Farmers & Merchants Bancorp

In 2025, the OCC announced its conditional approval of five national trust bank charter applications to either newly charter or convert existing institutions into national trust banks that propose to offer digital asset products and services. While national trust banks generally do not take insured deposits or engage in commercial lending, the proposed activities of the five institutions include digital asset custody, settlement, clearing, transfer, escrow, staking, trade execution, and brokerage services; fiduciary, exchange, and payment agent services; stablecoin issuance; and the provision of services, including reserve asset custody, to affiliated stablecoin issuers. These new non-traditional trust banks offer deposit-like products, although lacking FDIC insurance and core consumer protections, and they are not subject to the same capital, liquidity or supervisory standards as banks. Emerging technologies, such as artificial intelligence (including machine learning and generative artificial intelligence) and quantum computing, have the potential to intensify competition and accelerate disruption in the financial services industry. If we are unable to attract and retain customers, we may be unable to continue to grow our loan and deposit portfolios and our operations and financial condition may otherwise be adversely affected. Ultimately, we may be unable to compete successfully against current and future competitors.

Information security risks for financial institutions have increased recently in part because of new technologies, the use of the Internet and telecommunications technologies (including mobile devices) to conduct financial and other business transactions, and the increased sophistication and activities of organized crime, perpetrators of fraud, hackers, terrorists, nation-state adversaries, and others any of which may see their effectiveness increase as a result of artificial intelligence, including the use of generative AI to conduct more sophisticated social engineering attacks on us or our clients, further increasing risks in this area, including by making fraud detection more difficult. We are not able to anticipate or implement effective preventive measures against all potential security breaches, because the techniques used change frequently and because attacks can originate from a wide variety of sources. We employ detection and response mechanisms designed to contain and mitigate security incidents, but early detection may be thwarted by sophisticated attacks and malware designed to avoid detection.

We rely on our information technology and telecommunications systems and third-party servicers, and the failure of these systems could adversely affect our business. Our business is highly dependent on the successful and uninterrupted functioning of our information technology and telecommunications systems and third-party servicers. We rely on these systems to process deposit services, electronic funds transfer services (including wires and ACH), new and renewal loans, provide client service, facilitate collections and share data across our organization. The failure of these systems, or the termination of a third-party software license or service agreement on which any of these systems is based, could interrupt our operations. Because our information technology and telecommunications systems interface with and depend on third-party systems, we could experience service denials if demand for such services exceeds capacity or such third-party systems fail or experience interruptions. If sustained or repeated, a system failure or service denial could result in a deterioration of our ability to process deposit services, electronic funds transfer services (including wires and ACH), new and renewal loans and provide client service or compromise our ability to collect loan payments in a timely manner. Our ability to adopt new information technology and technological products needed to meet our clients’ banking needs may be limited if our third-party servicers are slow to adopt or choose not to adopt such new technology and products. Furthermore, the widespread adoption of new technologies by competitors, including artificial intelligence, could require us to make additional substantial investments to modify or adapt our existing products and services or alter the way we conduct business. These and other capital investments in the Company's business may not produce the growth in earnings anticipated at the time of the expenditure, and we may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers. Such a failure to provide this technology and products to our clients could result in a loss of clients, which would negatively affect our financial condition and operations. Implementation of certain new technologies, such as those related to artificial intelligence, automation and algorithms, also may have unintended consequences, including fraud or cybersecurity risk, due to their limitations, potential manipulation, or our failure to use them effectively.

Risks and exposures related to cybersecurity attacks, including litigation and enforcement risks, are expected to be elevated for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our customers. Implementation of certain new technologies, such as those related to artificial intelligence, automation and algorithms, also may have unintended consequences, including fraud or cybersecurity risk, due to their limitations, potential manipulation, or our failure to use them effectively.