CapStar Financial Holdings, Inc.

We necessarily collect, use and hold sensitive data concerning individuals and businesses with whom we have a banking relationship. Threats to data security, including unauthorized access and cyber-attacks, rapidly emerge and change, exposing us to additional costs for protection or remediation and competing time constraints to secure our data in accordance with client expectations and statutory and regulatory requirements. Although we actively invest in the security of our technological infrastructure, it is not feasible to defend against every risk posed by rapid technological development and the increasing sophistication of cyber criminals. Patching and other measures to protect existing systems and servers could be inadequate, especially on systems that are being retired. Controls employed by our information technology department and third-party vendors could prove inadequate. We could also experience a breach by intentional or negligent conduct on the part of our employees or other internal sources, software bugs or other technical malfunctions, or other causes. As a result of any of these threats, our client accounts may become vulnerable to account takeover schemes or cyber-fraud. Our systems and those of our third-party vendors may also become vulnerable to damage or disruption due to circumstances beyond our or their control, such as from network failures, viruses and malware, power anomalies or outages, natural disasters and catastrophic events. Additionally, the use of artificial intelligence could exacerbate many of these risks.

The financial services industry is undergoing rapid technological changes, with frequent introductions of new technology-driven products and services. In addition to serving clients better, the effective use of technology increases efficiency and enables financial institutions to reduce costs. Our success will depend in part on our ability to address our clients’ needs by using technology to provide products and services that will satisfy client demands for convenience, as well as to create additional efficiencies in our operations. Certain of our competitors have substantially greater resources to invest in technological improvements than us, and in the future, we may not be able to implement new technology-driven products and services timely, effectively or at all or be successful in marketing these products and services to our clients. For example, companies which claim to offer applications and services based on artificial intelligence are beginning to compete much more directly with traditional financial services companies in areas involving personal advice, including high-margin services such as financial planning and wealth management. As these technologies are improved in the future, we may, in order to remain competitive, be required to make significant capital expenditures, which may increase our overall expenses and have a material adverse effect on our net income. There is also no guarantee that any such investment in these products and services will create additional efficiencies in our operations.