OP Bancorp

Current report

Readers should consider the matters discussed in the section captioned Part II, Item 1A, “Risk Factors,” set forth in our Annual Report on Form 10-K for the fiscal year ended December 31, 2023, for a list of known risks and uncertainties that could affect our business, results of operations, financial condition and cash flows. In addition to those factors, certain events occurring in the second quarter of 2024 have expanded our knowledge regarding various cybersecurity risks, and we ask that readers consider the following as additional and updated factors that should be considered as risks associated with an investment in our common stock.

Current report

Interruptions, cyberattacks, fraudulent activity or other security breaches may have a material adverse effect on our business.

Current report

Our business is highly dependent on the collection, storage, transmittal, sharing, processing and retention of information about our customers and employees. To accomplish these activities, we rely heavily upon electronic infrastructure that we own or that we obtain via license or other contractual arrangements with third parties. These technologies affect, among other things, our customers’ ability to access and transfer funds, initiate and pay loans and leases, communicate with our customer service teams, and engage in a variety of other activities that form the foundation of modern financial services businesses. Likewise, our employee data and related technologies allow us to communicate with our employees about routine and extraordinary matters, compensate our staff, maintain timekeeping, payroll and benefits records, and comply with an increasingly complex web of labor and employment laws and regulations. The loss, interruption or disruption of these systems may damage our relationships with customers and correspondingly may harm our reputation. Compromises or interruptions in our employment-related systems may cause challenges in our relationships with our employees, upon whom we are heavily dependent in the conduct of our business and the development and maintenance of our relationships with customers and prospective customers.

Current report

There have been a number of recent and well-publicized incidents involving various types of cybersecurity lapses, some of which have had substantial adverse impacts upon targeted businesses and on customers of even some of the world’s most prominent cybersecurity and financial services firms. Similarly, extremely sophisticated criminal and nation-state organizations routinely target and exploit information technology networks, data systems, and other critical infrastructure. One of the most prominent recent events resulted in a widespread failure of a large cybersecurity platform, some of the consequences of which are not yet, and may not soon be, fully known or estimable.

Current report

We devote significant resources and management focus to ensuring the integrity of our systems against cybercriminals and similar actors, as well as against threats from fires and other natural disasters; power or telecommunications failures; acts of terrorism or wars or other catastrophic events; breaches, physical break-ins or errors resulting in interruptions and unauthorized disclosure of confidential information, through information security and business continuity programs. Likewise, we have made, and we continue to make, substantial investments in systems that are intended to protect against these vulnerabilities, including real-time threat detection and warning, security programs and protocols, backup and alternative-access systems, virus and malware protection programs, and a wide variety of other protective measures.

Current report

Notwithstanding these investments, cybersecurity measures are, by their nature, largely reactive, and threats are constantly evolving. We expect that the development of AI-based technologies will accelerate both the number and the sophistication of these threats. We routinely experience attempts to exploit our networks and systems, and we must continue investing in increasingly advanced (and concomitantly expensive) technology to counteract these threats. Further, if our systems cannot timely detect and mitigate vulnerabilities, or cannot promptly respond to threats, we may experience damage to or interruptions in the availability of our computer networks, or we may experience a loss of data, unauthorized use or disclosure of customer information, or a loss of customer funds as a result of unauthorized access to customer accounts. Likewise, breaches of our payroll, benefits, and other employee-related systems may give rise to liability under employment laws and may damage our relationships with our employees.

Current report

Disruptions or failures in the physical infrastructure, controls or operating systems that support our businesses and customers, failures of the third parties on which we rely to adequately or appropriately provide their services or perform their responsibilities, or our failure to effectively manage or oversee our third-party relationships, could result in business disruptions, loss of revenue or customers, legal or regulatory proceedings, remediation and other costs, violations of applicable privacy and other laws, reputational damage, customer harm, or other adverse consequences, any of which could materially adversely affect our results of operations or financial condition. Further, new and evolving SEC regulations, as well as federal and state banking and consumer privacy laws and regulations, could require us to provide notices of security breaches. Such disclosures could result in increased regulatory scrutiny, exacerbate our potential legal liability, and result in a loss of confidence in the security of our systems or an adverse perception of our products and services.

Current report

The access by unauthorized persons to, or the improper disclosure by us or our third-party vendors of, confidential information regarding our customers or our own proprietary information, software, methodologies and business secrets, failures or disruptions in our communications, information and technology systems, or our failure to adequately address them, could negatively affect our customer relationship management, online banking, accounting or other systems. We cannot assure readers that such breaches, failures or interruptions will not occur or, if they do occur, that they will be adequately addressed by us or the third parties on which we rely.

Current report

Accordingly, any failures or interruptions of our communications, information and technology systems could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on our business, financial condition or results of operations.

Current report

Our cybersecurity investments may create unforeseen implementation challenges that confer unexpected disruptions, unbudgeted costs, or delays in adaptation to crucial threats.

Current report

Enhancements and upgrades to our infrastructure or computer systems may be time-consuming, may entail significant costs, and may themselves create risks associated with implementing new systems and integrating them with existing ones. Due to the complexity and interconnectedness of our systems, the process of enhancing our infrastructure and operating systems, including their security measures and controls, also can create an inherent risk of system disruptions and security issues. Similarly, we may not be able to timely recover critical business processes or operations that have been disrupted, which may further increase any associated costs and consequences of such disruptions. Although we have enterprise incident response processes, business continuity plans and other safeguards in place to help provide operational resiliency, our business operations may be adversely affected by significant and widespread disruption to our physical infrastructure or computer systems that support our businesses and customers.

Current report

Our relatively small size requires us to be heavily reliant upon third-party vendors for cybersecurity expertise. Those vendors may themselves be subject to vulnerabilities, and their failures may be harmful to our business.

Current report

As a smaller bank holding company and a small community bank, we lack the resources available to larger institutions to recruit, train and retain a large staff focused on data security. Instead, like most community banks, we rely heavily on third-party vendors and other service providers for these functions. As financial institutions and technology systems become more interconnected and more complex, any operational incident at a third party, such as a vendor or customer, may increase our operational risks, including from information breaches or loss, breakdowns, disruptions or failures of their own systems or infrastructure, or any deficiencies in the performance of their responsibilities. These risks are increased to the extent we rely on a single-source vendor or provider. If a third-party vendor or service provider is not fully effective in assisting us in protecting our data and systems, we may be held responsible for any resulting failures, and even a failure by a third party could damage or jeopardize our relationships with our customers. Further, a recent and well-publicized cybersecurity incident involving the failure of one of the world’s most sophisticated security platforms resulted in extensive outages of that provider’s customer systems, the effect of which was a cascading failure of several of that firm’s clients’ networks. Such interruptions, occurring as a result of the acts or omissions of one or more of our vendors, could result in liability to our customers, as well as reputational harm and a potential interruption of our business.

Current report

Cybersecurity incidents, failures or lapses could give rise to regulatory harms to the Company or the Bank.

Current report

As cybersecurity threats become increasingly widespread and sophisticated, federal and state banking and privacy regulations are becoming correspondingly complex and prevalent, and the penalties for the actual or suspected violations of such rules are becoming increasingly substantial. Accordingly, we must meet stringent and increasingly costly regulatory requirements regarding our own obligations, as well as our reliance on third-party service providers, and any failure by us or our third-party service providers to comply with applicable laws, rules, regulations, or internal policies could result in the Company or the Bank becoming subject to fines, penalties, or business restrictions, as well as to increased costs to remediate any actual or perceived deficiencies and potentially to legal and other costs associated with defending against such regulatory sanctions.

Previous report

A discussion of the risk factors affecting us is set forth in Part I, Item 1A. Risk Factors in our 2023 Annual Report on Form 10-K. The discussion of risk factors provides a description of some of the important risk factors that could affect our actual results and could cause our results to vary materially from those expressed in public statements or documents. However, other factors besides those included in the discussion of risk factors or discussed elsewhere in other of our reports filed with or furnished to the SEC could affect our business or results. The readers should not consider any description of such factors to be a complete set of all potential risks that we may face.