ALERUS FINANCIAL CORP (ALRS) Business

ITEM 1.  BUSINESS

Company Overview and History

Alerus Financial Corporation (the “Company”) is a diversified financial services company headquartered in Grand Forks, North Dakota. Through the Company’s subsidiary, Alerus Financial, National Association (the “Bank”), the Company provides innovative and comprehensive financial solutions to businesses and consumers through three distinct business segments—banking, retirement and benefit services, and wealth. In prior periods, the Company had a fourth operating segment, mortgage. As of January 1, 2024, the mortgage division was fully integrated into the banking division to reflect the way the Company currently manages and views the business. These solutions are delivered through a relationship oriented primary point of contact along with responsive and client friendly technology.

As of December 31, 2025, the Company had $5.2 billion of total assets, $4.0 billion of total loans, $4.2 billion of total deposits, $564.9 million of stockholders’ equity, $44.9 billion of assets under administration/management in the Company’s retirement and benefit services segment, and $4.9 billion of assets under administration/management in the Company’s wealth segment.

The Company’s business model produces strong financial performance and a diversified revenue stream, which has helped the Company establish a brand and culture yielding both a loyal client base and passionate and dedicated employees. The Company believes its client first and advice-based philosophy, diversified business model and history of high performance and growth distinguishes the Company from other financial service providers. The Company generates its revenues from both net interest income and noninterest income. Net interest income is derived from offering the Company’s traditional banking products and services. Noninterest income is driven primarily by the Company’s retirement and benefit services and wealth business segments.

4

Table of Contents

The Company’s operations date back to 1879, when it was originally founded as the Bank of Grand Forks, one of the first banks chartered in the Dakota Territory. In 2000, the Company changed its name to Alerus Financial Corporation, reflecting the Company’s evolution from a traditional community bank to a high value financial services company focused on serving the needs of businesses and consumers who desire comprehensive financial solutions delivered through relationship-based advice and service. Since this rebranding, the Company has experienced significant growth, both organically and through a series of strategic acquisitions. This growth has allowed the Company to build a diversified franchise and expand its geographic footprint into growing metropolitan areas. The Company believes these initiatives have transformed itself into a high tech, high touch client service provider, increased earnings and allowed the Company to return more value to stockholders.

The Company’s Business Model and Products and Services

General

The Company’s business model is client centric, with a focus on offering a diversified range of solutions to clients who desire an advice-based relationship, enabling the Company to become the preferred financial services provider for clients. Through this approach, instead of focusing on the broader population, the Company targets specific business and consumer segments that the Company believes it can serve better than its competitors and that have meaningful growth potential. By offering sound financial advice and a long-term partnership, the Company believes it aligns best with clients who are achievement oriented in their purpose and will allow the Company to play an active role in their success at all stages of their businesses and lives. The Company classifies its consumer clients based on their financial needs and goals, aligning best with those clients with complex situations. The Company’s business clients are classified by industry, with a focus on specific high priority industries and client types, including professional services, finance and insurance, wholesale, small business, construction, retail, and manufacturers. The Company targets businesses with sales between $1.0 million and $100.0 million.

The Company’s commitment to delivering diversified solutions is driven by the Company’s “One Alerus” initiative, launched in 2017, which enables the Company to bring all of its product and service offerings to clients in a cohesive and seamless manner. Underlying the One Alerus initiative is the Company’s strategy of serving clients through a combination of technology and skilled advisors—a “high tech, high touch” approach that the Company believes clients demand and deserve. One Alerus lays the strategic foundation for current and future technology investments and the synergistic growth strategies of a diversified financial services firm. It also brings together the Company’s product and service offerings in a unified way, which the Company believes differentiates itself from competitors and allows the Company to impact clients more meaningfully and generate long term value for the Company. The primary components of One Alerus are:

Through One Alerus, the Company strives to provide each client with a primary point of contact—a trusted advisor—who takes the time to develop an in depth understanding of the client’s needs and goals. The Company’s advisors work holistically with clients in a guidance-based manner to proactively help them with their financial decisions. The Company’s products and services include traditional bank offerings such as checking accounts, debit cards, savings accounts, personal and business loans, credit cards, online banking, mobile banking / wallet, private banking, deposit and payment solutions, and mortgages, as well as fee income services such as individual retirement accounts (“IRAs”), 401(k) rollovers, retirement planning, employer sponsored plans, employee stock ownership plans, health savings account (“HSA”), flex spending account (“FSA”), administration and government health insurance program services, and wealth services such as advisory, investment management, and trust and fiduciary services. The advisor is equipped to tailor this diverse set of products and services to each client’s unique goals and is empowered to reach across the Company’s organization to bring the client in contact with product specialists as needed. One Alerus bridges the gaps between the Company’s business units with a focus on client advocacy. The Company believes the One Alerus initiative will enable the Company to achieve future organic growth by leveraging its existing client base and help continue to provide strong returns to the Company’s stockholders.

The trusted advisor relationship is supported and enhanced through an integrated client access portal called “My Alerus.” By collaborating with a key technology partner, the Company has integrated the diverse client applications of the Company’s full product suite into a unified system and layered in new technology to bring a client’s entire financial picture into one view. For example, a client who has multiple products with the Company, such as banking accounts, a mortgage, wealth accounts, a retirement account, and a health benefit account, can now access all of these accounts online and effect transactions via one, single login through My Alerus. Instead of being forced to use different usernames and passwords for each system, the Company has created a single login dashboard to access the most used information on client accounts and coupled that with the ability to link into more detailed information within each transaction system (banking, retirement and benefit, and wealth). The Company’s clients can further personalize their dashboard by integrating or linking financial accounts held at other institutions into My Alerus. Once the Company’s clients have integrated or linked all of their financial information, the data can be used to create a custom financial fitness score to help clients save for emergencies, plan for retirement, manage their debt, optimize health savings and protect them from unexpected events with insurance.

On October 9, 2024, the Company completed the acquisition of HMN Financial, Inc., the holding company of Home Federal Savings Bank. The primary reasons for the acquisition were to expand the Company’s business in the Rochester, Minnesota metropolitan statistical area (“Rochester MSA”), and grow the size of the overall Company. As consideration for the merger, the Company issued $123.6 million of its common stock (valued at $22.28 per share as of October 9, 2024) in a stock-for-stock transaction. As a result of the acquisition, the Company acquired $867.5 million in loans and assumed $957.6 million in deposits from Home Federal Savings Bank.

5

Table of Contents

Banking

Lending. Through the Company’s relationship-oriented lending approach, the Company’s strategy is to offer a broad range of customized commercial and consumer lending products for the personal investment and business needs of the Company’s clients. The Company’s commercial lending products include commercial loans, business term loans and lines of credit for a diversified mix of small and midsized businesses. The Company offers both owner occupied and non-owner occupied CRE loans, as well as construction and land development loans. The Company’s consumer lending products include residential first mortgage loans. In addition to originating these loans for the Company’s own portfolio, it originates and sells, primarily servicing released, whole loans in the secondary market. The Company’s mortgage loan sales activities are primarily directed at originating single family mortgages, which generally conform to Federal National Mortgage Association and Federal Home Loan Mortgage Corporation guidelines and are delivered to the investor shortly after funding. Additionally, the Company offers installment loans and lines of credit, typically to facilitate investment opportunities for consumer clients whose financial characteristics support the request. The Company also provides clients loans collateralized by cash and marketable securities.

The Company’s loan portfolio includes commercial and industrial (“C&I”) loans, CRE loans, which include construction, land and development loans, multifamily loans, non-owner occupied loans, and owner occupied loans, consumer loans, which include residential real estate (“RRE”) loans and other consumer loans, and a small amount of agricultural loans. The principal risk associated with each category of loans the Company makes is the creditworthiness of the borrower. Borrower creditworthiness is affected by general economic conditions and the attributes of the borrower and the borrower’s market or industry. The Company underwrites for strong cash flow, multiple sources of repayment, adequate collateral, borrower experience and backup guarantors. Attributes of the relevant business market or industry include the competitive environment, client and supplier availability, the threat of substitutes, and barriers to entry and exit.

Deposits. The Company provides a broad range of deposit products and services, including demand deposits, interest-bearing transaction accounts, money market accounts, time and savings deposits, and certificates of deposit. Core deposits, which consist of noninterest-bearing deposits, interest-bearing checking accounts, certificates of deposit less than $250,000, and money market accounts, provide the Company’s major source of funds from individuals, businesses and local governments. As of December 31, 2025, core deposits totaled $4.0 billion or 95.5% of the Company’s total deposits. The Company’s deposit portfolio includes synergistic deposits from the retirement and benefit services and wealth segments. As of December 31, 2025, these synergistic deposits totaled $1.0 billion. The Company also offers an HSA deposit program to attract low cost deposits. As of December 31, 2025, the Company had $203.4 million of HSA deposits which are included in the synergistic deposit total.

The Company offers a range of treasury management products, including electronic receivables management, remote deposit capture, cash vault services, merchant services, and other cash management services. Deposit flows are significantly influenced by general and local economic conditions, changes in prevailing interest rates, internal pricing decisions and competition. The Company’s deposits are primarily obtained from depositors located in the Company’s geographic footprint, and the Company believes that it has attractive opportunities to capture additional deposits in the Company’s markets. In addition, the Company has created a National Market to focus on growing the synergistic deposits from the retirement and benefit services and wealth segments. In order to attract and retain deposits, the Company relies on providing quality service, offering a suite of consumer and commercial products and services and introducing new products and services that meet the Company’s clients’ needs as they evolve.

Retirement and Benefit Services

The Company’s retirement and benefit services business offers retirement plan administration and investment advisory services, employee stock ownership plan (“ESOP”) administration, investment fiduciary services to retirement plans, HSA and other benefit services to clients on a nationwide basis. A breakdown of these services is as follows:

Wealth

The Company’s wealth division provides fiduciary services to consumer and commercial clients. These services include financial planning, investment management, personal and corporate trust services, estate administration, and custody services. In addition, the wealth division offers brokerage services to compliment the unique needs of its clients. The Company’s investment management services offer two unique and proprietary strategies called Dimension and Blueprint, which are primarily targeted toward IRAs, and agency account relationships. A Dimension account is a proprietary, separately managed account designed for individual investors, foundations, endowments and institutions with assets typically greater than $500 thousand. Dimension accounts use actively managed portfolios consisting of individual securities, mutual funds, and exchange traded funds selected and monitored by a centralized team of investment professionals. A Blueprint account uses a series of models that are designed to help investors gain exposure to a diversified, risk-based asset allocation. Portfolios in these accounts are comprised of mutual funds run by consistent, low-cost fund managers, with the Bank conducting initial and ongoing fund monitoring of the model allocations and rebalancing the portfolios on a regular basis.

The Company’s Banking Market Areas

The Company’s primary banking market areas are the states of North Dakota, Minnesota, specifically, the Twin Cities MSA and Rochester MSA, and Arizona, specifically, the Phoenix MSA. In addition to offices located in the Company’s banking markets, the retirement and benefit services business administers plans in all 50 states through an office located in Colorado.

6

Table of Contents

North Dakota

The Company’s corporate headquarters, which is a full-service banking office located at 401 Demers Avenue, Grand Forks, North Dakota 58201, primarily serves the eastern North Dakota market along with two other full-service banking offices located in Grand Forks, North Dakota, two full-service banking offices located in Fargo and West Fargo, North Dakota, and one full-service banking office located in Northwood, North Dakota. The Grand Forks MSA had total deposits of $12.7 billion as of June 30, 2025, and ranks as the 116th largest MSA in the United States in total deposits, based on FDIC data. The Fargo MSA had total deposits of $4.1 billion as of June 30, 2025, and ranks as the 268th largest MSA in the United States in total deposits, based on FDIC data. The Company believes this market is rich in low-cost, core deposits and is strengthened by the Bakken Oil region. The Company can use these low-cost, core deposits to fund loans in higher-growth metropolitan markets.

The State of North Dakota also features one of the only state-owned banks in the nation, the Bank of North Dakota, which offers services, many of which are similar to those offered by a correspondent bank, only to banks like the Company that are headquartered in the state. The Bank of North Dakota expands the Company’s lending capacity by purchasing participations from the Bank. In addition, the Bank of North Dakota offers the Company additional financing options such as bank stock loans, lines of credit and subordinated debt at competitive rates. Finally, the Bank of North Dakota enables state banks to take deposits and manage funds for municipal and county governments without meeting collateral requirements, which are waived by a letter of credit from the Bank of North Dakota.

Minnesota

The Company serves the Minnesota market through 19 full-service banking offices located primarily in the Twin Cities MSA and Rochester MSA. The Twin Cities MSA had total deposits of $232.6 billion as of June 30, 2025, and ranks as the 15th largest MSA in the United States in total deposits, based on FDIC data. The Twin Cities MSA is defined by attractive market demographics, including strong household incomes, dense populations, low unemployment, and the presence of a diverse group of large and small national and international businesses making the Twin Cities MSA one of the most economically vibrant and diverse markets in the country. The Rochester MSA had total deposits of $7.4 billion as of June 30, 2025, and ranks as the 173rd largest MSA in the United States in total deposits, based on FDIC data. The Rochester MSA is defined by attractive market demographics, including strong household incomes, low unemployment, and the presence of prominent healthcare companies.

Arizona

The Company serves the Arizona market through full-service banking offices located in Phoenix and Scottsdale, Arizona. The Phoenix MSA had total deposits of $180.8 billion as of June 30, 2025, and ranks as the 19th largest metropolitan statistical area in the United States in total deposits, based on FDIC data. The Phoenix MSA is defined by attractive market demographics, including a large number of high-net-worth households, dense populations, low unemployment, and the presence of a diverse group of small-to-medium sized businesses.

The Company’s National Market

The Company’s retirement and benefit services business serves clients in all 50 states. It offers retirement and benefit services at all of the Company’s banking offices located in the three primary market areas. In addition, the Company operates one retirement and benefit services office Colorado. In addition, the Company’s Chief Retirement Services Officer oversees the development of the national market’s client base. Retirement and benefit services assets under administration/management and wealth assets under administration/management attributable to the National Market were $35.3 billion and $0.6 billion, respectively, as of December 31, 2025, representing approximately 78.6% and 11.8%, respectively of total retirement and benefit services assets under administration/management and wealth assets under administration/management, as of that date.

Competition

The financial services industry is highly competitive, and the Company competes in a number of areas, including commercial and consumer banking, residential mortgages, wealth advisory, investment management, trust, and record-keeping among others. The Company competes with other bank and nonbank institutions located within the Company’s market areas, along with competitors situated regionally, nationally, and others with only an online presence. These include large banks and other financial intermediaries, such as consumer finance companies, brokerage firms, mortgage banking companies, business leasing and finance companies, credit unions, Fintech companies and digital asset service providers, all actively engaged in providing various types of loans and other financial services. The Company also faces growing competition from online businesses with few or no physical locations, including online banks, lenders and consumer and commercial lending platforms, as well as automated retirement and investment services providers. Competition involves efforts to retain current clients, obtain new loans, deposits, and advisory services, increase the scope and type of services offered, and offer competitive interest rates paid on deposits, charged on loans, or charged for advisory services. The Company believes its integrated and high-touch service offering, along with its sophisticated relationship-oriented approach sets the Company apart from competitors.

Human Capital Resources

The Company and its subsidiaries employed a total of 864 employees as of December 31, 2025, of which approximately:

The Company’s workforce further breaks down into the following categories:

7

Table of Contents

The Company operates as a commercial wealth bank and national retirement and benefit provider with the following breakdown of employees:

The staff and support divisions include 128 employees in Human Resources, Information Technology, Marketing, Audit, Legal, Compliance, and Executive staff.

Banking is a people- and relationship-driven business, and the Company’s employees are vital to the Company’s success in the financial services industry. In short, the Company’s long-term success depends on the Company’s ability to attract and retain top performers in every aspect of the Company’s business. The Company believes a diverse workforce better enables the Company to understand its client base, and to help its clients meet their own goals and expectations.

The Company’s culture is underpinned by its core values: Do the Right Thing (lead with integrity and provide valued advice and guidance), Passion for Excellence (act with accountability and a sense of urgency to best serve clients and achieve exceptional results), Success is Never Final (embrace opportunities to adapt and grow with our industry and our clients), and One Alerus (working together to provide purpose-driven products and services for our clients).

The development, attraction and retention of employees is a critical success factor for the Company for succession planning and sustaining its core values. To support the advancement of the Company’s employees, it offers training and development programs encouraging advancement from within and continues to fill its team with strong and experienced management talent. The Company leverages both formal and informal programs to identify, foster, and retain top talent at both the corporate and operating unit level. Training programs are offered through the Alerus University platform which provides a variety of courses in the areas of management, leadership, sales, technology, compliance, product knowledge, and on the job training opportunities. Alerus Essentials is a learning program for all employees to learn more about the Company’s goals, strategies, core values, and service offerings. Manager Connection provides managers across the Company an opportunity to learn together and share best practices for developing and leading teams.

The Company’s compensation programs are designed to align the compensation of its employees with the Company’s performance and to provide the proper incentives to attract, retain and motivate employees to achieve superior results. The structure of the Company’s compensation programs balances incentive earnings for both short-term and long-term performance. Specifically, the Company compensates most of its employees through a combination of base salary, sales incentive programs or an annual performance bonus program tied to company success measures, and a long-term equity program tied to Company long-term performance. Each element of compensation is designed to achieve a compensation package that is competitive in the Company’s markets and within the Company’s industry. The Company has engaged for 2025 and prior periods, compensation consultant FW Cook to perform compensation analysis and benchmarking compared to the peer group for executive compensation plans. For all other areas, the Company has used McLagan, a division of Aon, to provide benchmarking and analysis for base salary structures and sales incentive programs.

The Company’s benefits package provides employees medical, dental, vision, life, disability and accidental death insurance and paid time off benefits. The Company also provides its employees with retirement benefits designed to assist employees with planning for and securing appropriate levels of income during retirement. The Company believes these plans help attract and retain quality employees by offering benefits comparative with those offered by competitors.

The Company provides policies and training on ethical conduct. The Company maintains an open-door policy to encourage communication, feedback and discussion about any matter of importance to any employees. The Company hired Lighthouse Services to provide employees with a confidential reporting mechanism for misconduct, including discrimination, ethics, harassment and hostility, human resource issues, privacy, security and safety.

Corporate Information

The Company’s principal executive office is located at 401 Demers Avenue, Grand Forks, North Dakota 58201, and the Company’s telephone number at that address is (701) 795-3200. The Company’s website address is www.alerus.com. The information contained on the Company’s website is not a part of, or incorporated by reference into, this report. The SEC maintains an Internet site that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC, as the Company does. The website is www.sec.gov. The Company provides access to its SEC filings for viewing or downloading free of charge through its website at www.alerus.com. After accessing the website, the filings are available upon selecting “Investor Relations” and “SEC Filings.” Reports available include the Company’s proxy statements, annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and all amendments to those reports as soon as reasonably practicable after the documents and reports are electronically filed with or furnished to the SEC.

8

Table of Contents

SUPERVISION AND REGULATION

General

Alerus Financial Corporation, a financial holding company, and its subsidiary, Alerus Financial, National Association, a national banking association, are extensively regulated under federal law. As a result, the Company’s growth and earnings performance may be affected not only by management decisions and general economic conditions, but also by the requirements of applicable statutes and by the regulations and policies of various banking agencies, including the Company’s primary regulator, the Board of Governors of the Federal Reserve System (“Federal Reserve”), and the Bank’s primary regulator, the Office of the Comptroller of the Currency (“OCC”), as well as the FDIC, as the insurer of the Bank’s deposits, and consumer financial protection agencies. Furthermore, taxation laws administered by the Internal Revenue Service and state taxing authorities, accounting rules developed by the FASB, securities laws administered by the SEC, and state securities authorities, and anti-money laundering and sanctions laws enforced by the U.S. Department of the Treasury (“Treasury”), have an impact on the Company’s business. The effect of these statutes, regulations, regulatory policies, and accounting rules are significant to the Company’s operations and results.

Federal and state banking laws impose a comprehensive system of supervision, regulation, and enforcement on the operations of FDIC-insured institutions, their holding companies, and affiliates that is intended primarily for the protection of the FDIC-insured deposits and depositors of banks, rather than stockholders. These laws, and the regulations of the banking agencies issued under them, affect, among other things, the scope of the Company’s business; the kinds and amounts of investments that the Company and the Bank may make; required capital levels relative to the Company’s assets; the nature and amount of collateral for loans; the establishment of branches; the Company’s and the Bank’s ability to merge, consolidate and acquire; dealings with the Company’s and Bank’s insiders and affiliates; and the Company’s payment of dividends.

In response to the global financial crisis and particularly following passage of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”), the Company experienced heightened regulatory requirements and scrutiny. Although the reforms primarily targeted large banking organizations and systemically important financial institutions, their influence filtered down in varying degrees to community banking organizations over time and caused the Company’s compliance and risk management processes, and the costs thereof, to increase. The Economic Growth, Regulatory Relief and Consumer Protection Act of 2018 (the “Regulatory Relief Act”) clarified the inapplicability of certain of the Dodd-Frank Act reforms to community banking organizations, including relieving the Company of any requirement to engage in mandatory stress tests, maintain a risk committee, or comply with the Volcker Rule’s complicated prohibitions on proprietary trading and ownership of private funds.

Over the past year, the federal banking agencies have continued efforts to reduce regulatory burden on banking organizations, including community banks, through various supervisory, regulatory and policy initiatives. These efforts have included the rescission or revision of certain rulemakings and proposals, initiatives to streamline examination and application processes, and efforts to increase transparency and consistency in supervisory expectations. Congress also has considered additional measures aimed at easing specific compliance obligations for community banks, although no reforms comparable in scope to the Regulatory Relief Act have been enacted to date. The Company believes that these developments may be favorable to the operations of the Company or the Bank; however, future changes in laws, regulations, or supervisory priorities and their impacts on the Company’s or the Bank’s business, remain uncertain.

The supervisory framework applicable to U.S. banking organizations subjects banks and bank holding companies to regular examination by their respective banking agencies. These examinations result in confidential examination reports and supervisory ratings that may impact an institution’s operations, capital levels, growth, and strategic initiatives. Examinations consider not only compliance with applicable laws and regulations, but also capital levels, asset quality, management ability and performance, earnings, liquidity, and overall risk profile, among other things. The banking agencies generally have broad discretion to impose restrictions and limitations on the operations of a regulated entity where the agencies determine that such operations are unsafe or unsound, fail to comply with applicable law, or are otherwise inconsistent with laws and regulations. Changes in supervisory approach or emphasis may materially affect the operations and financial results of the Company and the Bank, as well as the banking industry in general. In recent supervisory communications, rulemakings, and policy statements, federal banking agencies have indicated an increased focus on core, material financial risks (rather than risk management processes), greater transparency in supervisory expectations, and efforts to reduce examination burden, particularly for community banks. For example, the OCC, the Bank’s primary federal regulator, has proposed or implemented initiatives: (i) to clarify standards for unsafe or unsound practices; (ii) to reduce the regulatory burden on community banking organizations in connection with anti-money laundering and countering the financing of terrorism examinations; and (iii) generally to streamline examination procedures for community banking organizations by allowing examiners to tailor the scope and frequency of examinations based on risk-based supervision, consistent with applicable laws and regulations. These initiatives may enable management to focus more effectively on growth opportunities and the management of material financial risks.

The following is a summary of the material elements of the supervisory and regulatory framework applicable to the Company and the Bank. It does not describe all of the statutes, regulations, and regulatory policies that apply, nor does it restate all of the requirements of those that are described. The descriptions are qualified in their entirety by reference to the particular statutory and regulatory provision.

The Role of Capital

Regulatory capital represents the net assets of a banking organization available to absorb losses. Because of the risks attendant to their business, FDIC-insured institutions, such as banks, as well as their holding companies (i.e., banking organizations) generally are required to hold more capital than other businesses, which directly affects the Company’s earnings capabilities. Although capital historically has been one of the key measures of the financial health of both bank holding companies and banks, its role became fundamentally more important in the wake of the global financial crisis, as the banking agencies recognized that the amount and quality of capital held by banking organizations prior to that crisis was insufficient to absorb losses during periods of severe stress.

Capital Levels. Banking organizations have been required to hold minimum levels of capital based on guidelines established by the federal banking agencies since 1983. The minimum capital levels for banking organizations have been expressed in terms of ratios of “capital” divided by “total assets.” The capital guidelines for U.S. banking organizations beginning in 1989 have been based upon international capital accords (known as the “Basel” accords) adopted by the Basel Committee on Banking Supervision, a committee of central banks and bank supervisors that acts as the primary global standard-setter for prudential regulation, as interpreted and implemented by the U.S. federal banking agencies on an interagency basis. These accords recognized that bank assets for the purpose of the capital ratio calculations needed to be risk weighted (the theory being that riskier assets should require more capital) and that off-balance sheet exposures needed to be factored in the calculations. Following the global financial crisis, the Group of Governors and Heads of Supervision, the oversight body of the Basel Committee on Banking Supervision, announced an agreement on a strengthened set of capital requirements for banking organizations around the world, known as the Basel III accords, to address deficiencies recognized in connection with the global financial crisis.

9

Table of Contents

The Basel III Rule. The U.S. federal banking agencies adopted the U.S. Basel III regulatory capital reforms, and, at the same time, effected changes required by the Dodd-Frank Act, in regulations that were effective in 2015 (with certain phase-ins), known as the Basel III Rule. The Basel III Rule established capital standards for banks and bank holding companies that are meaningfully more stringent than those in place previously, and are still in effect today. The Basel III Rule increased the required quantity and quality of capital and required a more complex, detailed, and calibrated assessment of risk in the calculation of risk weightings for bank assets. The Basel III Rule is applicable to all banking organizations that are subject to minimum capital requirements, including national and state banks and savings and loan associations, as well as to most bank and savings and loan holding companies. The Company and the Bank are each subject to the Basel III Rule.

Not only did the Basel III Rule increase most of the required minimum capital ratios in effect prior to January 1, 2015, but, by requiring that capital instruments be of higher quality to absorb loss, it introduced the concept of Common Equity Tier 1 Capital (“CET1”), which consists primarily of common stock, related surplus (net of Treasury stock), retained earnings, and CET1 minority interests, subject to certain regulatory adjustments and deductions. The Basel III Rule also changed the definition of regulatory capital by establishing more stringent criteria for instruments to qualify as Additional Tier 1 Capital (primarily non-cumulative perpetual preferred stock that meets certain requirements) and Tier 2 Capital (primarily other types of preferred stock and subordinated debt, subject to limitations). In addition, the Basel III Rule limited the inclusion of minority interests, mortgage-servicing assets, and deferred tax assets in regulatory capital and required deductions from CET1 if such assets exceeded prescribed thresholds.

The Basel III Rule requires banking organizations to maintain minimum capital ratios to be deemed “adequately capitalized,” as follows:

In addition, banking organizations that want to make capital distributions (including dividends and share repurchases) and pay discretionary bonuses to executive officers without restriction must maintain 2.5% of CET1 in the form of a capital conservation buffer. The purpose of the conservation buffer is to ensure that banking organizations maintain a cushion of capital that can be used to absorb losses during periods of financial and economic stress. Factoring in the capital conservation buffer increases the minimum ratios described above to 7% for CET1, 8.5% for Tier 1 Capital, and 10.5% for Total Capital.

Well Capitalized Requirements. The capital ratios described above represent minimum standards for banking organizations to be considered “adequately capitalized.” Banking agencies uniformly encourage banking organizations to maintain capital levels above these minimums and to be classified as “well capitalized.” To that end, federal law and regulations provide various incentives for banking organizations to maintain regulatory capital in excess of minimum regulatory requirements. For example, a well capitalized banking organization may: (i) qualify for exemptions from prior notice or application requirements otherwise applicable to certain activities; (ii) receive expedited processing of other required notices or applications; and (iii) accept, roll-over, or renew brokered deposits. In addition, the banking agencies may require higher capital levels where warranted by an institution’s specific risk profile or operating circumstances. For example, the Federal Reserve’s capital guidelines contemplate that additional capital may be required to take adequate account of, among other things, risks, such as interest rate risk, or risks associated with credit concentrations, nontraditional activities, or securities trading activities. Further, any banking organization experiencing or anticipating significant growth would be expected to maintain capital ratios, including tangible capital positions (i.e., Tier 1 Capital less all intangible assets), well above the minimum regulatory levels.

Under the capital regulations of the Federal Reserve for the Company and the OCC for the Bank, in order to be well capitalized, the Company and the Bank must maintain:

Under the Basel III Rule, a banking organization may be considered “well capitalized,” while not complying with the capital conservation buffer requirement described above.

As of December 31, 2025: (i) the Bank was not subject to a directive from the OCC to increase its capital and (ii) the Bank was well capitalized, as defined by OCC regulations. As of December 31, 2025, the Company had regulatory capital in excess of the Federal Reserve’s requirements and met the Basel III Rule requirements to be well capitalized. The Company also remained in compliance with the capital conservation buffer of 2.5 % as of December 31, 2025.

Basel III Endgame Proposal. Previously, the federal banking agencies proposed a “Basel III Endgame Rule” to complete the implementation of certain aspects of the Basel III accords; however, the proposal was not adopted, in part due to stakeholder concerns regarding potential economic impacts, data transparency, and the alignment of certain provisions with statutory tailoring requirements. Based on public statements from federal agency officials, it is anticipated that a revised proposal may be issued in the future. Any reproposal of the Basel III Endgame Rule is expected to primarily affect large, complex banking organizations.

10

Table of Contents

Prompt Corrective Action. The concept of a banking organization being “adequately capitalized” or “well capitalized,” as defined above, is part of a regulatory regime that provides the federal banking agencies with broad power to take “prompt corrective action” to resolve the problems of undercapitalized depository institutions based on the capital level of each particular institution. The extent of the banking agencies’ powers depends on whether the banking organization in question is “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” or “critically undercapitalized,” in each case as defined by regulation. Depending upon the capital category to which a banking organization is assigned, the agencies’ corrective powers include: (i) requiring the institution to submit a capital restoration plan; (ii) limiting the institution’s asset growth and restricting its activities; (iii) requiring the institution to issue additional capital stock (including additional voting stock) or to sell itself; (iv) restricting transactions between the institution and its affiliates; (v) restricting the interest rate that the institution may pay on deposits; (vi) ordering a new election of directors of the institution; (vii) requiring that senior executive officers or directors be dismissed; (viii) prohibiting the institution from accepting deposits from correspondent banks; (ix) requiring the institution to divest certain subsidiaries; (x) prohibiting the payment of principal or interest on subordinated debt; and (xi) ultimately, appointing a receiver for the institution.

Community Bank Capital Simplification. Community banking organizations have long raised concerns with federal banking agencies about the regulatory burden, complexity, and costs associated with certain provisions of the Basel III Rule. In response, the U.S. Congress provided an “off-ramp” for institutions, like the Company, with total consolidated assets of less than $10 billion as part of the Regulatory Relief Act. Section 201 of the Regulatory Relief Act specifically instructed the federal banking agencies to establish a single “Community Bank Leverage Ratio” (“CBLR”), of between 8 and 10%. Under a final regulation promulgated by the federal banking agencies, a community banking organization is eligible to elect to comply with its capital requirements under the CBLR framework if it has: (i) less than $10 billion in total consolidated assets; (ii) limited amounts of certain assets and off-balance sheet exposures; and (iii) a CBLR greater than 9%. In late 2025, the federal banking agencies proposed changes to the CBLR framework intended to encourage broader adoption, including reducing the required leverage ratio from 9.0% to 8.0%; however, the proposal has not yet been finalized. Neither the Company nor the Bank has elected to use the CBLR framework at this time.

Supervision and Regulation of the Company

General. The Company, as the sole stockholder of the Bank, is a bank holding company that has elected financial holding company status. As a bank holding company, the Company is registered with, and subject to regulation, supervision, and enforcement by, the Federal Reserve under the Bank Holding Company Act of 1956, as amended (the “BHCA”). The Company is legally obligated to act as a source of financial and managerial strength to the Bank and to commit resources to support the Bank in circumstances where the Company might not otherwise do so. Under the BHCA, the Company is subject to periodic examination by the Federal Reserve. The Company is required to file with the Federal Reserve periodic reports of the Company’s operations and such additional information regarding the Company and the Bank as the Federal Reserve may require.

Acquisitions and Activities. The primary purpose of a bank holding company is to control and manage banks. The BHCA generally requires the prior approval of the Federal Reserve for any merger involving a bank holding company or any acquisition by a bank holding company of another bank or bank holding company. Pursuant to the BHCA and the Dodd-Frank Act, the Federal Reserve may permit a well capitalized and well managed bank holding company to acquire banks located in any U.S. state, subject to federal deposit concentration limits, applicable nondiscriminatory state deposit-cap laws, and state minimum-existence requirements for target banks (not exceeding five years).

The BHCA generally prohibits the Company from acquiring direct or indirect ownership or control of more than 5% of a class of the outstanding voting shares of any nonbanking entity and from engaging in any business other than that of banking, managing, and controlling banks or furnishing services to banks and their subsidiaries. This general prohibition is subject to a number of exceptions. The principal exception allows bank holding companies to engage in, and to own shares of companies engaged in, certain businesses found by the Federal Reserve prior to November 11, 1999 to be “so closely related to banking... as to be a proper incident thereto.” This authority permits the Company to engage in a variety of banking-related businesses, including, among other things, the ownership and operation of a savings association, or any entity engaged in consumer finance, equipment leasing, the operation of a computer service bureau (including software development), and mortgage banking and brokerage services. The BHCA does not place formal territorial restrictions on the domestic activities of nonbank subsidiaries of bank holding companies. In addition to approval from the Federal Reserve that may be required in certain circumstances, prior approval for the establishment or acquisition of nonbank subsidiaries by the Company may be required from other agencies that regulate such nonbank company.

Financial Holding Company Election. Bank holding companies that meet certain BHCA eligibility requirements and elect to operate as financial holding companies may engage in, or own shares in companies engaged in, a wider range of nonbanking activities, including securities and insurance underwriting and sales, merchant banking and any other activity that: (i) the Federal Reserve, in consultation with the Secretary of the Treasury, determines by regulation or order is financial in nature or incidental to any such financial activity; or (ii) the Federal Reserve determines by order to be complementary to any such financial activity, as long as the activity does not pose a substantial risk to the safety or soundness of FDIC-insured institutions or the financial system generally. The Company has elected to operate as a financial holding company. In order to maintain the Company’s status as a financial holding company, both the Company and the Bank must be well capitalized, well managed, and the Bank must have at least a satisfactory Community Reinvestment Act (“CRA”) rating. If the Federal Reserve determines that either the Company or the Bank is not well capitalized or well managed, the Federal Reserve will provide a period of time in which to achieve compliance, but during the period of noncompliance, the Federal Reserve may place any limitations on the Company that it deems appropriate. Furthermore, if the Federal Reserve determines that the Bank has not received a satisfactory CRA rating, the Company would not be able to commence any new financial activities or acquire a company that engages in such activities.

Change in Control. Federal law prohibits any person or company from acquiring “control” of an FDIC-insured depository institution or its holding company without prior notice to the appropriate federal banking agency. “Control” is conclusively determined to exist upon the acquisition of 25% or more of the outstanding voting securities of a bank or bank holding company, but may be presumed to arise under certain circumstances between 10% and 24.99% ownership.

Capital Requirements. The Company is subject to the complex, consolidated capital requirements of the Basel III Rule, see “-The Role of Capital” above.

11

Table of Contents

Dividend Payments. The Company’s ability to pay dividends to stockholders may be affected by both general corporate law considerations and policies and capital requirements of the Federal Reserve applicable to bank holding companies. As a Delaware corporation, the Company is subject to the limitations of the Delaware General Corporation Law (the “DGCL”). The DGCL allows the Company to pay dividends only out of its surplus (as defined and computed in accordance with the provisions of the DGCL) or, if the Company has no such surplus, out of its net profits for the fiscal year in which the dividend is declared and/or the preceding fiscal year.

As a general matter, the Federal Reserve has indicated that the board of directors of a bank holding company should eliminate, defer, or significantly reduce dividends to stockholders if: (i) the company’s net income available to stockholders for the past four quarters, net of dividends previously paid during that period, is not sufficient to fully fund the dividends; (ii) the prospective rate of earnings retention is inconsistent with the company’s capital needs and overall current and prospective financial condition; or (iii) the company will not meet, or is in danger of not meeting, its minimum regulatory capital adequacy ratios. The Federal Reserve also possesses enforcement powers over bank holding companies and their nonbank subsidiaries to prevent or remedy actions that represent unsafe or unsound practices, or violations of applicable statutes and regulations. Among these powers is the ability to proscribe the payment of dividends by banks and bank holding companies. Finally, the Basel III Rule imposes consolidated capital requirements on banking organizations. As a result, banking organizations must hold a capital conservation buffer of 2.5% of risk-weighted assets in CET1 above the minimum risk-based capital requirements to avoid regulatory limits on dividends and other capital distributions. See “-The Role of Capital” above.

Monetary Policy. The monetary policy of the Federal Reserve has a significant effect on the operating results of bank holding companies and their subsidiaries. Among the tools available to the Federal Reserve to affect the money supply are open market transactions in U.S. government securities and changes in the discount rate on bank borrowings. These means are used in varying combinations to influence overall growth and distribution of bank loans, investments and deposits, and their use may affect interest rates charged on loans or paid on deposits, which may impact the Company’s business and operations.

Federal Securities Regulation. The Company’s common stock is registered with the SEC under the Securities Act of 1933 (the “Securities Act”) and the Securities Exchange Act of 1934 (the “Exchange Act”), each as amended. Consequently, the Company is subject to the information, proxy solicitation, insider trading, and other restrictions and requirements of the SEC.

Corporate Governance/Incentive Compensation. The Dodd-Frank Act addressed many investor protection, corporate governance, and executive compensation matters that affect most U.S. publicly traded companies. It increased stockholder influence over boards of directors by requiring companies to give stockholders a nonbinding vote on executive compensation and so-called “golden parachute” payments, and authorizing the SEC to promulgate rules that would allow stockholders to nominate and solicit voters for their own candidates using a company’s proxy materials.

The Dodd-Frank Act also directed the Federal Reserve, in coordination with the other federal banking and financial services agencies, to promulgate rules prohibiting excessive incentive-based compensation paid to executives of bank holding companies, regardless of whether such companies are publicly traded. Although several agencies have made repeated efforts to implement rules under this provision of the Dodd-Frank Act—including a proposal issued most recently in May 2024, which was subsequently withdrawn—no final rule has been adopted at this time. Nevertheless, the federal banking agencies have issued interagency guidance on sound incentive compensation practices for banking organizations, reflecting the agencies’ recognition that incentive compensation practices in the financial industry were among the factors contributing to the global financial crisis. The interagency guidance recognizes three core principles for effective incentive compensation plans: (i) appropriately balancing risk and reward; (ii) compatibility with effective controls and risk management; and (iii) support by strong corporate governance, including active and effective oversight by the organization’s board of directors. Although much of the guidance is directed at large banking organizations that are expected to maintain systematic and formalized policies and procedures, smaller banking organizations, like the Company, are expected to implement less extensive and less formalized systems pursuant to the guidance.

Supervision and Regulation of the Bank

General. The Bank is a national bank, chartered by the OCC under the National Bank Act, and a member of the Federal Reserve System. The deposit accounts of the Bank are insured by the deposit insurance fund (“DIF”) to the maximum extent provided under federal law and FDIC regulations, currently $250,000 per insured depositor ownership category. Ongoing policy discussions at the federal level have focused on potential changes to deposit insurance coverage, including possible adjustments to coverage limits, although no changes have been enacted.

As a national bank, the Bank is subject to the examination, supervision, reporting, and enforcement requirements of the OCC, the chartering authority for national banks. The Bank’s defined business lines of Banking, Retirement and Benefit, and Wealth are each subject to the OCC’s authority. The FDIC, as administrator of the DIF, also has residual regulatory authority over the Bank.

Supervision of Business Segments. As a national bank, the Bank is subject to examination and enforcement by the OCC. The OCC examines the Bank’s Banking business segment as part of its safety and soundness examinations, which evaluate not only compliance with applicable laws and regulations, but also capital adequacy, asset quality (with rigorous loan portfolio reviews), risk management, management ability and performance, earnings, liquidity, and various other factors. Many of these topics are discussed further below.

The Bank’s Retirement and Benefit and Wealth business segments are subject to separate examination as trust activities (generally on the same cycle as safety and soundness examinations). The OCC’s trust examinations evaluate compliance with applicable law, management ability, operations, internal controls and auditing, earnings, compliance, and asset management. In addition to federal oversight, these business segments are subject to a multitude of state laws (because trust law is primarily governed at the state level), as well as federal requirements applicable to the Bank and individual accounts. Relevant legal frameworks include trust investment law, securities law, banking law, tax law, contract law, anti-money laundering requirements, environmental law, consumer protection law, criminal law, and sanctions laws and regulations. The Employee Retirement Income Security Act of 1974 (“ERISA”) and the Internal Revenue Code are the primary sources of law governing the structure, administration, and operation of employee benefit plans. The U.S. Department of Labor is primarily responsible for administering and enforcing ERISA.

The OCC has broad enforcement authority to impose penalties, restrictions, and limitations on the Bank where it determines, among other things, that the Bank’s operations are unsafe or unsound, fail to comply with applicable law, or are otherwise inconsistent with laws and regulations.

12

Table of Contents

Deposit Insurance Assessments. As an FDIC-insured institution, the Bank is required to pay deposit insurance premium assessments to the FDIC. The FDIC has adopted a risk-based assessment system whereby FDIC-insured institutions pay insurance premiums at rates based on their risk classification. For institutions like the Bank that are not considered large and highly complex banking organizations, assessments are now based on examination ratings and financial ratios. The total base assessment rates, effective as of January 1, 2023, generally range from 2.5 basis points (for the lowest risk institutions) to 32 basis points or beyond (for higher risk institutions).

At least semi-annually, the FDIC updates its loss and income projections for the DIF and, if needed, increases or decreases the assessment rates, following notice and comment on proposed rulemaking. For this purpose, the reserve ratio is the DIF balance divided by estimated insured deposits. In response to the global financial crisis, the Dodd-Frank Act increased the minimum reserve ratio from 1.15% to 1.35% of the estimated amount of total insured deposits. In its May 2025 report, the FDIC stated that the reserve ratio likely will reach the statutory minimum by the September 30, 2028 deadline, and no adjustments to the base assessment rates are currently projected.

In addition, because the cost of the failures of Silicon Valley Bank and Signature Bank to the DIF attributable to the systemic risk exception was approximately $16.7 billion, the FDIC adopted a special assessment for banking organizations with assets of $5 billion or more. The base for the special assessment is equal to an insured depository institution’s estimated uninsured deposits for the December 31, 2022 reporting period, adjusted to exclude the first $5 billion in estimated uninsured deposits. Although the Company and the Bank are subject to the FDIC’s special assessment as a banking organization with assets of $5 billion or more, the Company does not have to pay the special assessment.

Supervisory Assessments. National banks are required to pay supervisory assessments to the OCC to fund the operations of the OCC. The amount of the OCC’s general assessment is calculated using a formula that considers the bank’s size and its supervisory condition. During the year ended December 31, 2025, the Bank paid supervisory assessments to the OCC totaling $488 thousand.

Capital Requirements. Banks are generally required to maintain capital levels in excess of other businesses. For a discussion of capital requirements, see “-The Role of Capital” above.

Liquidity Requirements. Liquidity is a measure of the ability and ease with which bank assets may be converted to meet financial obligations, such as deposits or other funding sources. Banks are required to implement liquidity risk management frameworks that ensure they maintain sufficient liquidity, including a cushion of unencumbered, high quality liquid assets, to withstand a range of stress events. The level and speed of deposit outflows contributing to the failures of Silicon Valley Bank, Signature Bank, and First Republic Bank in 2023 was unprecedented and contributed to acute liquidity and funding strain, underscoring the importance of liquidity risk management and contingency funding planning by insured depository institutions like the Bank, as highlighted in a 2023 addendum to existing interagency guidance on funding and liquidity risk management.

The primary roles of liquidity risk management are to: (i) prospectively assess the need for funds to meet financial obligations; and (ii) ensure the availability of cash or collateral to fulfill those needs at the appropriate time by coordinating the various sources of funds available to the institution under normal and stressed conditions. The Basel III Rule includes a liquidity framework that requires the largest insured institutions to measure their liquidity against specific liquidity tests. One test, referred to as the Liquidity Coverage Ratio (“LCR”), is designed to ensure that the banking organization has an adequate stock of unencumbered high-quality liquid assets that can be converted easily and immediately in private markets into cash to meet liquidity needs for a 30-calendar day liquidity stress scenario. The other test, known as the Net Stable Funding Ratio (“NSFR”), is designed to promote more medium- and long-term funding of the assets and activities of FDIC-insured institutions over a one-year horizon. These tests provide an incentive for banks and bank holding companies to increase their holdings in Treasury securities and other sovereign debt as a component of assets, increase the use of long-term debt as a funding source and rely on stable funding like core deposits (in lieu of brokered deposits). Although these tests do not apply to the Bank, the Company continues to review its liquidity risk management policies in light of regulatory requirements and industry developments.

Dividend Payments. The primary source of funds for the Company is dividends from the Bank. Under the National Bank Act, a national bank may pay dividends out of its undivided profits in such amounts and at such times as the bank’s board of directors deems prudent. Without OCC approval, however, a national bank may not pay dividends in any calendar year that, in the aggregate, exceed that bank’s year-to-date income plus the bank’s retained net income for the two preceding years. The payment of dividends by any FDIC-insured institution is affected by the requirement to maintain adequate capital pursuant to applicable capital adequacy guidelines and regulations, and an FDIC-insured institution generally is prohibited from paying any dividends if, following payment thereof, the institution would be undercapitalized. As described above, the Bank exceeded its capital requirements under applicable guidelines as of December 31, 2025. Notwithstanding the availability of funds for dividends, however, the OCC may prohibit the payment of dividends by the Bank if it determines such payment would constitute an unsafe or unsound practice. In addition, under the Basel III Rule, banking organizations that want to pay dividends have to maintain 2.5% in CET1 attributable to the capital conservation buffer. See “-The Role of Capital” above.

Investments, Activities and Acquisitions. The Bank is permitted to make investments and engage in activities directly or through subsidiaries as authorized by, and subject to the limitations set forth in, the National Bank Act, as well as OCC regulations and interpretations. The Bank may be required to obtain approval from the OCC and other applicable banking or financial services agencies before engaging in certain acquisitions or mergers under applicable state and federal law. With respect to interstate merger and acquisitions, federal law permits national banks to merge with banks in other states subject to: (i) regulatory approval; (ii) federal and state deposit concentration limits; and (iii) state law requirements that the merging bank has been in existence for a minimum period of time (not to exceed five years), prior to the merger. In 2025, the federal banking agencies, including the OCC and the FDIC, rescinded certain prior administrative actions regarding the review and approval of mergers and acquisitions, with the intent of streamlining and expediting the regulatory review of certain merger and acquisition applications.

Branching Authority. National banks headquartered in North Dakota, such as the Bank, have the same branching rights in North Dakota as banks chartered under North Dakota law, subject to OCC approval. North Dakota law grants North Dakota-chartered banks the authority to establish branches anywhere in the State of North Dakota, subject to receipt of all required regulatory approvals. The Dodd-Frank Act permits well capitalized and well managed banks to establish new interstate branches or to acquire individual branches of a bank in another state (rather than to acquire an out-of-state bank in its entirety) without impediments.

13

Table of Contents

Affiliate and Insider Transactions. The Bank is subject to certain restrictions imposed by federal law on “covered transactions” between the Bank and its “affiliates.” The Company is an affiliate of the Bank for purposes of these restrictions. Covered transactions subject to these restrictions include extensions of credit to the Company, investments in the stock or other securities of the Company and the acceptance of the stock or other securities of the Company as collateral for loans made by the Bank. The Dodd-Frank Act enhanced these requirements by expanding the definition of “covered transactions” and extending the period for which collateral requirements regarding covered transactions must be maintained.

Certain limitations and reporting requirements also apply to extensions of credit by the Bank to its directors and officers, to directors and officers of the Company and its subsidiaries, to principal stockholders of the Company and to “related interests” of such directors, officers and principal stockholders. In addition, federal law and regulations may govern the terms on which any person who is a director or officer of the Company or the Bank, or a principal stockholder of the Company, may obtain credit from banks with which the Bank maintains a correspondent relationship.

Safety and Soundness Standards/Risk Management. FDIC-insured institutions are expected to operate in a safe and sound manner. The federal banking agencies have adopted operational and managerial standards to promote the safety and soundness of such institutions that address internal controls, information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, compensation, fees and benefits, asset quality, and earnings.

These standards generally prescribe the goals to be achieved in each area, and each institution is responsible for establishing its own procedures to achieve those goals. If an institution fails to operate in a safe and sound manner, its primary federal regulator may require the submission of a plan to achieve and maintain compliance. Failure to submit an acceptable compliance plan, or to implement an approved plan in any material respect, may result in formal agency orders directing the institution to cure the deficiency. Until such deficiency is resolved, the agency may restrict the institution’s rate of growth, require additional capital, limit deposit rates, or take other corrective action as deemed appropriate. Operating in an unsafe or unsound manner also may constitute grounds for other enforcement action by the federal banking agencies, including cease and desist orders and civil money penalty assessments.

The federal banking agencies have emphasized the importance of sound risk management processes and strong internal controls when evaluating the activities of FDIC-insured institutions. In 2025, however, the agencies, including the OCC, signaled a shift toward focusing on the identification and management of material financial risks, rather than primarily on adherence to prescriptive operational processes. Although effective risk management, internal controls, and board and management oversight remain important, supervisory attention may increasingly center on whether specific practices pose material harm to the institution’s financial condition or create a risk of loss to the DIF. Despite this potential shift in focus, the agencies continue to evaluate a broad spectrum of risks—including credit, market, liquidity, operational, and legal risks—emphasizing their potential impact on safety and soundness. Notably, the federal banking agencies have taken a number of actions to remove reputation risk from consideration, citing concerns about its use in restricting banking services to certain industries or groups. The key risk themes identified for 2025 are discussed under Item 1A of this Form 10-K.

The Bank is expected to have active board and senior management oversight; adequate policies, procedures, and limits; adequate risk measurement, monitoring, and management information systems; and comprehensive internal controls. The federal banking agencies also have released specific risk management guidance on certain topics, including third-party relationships, in response to the proliferation of relationships between banking organizations and financial technology companies (although the guidance applies more broadly).

Privacy and Cybersecurity. The Bank is subject to numerous U.S. laws and regulations aimed at protecting non-public, personal and confidential information of its customers. These laws require the Bank to periodically disclose its privacy policies and practices regarding the sharing of such non-public customer information, and in certain circumstances, permit consumers to opt out of the sharing of information with unaffiliated third parties. They also limit the Bank’s ability to share certain information with affiliates and non-affiliates for marketing or nonmarketing purposes. In addition, as a part of its operational risk mitigation, the Bank is required to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of customer records and information, and to require the same of its service providers. These security and privacy policies and procedures are in effect across all business lines and geographic locations.

The Bank and the Company also are subject to a number of laws and regulations requiring notifications and disclosures regarding certain cybersecurity incidents. In addition, the Bank must consider and address cybersecurity risks as part of its risk management processes, including implementing and maintaining appropriate safeguards, monitoring and testing systems, and overseeing the cybersecurity practices of its service providers. Regulatory guidance emphasizes that cybersecurity should be integrated into overall enterprise risk management and business continuity planning.

Financial Subsidiaries. Under federal law and OCC regulations, national banks are authorized to engage, through “financial subsidiaries,” in any activity that is permissible for a financial holding company and any activity that the Secretary of the Treasury, in consultation with the Federal Reserve, determines is financial in nature or incidental to any such financial activity, except: (i) insurance underwriting; (ii) real estate development or real estate investment activities (unless otherwise permitted by law); (iii) insurance company portfolio investments; and (iv) merchant banking. The authority of a national bank to invest in a financial subsidiary is subject to conditions, including, among other things, requirements that the bank be well managed and well capitalized (after deducting from capital the bank’s outstanding investments in financial subsidiaries). At this time, the Bank has not applied for approval to establish any financial subsidiaries.

Federal Home Loan Bank System. The Bank is a member of a Federal Home Loan Bank (“FHLB”), which serves as a central credit facility for its members. The FHLB is funded primarily from proceeds from the sale of obligations of the FHLB system. It makes loans to member banks in the form of FHLB advances. All advances from the FHLB are required to be fully collateralized, as determined by the FHLB.

Community Reinvestment Act Requirements. The CRA imposes on the Bank a continuing and affirmative obligation, consistent with safe and sound operations, to help meet the credit needs of the entire community, including low- and moderate-income neighborhoods. The OCC regularly assesses the Bank’s record of meeting these credit needs through periodic CRA examinations. The Bank’s CRA ratings derived from these examinations can have significant impacts on the activities in which the Bank and the Company may engage. For example, a low CRA rating may impact the review of applications for acquisitions by the Bank or the Company’s financial holding company status.

In 2023, the federal banking agencies issued a final rule intended to strengthen and modernize the CRA regulations (the “CRA Rule”). The CRA Rule was subsequently challenged in court, which prevented it from taking effect. In 2025, the federal banking agencies issued a proposed rule to rescind the CRA Rule and reinstate the prior CRA regulatory framework adopted in 1995. Additionally, the OCC has indicated that, although the frequency of OCC examinations based on statutory requirements is unlikely to change, bank examiners will have greater discretion in determining the scope of compliance and consumer compliance activities that often inform the CRA evaluation process, which could result in more streamlined CRA examinations for community banks.

14

Table of Contents

Anti-Money Laundering/Countering the Financing of Terrorism/Sanctions. The Bank Secrecy Act (“BSA”) is a U.S. federal statutory framework, as amended and supplemented by subsequent laws and implemented through regulations, which is designed to combat money laundering, the financing of terrorism, and other illicit financial activity. The BSA and related anti-money laundering/countering the financing of terrorism (“AML/CFT”) laws and regulations are intended to prevent terrorists and criminals from accessing the U.S. financial system and have significant implications for FDIC-insured institutions and other businesses involved in the transmission of funds. Together, this regulatory framework provides a foundation to promote financial transparency and deter and detect efforts to misuse the U.S. financial system to launder criminal proceeds, finance terrorist acts, or facilitate other illicit conduct.

The BSA and related regulations require financial institutions to establish and maintain policies and procedures for addressing: (i) customer identification and due diligence; (ii) the prevention and detection of money laundering and terrorist financing; (iii) the identification and reporting of suspicious activities and certain currency transactions; (iv) compliance with laws relating to currency crimes; and (v) cooperation with law enforcement authorities. The Bank also must comply with stringent economic and trade sanctions regimes administered and enforced by the Office of Foreign Assets Control.

Although core AML/CFT statutory requirements and expectations remain unchanged, certain of the federal banking agencies, including the OCC, and the Financial Crimes Enforcement Network (FinCEN) have recently pursued or considered efforts to modernize and streamline AML/CFT compliance through a more risk-based approach, including targeted regulatory relief, revised examination expectations, and efforts to reduce certain compliance burden, particularly for lower-risk and community banking organizations.

Concentrations in Commercial Real Estate. Concentration risk exists when FDIC-insured institutions allocate a disproportionate amount of assets to any single industry or economic segment. Concentration in CRE lending is one area of regulatory focus. The interagency Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices guidance (the “CRE Guidance”) provides supervisory criteria, including the following numerical indicators, to assist bank examiners in identifying banks with potentially significant CRE concentrations that may warrant greater supervisory scrutiny. These indicators include: (i) total CRE loans exceeding 300% of capital and increasing 50% or more in the preceding three years; or (ii) construction and land development loans exceeding 100% of capital.

The CRE Guidance does not establish binding limits on CRE lending activities, but instead is intended to inform supervisory assessments of whether an institution’s risk profile, earnings capacity, and capital levels are commensurate with its CRE exposure. In recent years, the federal banking agencies have issued statements to reinforce prudent risk-management practices related to CRE lending, in response to observed growth in many CRE markets, increased competitive pressures, rising CRE concentrations, and an easing of CRE underwriting standards. In other statements, the agencies reminded FDIC-insured institutions to maintain underwriting discipline and to identify, measure, monitor, and manage the risks arising from CRE lending, including by holding capital commensurate with those risks. Based on the Bank’s loan portfolio, as of December 31, 2025, at 302.0%, the Bank's applicable investor CRE loans, as a percentage of its risk-based capital, slightly exceeded the regulatory guideline limit of 300%. Robust concentration management processes are in place to monitor this level of exposure, and the Company is following regulatory guidance as to prudent CRE concentration management, including appropriate underwriting and risk management practices.

Consumer Financial Services. The historical structure of federal consumer protection regulation applicable to all providers of consumer financial products and services changed significantly on July 21, 2011, when the CFPB commenced operations to supervise and enforce consumer protection laws. The CFPB has broad rulemaking authority for a wide range of consumer protection laws that apply to all providers of consumer products and services, including the Bank, as well as the authority to prohibit “unfair, deceptive or abusive” acts and practices. The CFPB has examination and enforcement authority over providers with more than $10 billion in assets. FDIC-insured institutions with $10 billion or less in assets, like the Bank, continue to be examined by their applicable banking agencies.

In response to mortgage-related abuses that contributed to the global financial crisis, the Dodd-Frank Act and CFPB rulemaking significantly expanded underwriting, disclosure and anti-predatory lending requirements for residential mortgage loans, including by imposing ability-to-repay standards and establishing a presumption of compliance for certain “qualified mortgages.” The CFPB has continued to refine these requirements through additional rulemaking addressing qualified mortgages ability-to-repay standards.

Over the last several years, the CFPB has taken an aggressive approach to the regulation (and supervision, where applicable) of providers of consumer financial products and services. However, more recently, changes in leadership and policy direction have led to: (i) shifts in regulatory priorities, including the rescission or reconsideration of certain CFPB guidance and rules; (ii) a reduction in CFPB enforcement activity; and (iii) constraints on the CFPB’s budget and resources, although the CFPB continues to retain statutory authority to administer, supervise, and enforce federal consumer financial protection laws. The CFPB’s rules have not had a significant impact on the Bank’s operations, except for higher compliance costs.

Although national banks, including the Bank, historically have benefited from federal preemption of certain state consumer protection laws, recent court decisions have called into question the scope of preemption under the National Bank Act, potentially narrowing the circumstances in which such laws are preempted, as applied to national banks operating in particular states. As a result, national banks, including the Bank, may be required to monitor, and potentially comply with, a broader range of state consumer protection requirements that could increase the Bank’s compliance costs and regulatory complexity, notwithstanding continued OCC support for a robust interpretation of preemption under the National Bank Act.