OP Bancorp

Cybersecurity measures are, by their nature, largely reactive, and threats are constantly evolving. We expect that the development of AI-based technologies will accelerate both the number and the sophistication of these threats. We routinely experience attempts to exploit our networks and systems, and we must continue investing in increasingly advanced (and concomitantly expensive) technology to counteract these threats. Further, if our systems cannot timely detect and mitigate vulnerabilities, or cannot promptly respond to threats, we may experience damage to or interruptions in the availability of our computer networks, or we may experience a loss of data, unauthorized use or disclosure of customer information, or a loss of customer funds as a result of unauthorized access to customer accounts. Likewise, breaches of our payroll, benefits, and other employee-related systems may give rise to liability under employment and privacy laws and may damage our relationships with our employees. Further, we may have a limited ability to enforce warranties, indemnities or other remedies against the providers of these systems in the event we incur a loss.

Our operations could be disrupted by our third‑party service providers, including risks arising from their use of artificial intelligence technologies, experiencing difficulty in providing their services, terminating their services, or failing to comply with banking regulations.

We depend to a significant extent on relationships with third‑party service providers. Specifically, we utilize third‑party core banking services and receive credit card and debit card services, branch capture services, Internet banking services and services complementary to our banking products from various third‑party service providers. Certain of these third‑party service providers may incorporate or rely on artificial intelligence (“AI”), machine learning, automated decision‑making technologies or similar emerging technologies in the development or delivery of their products and services, including technologies that are evolving rapidly and for which regulatory expectations are continuing to develop. These third‑party relationships are subject to increasingly demanding regulatory requirements that require us to maintain and continue to enhance our due diligence, contractual controls, and ongoing monitoring and oversight of our vendors, including with respect to their information security practices, data governance, model risk management, operational resilience and compliance with applicable laws and regulations. The use of AI by our third‑party service providers may increase the complexity of these oversight obligations and may expose us to additional risks, including risks

related to data privacy and security, model performance, bias or discrimination, explainability, intellectual property, and regulatory compliance. We may be required to renegotiate or modify our agreements to address these enhanced requirements or evolving supervisory expectations, which could increase our costs or may be impracticable. If our service providers experience operational difficulties, fail to perform in accordance with expectations, experience disruptions related to AI system failures or errors, suffer a cyberattack or other security breach, fail to comply with applicable laws or regulations, or terminate their services, and we are unable to replace them in a timely manner, our operations could be interrupted. It may be difficult for us to replace certain service providers promptly, particularly where the services involve specialized technologies or proprietary platforms, including AI‑enabled systems, and replacement services may be available only at higher cost or on less favorable terms.

In addition, many of our agreements with third‑party service providers limit our ability to recover damages, even for negligent actions that may result in customer harm, regulatory scrutiny, or enforcement actions. Regulatory requirements generally apply directly to financial institutions rather than to their service providers, and we expect that our regulators would hold us responsible for deficiencies in or failures of our third‑party relationships, including deficiencies related to the use of AI technologies by those providers. Such deficiencies could result in supervisory findings, enforcement actions, civil money penalties, litigation, customer remediation obligations, reputational harm, or other administrative or judicial penalties or fines, any of which could have a material adverse effect on our business, financial condition and results of operations.

Cybersecurity measures are, by their nature, largely reactive, and threats are constantly evolving. We expect that the development of AI-based technologies will accelerate both the number and the sophistication of these threats. We routinely experience attempts to exploit our networks and systems, and we must continue investing in increasingly advanced (and concomitantly expensive) technology to counteract these threats. Further, if our systems cannot timely detect and mitigate vulnerabilities, or cannot promptly respond to threats, we may experience damage to or interruptions in the availability of our computer networks, or we may experience a loss of data, unauthorized use or disclosure of customer information, or a loss of customer funds as a result of unauthorized access to customer accounts. Likewise, breaches of our payroll, benefits, and other employee-related systems may give rise to liability under employment and privacy laws and may damage our relationships with our employees. Further, we may have a limited ability to enforce warranties, indemnities or other remedies against the providers of these systems in the event we incur a loss.

Our operations could be disrupted by our third‑party service providers, including risks arising from their use of artificial intelligence technologies, experiencing difficulty in providing their services, terminating their services, or failing to comply with banking regulations.

We depend to a significant extent on relationships with third‑party service providers. Specifically, we utilize third‑party core banking services and receive credit card and debit card services, branch capture services, Internet banking services and services complementary to our banking products from various third‑party service providers. Certain of these third‑party service providers may incorporate or rely on artificial intelligence (“AI”), machine learning, automated decision‑making technologies or similar emerging technologies in the development or delivery of their products and services, including technologies that are evolving rapidly and for which regulatory expectations are continuing to develop. These third‑party relationships are subject to increasingly demanding regulatory requirements that require us to maintain and continue to enhance our due diligence, contractual controls, and ongoing monitoring and oversight of our vendors, including with respect to their information security practices, data governance, model risk management, operational resilience and compliance with applicable laws and regulations. The use of AI by our third‑party service providers may increase the complexity of these oversight obligations and may expose us to additional risks, including risks

related to data privacy and security, model performance, bias or discrimination, explainability, intellectual property, and regulatory compliance. We may be required to renegotiate or modify our agreements to address these enhanced requirements or evolving supervisory expectations, which could increase our costs or may be impracticable. If our service providers experience operational difficulties, fail to perform in accordance with expectations, experience disruptions related to AI system failures or errors, suffer a cyberattack or other security breach, fail to comply with applicable laws or regulations, or terminate their services, and we are unable to replace them in a timely manner, our operations could be interrupted. It may be difficult for us to replace certain service providers promptly, particularly where the services involve specialized technologies or proprietary platforms, including AI‑enabled systems, and replacement services may be available only at higher cost or on less favorable terms.

In addition, many of our agreements with third‑party service providers limit our ability to recover damages, even for negligent actions that may result in customer harm, regulatory scrutiny, or enforcement actions. Regulatory requirements generally apply directly to financial institutions rather than to their service providers, and we expect that our regulators would hold us responsible for deficiencies in or failures of our third‑party relationships, including deficiencies related to the use of AI technologies by those providers. Such deficiencies could result in supervisory findings, enforcement actions, civil money penalties, litigation, customer remediation obligations, reputational harm, or other administrative or judicial penalties or fines, any of which could have a material adverse effect on our business, financial condition and results of operations.

Cybersecurity measures are, by their nature, largely reactive, and threats are constantly evolving. We expect that the development of AI-based technologies will accelerate both the number and the sophistication of these threats. We routinely experience attempts to exploit our networks and systems, and we must continue investing in increasingly advanced (and concomitantly expensive) technology to counteract these threats. Further, if our systems cannot timely detect and mitigate vulnerabilities, or cannot promptly respond to threats, we may experience damage to or interruptions in the availability of our computer networks, or we may experience a loss of data, unauthorized use or disclosure of customer information, or a loss of customer funds as a result of unauthorized access to customer accounts. Likewise, breaches of our payroll, benefits, and other employee-related systems may give rise to liability under employment and privacy laws and may damage our

Our operations could be disrupted by our third‑party service providers, including risks arising from their use of artificial intelligence technologies, experiencing difficulty in providing their services, terminating their services, or failing to comply with banking regulations.

We depend to a significant extent on relationships with third‑party service providers. Specifically, we utilize third‑party core banking services and receive credit card and debit card services, branch capture services, Internet banking services and services complementary to our banking products from various third‑party service providers. Certain of these third‑party service providers may incorporate or rely on artificial intelligence (“AI”), machine learning, automated decision‑making technologies or similar emerging technologies

in the development or delivery of their products and services, including technologies that are evolving rapidly and for which regulatory expectations are continuing to develop. These third‑party relationships are subject to increasingly demanding regulatory requirements that require us to maintain and continue to enhance our due diligence, contractual controls, and ongoing monitoring and oversight of our vendors, including with respect to their information security practices, data governance, model risk management, operational resilience and compliance with applicable laws and regulations. The use of AI by our third‑party service providers may increase the complexity of these oversight obligations and may expose us to additional risks, including risks related to data privacy and security, model performance, bias or discrimination, explainability, intellectual property, and regulatory compliance. We may be required to renegotiate or modify our agreements to address these enhanced requirements or evolving supervisory expectations, which could increase our costs or may be impracticable. If our service providers experience operational difficulties, fail to perform in accordance with expectations, experience disruptions related to AI system failures or errors, suffer a cyberattack or other security breach, fail to comply with applicable laws or regulations, or terminate their services, and we are unable to replace them in a timely manner, our operations could be interrupted. It may be difficult for us to replace certain service providers promptly, particularly where the services involve specialized technologies or proprietary platforms, including AI‑enabled systems, and replacement services may be available only at higher cost or on less favorable terms.

In addition, many of our agreements with third‑party service providers limit our ability to recover damages, even for negligent actions that may result in customer harm, regulatory scrutiny, or enforcement actions. Regulatory requirements generally apply directly to financial institutions rather than to their service providers, and we expect that our regulators would hold us responsible for deficiencies in or failures of our third‑party relationships, including deficiencies related to the use of AI technologies by those providers. Such deficiencies could result in supervisory findings, enforcement actions, civil money penalties, litigation, customer remediation obligations, reputational harm, or other administrative or judicial penalties or fines, any of which could have a material adverse effect on our business, financial condition and results of operations.

Notwithstanding these investments, cybersecurity measures are, by their nature, largely reactive, and threats are constantly evolving. We expect that the development of AI-based technologies will accelerate both the number and the sophistication of these threats. We routinely experience attempts to exploit our networks and systems, and we must continue investing in increasingly advanced (and concomitantly expensive) technology to counteract these threats. Further, if our systems cannot timely detect and mitigate vulnerabilities, or cannot promptly respond to threats, we may experience damage to or interruptions in the availability of our computer networks, or we may experience a loss of data, unauthorized use or disclosure of customer information, or a loss of customer funds as a result of unauthorized access to customer accounts. Likewise, breaches of our payroll, benefits, and other employee-related systems may give rise to liability under employment and privacy laws and may damage our relationships with our employees. Further, we may have a limited ability to enforce warranties, indemnities or other remedies against the providers of these systems in the event we incur a loss.

Notwithstanding these investments, cybersecurity measures are, by their nature, largely reactive, and threats are constantly evolving. We expect that the development of AI-based technologies will accelerate both the number and the sophistication of these threats. We routinely experience attempts to exploit our networks and systems, and we must continue investing in increasingly advanced (and concomitantly expensive) technology to counteract these threats. Further, if our systems cannot timely detect and mitigate vulnerabilities, or cannot promptly respond to threats, we may experience

Notwithstanding these investments, cybersecurity measures are, by their nature, largely reactive, and threats are constantly evolving. We expect that the development of AI-based technologies will accelerate both the number and the sophistication of these threats. We routinely experience attempts to exploit our networks and systems, and we must continue investing in increasingly advanced (and concomitantly expensive) technology to counteract these threats. Further, if our systems cannot timely detect and mitigate vulnerabilities, or cannot promptly respond to threats, we may experience

Notwithstanding these investments, cybersecurity measures are, by their nature, largely reactive, and threats are constantly evolving. We expect that the development of AI-based technologies will accelerate both the number and the sophistication of these threats. We routinely experience attempts to exploit our networks and systems, and we must continue investing in increasingly advanced (and concomitantly expensive) technology to counteract these threats. Further, if our systems cannot timely detect and mitigate vulnerabilities, or cannot promptly respond to threats, we may experience damage to or interruptions in the availability of our computer networks, or we may experience a loss of data, unauthorized use or disclosure of customer information, or a loss of customer funds as a result of unauthorized access to customer accounts. Likewise, breaches of our payroll, benefits, and other employee-related systems may give rise to liability under employment laws and may damage our relationships with our employees.

The financial services industry is subject to rapid technological changes, of which we cannot predict the effects on our business. We expect that new services and technologies applicable to our industry will continue to emerge, and these new services and technologies may be superior to, or render obsolete, the technologies we currently utilize in our products and services. These rapid changes increase cybersecurity risks to our Company and our third-party vendors and service providers, including the risk of security breaches, “denial of service” attacks, “hacking” and identity theft. Criminals are using increasingly sophisticated methods to engage in illegal activities, including through the use of deposit account products and customer information and may also see their effectiveness enhanced by the use of artificial intelligence. A single significant incident of fraud, or increases in the overall level of fraud, involving our products and services could result in reputational damage to us. Such damage could reduce the use and acceptance of our products and services or lead to greater regulation that would increase our compliance costs. Fraudulent activity could also result in the imposition of regulatory sanctions, including significant monetary fines, which could adversely affect our business, results of operations and financial condition. To address the challenges that we face with respect to fraudulent activity, we maintain certain risk control policies and procedures, both internally and with respect to our third-party vendors and service providers, that make it more difficult for to fraudulently obtain and use our products and services. However, our inability to keep pace with technological changes, including our ability to identify and address cybersecurity risks, may significantly affect our financial position and results of operation.

Notwithstanding these investments, cybersecurity measures are, by their nature, largely reactive, and threats are constantly evolving. We expect that the development of AI-based technologies will accelerate both the number and the sophistication of these threats. We routinely experience attempts to exploit our networks and systems, and we must continue investing in increasingly advanced (and concomitantly expensive) technology to counteract these threats. Further, if our systems cannot timely detect and mitigate vulnerabilities, or cannot promptly respond to threats, we may experience damage to or interruptions in the availability of our computer networks, or we may experience a loss of data, unauthorized use or disclosure of customer information, or a loss of customer funds as a result of unauthorized access to customer accounts. Likewise, breaches of our payroll, benefits, and other employee-related systems may give rise to liability under employment laws and may damage our relationships with our employees.

Notwithstanding these investments, cybersecurity measures are, by their nature, largely reactive, and threats are constantly evolving. We expect that the development of AI-based technologies will accelerate both the number and the sophistication of these threats. We routinely experience attempts to exploit our networks and systems, and we must continue investing in increasingly advanced (and concomitantly expensive) technology to counteract these threats. Further, if our systems cannot timely detect and mitigate vulnerabilities, or cannot promptly respond to threats, we may experience damage to or interruptions in the availability of our computer networks, or we may experience a loss of data, unauthorized use or disclosure of customer information, or a loss of customer funds as a result of unauthorized access to customer

Notwithstanding these investments, cybersecurity measures are, by their nature, largely reactive, and threats are constantly evolving. We expect that the development of AI-based technologies will accelerate both the number and the sophistication of these threats. We routinely experience attempts to exploit our networks and systems, and we must continue investing in increasingly advanced (and concomitantly expensive) technology to counteract these threats. Further, if our systems cannot timely detect and mitigate vulnerabilities, or cannot promptly respond to threats, we may experience damage to or interruptions in the availability of our computer networks, or we may experience a loss of data, unauthorized use or disclosure of customer information, or a loss of customer funds as a result of unauthorized access to customer accounts. Likewise, breaches of our payroll, benefits, and other employee-related systems may give rise to liability under employment laws and may damage our relationships with our employees.

The financial services industry is subject to rapid technological changes, of which we cannot predict the effects on our business. We expect that new services and technologies applicable to our industry will continue to emerge, and these new services and technologies may be superior to, or render obsolete, the technologies we currently utilize in our products and services. These rapid changes increase cybersecurity risks to our Company and our third-party vendors and service providers, including the risk of security breaches, “denial of service” attacks, “hacking” and identity theft. Criminals are using increasingly sophisticated methods to engage in illegal activities, including through the use of deposit account products and customer information and may also see their effectiveness enhanced by the use of artificial intelligence. A single significant incident of fraud, or increases in the overall level of fraud, involving our products and services could result in reputational damage to us. Such damage could reduce the use and acceptance of our products and services or lead to greater regulation that would increase our compliance costs. Fraudulent activity could also result in the imposition of regulatory sanctions, including significant monetary fines, which could adversely affect our business, results of operations and financial condition. To address the challenges that we face with respect to fraudulent activity, we maintain certain risk control policies and procedures, both internally and with respect to our third-party vendors and service providers, that make it more difficult for to fraudulently obtain and use our products and services. However, our inability to keep pace with