Avidbank Holdings, Inc. (AVBH) Business

Item 1. Business

Overview

We are Avidbank Holdings, a bank holding company based in San Jose, California that operates through our wholly owned subsidiary, Avidbank, a California state-chartered bank ("Avidbank" or the "Bank"). Founded in 2003, Avidbank is a full-service commercial bank dedicated to providing innovative banking solutions to a diverse client base, including small-to-medium sized businesses, technology companies, and individuals through robust portfolios of lending products, deposit services, and digital banking capabilities. We believe we provide competitive deposit products and treasury management solutions with a high-touch, relationship-driven approach, guided by our commitment to being Responsive, Collaborative & Accountable—principles we embody in every client interaction. Our experienced management team focuses on loan growth while striving to maintain excellent credit quality, core deposit expansion, noninterest income growth and improving operational efficiency. We focus on corporate banking, commercial real estate, and real estate construction lending in the Bay Area (which we define as the counties of Alameda, Contra Costa, Marin, Monterey, Napa, San Francisco, San Mateo, Santa Clara, Santa Cruz, Solano, and Sonoma), while also maintaining a growing national presence in Venture Lending and Specialty Finance.

As of December 31, 2025, we had total consolidated assets of $2.57 billion, total loans of $2.15 billion, total deposits of $2.19 billion and total shareholders’ equity of $281.0 million.

Initial Public Offering and Repositioning of our Available-for-Sale Securities Portfolio

On August 11, 2025, the Company completed the sale of 2,610,000 shares of common stock, no par value per share, at a public offering price of $23.00 per share in its initial public offering (“IPO”). On August 13, 2025, the underwriters fully exercised their option to purchase an additional 391,500 shares of Common Stock in connection with the IPO, at the public offering price.

Proceeds from the IPO were used to increase the capital of the Bank to support our organic growth strategies, including expanding our overall market share and our lending activities, strengthening our regulatory capital, optimizing our balance sheet by repositioning a substantial portion of our available-for-sale securities portfolio as well as repaying short-term borrowings and non-core funding, and for working capital and other general corporate purposes. We received $274.7 million in proceeds from securities sold as part of this repositioning of the available-for-sale securities portfolio during the third quarter of 2025 at a pre-tax loss of $62.4 million and purchased $205.4 million in available-for-sale securities with an average purchase yield of 4.57% and a duration of 5.4 years. Additionally, we paid off existing short-term borrowings using proceeds from the IPO.

Our Market Area

The Bank operates with one branch located in San Jose, California and one loan production office in each of San Francisco, California and Redwood City, California. In addition, our Specialty Finance and Venture Lending divisions have bankers and customers located throughout the United States. We have banking relationships in 39 states with approximately 26% of our loan balances located outside of California as of December 31, 2025.

-5-

Table of Contents

Strategic Focus

We aim to drive sustainable organic growth by leveraging our established platform, capitalizing on market disruption, and adapting to an evolving banking landscape. Our strategic goals include:

Our Banking Divisions

The Bank is a full-service commercial bank with a focus in the Bay Area through our Corporate Banking, Commercial Real Estate, and Construction Lending divisions, and expanded reach both in the Bay Area and nationally through our Venture Lending and Specialty Finance divisions. In addition to providing products and services, the Bank emphasizes long-standing client relationships and tailors its products and services to meet the unique needs of its customers. Each loan is sourced and placed in a specific division based on product type and source of repayment.

The Bank’s commercial and industrial lending takes place in three divisions: Corporate Banking, Venture Lending, and Specialty Finance. Each of these divisions caters to different borrower profiles based on our initial loan origination assessment, which are defined as follows. Generally, Corporate Banking clients generate positive cash flow but have no institutional investors. Venture Lending clients are backed by institutional investors but have negative cash flow. Sponsor Finance clients within the Specialty Finance division are backed by institutional investors and generate positive cash flow, and the typical use of proceeds is to help facilitate an acquisition. In addition to Sponsor Finance, the Specialty Finance division also offers Asset-Based Lending and Accounts Receivable Factoring/Finance products. Because the latter two products include more stringent funding controls, occasionally after the loans are successfully originated, clients have been transitioned from other divisions into these products as a risk management tool.

More detail on our five banking divisions is as follows:

Corporate Banking Division

The Corporate Banking division specializes in delivering customized Commercial & Industrial lending solutions to small to mid-sized privately held businesses across a wide range of industries in the Bay Area. These loans are primarily used for funding operations, expansions, acquisitions and owner-occupied real estate loan acquisitions or refinances. Borrowers typically demonstrate consistent historical profitability, low balance sheet leverage and high liquidity. Our primary source of repayment is cash flow generated by the business, which is typically bolstered by personal guarantees. Loan terms range from 12 months for short-term working capital needs to 10 years for long-term real estate holdings. The loans typically have sizes of up to $20 million. The Bank’s client relationships include the borrower’s banking business in addition to the business of its owner(s) and often one or more affiliated entities.

-6-

Table of Contents

To a significantly lesser extent, the Bank also offers home equity lines of credit and consumer loans in our Corporate Banking, Commercial Real Estate, and Construction Lending divisions. Home equity lines of credit are loans made with a residence serving as collateral and may have a variety of reasons for the borrowing including providing funding to a business or paying for large personal expenditures. Consumer loans are primarily extended to individuals that may be unsecured or secured by collateral other than real estate. The unsecured loans are generally revolving personal lines of credit to established clients. As of December 31, 2025, our Corporate Banking deposits and loans totaled approximately $635 million and approximately $423 million, respectively.

Commercial Real Estate Division

This division is focused on term financing for commercial, multi-family and mixed-use properties throughout the Bay Area. Our team of local lenders provides financing for commercial real estate purchases and refinances, leveraging deep market expertise to structure loans that align with borrower needs and their investment objectives. The loans typically have sizes of up to $20 million and include acquisition and bridge to long term/permanent commercial real estate financing. Our commercial real estate loans are typically secured by multifamily, office, industrial, retail or other commercial properties. Our commercial real estate loans generally have amortization terms of 15 to 25 years with adjustable interest rates. As of December 31, 2025, our commercial real estate deposits and loans totaled approximately $43 million and approximately $612 million, respectively.

Construction Lending Division

The Construction Lending division specializes in financing the construction of high-end residential properties for experienced local developers and homeowners throughout the Bay Area. With deep roots in the community and long-standing relationships with local developers, our team brings extensive skill and knowledge of the region’s development landscape. We offer financing across all stages of development, including land acquisition, pre-development and construction for residential and commercial projects. These loans are designed to support both individual and commercial development projects and normally have sizes of up to $18 million. The maximum loan-to-value ratio is generally 70% of the lesser of the appraised value or the purchase price of the property, which ratio is subject to increase over the term of the loan if there are significant cost overruns or a decrease in the value of the property. As of December 31, 2025, our Construction Lending deposits and loans totaled approximately $21 million and approximately $242 million, respectively.

Venture Lending Division

Started in 2019, our Venture Lending division provides banking services to a broad spectrum of venture-backed technology companies and directly to venture capital and private equity firms. With team members positioned in key innovation hubs nationwide, we support emerging technology companies across the country that have secured equity capital from institutional investors, including venture capital and private equity firms. The banking needs of these clients are such that Venture Lending clients commonly generate balances of deposits well in excess of their borrowing needs.

Our targeted venture-backed technology clients are primarily companies that have received at least one round of funding from institutional investors and operate in industries such as software, information technology, fintech, telecommunications and digital healthcare. These technology companies normally have strong revenue growth with negative operating cash flows and no record of profitability while typically relying on future rounds of investor funding as our primary source of repayment. Loan sizes are typically up to $20 million. As of December 31, 2025, our Venture Lending deposits and loans totaled approximately $852 million and approximately $377 million, respectively, with 75% of deposits tied to existing lending relationships.

Specialty Finance Division

Specialty Finance is made up of three teams providing unique credit solutions: Sponsor Finance Lending, Asset Based Lending and Accounts Receivable Factoring/Finance.

Sponsor Finance Lending provides traditional private equity and search fund backed acquisition financing to lower-middle market businesses across the United States, with loans typically sized up to $20 million. Our portfolio spans a diverse range of industries, including software, healthcare, managed services, industrial services, staffing, manufacturing, behavioral health, media, retail, and education. Our primary source of repayment is cash flow generated from the business. With over a decade of experience, we have cultivated strong relationships with institutional funds and search fund sponsors.

-7-

Table of Contents

Asset-Based Lending provides tailored financing solutions to businesses across the United States secured by assets such as accounts receivable and inventory. Loan sizes are typically up to $20 million. Our target customers typically represent manufacturing, wholesaling and technology companies. Our primary source of repayment is collections from such collaterals (i.e., accounts receivable and inventory sales), and these loans have more stringent controls including a Lockbox and/or Bancontrol account than the accounts receivable based lines provided to Venture Lending or Sponsor Finance clients, which clients generally have stronger balance sheets and/or generate positive cash flow. We endeavor to work with a diverse set of clients in order to avoid industry concentration risk in our Asset-Based Lending portfolio.

Accounts Receivable Factoring/Finance provides invoice finance solutions to a variety of businesses nationally. Loan sizes are typically up to $10 million. Our primary source of repayment is collections from account debtors. This group has a diversified industry focus representing manufacturing, wholesaling and technology companies.

As of December 31, 2025, Specialty Finance deposits and loans totaled approximately $473 million and approximately $485 million, respectively.

Treasury Management Services

Our Treasury Management team plays a critical role in working with our bankers to grow deposits and noninterest income by leveraging client relationships. A key initiative that started in 2023 was bolstering this team with the addition of our Executive Vice President of Treasury Management Services and key treasury management sales and support hires. The expanded treasury management team is responsible for deposit growth and pricing, treasury product management, and non-interest income growth though services charges, credit cards, foreign exchange, and trade finance. This team shifted the treasury management team’s focus from operational support to proactive outreach, providing our bankers with additional resources to generate core deposit growth and expanding our suite of deposit offerings. Additionally, the team is developing new deposit initiatives, including 1031 exchange deposits. These deposits, held through qualified intermediaries, totaled approximately $144.6 million as of December 31, 2025.

The Bank offers a competitive suite of treasury management services to enable clients to best support their cash management requirements, including online and mobile banking, bill payments, ACH, domestic and international wires, remote deposit capture, positive pay, ZBA accounts and sweeps. In addition, the Bank offers clients access to business and commercial credit cards, foreign exchange services, merchant services, lockbox and trade finance, inclusive of standby and commercial letters of credit.

Credit Risk Management and Credit Philosophy

Loan Approval Process and Authority. Pursuant to applicable law, the aggregate amount of loans that we are permitted to make to any one borrower is generally limited to 15% of the sum of the Bank’s shareholders’ equity, allowance for credit losses, capital notes, and debentures (obligations to any one borrower, secured and unsecured, in all may not exceed 25% of the sum of the Bank’s shareholders’ equity, allowance for credit losses, capital notes, and debentures). Our unsecured legal lending limit was $46.5 million and our secured legal lending limit was $77.4 million at December 31, 2025. In addition, we have established an in-house target that is less than the legal limits on loans to one borrower. Our in-house unsecured target was $20 million, our in-house unsecured target for Fund Finance was $25 million, and our secured in-house target was $30 million at December 31, 2025. At December 31, 2025, our 10 largest credit relationships represented 12.3% of our total loan commitments.

Our lending activities follow written, nondiscriminatory underwriting standards and loan origination procedures established by our board of directors and management. The Bank has established standard levels of loan authority to more efficiently service our clients, prudently manage credit risks, and effectively ensure that credit policies are followed. Loans with aggregated commitments below the Officers’ Loan Committee (OLC) authority level are approved by individual or dual authority within the Credit Administration team. The OLC has authority to approve loans beginning over $4 million for unsecured and $6 million for secured up to and including the house limit. In addition, our Board’s Credit Committee (CC) has authority to approve loans over the house limit up to the legal lending limit of the Bank (with the exception of Regulation O (insider) loans which need to be approved by the board of directors).

-8-

Table of Contents

Ongoing Credit Risk Management. In addition to the underwriting process referenced above, we perform ongoing risk monitoring and review processes for all credit exposures. Although we grade and classify our loans internally, we have an independent third-party professional firm perform regular loan reviews to confirm loan classifications. We strive to identify potential problem loans early to aggressively seek resolution of these situations before the loans create a loss, record any necessary charge-offs promptly and maintain adequate allowance levels for credit losses expected in the loan portfolio.

Although we maintain a cautious credit outlook due to continued uncertainty in the economic environment, we believe the Bank is well positioned for the months ahead given a strong allowance for credit losses, application of prudent underwriting standards and a diverse loan portfolio.

Allowance for credit losses. The allowance for credit losses is evaluated on at least a quarterly basis by management and approved by the Board of Directors. It is based upon management’s periodic review of the collectability of the loans considering historical experience, the size and composition of the loan portfolio, adverse situations that may affect a borrower’s ability to repay, estimated value of any underlying collateral and prevailing economic conditions. This evaluation is inherently subjective as it requires estimates that are susceptible to significant revision as more information becomes available. As of December 31, 2025, the allowance for credit losses – loans and unfunded commitments to total loans was 1.15%.

Risk Management

We believe that effective risk management and control processes are critical to our safety and soundness, our ability to predict and manage the challenges that we face and, ultimately, our long-term corporate success. Risk management refers to the activities by which we identify, measure, monitor, evaluate and manage the risks we face during our banking activities. These include liquidity, interest rate, credit, operational, compliance, regulatory, strategic, financial and reputational risk exposures. Our board of directors, both directly and through its committees, is responsible for overseeing our risk management processes.

We place significant emphasis on risk mitigation as an integral component of our organizational culture. We have a Risk Operating Committee comprised of members of our executive management team and other senior members of the Bank responsible for implementing our risk management processes, including assessing and managing the risks we face.

The Audit Committee of our board of directors is responsible for overseeing financial, operational, compliance, and risks associated with financial matters. The Credit Committee is responsible for oversight of credit policies and overall credit quality of the loan portfolio. The Asset Liability Committee (ALCO) is responsible for controls over liquidity management, interest rate risk, capital, and pricing risk. See section entitled “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Risk Framework.”

Competition

The banking business is highly competitive, and we face strong competition from many other financial institutions. The Bank’s primary market for corporate banking and real estate teams is the Bay Area. Our venture lending and specialty finance teams compete nationally, in addition to the Bay Area. Our venture lending and specialty finance teams have built relationships with an extensive network of venture capital firms, institutional investors and private equity firms that invest in companies on a national basis. As a result of our strong domain expertise and deep relationships with these investors, these investors are a key referral source for our bankers to companies located across the country.

Our principal competitors are commercial and community banks, credit unions, non-bank lenders and consumer finance companies, including large national financial institutions that operate in our market. By virtue of their larger capital bases, these larger institutions have substantially greater lending limits than those of the Bank, as well as more locations, more products and services, greater economies of scale and greater ability to make investments in technology for the delivery of financial services.

-9-

Table of Contents

To compete effectively with these larger financial institutions, we differentiate ourselves through specialized services tailored to customer needs, responsive and highly personalized client service, experienced bankers with a strong track record of success and our one-branch model that allows for operational efficiency. Additionally, by leveraging our extensive banking relationships in the markets where we operate, we assist our customers requiring services not directly offered by us to obtain such services from our correspondent banks. For example, for customers whose loan demands exceed our lending limits, we seek to arrange funding for such loans on a participation basis with our correspondent banks or other independent commercial banks.

With respect to non-lending products such as deposits, treasury management services, and foreign exchange, we also compete with national, regional and local commercial banks. Such banks are frequently larger financial institutions than we are that have benefits of scale and can often offer more attractive prices and features than those we can offer. However, we believe our full spectrum of banking services, delivered in a personalized, high-touch manner, allows us to compete favorably in all of our markets. Although the competition in our markets is strong, we believe our breadth of products, our experience and our personalized, high-touch service continue to provide us with growth opportunities.

Employees and Human Capital

We believe that the success of our business is largely driven by the quality of our employees, the development of each employee’s full potential and our ability to provide timely and satisfying rewards. At December 31, 2025, we employed 151 full-time equivalent employees. We are not a party to any collective bargaining agreement.

We encourage and support the growth and development of our employees and, wherever possible, seek to fill positions by promotion and transfer from within the organization. Continual learning and career development are advanced through ongoing development conversations and annual performance reviews with employees, internally developed training programs, conferences and other training events that employees are encouraged to attend in connection with their job duties. Additionally, we invest in continual learning and development through tuition reimbursement for courses, degree programs and fees paid for certifications.

On an ongoing basis, we further promote the health and wellness of our employees by strongly encouraging work-life balance, offering flexible work schedules, keeping the employee portion of health care premiums to a minimum and sponsoring various wellness programs. We believe employee retention is crucial to operating efficiency and achieving one of our business objectives, which is being an exceptional service provider. We believe our commitment to actively prioritizing our employees’ well-being, supporting their career goals, offering competitive wages and providing valuable fringe benefits aids in retention of our top-performing employees.

Corporate Headquarters and Available Information

Our principal executive office is located at 1732 North First Street, 6th Floor, San Jose, California 95112, and our telephone number is (408) 200-7390. Our internet website can be found at www.avidbank.com. Our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and all amendments to those reports can be found on our internet website as soon as reasonably practicable after such materials are electronically filed with or furnished to the SEC. Copies of the Company's filings with the SEC may also be obtained directly from the SEC's website at www.sec.gov. These documents may also be obtained in print upon request to our Corporate Secretary.

Also posted on our website and available in print upon request to our Corporate Secretary, are the charters for our Audit Committee, Compensation Committee and Nominating and Governance Committee, as well as our Corporate Governance Guidelines and Code of Ethics. Within the time period required by the SEC and Nasdaq, we will post on our website any amendment to the Code of Ethics and any waiver applicable to our senior financial officers, as defined by the SEC, and our executive officers or directors. In addition, our website includes information concerning purchases and sales of our equity securities by our executive officers and directors, as well as disclosure in investor presentations including certain non-GAAP financial measures (as defined in the SEC's Regulation G) that we may make public orally, telephonically, by webcast, by broadcast or by similar means from time to time. None of the information posted on our website is incorporated by reference herein.

-10-

Table of Contents

SUPERVISION AND REGULATION

General

The Company and the Bank are subject to significant regulation and restrictions under applicable federal and state laws and by various regulatory agencies. These regulations and restrictions are intended primarily for the protection of depositors and the Federal Deposit Insurance Corporation (“FDIC”) Deposit Insurance Fund (“DIF”) and secondarily for the stability of the U.S. banking system. The following discussion of statutes and regulations is a summary and does not purport to be complete nor does it address all applicable statutes and regulations. This discussion is qualified in its entirety by reference to the statutes and regulations referred to in this discussion. From time to time, federal and state legislation is enacted and implemented by regulations which may have the effect of materially increasing the cost of doing business, limiting or expanding permissible activities, or affecting the competitive balance between banks and other financial services providers.

We cannot predict whether or when other legislation or new regulations may be enacted, and if enacted, the effect that new legislation or any implemented regulations and supervisory policies would have on our financial condition and results of operations. Such developments may further alter the structure, regulation, and competitive relationship among financial institutions, may limit the types or pricing of the products and services we offer, and may subject us to increased regulation, disclosure, and reporting requirements. We also cannot predict whether or when regulatory requirements may be reduced or eliminated and the overall effect such reduction or elimination may have on the Company and the Bank. We also cannot predict the extent or scope of any regulatory reforms.

Legislation and Regulatory Developments

The federal banking agencies have the ability to promulgate regulations and guidelines intended to ensure the financial strength and safety and soundness of banks and the stability of the U.S. banking system. While we believe the Trump administration will seek to implement a regulatory reform agenda that is different than that of the Biden administration, impacting the rulemaking, supervision, examination and enforcement priorities of the federal banking agencies, the scope of such changes cannot currently be determined.

Capital Adequacy Requirements

Bank holding companies and banks are subject to various regulatory capital requirements administered by federal and state bank regulatory agencies. Capital adequacy regulations and prompt corrective action regulations involve quantitative measures of assets, liabilities, and certain off-balance sheet items calculated under regulatory accounting practices, as well as qualitative judgments by the regulators about components of capital, risk-weightings, and other factors. United States capital regulations were substantially revised in 2013 as a result of changes in the Dodd-Frank Act and Basel III capital rules. The Federal Reserve and the FDIC, the primary federal regulators of the Company and Bank, respectively, have substantially similar generally applicable risk-based capital ratio and leverage ratio requirements.

We operate under the Federal Reserve’s Small Bank Holding Company Policy Statement, which exempts from the Federal Reserve’s risk-based-capital and leverage rules bank holding companies with assets of less than $3.0 billion that are not engaged in significant nonbanking activities, do not conduct significant off-balance sheet activities and that do not have a material amount of debt or equity securities registered with the SEC. Historically, the Federal Reserve has not usually deemed a bank holding company ineligible for application of this policy statement solely because its common stock is registered under the Exchange Act. However, there can be no assurance that the Federal Reserve will continue this practice, and changes to this practice may result in the loss of its eligibility under the Small Bank Holding Company Policy Statement for these purposes.

If the Company was no longer subject to the Small Bank Holding Company Policy Statement, the following generally applicable capital requirements that apply to the Bank also would apply to the Company. The Bank is required to meet a common equity Tier 1 capital to risk-weighted assets ratio of at least 7.00% (a minimum of 4.50% plus a capital conservation buffer of 2.50%), a Tier 1 capital to risk-weighted assets ratio of at least 8.50% (a minimum of 6.00% plus a capital conservation buffer of 2.50%), a total capital to risk-weighted assets ratio of at least 10.50% (a minimum of 8.00% plus a capital conservation buffer of 2.50%), and a Tier 1 leverage ratio of at least 4.00%. In addition, insured depository institutions such as the Bank, unlike bank holding companies, are subject to further capital requirements to be deemed “well-capitalized” under the prompt corrective action provisions of the FDI Act and implementing regulations of the federal banking agencies, as described in the section entitled “Supervision and Regulation of the Bank—Prompt Corrective Action” below.

-11-

Table of Contents

For purposes of calculating the denominator of the risk-based capital ratios, a banking institution’s assets and some of its specified off-balance sheet commitments and obligations are assigned to various risk categories. For purposes of calculating the numerator of the capital ratios, capital, at both the holding company and bank levels, is classified in one of three tiers depending on the “quality” and loss-absorbing features of the capital instrument. Common equity Tier 1 capital is predominantly comprised of common stock instruments (including related surplus) and retained earnings, net of treasury stock, and after making necessary capital deductions and adjustments. Tier 1 capital is comprised of common equity Tier 1 capital and additional Tier 1 capital, which includes non-cumulative perpetual preferred stock and similar instruments meeting specified eligibility criteria (including related surplus). Total capital is comprised of Tier 1 capital and Tier 2 capital, which includes certain subordinated debt with a minimum original maturity of five years (including related surplus) and a limited amount of allowance for loan losses. Newly issued trust preferred securities and cumulative perpetual preferred stock may be included in Tier 1 capital, provided they do not include features that are disallowed by the capital rules, such as the acceleration of principal other than in the event of bankruptcy, insolvency, or receivership of the issuer. Failure to meet minimum capital requirements could subject a banking organization to a variety of enforcement remedies. A banking organization’s failure to exceed the capital conservation buffer with common equity Tier 1 capital would result in limitations on the banking organization’s ability to make capital distributions and discretionary bonus payments.

Capital amounts and classifications are also subject to qualitative judgments by regulators about components, risk weighting and other factors. Bank holding companies and banks engaged in significant trading activity may also be subject to the market risk capital guidelines and be required to incorporate additional market and interest rate risk components into their risk-based capital standards. Bank holding companies are also required to act as a source of financial strength to their subsidiary banks. Under this policy, the Company must commit resources to support the Bank even when the Company may not be in a financial position to provide it.

Regulatory Capital and Risk-weighted Assets

The Federal Reserve monitors our capital adequacy on a consolidated basis, and the FDIC and the California Department of Financial Protection and Innovation (“DFPI”) monitor the capital adequacy of our Bank. These rules implement the Basel III international regulatory capital standards in the United States, as well as certain provisions of the Dodd-Frank Act. These quantitative calculations are minimums, and the Federal Reserve, FDIC or DFPI may determine that a banking organization (like the Company or the Bank), based on its size, complexity or risk profile, must maintain a higher level of capital in order to operate in a safe and sound manner.

Under the Basel III Capital Rules, the Bank’s assets, exposures and certain off-balance sheet items are subject to risk weights used to determine the institutions’ risk-weighted assets. These risk-weighted assets are used to calculate the following minimum capital ratios for the Bank:

-12-

Table of Contents

The total minimum regulatory capital ratios and well-capitalized minimum ratios are reflected in the charts below.

Failure to be well-capitalized or to meet minimum capital requirements could result in certain mandatory and possible additional discretionary actions by regulators that, if undertaken, could have a material adverse effect on our operations or financial condition. Failure to be well-capitalized or to meet minimum capital requirements could also result in restrictions on the Company’s or the Bank’s ability to pay dividends or otherwise distribute capital or to receive regulatory approval of applications.

In addition to meeting the minimum capital requirements, under the Basel III Capital Rules, the Bank must also maintain the required capital conservation buffer to avoid becoming subject to restrictions on capital distributions and certain discretionary bonus payments to management. The capital conservation buffer is calculated as a ratio of CET1 capital to risk-weighted assets, and it effectively increases the required minimum risk-based capital ratios. The capital conservation buffer is now at its fully phased-in level of 2.5%.

The Tier 1 Leverage Ratio is not impacted by the capital conservation buffer, and a banking institution may be considered well-capitalized while remaining out of compliance with the capital conservation buffer.

The table below summarizes the capital requirements that the Bank must satisfy to avoid limitations on capital distributions and certain discretionary bonus payments (i.e., the required minimum capital ratios plus the capital conservation buffer):

As of December 31, 2025, the Bank is well-capitalized for regulatory purposes. For a tabular presentation of the Company’s and Bank’s capital ratios as of December 31, 2025, see “Note 9 — Shareholders Equity — Regulatory Capital” of the consolidated financial statements for the years ended December 31, 2025 and 2024, which are contained elsewhere in this report, for more information.

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms (the standards are commonly referred to as “Basel III Endgame”). Among other things, these standards revise the Basel Committee’s standardized approach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain “unconditionally cancellable commitments,” such as unused credit card lines of credit) and provides a new standardized approach for operational risk capital. Under the Basel framework, as amended, these standards were effective on January 1, 2023, with an aggregate output floor phasing in through January 1, 2028. Under the current U.S. capital rules, operational risk capital requirements and a capital floor apply only to advanced approaches institutions, and not to the Company and the Bank.

In July 2023, the FRB, Office of the Comptroller of the Currency (“OCC”) and FDIC proposed significant changes to the Basel III capital rules which replaces the advanced approaches risk-weighted assets framework with a new enhanced risk-based framework and requires banking organizations with generally more than $100 billion in assets to calculate their regulatory capital using more enhanced requirements applicable to even larger organizations. Finalization of the proposal, including the required implementation date, is uncertain. The impact of any changes to capital requirements and calculations and the implementation of Basel III Endgame on us will depend on the manner in which it is implemented by the federal bank regulators with respect to smaller-sized institutions.

-13-

Table of Contents

On October 29, 2019, the federal banking regulators adopted a final rule, which was effective as of January 1, 2020, to simplify the regulatory capital requirements for certain community banks and holding companies that opt into the Community Bank Leverage Ratio (“CBLR”) framework. In order to be eligible to opt in to the CBLR framework, an institution must have less than $10 billion in average consolidated assets and a leverage ratio of at least 9.0% and meet certain other asset-related requirements. If the election is made, the institution would be considered to have satisfied the capital requirements of Basel III adopted by the federal banking regulators and would be able to satisfy the regulatory capital requirements by calculating and reporting a single leverage ratio, reducing the time associated with risk-weighting assets for capital ratio reporting purposes. An eligible institution may opt in to the CBLR framework in connection with any regulatory financial report and may opt out of the CBLR framework at any time by completing the Basel III capital ratio calculations in connection with any regulatory financial report. The rule establishes a two-quarter grace period for institutions 18 whose leverage ratio falls below 9.0 but remains above 8.0%. The Company and the Bank have not opted in to the CBLR framework.

Prompt Corrective Action Provisions

The Federal Deposit Insurance Act requires the federal bank regulatory agencies to take “prompt corrective action” with respect to a depository institution if that institution does not meet certain capital adequacy standards, including requiring the prompt submission of an acceptable capital restoration plan. Depending on the bank’s capital ratios, the agencies’ regulations define five categories in which an insured depository institution will be placed: well-capitalized, adequately capitalized, undercapitalized, significantly undercapitalized, and critically undercapitalized. At each successive lower capital category, an insured bank is subject to more restrictions, including restrictions on the bank’s activities, operational practices or the ability to pay dividends or executive bonuses. Based upon its capital levels, a bank that is classified as well-capitalized, adequately capitalized, or undercapitalized may be treated as though it were in the next lower capital category if the appropriate federal banking agency, after notice and opportunity for hearing, determines that an unsafe or unsound condition, or an unsafe or unsound practice, warrants such treatment.

The prompt corrective action standards were changed to conform with the capital rules. Under the current standards, in order to be considered well-capitalized, the bank will be required to meet the common equity Tier 1 ratio of 6.5%, an increased Tier 1 ratio of 8% (increased from 6%), a total capital ratio of 10% (unchanged) and a leverage ratio of 5% (unchanged).

The federal banking agencies also may require banks and bank holding companies subject to enforcement actions to maintain capital ratios in excess of the minimum ratios otherwise required to be deemed “well capitalized”, in which case institutions may no longer be deemed to be “well capitalized” and may therefore be subject to certain restrictions such as taking brokered deposits.

Volcker Rule

In December 2013, the federal bank regulatory agencies adopted final rules that implement a part of the Dodd-Frank Act commonly referred to as the “Volcker Rule.” Under these rules and subject to certain exceptions, banking entities are restricted from engaging in activities that are considered proprietary trading and from sponsoring or investing in certain entities, including hedge or private equity funds that are considered “covered funds.” These rules became effective on April 1, 2014, although certain provisions are subject to delayed effectiveness under rules promulgated by the FRB. Notwithstanding these provisions, in July 2019, the federal bank regulatory agencies finalized a rule which provides that a banking entity that does not have (and is not controlled by a company that has) more than $10 billion in total consolidated assets and does not have (and is not controlled by a company that has) total trading assets and liabilities of 5 percent or more of total consolidated assets, such as the Bank and the Company, is excluded from the Volcker Rule.

Brokered Deposits

The FDIC limits the ability to accept brokered deposits to those insured depository institutions that are “well capitalized”. Institutions that are less than “well capitalized” cannot accept, renew or roll over any brokered deposit unless they have applied for and been granted a waiver by the FDIC. In addition, FDIC regulations impose a cap on reciprocal deposits that may be exempt from being classified as brokered deposits depending on a bank’s capitalization and rating status, including a general cap equal to 20% of the Bank’s total liabilities. As of December 31, 2025, an additional $475.4 million of our reciprocal deposits in excess of the regulatory cap were considered brokered deposits by the FDIC. If the Bank became less than “well capitalized” for regulatory purposes, our ability to participate in any reciprocal deposit network could be limited which could adversely affect our liquidity, business, financial condition or results of operations.

-14-

Table of Contents

Bank Holding Company Regulation

Bank holding companies and their subsidiaries are subject to significant regulation and restrictions by Federal and State laws and regulatory agencies, which may affect the cost of doing business, and may limit permissible activities and expansion or impact the competitive balance between banks and other financial services providers.

A wide range of requirements and restrictions are contained in both federal and state banking laws, which together with implementing regulatory authority:

Change in Bank Control

Federal law and regulation set forth the types of transactions that require prior notice under the Change in Bank Control Act (“CIBCA”). Pursuant to the CIBCA, Regulation Y, and applicable FDIC regulations, any person (acting directly or indirectly) that seeks to acquire control of a bank or its holding company must provide prior notice to the Federal Reserve. A “person” for this purpose includes an individual, bank, corporation, partnership, trust, association, joint venture, pool, syndicate, sole proprietorship, unincorporated organization, or any other form of entity. A person acquires “control” of a banking organization whenever the person acquires ownership, control, or the power to vote 25 percent or more of any class of voting securities of the institution. The applicable regulations also provide for certain other “rebuttable” presumptions of control at lower percentage thresholds.

-15-

Table of Contents

In April 2020, the Federal Reserve adopted a final rule to revise its regulations related to determinations of whether a company has the ability to exercise a controlling influence over another company for purposes of the BHCA. The final rule expands and codifies the presumptions for use in such determinations. By codifying the presumptions, the final rule provides greater transparency on the types of relationships that the Federal Reserve generally views as supporting a facts-and-circumstances determination that one company controls another company. The Federal Reserve’s final rule applies to questions of control under the BHCA, but it does not extend to CIBCA or applicable provisions of California law.

Other Restrictions on the Company’s Activities

Subject to prior notice or Federal Reserve approval, bank holding companies may generally engage in, or acquire shares of companies engaged in, activities determined by the Federal Reserve to be so closely related to banking or managing or controlling banks as to be a proper incident thereto. Bank holding companies which elect and retain “financial holding company” status pursuant to the Gramm-Leach-Bliley Act of 1999 (“GLBA”) may engage in these nonbanking activities and broader securities, insurance, merchant banking and other activities that are determined to be “financial in nature” or are incidental or complementary to activities that are financial in nature without prior Federal Reserve approval. Pursuant to GLBA and Dodd-Frank, in order to elect and retain financial holding company status, a bank holding company and all depository institution subsidiaries of a bank holding company must be considered well capitalized and well managed, and, except in limited circumstances, depository subsidiaries must be in satisfactory compliance with the Community Reinvestment Act (“CRA”), which requires banks to help meet the credit needs of the communities in which they operate. Failure to sustain compliance with these requirements or correct any non-compliance within a fixed time period could lead to divestiture of subsidiary banks or require all activities to conform to those permissible for a bank holding company. The Company has not elected financial holding company status and neither the Company nor the Bank has engaged in any activities determined by the Federal Reserve to be “financial in nature” or incidental or complementary to activities that are “financial in nature.”

The Company is also a bank holding company within the meaning of Section 3700 of the California Financial Code. Therefore, the Company and any of its subsidiaries are subject to examination by, and may be required to file reports with, the California DFPI. DFPI approvals may also be required for certain mergers and acquisitions.

Securities Exchange Act of 1934

The Company’s common stock is listed on the Nasdaq Global Select Stock Market under the symbol "AVBH", and the Company is subject to the periodic reporting, information, proxy solicitation, insider trading, corporate governance and other requirements and restrictions of the Securities Exchange Act of 1934 and the regulations of the Securities and Exchange Commission (“SEC”) promulgated thereunder as well as listing requirements of Nasdaq.

Sarbanes-Oxley Act

The Company is subject to the accounting oversight and corporate governance requirements of the Sarbanes-Oxley Act of 2002, including, among other things, required executive certification of financial presentations, requirements for board audit committees and their members, and disclosure of controls and procedures and internal control over financial reporting.

Bank Regulation

As a California commercial bank whose deposits are insured by the FDIC, the Bank is subject to regulation, supervision, and regular examination by the DFPI and by the FDIC, as the Bank’s primary Federal regulator, and must additionally comply with certain applicable regulations of the Federal Reserve. Specific federal and state laws and regulations which are applicable to banks regulate, among other things, the scope of their business, their investments, their reserves against deposits, the timing of the availability of deposited funds, their activities relating to dividends, investments, loans, the nature and amount of and collateral for certain loans, servicing and foreclosing on loans, borrowings, capital requirements, certain check-clearing activities, branching, and mergers and acquisitions. California banks are also subject to statutes and regulations including Federal Reserve Regulation O and Federal Reserve Act Sections 23A and 23B and Regulation W, which restrict or limit loans or extensions of credit to “insiders,” including officers, directors, and principal shareholders, and loans or extension of credit by banks to affiliates or purchases of assets from affiliates, including parent bank holding companies, except pursuant to certain exceptions and only on terms and conditions at least as favorable to those prevailing for comparable transactions with unaffiliated parties. Failure to comply with applicable bank regulations or adverse results from any examinations of the Bank could affect our costs of doing business and may also limit or impede otherwise permissible activities and expansion activities by the Bank.

-16-

Table of Contents

Pursuant to the Federal Deposit Insurance Act (“FDI Act”) and the California Financial Code, California state chartered commercial banks may generally engage in any activity permissible for national banks. Therefore, the Bank may form subsidiaries to engage in the activities commonly conducted by national banks in operating subsidiaries. Further, California banks may conduct certain “financial” activities permitted under GLBA in a “financial subsidiary” to the same extent as may a national bank, provided the bank is and remains “well-capitalized,” “well-managed” and in satisfactory compliance with the CRA. The Bank currently has no financial subsidiaries.

FDIC and DFPI Enforcement Authority

The federal and California regulatory structure gives the bank regulatory agencies extensive discretion in connection with their supervisory and enforcement activities and examination policies, including policies with respect to the classification of assets and the establishment of appropriate loan loss reserves for regulatory purposes. The regulatory agencies have adopted guidelines to assist in identifying and addressing potential safety and soundness concerns before an institution’s capital becomes impaired. The guidelines establish operational and managerial standards generally relating to: (1) internal controls, information systems, and internal audit systems; (2) loan documentation; (3) credit underwriting; (4) interest-rate exposure; (5) asset growth and asset quality; and (6) compensation, fees, and benefits. Further, the regulatory agencies have adopted safety and soundness guidelines for asset quality and for evaluating and monitoring earnings to ensure that earnings are sufficient for the maintenance of adequate capital and reserves.

If, as a result of an examination, the DFPI or the FDIC should determine that the financial condition, capital resources, asset quality, earnings prospects, management, liquidity, or other aspects of the Bank’s operations are unsatisfactory or that the Bank or its management is violating or has violated any law or regulation, the DFPI and the FDIC have authority to:

In accordance with the Dodd-Frank Act and long-standing Federal Reserve policy, the Company must act as a source of financial and managerial strength to Avidbank. Under this policy, the Company must commit resources to support the Bank, including at times when the Company may not be in a financial position to provide it. The Company could be required to guarantee the capital plan of Avidbank if it becomes undercapitalized for purposes of banking regulations, as described below. Any capital loans by a bank holding company to its subsidiary bank are subordinate in right of payment to deposits and to certain other indebtedness of such subsidiary bank. The Bank Holding Company Act of 1956, as amended (the “BHC Act”) provides that, in the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a bank subsidiary will be assumed by the bankruptcy trustee and entitled to priority of payment.

Mergers and Acquisitions

In 2024, the OCC and FDIC issued policy statements which conveyed a heightened level of scrutiny for bank merger and acquisition activity. Following the election of President Trump, in May 2025 the FDIC rescinded its 2024 policy statement on bank merger review and instead reverted to prior guidance from 1998. Similarly, the OCC issued an interim final rule that rescinded its 2024 policy statement and reinstated regulatory provisions allowing for automatic expedited processing for certain eligible mergers and acquisitions. Subsequently, President Trump executed a resolution, which, among other things, prevents an agency from reissuing a substantially similar rule. Accordingly, with the FDIC and OCC reinstating pre-2024 policies, we believe applicants have a more predictable merger approval path for qualifying transactions. The FRB has not issued new merger and acquisition regulations or policy statements but has recently approved a number of larger acquisitions. The full impact of the election of President Trump on bank mergers and acquisition policy has yet to be fully determined.

-17-

Table of Contents

In September 2024, the Department of Justice ("DOJ") announced that it withdrew its 1995 Bank Merger Guidelines and, instead, for purposes of evaluating the competitive impact of bank mergers, will rely on its 2023 Merger Guidelines which apply to all industries. For banks considering combinations where there may be even a remote possibility of antitrust concerns under the 2023 Merger Guidelines, the DOJ will review “market realities” in analyzing the competitive effects of a particular transaction. While branch deposit concentration may be one area of focus (i.e., traditional Herfindahl Hirschman Index (HHI) analysis for deposit concentration utilizing the 2023 Merger Guideline baselines), the DOJ will drill down into the products and services that a bank merger may affect prior to fully assessing the impact of a combination. This type of analysis may involve a more robust review of the competitive landscape (i.e., the impact of credit unions and other non-bank competitors), and a closer analysis of interest rates, types of mortgages and other loans offered, quality of service and convenience at branch locations, the types of customers served, and the unique needs in a particular bank market for bespoke financing.

Deposit Insurance

The FDIC is an independent federal agency that insures deposits, up to prescribed statutory limits, of federally insured banks and savings institutions and safeguards the safety and soundness of the banking and savings industries. The FDIC insures our customer deposits through the DIF up to prescribed limits for each depositor. The Dodd-Frank Act revised the FDIC’s DIF management authority by setting requirements for the Designated Reserve Ratio (the DIF balance divided by estimated insured deposits) and redefining the assessment base, which is used to calculate banks’ quarterly assessments. The amount of FDIC assessments paid by each DIF member institution is based on its asset size and relative risk of default as measured by regulatory capital ratios and other supervisory factors. The FDIC may terminate a depository institution’s deposit insurance upon a finding that the institution’s financial condition is unsafe or unsound or that the institution has engaged in unsafe or unsound practices that pose a risk to the DIF or that may prejudice the interest of the bank’s depositors. The termination of deposit insurance for a bank would also result in the revocation of the bank’s charter by the DFPI.

We are generally unable to control the amount of premiums that we are required to pay for FDIC insurance, which can be affected by the cost of bank failures to the FDIC among other factors. The FDIC is an independent federal agency that insures deposits through the DIF up to prescribed statutory limits of federally insured banks and savings institutions and safeguards the safety and soundness of the banking and savings industries. The Dodd-Frank Act revised the FDIC’s DIF management authority by setting requirements for the Designated Reserve Ratio (the “DRR,” calculated as the DIF balance divided by estimated insured deposits) and redefining the assessment base which is used to calculate banks’ quarterly assessments. The amount of FDIC assessments paid by each DIF member institution is based on its asset size and its relative risk of default as measured by regulatory capital ratios and other supervisory factors.

The FDIC has set the DRR at 2.00%. In October 2022, in order to increase the likelihood that the reserve ratio would be restored to at least 1.35% by the statutory deadline of September 30, 2029, the FDIC increased the initial base deposit insurance assessment rate schedules uniformly by two (2) basis points. The FDIC will, at least semi-annually, update its income and loss projections for the Deposit Insurance Fund and, if necessary, propose rules to further increase assessment rates.

In addition, in November 2023, the FDIC finalized a special assessment to recover the loss to the DIF as a result of the closure of several large regional banks during 2023. The special assessment was equal to approximately 13.4 basis points annually based on the amount of an institution’s uninsured deposits as of the quarter ended December 31, 2022, and after applying a $5 billion deduction for such uninsured deposits. As a result of the application of the $5 billion deduction, the Bank was not required to incur any additional assessment.

Any future increases in FDIC insurance premiums may have a material and adverse effect on our earnings and could have a material adverse effect on the value of, or market for, our common stock.

Dividends and Stock Repurchases

The Company may be limited in its ability to pay dividends or repurchase its stock by the Federal Reserve, including if doing so would be an unsafe or unsound banking practice. When a bank holding company intends to declare or pay a dividend that could raise safety and soundness concerns, it generally will be required to inform and consult with the Federal Reserve in advance. It is the policy of the Federal Reserve that a bank holding company should generally pay dividends on common stock only out of earnings, and only if prospective earnings retention is consistent with the company’s capital needs and overall current and prospective financial condition. Additionally, bank holding companies should inform and consult with the Federal Reserve in advance of declaring and paying a dividend that exceeds earnings for the period for which the dividend is being paid.

-18-

Table of Contents

Because the Company operates under the Small Bank Holding Company Policy Statement, the Federal Reserve will generally expect the Company not to pay dividends unless its debt to equity ratio is 1:1 or lower, the Company meets certain other criteria under the Federal Reserve’s Regulation Y, and the dividends are reasonable in amount, do not adversely affect the ability of the Company to service its debt in an orderly manner, and do not adversely affect the ability of the Bank to be well-capitalized. Although the Company currently meets these requirements, the Company has no current intention to pay dividends and cannot be sure that it will continue to meet those requirements or that even if it does, it will be able to pay dividends.

If a bank holding company does not operate under the Small Bank Holding Company Policy Statement, according to guidance from the Federal Reserve, the bank holding company’s dividend policies will be assessed against, among other things, its ability to achieve applicable capital ratio requirements. If a bank holding company does not achieve applicable capital ratio requirements, it may not be able to pay dividends. The Company cannot be sure that it would meet those requirements or that even if it does, it would be able to pay dividends.

A bank holding company may be required to give the Federal Reserve prior written notice before purchasing or redeeming its equity securities if the gross consideration for the purchase or redemption, when aggregated with the net consideration paid by the bank holding company for all such purchases or redemptions during the preceding 12 months, is equal to 10.00% or more of the bank holding company’s consolidated net worth. The Federal Reserve may disapprove such a purchase or redemption if it determines that the proposal would constitute an unsafe or unsound practice or would violate any law, regulation, Federal Reserve order, or any condition imposed by or written agreement with the Federal Reserve. However, this prior notice requirement does not apply to any bank holding company that meets certain “well-capitalized” and “well-managed” standards and is not the subject of any unresolved supervisory issues, such as the Company. Furthermore, a bank holding company that is eligible for the Small Bank Holding Company Policy Statement, such as the Company, is eligible for the exemption from the prior notice requirement as long as the bank holding company has a pro forma debt to equity ratio of 1:1 or less and otherwise meets the requirements of Regulation Y.

In addition, a bank holding company is required to consult with the Federal Reserve before redeeming certain tier 1 and tier 2 capital instruments. To qualify as additional tier 1 capital, redemption or repurchase of the capital instrument requires prior approval of the Federal Reserve. Similarly, to qualify as tier 2 capital, redemption of the instrument prior to maturity or repurchase requires the prior approval of the Federal Reserve. Further, a bank holding company is required to consult with the Federal Reserve before redeeming any equity or other capital instrument included in Tier 1 or Tier 2 capital prior to stated maturity if such redemption could have a material effect on the level or composition of the organization’s capital base. For bank holding companies, such as the Company, that are subject to the Small Bank Holding Company Policy Statement, such consultation is only required for the redemption of instruments included in equity as defined under accounting principles generally accepted in the United States of America (“GAAP”), such as common and perpetual preferred stock, and not for certain other instruments included as regulatory capital.

In November 2020, our board of directors approved a stock repurchase program authorizing the repurchase of up to 307,780 shares of our common stock (5% of the then outstanding shares of common stock) from time to time in the open market, in privately negotiated transactions, or otherwise, subject to applicable laws and regulations. The program has no expiration date. During 2020, we repurchased 25,347 shares of our common stock under this program. During the year ended December 31, 2025, we did not repurchase any shares of our common stock and are under no obligation to repurchase any such shares.

The Bank is a legal entity that is separate and distinct from its holding company. The Company relies on dividends received from the Bank for use in the operation of the Company and the ability of the Company to pay dividends to shareholders. Future cash dividends by the Bank will also depend upon management’s assessment of future capital requirements, contractual restrictions, and other factors. Current capital rules may restrict dividends by the Bank if the additional capital conservation buffer is not achieved. See section entitled “—Capital Adequacy Requirements” for further discussion.

The ability of the Bank to declare a cash dividend to the Company is subject to California law, which restricts the amount available for cash dividends to the lesser of a bank’s retained earnings or net income for its last three fiscal years (less any distributions to shareholders made during such period). Where the above test is not met, cash dividends may still be paid, with the prior approval of the DFPI, in an amount not exceeding the greatest of (1) retained earnings of the bank; (2) the net income of the bank for its last fiscal year; or (3) the net income of the bank for its current fiscal year.

-19-

Table of Contents

Compensation

Under regulatory guidance applicable to all banking organizations, incentive compensation policies must be consistent with safety and soundness principles. Under this guidance, financial institutions must review their compensation programs to ensure that they: (i) provide employees with incentives that appropriately balance risk and reward and that do not encourage imprudent risk, (ii) are compatible with effective controls and risk management, and (iii) are supported by strong corporate governance, including active and effective oversight by the banking organization’s board of directors. Monitoring methods and processes used by a banking organization should be commensurate with the size and complexity of the organization and its use of incentive compensation.

In October 2022, the SEC adopted final rules implementing the incentive-based compensation recovery (clawback) provisions of the Dodd-Frank Act. In response to the final rules, the Nasdaq Stock Market implemented new clawback listing standards which are applicable to the Company. The Company has adopted a Nasdaq compliant clawback policy, which is included with this Annual Report as an Exhibit.

Cybersecurity and Data Breaches

Federal regulators have issued multiple statements regarding cybersecurity and that financial institutions need to design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. In addition, a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations in the event of a cyber-attack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or one of its critical service providers fall victim to a cyber-attack. In November 2021, the federal banking agencies adopted a final rule, with compliance required by May 1, 2022, that requires banking organizations to notify their primary banking regulator within 36 hours of determining that a “computer-security incident” has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, a number of states, notably including California where we conduct substantially all our banking business, have adopted laws and/or regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many such states have also implemented or modified their data breach notification and data privacy requirements, including California and New York. We expect this trend of state-level activity in those areas to continue, and we continue to monitor relevant legislative and regulatory developments in California and other states in which our customers are located or in which we conduct business.

In the ordinary course of business, we rely on electronic communications and information systems, as well as certain third-party service providers’ electronic communication and information systems, to conduct our operations and to store sensitive data. We employ a layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. We also seek to evaluate and monitor the cybersecurity policies and practices of key third-party service providers which utilize electronic and information systems that interface with our Bank’s systems, in the manner and to the extent required by applicable banking laws and regulations. Notwithstanding the strength of our defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. Our systems and those of our customers and third-party service providers are under constant threat, and we or they could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of digital banking, mobile banking and other technology-based products and services by us and our customers. In addition, to the extent we experience any data breaches, we may become subject to governmental fines or enforcement actions and reputation risk as well as potential liability arising out of governmental or private litigation. See section entitled “Risk Factors” for a further discussion of risks related to cybersecurity and data breaches.

-20-

Table of Contents

Operations and Consumer Compliance Laws

The Bank must comply with numerous federal and state anti-money laundering and consumer protection statutes and implementing regulations, the Foreign Account Tax Compliance provisions of the Halting International Relocation of Employment (“HIRE”) Act, the CRA, the California Consumer Privacy Act, the California Privacy Rights Act, the Fair Debt Collection Practices Act, the Fair Credit Reporting Act, the Equal Credit Opportunity Act, the Truth in Lending Act, the Fair Housing Act, the Home Mortgage Disclosure Act, the Real Estate Settlement Procedures Act, the National Flood Insurance Act, the California Homeowner Bill of Rights and various federal and state privacy protection laws, including the Telephone Consumer Protection Act and the CAN-SPAM Act. Noncompliance with any of these laws could subject the Bank to compliance enforcement actions as well as lawsuits and could also result in administrative penalties, including, fines and reimbursements. The Bank and the Company are also subject to federal and state laws prohibiting unfair or fraudulent business practices, untrue or misleading advertising and unfair competition.

These laws and regulations mandate certain disclosure and reporting requirements and regulate the manner in which financial institutions must deal with customers when taking deposits, making loans, servicing, collecting and foreclosure of loans, and providing other services. Failure to comply with these laws and regulations can subject the Bank and the Company to various penalties, including but not limited to enforcement actions, injunctions, fines or criminal penalties, punitive damages to consumers, and the loss of certain contractual rights.

The CRA specifically directs the federal bank regulatory agencies, in examining insured depository institutions, to assess their record of helping to meet the credit needs of the entire communities in which the financial institution operates, including low and moderate income (“LMI”) communities, consistent with safe and sound banking practices. The CRA further requires the agencies to take a financial institution’s record of meeting its community credit needs into account when evaluating applications for, among other things, domestic branches, consummating mergers or acquisitions or holding company formations. The Bank received an overall “Satisfactory” rating in its most recent FDIC CRA performance evaluation, which measures how financial institutions support their communities in the areas of lending, investment and service tests. The Bank received a “Satisfactory” rating for both the lending and the community development tests.

On October 24, 2023, the OCC, FDIC, and FRB issued a final rule (the “October Final Rule”) intended to modernize and strengthen regulations implementing the CRA. For banks with total assets in excess of $2 billion, which includes the Bank, the Bank’s CRA evaluation was going to be based on four tests: (i) retail lending; (ii) retail services and products (including digital delivery systems for banks with more than $10 billion in assets or banks which request consideration of such systems); (iii) community development (CD) financing; and (iv) CD services. Weighting of each test was to be applied to those banks (such as the Bank) when regulators are evaluating CRA performance based on multiple tests. Alternatively, banks (including the Bank) would have had the option to be evaluated based on a regulator-approved strategic CRA plan. In addition, banks with total assets in excess of $2 billion are subject to revised and more comprehensive CRA-related data collection, reporting and maintenance requirements. Regulators would downgrade an institution’s CRA rating in the case of illegal or discriminatory credit practices.

The October Final Rule was intended to take effect on April 1, 2024 with staggered compliance dates, including compliance with the new tests, data collection requirements, and the requirement to define retail lending assessment areas. The October Final Rule is currently subject to a preliminary injunction that stays its effective and implementation dates. On July 16, 2025, the OCC, the FDIC and the FRB issued a joint notice of proposed rulemaking to rescind the October Final Rule.

The Dodd-Frank Act centralized responsibility for consumer financial protection by creating a new agency, the Consumer Financial Protection Bureau (“CFPB”), and giving it responsibility for implementing, examining, and enforcing compliance with federal consumer protection laws for financial institutions, as well as their affiliates, with more than $10 billion of assets and, to a lesser extent, smaller institutions. The CFPB focuses on (i) risks to consumers and compliance with the federal consumer financial laws, (ii) the markets in which firms operate and risks to consumers posed by activities in those markets, (iii) depository institutions that offer a wide variety of consumer financial products and services, and (iv) non-depository companies that offer one or more consumer financial products or services. The CFPB has broad rulemaking authority for a wide range of consumer financial laws that apply to all banks, including, among other things, the authority to prohibit “unfair, deceptive or abusive” acts and practices (“UDAAP”). Abusive acts or practices are defined as those that materially interfere with a consumer’s ability to understand a term or condition of a consumer financial product or service or that take unreasonable advantage of a consumer’s (i) lack of financial savvy, (ii) inability to protect himself in the selection or use of consumer financial products or services, or (iii) reasonable reliance on a covered entity to act in the consumer’s interests. The CFPB can issue cease-and-desist orders against banks and other entities that violate consumer financial laws. The CFPB may also institute a civil action against an entity in violation of federal consumer financial law in order to impose a civil penalty or injunction.

-21-

Table of Contents

Because the Company and the Bank have less than $10 billion in assets, most consumer protection aspects of the Dodd-Frank Act will continue to be applied to the Company by the Federal Reserve and to the Bank by the FDIC. However, the CFPB may include its own examiners in regulatory examinations by a smaller institution’s principal regulators and may require smaller institutions to comply with certain CFPB reporting requirements. In addition, regulatory positions taken by the CFPB and administrative and legal precedents established by CFPB enforcement activities, including in connection with supervision of larger bank holding companies and banks, could influence how the Federal Reserve and OCC apply consumer protection laws and regulations to financial institutions that are not directly supervised by the CFPB. The precise effect of the CFPB’s consumer protection activities on the Company and the Bank cannot be determined with certainty.

The review of products and practices to prevent UDAAP is a continuing focus of the CFPB, and of banking regulators more broadly. The ultimate impact of this heightened scrutiny is uncertain but could result in changes to pricing, practices, products and procedures. It could also result in increased costs related to regulatory oversight, supervision and examination, additional remediation efforts and possible penalties. In addition, the Dodd-Frank Act provides the CFPB with broad supervisory, examination and enforcement authority over various consumer financial products and services, including the ability to require reimbursements and other payments to customers for alleged violations of UDAAP and other legal requirements and to impose significant penalties, as well as injunctive relief that prohibits lenders from engaging in allegedly unlawful practices. The CFPB also has the authority to obtain cease and desist orders providing for affirmative relief or monetary penalties. The Dodd-Frank Act does not prevent states from adopting stricter consumer protection standards. CFPB and state regulation of financial products and potential enforcement actions could adversely affect the Bank’s business, financial condition or results of operations.

The federal bank regulators have adopted rules limiting the ability of banks and other financial institutions to disclose non-public information about consumers to unaffiliated third parties. These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a nonaffiliated third party. These regulations affect how consumer information is transmitted through diversified financial companies and conveyed to outside vendors. In addition, consumers may also prevent disclosure of certain information among affiliated companies that is assembled or used to determine eligibility for a product or service, such as that shown on consumer credit reports and asset and income information from applications. Consumers also have the option to direct banks and other financial institutions not to share information about transactions and experiences with affiliated companies for the purpose of marketing products or services.

In California, consumer privacy rights have been further bolstered by the enactment of the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (CPRA). The CCPA and CPRA create new consumer rights, impose additional obligations on businesses that collect personal information from California consumers, and create a new enforcement agency called the California Privacy Protection Agency. In particular, The CCPA and CPRA introduces four new consumer rights, including (1) the right to correction, meaning that users can request to have their personal information corrected; (2) the right to opt-out of automated decision making, meaning that California residents can say ‘no’ to their personal information being used in profiling for behavioral advertisement online; (3) the right to know about automated decision making; and (4) the right to limit use of sensitive personal information. These two statutes also significantly expand the types of consumer data subject to privacy restrictions and increase the potential penalties for any violations.

Under the Durbin Amendment to the Dodd-Frank Act, the Federal Reserve adopted rules establishing standards for assessing whether the interchange fees that may be charged with respect to certain electronic debit transactions are “reasonable and proportional” to the costs incurred by issuers for processing such transactions.

Interchange fees, or “swipe” fees, are charges that merchants pay to us and other card-issuing banks for processing electronic payment transactions. Under the final rules, the maximum permissible interchange fee is equal to no more than 21 cents plus 5 basis points of the transaction value for many types of debit interchange transactions. The Federal Reserve also adopted a rule to allow a debit card issuer to recover one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements required by the Federal Reserve. The Federal Reserve also has rules governing routing and exclusivity that require issuers to offer two unaffiliated networks for routing transactions on each debit or prepaid product.

In October 2023, the Federal Reserve issued a proposal under which the maximum permissible interchange fee for an electronic debit transaction would be the sum of 14.4 cents per transaction and 4 basis points multiplied by the value of the transaction. Furthermore, the fraud-prevention adjustment would increase from a maximum of 1 cent to 1.3 cents per debit card transaction. The proposal would adopt an approach for future adjustments to the interchange fee cap which would occur every other year based on issuer cost data gathered by the Federal Reserve from large debit card issuers. The comment period for this proposal ended in May 2024. The extent to which any such proposed changes in permissible interchange fees will impact our future revenues is uncertain.

-22-

Table of Contents

Currently, we qualify for the small issuer exemption from the interchange fee cap, which applies to any debit card issuer that, together with its affiliates, has total assets of less than $10 billion as of the end of the previous calendar year. If our total assets were to reach or exceed $10 billion, we could become subject to the interchange fee cap beginning July 1 of the year following the time when our total assets crossed that threshold. Reliance on the small issuer exemption does not exempt us from federal regulations prohibiting network exclusivity arrangements or from routing restrictions.

Commercial Real Estate Concentration Limits

In December 2006, the federal banking regulators issued guidance entitled “Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices” to address increased concentrations in commercial real estate, or CRE, loans. In addition, in December 2015, the federal bank agencies issued additional guidance entitled “Statement on Prudent Risk Management for Commercial Real Estate Lending.” Together, these guidelines describe the criteria the agencies will use as indicators to identify institutions potentially exposed to CRE concentration risk. An institution that has (i) experienced rapid growth in CRE lending, (ii) notable exposure to a specific type of CRE, (iii) total reported loans for construction, land development, and other land representing 100% or more of the institution’s capital, or (iv) total CRE loans (which excludes owner-occupied CRE loans) representing 300% or more of the institution’s capital, and the outstanding balance of the institutions CRE portfolio has increased by 50% or more in the prior 36 months, may be identified for further supervisory analysis of the level and nature of its CRE concentration risk. As of March 31, 2025, the Bank’s total CRE loan concentration based on total outstanding loans was 309% of risk-based capital.

Anti-Money Laundering

The BSA, as amended by the USA PATRIOT Act, and its implementing regulations and other laws and regulations that impose anti-money laundering obligations require financial institutions to, among other duties, implement and maintain an effective Anti-Money Laundering and Countering the Financing of Terrorism (“AML/CFT”) compliance program and to file reports, such as suspicious activity reports and currency transaction reports. Our federal and state banking regulators, FinCEN, and other government agencies are authorized to impose significant civil money penalties for violations of the BSA and its implementing regulations and other applicable anti-money laundering requirements.

A continued focus of governmental policy relating to financial institutions in recent years has been combating money laundering and terrorist financing. The USA PATRIOT Act amended the BSA to broaden the application of anti-money laundering regulations to apply to additional types of financial institutions, such as broker-dealers, investment advisors, and insurance companies, and strengthened the ability of the U.S. government to help prevent, detect and prosecute international money laundering and the financing of terrorism. The principal provisions of Title III of the USA PATRIOT Act require that regulated financial institutions, including banks: (i) establish an AML/CFT compliance program that includes training and audit components; (ii) comply with regulations regarding the verification of the identity of any person seeking to open an account; (iii) take additional required precautions with non-U.S. owned accounts; and (iv) perform certain verification and certification of money laundering risk for their foreign correspondent banking relationships. Failure of a financial institution to comply with the BSA’s requirements could have serious legal and reputational consequences for the institution. The federal banking agencies examine the institution for compliance with the BSA and its implementing regulations and we continue to monitor and augment, where necessary, our AML/CFT compliance program. The federal banking agencies will also consider compliance with the BSA and its implementing regulations when reviewing merger and acquisition proposals. Failure to comply with the BSA and its implementing regulations can result in a federal banking agency imposing cease and desist and other regulatory orders and civil money penalties against a bank. Our Bank has augmented its AML/CFT compliance systems and procedures to meet the requirements of the BSA and its implementing regulations and will continue to revise and update its compliance policies, procedures, and controls to reflect changes required by law.

Office of Foreign Assets Control Regulation

The U.S. Treasury Department’s OFAC administers and enforces U.S. economic and trade sanctions against targeted foreign persons, countries and regimes. OFAC publishes lists of specially designated nationals and blocked persons and administers territorial sanctions programs. We are responsible for, among other things, blocking or restricting the accounts of and blocking or rejecting transactions involving sanctioned individuals, entities and countries and territories that are the subject of U.S. economic sanctions and reporting blocked or rejected transactions. Failure to comply with U.S. economic sanctions could have serious financial, legal and reputational consequences, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required. Regulatory and law enforcement authorities have imposed, among other enforcement actions, cease and desist orders, civil money penalties and criminal fines and forfeiture against financial institutions that have been found to be in violation of U.S. economic sanctions.

-23-

Table of Contents

Changes in the Federal, State, or Local Tax Laws

We are subject to changes in federal and applicable state tax laws and regulations that may impact our effective tax rates. Changes in these tax laws may be retroactive to previous periods and as a result could negatively impact our current and future financial performance. For example, the Tax Cuts and Jobs Act of 2017 resulted in a reduction of our federal tax rate from a minimum of 35% in 2017 to 21% in 2018, which had a favorable impact on our earnings. Conversely, this legislation also enacted limitations on certain deductions, including the deduction of FDIC deposit insurance premiums, which partially offset the expected increase in net earnings from the lower tax rate.

On August 16, 2022, the Inflation Reduction Act of 2022 (the “IRA”) was enacted into law. The IRA, among other things, imposes a non-deductible 1% excise tax on the aggregate fair market value of stock repurchased by certain public companies, if any, occurring after December 31, 2022.

The foregoing description of the impact of changes in federal and applicable state tax laws on us should be read in conjunction with Note 1 Summary of Significant Accounting Policies— Income Taxes of the consolidated financial statements for the years ended December 31, 2025 and 2024, which are contained elsewhere in this report, for more information.

-24-