COLONY BANKCORP INC (CBAN) Business

Business

COLONY BANKCORP, INC.

General

Colony Bankcorp, Inc. (the “Company” or “Colony”) is a financial services company and a registered bank holding company headquartered in Fitzgerald, Georgia. The Company was incorporated on November 8, 1982 under the laws of the State of Georgia. The Company was organized for the purpose of operating as a bank holding company under the Bank Holding Company Act of 1956, as amended, and the bank holding company laws of Georgia. Our business is conducted primarily through our wholly-owned bank subsidiary, Colony Bank, a Georgia state-chartered commercial bank, which provides a broad range of banking services to its retail and commercial customers. We operate locations throughout Georgia as well as in Birmingham, Alabama, and Jacksonville, Santa Rosa Beach and Tallahassee, Florida. At December 31, 2025, we had approximately $3.7 billion in total assets, $2.5 billion in total loans, $3.1 billion in total deposits and $375.9 million in stockholder’s equity. Deposits are insured, up to applicable limits, by the Federal Deposit Insurance Corporation.

The Parent Company

Because the Company is a financial services company and a registered bank holding company, its principal operations are conducted through the Bank. It has 100 percent ownership of the Bank and maintains systems of financial, operational and administrative controls that permit centralized evaluation of the operations of the Bank in selected functional areas including operations, accounting, marketing, investment management, purchasing, human resources, computer services, auditing, compliance and credit review. As a bank holding company, we also perform certain shareholder and investor relations functions.

Colony Bank - Banking Services

Our principal subsidiary is the Bank. The Bank, headquartered in Fitzgerald, Georgia, offers a comprehensive range of banking solutions tailored to both personal and commercial customers. Our lending solutions include loans for small and medium-sized businesses, residential and commercial construction, land development and commercial real estate. We also provide commercial loans, agri-business and production loans, residential mortgages, home equity loans, and consumer loans. In addition to traditional lending, we offer specialized loan programs, including government-guaranteed loans through our Small Business Specialty Lending ("SBSL") department and financing for marine and recreational vehicles.

Our deposit products serve as the primary funding source for our loans and are designed to meet the needs of both individuals and businesses. We offer a variety of noninterest-bearing and interest-bearing accounts, including checking, savings, money market, and other deposit options. Our focus is on expanding core deposits while strengthening customer relationships. To complement our deposit offerings, we also provide treasury solutions, merchant services, and other financial tools that support businesses in managing cash flow and operational efficiency.

We also offer wealth management, consumer insurance, internet banking services, electronic bill payment services, safe deposit box rentals, telephone banking, credit and debit card services, remote depository products and access to a network of ATMs to our customers. The Bank conducts its business through full-service banking centers and loan production offices located throughout Georgia, Alabama and Florida. Georgia locations include the cities of Albany, Ashburn, Athens, Atlanta, Augusta, Broxton, Cedartown, Centerville, Chickamauga, Columbus, Cordele, Covington, Douglas, Eastman, Fayetteville, Fitzgerald, Greensboro, LaGrange, Leesburg, Macon, Manchester, Monroe, Moultrie, Quitman, Rochelle, Rockmart, Savannah, Statesboro, Sylvester, Thomaston, Thomasville, Tifton, Valdosta and Warner Robins. The Bank also operates locations in Birmingham, Alabama, and Jacksonville, Santa Rosa Beach and Tallahassee, Florida.

Recent Developments

Stock Buyback Program

On October 20, 2022, the Company's Board of Directors authorized a stock buyback program, permitting the repurchase of up to $12 million of the Company's outstanding common stock. Repurchases under this program may be conducted through open market purchases, privately negotiated transactions, or other methods compliant with applicable laws and regulations. The

7

initial buyback program commenced on October 20, 2022 and expired on December 31, 2023. On March 22, 2024, the Board approved an extension of the program through the end of 2024, followed by an additional extension on December 18, 2024 through the end of 2025. On December 22, 2025, the Board authorized a further extension of the program through the end of 2026. As of December 31, 2025, the Company had repurchased a total of 318,778 shares for a total of $4,613,000 since the start of the program in 2022, leaving $7,387,000 available to repurchase.

Acquisitions

On April 1, 2025, the Company acquired The Ellerbee Agency, an Allstate appointed consumer property and casualty insurance agency which became part of Colony's insurance division and expanded our insurance footprint and customer base into two new locations in Monroe and Greensboro, Georgia.

On December 1, 2025, the Company completed its acquisition of TC Bancshares, Inc. (“TCBC”), a bank holding company headquartered in Thomasville, Georgia. Upon consummation of the acquisition, TCBC was merged with and into the Company, with Colony Bankcorp, Inc. as the surviving entity in the merger. Immediately following the holding company merger, TCBC’s wholly owned bank subsidiary, TC Federal Bank was also merged with and into the Bank. The acquisition expanded the Company’s market presence, as TC Federal Bank had four full-service banking locations in Thomasville and Savannah, Georgia and in Tallahassee and Jacksonville, Florida. Under the terms of the Agreement and Plan of Merger, each TCBC shareholder had the option to receive either $21.25 in cash or 1.25 shares of the Company’s common stock in exchange for each share of TCBC stock. As a result, the Company issued 3,839,613 common shares at a fair value of $65.8 million and paid $15.4 million in cash to the former shareholders of TCBC as merger consideration.

Markets and Competition

The banking industry in general is highly competitive. Our market areas consist of north, central, south and coastal Georgia as well as Birmingham, Alabama, and Santa Rosa Beach, Jacksonville and Tallahassee, Florida. In contrast to our rural markets, in which we typically rank in the top three in terms of market share, we face competitive pressures in attracting deposits and making loans from larger regional banks and smaller community banks. The Bank's competition includes not only other banks of comparable or larger size in the same markets, but also various other nonbank financial institutions, including savings and loan associations, credit unions, mortgage companies, personal and commercial financial companies, peer to peer lending businesses, fintech companies, investment brokerage and financial advisory firms and mutual fund companies. The Bank competes for deposits, commercial, fiduciary and investment services and various types of loans and other financial services. The Bank also competes for interest-bearing funds with a number of other financial intermediaries, including brokerage and insurance firms, as well as investment alternatives, including mutual funds, governmental and corporate bonds, and other securities. Continued consolidation and rapid technological changes within the financial services industry will likely change the nature and intensity of competition, but also will create opportunities for the Company to demonstrate and leverage its competitive advantages. The continuing consolidation within the financial services industry is leading to larger, better capitalized and geographically diverse institutions with enhanced product and technology capabilities. Additionally, competition from fintechs, is increasing. These competitors increasingly offer digital-first alternatives for payments, deposits, lending and other financial services that may reduce customer reliance on traditional banking relationships.

In addition to fintechs, certain technology companies are working to provide financial services directly to their customers. These nontraditional financial service providers have been successful in developing digital and other products and services that effectively compete with traditional banking services, but are in some cases subject to fewer regulatory restrictions than banks and bank holding companies, allowing them to operate with greater flexibility and lower cost structures. Although digital products and services have been important competitive features of financial institutions for some time, the move toward digital financial services products has accelerated in recent years and we expect that trend to continue.

Competitors include not only financial institutions based in Georgia, but also a number of large out-of-state and foreign banks, bank holding companies and other financial institutions that have an established market presence in Georgia or that offer internet-based products. Many of the Company's competitors are engaged in local, regional, national and international operations and have greater assets, personnel and other resources. Some of these competitors are subject to less regulation and/or more favorable tax treatment. Many of these institutions have greater resources, broader geographic markets and higher lending limits, and may offer services that the Company does not offer. In addition, these institutions may be able to better afford and make broader use of media advertising, support services, and electronic and other technology. To offset these potential competitive disadvantages, the Company depends on its reputation for superior service, ability to make credit and other business decisions quickly, and the delivery of an integrated distribution of traditional branches and bankers, with digital technology.

8

Correspondents

Colony Bank has correspondent relationships with the following banks: Federal Reserve Bank of Atlanta; FHN Financial in Memphis, Tennessee; SouthState Bank in Lake Wales, Florida; ServisFirst in Birmingham, Alabama; The Independent BankersBank (TIB, N.A.) in Farmers Branch, Texas; Pacific Coast Bankers' Bank in Walnut Creek, California; and the Federal Home Loan Bank of Atlanta. These correspondent relationships facilitate the transaction of business by means of loans, collections, investment services, lines of credit and exchange services, particularly in markets in which Colony Bank does not have a physical presence. As compensation for these services, the Bank maintains balances with its correspondents in primarily interest-bearing accounts and pays some service charges.

Human Capital Resources

We recognize that our most valuable asset is our people. One of our top strategic priorities is the retention and development of our talent. This includes providing career development opportunities for all associates; increasing our inclusivity and recognizing that diverse perspectives, backgrounds, and experiences strengthen our ability to meet the needs of our associates, communities, clients and shareholders; training our next generation of leaders; and succession planning.

On December 31, 2025, the Company had a total of 537 employees, 526 of which are full-time equivalent employees. None of our employees are represented by any collective bargaining unit or is a party to a collective bargaining agreement. We consider our relationship with our employees to be satisfactory and have not experienced interruptions of operations due to labor disagreements. All of our employees are chosen on the basis of their qualifications and merit.

Talent Acquisition, Development and Retention

Our culture emphasizes our longstanding dedication to being respectful to others and having a workforce that is representative of the communities we serve. Inclusion and belonging are fundamental to our culture. We believe in attracting, retaining and promoting quality talent and recognize that diversity makes us stronger as a company. Our success depends on our ability to attract, retain and develop employees, and our talent acquisition teams partner with hiring managers in sourcing and presenting a slate of qualified candidates to strengthen our organization. Professional development is a key priority, which is facilitated through our many corporate development initiatives including extensive training programs, corporate mentoring, leadership programs, educational reimbursement and professional speaker series. Our talent acquisition, development and retention focuses on rewarding merit and achievement while nurturing and progressing skilled talent across various business segments.

Health and Welfare

As part of our effort to attract and retain employees, we offer a broad range of benefits, including a profit-sharing plan covering all employees, subject to certain minimum age and service requirements. In addition, the Company maintains a comprehensive employee benefit program providing, among other benefits, hospitalization, major medical, life insurance and disability insurance. Management considers these benefits to be competitive with those offered by other financial institutions in our market area. Colony’s employees are not represented by any collective bargaining group.

Corporate Information

The Company’s headquarters is located at 115 South Grant Street, Fitzgerald, Georgia 31750, its telephone number is 229-426-6000 and its internet address is www.colonybank.com. The information contained on or accessible from our website does not constitute a part of this Annual Report on Form 10-K and is not incorporated by reference herein.

Public Information

Persons interested in obtaining information on the Company may read and copy any materials that we file with the U.S. Securities and Exchange Commission ("SEC"). The Commission maintains an Internet site that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC at https://www.sec.gov. We make available, free of charge, on or through our website, https://investors.colony.bank.com/sec-filings, our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and other filings pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, and amendments to such filings, as soon as reasonably practicable after each is electronically filed with, or furnished to, the SEC.

9

SUPERVISION AND REGULATION

General

We are extensively regulated under federal and state law. The following is a brief summary that does not purport to be a complete description of all regulations that affect us or all aspects of those regulations. This discussion is qualified in its entirety by reference to the particular statutory and regulatory provisions described below and is not intended to be an exhaustive description of the statutes or regulations applicable to the Company’s and the Bank’s business. In addition, proposals to change the laws and regulations governing the banking industry are frequently raised at both the state and federal levels. The likelihood and timing of any changes in these laws and regulations, and the impact such changes may have on us and the Bank, are difficult to predict. In addition, bank regulatory agencies may issue enforcement actions, policy statements, interpretive letters and similar written guidance applicable to us or the Bank. Changes in applicable laws, regulations or regulatory guidance, or their interpretation by regulatory agencies or courts may have a material adverse effect on our and the Bank’s business, operations, and earnings. Supervision and regulation of banks, their holding companies and affiliates is intended primarily for the protection of depositors and customers, the Deposit Insurance Fund (“DIF”) of the Federal Deposit Insurance Corporation (“FDIC”), and the U.S. banking and financial system rather than holders of our capital stock.

Regulation of the Company

We are registered as a bank holding company with the Federal Reserve under the Bank Holding Company Act of 1956, as amended (the “BHC Act”) and have elected to be treated as a financial holding company. As such, we are subject to comprehensive supervision and regulation by the Federal Reserve and are subject to its regulatory reporting requirements. Federal law subjects financial holding companies, such as the Company, to particular restrictions on the types of activities in which they may engage, and to a range of supervisory requirements and activities, including regulatory enforcement actions for violations of laws and regulations. Violations of laws and regulations, or other unsafe and unsound practices, may result in regulatory agencies imposing fines or penalties, cease and desist orders, or taking other enforcement actions. Under certain circumstances, these agencies may enforce these remedies directly against officers, directors, employees and other parties participating in the affairs of a bank or bank holding company.

Activity Limitations. As a financial holding company, we are permitted to engage directly or indirectly in a broader range of activities than those permitted for a bank holding company that has not elected to be a financial holding company. Bank holding companies are generally restricted to engaging in the business of banking, managing or controlling banks and certain other activities determined by the Federal Reserve to be closely related to banking. Financial holding companies may also engage in activities that are considered to be financial in nature, as well as those incidental or, if determined by the Federal Reserve, complementary to financial activities. We and Colony Bank must each remain “well-capitalized” and “well-managed” and Colony Bank must receive a CRA rating of at least “Satisfactory” at its most recent examination in order for us to maintain our status as a financial holding company. If Colony Bank ceases to be “well capitalized” or “well managed” under applicable regulatory standards, or if Colony Bank receives a rating of less than satisfactory under the CRA, the Federal Reserve Board may, among other things, place limitations on our ability to conduct these broader financial activities or, if the deficiencies persist, require us to divest the banking subsidiary or the businesses engaged in activities permissible only for financial holding companies.

In addition, the Federal Reserve has the power to order a bank holding company or its subsidiaries to terminate any nonbanking activity or terminate its ownership or control of any nonbank subsidiary, when it has reasonable cause to believe that continuation of such activity or such ownership or control constitutes a serious risk to the financial safety, soundness, or stability of any bank subsidiary of that bank holding company.

Source of Strength Obligations. A financial holding company is required to act as a source of financial and managerial strength to its subsidiary bank and to maintain resources adequate to support its bank. The term “source of financial strength” means the ability of a company, such as us, that directly or indirectly owns or controls an insured depository institution, such as the Bank, to provide financial assistance to such insured depository institution in the event of financial distress. The appropriate federal banking agency for the depository institution (in the case of the Bank, this agency is the FDIC) may require reports from us to assess our ability to serve as a source of strength and to enforce compliance with the source of strength requirements by requiring us to provide financial assistance to the Bank in the event of financial distress. If we were to enter bankruptcy or become subject to the orderly liquidation process established by the Dodd-Frank Act, any commitment by us to a federal bank regulatory agency to maintain the capital of the Bank would be assumed by the bankruptcy trustee or the FDIC, as appropriate, and entitled to a priority of payment.

10

Acquisitions. The BHC Act permits acquisitions of banks by bank holding companies, such that we and any other bank holding company, whether located in Georgia or elsewhere, may acquire a bank located in any other state, subject to certain deposit-percentage, age of bank charter requirements, and other restrictions. The BHC Act requires that a bank holding company obtain the prior approval of the Federal Reserve before (i) acquiring direct or indirect ownership or control of more than 5% of the voting shares of any additional bank or bank holding company, (ii) taking any action that causes an additional bank or bank holding company to become a subsidiary of the bank holding company, or (iii) merging or consolidating with any other bank holding company. The Federal Reserve may not approve any such transaction that would result in a monopoly or would be in furtherance of any combination or conspiracy to monopolize or attempt to monopolize the business of banking in any section of the United States, or the effect of which may be substantially to lessen competition or to tend to create a monopoly in any section of the country,  or that in any other manner would be in restraint of trade, unless the anticompetitive effects of the proposed transaction are clearly outweighed by the public interest in meeting the convenience and needs of the community to be served. The Federal Reserve is also required to consider: (1) the financial and managerial resources of the companies involved, including pro forma capital ratios; (2) the risk to the stability of the United States banking or financial system; (3) the convenience and needs of the communities to be served, including performance under the Community Reinvestment Act, further described below; and (4) the effectiveness of the companies in combatting money laundering.

Change in Control. Federal law restricts the amount of voting stock of a bank holding company or a bank that a person may acquire without the prior approval of banking regulators. Under the Change in Bank Control Act and the regulations thereunder, a person or group must give advance notice to the Federal Reserve before acquiring control of any bank holding company, such as the Company, and the FDIC before acquiring control of the Bank. Upon receipt of such notice, the bank regulatory agencies may approve or disapprove the acquisition. The Change in Bank Control Act creates a rebuttable presumption of control if a person or group acquires the power to vote 10% or more of our outstanding common stock. The overall effect of such laws is to make it more difficult to acquire a bank holding company and a bank by tender offer or similar means than it might be to acquire control of another type of corporation. Consequently, shareholders of the Company may be less likely to benefit from the rapid increases in stock prices that may result from tender offers or similar efforts to acquire control of other companies. Investors should be aware of these requirements when acquiring shares of our stock.

Governance and Financial Reporting Obligations. We are required to comply with various corporate governance and financial reporting requirements under the Sarbanes-Oxley Act of 2002, as well as rules and regulations adopted by the SEC, the Public Company Accounting Oversight Board, and the New York Stock Exchange. In particular, we are required to include management and independent registered public accounting firm reports on internal controls as part of our Annual Report on Form 10-K in order to comply with Section 404 of the Sarbanes-Oxley Act. We have evaluated our controls, including compliance with the SEC rules on internal controls, and have and expect to continue to spend significant amounts of time and money on compliance with these rules. Our failure to comply with these internal control rules may materially adversely affect our reputation, ability to obtain the necessary certifications to financial statements, and the values of our securities.

Corporate Governance. The Dodd-Frank Act addresses many investor protections, corporate governance, and executive compensation matters that will affect most U.S. publicly traded companies. The Dodd-Frank Act (1) grants shareholders of U.S. publicly traded companies an advisory vote on executive compensation; (2) enhances independence requirements for Compensation Committee members; and (3) requires companies listed on national securities exchanges to adopt incentive-based compensation claw-back policies for executive officers.

Incentive Compensation. The Dodd-Frank Act required the banking agencies and the SEC to establish joint rules or guidelines for financial institutions with more than $1 billion in assets, such as us and the Bank, which prohibit incentive compensation arrangements that the agencies determine to encourage inappropriate risks by the institution. The federal banking agencies issued proposed rules in 2011 and previously issued guidance on sound incentive compensation policies. In 2016, the federal banking agencies also proposed rules that would, depending upon the assets of the institution, directly regulate incentive compensation arrangements and would require enhanced oversight and recordkeeping. As of December 31, 2025, these rules have not been implemented.  We and the Bank have undertaken efforts to ensure that our incentive compensation plans do not encourage inappropriate risks, consistent with three key principles - that incentive compensation arrangements should appropriately balance risk and financial rewards, be compatible with effective controls and risk management, and be supported by strong corporate governance. On October 26, 2022, the SEC adopted final rules to implement Section 954 of the Dodd-Frank Act that require public companies to adopt and disclose a policy for the recovery of incentive-based compensation received by current or former executive officers that is based on erroneously reported financial information in the event of a required accounting restatement. The rules also require disclosure of the policy, including filing the policy as an exhibit to annual reports on Form 10-K and additional disclosure in the event an accounting restatement is required and recovery is triggered under the policy.

Shareholder Say-On-Pay Votes. The Dodd-Frank Act requires public companies to take shareholders’ votes on proposals addressing compensation (known as say-on-pay), the frequency of a say-on-pay vote, and the golden parachutes available to

11

executives in connection with change-in-control transactions. Public companies must give shareholders the opportunity to vote on the compensation at least every three years and the opportunity to vote on frequency at least every six years, indicating whether the say-on-pay vote should be held annually, biennially, or triennially. The say-on-pay, the say-on-parachute and the say-on-frequency votes are explicitly nonbinding and cannot override a decision of our board of directors.

Other Regulatory Matters. We and our subsidiaries are subject to oversight by the SEC, the Financial Industry Regulatory Authority, (“FINRA”), the PCAOB, the New York Stock Exchange and various state securities regulators. We and our subsidiaries have from time to time received requests for information from regulatory authorities in various states, including state attorneys general, securities regulators and other regulatory authorities, concerning our business practices. Such requests are considered incidental to the normal conduct of business.

Capital Requirements. The Company and the Bank are each required under federal law to maintain certain minimum capital levels based on ratios of capital to total assets and capital to risk-weighted assets. The required capital ratios are minimums, and the federal banking agencies may determine that a banking organization, based on its size, complexity or risk profile, must maintain a higher level of capital in order to operate in a safe and sound manner. Risks such as concentration of credit risks and the risk arising from non-traditional activities, as well as the institution’s exposure to a decline in the economic value of its capital due to changes in interest rates, and an institution’s ability to manage those risks are important factors that are to be taken into account in assessing an institution’s overall capital adequacy. The following is a brief description of the relevant provisions of these capital rules and their potential impact on our capital levels.

The Company and the Bank are each subject to the following risk-based capital ratios: a common equity Tier 1 (“CET1”) risk-based capital ratio, a Tier 1 risk-based capital ratio, which includes CET1 and additional Tier 1 capital, and a total risk-based capital ratio, which includes Tier 1 and Tier 2 capital. CET1 is primarily comprised of the sum of common stock instruments and related surplus net of treasury stock, plus retained earnings, and certain qualifying minority interests, less certain adjustments and deductions, including with respect to goodwill, intangible assets, mortgage servicing assets and deferred tax assets subject to temporary timing differences. Additional Tier 1 capital is primarily comprised of noncumulative perpetual preferred stock, tier 1 minority interests and grandfathered trust preferred securities. Tier 2 capital consists of instruments disqualified from Tier 1 capital, including qualifying subordinated debt, other preferred stock and certain hybrid capital instruments, and a limited amount of loan loss reserves up to a maximum of 1.25% of risk-weighted assets, subject to certain eligibility criteria. The capital rules also define the risk-weights assigned to assets and off-balance sheet items to determine the risk-weighted asset components of the risk-based capital rules, including, for example, certain “high volatility” commercial real estate, past due assets, structured securities and equity holdings.

The leverage capital ratio, which serves as a minimum capital standard, is the ratio of Tier 1 capital to quarterly average total consolidated assets net of goodwill, certain other intangible assets, and certain required deduction items. The required minimum leverage ratio for all banks is 4%.

In addition, as of January 1, 2019, the capital rules require a capital conservation buffer of 2.5%, constituted of CET1, above each of the minimum capital ratio requirements (CET1, Tier 1, and total risk-based capital), which is designed to absorb losses during periods of economic stress. These buffer requirements must be met for a bank to be able to pay dividends, engage in share buybacks or make discretionary bonus payments to executive management without restriction.

The Federal Deposit Insurance Corporation Improvement Act of 1991 (“FDICIA”), among other things, requires the federal bank regulatory agencies to take “prompt corrective action” regarding depository institutions that do not meet minimum capital requirements. FDICIA establishes five regulatory capital tiers: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” A depository institution’s capital tier will depend upon how its capital levels compare to various relevant capital measures and certain other factors, as established by regulation. FDICIA generally prohibits a depository institution from making any capital distribution (including payment of a dividend) or paying any management fee to its holding company if the depository institution would thereafter be undercapitalized. The FDICIA imposes progressively more restrictive restraints on operations, management and capital distributions, depending on the category in which an institution is classified.

To be well-capitalized, the Bank must maintain at least the following capital ratios:

•6.5% CET1 to risk-weighted assets;

•8.0% Tier 1 capital to risk-weighted assets;

•10.0% Total capital to risk-weighted assets; and

•5.0% Leverage ratio.

12

Failure to be well-capitalized or to meet minimum capital requirements could result in certain mandatory and possible additional discretionary actions by regulators that, if undertaken, could have an adverse material effect on our operations or financial condition. For example, only a well-capitalized depository institution may accept brokered deposits without prior regulatory approval. Failure to be well-capitalized or to meet minimum capital requirements could also result in restrictions on the Bank’s ability to pay dividends or otherwise distribute capital or to receive regulatory approval of applications or other restrictions on its growth.

The Federal Reserve has not yet revised the well-capitalized standard for bank holding companies to reflect the higher capital requirements imposed under the current capital rules. For purposes of the FRB's Regulation Y, including determining whether a bank holding company meets the requirements to be a financial holding company, bank holding companies, such as the Company, must maintain a Tier 1 risk-based capital ratio of 6.0% or greater and a total risk-based capital ratio of 10% or greater to be well-capitalized.

The Company is required to comply with minimum regulatory capital levels due to surpassing the $3 billion asset threshold in 2023. The Economic Growth, Regulatory Relief, and Consumer Protection Act (the “Economic Growth Act”) signed into law in May 2018 scaled back certain requirements of the Dodd-Frank Act and provided other regulatory relief. Among the provisions of the Economic Growth Act was a requirement that the Federal Reserve raise the asset threshold for those bank holding companies subject to the Federal Reserve’s Small Bank Holding Company Policy Statement (“Policy Statement”) to $3 billion. As a result, as of the effective date of that change in 2018, the Company was no longer required to comply with the risk-based capital rules applicable to the Bank as described above from 2018 until June 2023 when its assets passed the $3 billion asset threshold.

As of December 31, 2025, the Company's and the Bank's regulatory capital ratios were above the applicable well-capitalized standards and met the then-applicable capital conservation buffer.

As a result of the Economic Growth Act, the federal banking agencies were also required to develop a “Community Bank Leverage Ratio” (the ratio of a bank’s Tier 1 capital to average total consolidated assets) for financial institutions with assets of less than $10 billion. A “qualifying community bank” that exceeds this ratio will be deemed to be in compliance with all other capital and leverage requirements, including the capital requirements to be considered “well capitalized” under prompt corrective action statutes. The federal banking agencies may consider a financial institution's risk profile when evaluating whether it qualifies as a community bank for purposes of the capital ratio requirement. The federal banking agencies set the minimum capital for the new Community Bank Leverage Ratio at 9%. The Bank has not opted into the Community Bank Leverage Ratio Framework.

Payment of Dividends. We are a legal entity separate and distinct from the Bank and our other subsidiaries. Our primary source of cash, other than securities offerings, is dividends from the Bank. Under the laws of the State of Georgia, we, as a business corporation, may declare and pay dividends in cash or property unless the payment or declaration would be contrary to restrictions contained in our Articles of Incorporation, as amended, or unless, after payment of the dividend, we would not be able to pay our debts when they become due in the usual course of our business or our total assets would be less than the sum of our total liabilities. In addition, we are also subject to federal regulatory capital requirements that effectively limit the amount of cash dividends that we may pay.

The primary sources of funds for our payment of dividends to our shareholders are cash on hand and dividends from the Bank and our non-bank subsidiaries. Various federal and state statutory provisions and regulations limit the amount of dividends that the Bank and our non-bank subsidiaries may pay. The Bank is a Georgia bank. Under the regulations of the Georgia Department of Banking and Finance ("GA DBF"), a Georgia bank must have approval of the GA DBF to pay cash dividends if, at the time of such payment:

•the ratio of Tier 1 capital to average total assets is less than 6%;

•the aggregate amount of dividends to be declared or anticipated to be declared during the current calendar year exceeds 50% of its net after-tax profits before dividends for the previous calendar year; or

•its total adversely classified assets in its most recent regulatory examination exceeded 80% of its Tier 1 capital plus its allowance for loan and lease losses.

The Georgia Financial Institutions Code contains restrictions on the ability of a Georgia bank to pay dividends other than from retained earnings without the approval of the GA DBF. As a result of the foregoing restrictions, the Bank may be required to seek approval from the GA DBF to pay dividends.

13

In addition, we and the Bank are subject to various general regulatory policies and requirements relating to the payment of dividends, including requirements to maintain adequate capital above regulatory minimums. The appropriate federal bank regulatory authority may prohibit the payment of dividends where it has determined that the payment of dividends would be an unsafe or unsound practice and to prohibit payment thereof. The FDIC and the Federal Reserve have indicated that paying dividends that deplete a bank’s capital base to an inadequate level would be an unsound and unsafe banking practice. The FDIC and the Federal Reserve have each indicated that depository institutions and their holding companies should generally pay dividends only out of current operating earnings. Prior approval by the FDIC is required if the total of all dividends declared by a bank in any calendar year exceeds the bank’s profits for that year combined with its retained net profits for the preceding two calendar years.

Under a Federal Reserve policy adopted in 2009, the board of directors of a bank holding company must consider different factors to ensure that its dividend level is prudent relative to maintaining a strong financial position, and is not based on overly optimistic earnings scenarios, such as potential events that could affect its ability to pay, while still maintaining a strong financial position. As a general matter, the Federal Reserve has indicated that the board of directors of a bank holding company should consult with the Federal Reserve and eliminate, defer or significantly reduce the bank holding company’s dividends if:

•its net income available to shareholders for the past four quarters, net of dividends previously paid during that period, is not sufficient to fully fund the dividends;

•its prospective rate of earnings retention is not consistent with its capital needs and overall current and prospective financial condition; or

•it will not meet, or is in danger of not meeting, its minimum regulatory capital adequacy ratios.

Regulation of the Bank

The Bank is subject to comprehensive supervision and regulation by the FDIC and is subject to its regulatory reporting requirements. The Bank also is subject to certain Federal Reserve regulations. In addition, as discussed in more detail below, the Bank and any other of our subsidiaries that offer consumer financial products and services are subject to regulation and potential supervision by the Consumer Financial Protection Bureau ("CFPB"). Authority to supervise and examine the Company and the Bank for compliance with federal consumer laws remains largely with the Federal Reserve and the FDIC, respectively. However, the CFPB may participate in examinations on a “sampling basis” and may refer potential enforcement actions against such institutions to their primary regulators. The CFPB also may participate in examinations of our other direct or indirect subsidiaries that offer consumer financial products or services. In addition, the Dodd-Frank Act permits states to adopt consumer protection laws and regulations that are stricter than those regulations promulgated by the CFPB, and state attorneys general are permitted to enforce certain federal consumer financial protection rules adopted by the CFPB.

Broadly, regulations applicable to the Bank include limitations on loans to a single borrower and to its directors, officers and employees; restrictions on the opening and closing of branch offices; the maintenance of required capital and liquidity ratios; the granting of credit under equal and fair conditions; the disclosure of the costs and terms of such credit; requirements to maintain reserves against deposits and loans; limitations on the types of investment that may be made by the Bank; and requirements governing risk management practices. The Bank is permitted under federal law to branch on a de novo basis across state lines where the laws of that state would permit a bank chartered by that state to open a de novo branch.

Transactions with Affiliates and Insiders. The Bank is subject to restrictions on extensions of credit and certain other transactions between the Bank and the Company or any nonbank affiliate. Generally, these covered transactions with either the Company or any affiliate are limited to 10% of the Bank’s capital and surplus, and all such transactions between the Bank and the Company and all of its nonbank affiliates combined are limited to 20% of the Bank’s capital and surplus. Loans and other extensions of credit from the Bank to the Company or any affiliate generally are required to be secured by eligible collateral in specified amounts. In addition, any transaction between the Bank and the Company or any affiliate are required to be on an arm’s length basis. Federal banking laws also place similar restrictions on certain extensions of credit by insured banks, such as the Bank, to their directors, executive officers and principal shareholders.

Reserves. Federal Reserve rules require depository institutions, such as the Bank, to maintain reserves against their transaction accounts, primarily interest bearing and non-interest bearing checking accounts. Effective March 26, 2020, reserve requirement ratios were reduced to zero percent. These reserve requirements are subject to annual adjustment by the Federal Reserve. At December 31, 2025, the reserve requirement ratio remains at zero percent.

FDIC Insurance Assessments and Depositor Preference. The Bank’s deposits are insured by the FDIC’s DIF up to the limits under applicable law, which currently are set at $250,000 per depositor, per insured bank, for each account ownership category. The Bank is subject to FDIC assessments for its deposit insurance. The FDIC calculates quarterly deposit insurance assessments

14

based on an institution’s average total consolidated assets less its average tangible equity, and applies one of four risk categories determined by reference to its capital levels, supervisory ratings, and certain other factors. The assessment rate schedule can change from time to time, at the discretion of the FDIC, subject to certain limits.

As of September 30, 2025, the DIF reserve ratio reached 1.40%, exceeding the statutory minimum of 1.35%. The FDIC, as required under the Federal Deposit Insurance Act, established a plan on September 15, 2020 to restore the DIF reserve ratio to meet or exceed the statutory minimum of 1.35% within eight years. On October 18, 2022, the FDIC adopted a final plan and increased the initial base deposit insurance assessment rate schedules uniformly by 2 basis points, beginning in the first quarterly assessment period of 2023. The FDIC could further increase the deposit insurance assessments for certain insured depository institutions, including the Bank, if the DIF reserve ratio is not maintained.

Insurance of deposits may be terminated by the FDIC upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by a bank’s federal regulatory agency. In addition, the Federal Deposit Insurance Act provides that, in the event of the liquidation or other resolution of an insured depository institution, the claims of depositors of the institution, including the claims of the FDIC as subrogee of insured depositors, and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution, including those of the parent bank holding company.

Standards for Safety and Soundness. The Federal Deposit Insurance Act requires the federal bank regulatory agencies to prescribe, by regulation or guideline, operational and managerial standards for all insured depository institutions relating to: (1) internal controls; (2) information systems and audit systems; (3) loan documentation; (4) credit underwriting; (5) interest rate risk exposure; and (6) asset quality.

The federal banking agencies have adopted regulations and Interagency Guidelines Establishing Standards for Safety and Soundness to implement these required standards. These guidelines set forth the safety and soundness standards used to identify and address problems at insured depository institutions before capital becomes impaired. Under the regulations, if a regulator determines that a bank fails to meet any standards prescribed by the guidelines, the regulator may require the bank to submit an acceptable plan to achieve compliance, consistent with deadlines for the submission and review of such safety and soundness compliance plans.

Anti-Money Laundering.  A continued focus of governmental policy relating to financial institutions in recent years has been combating money laundering and terrorist financing. The USA PATRIOT Act broadened the application of anti-money laundering regulations to apply to additional types of financial institutions such as broker-dealers, investment advisors and insurance companies, and strengthened the ability of the U.S. Government to help prevent, detect and prosecute international money laundering and the financing of terrorism. The principal provisions of Title III of the USA PATRIOT Act require that regulated financial institutions, including state member banks: (i) establish an anti-money laundering program that includes training and audit components; (ii) comply with regulations regarding the verification of the identity of any person seeking to open an account; (iii) take additional required precautions with non-U.S. owned accounts; and (iv) perform certain verification and certification of money laundering risk for their foreign correspondent banking relationships. Failure of a financial institution to comply with the USA PATRIOT Act’s requirements could have serious legal and reputational consequences for the institution. The Bank has augmented its systems and procedures to meet the requirements of these regulations and will continue to revise and update its policies, procedures and controls to reflect changes required by law.

FinCEN has adopted rules that require financial institutions to obtain beneficial ownership information with respect to legal entities with which such institutions conduct business, subject to certain exclusions and exemptions. Bank regulators are focusing their examinations on anti-money laundering compliance, and we continue to monitor and augment, where necessary, our anti-money laundering compliance programs.

Banking regulators will consider compliance with the Act’s money laundering provisions in acting upon acquisition and merger proposals. Bank regulators routinely examine institutions for compliance with these obligations and have been active in imposing cease and desist and other regulatory orders and money penalty sanctions against institutions found to be violating these obligations. Sanctions for violations of the Act can be imposed in an amount equal to twice the sum involved in the violating transaction, up to $1 million. On January 1, 2021, Congress passed federal legislation that made sweeping changes to federal anti-money laundering laws, including changes that will be implemented in 2021 and subsequent years. In 2024, U.S. federal regulators proposed amendments to modernize Anti-Money Laundering (AML) and Countering the Financing of Terrorism (CFT) program requirements. Aligned with the Anti-Money Laundering Act of 2020, the rules mandate a risk-based approach requiring institutions to identify, evaluate, and document risks based on business activities and national priorities.

15

Economic Sanctions. The Office of Foreign Assets Control (“OFAC”) is responsible for helping to ensure that U.S. entities do not engage in transactions with certain prohibited parties, as defined by various Executive Orders and acts of Congress. OFAC publishes, and routinely updates, lists of names of persons and organizations suspected of aiding, harboring or engaging in terrorist acts, including the Specially Designated Nationals and Blocked Persons List. If we find a name on any transaction, account or wire transfer that is on an OFAC list, we must undertake certain specified activities, which could include blocking or freezing the account or transaction requested, and we must notify the appropriate authorities.

Concentrations in Lending. During 2006, the federal bank regulatory agencies released guidance on "Concentrations in Commercial Real Estate Lending" and advised financial institutions of the risks posed by commercial real estate ("CRE") lending concentrations. The guidance requires that appropriate processes be in place to identify, monitor and control risks associated with real estate lending concentrations. Under the new guidance, a financial institution will be considered to have a significant commercial real estate ("CRE") concentration risk, and will be subject to enhanced supervisory expectations to manage that risk, if:

•total reported loans for construction, land & land development represent 100% or more of a bank’s tier 1 capital plus the allowance for credit losses for loans; or

•total reported loans for construction, land & land development plus non-owner occupied CRE represent 300% or more of a bank's tier 1 capital plus the allowance for credit losses for loans and the outstanding balance of the bank's CRE loan portfolio has increased by 50% or more during the prior 36 months.

As of December 31, 2025, the Company's construction, land & land development concentration as a percentage of capital totaled 79.7% and our CRE concentration, net of owner occupied loans, as a percentage of capital totaled 282.5%. As of December 31, 2025, both percentages were below the established regulatory guidelines.

We have always had exposures to loans secured by commercial real estate due to the nature of our markets and the loan needs of both retail and commercial customers. We believe our long term experience in CRE lending, underwriting policies, internal controls, and other policies currently in place, as well as our loan and credit monitoring and administration procedures, which include calculation of the above two ratios, are generally appropriate to managing our concentrations as required under the guidance.

Community Reinvestment Act. The Bank is subject to the provisions of the Community Reinvestment Act (“CRA”), which imposes a continuing and affirmative obligation, consistent with their safe and sound operation, to help meet the credit needs of entire communities where the bank accepts deposits, including low- and moderate-income neighborhoods. The FDIC’s assessment of the Bank’s CRA record is made available to the public. Further, a less than satisfactory CRA rating will slow, if not preclude, expansion of banking activities and prevent a company from becoming or remaining a financial holding company. Following the enactment of the Gramm-Leach-Bliley Act (“GLB”), CRA agreements with private parties must be disclosed and annual CRA reports must be made to a bank’s primary federal regulator. A bank holding company will not be permitted to become or remain a financial holding company and no new activities authorized under GLB may be commenced by a holding company or by a bank financial subsidiary if any of its bank subsidiaries received less than a “satisfactory” CRA rating in its latest CRA examination. Federal CRA regulations require, among other things, that evidence of discrimination against applicants on a prohibited basis, and illegal or abusive lending practices be considered in the CRA evaluation. The Bank has a rating of “Satisfactory” in its most recent CRA evaluation.

In 2023, the Federal Reserve, OCC, and FDIC issued a final rule to modernize their respective CRA regulations. The revised rules would substantially alter the methodology for assessing compliance with the CRA, with material aspects taking effect January 1, 2026 and revised data reporting requirements taking effect January 1, 2027. The revised CRA regulations have been subject to an injunction since March 29, 2024. On July 16, 2025, the Federal Reserve, OCC, and FDIC issued a joint proposal to rescind the 2023 modernization rule. The agencies continue to apply the CRA rules as they existed before the 2023 modernization, considering the injunction and pending finalization of the recission of the modernization rule.

Privacy and Data Security. The GLB generally prohibits disclosure of consumer information to non-affiliated third parties unless the consumer has been given the opportunity to object and has not objected to such disclosure. Financial institutions are further required to disclose their privacy policies to customers annually. Financial institutions, however, will be required to comply with state law if it is more protective of consumer privacy than the GLB. The GLB also directed federal regulators, including the FDIC, to prescribe standards for the security of consumer information. The Bank is subject to such standards, as well as standards for notifying customers in the event of a security breach. Under federal law, the Bank must disclose its privacy policy to consumers, permit customers to opt out of having nonpublic customer information disclosed to third parties in certain circumstances and allow customers to opt out of receiving marketing solicitations based on information about the customer received from another subsidiary. States may adopt more extensive privacy protections. We are similarly required to

16

have an information security program to safeguard the confidentiality and security of customer information and to ensure proper disposal. Customers must be notified when unauthorized disclosure involves sensitive customer information that may be misused. The federal banking agencies require banks to notify their regulators within 36 hours of a “computer-security incident” that rises to the level of a “notification incident.”

Consumer Regulation. Activities of the Bank are subject to a variety of statutes and regulations designed to protect consumers. These laws and regulations include, among numerous other things, provisions that:

•limit the interest and other charges collected or contracted for by the Bank, including new rules respecting the terms of credit cards and of debit card overdrafts;

•govern the Bank’s disclosures of credit terms to consumer borrowers;

•require the Bank to provide information to enable the public and public officials to determine whether it is fulfilling its obligation to help meet the housing needs of the community it serves;

•prohibit the Bank from discriminating on the basis of race, creed or other prohibited factors when it makes decisions to extend credit;

•govern the manner in which the Bank may collect consumer debts; and

•prohibit unfair, deceptive or abusive acts or practices in the provision of consumer financial products and services.

Mortgage Regulation. The CFPB adopted a rule that implements the ability-to-repay and qualified mortgage provisions of the Dodd-Frank Act (the “ATR/QM rule”), which requires lenders to consider, among other things, income, employment status, assets, payment amounts, and credit history before approving a mortgage, and provides a compliance “safe harbor” for lenders that issue certain “qualified mortgages.” The ATR/QM rule defines a “qualified mortgage” to have certain specified characteristics, and generally prohibit loans with negative amortization, interest-only payments, balloon payments, or terms exceeding 30 years from being qualified mortgages. The rule also establishes general underwriting criteria for qualified mortgages, including that monthly payments be calculated based on the highest payment that will apply in the first five years of the loan and that the borrower have a total debt-to-income ratio that is less than or equal to 43%. While “qualified mortgages” will generally be afforded safe harbor status, a rebuttable presumption of compliance with the ability-to-repay requirements will attach to “qualified mortgages” that are “higher priced mortgages” (which are generally subprime loans). In addition, the securitizer of asset-backed securities must retain not less than 5% of the credit risk of the assets collateralizing the asset-backed securities, unless subject to an exemption for asset-backed securities that are collateralized exclusively by residential mortgages that qualify as “qualified residential mortgages.”

The CFPB has also issued rules to implement requirements of the Dodd-Frank Act pertaining to mortgage loan origination (including with respect to loan originator compensation and loan originator qualifications) as well as integrated mortgage disclosure rules. In addition, the CFPB has issued rules that require servicers to comply with new standards and practices with regard to: error correction; information disclosure; force-placement of insurance; information management policies and procedures; requiring information about mortgage loss mitigation options be provided to delinquent borrowers; providing delinquent borrowers access to servicer personnel with continuity of contact about the borrower’s mortgage loan account; and evaluating borrowers’ applications for available loss mitigation options. These rules also address initial rate adjustment notices for adjustable-rate mortgages (ARMs), periodic statements for residential mortgage loans, and prompt crediting of mortgage payments and response to requests for payoff amounts.

Non-Discrimination Policies. The Bank is also subject to, among other things, the provisions of the Equal Credit Opportunity Act (the “ECOA”) and the Fair Housing Act (the “FHA”), both of which prohibit discrimination based on race or color, religion, national origin, sex, and familial status in any aspect of a consumer or commercial credit or residential real estate transaction. The Department of Justice (the “DOJ”), and the federal bank regulatory agencies have issued an Interagency Policy Statement on Discrimination in Lending that provides guidance to financial institutions in determining whether discrimination exists, how the agencies will respond to lending discrimination, and what steps lenders might take to prevent discriminatory lending practices. The DOJ has increased its efforts to prosecute what it regards as violations of the ECOA and FHA.