COLUMBIA BANKING SYSTEM, INC. (COLB) Business

ITEM 1. BUSINESS.

In this Annual Report on Form 10-K, we refer to Columbia Banking System, Inc. as the "Company," "Columbia," "we," "us," "our," or similar references.

Forward-Looking Statements

This Annual Report on Form 10-K contains certain forward-looking statements within the meaning of Section 27A of the Securities Act of 1933 and Section 21E of the Securities Exchange Act of 1934, which are intended to be covered by the safe harbor for "forward-looking statements" provided by the Private Securities Litigation Reform Act of 1995. These statements may include statements that expressly or implicitly predict future results, performance, or events. Statements other than statements of historical fact are forward-looking statements. You can find many of these statements by looking for words such as "anticipates," "expects," "believes," "estimates," "intends," "forecast," and words or phrases of similar meaning.

We make forward-looking statements including, but not limited to, statements about derivatives and hedging; the results and performance of models and economic assumptions used in our calculation of the ACL; projected sources of funds and the Company's liquidity position and deposit level and types; our securities portfolio; loan sales; adequacy of our ACL, including the RUC; provision for credit losses; non-performing loans and future losses; our CRE portfolio, its collectability and subsequent charge-offs; resolution of non-accrual loans; mortgage volumes and the impact of rate changes; the economic environment; inflation and interest rates generally; litigation; dividends; junior subordinated debentures; fair values of certain assets and liabilities, including MSR values and sensitivity analyses; tax rates; deposit pricing; and the effect of accounting pronouncements and changes in accounting methodology.

Forward-looking statements involve substantial risks and uncertainties, many of which are difficult to predict and are generally beyond our control. There are many factors that could cause actual results to differ materially from those contemplated by these forward-looking statements. Risks and uncertainties include those set forth in the sections titled “Risk Factors,” “Business” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in this Annual Report on Form 10-K, the following factors that, among others, could cause actual results to differ materially from the anticipated results expressed or implied by forward-looking statements:

•changes in general economic, political, or industry conditions, and in conditions impacting the banking industry specifically;

•deterioration in economic conditions that could result in increased loan and lease losses, especially those risks associated with concentrations in real estate related loans;

•uncertainty in U.S. fiscal and monetary policy, including the interest rate policies of the Federal Reserve or the effects of any declines in housing and CRE prices, high or increasing unemployment rates, renewed inflation, or any recession or slowdown in economic growth particularly in the western United States;

•volatility and disruptions in global capital and credit markets;

•risks related to the acquisition of Pacific Premier including, among others, cost savings and any revenue or expense synergies from the acquisition may not be fully realized or may take longer than anticipated to be realized;

•the impact of proposed or imposed tariffs by the U.S. government and retaliatory tariffs proposed or imposed by U.S. trading partners that could have an adverse impact on customers;

•the impact of bank failures or adverse developments at other banks on general investor sentiment regarding the stability and liquidity of banks;

•changes in interest rates that could significantly reduce net interest income and negatively affect asset yields and valuations and funding sources, including impacts on prepayment speeds;

•competitive pressures among financial institutions and nontraditional providers of financial services, including on product pricing and services;

•continued consolidation in the financial services industry resulting in the creation of larger financial institutions that have greater resources;

•our ability to successfully, including on time and on budget, implement and sustain information technology product and system enhancements and operational initiatives;

•our ability to attract new deposits and loans and leases;

•our ability to retain deposits;

5

Table of Contents

•our ability to achieve the efficiencies and enhanced financial and operating performance we expect to realize from investments in personnel, acquisitions, and infrastructure;

•the possibility that our recorded goodwill could become impaired, which may have an adverse impact on our earnings and capital;

•demand for financial services in our market areas;

•stability, cost, and continued availability of borrowings and other funding sources, such as brokered and public deposits;

•changes in legal or regulatory requirements or the results of regulatory examinations that could increase expenses or restrict growth;

•changes in the scope and cost of FDIC insurance and other coverage;

•our ability to manage climate change concerns, related regulations, and potential impacts on the creditworthiness of our customers;

•our ability to recruit and retain key management and staff;

•our ability to raise capital or incur debt on reasonable terms;

•regulatory limits on the Bank's ability to pay dividends to the Company that could impact the timing and amount of dividends to shareholders;

•financial services reform and the impact of legislation and implementing regulations on our business operations, including our compliance costs, interest expense, and revenue;

•a breach or failure of our operational or security systems, or those of our third-party vendors, including as a result of cyber-attacks;

•success, impact, and timing of our business strategies, including market acceptance of any new products or services;

•the outcome of legal proceedings;

•our ability to effectively manage credit risk, interest rate risk, market risk, operational risk, legal risk, liquidity risk, and regulatory and compliance risk;

•the possibility that the anticipated benefits from ongoing initiatives to improve operational performance are not realized in the amounts or when expected if at all;

•economic forecast variables that are either materially worse or better than end of quarter projections and deterioration in the economy that exceeds current consensus estimates;

•the effect of geopolitical instability, including wars, conflicts, and terrorist attacks;

•natural disasters, including earthquakes, tsunamis, flooding, fires, pandemics, and other similarly unexpected events outside of our control;

•our ability to effectively manage problem credits;

•our ability to successfully negotiate with landlords or reconfigure facilities; and

•the effects of any damage to our reputation resulting from developments related to any of the items identified above.

There are many factors that could cause actual results to differ materially from those contemplated by these forward-looking statements. Forward-looking statements are made as of the date of this Annual Report on Form 10-K. We undertake no obligation to update any forward-looking statements, whether as a result of new information, future events or otherwise, except as required under federal securities laws. Readers should consider any forward-looking statements in light of this explanation, and we caution readers about relying on forward-looking statements.

For a more detailed discussion of some of the risk factors that could (i) affect our business, financial condition, and future results, or (ii) cause actual results to differ materially from those contemplated by these forward-looking statements, see the section entitled "Risk Factors" under Item 1A of this Annual Report on Form 10-K. We do not intend to update any factors, except as required by SEC rules, or to publicly announce revisions to any of our forward-looking statements. Any forward-looking statement speaks only as of the date that such statement was made. You should consider any forward-looking statements in light of this explanation, and we caution you about relying on forward-looking statements.

6

Table of Contents

SEC Filings

We electronically file Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, proxy and information statements and other information with the SEC. You may obtain these reports and statements, and any amendments, from the SEC's website at www.sec.gov. You may obtain copies of these reports, and any amendments, through the investor relations section of our website at www.columbiabankingsystem.com. These reports are available through our website as soon as reasonably practicable after they are filed electronically with the SEC.

Introduction

Columbia Banking System, Inc. (referred to in this Annual Report on Form 10-K as "we," "our," the "Company," and "Columbia") is a registered financial holding company. On August 31, 2025, Columbia completed its previously announced acquisition of Pacific Premier.

Effective September 1, 2025, the Bank began serving customers under its unified "Columbia Bank" name and "Columbia" brand. This strategic transition streamlines our identity across all business lines including Columbia Wealth Management, Columbia Trust Company, Columbia Private Bank, Columbia Wealth Advisors, and Columbia Private Trust making it easier for customers to recognize and engage with the full breadth of our services. Through the Bank, we provide a broad range of banking, private banking, mortgage, and other financial services to corporate, institutional, small business, and individual customers. FinPac, a commercial equipment leasing company, is a subsidiary of the Bank. Along with its subsidiaries, the Company is subject to the regulations of state and federal agencies and undergoes regular examinations by these regulatory agencies.

The majority of the Bank’s loans and deposits are within its service areas in Arizona, California, Colorado, Idaho, Nevada, Oregon, Utah, and Washington. Columbia Bank is an Oregon state-chartered commercial bank, the deposits of which are insured in whole or in part by the FDIC.

Business Strategy

Columbia, through its principal subsidiary, Columbia Bank, seeks to bank businesses of all sizes, along with their owners, executives, and employees, in addition to the residents of the communities we serve. We seek to provide our customers with the financial sophistication and product depth of a regional banking company while retaining the appeal and service level of a community bank. Our approach is a concentrated focus on full banking relationships, bringing together collaborative teams from commercial and consumer banking as well as wealth management, and leveraging our retail branch network to provide "Community Banking at Scale" in support of our "Business Bank of Choice" strategy.

We continually evaluate our existing business processes while focusing on maintaining asset quality and granular loan and deposit portfolios diversified by product, customer, industry, and geography. Our acquisition of Pacific Premier greatly accelerated our Southern California expansion strategy and enhanced our presence in other growth markets in our footprint supporting our targeted strategy to expand market share in communities in the western United States. Our scaled franchise and offerings, talented associate base, and customer-focused business model enable us to provide comprehensive financial services in a manner that serves our four identified stakeholder groups: associates, customers, shareholders, and communities. We seek to expand total revenue while controlling expenses in an effort to gain operational efficiencies and increase our return on average tangible common equity. As a result of our strong commitment to highly personalized, relationship-oriented customer service, our diverse products, our strategic branch locations, and the long-standing community presence of our associates, we believe we are well positioned to attract new customers while not only retaining existing customers but also deepening our relationships with them. We focus on balanced, relationship-driven growth in loans, deposits, and sustainable core fee income that results from providing customers tailored financial solutions to meet their needs.

Products and Services

We place the highest priority on customer service and assist our customers in making informed decisions when selecting from the products and services we offer. Our array of financial products are delivered through traditional and digital channels to meet the banking needs of our market area and commercial and consumer customers. To ensure the ongoing viability of our product offerings, we regularly examine the desirability and profitability of existing and potential new products. Our customers can access our products through our branch network, mobile banking applications, and our website: www.columbiabank.com (information contained on our website is not incorporated by reference into this Annual Report on Form 10-K).

7

Table of Contents

Commercial Lending Products. We offer specialized loans for corporate, middle market, and small business customers, including commercial lines of credit and term loans, accounts receivable and inventory financing, international trade finance, commercial property loans, multifamily loans, equipment loans, commercial equipment leases, real estate construction loans and permanent financing, SBA program financing, and capital markets.

Treasury Management and Payments. As Columbia Bank focuses on banking the full customer relationship and meeting the needs of customers of all sizes, we offer treasury management and payments solutions to our customers through our Global Payments & Deposits group. These products include business digital and mobile banking solutions, ACH, wires, positive pay, remote deposit capture, integrated payments, integrated receivables, lockbox, cash vault, Real-Time Payments via The Clearinghouse, commercial card, fraud prevention solutions, open application programming interfaces banking, foreign exchange, trade and supply chain finance, and international banking-related products. We also offer merchant services in coordination with a strategic partner. Within our business digital experience, customers can engage in a fully authenticated chat and co-browse feature with a knowledgeable representative if they require assistance with any of the Bank’s solutions. We offer our treasury management and payments solutions using a unique consulting experience for prospects and customers that involves a holistic review of a business's cash flows and financial operations to advise the business on opportunities to optimize working capital, gain efficiencies through automation, and achieve cost savings through financial technology deployment.

Deposit Products. We offer deposit products, including non-interest-bearing checking accounts, analyzed business accounts, interest-bearing checking and savings accounts, money market accounts, insured cash sweep and other investment sweep solutions, and certificates of deposit. Interest-bearing accounts earn interest at rates established by management based on competitive market factors and management's desire to increase certain types of deposit liabilities. Our approach is to provide a streamlined and differentiated experience that meets the customer's needs across all channels. This approach is designed to add value for the customer and generate related fee income for the services provided.

Wealth Management. As a division of Columbia Bank, the Wealth Management team provides a full suite of financial planning, investment, trust, insurance, and private banking solutions to individuals, families, and businesses through Columbia Wealth Advisors, Columbia Trust Company, Columbia Private Trust, and Columbia Private Bank. We deliver personalized service and experience through dedicated financial advisors that leverage an approach revolving around the three stages of the wealth cycle: grow, preserve, and transition.

Residential Real Estate Loans. Real estate loans are available for the construction, purchase, and refinancing of residential owner occupied and rental properties. Borrowers can choose from a variety of fixed and adjustable rate options and terms. We sell many of the residential real estate loans that we originate into the secondary market. Servicing is retained on the majority of these loans.

Consumer Loans. We provide loans to individual borrowers for a variety of purposes, including secured and unsecured personal loans, home equity and personal lines of credit, and motor vehicle loans.

Market Area and Competition

The geographic markets we serve are highly competitive for deposits, loans, leases, and other fee-generating products and services. We compete with traditional banking institutions, as well as non-bank financial service providers, such as credit unions, mortgage companies, fintechs, and online based financial service providers. In our market areas of Arizona, California, Colorado, Idaho, Nevada, Oregon, Texas, Utah, and Washington, major national banks generally hold top market share positions. Competition also includes small community banks that operate in concentrated areas within our footprint and other regional banks that focus on commercial and retail banking. In 2025, due to the acquisition of Pacific Premier, the Bank has expanded its market area into Texas through an HOA office.

As the industry becomes increasingly oriented toward technology-driven delivery systems, permitting transactions to be conducted on mobile devices and computers, non-bank institutions are able to attract customers and provide lending and other financial services even without offices located in our primary service area. Some insurance companies and brokerage firms compete for deposits by offering rates that are higher than the weighted average market price and may be inappropriate for the Bank in relation to its asset and liability management objectives.

8

Table of Contents

Credit unions present a significant competitive challenge for our banking services and products. As credit unions currently enjoy an exemption from income tax, they are able to offer higher deposit rates and lower loan rates than banks can on a comparable basis. Credit unions are also not currently subject to certain regulatory constraints, such as the Community Reinvestment Act, which, among other things, requires us to implement procedures to make and monitor loans throughout the communities we serve. Adhering to such regulatory requirements raises the costs associated with our lending activities and reduces potential operating profits.

We seek to compete by focusing on building customer relationships, providing superior service, and offering a wide variety of commercial and consumer banking products. Our branch system funds our lending activities and allows us to better serve both retail (consumer) and business (commercial) depositors. We believe this approach enables us to expand lending activities while attracting a stable core deposit base and enhancing utilization of our full range of products and services. Our branch system and other delivery channels are continually evaluated as an important component of ongoing efforts to improve efficiencies without compromising customer service.

The following table presents the Bank's market share percentage for total deposits as of June 30, 2025 in each state where we have operations. The table also indicates the ranking by deposit size in each market. All information in the table was obtained from S&P Global, which compiles deposit data published by the Federal Deposit Insurance Corporation as of June 30, 2025 and updates the information for any bank mergers and acquisitions completed subsequent to the reporting date.

Sustainability and Responsible Business

While ultimately our goal is to build long-term value for our shareholders, we take pride in being able to do so while also being an active partner to build stronger, more resilient, better connected, and thriving economies throughout our footprint. Our approach to sustainability is about making responsible business decisions that support all of our stakeholders for the long term, and it is embedded in the fabric of our corporate values and culture, driving us to think very intentionally about how we serve our communities every day.

To inform our strategy and approach, the Company completed a comprehensive assessment of our corporate impact in 2024 to identify priority sustainability areas for the Company. Through internal and external stakeholder analysis, fourteen key topics were identified and ranked with the final prioritization approved by executive leadership and the Board’s Nominating and Governance Committee. Additionally, the Company expanded its corporate responsibility performance reporting in our 2024 Corporate Citizenship Report to reference recommendations by the Task Force on Climate-related Financial Disclosure, alongside standards outlined by the Global Reporting Initiative and Sustainability Accounting Standards Board frameworks.

Our annual Corporate Citizenship Report is available at the “About Us-Our Impact” section of the Bank's website (www.columbiabank.com) but is not incorporated by reference into this Annual Report on Form 10-K. This report provides additional detail about our commitment to operating responsibly and building long-term value for all of our stakeholders. A brief overview:

Associates

We create an environment where our associates have the chance to grow, connect, and do meaningful work together. Relationship banking is at our core, and our people are the key to maintaining relationships with each other, our customers, and our communities. Our Do Right culture underpins a work environment grounded in respect, collaboration, and accountability, where associates care for one another, act in the best interest of our customers, and participate in making their community a better place to live and work. Our associates are encouraged to use their skills and passions to make a difference in their communities while growing their careers and being recognized and appreciated for their respective talents, backgrounds, and perspectives.

9

Table of Contents

•We emphasize a culture of kindness and positivity, encouraging behaviors consistent with our Do Right values1, which describe the qualities we expect all of our associates to embody every day in all interactions with other associates, customers, shareholders, and in our communities.

•Inclusion and belonging are strong anchors in our foundation. We celebrate differences and encourage authenticity, not just where we work, but also with our customers and in our communities.

•We support our associates with a portfolio of programs that address their well-being, from physical and financial health to community connections and workplace recognition.

Customers

We are committed to helping individuals, families, and businesses thrive. The Company focuses on the genuine human connection and building long-term relationships through focused attention on customer needs. We see technology as a vital tool to better serve our customers expanding access to the expertise of our bankers.

•We prioritize financial health and access to capital for our customers and communities. We continue to innovate and find new ways to provide access to financial solutions across a diverse customer base.

•In 2025, the Bank launched its Legacy Builder Program to meet the specific needs of first-generation homebuyers. The program incorporates features such as Down Payment Assistance empowering first-time buyers and helping them build a foundation for generational wealth.

•Demonstrating our commitment to fostering economic empowerment and financial inclusion for Native American communities across our footprint, the Bank participates in the Department of Housing and Urban Development Section 184 Indian Home Loan Guarantee Program, a critical step toward expanding access to affordable housing for tribal members.

•To help protect our customers from evolving threats, our fraud‑prevention initiative, Success Against Fraud Events (S.A.F.E.), is in place across our footprint, sharing emerging trends with customers and delivering actionable insights that reinforce the value of our fraud‑protection solutions for business customers.

•Underscoring our commitment to the growth and success of our customers and their needs, the Company continued its outreach to small and middle market business by publishing the Columbia Bank Business Barometer Report for the eighth consecutive year. The 2025 survey collected responses from nearly 1,300 businesses across the United States to gauge their perspective and plans regarding the United States economy and business conditions.

•Our Client Advisory Board, comprised of customers from around our footprint, meets regularly to discuss new topics, industry trends, products and services that are important to them in order for them to build, operate, and grow their businesses. This enhances the Company's understanding of market conditions and client priorities, supporting decision-making related to product development, service delivery, and strategic planning.

Communities

We strive to meaningfully support economic prosperity in the communities where we live and work. Our approach to community investment focuses on increasing the economic vitality of our communities, particularly in places suffering from a lack of access to financial expertise, gainful employment, and building intergenerational wealth.

•Following the acquisition of Pacific Premier Bank in 2025, we expanded the five-year Community Benefits Agreement with the National Community Reinvestment Coalition, increasing our total commitments to $9.8 billion. The expanded agreement is intended to support economic opportunity for individuals and small business formation in historically underserved communities throughout the Bank’s footprint. In connection with these efforts, we periodically engage with a Community Advisory Panel comprised of nonprofit partners that represent under-resourced groups from throughout the Bank’s footprint, to help to guide our efforts.

•Through bank sponsorships as well as the Columbia Bank Community Impact Fund, we are committed to providing sponsorship and grant funding in communities where we have a physical banking presence. Combined, sponsorships and grants totaling $11 million were provided in support of nonprofits across our footprint in 2025. Both programs focus on nonprofits that have shown strong community leadership, a commitment to improving access to economic opportunity and to support for a variety of under-resourced communities in the areas of financial mobility, housing stability, and community resilience.

1 The Do Right values consist of:

R: Form lasting RELATIONSHIPS with customers and each other.

I: Create IMPACT through purposeful action.

G: Pursue GROWTH for you, your customers, and communities.

H: Serve others with HEART.

T: Build TRUST through credibility.

10

Table of Contents

•The Company's Connect Volunteer Network™ continues to be one of the nation's leading volunteer programs, providing all associates with up to 40 hours of paid time off each year committed to a wide range of community needs.

•Our “Dollars for Doers” program further amplifies our associates’ impact and support of their philanthropic passions and goals. The Company made an additional $500 donation on behalf of each associate who met the 40-hour volunteerism threshold to the associate’s nonprofit organization of choice.

•We remain committed to supporting our associates’ philanthropic efforts through our matching‑gifts program, which matches their charitable contributions dollar‑for‑dollar up to $1,000, to further extend their community impact.

Operational Sustainability

We focus on smart business operations that benefit both the environment and the Company. As a financial institution, we acknowledge the economic, societal, and ecological impacts of climate change to our business and to our customers. We seek to advance efficient, responsible practices that lessen our impact and contribute to the Company's business goals. As we expand into new markets, we are taking steps that are designed to optimize the resources we consume and minimize the waste we create, limiting our operational impact so that we help both our communities and our bottom line.

•We maintain an Environmental Commitment Statement.

•We annually report our Greenhouse Gas Inventory as well as our energy, water, and business travel usage.

•Our fourteen material topics identified in 2024 included energy management, resource management, environmental impact of operations, and environmental benefits of products and services.

Stakeholder Engagement

We solicit input from our stakeholders through a variety of channels, including:

•Customers may provide feedback to any of our associates through our customer resource center and through outreach from our customer insights team.

•Associates may provide feedback through periodic engagement surveys, executive listening sessions, and all-hands and division calls.

•Community members or representatives may reach out anytime or talk directly with footprint-based Community Impact Officers.

•We maintain regular contact with government entities and regulatory bodies to support transparency and alignment with applicable requirements.

•Shareholders regularly interact with our executive management team at investor conferences, road shows and 1:1 meetings, and they may contact our Director of Investor Relations directly or via our Investor Relations webpage (www.columbiabankingsystem.com).

Human Capital

At our institution, relationships are paramount, and associates are central to our continued success. We leverage the collective talents, skills, and expertise of our dedicated workforce to fulfill our mission and uphold our commitments to customers, shareholders, and communities. Our approach is focused on supporting the growth and prosperity of businesses and families, as well as fostering the well-being and professional development of our associates.

We aim to provide an employment experience rooted in a constructive and respectful culture that values every team member. Our associates are empowered to pursue growth, establish connections, and engage in meaningful work. We recognize and appreciate their different talents, backgrounds, and perspectives. The organization is committed to offering competitive, performance-based compensation packages, attractive benefits, a safe workspace, and comprehensive learning opportunities.

Workforce Composition. As of December 31, 2025, the Company employed 6,005 individuals, predominantly full-time associates. The workforce spans customer-facing roles across retail branches, business and commercial banking, wealth management, trust services, and support functions including technology, finance, risk, audit, legal, and human resources, primarily located in our footprint.

Total workforce increased by 27%, attributed largely to the acquisition of Pacific Premier Bank in September 2025. The turnover rate for the combined company, as recorded in our payroll system, was 20.8%.

11

Table of Contents

Employee Health and Well-being. Associates have access to competitive medical, dental, vision, life, short- and long-term disability, and accident insurance. Paid time off for vacation, sick leave, and volunteer activities is included. Medical benefits are available to associates working at least 30 hours per week, with paid time off starting at 20 hours per week. All programs undergo regular assessment against market standards.

Compensation. Compensation practices are designed to attract and reward associates through market-aligned salaries and benefits. Our pay structure is regularly reviewed and adjusted in response to market trends, with an emphasis on performance-based rewards and pay equity analyses. Many roles include incentive plans linked to corporate, business unit, and individual objectives.

Associate engagement surveys are administered regularly to monitor sentiment and gather feedback on various aspects of the employment experience. These insights guide improvements to people-focused programs and practices.

Talent Development

Inclusion and Belonging. The organization seeks to create an inclusive workplace where varying experiences, cultures, and perspectives contribute to a sense of belonging that mirrors our communities. Compliance with relevant anti-discrimination laws is strictly observed.

Our culture of belonging is fostered through comprehensive support mechanisms led by the executive team and various Associate Resource Groups, comprising associates from across the organization. We are committed to being a financial institution that serves the entire community and are proud to act as a community leader.

Information about our Executive Officers

Information regarding employment agreements with our executive officers is contained in Item 11 of this Annual Report on Form 10-K, which item is incorporated by reference to the Proxy Statement.

Government Policies

The operations of the Company and our subsidiaries are affected by state and federal legislative and regulatory changes and by policies of various regulatory authorities, including domestic monetary policies of the Federal Reserve, United States fiscal policy, and capital adequacy and liquidity constraints imposed by federal and state regulatory agencies.

Supervision and Regulation

The following discussion provides an overview of certain elements of the extensive regulatory framework applicable to the Company and Columbia Bank, which operates in Arizona, California, Colorado, Idaho, Nevada, Oregon, Texas, Utah, and Washington. This regulatory framework is primarily designed for the protection of depositors, customers, federal DIFs, and the banking system as a whole, rather than specifically for the protection of shareholders or non-depository creditors. Due to the breadth and growth of this regulatory framework, our costs of compliance continue to increase in order to monitor and satisfy these requirements.

To the extent that this section describes statutory and regulatory provisions, it is qualified by reference to those provisions. These statutes and regulations, as well as related policies, are subject to change by Congress, state legislatures and federal and state regulators. Changes in statutes, regulations, or regulatory policies applicable to us, including the interpretation or implementation thereof, cannot be predicted, but may have a material effect on our business, financial condition, or results of operations. Our continued efforts to monitor and comply with new regulatory requirements and developments add to the complexity and cost of our business.

We expect that the current presidential administration's regulatory agenda will continue to differ from that of the previous presidential administration, which could lead to significant impacts on the rulemaking, supervision, examination, and enforcement priorities of federal agencies, including the federal banking agencies. We will continue to monitor regulatory developments and assess their impacts on the Company.

12

Table of Contents

Federal and State Bank Holding Company Regulation

General. The Company is a bank holding company as defined in the BHCA that has elected to be a financial holding company, and is therefore subject to regulation, supervision, and examination by the Federal Reserve. The Company must file reports with and provide the Federal Reserve such additional information as it may require. Under the Financial Services Modernization Act of 1999, a bank holding company may apply to the Federal Reserve to become a financial holding company, and thereby engage (directly or through a subsidiary) in certain expanded activities deemed financial in nature, such as securities underwriting and dealing, insurance underwriting and brokerage, merchant banking and other activities that are determined by the FRB, in coordination with the Treasury Department, to be “financial in nature or incidental thereto” or that the FRB determines unilaterally to be “complementary” to financial activities. To maintain its status as a financial holding company, a bank holding company (and all of its depository institution subsidiaries) must each remain “well-capitalized” and “well-managed.” If a bank holding company fails to meet these regulatory standards, the Federal Reserve could place limitations on its ability to conduct the broader financial activities permissible for financial holding companies or impose limitations or conditions on the conduct or activities of the bank holding company or its affiliates. If the deficiencies persisted, the Federal Reserve could order the bank holding company to divest any subsidiary bank or to cease engaging in any activities permissible for financial holding companies that are not permissible for bank holding companies.

Holding Company Bank Ownership. The BHCA requires every bank holding company to obtain the prior approval of the Federal Reserve before (i) acquiring, directly or indirectly, ownership or control of any voting shares of another bank or bank holding company if, after such acquisition, it would own or control more than 5% of such shares; (ii) acquiring all or substantially all of the assets of another bank or bank holding company; or (iii) merging or consolidating with another bank holding company. In addition, under the BMA, the prior approval of the FDIC is required for the Bank to merge with another bank or purchase all or substantially all of the assets or assume any of the deposits of another FDIC IDI. In reviewing applications seeking approval of merger and acquisition transactions, bank regulators consider, among other things, the competitive effect and public benefits of the transactions, the capital position and managerial resources of the combined organization, the risks to the stability of the U.S. banking or financial system, the applicant’s performance record under the CRA, the applicant’s compliance with other laws, including fair housing and consumer protection laws, and the effectiveness of all organizations involved in combating money laundering activities. In addition, failure to implement or maintain adequate compliance programs could cause bank regulators not to approve an acquisition where regulatory approval is required or to prohibit an acquisition even if approval is not required.

In July 2021, the Biden administration issued an executive order on competition, which included provisions relating to bank mergers. These provisions “encourage” the Department of Justice and the federal banking regulators to update guidelines on banking mergers and to provide more scrutiny of bank mergers. In September 2024, the FDIC approved a final statement of policy on bank merger transactions that details the types of transactions that require FDIC approval, the principles the FDIC applies when applying the BMA statutory factors, and the procedures the FDIC uses in reviewing BMA applications. The statement of policy provides, among other things, that (i) the evaluation of a merger’s competitive effects may take into account concentration beyond deposits, including the ability of the resulting IDI to better meet the needs of the community to be served, (ii) the FDIC may require divestitures to be completed before allowing bank merger transactions to be consummated, (iii) the FDIC expects to hold public hearings for mergers resulting in IDIs that have $50 billion or more in total consolidated assets, and (iv) mergers resulting in IDIs that have $100 billion or more in total consolidated assets will be subject to added scrutiny. The FDIC statement of policy was expected to apply where the surviving bank would be a state bank that is not a member of the Federal Reserve system. In May 2025, the FDIC rescinded the statement of policy, with the previously in effect statement of policy on bank merger transactions reinstated, effective as of August 2025. In September 2024, the Department of Justice withdrew from the 1995 Bank Merger Guidelines and issued a banking addendum to its 2023 Merger Guidelines, which will apply to all bank mergers. The banking addendum to the 2023 Merger Guidelines provides that the Department of Justice will evaluate potential harms to more narrowly defined customer markets and that the federal bank regulators may, at their discretion, use their own methods to evaluate bank mergers. We are unable to predict what impact the executive order, the reinstated FDIC statement of policy, the Department of Justice withdrawal from the 1995 Bank Merger Guidelines and the issuance of a banking addendum to the 2023 Merger Guidelines, or any other responsive changes to such guidelines, will have on the timing of or ability to obtain regulatory approvals of future mergers.

13

Table of Contents

In July 2024, the FDIC issued a proposed rule to amend its regulations under the Change in Bank Control Act of 1978, which generally provides that no person, acting directly or indirectly, may acquire control of an IDI unless the person has given the appropriate federal banking agency prior notice of the proposed transaction, and the agency has not disapproved the transaction. The proposed rule would eliminate the existing exemption from FDIC approval for acquisitions of voting securities at the bank holding company level for which the Federal Reserve reviews a notice pursuant to the Change in Bank Control Act of 1978. In May 2025, the FDIC rescinded the proposed rule.

Holding Company Control of Nonbanks. With some exceptions, the BHCA also prohibits a bank holding company from acquiring or retaining direct or indirect ownership or control of more than 5% of the voting shares of any company which is not a bank or bank holding company, or from engaging directly or indirectly in activities other than those of banking, managing, or controlling banks, or providing services for its subsidiaries. The principal exceptions to these prohibitions involve certain non-bank activities that, by statute or by Federal Reserve regulation or order, have been identified as activities so closely related to the business of banking as to be a proper incident thereto.

Tying Arrangements. We are prohibited from engaging in certain tie-in arrangements in connection with any extension of credit, sale or lease of property or furnishing of services. For example, with certain exceptions, neither the Company nor its subsidiaries may condition an extension of credit to a customer on either (i) a requirement that the customer obtain additional services provided by us; or (ii) an agreement by the customer to refrain from obtaining other services from a competitor.

Support of Subsidiary Banks. Under Federal Reserve policy and federal law, the Company is required to act as a source of financial and managerial strength to Columbia Bank, including at times when we may not be in a financial position to provide such resources, and it may not be in our, or our shareholders’ best interests to do so. This means that the Company is required to commit resources, as necessary, to support Columbia Bank. Any capital loans the Company makes to Columbia Bank are subordinate to deposits and to certain other indebtedness of Columbia Bank.

State Law Restrictions. As a Washington corporation, the Company is subject to certain limitations and restrictions under applicable Washington corporate law. For example, state law restrictions in Washington include limitations and restrictions relating to indemnification of directors, distributions to shareholders, transactions involving directors, officers or interested shareholders, maintenance of books, records and minutes, and observance of certain corporate formalities.

Federal and State Regulation of Columbia Bank

General. The deposits of Columbia Bank, an Oregon state-chartered commercial bank in Arizona, California, Colorado, Idaho, Nevada, Oregon, Utah, and Washington, are insured by the FDIC. As a result, Columbia Bank is subject to supervision and regulation by the DCBS and the FDIC. These agencies have the authority to prohibit banks from engaging in what they believe constitute unsafe or unsound banking practices. Furthermore, under the FDIA, insurance of deposits may be terminated by the FDIC if the FDIC finds that the IDI has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order, or condition imposed by the FDIC. With respect to branches of Columbia Bank, the Bank is also subject to certain laws and regulations governing its activities in the states in which we operate.

State Bank Regulation. Columbia Bank, as an Oregon state-chartered bank, is primarily subject to the state-level supervision and regulation of the DCBS. In addition, Columbia Bank is subject to regulation by the financial institution oversight authorities in the states of Arizona, California, Colorado, Idaho, Nevada, Oregon, Utah, and Washington. Our primary state regulator regularly examines the Bank or participates in joint examinations with the FDIC; these agencies may prohibit the Bank from engaging in what they believe constitute unsafe or unsound banking practices.

14

Table of Contents

Consumer Protection. The Bank is subject to a variety of federal and state consumer protection laws and regulations that govern its relationship with consumers, including laws and regulations that impose certain disclosure requirements and regulate the manner in which we take deposits, make, and collect loans, and provide other services. Failure to comply with these laws and regulations may subject the Bank to various penalties, including but not limited to, enforcement actions, injunctions, fines, civil monetary penalties, criminal penalties, punitive damages, and the loss of certain contractual rights. As an IDI with assets of $10 billion or more, the CFPB has primary enforcement and enforcement authority for federal consumer financial laws over the Bank. This includes the right to obtain information about the Bank’s activities and compliance systems and procedures and to detect and assess risks to consumers and markets. The CFPB engages in several activities, including (i) investigating consumer complaints about credit cards and mortgages, (ii) launching supervisory programs, (iii) conducting research for and developing mandatory financial product disclosures, and (iv) engaging in consumer financial protection rulemaking. Columbia Bank has established a compliance management system designed to ensure consumer protection. In October 2024, the CFPB adopted a final rule regarding personal financial data rights that applies to financial institutions that offer consumer deposit accounts such as Columbia Bank. Covered financial institutions are required to provide consumers electronic access to 24 months of transaction data and certain account information under the final rule and are prohibited from imposing any fees or charges for maintaining or providing access to such data. The final rule also imposes data accuracy, retention, and other obligations. In August 2025, the CFPB issued an advance notice of proposed rulemaking to reconsider several elements of the final rule on personal financial data rights, including a better understanding of the costs and benefits of the personal financial data rights rule and how to defray costs for covered institutions. These requirements, if the final rule remains in effect without modification, will apply to Columbia Bank beginning on April 1, 2027, and we will continue to evaluate the final rule and the impact on Columbia Bank.

Under the current presidential administration and Congress, the scope of regulation by the CFPB and other federal agencies remains uncertain. In February 2025, the acting director of the CFPB directed the CFPB’s staff to cease all supervision and examination activity and stakeholder engagement, stop all work on proposed rulemaking, suspend the effective dates of any finalized but not yet effective rules, and halt other actions relating to investigations, enforcement, and litigation. The extent to which these recent or other future developments will ultimately impact the CFPB’s regulation of the Bank’s business remains uncertain.

Community Reinvestment. The CRA requires that, in connection with examinations of financial institutions within their jurisdiction, the Federal Reserve, the OCC or the FDIC evaluate the record of the financial institution in meeting the credit needs of its local communities, including low- and moderate-income neighborhoods, consistent with the safe and sound operation of the institution. A bank’s community reinvestment record is also considered by the applicable banking agencies in evaluating mergers, acquisitions, and applications to open a branch or facility. The Bank’s failure to comply with the CRA could, among other things, result in the denial or delay of such transactions. The Bank received a rating of "Satisfactory" in its most recently completed CRA examination. On October 24, 2023, the Federal Reserve, the FDIC and the OCC jointly issued a final rule amending the agencies’ CRA regulations to achieve the following goals: (i) encourage banks to expand access to credit, investment and banking services in low- and moderate-income communities, (ii) adapt to changes in the banking industry, including internet and mobile banking, (iii) provide greater clarity and consistency in the application of the CRA regulations, and (iv) tailor CRA evaluations and data collection to bank size and type. Enforcement of the rule by federal bank regulators has been stayed since the issuance of a preliminary injunction by a court in March 2024, pending resolution of a lawsuit challenging the regulations. On July 16, 2025, the Federal Reserve, the FDIC and the OCC issued a joint notice of proposed rulemaking that would rescind the October 2023 rule and replace it with the 1995 CRA regulations. These proposed rules have not been finalized as of the date of this Annual Report on Form 10-K.

15

Table of Contents

Anti-Money Laundering, Anti-Terrorism and Sanctions. The BSA requires all financial institutions, including banks, to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. It includes a variety of recordkeeping and reporting requirements (such as cash and suspicious activity reporting) as well as due diligence/know-your-customer documentation requirements. In August 2024, the United States Treasury Department’s Financial Crimes Enforcement Network (“FinCEN”) issued a final rule that would amend the anti-money laundering/countering the financing of terrorism (“AML/CFT”) program requirements for all financial institutions subject to the BSA with AML/CFT program obligations, including the Bank. The final rule, which was scheduled to go into effect on January 1, 2026, would, among other things, require that (i) financial institutions have a risk assessment process to identify, evaluate, and document the financial institution’s money laundering, terrorist financing, and other illicit activity risks, and (ii) the risk assessment process must be updated on a periodic basis, including when certain material changes occur in the financial institution’s products, services, customer base, intermediaries, and geographic footprint. In December 2025, FinCEN issued a final rule delaying the effective date until January 1, 2028. In July 2024, the OCC, the Federal Reserve, and the FDIC each proposed rules to amend their respective BSA compliance program rules to align with FinCEN’s June 2024 proposed rule. These proposed rules have not been finalized as of the date of this Annual Report on Form 10-K.

The USA PATRIOT Act further augments and strengthens the requirements set forth in the BSA. The USA PATRIOT Act, in relevant part, (i) prohibits banks from providing correspondent accounts directly to foreign shell banks; (ii) imposes due diligence requirements on banks opening or holding accounts for foreign financial institutions or wealthy foreign individuals; (iii) requires financial institutions to establish an anti-money-laundering compliance program; and (iv) eliminates civil liability for persons who file suspicious activity reports. The USA PATRIOT Act also includes provisions providing the government with power to investigate terrorism, including expanded government access to bank account records.

Columbia Bank is also subject to regulation under the International Emergency Economic Powers Act and the Trading with the Enemy Act, as administered by the United States Treasury Department’s Office of Foreign Assets Control (“Sanctions Laws”). The Sanctions Laws are intended to restrict transactions with persons, companies, or foreign governments sanctions by U.S. authorities. An institution that fails to meet these standards may be subject to regulatory sanctions, including limitations on growth. Columbia Bank has established compliance programs designed to comply with the BSA, the USA PATRIOT Act and applicable Sanctions Laws.

Transactions with Affiliates; Insider Credit Transactions. Transactions between the Bank and its subsidiaries, on the one hand, and the Company or any other subsidiary, on the other hand, are regulated under federal banking law. The Federal Reserve Act imposes quantitative and qualitative requirements and collateral requirements on covered transactions by the Bank with, or for the benefit of, its affiliates. In addition, subsidiary banks of a bank holding company are subject to restrictions on extensions of credit to the holding company or its subsidiaries, on investments in securities of the holding company or its subsidiaries and on the use of their securities as collateral for loans to any borrower. These regulations and restrictions may limit the Company’s ability to obtain funds from Columbia Bank for its cash needs, including funds for payment of dividends, interest, and operational expenses.

Banks are also subject to certain restrictions imposed by the Federal Reserve Act on extensions of credit to executive officers, directors, principal shareholders, or any related interests of such persons. Extensions of credit (i) must be made on substantially the same terms, including interest rates and collateral, and follow credit underwriting procedures that are at least as stringent as those prevailing at the time for comparable transactions with persons not related to the lending bank; and (ii) must not involve more than the normal risk of repayment or present other unfavorable features. Banks are also subject to certain lending limits and restrictions on overdrafts to insiders. A violation of these restrictions may result in the assessment of substantial civil monetary penalties, regulatory enforcement actions, and other regulatory sanctions. The Columbia Bank board has established controls to ensure compliance with regulatory expectations around affiliated transactions.

Regulation of Management. Federal law (i) sets forth circumstances under which officers or directors of a bank may be removed by the institution’s federal supervisory agency; (ii) places constraints on lending by a bank to its executive officers, directors, principal shareholders, and their related interests; and (iii) generally prohibits management personnel of a bank from serving as directors or in other management positions of another financial institution whose assets exceed a specified amount or which has an office within a specified geographic area.

16

Table of Contents

Safety and Soundness Standards. Certain non-capital safety and soundness standards are also imposed upon banks. These standards cover internal controls, information systems and internal audit, loan documentation, credit underwriting, interest rate exposure, asset growth, compensation, fees and benefits, such other operational and managerial standards as the agency determines to be appropriate, and standards for asset quality, earnings, and stock valuation. An institution that fails to meet these standards may be subject to regulatory sanctions, including limitations on growth. Columbia Bank has established policies and risk management activities designed to ensure the safety and soundness of the Bank.

Interstate Banking and Branching

The Interstate Act together with the Dodd-Frank Act relaxed prior interstate branching restrictions under federal law by permitting, subject to regulatory approval, state and federally chartered commercial banks to establish branches in states where the laws permit banks chartered in such states to establish branches. The Interstate Act requires regulators to consult with community organizations before permitting an interstate institution to close a branch in a low-income area. Federal banking agency regulations prohibit banks from using their interstate branches primarily for deposit production and the federal banking agencies have implemented a loan-to-deposit ratio screen to ensure compliance with this prohibition.

Dividends

Columbia is a legal entity separate and distinct from the Bank and its other subsidiaries. As a bank holding company, Columbia is subject to certain restrictions on its ability to pay dividends under applicable banking laws and regulations. Federal bank regulators are authorized to determine under certain circumstances relating to the financial condition of a bank holding company or a bank that the payment of dividends would be an unsafe or unsound practice and to prohibit payment thereof. In particular, federal bank regulators have stated that paying dividends that deplete a banking organization’s capital base to an inadequate level would be an unsafe and unsound banking practice and that banking organizations should generally pay dividends only out of current operating earnings. In addition, in the current financial and economic environment, the Federal Reserve has indicated that bank holding companies should carefully review their dividend policy and has discouraged payment ratios that are at maximum allowable levels unless both asset quality and capital are very strong. Federal Reserve policy also provides that a bank holding company should inform the Federal Reserve reasonably in advance of declaring or paying a dividend that exceeds earnings for the period for which the dividend is being paid or that could result in a material adverse change to the bank holding company’s capital structure.

A significant portion of our income comes from dividends from the Bank, which is also the primary source of our liquidity. In addition to the restrictions discussed above, the Bank is subject to limitations under Oregon law regarding the level of dividends that it may pay to the Company. Oregon law provides that a bank may not pay dividends greater than the bank’s unreserved retained earnings, deducting therefrom, to the extent not already charged against earnings or reflected in a reserve, all bad debts, which are debts on which interest is past due and unpaid for at least six months, unless the debt is fully secured and in the process of collection; all other assets charged-off as required by Oregon bank regulators or a state or federal examiner; and all accrued expenses, interest and taxes of the institution. Under the Oregon Bank Act and the Federal Deposit Insurance Corporation Improvement Act of 1991, Columbia Bank is subject to restrictions on the payment of cash dividends to its parent company and may be required to receive prior approval in certain circumstances. In addition, state and federal regulatory authorities are authorized to prohibit banks and holding companies from paying dividends that would constitute an unsafe or unsound banking practice. The Bank currently has an accumulated deficit and is required to seek FDIC and DCBS approval for dividends from Columbia Bank to the Company.

Regulatory Capital Requirements

The Federal Reserve monitors the capital adequacy of the Company on a consolidated basis, and the FDIC and the DCBS will monitor the capital adequacy of the Bank. The Capital Rules are based on the December 2010 final capital framework for strengthening international capital standards, known as Basel III, of the Basel Committee. As of December 31, 2025, Columbia and the Bank met all capital adequacy requirements under the Capital Rules, as described below.

The Capital Rules, among other things (i) include a capital measure called CET1, (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting specified requirements, and (iii) define CET1 narrowly by requiring that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital. Under the Capital Rules, the minimum capital ratios are (i) 4.5% CET1 to risk-weighted assets, (ii) 6% Tier 1 capital (that is, CET1 plus Additional Tier 1 capital) to risk-weighted assets, and (iii) 8% total capital (that is, Tier 1 capital plus Tier 2 capital) to risk-weighted assets.

17

Table of Contents

The Capital Rules also require an institution to establish a capital conservation buffer of CET1 in an amount above the minimum risk-based capital requirements for “adequately capitalized” institutions equal to 2.5% of total risk-weighted assets. Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the capital conservation buffer will face constraints on dividends, equity repurchases and compensation based on the amount of the shortfall and the institution’s “eligible retained income” (that is, the greater of (i) net income for the preceding four quarters, net of distributions and associated tax effects not reflected in net income and (ii) average net income over the preceding four quarters).

The Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, certain deferred tax assets and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. The Capital Rules also generally preclude certain hybrid securities, such as trust preferred securities, from being counted as Tier 1 capital for most bank holding companies.

In addition, the Company and the Bank are subject to the final rule adopted by the Federal Reserve, OCC and FDIC in July 2019 relating to simplifications of the capital rules applicable to non-advanced approaches banking organizations. These rules became effective for the Company on April 1, 2020 and provide for simplified capital requirements relating to the threshold deductions for mortgage servicing assets, deferred tax assets arising from temporary differences that a banking organization could not realize through net operating loss carry backs, and investments in the capital of unconsolidated financial institutions, as well as the inclusion of minority interests in regulatory capital.

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms. The standards are commonly referred to as “Basel IV.” Among other things, these standards revise the Basel Committee’s standardized approach for credit risk (including by recalibrating risk-weights and introducing new capital requirements for certain “unconditionally cancellable commitments,” such as home equity lines of credit) and provide a new standardized approach for operational risk capital. The Basel framework standards have been generally effective since January 1, 2023, with an aggregate output floor phasing in through January 1, 2028.

In September 2025, the Federal Reserve Vice Chair for Supervision, Michelle Bowman, stated that the Federal Reserve, the OCC and the FDIC are working together to repropose, with industry-friendly modifications, the set of capital requirement rules for large banks based upon the standards commonly referred to as “Basel III Endgame.” The Basel III Endgame framework, which would significantly increase capital requirements for global systemically important banks and a moderate increase for regional banks with over $100 billion assets and would change the way such banks are required to calculate risk-weighted assets, would only be applicable to banks with at least $100 billion in assets. Such proposed rules implementing Basel III Endgame are expected to be introduced in early 2026. Although the rules implementing Basel III Endgame would not be applicable to the Company at this time, there is no guarantee they may not be applicable at a future time.

The Bank is also subject to the prompt corrective action regulations pursuant to Section 38 of the FDIA. See “Prompt Corrective Action Framework” below.

Prompt Corrective Action Framework

The FDIA requires the federal bank regulators to take prompt corrective action in respect of depository institutions that fail to meet specified capital requirements. The FDIA establishes five capital categories (“well-capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized”), and the federal bank regulators are required to take certain mandatory supervisory actions, and are authorized to take other discretionary actions, with respect to institutions that are undercapitalized, significantly undercapitalized, or critically undercapitalized. The severity of these mandatory and discretionary supervisory actions depends upon the capital category in which the institution is placed. Generally, subject to a narrow exception, the FDIA requires the regulator to appoint a receiver or conservator for an institution that is critically undercapitalized.

18

Table of Contents

Under the rules currently in effect, the following table presents the requirements for an IDI to be classified as well-capitalized or adequately capitalized:

An institution may be downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios if it is determined to be in an unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters. A bank’s capital category is determined solely for the purpose of applying prompt corrective action regulations, and the capital category may not constitute an accurate representation of the Bank’s overall financial condition or prospects for other purposes.

As of December 31, 2025, the Company and the Bank met the capital requirements to be well-capitalized with CET1 capital ratios of 11.80% and 12.32%, respectively, Tier 1 capital ratios of 11.80% and 12.32%, respectively, total capital ratios of 13.63% and 13.26%, respectively, and Tier 1 leverage ratios of 9.29% and 9.70%, respectively.

An institution that is categorized as undercapitalized, significantly undercapitalized or critically undercapitalized is required to submit an acceptable capital restoration plan to its appropriate federal bank regulator. Under the FDIA, in order for the capital restoration plan to be accepted by the appropriate federal banking agency, a bank holding company must guarantee that a subsidiary depository institution will comply with its capital restoration plan, subject to certain limitations. The bank holding company must also provide appropriate assurances of performance. The obligation of a controlling bank holding company under the FDIA to fund a capital restoration plan is limited to the lesser of 5% of an undercapitalized subsidiary’s assets or the amount required to meet regulatory capital requirements. An undercapitalized institution is also generally prohibited from increasing its average total assets, making acquisitions and capital distributions, establishing any branches, or engaging in any new line of business, except in accordance with an accepted capital restoration plan or with the approval of the FDIC. Institutions that are undercapitalized or significantly undercapitalized and either fail to submit an acceptable capital restoration plan or fail to implement an approved capital restoration plan may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become adequately capitalized, requirements to reduce total assets and cessation of receipt of deposits from correspondent banks. Critically undercapitalized depository institutions failing to submit or implement an acceptable capital restoration plan are subject to appointment of a receiver or conservator.

Resolution Planning

In June 2024, the FDIC issued a final rule that revised its then existing rule that requires the submission of resolution plans by IDI’s with $50 billion or more in total assets. Under the final rule, IDI’s with more than $50 billion in total assets, but less than $100 billion in total assets, must submit a full informational filing to the FDIC every three years, with interim supplements to be submitted in years that an informational filing is not required. The final rule also contains a credibility standard which provides that an informational filing can be found “not credible” if the information and analysis in the informational filing are not supported with observable and verifiable capabilities and data and reasonable projections, or the IDI fails to comply in all material respects with the requirements of the final rule. The information filing does not require, among other things, development of an identified strategy for resolution of the IDI in a failure scenario. Columbia Bank’s initial informational filing under the final rule will be due on or before July 1, 2026.

Brokered Deposits

The FDIA prohibits an IDI from accepting brokered deposits or offering interest rates on any deposits significantly higher than the prevailing rate in the Bank’s normal market area or nationally (depending upon where the deposits are solicited) unless it is well-capitalized or is adequately capitalized and receives a waiver from the FDIC. A depository institution that is adequately capitalized and accepts brokered deposits under a waiver from the FDIC may not pay an interest rate on any deposit in excess of 75 basis points over certain prevailing market rates.

19

Table of Contents

Regulatory Oversight and Examination

The Federal Reserve conducts periodic inspections of bank holding companies. The supervisory objectives of the inspection program are to ascertain whether the financial strength of the bank holding company is being maintained on an ongoing basis and to determine the effects or consequences of transactions between a holding company or its non-banking subsidiaries and its subsidiary banks.

Banks are subject to periodic examinations by their primary regulators. Bank examinations have evolved from reliance on transaction testing in assessing a bank’s condition to a risk-focused approach. These examinations are extensive and cover the entire breadth of operations of the Bank. Generally, FDIC safety and soundness examinations for a bank of our size are completed on an annual basis through the execution of a quarterly focal review process. The FDIC and state bank regulatory agencies complete these examinations on a combined schedule.

In October 2025, the FDIC and OCC issued a joint notice of proposed rulemaking that would codify the removal of reputation risk from their respective supervisory programs. The proposed rule would prohibit the FDIC or OCC from taking any adverse action against a supervised institution on the basis of reputational risk or encouraging a supervised institution to take any action or refrain from taking any action against any person on the basis of reputational risk. The proposed rule has not been finalized as of the date of this Annual Report on Form 10-K.

The CFPB has primary examination and enforcement authority over institutions with assets of $10 billion or more, including the Bank, with respect to various federal consumer protection laws, and we are subject to continued examination by the FDIC on certain consumer regulations. State authorities are also responsible for monitoring our compliance with all state consumer laws.

The frequency of consumer compliance and CRA examinations is linked to the size of the institution and its compliance and CRA ratings at its most recent examinations. However, the examination authority of the Federal Reserve and the FDIC allows them to examine supervised banks as frequently as deemed necessary based on the condition of the supervised bank or as a result of certain triggering events.

Financial Privacy

Under the Gramm-Leach-Bliley Act of 1999, as amended, a financial institution may not disclose non-public personal information about a consumer to unaffiliated third parties unless the institution satisfies various disclosure requirements and the consumer has not elected to opt out of the information sharing. The financial institution must provide its customers with a notice of its privacy policies and practices. The Federal Reserve, the FDIC, and other financial regulatory agencies issued regulations implementing notice requirements and restrictions on a financial institution's ability to disclose non-public personal information about consumers to unaffiliated third parties.

In addition, privacy and data protection are areas of increasing state legislative focus, and several states have recently enacted consumer privacy laws that impose significant compliance obligations with respect to personal information. For example, the Company is subject to the CCPA and its implementing regulations. The CCPA gives consumers the right to request disclosure of information collected about them, and whether that information has been sold or shared with others, the right to request deletion of personal information (subject to certain exceptions), the right to opt out of the sale of the consumer’s personal information, and the right not to be discriminated against for exercising these rights. The CCPA contains several exemptions, including an exemption applicable to information that is collected, processed, sold, or disclosed pursuant to the Gramm-Leach-Bliley Act of 1999, as amended. In November 2020, voters in the CPRA, a ballot measure that amends and supplements the CCPA by, among other things, expanding certain rights relating to personal information and its use, collection, and disclosure by covered businesses. The key provisions of the CPRA became effective on January 1, 2023, with civil and administrative enforcement of the CPRA beginning July 1, 2023. In September 2025, the California Privacy Protection Agency finalized regulations under the CCPA that, among other things, require business to conduct risk assessments prior to processing personal data if such processing presents a “significant risk” to consumers privacy and to provide consumers notice and the ability to opt out when automated-decision making technology is used to make significant decisions. Similar laws may in the future be adopted by other states where the Company does business. The Company has made and will make operational adjustments in accordance with the requirements of the CCPA and other state privacy laws. Furthermore, privacy and data protection areas are expected to receive further attention at the federal level. The potential effects of state or federal privacy and data protection laws on the Company’s business cannot be determined at this time and will depend both on whether such laws are adopted by states in which the Company does business and/or at the federal level and the requirements imposed by any such laws.

20

Table of Contents

Cybersecurity

The federal banking agencies have established certain expectations with respect to an institution's information security and cybersecurity programs, with an increasing focus on risk management, processes related to information technology and operational resiliency, and the use of third parties in the provision of financial services. In October 2016, the federal banking agencies jointly issued an advance notice of proposed rulemaking on enhanced cybersecurity risk-management and resilience standards that would address five categories of cyber standards which include (i) cyber risk governance, (ii) cyber risk management, (iii) internal dependency management, (iv) external dependency management, and (v) incident response, cyber resilience, and situational awareness. The federal banking agencies have not yet taken further action on these proposed standards.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs with detailed requirements, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. For example, in September 2025, the California Privacy Protection Agency finalized regulations under the CCPA relating to annual cybersecurity audits for all businesses that have over $25 million in annual revenue and either (i) process personal information of at least 250,000 California consumers or households or (ii) process sensitive personal information of at least 50,000 California consumers or households. We expect this trend of state-level cybersecurity regulation to continue and are continually monitoring developments in the states in which the Company operates.

In February 2018, the SEC published interpretive guidance to assist public companies in preparing disclosures about cybersecurity risks and incidents. These SEC guidelines, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations. In addition, on July 26, 2023, the SEC adopted rules that require reporting in Current Reports on Form 8-K of material cybersecurity incidents. These rules also require disclosures in Annual Reports on Form 10-K describing (i) the processes for assessing, identifying and managing material risks from cybersecurity threats, (ii) the material effects or reasonably likely material effects of risks from cybersecurity threats and previous cybersecurity incidents, and (iii) the board of directors’ oversight of risks from cybersecurity threats and management’s role and expertise in assessing and managing material risks from cybersecurity threats.

In November 2021, the U.S. federal bank regulatory agencies adopted a rule regarding notification requirements for banking organizations related to significant computer security incidents. Under the final rule, a bank holding company, such as the Company, and an FDIC-supervised IDI, such as the Bank, are required to notify the Federal Reserve or FDIC, respectively, within 36 hours of incidents that have materially disrupted or degraded, or are reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector.

Corporate Governance and Accounting

SOX addresses, among other things, corporate governance, auditing and accounting, enhanced and timely disclosure of corporate information, and penalties for non-compliance. Generally, SOX (i) requires CEOs and CFOs to certify the accuracy of periodic reports filed with the SEC; (ii) imposes specific and enhanced corporate disclosure requirements; (iii) accelerates the time frame for reporting of insider transactions and periodic disclosures by public companies; (iv) requires companies to adopt and disclose information about corporate governance practices, including whether or not they have adopted a code of ethics for senior financial officers and whether the audit committee includes at least one “audit committee financial expert;” and (v) requires the SEC, based on certain enumerated factors, to regularly and systematically review corporate filings.

Deposit Insurance

The Bank’s deposits are insured under the FDIA up to the maximum applicable limits and are subject to deposit insurance assessments designed to tie what banks pay for deposit insurance to the risks they pose. Under the FDIC’s assessment system for determining payments to the DIF, large IDIs with more than $10 billion in assets are assessed under a complex “scorecard” methodology that seeks to capture both the probability that an individual large IDI will fail and the magnitude of the impact on the DIF if such a failure occurs. The assessment base of a large IDI is its total assets less tangible equity.

21

Table of Contents

In November 2023, the FDIC finalized a rule that imposes special assessments to recover the losses to the DIF resulting from the FDIC’s use, in March 2023, of the systemic risk exception to the least-cost resolution test under the FDIA in connection with the receiverships of Silicon Valley Bank and Signature Bank. The FDIC estimated in approving the rule that those assessed losses total approximately $16.3 billion. The rule provides that this loss estimate will be periodically adjusted, which will affect the amount of the special assessment. As of September 30, 2025, the FDIC’s total loss estimate to be recovered through the special assessment was $16.7 billion. Under the final rule, the assessment base is the estimated uninsured deposits that an IDI reported in its December 31, 2022 Call Report, excluding the first $5 billion in estimated uninsured deposits. The special assessments were collected at an annual rate of approximately 13.4 basis points per year (3.36 basis points per quarter) over eight quarters in 2024 and 2025, with the first assessment period beginning January 1, 2024. Because the estimated loss pursuant to the systemic risk determination will be periodically adjusted, the FDIC retains the ability to cease collection early, extend the special assessment collection period and impose a final shortfall special assessment on a one-time basis. In an interim final rule approved in December 2025 by the FDIC, the special assessment rate was reduced to 2.97 basis points for the eighth and final quarter. For additional discussion of this special assessment, see the section entitled "Non-Interest Expense" under Item 7 of this Annual Report on Form 10-K.

The Volcker Rule

The Dodd-Frank Act prohibits banks and their affiliates from engaging in proprietary trading and investing in and sponsoring hedge funds and private equity funds. The statutory provision is commonly called the “Volcker Rule.” The Volcker Rule does not significantly impact the operations of the Company and the Bank, as we do not have any significant engagement in the businesses prohibited by the Volcker Rule.

Interchange Fees

The Company is subject to rules governing interchange fees, which establish standards for assessing whether the interchange fees that may be charged with respect to certain electronic debit transactions are “reasonable and proportional” to the costs incurred by issuers for processing such transactions.

Interchange fees, or “swipe” fees, are charges that merchants pay to us and other card-issuing banks for processing electronic payment transactions. Under applicable rules, the maximum permissible interchange fee is equal to no more than 21 cents plus 5 basis points of the transaction value for many types of debit interchange transactions. The Federal Reserve also adopted a rule to allow a debit card issuer to recover one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements required by the Federal Reserve. The Federal Reserve also has rules governing routing and exclusivity that require issuers to offer two unaffiliated networks for routing transactions on each debit or prepaid product. In October 2023, the Federal Reserve issued a proposed rule that would reduce the maximum permissible interchange fee to 14.4 cents plus 4 basis points of the transaction value plus 1.3 cents in adjustments for fraud prevention purposes for many types of debit interchange transactions. The proposed rule also included a mechanism to automatically update the maximum permissible interchange fee every two years based on responses to the debit card issuer survey. In August 2025, a federal district court vacated the Federal Reserve’s 2011 Regulation II interchange fee cap rule, with the decision stayed pending appeal.

Incentive Compensation

The Dodd-Frank Act requires the federal bank regulators and the SEC to establish joint regulations or guidelines prohibiting incentive-based payment arrangements at specified regulated entities, including us and the Bank, having at least $1 billion in total assets that encourage inappropriate risks by providing an executive officer, employee, director or principal stockholder with excessive compensation, fees, or benefits or that could lead to material financial loss to the entity. In addition, these regulators must establish regulations or guidelines requiring enhanced disclosure to regulators of incentive-based compensation arrangements.

In June 2010, the Federal Reserve and FDIC issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that appropriately balance risk and financial results in a manner that does not encourage employees to expose their organizations to imprudent risk, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

22

Table of Contents

During the second quarter of 2016, the U.S. financial regulators, including the Federal Reserve and the SEC, first proposed revised rules on incentive-based payment arrangements at specified regulated entities having at least $1 billion in total assets. In May and July 2024, the Federal Housing Finance Agency, the FDIC, the National Credit Union Administration, and the OCC re-proposed the revised rules on incentive-based payment arrangements that prohibit incentive-based compensation that encourages inappropriate risk. However, the Federal Reserve and the SEC have so far declined to join the other U.S. financial regulators in re-proposing the revised rules which are legislatively mandated to be a joint rule among the six aforementioned U.S. financial regulators.

The Federal Reserve will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as us, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements or related risk management control or governance processes pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

In October 2023, Nasdaq adopted a rule as required by the SEC’s 2022 rule-making that requires listed companies to adopt policies mandating the recovery or “clawback” of excess incentive-based compensation earned by a current or former executive officer during the three fiscal years preceding a required accounting restatement, including to correct an error that would result in a material misstatement if the error were corrected in the current period or left uncorrected in the current period. The excess compensation would be based on the amount the executive officer would have received had the incentive-based compensation been determined using the restated financials. Effective as of December 1, 2023, Columbia adopted a clawback policy in accordance with Nasdaq’s listing standards.

Proposed Legislation

Proposed legislation relating to the banking industry is introduced in almost every legislative session. Certain of such legislation could dramatically affect the regulation of the banking industry. We cannot predict if any such legislation will be adopted or if it is adopted how it would affect the business of Columbia Bank or the Company.

Effects of Government Monetary Policy

Our earnings and growth are affected not only by general economic conditions, but also by the fiscal and monetary policies of the federal government, particularly the Federal Reserve. The Federal Reserve implements national monetary policy for such purposes as curbing inflation and combating recession, but its open market operations in U.S. government securities, control of the discount rate applicable to borrowings from the Federal Reserve, and establishment of reserve requirements against certain deposits influence the growth of bank loans, investments and deposits and also affect interest rates charged on loans or paid on deposits. The nature and impact of future changes in monetary policies and their impact on us cannot be predicted with certainty.