FIRST BUSEY CORP /NV/

Busey’s framework for managing risks may not be fully effective in mitigating risk and loss.

Busey’s risk management framework is designed to identify, measure, monitor, and analyze a broad spectrum of risks, including compliance, operational, and reputational risks. However, as with any framework, inherent limitations exist, particularly as new risks emerge or previously unidentified vulnerabilities become apparent.

The effectiveness of this framework depends on its alignment with Busey’s evolving risk profile, especially following the completion of the CrossFirst merger. As the organization grows in complexity, risks related to system integration, process harmonization, and operational oversight may challenge the framework's capacity to adapt in a timely and effective manner. Failures to identify and manage these risks could adversely affect Busey’s financial condition, regulatory standing, and overall operational stability.

To address these challenges, Busey continuously refines its risk management processes, leveraging enhanced risk assessment tools, investing in automation and analytics, and aligning with industry best practices. Despite these efforts, no risk management framework is foolproof, and unforeseen losses or disruptions remain a possibility, which may materially and adversely affect Busey’s financial condition and results of operations.

Technological investments drive efficiency but introduce cybersecurity risks.

Busey’s ongoing investments in technology infrastructure have strengthened operational efficiency, enhanced client service delivery, and supported the scaling of key business functions. Initiatives such as enterprise-wide automation, cloud integration, and enhanced data analytics capabilities have positioned Busey as a forward-thinking financial institution. However, these advancements introduce vulnerabilities, including the risk of cyber-attacks and operational disruptions.

The Federal Reserve’s November 2025 Financial Stability Report has emphasized growing threats posed by sophisticated cyber-attacks. These threats not only compromise data integrity but also pose significant reputational and financial risks. The outcomes of such risks include:

•Amplification of Vendor Risk: Third-party vendors and their subcontractors introduce multi-layered risks, complicating oversight and heightening the likelihood of service interruptions or compliance breaches.

•Need for Advanced Cyber Protections: As bad actors deploy increasingly sophisticated tactics, including artificial intelligence-driven impersonation and malware, the effectiveness of traditional cybersecurity defenses is diminished.

To mitigate these risks, Busey has implemented robust cybersecurity protocols, regular system audits, and incident response plans. The use of artificial intelligence-powered tools provide additional layers of fraud and threat detection, enabling proactive management. However, as cybersecurity threats evolve, the possibility of system penetration persists even with robust security protocols in place. As a result, successful or attempted cyber intrusions, vendor failures, or operational disruptions stemming from these evolving threats could materially and adversely impact Busey’s financial condition and results of operations.

First Busey Corporation(BUSE) | 2025 —46

Outsourcing dependencies could disrupt operations and increase compliance risks.

Busey’s reliance on secure and resilient systems to manage customer relationships, transactions, and data underscores the critical importance of operational stability. Outsourcing arrangements introduce risks tied to service disruptions, compliance violations, and vulnerabilities stemming from subcontractors in downstream supply chains.

This cascading outsourcing structure adds complexity to communication and coordination, particularly when vendors operate in regions with varying regulatory standards. Risks are further amplified by geopolitical tensions, trade restrictions, or cyberattacks targeting these external partners.

While Busey conducts rigorous due diligence when selecting third-party providers, residual risks, especially from indirect outsourcing (fourth parties), remain challenging to eliminate entirely. Failures or breaches in these systems could disrupt Busey’s operations, damage its reputation, and materially and adversely affect its financial conditions and results of operations.

Fraudulent activities could erode financial stability and customer trust.

The rising sophistication of fraudulent schemes poses a persistent challenge for financial institutions, with Busey being no exception. Fraudulent activities, such as identity theft, phishing, and unauthorized transactions, could result in financial losses, regulatory penalties, and erosion of customer trust.

Busey employs a multi-layered approach to fraud prevention, including internal controls, advanced fraud detection tools, and insurance coverage. However, even robust frameworks may not fully eliminate risks, particularly as threat actors adapt their tactics to exploit emerging industry vulnerabilities and customer vulnerabilities. Accordingly, successful fraud attempts or failures in our fraud‑prevention controls could result in financial losses, increased operational costs, regulatory consequences, and reputational harm that could adversely affect Busey’s financial condition and results of operations.

Busey’s ability to attract and retain key personnel may affect future growth and earnings.

Busey’s ability to attract and retain experienced management and qualified personnel remains critical to sustaining growth and executing its strategic objectives. Despite continued investment in leadership development, succession planning, and employee engagement, competitive labor markets and evolving employee expectations pose ongoing challenges.

Beyond executive leadership, Busey's ability to build and maintain a diverse and skilled workforce is essential to implementing its community-based strategy and serving an expanded geographic footprint. The unexpected departure of high-performing employees or difficulty in recruiting specialized talent could disrupt operations, delay strategic initiatives, or increase costs associated with workforce realignment, all of which may materially and adversely affect Busey’s financial condition and results of operations.

Damage resulting from negative publicity could harm Busey’s reputation and adversely impact its business and financial condition.

Busey’s ability to attract and retain customers, investors, employees, and business partners depends significantly on the trust placed in its brand, business practices, and commitment to responsible conduct. Negative public opinion may arise from actual or alleged issues across a wide range of activities, including employee misconduct, customer service failures, loan origination or servicing practices, compliance or regulatory violations, cybersecurity incidents, data‑protection lapses, corporate governance concerns, product suitability issues, or perceived shortfalls in Busey’s community and stakeholder engagement. Even isolated incidents—whether substantiated or not—can be rapidly amplified through social media, news outlets, or regulatory commentary, increasing the speed and scale at which reputational harm may occur.

Reputation risk is heightened by Busey’s relationship‑based operating model, in which customer loyalty and business development rely heavily on personal trust and perceived service quality. Busey is also exposed to reputational impacts arising from its third‑party relationships, including vendors, fintech partners, and other service providers, whose failures or misconduct may be attributed to Busey.

First Busey Corporation(BUSE) | 2025 —47

Reputational harm can lead to customer attrition, reduced deposit and loan growth, lower fee income, diminished employee morale or retention challenges, increased regulatory scrutiny, delays in obtaining regulatory approvals, reduced investor confidence, and exposure to litigation or enforcement actions. These effects may also limit Busey’s ability to pursue strategic initiatives or partnerships. Any failure to effectively identify, monitor, and manage reputational risks could result in lost business opportunities, elevated costs, and operational disruptions, and could materially and adversely affect Busey’s financial condition and results of operations.

Severe weather, natural disasters, pandemics or other health crises, acts of war or terrorism and other external events could significantly impact Busey’s business.

Adverse external events—including severe weather, natural disasters, wildfires, pandemics or other public‑health crises, acts of war or terrorism, and other large‑scale disruptions—could significantly affect Busey’s operations and the ability of customers, counterparties, and third‑party providers to conduct business. Such events may interrupt business activity, damage physical assets, disrupt supply chains, reduce demand for financial services, impair borrowers’ repayment capacity, increase vacancy rates in commercial properties, and reduce the value of collateral supporting Busey’s loan portfolio. They may also lead to financial‑market volatility, elevated credit losses, and operational challenges stemming from facility closures, evacuations, or interruptions in access to banking channels. Geopolitical conflicts can further influence energy prices, commodity markets, and financial‑market stability, while regulatory responses to these events may impose additional compliance or operational requirements.

Although Busey maintains business‑continuity plans and risk‑management processes, the occurrence of one or more such adverse events could disrupt operations, increase costs, reduce revenue, and materially and adversely affect Busey’s financial condition and results of operations.