EAGLE BANCORP INC (EGBN) Business

ITEM 1.    BUSINESS

In this report, unless otherwise expressly stated or the context otherwise requires, the terms "we," "us," the "Company," "Eagle" and "our" refer to Eagle Bancorp, Inc. and our subsidiaries on a consolidated basis, except in the description of any of our securities, in which case these terms refer solely to Eagle Bancorp, Inc. and not to any of our subsidiaries. References to "EagleBank" or "Bank" refer to EagleBank, which is our principal operating subsidiary. This report contains additional trade names and trademarks of other companies. We do not intend our use or display of other companies' trade names or trademarks to imply an endorsement or sponsorship of us by such companies or any relationship with any of these companies.

Eagle Bancorp, Inc. (the "Company"), headquartered in Bethesda, Maryland, was incorporated under the laws of the State of Maryland on October 28, 1997, to serve as the bank holding company for EagleBank (the "Bank"). The Company was formed by a group of local businessmen and professionals with significant prior experience in community banking in the Company’s market area, together with an experienced community bank senior management team.

The Bank, a Maryland chartered commercial bank, which is a member of the Federal Reserve System ("Federal Reserve Board," "Federal Reserve" or "FRB"), is the Company’s principal operating subsidiary. It commenced banking operations on July 20, 1998. The Bank currently operates twelve branch offices: six in Suburban Maryland; three located in the District of Columbia; and three in Northern Virginia. The Bank also has four lending centers and utilizes various digital capabilities, including remote deposit services and mobile banking services. The Bank maintains its physical presence via branches and lending centers consistent with its strategic plan.

The Bank has three active direct subsidiaries: Bethesda Leasing, LLC, Eagle Insurance Services, LLC and Landroval Municipal Finance, Inc. Bethesda Leasing, LLC holds title to and operates real estate owned and acquired through foreclosure. Eagle Insurance Services, LLC, which previously offered access to insurance products and services through a referral program with a third-party insurance broker, continues to receive fee income in connection with such program. Landroval Municipal Finance, Inc. focuses on lending to municipalities by buying debt on the public market as well as direct purchase issuance.

The Bank operates as a community bank alternative to the super-regional financial institutions that dominate its primary market area. The cornerstone of the Bank’s philosophy is to provide superior, personalized service to its clients. The Bank focuses on relationship banking, providing each client with a number of services, familiarizing itself with, and addressing itself to, client needs in a proactive, personalized fashion. Management believes that the Bank’s target market segments, small, medium and middle-sized for profit and non-profit businesses and the consumer base working or living in and near the Bank’s market area, demand the convenience and personal service that an independent locally based financial institution such as the Bank can offer. These themes of convenience and proactive personal service form the basis for the Bank’s business development strategies.

Over its twenty-seven year history, the Company has grown primarily through organic growth, but also has completed two whole bank acquisitions. On August 31, 2008, the Company acquired Fidelity & Trust Financial Corporation ("Fidelity") and on October 31, 2014 acquired Virginia Heritage Bank ("Virginia Heritage").

Description of Services. The Bank offers a broad range of commercial banking services to its business and professional clients, as well as consumer banking services to individuals living and/or working primarily in the Bank’s market area. These services include (i) commercial loans for a variety of business purposes such as for working capital, equipment purchases, real estate lines of credit and government contract financing; (ii) asset based lending and accounts receivable financing (on a limited basis); (iii) construction and commercial real estate loans; (iv) business equipment financing; (v) consumer home equity lines of credit, personal lines of credit and term loans; (vi) consumer installment loans such as auto and personal loans; and (vii) personal credit cards offered through an outside vendor.

The Bank emphasizes providing commercial banking services to sole proprietors, small, medium and middle-sized businesses, partnerships, corporations, non-profit organizations and associations and investors generally living and working in and near the Bank’s primary service area. A full range of retail banking services are offered to accommodate the individual needs of both corporate customers as well as the community the Bank serves. The Bank also offers online banking, mobile banking and a remote deposit service, which allows clients to facilitate and expedite deposit transactions through the use of electronic devices. A suite of Treasury Management services is also offered to business clients. The Bank’s deposits are insured by the Federal Deposit Insurance Corporation ("FDIC") to the fullest extent provided by law.

The Bank’s loan portfolio consists primarily of traditional business and real estate secured loans. Commercial and industrial loans are made, with a substantial portion having variable and adjustable rates, where the cash flow of the borrower's operating business is the principal source of debt service with a secondary emphasis on collateral. Real estate loans are made generally for commercial purposes and are structured using both variable and fixed rates and renegotiable rates which adjust in three to five years, with maturities of generally five to ten years. Commercial real estate loans, which comprise the largest portion of the loan portfolio, are secured by both owner occupied and non-owner occupied real property and include a component of acquisition, development and construction ("ADC") lending.

The Bank’s consumer loan portfolio is a smaller portion of the loan portfolio and primarily includes home equity loans and lines of credit that are structured with an interest only draw period followed either by a balloon maturity or a fully amortized repayment schedule.

The Bank is also a preferred lender under the Small Business Administration's ("SBA") Preferred Lender Program. As a preferred lender, the Bank can originate certain SBA loans in-house without prior SBA approval. SBA loans are made through programs designed by the federal government to assist the small business community in obtaining financing from financial institutions that are given government guarantees as an incentive to make the loans. Under certain circumstances, the Bank attempts to further mitigate commercial term loan losses by using loan guarantee programs offered by the SBA. SBA lending is subject to federal legislation that can affect the availability and funding of the program. From time to time, this dependence on legislative funding causes limitations and uncertainties with regard to the continued funding of such programs, which could potentially have an adverse financial impact on our business.

Up until the second half of 2024, the Company originated multifamily Federal Housing Administration ("FHA") loans through the Department of Housing and Urban Development's Multifamily Accelerated Program. The Company securitized these loans through the Government National Mortgage Association ("Ginnie Mae") MBS I program and sold the resulting securities in the open market to authorized dealers in the normal course of business and periodically bundled and sold the servicing rights. As of December 31, 2024, the Company had exited this business.

The Bank's lending activities carry the risk that the borrowers will be unable to perform on their obligations. As such, interest rate policies of the Federal Reserve and general economic conditions, nationally and in the Bank’s primary market area, could have a significant impact on the Bank’s and the Company’s results of operations. To the extent that economic conditions deteriorate, business and individual borrowers may be less able to meet their obligations to the Bank in full, in a timely manner, resulting in decreased earnings or losses to the Bank. Economic conditions may also adversely affect the value of property pledged as security for loans.

The Bank's goal is to mitigate risks in the event of unforeseen threats to the loan portfolio as a result of economic downturn or other negative influences. Plans for mitigating inherent risks in managing loan assets include: designing and enforcing loan policies and procedures to mitigate those risks, evaluating each borrower’s business plan during the underwriting process, identifying and monitoring primary and alternative sources for loan repayment and obtaining collateral to mitigate economic loss in the event of liquidation. Specific loan reserves may be established based upon credit and/or collateral risks on an individual loan basis. A risk rating system is employed to proactively estimate loss exposure and provide a measuring system for setting general and specific reserve allocations.

The composition of the Company’s loan portfolio is heavily weighted toward commercial real estate, both owner occupied and income producing. As of December 31, 2025, owner occupied commercial real estate and construction – commercial and industrial ("C&I") (owner occupied) represented approximately 23% of the loan portfolio while non-owner occupied commercial real estate and real estate construction represented approximately 57% of the loan portfolio. The combined owner and non-owner occupied and commercial real estate loans represented approximately 80% of the loan portfolio. Real estate also serves as collateral for loans made for other purposes, resulting in a combined total 82% of all loans in our portfolio being secured or partially secured by real estate. These loans are underwritten to mitigate lending risks typical of this type of loan such as declines in real estate values, changes in borrower cash flow and general economic conditions. The Bank typically requires a maximum loan-to-value ("LTV") ratio of 80% and a minimum debt service coverage ratio ("DSCR") of 1.15 to 1.0. Personal guarantees may be required but may be limited. In making real estate commercial mortgage loans, the Bank generally requires that interest rates adjust not less frequently than five years.

The Company is also an active traditional commercial lender providing loans for a variety of purposes, including working capital, equipment, accounts receivable financing and other corporate purposes. The Company's underwriting standards address collateral and debt service cash flow. Personal guarantees are generally required, but may be limited. In originating SBA loans, the Company assumes the risk of non-payment on the unguaranteed portion of the credit. The Company generally sells the guaranteed portion of the loan generating noninterest income

from the gains on sale, as well as servicing income on the portion participated. SBA loans other than Paycheck Protection Program ("PPP") loans are subject to the same cash flow analyses as other commercial loans. SBA loans are subject to a maximum loan size established by the SBA as well as internal loan size guidelines. Refer to "Note 4 – Loans and Allowance for Credit Losses" to the Consolidated Financial Statements for additional information regarding loan origination and risk management.

Our lending activities are subject to a variety of borrower lending limits imposed by state and federal law. These limits will increase or decrease in response to increases or decreases in the Bank’s level of capital. As of December 31, 2025, the Bank had a legal lending limit of $195.0 million. As of December 31, 2025, the average loan size outstanding for Commercial Real Estate ("CRE") and C&I loans were $7.5 million and $1.7 million, respectively. In accordance with internal lending policies, the Bank may sell participations in its loans to other banks, which allows the Bank to manage risk involved in these loans and to meet the lending needs of its clients. The risk of nonpayment (or deferred payment) of loans is inherent in all lending. The Bank’s marketing focus on small to medium-sized businesses may result in the assumption by the Bank of certain lending risks that are different from those associated with loans to larger companies. Management and/or committees of the Bank carefully evaluate loan applications and attempt to minimize credit risk exposure by use of loan application data, due diligence and approval and monitoring procedures; however, there can be no assurance that such procedures can significantly reduce such lending risks.

Loans are secured primarily by duly recorded first deeds of trust or mortgages. In some cases, the Bank may accept a recorded junior trust position. In general, borrowers will have a proven ability to build, lease, manage and/or sell a commercial or residential project and demonstrate satisfactory financial condition. Additionally, an equity contribution toward the project is generally required whether associated with acquisition or construction of a property.

The general terms and underwriting standards for each type of commercial real estate and construction loan are incorporated into the Bank’s lending policies. These policies are analyzed periodically by management, and the policies are reviewed and re-approved periodically by either the Board of Directors (the "Board") or a designated committee thereof. The Bank’s loan policies and practices described in this report are subject to periodic change, and each guideline or standard is subject to waiver or exception in the case of any particular loan, by the appropriate officer or committee, in accordance with the Bank’s loan policies. Loan policy standards are often stated in mandatory terms, such as "shall" or "must," but these provisions are subject to exceptions. Policy requires that loan value not exceed a percentage of "market value" or "fair value" based upon appraisals or evaluations obtained in the ordinary course of the Bank’s underwriting practices.

Construction loans require that the financial condition and experience of the general contractor and major subcontractors be satisfactory to the Bank. Guaranteed, fixed price contracts are required whenever appropriate, along with payment and performance bonds or completion bonds for larger scale projects.

Loans intended for residential land acquisition, lot development and construction are made on the premise that the land: (1) is or will be developed for building sites for residential structures; and (2) will ultimately be utilized for construction or improvement of residential zoned real properties, including the creation of housing. Residential development and construction loans will finance projects such as single family subdivisions, planned unit developments, townhouses and condominiums. Residential land ADC loans generally are underwritten with a maximum term of 36 months, including extensions approved at origination.

Commercial land acquisition and construction loans are secured by real property where loan funds will be used to acquire land and to construct or improve appropriately zoned real property for the creation of income producing or owner-user commercial properties. Borrowers are generally required to put equity into each project at levels determined by the appropriate loan committee. Commercial land acquisition and construction loans generally are underwritten with a maximum term of 24 months.

LTV ratios, with few exceptions, are maintained consistent with or below supervisory guidelines.

Substantially all construction draw requests must be presented in writing on American Institute of Architects documents and certified either by the contractor, the borrower and/or the borrower’s architect. The Company's policies also provide that each draw request shall also include the borrower’s soft cost breakdown certified by the borrower or their Chief Financial Officer. Prior to an advance, to justify the draw requisition, the Bank or its contractor inspects the project to determine that the work has been completed.

Commercial permanent loans are generally secured by improved real property, which is generating income in the normal course of operation. Debt service coverage, assuming stabilized occupancy, must be satisfactory to support

a permanent loan. The DSCR is ordinarily at least 1.15 to 1.0. As part of the underwriting process, DSCRs are generally stress tested assuming a 200 basis point increase in interest rates from their current levels.

Commercial permanent loans generally are underwritten with a term not greater than 10 years or the remaining useful life of the property, whichever is lower. The preferred term is between 5 to 7 years, with amortization to a maximum of 25 years.

Personal guarantees are generally received from the principals on commercial real estate loans, and only in instances where the LTV is sufficiently low and the debt service coverage is sufficiently high is consideration given to either limiting or not requiring personal recourse.

Updated appraisals for real estate secured loans are obtained based on factors relating to borrower financial condition, project status, loan terms and market conditions.

The Company’s loan portfolio includes ADC real estate loans including both investment and owner occupied projects. ADC loans amounted to $1.2 billion as of December 31, 2025. A portion of the ADC portfolio, both speculative and non-speculative, includes loan funded interest reserves at origination. ADC loans that provide for the use of interest reserves represented approximately 38% of the outstanding ADC loan portfolio as of December 31, 2025. The decision to establish a loan-funded interest reserve is made upon origination of the ADC loan and is based upon a number of factors considered during underwriting of the credit including: (1) the feasibility of the project; (2) the experience of the sponsor; (3) the creditworthiness of the borrower and guarantors; (4) borrower equity contribution; and (5) the level of collateral protection.

When appropriate, an interest reserve provides an effective means of addressing the cash flow characteristics of a properly underwritten ADC loan, although as with all lending activities the Company remains exposed to credit risk. The Company does not significantly utilize interest reserves in other loan products. The Company recognizes that one of the risks inherent in the use of interest reserves is the potential masking of underlying problems with the project and/or the borrower’s ability to repay the loan. In order to mitigate this inherent risk, the Company employs a series of reporting and monitoring mechanisms on all ADC loans, whether or not an interest reserve is provided, including: (1) construction and development timelines which are monitored on an ongoing basis which track the progress of a given project to the timeline projected at origination; (2) a construction loan administration department independent of the lending function; (3) third-party independent construction loan inspection reports; (4) monthly interest reserve monitoring reports detailing the balance of the interest reserves approved at origination and the days of interest carry represented by the reserve balances as compared to the then current anticipated time to completion and/or sale of speculative projects; and (5) quarterly commercial real estate construction meetings among senior Company management, which includes monitoring of current and projected real estate market conditions. If a project has not performed as expected, it is not the customary practice of the Company to increase loan funded interest reserves.

As part of its overall risk assessments, management reviews the Bank’s loan portfolio and general economic and market conditions on a regular basis and will continue to adjust both quantitative and qualitative reserve factors as necessary.

Deposit services include business and personal checking accounts, Negotiable Order of Withdrawal ("NOW") accounts, tiered savings and money market accounts and time deposits with varying maturity structures and customer options. A complete individual retirement account program is available. The Bank also participates in the IntraFi Network, LLC ("IntraFi") Certificate of Deposit Account Registry Service ("CDARS") and its Insured Cash Sweep ("ICS") program, both of which function to provide greater FDIC insurance coverage for participating Bank customers. The Bank also utilizes brokered deposit funds in its overall asset/liability management program.

The Bank historically has offered a full range of online banking services for both personal and business accounts and has a Mobile Banking application. In early 2024, the Bank launched a new online and mobile banking digital platform as the Bank seeks to further modernize its deposit offerings to its customers. Deposit services associated with this digital platform are available and marketed outside of the Bank's immediate market area across the United States. This digital banking platform is predominantly focused on Certificates of Deposits and High Yield Savings Accounts. Other deposit services offered by the Bank within our Washington, D.C. metropolitan area market include cash management services, business sweep accounts, lockbox, remote deposit capture, account reconciliation services, merchant card services, safe deposit boxes and Automated Clearing House origination. After-hours depositories and automated teller machine ("ATM") service are also available.

The Company and Bank maintain portfolios of short term investments and investment securities consisting primarily of U.S. agency bonds and government sponsored enterprise mortgage-backed securities, municipal bonds and corporate bonds. The Bank also owns equity investments related to membership in the Federal Reserve and the

Federal Home Loan Bank of Atlanta ("FHLB"). The Company’s securities also include equity investments in the form of common stock of two local banking companies. These equity investments are categorized as Other Assets and not accounted for in the Fixed Income Securities tables. The investment securities portfolio provides the following objectives: capital preservation, liquidity management, additional income to the Company and Bank in the form of interest, collateral to facilitate borrowing arrangements and assistance with meeting interest rate risk management objectives. The current Investment Policy primarily limits the Bank to investments of high quality U.S. Treasury securities, U.S. agency securities, government sponsored enterprise MBS and high grade municipal and corporate securities, with certain exceptions for the purchase of BBB- or non-rated subordinated debentures of U.S. regulated banks following an analysis of credit worthiness. High risk investments, including private label collateralized mortgage obligations rated AA and below or municipal or corporate bonds rated BBB and below, and non-traditional investments are prohibited. Investment maturities are generally limited to ten to fifteen years, except as specifically approved by the Asset Liability Committee ("ALCO") and mortgage-backed pass-through securities, which may have final stated maturities of 30 years, with average lives generally not to exceed eight years.

The Company and Bank have formalized an asset and liability management process and have a standing ALCO consisting of senior management overseen by the Board. The ALCO operates under established policies and practices and a Committee Charter, which practices are updated and re-approved annually. A typical ALCO meeting includes discussion of current economic conditions and balance sheet and other strategies, including interest rate trends and the current balance sheet and earnings position, comparisons to budget, cash flow estimates, liquidity positions, liquidity stress tests, and funding alternatives as necessary, interest rate risk position (monthly), including derivative positions, capital positions of the Company and Bank, reviews (including independent reviews) of the investment portfolio of the Bank and Company and the approval of investment transactions. Additionally, ALCO meetings may include reports and analysis of outside firms to enhance the Committee’s knowledge and understanding of various financial matters. Various other bank employees attend monthly committee meetings to build their understanding of all financial matters. A weekly conference call is scheduled to bring added attention primarily to shorter term cash flow estimates and interest rate matters.

The development of the Company’s customer base has benefited from building full relationships that include deposit balances, loan balances and noninterest revenue sources. The Bank has placed enhanced reliance on proactively designed officer calling programs and lender teams, active participation in business organizations, and enhanced referral programs.

Internet Access to Company Documents. The Company provides access to its Securities and Exchange Commission ("SEC") filings through its web site at www.eaglebankcorp.com. After accessing the web site, the filings are available upon selecting "Investor Relations/SEC Filings/Documents." Reports available include the annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and all amendments to those reports as soon as reasonably practicable after the reports are electronically filed with or furnished to the SEC. Further, the SEC maintains an Internet site that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC at http://www.sec.gov.

Market Area

The primary market area of the Bank is the Washington, D.C. metropolitan area. With a population of 6.5 million and projected annualized growth rate of 0.55% through 2031, the region is the 6th largest metropolitan area in the U.S. (U.S. Census Bureau 2024). Total employment in the region is approximately 3.4 million per the 2026 Bureau of Labor Statistics report. The unemployment rate has increased since 2024. As of November 30, 2025 and 2024, the region had a 4.1% and 3.2% unemployment rate, respectively. The Washington, D.C. metropolitan area contains a substantial federal workforce, as well as a variety of support industries that employ professionals such as attorneys, lobbyists, government contractors, real estate developers and investors, non-profit organizations and consultants. The Gross Regional Product for the metropolitan area in 2023 (latest data available) was reported at $714.7 billion, per the Federal Reserve Economic Data. This figure can be heavily attributed to the federal government, but other significant sectors include professional and business services, education, healthcare, leisure and hospitality. The region also has a very active non-profit sector including trade associations, colleges, universities and major hospitals. Transportation congestion and federal government spending and employment levels remain threats to future economic development and quality of life in the area.

Effective July 1, 2015, the Bank entered into a multi-faceted support agreement with George Mason University ("George Mason"), the Commonwealth of Virginia’s largest public research university. The agreement provides for significant educational support, and a strategic alliance including the Bank obtaining the naming rights to a multi-purpose sports and entertainment venue formerly known as the Patriot Center, now known as "EagleBank Arena" in Fairfax, Virginia for up to a 20-year term. Under the agreement, the Bank pays George Mason an annual fee to be used for scholarships, internships, overall educational, athletic support and beautification efforts.

Competition

The Bank faces significant competition in originating and retaining loans and attracting deposits as the Washington, D.C. market area has a high concentration of large and regional banks based outside the area, one large locally based bank that operates nationwide, numerous community banks and several large credit unions. Although some consolidation has occurred in the market in the past few years, the Bank continues to compete with other community banks, savings and loan associations, credit unions and finance companies, as well as other kinds of financial institutions and enterprises, such as securities firms, insurance companies, savings associations, private lenders and nontraditional competitors such as fintech companies and internet-based lenders, depositories and payment systems.

The Bank’s most direct competition for deposits comes from large and regional banks based outside the Washington, D.C. market area, all of which have substantially greater financial resources than the Bank. Among the advantages that many of these large institutions have over the Bank are their ability to finance extensive advertising campaigns, maintain extensive branch networks, make larger technology investments and to directly offer certain services, such as international banking and trust services, which are not offered directly by the Bank. In addition, following the banking sector stress of March 2023, some large banks had advantages in sourcing deposits due to the perceived stability of larger banks.

The Bank faces direct competition for loans from each of these institutions described above as well as from on-line lenders and other loan origination firms. Further, the greater capitalization of the larger institutions headquartered out-of-state allows for higher lending limits than the Bank, although we believe the Bank’s current lending limit is sufficient for our business and able to accommodate the credit needs of most businesses in the Washington, D.C. metropolitan area, which distinguishes it from most community banks in the market area. Some of these competitors have other advantages, such as tax exemption in the case of credit unions and, to some extent, lesser regulation in the case of finance companies and many nontraditional competitors.

Under current law, unlimited interstate de novo branching is available to all state and federally chartered banks.

Human Capital Resources and Management

Human Capital

At EagleBank, our culture is defined by our Relationships F.I.R.S.T. corporate values: Flexible, Involved, Responsive, Strong, and Trusted. We value our employees by investing in a healthy work-life balance, competitive compensation and benefit packages and a vibrant, team-oriented environment centered on professional service and open communication amongst employees. We strive to build and maintain a high-performing culture and be an "employer of choice" by creating a work environment that attracts and retains outstanding, engaged employees who embody our company mantra of "Relationships FIRST."

The Board oversees the strategic management of our human capital resources. The Human Resources Department’s day-to-day responsibility is managing our human capital resources.

Talent Acquisition and Retention

As of December 31, 2025, we employed 475 full and part time employees across our 17 locations, which includes our branch offices, corporate offices and lending and other operating facilities. During 2025, we hired 133 employees. Our voluntary turnover rate was 15%, 18% and 12%, respectively, for the years ended December 31, 2025, 2024 and 2023. None of our employees are represented by a union or subject to a collective bargaining agreement.

Opportunity, Belonging and Inclusion

We strive toward a powerful and inclusive team of employees, knowing we are better together with our combined wisdom and intellect. With a commitment to inclusion for every employee, we focus on understanding, accepting and valuing the differences among people. To accomplish this, we have established an Opportunity, Belonging & Inclusion Council made up of 20 employee representatives.

Compensation and Benefits

We provide a competitive compensation and benefits program to help meet the needs of our employees. In addition to salaries, these programs include annual bonuses, stock awards, a 401(k) Plan with an employer matching contribution, healthcare and insurance benefits, health savings accounts, flexible spending accounts, vacation and sick leave, family leave and an employee assistance program.

We provide pay levels and pay opportunities that are designed to be internally fair, externally competitive and cost-effective. To determine competitive market compensation levels, we use market surveys that report salary data of companies with similar positions, asset size and geographical location. To further align base pay with experience and individual performance, we annually review our salary structure and ranges to keep pace with changes in the marketplace. With the support of independent third-party experts in this field, we review the compensation of employees and conduct a pay equity analysis as part of our efforts to ensure consistent pay practices.

Employee Engagement

We regularly collect feedback to better understand and improve the employee experience and identify opportunities to continually strengthen our culture. We host periodic all-employee conference calls to disseminate information and to respond to employee questions. In May 2025, we introduced an Enterprise Engagement Council and sub-councils for each location. These Councils provide an assortment of employee engagement and recognition events.

Learning and Development

We invest in the growth and development of our employees by providing a multi-dimensional approach to learning that is designed to empower, intellectually grow and professionally develop our colleagues. Our employees receive continuing education courses that are relevant to the banking industry and their job function. We also offer leadership and customer service training. These resources help to provide employees with the skills they need to achieve their career goals, build management skills and become leaders within our Company. Employees have access to more than 23,000 on-demand learning solutions to help them learn new skills and advance in their career as well as certificate programs built around specific job roles. We also provide tuition reimbursement to help employees develop their skills and enhance their performance.

Regulation

Our business and operations are subject to extensive federal and state governmental regulation and supervision. The following is a brief summary of certain statutes and rules and regulations that affect or may affect us. This summary is not intended to be an exhaustive description of the statutes or regulations applicable to our business. Supervision, regulation, and examination of the Company by the regulatory agencies are intended primarily for the protection of depositors and the Deposit Insurance Fund ("DIF"), rather than our shareholders or other investors.

The Company. The Company is a bank holding company registered under the Bank Holding Company Act of 1956, as amended ("BHC Act") and is subject to regulation and supervision by the FRB. The BHC Act and other federal laws subject bank holding companies to restrictions on the types of activities in which they may engage, and to a range of supervisory requirements and actions, including regulatory enforcement actions for violations of laws and regulations and unsafe and unsound banking practices. As a bank holding company, the Company is required to file with the FRB an annual report and such other additional information as the FRB may require pursuant to the BHC Act. The FRB may also examine the Company and each of its subsidiaries. The Company is subject to risk-based capital requirements adopted by the FRB, which are substantially identical to those applicable to the Bank, and which are described below.

The BHC Act requires approval of the FRB for, among other things, a bank holding company’s direct or indirect acquisition of control of more than five percent (5%) of the voting shares, or substantially all the assets, of any bank or the merger or consolidation by a bank holding company with another bank holding company. The BHC Act also generally permits the acquisition by a bank holding company of control, or substantially all of the assets, of any bank located in a state other than the home state of the bank holding company, except where the bank has not been in existence for the minimum period of time required by state law; but if the bank is at least 5 years old, the FRB may approve the acquisition.

With certain limited exceptions, a bank holding company is prohibited from acquiring control of any voting shares of any company that is not a bank or bank holding company and from engaging directly or indirectly in any activity other than banking or managing or controlling banks or furnishing services to or performing services for its authorized subsidiaries. A bank holding company may, however, engage in, or acquire an interest in a company that engages in, activities which the FRB has determined by order or regulation to be so closely related to banking or managing or controlling banks as to be properly incident thereto. In making such a determination, the FRB is required to consider whether the performance of such activities can reasonably be expected to produce benefits to the public, such as convenience, increased competition or gains in efficiency, which outweigh possible adverse effects, such as undue concentration of resources, decreased or unfair competition, conflicts of interest or unsound banking practices. Some of the activities that the FRB has determined by regulation to be closely related to banking include making or servicing loans, performing certain data processing services, acting as a fiduciary or investment or financial advisor and making investments in corporations or projects designed primarily to promote community welfare. The FRB may order a bank holding company or its subsidiaries to terminate any of these activities or to

terminate its ownership or control of any subsidiary when it has reasonable cause to believe that the bank holding company’s continued ownership, activity or control constitutes a serious risk to the financial safety, soundness or stability of it or any of its bank subsidiaries.

The Gramm Leach-Bliley Act of 1999 ("GLB Act") allows a bank holding company satisfying criteria related to its and its bank subsidiaries' status as well capitalized and well managed and the bank's under the Community Reinvestment Act to certify its status as a financial holding company, which would allow such company to engage in activities that are financial in nature, that are incidental to such activities or are complementary to such activities. The GLB Act enumerates certain activities that are deemed financial in nature, such as underwriting insurance or acting as an insurance principal, agent or broker, underwriting, dealing in or making markets in securities and engaging in merchant banking under certain restrictions. It also authorizes the FRB to determine by regulation what other activities are financial in nature or incidental or complementary thereto. The Company has not elected financial holding company status.

Federal Reserve policy and regulation and the Federal Deposit Insurance Act ("FDIA") require a bank holding company to serve as a source of financial and managerial strength to its bank subsidiaries. As a result of a bank holding company's source of strength obligation, a bank holding company may be required to provide funds to a bank subsidiary in the form of subordinated capital or other instruments which qualify as capital under bank regulatory rules, including at times that the bank holding company might otherwise determine not to provide support. Any loans from the holding company to such subsidiary banks likely would be unsecured and subordinated to such bank’s depositors and perhaps to other creditors of the bank. If a bank holding company commits to a U.S. federal banking agency that it will maintain the capital of its bank subsidiary, whether in response to the source-of-strength authority or other regulatory measures, that commitment will be assumed by the bankruptcy trustee for the bank holding company if it commences bankruptcy proceedings, and the bank will be entitled to priority payment in respect of that commitment, ahead of other creditors of the bank holding company. In addition, where a bank holding company has more than one FDIC-insured bank or thrift subsidiary, each of the bank holding company's subsidiary FDIC-insured depository institutions is responsible for losses to the FDIC as a result of an affiliated depository institution's failure.

Share Repurchases. A bank holding company is generally required to give the FRB prior written notice of any purchase or redemption of its own then outstanding common stock if the gross consideration for the purchase or redemption, when combined with the net consideration paid for all such purchases or redemptions during the preceding 12 months, is equal to 10% or more of the company's consolidated net worth. The FRB may disapprove such a purchase or redemption if it determines that the proposal would constitute an unsafe and unsound practice or would violate any law, regulation, FRB order or directive or any condition imposed by, or written agreement with, the FRB. The FRB has adopted an exception to this approval requirement for well-capitalized bank holding companies that meet certain conditions. In addition, in certain circumstances a bank holding company’s repurchases of its common stock are subject to prior notice or supervisory non-objection under policies or supervisory expectations of the FRB. Redemptions of equity in the form of preferred stock are generally subject to a prior approval requirement, and the capital conservation buffer requirement can also restrict the Company’s ability to engage in repurchases of its regulatory capital instruments as described below under "Capital Adequacy."

As a Maryland corporation, the Company is subject to additional requirements, limitations and restrictions. For example, state law restrictions include limitations and restrictions relating to indemnification of directors, distributions to shareholders, transactions involving directors, officers or interested shareholders, maintenance of books, records, minutes, borrowing and the observance of corporate formalities.

The Bank. The Bank is a Maryland chartered commercial bank and a member of the Federal Reserve and a state member bank, whose accounts are insured by the Deposit Insurance Fund ("DIF") of the FDIC up to the maximum legal limits of the FDIC. The Bank is subject to regulation, supervision and regular examination by the State of Maryland Office of Financial Regulation and the FRB. The regulations of these various agencies govern most aspects of the Bank’s business, including required reserves against deposits, loans, investments, mergers and acquisitions, borrowing, dividends and location and number of branch offices. As an institution with over $10 billion in total consolidated assets, the Bank became subject to increased regulation and supervision by the FRB and the FDIC in 2022. As of December 31, 2025, our total assets were $10.5 billion. Therefore, the Bank is subject to ongoing (rather than periodic) supervision, targeted examinations, more frequent loan portfolio reviews and other enhanced supervision. In particular, the FRB and the FDIC focus on the soundness of the Bank’s risk management framework and capabilities, given the greater complexity and impact of the Bank’s risks as a larger institution. The laws and regulations governing the Bank generally have been promulgated to protect depositors and the DIF and not for the purpose of protecting shareholders or other investors.

Commercial banks, savings and loan associations and credit unions are generally able to engage in interstate banking or acquisition activities. As a result, banks in the Washington, D.C. Metropolitan area can, subject to limited restrictions, acquire or merge with a bank in another jurisdiction and can branch de novo in any jurisdiction.

Subsidiary banks of a bank holding company are subject to certain restrictions imposed by the Federal Reserve Act on any extensions of credit to the bank holding company or any of its subsidiaries or investments in the stock or other securities thereof, and on the taking of such stock or securities as collateral for loans to any borrower. Further, a bank holding company and any subsidiary bank are prohibited from engaging in certain tie in arrangements in connection with the extension of credit. A subsidiary bank may not extend credit, lease or sell property or furnish any services or fix or vary the consideration for any of the foregoing on the condition that: (i) the customer obtain or provide some additional credit, property or services from or to such bank other than a loan, discount, deposit or trust service; (ii) the customer obtain or provide some additional credit, property or service from or to the Company or any other subsidiary of the Company; or (iii) the customer not obtain some other credit, property or service from competitors, except for reasonable requirements to assure the soundness of credit extended.

Branching and Interstate Banking. The federal banking agencies are authorized to approve interstate bank merger transactions without regard to whether such transaction is prohibited by the law of any state, unless the home state of one of the banks has opted out of the interstate bank merger provisions of the Riegle-Neal Interstate Banking and Branching Efficiency Act of 1994 ("Riegle-Neal Act") by adopting a law after the date of enactment of the Riegle-Neal Act and prior to June 1, 1997, which applies equally to all out-of-state banks and expressly prohibits merger transactions involving out-of-state banks. Interstate acquisitions of branches are permitted only if the law of the state in which the branch is located permits such acquisitions. Such interstate bank mergers and branch acquisitions are also subject to the nationwide and statewide insured deposit concentration limitations described in the Riegle-Neal Act. Washington, D.C., Maryland and Virginia have each enacted laws that permit interstate acquisitions of banks and bank branches. The Dodd-Frank Act authorizes national and state banks to establish de novo branches in other states to the same extent as a bank chartered by that state would be permitted to branch.

Brokered Deposits. A "brokered deposit" is any deposit that is obtained from or through the mediation or assistance of a deposit broker. Deposit brokers may attract deposits from individuals and companies throughout the United States and internationally whose deposit decisions are based primarily on obtaining the highest interest rates. Banks that become less than "well-capitalized" under applicable regulatory capital requirements may be restricted in their ability to accept or renew, or prohibited from accepting or renewing, brokered deposits, and less than "well capitalized" banks also are subject to interest rate restrictions on deposits.

Bank Secrecy Act. Under the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act, commonly referred to as the "USA Patriot Act," financial institutions are subject to prohibitions against specified financial transactions and account relationships, as well as enhanced due diligence standards intended to detect and prevent the use of the United States financial system for money laundering and terrorist financing activities. The Bank Secrecy Act requires financial institutions, including banks, to establish anti-money laundering programs, including employee training and independent audit requirements, meet minimum standards specified by the act, follow minimum standards for customer identification and maintenance of customer identification records and regularly compare customer lists against lists of suspected terrorists, terrorist organizations and money launderers.

Office of Foreign Assets Control. The United States has imposed economic sanctions that affect transactions with designated foreign countries, foreign nationals and others, which are administered by the U.S. Treasury Department’s Office of Foreign Assets Control ("OFAC"). The OFAC-administered sanctions targeting countries take many different forms. Generally, however, they contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on a “U.S. person” engaging in financial transactions relating to making investments in, or providing investment-related advice or assistance to, a sanctioned country; and (ii) a blocking of assets in which the government or specially designated nationals of a sanctioned country have an interest by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal and reputational consequences.

Capital Adequacy. The FRB and the other federal banking agencies have adopted risk-based and leverage capital adequacy requirements, pursuant to which they assess the adequacy of capital in examining and supervising banks and bank holding companies and in analyzing bank regulatory applications. Risk-based capital requirements assign different capital requirements to various classes of assets and off-balance sheet items based on standardized supervisory measures of risk. The Dodd-Frank Act additionally requires capital requirements to be counter cyclical

so that the required amount of capital increases in times of economic expansion and decreases in times of economic contraction, consistent with safety and soundness.

The federal banking agencies have adopted rules, referred to as the Basel III Rules, to implement the framework for strengthening international capital and liquidity regulation adopted by the Basel Committee on Banking Supervision, or Basel III. The Basel III framework, among other things, (i) introduced the concept of common equity tier one capital ("CET1"); (ii) required that most adjustments to regulatory capital measures be made to CET1 and not to the other components of capital; (iii) expanded the scope of the adjustments to capital that may be made as compared to prior regulations; and (iv) specified that Tier 1 capital consists of CET1 and "Additional Tier 1 capital" instruments meeting specified requirements. Under the Basel III Rules, repurchase or redemption of Additional Tier 1 and Tier 2 capital instruments requires prior approval of the appropriate federal banking agency, which in our case is the FRB for both the Company and the Bank. Prior approval to repurchase or redeem CET1 instruments is only required under the Basel III Rules to the extent that a separate legal or regulatory requirement for prior approval applies, such as the restrictions described under "Share Repurchases" above.

The Basel III Rules require institutions to maintain: (i) a minimum ratio of CET1 to risk-weighted assets of 4.5% plus a "capital conservation buffer" of 2.5% for an overall effective requirement of 7.0%; (ii) a minimum ratio of Tier 1 capital to risk-weighted assets of 6.0% plus the capital conservation buffer for an overall effective requirement of 8.5%; (iii) a minimum ratio of Total (Tier 1 plus Tier 2) capital to risk-weighted assets of 8.0% plus the capital conservation buffer for an overall effective requirement of 10.5%; and (iv) a minimum leverage ratio of 4%, calculated as the ratio of Tier 1 capital to balance sheet exposures plus certain off-balance sheet exposures (computed as the average of the month-end ratios each month during a calendar quarter).

Banking institutions with a risk-based ratio above the minimum but below the capital conservation buffer face constraints on their ability to pay dividends, effect equity repurchases and pay discretionary bonuses to executive officers, which constraints vary based on the amount of the shortfall, and the institution's "eligible retained income" (that is, the greater of (i) net income for the preceding four quarters, net of distributions and associated tax effects not reflected in net income, and (ii) average net income over the preceding four quarters).

The Basel III Rules provide for the manner of calculating risk-weighted assets, including the recognition of credit risk mitigation, such as financial collateral and a range of eligible guarantors. As discussed below, the Basel III Rules also integrate the capital requirements into the prompt corrective action provisions under Section 38 of the FDIA.

The capital ratios described above are the minimum levels that the federal banking agencies expect. Our state and federal regulators have the discretion to require us to maintain higher capital levels based upon our concentrations of loans, the risk of our lending or other activities, the performance of our loan and investment portfolios and other factors. Failure to maintain such higher capital in accordance with supervisory expectations could result in a lower composite regulatory rating, which would impact our deposit insurance premiums and could affect our ability to borrow and costs of borrowing and could result in additional or more severe enforcement actions. In respect of institutions with high concentrations of loans in areas deemed to be higher risk, or during periods of significant economic stress, regulators may require an institution to maintain a higher level of capital and/or to maintain more stringent risk management measures than those required by these regulations.

In December 2017, the Basel Committee on Banking Supervision published the last version of the Basel III accord, generally referred to as "Basel III Endgame." On July 27, 2023, the federal banking regulators proposed revisions to the Basel III Rules to implement the Basel Committee’s 2017 standards and make other changes to the Basel III Rules. The revised capital requirements of the proposed rule would not apply to the Company or the Bank because they have less than $100 billion in total consolidated assets and trading assets and liabilities below the threshold for market risk requirements. The federal banking regulators have subsequently indicated that they expect to issue a revised proposal in 2026.

In 2016, the Financial Accounting Standards Board ("FASB") issued the current expected credit losses model ("CECL"). CECL requires financial institutions to estimate and establish a provision for expected credit losses over the lifetime of the asset, at the origination or the date of acquisition of the asset, as opposed to reserving for incurred or probable losses through the balance sheet date. Upon implementation, an institution recognized a one-time cumulative effect adjustment to the allowance for credit losses ("ACL.") The federal banking regulators issued a final rule in March 2020 that provided banking organizations with an option to temporarily delay for two years the estimated impact of the adoption of the CECL methodology on regulatory capital, followed by a three-year phase-in period. The cumulative amount that is not recognized in regulatory capital was phased in at 25% per year beginning January 1, 2022. We elected to adopt the option provided in the March 2020 interim final rule, so our regulatory capital ratios prior to 2025 reflect this election to phase in the effects of CECL. 2025 regulatory capital ratios include the full impact from CECL now that the phase-in period has ended.

Prompt Corrective Action. Under Section 38 of the FDIA, each federal banking agency is required to implement a system of prompt corrective action for institutions that it regulates. The federal banking agencies have promulgated substantially similar regulations for this purpose. The following capital requirements currently apply to the Bank for purposes of Section 38.

An institution generally must file a written capital restoration plan which meets specified requirements with the appropriate federal banking agency within 45 days of the date the institution receives notice or is deemed to have notice that it is undercapitalized, significantly undercapitalized or critically undercapitalized. The appropriate federal banking agency must provide the institution with written notice of approval or disapproval within 60 days after receiving a capital restoration plan, subject to extensions by the applicable agency.

An institution that is required to submit a capital restoration plan must concurrently submit a performance guaranty by each company that controls the institution. Such guaranty shall be limited to the lesser of (i) an amount equal to 5.0% of the institution’s total assets at the time the institution was notified or deemed to have notice that it was undercapitalized or (ii) the amount necessary at such time to restore the relevant capital measures of the institution to the levels required for the institution to be classified as adequately capitalized. Such a guaranty shall expire after the appropriate federal banking agency notifies the institution that it has remained adequately capitalized for four consecutive calendar quarters. An institution that fails to submit a written capital restoration plan within the requisite period, including any required performance guaranty, or fails in any material respect to implement a capital restoration plan, shall be subject to the restrictions in Section 38 of the FDIA that are applicable to significantly undercapitalized institutions.

A "critically undercapitalized institution" is required to be placed in conservatorship or receivership within 90 days, unless the FDIC formally determines that forbearance from such action would better protect the DIF. Unless the FDIC or other appropriate federal banking agency makes specific further findings and certifies that the institution is viable and is not expected to fail, an institution that remains critically undercapitalized during the fourth calendar quarter after the date it became critically undercapitalized must be placed in receivership. The general rule is that the FDIC will be appointed as receiver within 90 days after an institution becomes critically undercapitalized unless good cause is shown and an extension is agreed to by the federal regulators. In general, good cause requires that adequate capital has been raised and is imminently available for infusion into the institution, except for certain technical requirements, which may delay the infusion for a period of time beyond the 90 day time period.

Immediately upon becoming undercapitalized, an institution shall become subject to the provisions of Section 38 of the FDIA, which (i) restrict payment of capital distributions and management fees; (ii) require that the appropriate federal banking agency monitor the condition of the institution and its efforts to restore its capital; (iii) require submission of a capital restoration plan; (iv) restrict the growth of the institution’s assets; and (v) require prior approval of certain expansion proposals. The appropriate federal banking agency for an undercapitalized institution also may take any number of discretionary supervisory actions if the agency determines that any of these actions is necessary to resolve the problems of the institution at the least possible long-term cost to the DIF, subject in certain cases to specified procedures. These discretionary supervisory actions include: requiring the institution to raise additional capital; restricting transactions with affiliates; requiring divestiture of the institution or the sale of the institution to a willing purchaser; and any other supervisory action that the agency deems appropriate. These and additional mandatory and permissive supervisory actions may be taken with respect to significantly undercapitalized and critically undercapitalized institutions.

Additionally, under Section 11(c)(5) of the FDIA, a conservator or receiver may be appointed for an institution where: (i) an institution’s obligations exceed its assets; (ii) there is substantial dissipation of the institution’s assets or earnings as a result of any violation of law or any unsafe or unsound practice; (iii) the institution is in an unsafe or unsound condition; (iv) there is a willful violation of a cease-and-desist order; (v) the institution is unable to pay its

obligations in the ordinary course of business; (vi) losses or threatened losses deplete all or substantially all of an institution’s capital, and there is no reasonable prospect of becoming "adequately capitalized" without assistance; (vii) there is any violation of law or unsafe or unsound practice or condition that is likely to cause insolvency or substantial dissipation of assets or earnings, weaken the institution’s condition or otherwise seriously prejudice the interests of depositors or the insurance fund; (viii) an institution ceases to be insured; (ix) the institution is undercapitalized and has no reasonable prospect that it will become adequately capitalized, fails to become adequately capitalized when required to do so or fails to submit or materially implement a capital restoration plan; or (x) the institution is critically undercapitalized or otherwise has substantially insufficient capital.

Regulatory Enforcement Authority. Federal banking law grants substantial enforcement powers to the federal banking agencies. This enforcement authority includes, among other things, the ability to assess civil money penalties, to issue cease-and-desist or removal orders and to initiate injunctive actions against banking organizations and institution-affiliated parties. In general, these enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices. Other actions or inactions may provide the basis for enforcement action, including misleading or untimely reports filed with regulatory authorities. In October 2025, the FDIC and OCC issued a proposed rule that would define the term “unsafe or unsound practice” for purposes of their enforcement powers under the FDIA. The proposed definition would focus on whether the practice is likely to materially harm, or already has materially harmed, the financial condition of an institution. However, the FRB has not issued a similar proposal.

Consumer Financial Protection Bureau. The Dodd-Frank Act created the CFPB, an independent federal agency with broad rulemaking, supervisory and enforcement powers under various federal consumer financial protection laws, including the Equal Credit Opportunity Act, Truth in Lending Act, Real Estate Settlement Procedures Act, Fair Credit Reporting Act, Fair Debt Collection Practices Act, the consumer financial privacy provisions of the GLB Act and certain other statutes. The CFPB has examination and primary enforcement authority with respect to depository institutions with over $10 billion in assets. The CFPB also has authority to prevent unfair, deceptive or abusive practices in connection with the offering of consumer financial products. The Dodd-Frank Act permits states to adopt consumer protection laws and standards that are more stringent than those adopted at the federal level and, in certain circumstances, permits state attorneys general to enforce compliance with both the state and federal laws and regulations.

The Bank is subject to periodic examinations by the CFPB focused on compliance with consumer laws and regulations, as a banking organization over $10 billion in total assets.

In October 2024, the CFPB finalized a new rule that requires a provider of payment accounts or products, such as a bank, to make data available to consumers upon request regarding the products or services they obtain from the provider. Any such data provider is also required to make such data available to third parties, with the consumer’s express authorization and through an interface that satisfies formatting, performance and security standards, for the purpose of such third parties providing the consumer with financial products or services requested by the consumer. Data required to be made available under the rule includes transaction information, account balance, account and routing numbers, terms and conditions, upcoming bill information, and certain account verification data. The rule is intended to give consumers control over their financial data, including with whom it is shared, and encourage competition in the provision of consumer financial products or services. For banks with at least $10 billion but less than $250 billion in total assets, compliance with the rule’s requirements is required by April 1, 2027. The rule is the subject of litigation, which is currently stayed while the CFPB considers revisions to the rule.

During 2025, the CFPB reduced its staff by over 80%. The reduction in force is the subject of litigation, and the staffing cuts are currently stayed pending the federal circuit court’s en banc rehearing of the case. The impact of these developments on banking organizations subject to CFPB regulation and supervision, including the Bank, is uncertain. States and state attorneys general may increase regulatory, investigative and enforcement activity with respect to consumer protection, in response to changes in regulation, supervision and enforcement of consumer protection laws by federal regulators.

Fair and Responsible Banking. Banks and other financial institutions are subject to numerous laws and regulations intended to promote fair and responsible banking and prohibit unlawful discrimination and unfair, deceptive or abusive practices in banking. These laws include, among others, the Dodd-Frank Act, Section 5 of the Federal Trade Commission Act, the Equal Credit Opportunity Act and the Fair Housing Act. Many states and local jurisdictions have consumer protection laws analogous, and in addition, to those listed above. These federal, state and local laws regulate the manner in which financial institutions deal with customers taking deposits, making loans or conducting other types of transactions. Failure to comply with these laws and regulations could give rise to regulatory sanctions and actions by the U.S. Department of Justice and state attorneys general.

In addition, in recent years, certain states have enacted, or have proposed to enact, statutes, regulations or policies that prohibit financial institutions from denying or canceling products or services to a person or business, or otherwise discriminating against a person or business in making available products or services, on the basis of certain social or political factors or other activities. In August 2025, President Trump signed Executive Order 14331, “Guaranteeing Fair Banking Access for All Americans,” which states that it is the policy of the United States that no American should be denied access to financial services because of their constitutionally or statutorily protected beliefs, affiliations or political views. The Executive Order directs the U.S. Treasury Secretary and federal banking regulators to address politicized or unlawful debanking activities.

Financial Privacy and Cybersecurity. Under the Federal Right to Privacy Act of 1978 and the GLB Act, which imposes requirements regarding the safeguarding and confidentiality of consumer financial records and prescribes procedures for complying with administrative subpoenas of financial records, financial institutions are required to disclose their policies for collecting and protecting confidential information. Consumers generally may prevent financial institutions from sharing personal financial information with nonaffiliated third parties except for third parties that market the institutions’ own products and services. Additionally, financial institutions generally may not disclose consumer account numbers to any nonaffiliated third party for use in telemarketing, direct mail marketing or other marketing through electronic mail to consumers.

The federal banking regulators issue guidance regarding cybersecurity intended to enhance cyber risk management standards among financial institutions. A financial institution is expected to establish multiple lines of defense and to ensure their risk management processes address the risk posed by potential threats to the institution. A financial institution’s management is expected to maintain sufficient processes to effectively respond and recover the institution’s operations after a cyberattack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations if a critical service provider of the institution falls victim to this type of cyberattack. The Bank has adopted an Information Security Policy and Program that has been approved by the Board and reviewed by its regulators.

In November 2021, the federal bank regulatory agencies issued a final rule regarding notification requirements for banking organizations related to significant computer security incidents. Under the final rule, a bank holding company, such as the Company, and a state member bank, such as the Bank, would be required to notify the Federal Reserve within 36 hours of any incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or pose a threat to the financial stability of the United States.

In July 2023, the SEC issued a final rule that requires registrants, such as the Company, to (i) report material cybersecurity incidents on Form 8-K within four business days of their being deemed material, (ii) disclose cybersecurity policies and procedures and governance practices, including at the board and management levels, in Form 10-K and (iii) present the disclosures in inline XBRL.

Community Reinvestment Act. The Community Reinvestment Act ("CRA") requires that, in connection with examinations of insured depository institutions within their respective jurisdictions, the federal banking agencies evaluate the record of each financial institution in meeting the needs of its local community, including low- and moderate-income neighborhoods. The Bank’s record of performance under the CRA is publicly available. A bank’s CRA performance is also considered in evaluating applications seeking approval for mergers, acquisitions and new offices or facilities. Failure to adequately meet these criteria could result in additional requirements and limitations being imposed on the Bank. Additionally, we must publicly disclose the terms of certain CRA-related agreements.

Concentration and Risk Guidance. The federal banking regulatory agencies promulgated joint interagency guidance regarding material direct and indirect asset and funding concentrations. The guidance defines a concentration as any of the following: (i) asset concentrations of 25% or more of Total Capital (loan related) or Tier 1 Capital (non-loan related) by individual borrower, small interrelated group of individuals, single repayment source or individual project; (ii) asset concentrations of 100% or more of Total Capital (loan related) or Tier 1 Capital (non-loan related) by industry, product line, type of collateral or short-term obligations of one financial institution or affiliated group; (iii) funding concentrations from a single source representing 10% or more of Total Assets; or (iv) potentially volatile funding sources that when combined represent 25% or more of Total Assets (these sources may include brokered, large, high-rate, uninsured, internet-listing-service deposits, Federal funds purchased or other potentially volatile deposits or borrowings). If a concentration is present, management must employ heightened risk management practices including board and management oversight and strategic planning, development of underwriting standards, risk assessment and monitoring through market analysis and stress testing, third party review and increasing capital requirements.

Additionally, the federal bank regulatory agencies have issued guidance governing financial institutions with concentrations in commercial real estate lending. The guidance provides that institutions that have (i) total reported

loans for construction, land development and other land which represent 100% or more of an institution’s total risk-based capital; or (ii) total reported commercial real estate loans, excluding loans secured by owner occupied commercial real estate, representing 300% or more of the institution’s total risk-based capital and the institution’s commercial real estate loan portfolio has increased 50% or more during the prior 36 months, are identified as having potential commercial real estate concentration risk. As of December 31, 2025, as per the regulatory guidance, commercial real estate loans (including construction, land and land development loans) represented 336.6% of consolidated risk based capital; however, growth in that segment over the past 36 months at (9.1)% did not exceed the 50% threshold laid out in the regulatory guidance. Construction, land and land development loans represented 92.09% of consolidated risk based capital as of December 31, 2025. Institutions that are deemed to have concentrations in commercial real estate lending are expected to employ heightened levels of risk management with respect to their commercial real estate portfolios, and may be required to hold higher levels of capital.

FDIC Insurance Premiums. Deposits at the Bank are insured up to applicable limits by the DIF of the FDIC and the Bank is subject to deposit insurance assessments to maintain the DIF. Deposit insurance assessments are based on average total assets minus average tangible equity. For larger institutions, such as the Bank, the FDIC uses a performance score and a loss-severity score to calculate an initial assessment rate. In calculating these scores, the FDIC uses a bank’s capital level and supervisory ratings and certain financial measures to assess an institution’s ability to withstand asset-related stress and funding-related stress. The FDIC has the ability to make discretionary adjustments to the total score based upon significant risk factors that are not adequately captured in the calculations.

Under the FDIA, the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC. In addition, the FDIC is authorized to conduct examinations of and require reporting by FDIC-insured institutions.

The Dodd-Frank Act permanently increased the maximum deposit insurance amount for banks, savings institutions and credit unions to $250 thousand per depositor. The Dodd-Frank Act also broadened the base for calculating FDIC insurance assessments. Assessments are now based on a financial institution’s average consolidated total assets less tangible equity capital. The Dodd-Frank Act required the FDIC to increase the reserve ratio of the DIF to 1.35% of insured deposits and eliminated the requirement that the FDIC pay dividends to insured depository institutions when the reserve ratio exceeds certain thresholds.

Affiliate Transactions. The Company and Bank are separate and distinct legal entities, and the Company is an affiliate of the Bank. Federal laws strictly limit the ability of banks to engage in certain transactions with their affiliates. Transactions deemed to be a "covered transaction" under Section 23A of the Federal Reserve Act between a bank and an affiliate are limited to 10% of the bank's capital and surplus and, with respect to all affiliates, to an aggregate of 20% of the bank's capital and surplus. Further, covered transactions that are loans and extensions of credit generally are required to be secured by eligible collateral in specified amounts. Federal law also requires that covered transactions and certain other transactions listed in Section 23B of the Federal Reserve Act between a bank and its affiliates be on terms as favorable to the bank as transactions with non-affiliates.

Incentive Compensation. The FRB reviews, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Company, that are not "large, complex banking organizations." These reviews are tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives are included in reports of examination. Deficiencies are incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

Under FRB guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, a banking organization’s incentive compensation arrangements should (i) provide incentives that appropriately balance risk and financial results in a manner that does not encourage employees to expose their organizations to imprudent risk, (ii) be compatible with effective internal controls and risk management and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

In 2016, the U.S. financial regulators, including the FRB and the SEC, proposed revised rules on incentive-based payment arrangements at specified regulated entities having at least $1 billion in total assets (including the Company and the Bank), but these proposed rules have not been finalized.

In October 2022, the SEC adopted a final rule directing national securities exchanges and associations, including NASDAQ, to require policies mandating the recovery or "clawback" of excess incentive-based compensation earned by a current or former executive officer during the three fiscal years preceding a required accounting restatement, including to correct an error that would result in a material misstatement if the error were corrected in the current period or left uncorrected in the current period. The excess compensation would be based on the amount the executive officer would have received had the incentive-based compensation been determined using the restated financials. NASDAQ’s listing standards pursuant to the SEC’s rule became effective October 2, 2023. The Company’s clawback policy adopted in accordance with these listing standards is included as Exhibit 97.1.

Climate-Related and ESG Developments. In recent years, certain lawmakers and regulators in and outside of the United States have increased their focus on financial institutions’ and other companies’ risk oversight, disclosures and practices in connection with climate change and other environmental, social and governance ("ESG") matters. Several states have enacted or proposed statutes or regulations addressing climate change and other ESG issues. For example, California enacted climate-related disclosure laws requiring certain companies doing business in California to make certain climate-related disclosures, including but not limited to greenhouse gas emissions data and climate-related risks.

Future Legislation and Regulation

In addition to the discussion above, other new proposals for legislation continue to be introduced in the Congress that could further substantially increase regulation of the bank and non-bank financial services industries and impose restrictions on the operations and general ability of firms within the industry to conduct business consistent with historical practices. Federal and state regulatory agencies also frequently adopt changes to their regulations or change the manner in which existing regulations are applied. Certain aspects of current or proposed regulatory or legislative changes to laws applicable to the financial industry, if enacted or adopted, may impact the profitability of our business activities, require more oversight or change certain of our business practices, including the ability to offer new products, obtain financing, attract deposits, make loans and achieve satisfactory interest spreads and could expose the Company to additional costs, including increased compliance costs. These changes also may require significant management attention and resources to make any necessary changes to operations to comply and could have an adverse effect on our business, financial condition and results of operations.