First Internet Bancorp

In 2015, federal regulators issued two related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish lines of defense and ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing digital-based services of the financial institution. The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption, and maintenance of the institution’s operations after a cyber-attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.

In November 2021, the federal banking agencies published a final rule establishing computer-security incident notification requirements that require a banking organization to notify its primary federal regulator of any “computer security incident” that rises to the level of a “notification incident” as soon as possible and no later than 36 hours after determining that such an incident has occurred. The rule also requires a bank service provider to notify each affected banking organization customer as soon as possible when the service provider determines it has experienced a computer security incident that has caused, or is reasonably likely to cause, a material service disruption or degradation for four or more hours.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. For example, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. We expect this trend of increased activity and changes at the state level to continue.

Recently, the SEC has enacted laws requiring public companies to disclose material cybersecurity risks and incidents along with cybersecurity protections and governance processes. These SEC guidelines, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations. See Part I, Item 1C.

Cybersecurity of this Annual Report on Form 10-K for additional information.

In support of our digital banking platform, we rely heavily on electronic communications and information systems to conduct our operations and store sensitive data. We employ an in-depth approach that leverages people, processes, and technology to manage and maintain cybersecurity controls. In addition, we employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of our defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures.

We continually strive to enhance our cyber and information security in order to be resilient against emerging threats and improve our ability to detect and respond to attempts to gain unauthorized access to our data and systems. We regularly conduct cybersecurity risk assessments, regularly engage with the Board or appropriate committees on cybersecurity matters, routinely update our incident response plans based on emerging threats, periodically practice implementation of incident response plans across applicable departments, and train officers and employees to detect and report suspicious activity. Although to date we have not experienced any material losses relating to cyber-attacks or other information security breaches, our systems and those of our customers and third-party service providers are under constant threat, and it is possible that we could experience a significant event in the future due to the rapidly evolving nature and sophistication of these threats.

Climate-Related Risk Management and Regulation. In recent years, the federal banking agencies and the SEC have increased their focus on climate-related risks impacting the operation of banks, the communities they serve and the financial system as a whole. Proposals related to climate-related financial and other risks impacting banks are being considered at both the federal and state level. It is too early to predict to what extent legislative and regulatory proposals will impact the Company and the Bank, but we will continue to monitor these developments and the steps that will need to be taken to address any new requirements.

Additional Matters. The earnings of financial institutions are also affected by general economic conditions and prevailing interest rates, both domestic and foreign, and by the monetary and fiscal policies of the United States Government and its various agencies, particularly the Federal Reserve. The Federal Reserve regulates the supply of credit in order to influence general economic conditions, primarily through open market operations in United States Government obligations, varying the discount rate on financial institution borrowings, varying reserve requirements against financial institution deposits, and restricting certain borrowings by financial institutions and their subsidiaries. The monetary policies of the Federal Reserve have had a significant effect on the operating results of the Bank in the past and are expected to continue to do so in the future.

Additional legislation and administrative actions affecting the banking industry may be considered by the United States Congress, state legislatures and various regulatory agencies, including those referred to above. It cannot be predicted with certainty whether such legislation or administrative action will be enacted or the extent to which the banking industry, the Company or the Bank would be affected.

Available Information

The Company makes available its Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and all amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), free of charge on its website at www.firstinternetbancorp.com as soon as reasonably practicable after it electronically files such material with, or furnishes it to, the SEC. In addition, the SEC maintains an internet site at www.sec.gov that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC. References to the Company’s website address in this Annual Report on Form 10-K are provided as a convenience only and are not incorporated by reference.