Bank7 Corp. (BSVN) Business

Item 1.   Business

Company Overview

We are Bank7 Corp., a bank holding company headquartered in Oklahoma City, Oklahoma. Through our wholly-owned subsidiary, Bank7, we operate twelve full-service branches in Oklahoma, Texas, and
Kansas. We were formed in 2004 in connection with our acquisition of First National Bank of Medford, which was renamed Bank7 (the “Bank”).  We are focused on serving business owners and entrepreneurs by delivering fast, consistent and well-designed
banking solutions. As of December 31, 2025, we had total assets of $1.96 billion, total loans of $1.61 billion, total deposits of $1.70 billion and total shareholders’ equity of $251.0 million.

Our website is: www.bank7.com. We make available free of charge through our website, our annual report on Form 10-K, our quarterly reports on Form 10-Q, current reports on Form 8-K, and
amendments to those reports as soon as reasonably practicable after they have been electronically filed or furnished with the Securities and Exchange Commission. Information included on our website is not incorporated into this filing.

Products and Services

The Bank is a full-service commercial bank.  We focus on the development of deep business relationships with our commercial customers and their principals.  We also focus on providing customers
with exceptional service and meeting their banking needs through a wide variety of commercial and retail financial services.

The Bank has a particular focus in the following loan categories (i) commercial real estate lending (“CRE”), (ii) hospitality lending, (iii) energy lending, and (iv) commercial and industrial
lending.  Although it is a small segment of the Bank, we also provide consumer lending services to individuals for personal and household purposes, including secured and unsecured term loans and home improvement loans.  Consumer lending services
include (i) residential real estate loans and mortgage banking services, (ii) personal lines of credit, (iii) loans for the purchase of automobiles, and (iv) other installment loans.

The Bank offers deposit banking products, including (i) commercial deposit services, commercial checking, money market, and other deposit accounts, and (ii) retail deposit services such as
certificates of deposit, money market accounts, checking accounts, negotiable order of withdrawal accounts, savings accounts, and automated teller machine access.

Strategic Focus

Our success is driven by:

We focus on our daily execution, making sound credit decisions and maintaining cost discipline, which is the foundation for our success. Our customers are our top priority and we focus on
efficiently providing tailored banking products and services to business owners and entrepreneurs, with a goal of generating consistent growth and delivering exceptional returns to our shareholders.  Additionally, we continually position ourselves
for future growth both organically and through strategic acquisitions.

Cost Discipline and Efficiency

We constantly monitor expenditures, and, when appropriate, we use automation, technology and repeatable processes to drive profitability. The Bank operates as few branches as practical, and the
branches we do operate are smaller and more cost efficient than a traditional branch. As we continue to grow, we expect our utilization of automation, technology, and repeatable processes will continue to drive efficiencies throughout the Bank.
Combining talented people with process automation will enable us to scale even further, and will also enable us to deliver consistently superior customer service.

1

Table
of Contents

Organic Growth

Much of our historic asset growth has been driven organically and within our current markets, particularly the Dallas/Fort Worth metropolitan area, Oklahoma City, and Tulsa. Although our
expansion with brick and mortar branches will be limited, we believe operating strategically placed branches will be important, and therefore we will continue to selectively build our presence in key markets. We currently operate twelve branches.
We also intend to continually enhance our internet and mobile banking products to remain competitive in the marketplace.

Markets

We are headquartered in Oklahoma City, Oklahoma, and we operate seven additional branches in Oklahoma. We also operate two branches in the Dallas/Fort Worth metropolitan area and two branches in
Kansas.

Competition

The banking and financial services industry is highly competitive, and we compete with a wide range of financial institutions within our markets, including local, regional and national commercial
banks and credit unions. We also compete with mortgage companies, trust companies, brokerage firms, consumer finance companies, mutual funds, securities firms, insurance companies, third-party payment processors, financial technology, or Fintech,
companies and other financial intermediaries for certain of our products and services. Some of our competitors are not subject to the regulatory restrictions and level of regulatory supervision applicable to us.

Interest rates on loans and deposits, as well as prices on fee-based services, are typically significant competitive factors within the banking and financial services industry. Many of our
competitors are much larger financial institutions that have greater financial resources than we do and compete aggressively for market share. These competitors attempt to gain market share through their financial product mix, pricing strategies
and banking center locations. Other important competitive factors in our industry and markets include office locations and hours, quality of customer service, community reputation, continuity of personnel and services, capacity and willingness to
extend credit, and ability to offer excellent banking products and services. While we seek to remain competitive with respect to fees charged, interest rates and pricing, we believe that our broad suite of financial solutions, our high-quality
customer service culture, our positive reputation and our long-standing community relationships enable us to compete successfully within our markets and enhance our ability to attract and retain customers.

Human Capital

Our corporate culture is defined by core values which include integrity, accountability, professionalism, community-focus and efficiency. As of December 31, 2025, we had 125 full-time employees.
We value our employees by investing in competitive compensation and benefit packages and fostering a team environment centered on professional service and open communication. Attracting, retaining and developing qualified, engaged employees who
embody these values are crucial to our success. We offer all of our employees a comprehensive benefits package that includes medical, dental and vision insurance, a flexible spending plan, group life insurance, short-term and long-term disability
insurance, a traditional 401(k) plan, competitive paid time off/paid holidays, and competitive incentives.

We are committed and focused on the health and safety of our employees, customers, and communities and are committed to providing a safe and secure work environment in accordance with applicable
labor, safety, health, anti-discrimination and other workplace laws. We strive for all of our employees to feel safe at work. To that end, we maintain a whistleblower hotline that allows associates and others to anonymously voice concerns. We
prohibit retaliation against an individual who reported a concern or assisted with an inquiry or investigation.

Supervision and Regulation

The following is a general summary of the material aspects of certain statutes and regulations that are applicable to us. These summary descriptions are not complete and are
subject to many exceptions. Please refer to the full text of the statutes, regulations, and corresponding guidance for more information. These statutes and regulations are subject to change, and additional statutes, regulations, and corresponding
guidance may be adopted. We are unable to predict future changes or the effects, if any, that these changes could have on our business or our revenues.

2

Table
of Contents

General

We are extensively regulated under U.S. federal and state law. As a result, our growth and earnings may be affected not only by management decisions and general economic conditions, but also by
federal and state statutes and by the regulations and policies of various bank regulatory agencies, including the Oklahoma Banking Department (“OBD”), the Federal Reserve (“FED”), the Federal Deposit Insurance Corporation (“FDIC”) and the Consumer
Financial Protection Bureau (“CFPB”). Furthermore, tax laws administered by the Internal Revenue Service (“IRS”) and state taxing authorities, accounting rules developed by the Financial Accounting Standards Board (“FASB”), securities laws
administered by the Securities and Exchange Commission (“SEC”) and state securities authorities and Anti-Money Laundering (“AML”) laws enforced by the U.S. Department of the Treasury (“Treasury”) also impact our business.

Federal and state banking laws impose a comprehensive system of supervision, regulation and enforcement on the operations of banks, their holding companies and their affiliates. These laws are
intended primarily for the protection of depositors, customers and the Depositor Insurance Fund of the FDIC (“DIF”) rather than for shareholders. Federal and state laws, and the related regulations of the bank regulatory agencies, affect, among
other things, the scope of business, the kinds and amounts of permissible investments, reserve requirements, capital levels relative to assets, the nature and amount of collateral for loans, the establishment of branches, the ability to merge,
consolidate and acquire, dealings with insiders and affiliates. the payment of dividends and redemption of securities.

This supervisory and regulatory framework subjects banks and bank holding companies to regular examination by their respective regulatory agencies, which results in examination reports and
ratings that, while not publicly available, can affect the conduct and growth of their businesses. These examinations consider not only compliance with applicable laws and regulations, but also capital levels, asset quality and risk, management’s
ability and performance, earnings, liquidity sensitivity to market risk and various other factors. These regulatory agencies have broad discretion to impose restrictions and limitations on the operations of a regulated entity and exercise
enforcement powers over a regulated entity (including terminating deposit insurance, imposing orders, fines and other civil and criminal penalties, removing officers and directors and appointing supervisors and conservators) where the agencies
determine, among other things, that such operations are unsafe or unsound, fail to comply with applicable law or regulations, or are otherwise inconsistent with the supervisory policies of these agencies.

Regulatory Capital Requirements

The federal banking agencies require that banking organizations meet several risk-based capital adequacy requirements. The current risk-based capital standards applicable to Bank7 Corp. (the “Company”) and Bank7 (the
“Bank”) are based on the Basel III Capital Rules established by the Basel Committee on Banking Supervision (the “Basel Committee”). The Basel Committee is a committee of central banks and bank supervisors/regulators from the major industrialized
countries that develops broad policy guidelines for use by each country’s supervisors in determining the supervisory policies they apply. The requirements are intended to ensure that banking organizations have adequate capital given the risk levels
of assets and off-balance sheet financial instruments.

The Basel III Capital Rules require the Bank and the Company to comply with four minimum capital standards: a Tier 1 leverage ratio of at least 4.0%; a Common Equity Tier 1 (“CET1”) capital to risk-weighted assets
ratio of 4.5%; a Tier 1 capital to risk-weighted assets ratio of at least 6.0%; and a total capital to risk-weighted assets ratio of at least 8.0%. The calculation of all types of regulatory capital is subject to definitions, deductions and
adjustments specified in the regulations.

The Basel III Capital Rules also require a “capital conservation buffer” of 2.5% above the regulatory minimum risk-based capital requirements. The capital conservation buffer is designed to absorb losses during
periods of economic stress and effectively increases the minimum required risk-weighted capital ratios. Banking institutions with a ratio of CET1 to risk-weighted assets below the effective minimum (4.5% plus the capital conservation buffer) is
subject to limitations on certain activities, including payment of dividends, share repurchases and discretionary bonuses to executive officers based on the amount of the shortfall.

As of December 31, 2025, the Company’s and the Bank’s capital ratios exceeded the minimum capital adequacy guideline percentage requirements under the Basel III Capital Rules.

3

Table
of Contents

Prompt Corrective Action

The Federal Deposit Insurance Act requires federal banking agencies to take “prompt corrective action” with respect to depository institutions that do not meet minimum capital requirements. For purposes of prompt
corrective action, the law establishes five capital tiers: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” A depository institution’s capital tier depends on its
capital levels and certain other factors established by regulation. Under the applicable FDIC regulations, an institution is deemed to be “well-capitalized” if it has a total risk-based capital ratio of 10.0% or greater, a Tier 1 risk-based capital
ratio of 8.0% or greater, a CET1 ratio of 6.5% or greater and a leverage ratio of 5.0% or greater.

At each lower capital category, a bank is subject to increased restrictions on its operations. For example, a bank is generally prohibited from making capital distributions and paying management fees to its holding
company if doing so would make the bank “undercapitalized.” Asset growth and branching restrictions apply to undercapitalized banks, which are required to submit written capital restoration plans meeting specified requirements (including a
guarantee by the parent holding company, if any). “Significantly undercapitalized” banks are subject to broad regulatory restrictions, including among other things, capital directives, forced mergers, restrictions on the rates of interest they may
pay on deposits, restrictions on asset growth and activities, and prohibitions on paying bonuses or increasing compensation to senior executive officers without FDIC approval. “Critically undercapitalized” are subject to even more severe
restrictions, including, subject to a narrow exception, the appointment of a conservator or receiver within 90 days after becoming critically undercapitalized.

The appropriate federal banking agency may determine (after notice and opportunity for a hearing) that the institution is in an unsafe or unsound condition or deems the institution to be engaging in an unsafe or
unsound practice. The appropriate agency is also permitted to require an adequately capitalized or undercapitalized institution to comply with the supervisory provisions as if the institution were in the next lower category (but not treat a
significantly undercapitalized institution as critically undercapitalized) based on supervisory information other than the capital levels of the institution.

The capital classification of a bank affects the frequency of regulatory examinations, the bank’s ability to engage in certain activities and the deposit insurance premium paid by the bank. A bank’s capital category
is determined solely for the purpose of applying prompt correct action regulations and the capital category may not accurately reflect the bank’s overall financial condition or prospects.

As of December 31, 2025, the Bank met the requirements for being deemed “well-capitalized” for purposes of the prompt corrective action regulations.

The Company

General. As a bank holding company, the Company is subject to regulation and supervision by the Federal Reserve under the Bank Holding Company Act of 1956, as amended (the “BHCA”). Under the BHCA, the Company
is subject to periodic examination by the Federal Reserve.  The Company is required to file with the Federal Reserve periodic reports of its operations and such additional information as the Federal Reserve may require.

Acquisitions, Activities and Change in Control. The BHCA generally requires the prior approval by the Federal Reserve for any merger involving a bank holding company or a bank holding company’s acquisition of
more than 5% of a class of voting securities of any additional bank or bank holding company or to acquire all or substantially all of the assets of any additional bank or bank holding company.

Subject to certain conditions (including deposit concentration limits established by the BHCA and the Dodd-Frank Act), the Federal Reserve may allow a bank holding company to acquire banks located in any state of the
United States. Federal law also generally prohibits any person or company from acquiring “control” of an FDIC-insured depository institution or its holding company without prior notice to the appropriate federal bank regulator.

Permitted Activities. The BHCA generally prohibits the Company from controlling or engaging in any business other than that of banking, managing and controlling banks or furnishing services to banks and their
subsidiaries. This general prohibition is subject to a number of exceptions. The principal exception allows bank holding companies to engage in, and to own shares of companies engaged in, certain businesses found by the Federal Reserve prior to
November 11, 1999 to be “so closely related to banking as to be a proper incident thereto.” This authority would permit the Company to engage in a variety of banking-related businesses, including operating a mortgage, finance, credit card or
factoring company; performing certain data processing operations; providing investment and financial advice; acting as an insurance agent for certain types of credit-related insurance; leasing personal property on a full-payout, non-operating
basis; and providing certain stock brokerage and investment advisory services. The BHCA generally does not place territorial restrictions on the domestic activities of nonbank subsidiaries of bank holding companies. The Federal Reserve has the
power to order any bank holding company or its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the Federal Reserve has reasonable grounds to believe that continuing such activity, ownership or
control constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company.

4

Table
of Contents

Source of Strength. Federal Reserve policy historically required bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. The Dodd-Frank Act codified this
policy as a statutory requirement. Under this requirement the Company is expected to commit resources to support the Bank, including at times when the Company may not be in a financial position to provide it. The Company must stand ready to use its
available resources to provide adequate capital to the Bank during periods of financial stress or adversity. The Company must also maintain the financial flexibility and capital raising capacity to obtain additional resources for assisting the
Bank. The Company’s failure to meet its source of strength obligations may constitute an unsafe and unsound practice or a violation of the Federal Reserve’s regulations or both. The source of strength obligation most directly affects bank holding
companies where a bank holding company’s subsidiary bank fails to maintain adequate capital levels. Any capital loans by a bank holding company to the subsidiary bank are subordinate in right of payment to deposits and to certain other indebtedness
of the subsidiary bank. The BHCA provides that in the event of a bank holding company’s bankruptcy any commitment by a bank holding company to a federal bank regulatory agency to maintain the capital of its subsidiary bank will be assumed by the
bankruptcy trustee and entitled to priority of payment.

Safe and Sound Banking Practices. Bank holding companies and their non-banking subsidiaries are prohibited from engaging in activities that represent unsafe and unsound banking practices or that constitute a
violation of law or regulations. Under certain conditions the Federal Reserve may conclude that certain actions of a bank holding company, such as a payment of a cash dividend, would constitute an unsafe and unsound banking practice. The Federal
Reserve also has the authority to regulate the debt of bank holding companies, including the authority to impose interest rate ceilings and reserve requirements on such debt. Under certain circumstances, the Federal Reserve may require a bank
holding company to file written notice and obtain approval prior to purchasing or redeeming the bank holding company’s equity securities, unless certain conditions are met.

Dividend Payments, Stock Redemptions and Repurchases. The Company’s ability to pay dividends to its shareholders is affected by both general corporate law considerations and the regulations and policies of the
Federal Reserve applicable to bank holding companies, including the Basel III Capital Rules.

Generally, an Oklahoma corporation may pay dividends out of surplus or, if there is no surplus, out of the corporation’s net profits for the fiscal year in which the dividend is declared and/or the preceding fiscal
year.  However, if the capital of the corporation has been diminished to an amount less than the aggregate amount of capital represented by preferred stock, if any, dividends may not be declared and paid out of any such net profits until the
deficiency in the amount of capital represented by the preferred stock has been restored.

It is the Federal Reserve’s policy that bank holding companies should generally pay dividends on common stock only out of income available over the past year, and only if prospective earnings retention is consistent
with the organization’s expected future needs and financial condition.  It is also the Federal Reserve’s policy that bank holding companies should not maintain dividend levels that undermine their ability to be a source of strength to its banking
subsidiaries. Additionally, the Federal Reserve has indicated that bank holding companies should carefully review their dividend policy and has discouraged payment ratios that are at maximum allowable levels unless both asset quality and capital
are very strong.

Bank holding companies must consult with the Federal Reserve before redeeming any equity or other capital instrument included in Tier 1 or Tier 2 capital prior to stated maturity, if such redemption could have a
material effect on the level or composition of the organization’s capital base.  In addition, bank holding companies are unable to repurchase shares equal to 10% or more of its net worth if it would not be well-capitalized (as defined by the
Federal Reserve) after giving effect to such repurchase. Bank holding companies experiencing financial weaknesses, or that are at significant risk of developing financial weaknesses, must consult with the Federal Reserve before redeeming or
repurchasing common stock or other regulatory capital instruments.

The Bank

General. The Bank is an Oklahoma-chartered member bank and is subject to examination, supervision and regulation by the OBD and the Federal Reserve. The Bank is also subject to certain regulations of the FDIC
and the CFPB.

The OBD supervises and regulates all areas of the Bank’s operations including, without limitation, the making of loans, the issuance of securities, the conduct of the Bank’s corporate affairs, the satisfaction of
capital adequacy requirements, the payment of dividends, and the establishment or closing of banking offices. The Federal Reserve is the Bank’s primary federal regulatory agency, and periodically examines the Bank’s operations and financial
condition and compliance with federal law. In addition, the Bank’s deposit accounts are insured by the DIF, and the FDIC has certain enforcement powers over the Bank.

Depositor Preference. In the event of the “liquidation or other resolution” of an insured depository institution, the claims of depositors of the institution, including the claims of the FDIC as subrogee of
insured depositors, and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution. If an insured depository institution fails, insured and uninsured
depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors including the parent bank holding company with respect to any extensions of credit they have made to that insured depository institution.

5

Table
of Contents

Deposit Insurance. As an FDIC-insured institution, the Bank is required to pay deposit insurance premiums to the FDIC. The amount of such premiums is determined by multiplying the institution’s assessment rate
by its assessment base. The assessment rate is based on the institution’s risk classification which is assigned based on the institution’s capital levels and the level of supervisory concern the institution poses to the regulators. The assessment
base is calculated as the institution’s average consolidated total assets minus average tangible equity.

Additionally, the Dodd-Frank Act altered the minimum designated reserve ratio of the DIF, increasing the minimum from 1.15% to 1.35% of the estimated amount of total insured deposits, and eliminating the requirement
that the FDIC pay dividends to depository institutions when the reserve ratio exceeds certain thresholds. At least semi-annually, the FDIC updates its loss and income projections for the DIF and, if needed, may increase or decrease the assessment
rates, following notice and comment on proposed rulemaking. As a result, the Bank’s FDIC deposit insurance premiums could increase.

Examination Assessments. Oklahoma-chartered banks are required to pay an annual fee of $1,000 to the OBD to fund its operations. In addition, Oklahoma-chartered banks are charged an examination assessment
calculated based on the amount of the Bank’s assets at rates established by the Oklahoma Banking Board. During the year ended December 31, 2025, the Bank paid examination assessments to the OBD totaling $214,000.

Capital Requirements. Banks are generally required to maintain minimum capital ratios. For a discussion of the capital requirements applicable to the Bank, see “—Regulatory Capital Requirements” above.

Bank Reserves. The Federal Reserve requires all depository institutions to maintain reserves against some transaction accounts (primarily NOW and Super NOW checking accounts). The balances maintained to meet
the reserve requirements imposed by the Federal Reserve may be used to satisfy liquidity requirements. An institution may borrow from the Federal Reserve “discount window” as a secondary source of funds if the institution meets the Federal
Reserve’s credit standards.

Dividend Payments. The primary source of funds for the Company is dividends from the Bank. Unless the approval of the Federal Reserve is obtained, the Bank may not declare or pay a dividend if the total of all
dividends declared during the calendar year, including the proposed dividend, exceeds the sum of the Bank’s net income during the current calendar year and the retained net income of the prior two calendar years. Oklahoma law also places
restrictions on the declaration of dividends by Oklahoma state-chartered banks, including the Bank, to their shareholders. Before any dividend may be declared by the Bank, not less than 10% of the net profits of the Bank must be transferred to a
surplus fund until the surplus equals 100% of the Bank’s capital stock. This may decrease any amount available for the payment of dividends in a particular period if the surplus funds for the Bank fail to comply with this limitation. Furthermore,
the approval of the Commissioner of the OBD is required if the total of all dividends declared by the Bank in any calendar year exceed the total of its net profits of that year combined with its retained net profits of the preceding two years, less
any required transfers to surplus or a fund for the retirement of any preferred stock.  The Federal Reserve and the OBD also may, under certain circumstances, prohibit the payment of dividends to us from the Bank. Oklahoma corporate law also
requires that dividends can only be paid out of funds legally available therefore.

The payment of dividends by any financial institution is affected by the requirement to maintain adequate capital pursuant to applicable capital adequacy guidelines and regulations, and a financial institution
generally is prohibited from paying any dividends if, following payment thereof, the institution would be undercapitalized. As described above, the Bank exceeded its minimum capital requirements under applicable regulatory guidelines as of December
31, 2025.

Transactions with Affiliates. The Bank is subject to sections 23A and 23B of the Federal Reserve Act (the “Affiliates Act”), and the Federal Reserve’s implementing Regulation W. An affiliate of a bank is any
company or entity that controls, is controlled by or is under common control with the bank. Accordingly, transactions between the Company, the Bank and any non-bank subsidiaries will be subject to a number of restrictions. The Affiliates Act
imposes restrictions and limitations on the Bank from making extensions of credit to, or the issuance of a guarantee or letter of credit on behalf of, the Company or other affiliates, the purchase of, or investment in, stock or other securities
thereof, the taking of such securities as collateral for loans, and the purchase of assets of the Company or other affiliates. Such restrictions and limitations prevent the Company or other affiliates from borrowing from the Bank unless the loans
are secured by marketable obligations of designated amounts. Furthermore, such secured loans and investments by the Bank to or in the Company or to or in any other non-banking affiliate are limited, individually, to 10% of the Bank’s capital and
surplus, and such transactions are limited in the aggregate to 20% of the Bank’s capital and surplus. All such transactions, as well as contracts entered into between the Bank and affiliates, must be on terms that are no less favorable to the Bank
than those that would be available from non-affiliated third parties. Federal Reserve policies also forbid the payment by bank subsidiaries of management fees which are unreasonable in amount or exceed the fair market value of the services rendered
or, if no market exists, actual costs plus a reasonable profit.

6

Table
of Contents

Transactions with Related Parties. The authority of the Bank to extend credit to its directors, executive officers and principal shareholders, including their immediate family members and corporations and
other entities that they control, is subject to substantial restrictions and requirements under the Federal Reserve’s Regulation O, as well as the Sarbanes-Oxley Act. These statutes and regulations impose limits on the amount of loans the Bank may
make to insiders and require that the loans must be made on substantially the same terms, including interest rates and collateral, as prevailing at the time for comparable transactions with persons not affiliated with the Company or the Bank.

At December 31, 2025 and 2024, the Company had loans outstanding to these related parties in the amount of $10.45 million and $10.85 million, respectively. Additionally, the Company holds deposits from related
parties, including directors, executive officers, and their related interests. At December 31, 2025 and 2024, these related party deposits totaled $66.62 million and $70.12 million, respectively. These deposit balances represented 26.55% and 32.89%
of total stockholders’ equity at December 31, 2025 and 2024, respectively.

All such loans and deposits were made in the ordinary course of business on substantially the same terms, including interest rates and collateral, as those prevailing at the time for comparable transactions with
persons not affiliated with the Company or the Bank and did not involve more than the normal risk of collectability or present other unfavorable features.

Limits on Loans to One Borrower. As an Oklahoma state-chartered bank, the Bank is subject to limits on the amount of loans it can make to one borrower. With certain limited exceptions, loans and extensions of
credit from Oklahoma state-chartered banks outstanding to any borrower (including certain related entities of the borrower) at any one time may not exceed 30% of the capital, less intangible assets, of the bank. An Oklahoma state-chartered bank may
lend an additional amount if the loan is fully secured by certain types of collateral, like bonds or notes of the United States. Certain types of loans are exempted from the lending limits, including loans secured by segregated deposits held by the
Bank. The Bank’s legal lending limit to any one borrower was $78.4 million as of December 31, 2025.

Safety and Soundness Standards/Risk Management. The federal banking agencies have adopted guidelines establishing operational and managerial standards to promote the safety and soundness of federally insured
depository institutions. The guidelines set forth standards for internal controls, information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, compensation, fees and benefits, asset
quality and earnings.

If an institution fails to comply with any of the standards set forth in the guidelines, the financial institution’s primary federal regulator may require the institution to submit a plan for achieving and
maintaining compliance. If a financial institution fails to submit an acceptable compliance plan, or fails in any material respect to implement a compliance plan that has been accepted by its primary federal regulator, the regulator is required to
issue an order directing the institution to cure the deficiency. Until the deficiency cited in the regulator’s order is cured, the regulator may restrict the financial institution’s rate of growth, require the financial institution to increase its
capital, restrict the rates the institution pays on deposits or require the institution to take any action the regulator deems appropriate under the circumstances. Noncompliance with the standards established by the safety and soundness guidelines
may also constitute grounds for other enforcement action by the federal bank regulatory agencies, including cease and desist orders and civil money penalty assessments.

Branching Authority. New branches must be approved by the Federal Reserve and the OBD, which consider a number of factors, including financial history, capital adequacy, earnings prospects, character of
management, needs of the community and consistency with corporate power. The Dodd-Frank Act permits insured state banks to engage in interstate branching if the laws of the state where the new banking office is to be established would permit the
establishment of the banking office if it were chartered by a bank in such state. Finally, we may also establish banking offices in other states by merging with banks or by purchasing banking offices of other banks in other states, subject to
certain restrictions.

Interstate Deposit Restrictions. The Interstate Act, together with the Dodd-Frank Act, relaxed prior branching restrictions under federal law by permitting, subject to regulatory approval, banks to establish
branches in states where the laws permit banks chartered in such states to establish branches.

Section 109 of the Interstate Act prohibits a bank from establishing or acquiring a branch or branches outside of its home state primarily for the purpose of deposit production.

Community Reinvestment Act. The CRA directs the federal bank regulatory agencies, in examining insured depository institutions, to assess their record of helping to meet the credit needs of their entire
community, including low- and moderate- income neighborhoods, consistent with safe and sound banking practices. The CRA further requires the agencies to take a financial institution’s record of meeting its community credit needs into account when
evaluating applications for, among other things, domestic branches, consummating mergers or acquisitions or holding company formations.

The federal banking agencies have adopted regulations which measure a bank’s compliance with its CRA obligations on a performance-based evaluation system. This system bases CRA ratings on an institution’s actual
lending service and investment performance rather than the extent to which the institution conducts needs assessments, documents community outreach or complies with other procedural requirements. The ratings range from a high of “outstanding” to a
low of “substantial noncompliance.” The Bank had a CRA rating of “satisfactory” as of its most recent CRA assessment.

7

Table
of Contents

Anti-Money Laundering and the Office of Foreign Assets Control Regulation. The USA PATRIOT Act is designed to deny terrorists and criminals the ability to obtain access to the U.S. financial system and has
significant implications for depository institutions, brokers, dealers and other businesses involved in the transfer of money. The USA PATRIOT Act substantially broadened the scope of United States AML laws and regulations by imposing significant
compliance and due diligence obligations, created new crimes and penalties and expanded the extra territorial jurisdiction of the United States. Financial institutions are also prohibited from entering into specified financial transactions and
account relationships, must use enhanced due diligence procedures in their dealings with certain types of high-risk customers and must implement a written customer identification program. Financial institutions must take certain steps to assist
government agencies in detecting and preventing money laundering and report certain types of suspicious transactions. Regulatory authorities routinely examine financial institutions for compliance with these obligations and have imposed cease and
desist orders and civil money penalties against institutions found to be in violation of these obligations.

Likewise, Office of Foreign Asset Control (“OFAC”) administers and enforces economic and trade sanctions against targeted foreign countries and regimes under authority of various laws, including designated foreign
countries, nationals and others. OFAC publishes lists of specially designated targets and countries.  Financial institutions are responsible for, among other things, blocking accounts of and transactions with such targets and countries, prohibiting
unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence.

Failure of a financial institution to maintain and implement adequate AML and OFAC programs, or to comply with all of the relevant laws or regulations, could have serious legal and reputational consequences for the
institution, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required.

Consumer Financial Services

We are subject to a number of federal and state consumer protection laws that extensively govern our relationship with our customers. These laws include the ECOA, the Fair Credit Reporting Act, the Truth in Lending
Act, the Truth in Savings Act, the Electronic Fund Transfer Act, the Expedited Funds Availability Act, the Home Mortgage Disclosure Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Fair Debt Collection Practices Act, the
Service Members Civil Relief Act, the Military Lending Act, and these laws’ respective state law counterparts, as well as state usury laws and laws regarding unfair and deceptive acts and practices. These and other federal laws, among other things,
require disclosures of the cost of credit and terms of deposit accounts, provide substantive consumer rights, prohibit discrimination in credit transactions, regulate the use of credit report information, provide financial privacy protections,
prohibit unfair, deceptive and abusive practices and subject us to substantial regulatory oversight. Violations of applicable consumer protection laws can result in significant potential liability from litigation brought by customers, including
actual damages, restitution and attorneys’ fees. Federal bank regulators, state attorneys general and state and local consumer protection agencies may also seek to enforce consumer protection requirements and obtain these and other remedies,
including regulatory sanctions, customer rescission rights, action by the state and local attorneys general in each jurisdiction in which we operate and civil money penalties. Failure to comply with consumer protection requirements may also result
in failure to obtain any required bank regulatory approval for mergers or acquisitions or prohibition from engaging in such transactions even if approval is not required.

Rulemaking authority for most federal consumer protection laws was transferred from the prudential regulators to the CFPB on July 21, 2011.  In some cases, regulators such as the Federal Trade Commission and the DOJ
also retain certain rulemaking or enforcement authority. The CFPB also has broad authority to prohibit unfair, deceptive and abusive acts and practices, or UDAAP, and to investigate and penalize financial institutions that violate this prohibition.
While the statutory language of the Dodd-Frank Act sets forth the standards for acts and practices that violate the prohibition on UDAAP, certain aspects of these standards are untested, and thus it is currently not possible to predict how the CFPB
will exercise this authority.

The consumer protection provisions of the Dodd-Frank Act and the examination, supervision and enforcement of those laws and implementing regulations by the CFPB have created a more intense and complex environment for
consumer finance regulation. The CFPB has significant authority to implement and enforce federal consumer protection laws and new requirements for financial services products provided for in the Dodd-Frank Act, as well as the authority to identify
and prohibit UDAAP. The review of products and practices to prevent such acts and practices is a continuing focus of the CFPB, and of banking regulators more broadly. The ultimate impact of this heightened scrutiny is uncertain but could result in
changes to pricing, practices, products and procedures. It could also result in increased costs related to regulatory oversight, supervision and examination, additional remediation efforts and possible penalties. In addition, the Dodd-Frank Act
provides the CFPB with broad supervisory, examination and enforcement authority over various consumer financial products and services, including the ability to require reimbursements and other payments to customers for alleged legal violations and
to impose significant penalties, as well as injunctive relief that prohibits lenders from engaging in allegedly unlawful practices. The CFPB also has the authority to obtain cease and desist orders providing for affirmative relief or monetary
penalties. The Dodd-Frank Act does not prevent states from adopting stricter consumer protection standards. State regulation of financial products and potential enforcement actions could also adversely affect our business, financial condition or
results of operations.

The CFPB has examination and enforcement authority over providers with more than $10 billion in assets. Banks and savings institutions with $10 billion or less in assets, like the Bank, will continue to be examined
by their applicable bank regulators.

8

Table
of Contents

Federal Banking Agency Incentive Compensation Guidance

The federal bank regulatory agencies have issued comprehensive guidance intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of those
organizations by encouraging excessive risk-taking. The incentive compensation guidance sets expectations for banking organizations concerning their incentive compensation arrangements and related risk management, control and governance processes.
The incentive compensation guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon three primary principles: (1) balanced
risk-taking incentives; (2) compatibility with effective controls and risk management; and (3) strong corporate governance. Any deficiencies in compensation practices that are identified may be incorporated into the organization’s supervisory
ratings, which can affect its ability to make acquisitions or take other actions. In addition, under the incentive compensation guidance, a banking organization’s federal supervisor may initiate enforcement action if the organization’s incentive
compensation arrangements pose a risk to the safety and soundness of the organization. Further, the Basel III capital rules limit discretionary bonus payments to bank executives if the institution’s regulatory capital ratios fail to exceed certain
thresholds. Although the federal bank regulatory agencies proposed additional rules in June of 2016 and again in May of 2024 related to incentive compensation for all banks with more than $1.0 billion in assets, which would include the Company and
the Bank, those rules have not been finalized and the scope and content of the U.S. banking regulators’ policies on executive compensation are continuing to develop and are likely to continue evolving in the near future.

Financial Privacy

The federal bank regulatory agencies have adopted rules that limit the ability of banks and other financial institutions to disclose non-public information about consumers to non-affiliated third parties. These
limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a non-affiliated third party. These regulations affect how consumer information is
transmitted through financial services companies and conveyed to outside vendors. In addition, consumers may also prevent disclosure of certain information among affiliated companies that is assembled or used to determine eligibility for a product
or service, such as that shown on consumer credit reports and asset and income information from applications. Consumers also have the option to direct banks and other financial institutions not to share information about transactions and
experiences with affiliated companies for the purpose of marketing products or services.

Cybersecurity

Banking institutions are required to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of customer
records and information. These security and privacy policies and procedures for the protection of confidential and personal information are in effect across our lines of business. Furthermore, the federal banking regulators regularly issue guidance
regarding cybersecurity intended to enhance cyber risk management. A financial institution is expected to implement multiple lines of defense against cyber-attacks and ensure that their risk management procedures address the risk posed by potential
cyber threats. A financial institution is further expected to maintain procedures to effectively respond to a cyber-attack and resume operations following any such attack. The Bank has adopted and implemented policies and procedures to comply with
privacy, information security, and cybersecurity requirements. On November 18, 2021, the federal banking agencies issued a new rule effective in 2022 that requires banks to notify their regulators within 36 hours of a “computer-security incident”
that rises to the level of a “notification incident.”

Impact of Monetary Policy

The monetary policy of the Federal Reserve has a significant effect on the operating results of financial or bank holding companies and their subsidiaries. Among the tools available to the Federal Reserve to affect
the money supply are open market transactions in U.S. government securities, changes in the discount rate on member bank borrowings and changes in reserve requirements against member bank deposits. These tools are used in varying combinations to
influence overall growth and distribution of bank loans, investments and deposits, and their use may affect interest rates charged on loans or paid on deposits.

Changes in Laws, Regulations or Policies

Other legislative and regulatory initiatives which could affect the Company, the Bank and the banking industry in general may be pending, proposed or introduced before the U.S. Congress, the Oklahoma Legislature and
other governmental bodies from time to time. Such proposals, if enacted, may further alter the structure, regulation and competitive relationship among financial institutions, and may subject the Company or the Bank to increased regulation,
disclosure and reporting requirements. In addition, the various banking regulatory agencies often adopt new rules and regulations to implement and enforce existing legislation. It cannot be predicted whether, or in what form, any such legislation
or regulations may be enacted or the extent to which the business of the Company or the Bank would be affected thereby.