Capital Bancorp Inc (CBNK) Business

ITEM 1. BUSINESS

We are Capital Bancorp, Inc., a bank holding company and a Maryland corporation incorporated in 1998, operating primarily through our wholly-owned subsidiary, Capital Bank, N.A., a commercial-focused community bank based in the Washington, D.C. and Baltimore metropolitan areas. The Bank is headquartered in Rockville, Maryland, received its charter in 1999 and began operations the same year. We serve businesses, not-for-profit associations, entrepreneurs and others throughout the Washington, D.C., Baltimore, other Maryland markets, Delaware, Florida, Illinois, and North Carolina through seven commercial bank branches, one mortgage banking office, three loan production offices, three government loan servicing offices, and one credit card operations office.

On October 1, 2024, the Company completed its acquisition of IFH. At the effective time of the merger, IFH merged with and into the Company, with the Company continuing as the surviving corporation in the acquisition. Immediately following the acquisition, West Town Bank & Trust, merged with and into Capital Bank, with Capital Bank as the surviving bank. Windsor Advantage™, a wholly owned subsidiary of the Company, was acquired in connection with the IFH acquisition.

The Company currently operates four divisions and reporting segments: Commercial Banking, OpenSky™, Windsor Advantage™, and Capital Bank Home Loans (“CBHL”). In determining the appropriateness of segment definition, the Company considers components of the business about which financial information is available and regularly evaluated relative to resource allocation and performance assessment. The accompanying consolidated financial statements have been prepared in accordance with GAAP, and conform to general practices within the banking industry.

Our Commercial Banking division primarily operates within a corridor extending from Raleigh, North Carolina to Delaware, with significant activity in the Washington, D.C. and Baltimore metropolitan statistical areas. The Commercial Bank also maintains offices in Chicago, Illinois and Fort Lauderdale, Florida. In addition to providing relationship-driven banking services within its primary geographic markets, the Commercial Bank conducts certain lending and deposit activities on a nationwide basis through specialized verticals. These lending verticals include lender finance, government guaranteed lending and other forms of commercial and industrial (“C&I”) lending. The Commercial Bank also operates national deposit verticals serving homeowners associations (“HOAs”), title companies, political action committees (“PACs”), not-for-profit organizations, and other commercial clients.

OpenSky™ and CBHL both leverage Capital Bank’s national banking charter to operate national consumer business lines. OpenSky™ provides nationwide, digitally-originated and served, secured, partially-secured, and unsecured credit cards to under-banked populations and those looking to rebuild their credit scores. CBHL acts as our residential mortgage origination platform. Windsor Advantage™ generates fee revenue for the Company through its servicing, processing and packaging of SBA and USDA loans for its financial institution clients.

In addition to its subsidiaries discussed above, Capital Bancorp, Inc. owns all of the stock of Capital Bancorp (MD) Statutory Trust I (the “Trust”). The Trust is a special purpose, non-consolidated entity organized for the sole purpose of issuing trust preferred securities.

Commercial Banking Division

The Commercial Banking division operates out of seven full service banking locations, three of which are in the Washington, D.C. Metropolitan Statistical Area (“MSA”), and its full service banking locations in Columbia, Maryland in the Baltimore, Maryland MSA, in Ft. Lauderdale, Florida in the Miami Metro Area MSA, in Chicago, Illinois in the Chicago MSA, and in Raleigh, North Carolina in the Raleigh MSA. Additionally, we have three loan production offices, one located in the Washington, D.C. area, one in Columbia, Maryland, and one in Towson, Maryland. Our Commercial Banking division’s commercial loan officers and commercial real estate loan officers provide C&I, commercial real estate, including lender finance loans, and construction lending solutions to business clients in Capital Bank’s operating markets.

Government guaranteed lending serves customers throughout the country in need of, and qualifying for, USDA and SBA loans. We generally sell the government guaranteed portion of USDA and SBA loans into the secondary market while retaining the non-guaranteed portion of the loan and the servicing rights. This allows us to realize one time gain on sale income along with a recurring servicing and interest revenue stream. In addition to the business development officers upon whom we rely to generate new business, we also have a dedicated servicing, portfolio management and workout staff with specialized expertise in U.S. government guaranteed loans.

Construction lending is a core competency of our Commercial Banking division. Our construction loan portfolio provides Capital Bank with short duration, higher yield loans. Our construction lending is focused on commercial and residential construction projects within the Washington, D.C. and Baltimore-Columbia-Towson, Maryland metropolitan operating areas, with limited exposure to suburban subdivision tract development.

Lender finance loans are loans to companies used to purchase finance receivables or extend finance receivables to the underlying obligors and are secured primarily by the finance receivables held by our borrowers.

In addition to its loan officers, who have incentives and goals to drive core deposit growth, our Commercial Banking division currently has a team of business development officers concentrating on continuing to diversify and grow Capital Bank’s core deposit funding and lessen the dependency on wholesale funding. These officers seek to grow deposits generally across the commercial client customer base and through several specialized deposit channels serving multiple sectors nationwide including the homeowner’s association sector, the title insurance sector, political action committees and not-for-profits.

Capital Bank Home Loans Division

Capital Bank Home Loans (“CBHL”) originates conventional and government guaranteed residential mortgage loans on a nationwide basis primarily for sale into the secondary market and, in certain circumstances, for our loan portfolio. Loans sold into the secondary market are sold servicing released. Our residential loan portfolio aims to retain high-quality, lower risk loans which support the Company’s business strategies. A portion of the retained residential portfolio is represented by mortgage loans on primary residences within Capital Bank’s operating markets to individuals who own businesses where Capital Bank may also pursue a commercial lending relationship and has a vested interest in maintaining the fullest possible banking relationship.

Approximately 78.5% of CBHL loan originations by volume occur within Maryland, Virginia, Delaware and Washington, D.C. The remainder of originations are national in scope and originate primarily through a direct-to-consumer model that utilizes consumer marketing and social media applications.

OpenSky™ Secured Credit Card Division

The OpenSky™ Division provides secured, partially secured and unsecured credit cards on a nationwide basis.

The secured credit cards require a minimum initial deposit of $100 and permit maximum initial deposits of $3,000 per card and $10,000 per individual. OpenSky™ focuses on under-banked populations and those looking to rebuild their credit scores. In order to obtain a secured credit card from us, the customer must select a credit line amount that the customer secures with a matching deposit amount. A deposit equal to the full credit limit of the card is made into a noninterest-bearing demand account with the Bank. Once the account is opened, the deposit is required to be maintained throughout the life of the card. The customer’s funding of the deposit account is collateral and while it is not a consideration in the credit card approval process, it is a prerequisite to activating the credit line. Once the customer’s deposit account has been funded, the credit line is activated and the collateral funds are generally available to absorb potential losses on the account that may occur. Given the secured nature of the cards, credit history inquiries are not required at the time of application.

The partially secured credit card uses our proprietary scoring model, which considers among other things, credit score and repayment history (typically a minimum of six months of on-time repayments, but ultimately determined on a case-by-case basis), to offer certain existing customers an unsecured line supplementary to their secured line of credit. As each customer’s secured account ages, we obtain credit scores to baseline the customer’s improvement as an input into any decision to extend unsecured credit.

The unsecured credit card was added, for qualifying existing customers, in the fourth quarter of 2021 to expand the OpenSky™ product offering. The addition of the unsecured card allows for an uninterrupted experience for OpenSky™ customers who can now more easily transition from a secured to unsecured credit card and continue their relationship with the Bank. At December 31, 2025, 31% of our credit card customers had a FICO score in excess of 660 and were considered prime and 33% of outstanding credit card balances were unsecured.

OpenSky™ cards operate on a digital and mobile enabled platform with almost all marketing and application procedures being conducted through website and mobile applications. OpenSky™ credit cards have variable interest rates, which are beneficial to us in a rising rate environment. We believe the OpenSky™ secured credit card product may provide a counter-cyclical benefit as more people may enter our target segment of credit rebuilders during an economic downturn. Credit card eligibility for all product offerings is based on identity and income verification.

Capital Bank uses data analytics, including AI and proprietary models, throughout the OpenSky™ customer lifecycle to support fraud prevention and credit decisioning. During onboarding, these tools are used to help validate identity, verify eligibility and income, and inform which customers may receive offers for additional credit. After account opening, credit card transactions are evaluated in real-time to help assess transaction legitimacy and detect potentially fraudulent activity. The Bank also uses portfolio monitoring and behavioral models to provide management with insight into credit trends, identify emerging risk, mitigate potential losses, and inform actions intended to optimize account profitability over the life of the relationship.

Windsor Advantage™ Division

Windsor Advantage™ is a loan service provider that offers community banks and credit unions a comprehensive outsourced SBA and USDA lending platform. Windsor Advantage™ generates fee income for the Company through its servicing, processing and packaging of such loans for its financial institution clients, including Capital Bank. Gross government loan servicing revenue totaled $19.6 million, including $4.1 million of Capital Bank related servicing fees, for the year ended December 31, 2025. Windsor

Advantage's™ total servicing portfolio was $3.1 billion, including $1.3 billion attributable to Capital Bank at December 31, 2025.

Our Business Strategy

We believe that by using technology-enabled strategies and advice-based solutions, we can deliver attractive shareholder returns in excess of our cost of capital. While regulations, technology and competition have fundamentally impacted the economics of the banking sector, we continue to adopt strategies that we believe will drive growth while maintaining consistent profitability and enhancing shareholder value, including:

Deliver premium advice-based solutions that drive organic loan and core deposit growth with corresponding net interest income and fee revenues

•Serve as financial partners to our customers, helping them to grow their businesses through advice-based financial solutions;

•Endeavor to provide comprehensive loan and deposit solutions to our customers that are tailored to their needs, and leverage data, analytics and financial technology to improve the customer experience;

•Scale our consumer fee-based platforms by investing in fintech and other capabilities, while leveraging digital marketing to deliver high impact products and services and differentiated customer experience;

•Grow new loan and deposit verticals and products where we have a competitive advantage;

•Capitalize on market dislocation from recent in-market acquisitions to attract top sales talent, and acquire new commercial banking relationships from local competitors; and

•Selectively add banking centers where sales teams have already proved an ability to capture market share and leverage customer relationships.

Leverage technology to improve the customer experience and loyalty and deliver operational efficiencies

•Use solution structuring and customized technology implementation as differentiators to add value to clients with complex needs and enhance our relationships within our existing customer base;

•Deploy technologies that better support our lending associates and simplify our processes;

•Maximize the potential of web-based and mobile banking applications to drive core funding while maintaining our branch-lite business model; and

•Enhance cross-selling capabilities among our OpenSky™, Capital Bank Home Loans and Commercial Banking division customers.

Increase scale in our fee-based platforms through delivery of high value products and services

•Utilize our customer acquisition capabilities, and leverage our investment in our core processing systems, together with our expertise in data, analytics and marketing, to deliver new products and services and grow our secured credit card business;

•Retain OpenSky™ customers that “graduate” from our secured credit product through the limited use of partially and fully unsecured credit products;

•Expand our purchase-oriented mortgage loan sales both in-market and in adjacent markets through the hiring of qualified mortgage originators and continue to enhance our direct to consumer marketing channels; and

•Utilize the systems, processes and technology within Windsor Advantage™ to participate in the processing and packaging of SBA and USDA loans originated by our financial institution clients and to grow associated servicing balances.

Pursue acquisitions opportunistically

•Seek strategic acquisitions that complement or supplement our existing product offerings and geographic footprint, advance our business strategies and diversify our revenue and balance sheet mix;

•Evaluate specialty finance and non-bank financial company opportunities where we can add value through increasing interest and fee income and leveraging our management’s expertise and existing strategic assets; and

•Use our management’s and Board’s expertise to structure transactions in ways that minimize the integration and execution risk for the Bank.

Sustainability

We aspire to be the most valued and trusted community bank within the markets we serve. We understand our obligation to both our shareholders and the communities we serve -- to be an institution that achieves superior financial performance, while contributing to the communities we serve by delivering products and services to our customers that enhance and strengthen access, equity and opportunity.

We focus our sustainability efforts on issues that are important to our business and to our key stakeholders. Our mission is to support businesses, help people and strengthen communities, as well as to grow our operations and revenue. Essential to this mission is our commitment to provide long-term, financial and social value to our stakeholders, including the communities we serve, our shareholders and our employees.

Employees and Human Capital Resources

At December 31, 2025, we employed 459 persons, of which 434 were employed on a full-time basis. None of our employees are represented by any collective bargaining unit or are a party to a collective bargaining agreement. We believe the relationship with our employees to be excellent and we have been named a Best Bank to Work For by American Banker for six of the past seven years. Our ability to attract and retain employees is a key pillar of our success. We believe we offer a competitive total compensation and benefits program and a congenial work environment to our employees.

The Company prides itself on being a values-driven organization, where employees are empowered to share ideas that keep the organization moving forward. Our company core values guide each team member to:

•Act as an Owner

•Practice Balanced Risk Management

•Challenge the Norm

•Leverage the Team

We believe that these values enable our success with our customers and have helped us build a fun, vibrant and accountability driven culture. In addition, we are committed to developing our staff through internal/external training programs, including the use of online training resources and by affording all levels of leadership within the organization an opportunity to participate in leadership development programs.

Available Information

The Company provides access to its SEC filings through its website at www.capitalbankmd.com. After accessing the website, the filings are available upon selecting “Investor Relations.” Reports available include the Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and all amendments to those reports as soon as reasonably practicable after the reports are electronically filed with or furnished to the SEC. Further, the SEC maintains an internet site that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC at www.sec.gov. The information on, or accessible through, our website or any other website cited in this Annual Report on Form 10-K is not part of, or incorporated by reference into, this Annual Report on Form 10-K and should not be relied upon in determining whether to make an investment decision.

SUPERVISION AND REGULATION

General

We are extensively regulated under both federal and state law. These laws restrict permissible activities and investments and require compliance with various consumer protection provisions applicable to lending, deposit, brokerage and fiduciary activities. They also impose capital adequacy requirements and conditions on a bank holding company’s (“BHC”) ability to repurchase stock or to receive dividends from its subsidiary banks. We are subject to examination and supervision by the Board of Governors of the Federal Reserve (“Federal Reserve”), and the Bank is subject to comprehensive examination and supervision by the Office of the Comptroller of the Currency (“OCC”). We are required to file with the Federal Reserve quarterly and annual reports and such additional information as the Federal Reserve may require pursuant to the Bank Holding Company Act of 1956 (“BHC Act”). The Federal Reserve may conduct examinations of BHCs and their subsidiaries. The Bank’s deposits are insured by the FDIC, through the Deposit Insurance Fund (“DIF”). As a result of this deposit insurance function, the FDIC also has certain supervisory authority and powers over the Bank as well as all other FDIC insured institutions. The Company’s and the Bank’s regulators generally have broad discretion to impose restrictions and limitations on our operations. Bank regulation is intended to protect depositors and consumers and not shareholders. This supervisory framework could materially and adversely impact the conduct and profitability of our activities.

To the extent that the following information describes statutory and regulatory provisions, it is qualified in its entirety by reference to the text of the applicable statutory and regulatory provisions. Legislative and regulatory initiatives, which necessarily impact the regulation of the financial services industry, are introduced from time to time. We cannot predict whether or when potential legislation or new regulations will be enacted, and if enacted, the effect that new legislation or any implemented regulations and supervisory policies would have on our financial condition and results of operations. The Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), by way of example, contains a comprehensive set of provisions designed to govern the practices and oversight of financial institutions and other participants in the financial markets. The Dodd-Frank Act made extensive changes in the regulation of financial institutions and their holding companies. Some of the changes brought about by the Dodd-Frank Act were modified by the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 (the “Regulatory Relief Act”), signed into law on May 24, 2018. The Dodd-Frank Act has increased the regulatory burden and compliance costs borne by the Company. The Dodd-Frank Act also modified the standard by which state consumer financial laws may be applied to national banking associations, such as the Bank. The application of that standard by state regulators and the courts may

cause the Bank’s compliance burden and costs to increase. Moreover, bank regulatory agencies appear to be increasingly aggressive in responding to concerns and trends identified in examinations, which could result in higher frequency initiation of enforcement actions against financial institutions to address credit quality, liquidity, risk management and capital adequacy, as well as other safety and soundness concerns.

Regulation of Capital Bancorp, Inc.

We are registered as a BHC under the BHC Act and are subject to regulation and supervision by the Federal Reserve. The BHC Act requires us to secure the prior approval of the Federal Reserve before we own or control, directly or indirectly, more than 5% of the voting shares or substantially all of the assets of any bank or thrift, or merge or consolidate with another bank or thrift holding company. Further, under the BHC Act, our activities and those of any nonbank subsidiary are limited to: (i) those activities that the Federal Reserve determines to be so closely related to banking as to be a proper incident thereto, and (ii) investments in companies not engaged in activities closely related to banking, subject to quantitative limitations on the value of such investments. Prior approval of the Federal Reserve may be required before engaging in certain activities. In making such determinations, the Federal Reserve is required to weigh the expected benefits to the public, such as greater convenience, increased competition and gains in efficiency, against the possible adverse effects, such as undue concentration of resources, decreased or unfair competition, conflicts of interest and unsound banking practices.

Regulation of Capital Bank

The operations and investments of our Bank are subject to the supervision, examination and reporting requirements of the National Bank Act and the regulations of the OCC as well as other federal banking statutes and regulations, including with respect to the level of reserves that our Bank must maintain against deposits, restrictions on the types, amount, and terms and conditions of loans it may originate, and limits on the types of other activities in which our Bank may engage and the investments that it may make. The OCC also has the power to prevent the continuance or development of unsafe or unsound banking practices and other violations of law. Because our Bank’s deposits are insured by the FDIC to the maximum extent provided by law, it is also subject to certain FDIC regulations, and the FDIC has backup examination authority and some enforcement powers over our Bank. If, as a result of an examination of our Bank, the regulators should determine that the financial condition, capital resources, asset quality, earnings prospects, management, liquidity or other aspects of the Bank’s operations are unsatisfactory or that the Bank or our management is violating or has violated any law or regulation, various remedies are available to the regulators. Such remedies include the power to enjoin unsafe or unsound practices, require affirmative action to correct any conditions resulting from any violation or practice, issue an administrative order that can be judicially enforced, direct an increase in capital, restrict growth, assess civil monetary penalties and remove officers and directors. The regulators also may request the FDIC to terminate the Bank’s deposit insurance.

Capital Adequacy Guidelines

Bank holding companies and banks are subject to various regulatory capital requirements administered by state and federal agencies. See “Part II, Item 8. Financial Statements and Supplementary Data - Notes to Consolidated Financial Statements - Note 14, Regulatory Capital Matters” for additional regulatory capital information, including the Bank’s and Company’s leverage ratio as of December 31, 2025.

Community Reinvestment Act

The CRA requires the federal banking regulatory agencies to assess all financial institutions that they regulate to determine whether these institutions are meeting the credit needs of the communities they serve, including their assessment area(s) (as established for these purposes in accordance with

applicable regulations based principally on the location of branch offices). In addition to substantial penalties and corrective measures that may be required for a violation of certain fair lending laws, the federal banking agencies may take compliance with such laws and CRA into account when regulating and supervising other activities. Under the CRA, institutions are assigned a rating of “outstanding,” “satisfactory,” “needs to improve,” or “unsatisfactory.” A rating that is less than “satisfactory” may substantially inhibit the Bank’s opportunities for future growth. An institution’s record in meeting the requirements of the CRA is based on a performance-based evaluation system, and is made publicly available and is taken into consideration in evaluating any applications it files with federal regulators to engage in certain activities, including approval of a branch or other deposit facility, mergers and acquisitions, office relocations, and expansions into non-banking activities. Our Bank received an “outstanding” rating in its most recent CRA evaluation dated April 30, 2024, which was performed under the intermediate small bank requirements. Due to its asset size, our Bank will be evaluated under the “large bank” requirements in future CRA evaluations.

In October 2023, the OCC, together with the Federal Reserve and FDIC, issued a joint final rule to modernize the CRA regulatory framework. However, in July 2025, due to litigation, such agencies issued a joint notice of proposed rulemaking to rescind the 2023 final rule and replace it with the CRA framework that existed prior to the 2023 final rule.

Anti-Terrorism, Money Laundering Legislation and OFAC

The Bank is subject to the Bank Secrecy Act and the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (the “USA PATRIOT Act”). These statutes and related rules and regulations impose requirements and limitations on specified financial transactions and accounts and other relationships intended to guard against money laundering and terrorism financing. The principal requirements for an insured depository institution include (i) establishment of an anti-money laundering program that includes training and audit components, (ii) establishment of a “know your customer” program involving due diligence to confirm the identities of persons seeking to open accounts and to decline to open accounts for those persons unable to demonstrate their identities, (iii) the filing of currency transaction reports for deposits and withdrawals of large amounts of cash and suspicious activities reports for activity that might signify money laundering, tax evasion or other criminal activities, (iv) additional precautions for accounts sought and managed for non-U.S. persons and (v) verification and certification of money laundering risk with respect to private banking and foreign correspondent banking relationships. For many of these tasks, a bank must keep records to be made available to its primary federal regulator. Anti-money laundering rules and policies are developed by a bureau within the Financial Crimes Enforcement Network, but compliance by individual institutions is overseen by its primary federal regulator.

The Bank has established anti-money laundering and customer identification programs and it maintains records of cash purchases of negotiable instruments, files reports of certain cash transactions exceeding $10,000 (daily aggregate amount), and reports suspicious activity that might signify money laundering, tax evasion or other criminal activities pursuant to the Bank Secrecy Act.

The Treasury Department’s Office of Foreign Assets Control (“OFAC”) administers and enforces economic and trade sanctions against targeted foreign countries, persons, non-governmental organizations, associations, and criminal networks, among others, as defined by various Executive Orders and Acts of Congress. OFAC publishes lists of persons that are the target of sanctions, including the List of Specially Designated Nationals and Blocked Persons. Financial institutions are responsible for, among other things, blocking accounts of and transactions with sanctioned persons and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked and rejected transactions after their occurrence. If the Company or the Bank finds a name or other information on any transaction, account or wire transfer that is on an OFAC list or that otherwise indicates that the transaction involves a target of an OFAC-administered sanctions program, the Company or the Bank generally must freeze or block such account or transaction, file a suspicious activity report, and notify the appropriate

authorities. Banking regulators examine banks for compliance with the economic sanctions regulations administered by OFAC.

The Bank has implemented policies and procedures to comply with the foregoing requirements.

Federal Home Loan Bank Membership

The Bank is a member of the FHLB. Each member of the FHLB is required to maintain a minimum investment in the Class B stock of the FHLB. The Board of Directors of the FHLB can increase the minimum investment requirements in the event it has concluded that additional capital is required to allow it to meet its own regulatory capital requirements. Any increase in the minimum investment requirements outside of specified ranges requires the approval of the Federal Housing Finance Agency. Because the extent of any obligation to increase the level of investment in the FHLB depends entirely upon the occurrence of a future event, the Company is unable to determine the extent of future required potential payments to the FHLB. Additionally, if a member financial institution fails, the right of the FHLB to seek repayment of funds loaned to that institution will take priority (a super lien) over the rights of all other creditors.

Dividends and Share Repurchases

The ability of the Company to pay dividends or to repurchase its common stock, and the ability of the Bank to pay dividends to the Company, may be restricted due to several factors including: (a) the Maryland General Corporate Law ("MGCL," in the case of the Company), (b) covenants contained in any subordinated debentures and borrowing agreements in existence now or that may exist in the future, (c) restrictions on the ability of the Bank to declare dividends under the National Bank Act and OCC regulations (in the case of the Bank), and (d) the general supervisory authority of the Federal Reserve and the OCC. Our ability to pay dividends to our stockholders or to repurchase shares of our common stock is subject to the restrictions set forth in the MGCL.

Notification to the Federal Reserve is required prior to our declaring and paying a cash dividend to our stockholders during any period in which our quarterly and/or cumulative twelve‑month net earnings are insufficient to fund the dividend amount, among other requirements. Under such circumstances, we may not pay a dividend should the Federal Reserve object until such time as we receive approval from the Federal Reserve or no longer need to provide notice under applicable regulations. In addition, prior approval of the Federal Reserve may be required in certain circumstances prior to our repurchasing shares of our common stock.

In connection with the decision regarding dividends and share repurchase programs, our Board will take into account general business conditions, our financial results, projected cash flows, capital requirements, contractual, legal and regulatory restrictions on the payment of dividends by the Bank to the Company and such other factors as may be deemed relevant. We can provide no assurance that we will continue to declare dividends on a quarterly basis or otherwise or to repurchase shares of our common stock. The declaration of dividends by the Company is subject to the discretion of our Board.

Mergers and Acquisitions

Under the BHC Act, prior approval from the Federal Reserve System is required in order for any bank holding company to (i) acquire direct or indirect ownership or control of more than 5% of the voting shares of any bank, (ii) acquire all or substantially all of the assets of a bank, or (iii) merge or consolidate with any other bank holding company. Generally, the Company is not required to obtain prior approval from the Federal Reserve System to acquire a non-bank that engages in activities that are financial in nature or incidental to activities that are financial in nature, as long as the Company meets the capital, managerial, and CRA requirements to qualify as a financial holding company. Pursuant to Section 18(c) of the Federal Deposit Insurance Act, more commonly known as the Bank Merger Act, and for national banks relying on

certain other sources of merger authority, prior written approval from a bank's primary federal regulator is required before any insured depository institution may consummate a merger transaction, which includes a merger, consolidation, assumption of deposit liabilities, and certain asset transfers between or among two or more institutions. Prior written approval of a bank's primary federal regulator is also required for merger transactions between or among affiliated institutions, as well as for merger transactions between or among non-affiliated institutions. Transactions that do not involve a transfer of deposit liabilities typically do not require prior approval under the Bank Merger Act, unless the transaction involves the acquisition of all or substantially all of an institution's assets. When evaluating and acting on proposed merger transactions, regulators consider the extent of existing competition between and among the merging institutions, other depository institutions, and other providers of similar or equivalent services in the relevant product and geographic markets, the convenience and needs of the community to be served, capital adequacy and earnings prospects, and the effectiveness of the merger institutions in combating money-laundering activities, among other factors. Further, the Change in Bank Control Act of 1978 generally prohibits any person, acting directly or indirectly or in concert with other persons, from acquiring control of a covered institution without providing at least 60 days prior written notice to the FDIC or upon receipt of written notice that the FDIC does not disapprove of the acquisition.

On September 17, 2024, the FDIC, the OCC and the U.S. Department of Justice ("DOJ"), each announced new rules and policy statements impacting their bank merger review processes.

Among these actions, the FDIC approved a final statement of policy on bank merger transactions (the “2024 Statement”) and the OCC approved a final rule updating the agency’s regulations for business combinations involving national banks and federal savings associations. The OCC’s final rule modifies its procedures for reviewing bank merger applications under the Bank Merger Act, including the elimination of the expedited bank merger review and the streamlined application procedures. The OCC’s final rule also includes a new policy statement that addresses the substantive standards that it will use to evaluate bank merger applications, including indicators that point in favor of likely approval or rejection.

Concurrent with the FDIC and OCC announcements, the DOJ withdrew its 1995 Bank Merger Guidelines and announced that it would consider bank mergers under its 2023 Merger Guidelines, which are not industry specific, as well as under a separate, recently adopted bank merger addendum.

In May 2025, the OCC adopted an interim final rule amending the 2024 final rule to restore the expedited review and the use of the streamlined business combination. The OCC also rescinded its 2024 policy statement. Additionally, in July 2025, the FDIC rescinded the 2024 Statement and reinstated, on an interim basis, the statement of policy on bank merger transactions that was in effect prior to the 2024 Statement.

Customer Information Privacy and Cybersecurity

The Federal Reserve and other bank regulatory agencies have adopted guidelines for safeguarding confidential, personal, non‑public customer information. These guidelines require each financial institution, under the supervision and ongoing oversight of its board of directors or an appropriate committee thereof, to create, implement, and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazard to the security or integrity of such information, and protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. We have adopted a customer information security program to comply with these requirements.

The Gramm‑Leach‑Bliley Act of 1999 (the “GLBA”) requires financial institutions to implement policies and procedures regarding the disclosure of non-public personal information about consumers to non‑affiliated third parties. The GLBA requires disclosures to consumers on policies and procedures regarding the disclosure of such non-public personal information and, except as otherwise required by

law, prohibits disclosing such information except as provided in the Bank’s policies and procedures. We have implemented privacy policies addressing these restrictions that are distributed regularly to all existing and new customers of the Bank.

In March 2015, federal regulators issued two related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing Internet-based services of the financial institution. The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.

In November 2021, the federal bank regulatory agencies issued a joint rule establishing computer-security incident notification requirements for banking organizations and their service providers. This rule requires new notification requirements when a banking organization experiences a computer-security incident.

State regulators have been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements.

In July 2023, the SEC adopted rules requiring registrants to disclose material cybersecurity incidents experienced and describe the material aspects of their nature, scope and timing. The rules, which supersede previously issued guidance published in February 2018, also require annual disclosures describing a company’s cybersecurity risk management, strategy and governance. These SEC rules, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations. See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity and Item 1C. Cybersecurity for a further discussion of the Company’s risk management strategies and governance processes related to cybersecurity.

Interchange Fees

Under the Durbin Amendment to the Dodd-Frank Act, the Federal Reserve adopted rules establishing standards for assessing whether the interchange fees that may be charged with respect to certain electronic debit transactions are “reasonable and proportional” to the costs incurred by issuers for processing such transactions. Interchange fees or “swipe” fees are charges that merchants pay to the Company and other card-issuing banks for processing electronic payment transactions. The Federal Reserve has ruled that for financial institutions with assets of $10 billion or more the maximum permissible interchange fee for an electronic debit transaction is the sum of 21 cents per transaction and 5 basis points multiplied by the value of the transaction. The Federal Reserve also has rules governing routing and exclusivity that require issuers to offer two unaffiliated networks for routing transactions on each debit or prepaid product. In October 2023, the Federal Reserve issued a proposal under which the maximum permissible interchange fee for an electronic debit transaction would be the sum of 14.4 cents per transaction and 4 basis points multiplied by the value of the transaction. While financial institutions with less than $10 billion in assets, like the Company, are exempt, there is concern that these requirements will eventually be pushed down to all financial institutions, which would negatively impact the Company’s non-interest income.

Consumer Financial Protection Bureau

The Dodd-Frank Act created a new, independent federal agency called the Consumer Financial Protection Bureau (“CFPB”), which is granted broad rulemaking, supervisory and enforcement powers under various federal consumer financial protection laws, including the Equal Credit Opportunity Act, Truth in Lending Act, Real Estate Settlement Procedures Act, Fair Credit Reporting Act, Fair Debt Collection Act, the Consumer Financial Privacy Provisions of the Gramm-Leach-Bliley Act, and certain other statutes. The CFPB has examination and primary enforcement authority with respect to depository institutions with $10 billion or more in assets. Smaller institutions are subject to rules promulgated by the CFPB but continue to be examined and supervised by federal banking regulators for consumer compliance purposes. The CFPB has authority to prevent unfair, deceptive, or abusive practices in connection with the offering of consumer financial products.

On March 5, 2024, the CFPB issued a final rule amending provisions in Regulation Z that govern credit card late fee charges to lower the safe harbor amount for past due fees that a credit card issuer can charge on consumer credit card accounts from up to $41 to $8 and eliminates a higher safe harbor dollar amount for late fees for subsequent violations of the same type. This rule only applies to card issuers, that together with their affiliates, have one million or more open credit card accounts. In April 2025, the final rule was vacated by the U.S. District Court for the Northern District of Texas.

In December 2024, the CFPB issued a final rule that subjects (with certain exceptions) overdraft services provided by financial institutions with more than $10 billion in assets to the provisions of the Truth in Lending Act and other consumer financial protection laws. In May 2025, President Trump signed a Congressional Review Act resolution that overturned the CFPB’s December 2024 final rule, which would have taken effect October 1, 2025.

In February 2025, the acting director of the CFPB directed the CFPB’s staff to cease all supervision and examination activity and stakeholder engagement, stop all work on proposed rulemaking, suspend the effective dates of any finalized but not yet effective rules, and halt other actions relating to investigations, enforcement, and litigation. Beyond the initial halt, the CFPB moved toward a more deregulatory stance in 2025, significantly reducing the volume of final rules and enforcement actions compared to 2024. Under the current U.S. administration, a level of heightened uncertainty exists with respect to the future of the CFPB, including its structure, staffing, and responsibilities. It remains uncertain whether, or to what extent, changes at the CFPB will impact our business and the overall regulatory environment.

Deposit Insurance

The Bank is a national banking association, regulated by the OCC. The Bank accepts deposits, and those deposits have the benefit of FDIC insurance up to the applicable limits established by law. The applicable statutory limit for FDIC insurance for most types of accounts is $250,000.

Under the FDIC's risk-based deposit premium assessment system, the assessment rates for an insured depository institution are determined by an assessment rate calculator, which is based on a number of elements that measure the risk each institution poses to the Deposit Insurance Fund. The calculated assessment rate is applied to average consolidated assets less the average tangible equity of the insured depository institution during the assessment period to determine the dollar amount of the quarterly assessment. Under the current system, premiums are assessed quarterly and could increase if, for example, criticized loans and leases and/or other higher risk assets increase or balance sheet liquidity decreases.

Under the Federal Deposit Insurance Act, the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the

FDIC. In the event any insured depository institution, such as the Bank, is placed into FDIC receivership due to the termination of deposit insurance, or for any other reason, and the institution is sold or liquidated, the chances of the institution's parent BHC's shareholders recovering any value is very unlikely.

Future Legislative Developments

Various legislative acts are from time to time introduced in Congress. This legislation may change banking statutes and the environment in which we operate in substantial and unpredictable ways. We cannot determine the ultimate effect that potential legislation, if enacted, or implementing regulations and interpretations with respect thereto, would have on our financial condition or results of operations.

The current presidential administration and many members of Congress have advocated for changes in financial services regulation, potentially including amendments to the Dodd-Frank Act and other federal banking laws, and structural changes to the CFPB. We cannot predict whether or in what form any other proposed regulations or statutes will be adopted or the extent to which our business may be affected by any new regulation or statute. These changes become less predictable, yet more likely to occur, following the transition of power from one presidential administration to another, especially as occurred in 2025, when it involves a change in the governing political party. New agency leaders have different priorities and, as a result, there have been and will be a number of proposed changes to regulations, guidance and supervisory tactics that impact our business. It is therefore unclear at the present time what effect the aforementioned changes will have on the banking industry as a whole or the Company specifically.