in an attack and the costs of remediating our systems after an attack. Although we have security safeguards and take numerous steps to protect our systems from a potential attack, we can provide no assurance that these measures will be successful in preventing intrusions into our systems. A portion of our workforce (which changes based on management’s discretion) are working a portion of their work hours remotely which has only increased our risk in this area. Therefore, the Bank’s information technology department has instituted additional security measures with the use of laptop computers at home, such as specially loaded software providing more accessibility, increased monitoring of access logs, and the requirement for employees to bring their laptop computer into the office when working there. In addition, files and documents are only allowed to be transferred via the issued laptop computer; no personal emails can be used. The occurrence of a breach of security involving our customers could damage our reputation and result in a loss of customers and business, subject us to additional regulatory scrutiny and could expose us to litigation and possible financial liability. Any of these events could have a material adverse effect on our financial condition and results of operations.

Current report — wording carried from elsewhere

These loans may have delinquency or charge off levels above our expectations, which could negatively affect our performance.