First Financial Bancorp

In addition, a cybersecurity breach of a vendor's system may result in theft of our data or disruption of business processes. Increased use of artificial intelligence (AI) by vendors can further increase the risks of a cybersecurity breach, as discussed in the Risk Factor titled “The increased use and capacity of AI, Generative AI, large language models (LLMs), and AI agents by customers, vendors and competitors increases risks to our business.” A material breach of customer data security at a service provider's site may negatively impact our business reputation and cause a loss of customers, result in increased expense to contain the event and/or require that we provide credit monitoring services for affected customers, result in regulatory fines and sanctions, and possibly litigation. We may experience liability to our customers for losses arising from a breach of a vendor's data security system. We rely on our outsourced service providers to implement and maintain prudent cybersecurity controls. Furthermore, we may not be insured against all types of losses as a result of third-party failures, and our insurance coverage may be inadequate to cover all losses resulting from system failures or other disruptions. Failures in our business infrastructure could interrupt our operations, cause reputational harm, increase the costs of doing business and impact the results of our operations. In certain cases, a limited number of vendors provide critical or specialized services, and disruption, pricing changes, financial stress, or service degradation at one of these providers could have a disproportionate impact on our operations. The Company’s business continuity and disaster recovery planning addresses disruption in critical vendors.

In addition, continuing cyberattacks and current geopolitical tensions highlight the importance of heightened threat monitoring and safeguarding against disruptive attacks targeting the financial sector. There have been instances where financial institutions have been victims of fraudulent activity in which criminals pose as customers to initiate wire and automated clearinghouse transactions out of customer accounts. There have also been increased instances of scammers who target and socially engineer clients to gain access to their accounts to conduct transactions or induce customers to authorize fraudulent transactions for the scammers’ benefit. Although we have commercially reasonable policies and procedures in place to verify the authenticity of our customers, we cannot assure that such policies and procedures will prevent all fraudulent transfers. AI tools may also be utilized by bad actors to increase the sophistication and speed of cyberattacks and fraud attempts. For more information on the risks associated with AI, see the Risk Factor titled “The increased use and capacity of AI, Generative AI, large language models (LLMs), and AI agents by customers, vendors and competitors increases risks to our business.”

The increased use and capacity of AI, Generative AI, large language models (LLMs), and AI agents by customers, vendors and competitors increases risks to our business. The use and capacity of AI, Generative AI, LLMs and AI agents has increased in the past year and is being employed by customers, competitors, and vendors at increased rates. Many of these tools can increase cybersecurity risks, require specific technical expertise to operate, or expose information through open source code. These tools are being used by parties in various capacities, and employing these tools without sufficient knowledge or expertise of the power and risks associated with the tools can increase risks for the users. These tools are relatively new and there is potential of continued and/or increased adoption of legal and regulatory frameworks governing the use of these tools, by law, our primary banking regulators, other federal or state regulatory bodies, or other self-regulatory organizations.

Competition in the financial services industry is intense and could result in our losing business and/or experiencing reduced margins. We operate in a highly competitive industry that could become even more competitive as a result of legislative, regulatory and technological changes, including AI, Generative AI, LLMs and AI agents, and continued consolidation. We face aggressive competition from other domestic and foreign lending institutions as well as from numerous other providers of financial services. The ability of non-banking financial institutions to provide services previously limited to commercial banks has intensified competition. Because non-banking financial institutions are not subject to the same regulatory restrictions as banks and bank holding companies, they can often operate with greater flexibility and lower cost structures. Securities firms and insurance companies that elect to become financial holding companies may acquire banks and other financial institutions. These developments may significantly change the competitive environment in which we conduct business.

Additionally, implementation of certain new technologies, such as AI, Generative AI, LLMs, AI agents and similar technologies, can expose us to new or increased operational risks, including risks related to data leakage, model bias, decision errors, regulatory non-compliance, or ineffective governance or internal controls. The implementation of these new technologies may have unintended consequences due to their limitations or failure to use and implement them effectively. Further, many of our competitors have greater resources to develop these and other new technologies without reliance on third party vendors or developers, which can reduce their costs and exposure to third party risks, which could put us at a competitive disadvantage. For more information on the risks associated with these new technologies, see the Risk Factor titled “The increased use and capacity of AI, Generative AI, large language models (LLMs), and AI agents by customers, vendors and competitors increases risks to our business.”

Additionally, implementation of certain new technologies, such as artificial intelligence, machine learning and other large language models and similar technologies, can expose us to new or increased operational risks, including risks related to our system of internal controls. The implementation of these new technologies may have unintended consequences due to their limitations or failure to use and implement them effectively. Further, many of our competitors have greater resources to