PATRIOT NATIONAL BANCORP INC

Except as set forth below, there have been no material changes to the risk factors previously disclosed in the Company’s Annual Report on Form 10-K for the year ended December 31, 2025, as supplemented by our Quarterly Report on Form 10-Q for the quarter ended March 31, 2026.

Our reliance on third-party vendors, program managers, fintech service providers, and other counterparties exposes us to significant third-party risk.

Our institutional banking, digital payments, treasury, compliance, regulatory reporting, audit, and technology activities depend on third-party relationships, including program managers, processors, technology providers, compliance and monitoring vendors, professional service providers, and other counterparties. Banking regulators expect banks to maintain risk-based due diligence, ongoing monitoring, periodic reviews, and appropriate oversight of significant third-party relationships.

Third parties may fail to comply with law, contract, or our policies; may have inadequate controls; may experience financial distress, fraud, cyber incidents, operational failures, or business interruption; or may not provide us with timely and accurate data. Because regulators increasingly expect banks to manage third-party risk as if the activity were conducted internally, failures by our vendors or partners could expose us to losses, remediation costs, litigation, regulatory criticism, and reputational damage even where the immediate failure occurred outside the Bank.

From time to time, we receive reports from vendors, regulators, or other third parties concerning cybersecurity, privacy, or other data incidents that may involve Bank or customer information maintained by third parties. We investigate and evaluate such matters to determine their nature and scope and any appropriate response. Such incidents could require significant and costly notification, remediation, investigation, or other response measures and could result in regulatory inquiries, litigation, or other liabilities. Although we may have contractual indemnification rights against responsible third parties and insurance coverage for certain losses, such rights and coverage may be insufficient, subject to limitations or exclusions, or exceed the financial resources of the responsible party or applicable policy limits. Any such incident could materially adversely affect our business, financial condition, and results of operations.