FIRST BUSINESS FINANCIAL SERVICES, INC. (FBIZ) Business

Item 1. Business

BUSINESS

General

First Business Financial Services, Inc. (together with all of its subsidiaries, collectively referred to as the “Corporation,” “FBFS,” “we,” “us,” or “our”) is a registered bank holding company originally incorporated in 1986 under the laws of the State of Wisconsin and is engaged in the commercial banking business through its wholly-owned bank subsidiary, First Business Bank (collectively with its subsidiaries “FBB” or the “Bank”), headquartered in Madison, Wisconsin. All of our operations are conducted through FBB and its wholly-owned subsidiary First Business Specialty Finance, LLC (“FBSF”). The Bank operates as a business bank, delivering a full line of commercial banking products and services tailored to meet the specific needs of small and medium-sized businesses, business owners, executives, professionals, and high net worth individuals. Our products and services are focused on business banking, private wealth, and bank consulting. Within business banking, we offer commercial real estate lending, commercial and industrial lending, asset-based lending, accounts receivable financing, equipment financing, floorplan financing, vendor financing, Small Business Administration (“SBA”) lending and servicing, treasury management solutions, and company retirement services. Our private wealth management services include trust and estate administration, financial planning, investment management, and private banking. Our bank consulting experts provide investment portfolio administrative services and asset liability management services. We are not a retail bank and do not rely on a traditional branch network to gather deposits or attract clients. Instead, our operating model is built on deep client relationships, specialized financial expertise, and an efficient, centralized administrative structure designed to deliver best-in-class client satisfaction. This focused approach enables our experienced professionals to provide the level of insight and service required to develop and sustain long-term client relationships. We conduct our commercial banking operations through one operating segment.

As of December 31, 2025, on a consolidated basis, we had total assets of $4.082 billion, total gross loans and leases of $3.375 billion, total deposits of $3.380 billion, and total stockholders’ equity of $371.6 million.

Commercial Banking Products and Services

We strive to meet the specific commercial banking needs of small- to medium-sized companies in our primary markets in Wisconsin, Kansas, and Missouri, predominantly through lines of credit, term loans, deposit accounts and treasury management services. Through FBB, we serve Wisconsin and the greater Kansas City Metro, and other clients through products with national channels.

Commercial Real Estate Lending We originate loans secured by commercial real estate, including owner-occupied properties, non-owner-occupied facilities, multifamily developments, 1-4 family residential developments, and construction loans for these types of buildings. As of December 31, 2025, our commercial real estate portfolio (“CRE”) represented approximately 61.0% of our total gross loans and leases receivable.

Commercial and Industrial Lending Our commercial loans are typically secured by various types of business assets, including inventory, receivables, and equipment. As of December 31, 2025, our commercial and industrial portfolio (“C&I”) represented approximately 37.7% of our total gross loans and leases receivable. The C&I portfolio includes conventional commercial and industrial loans as well as asset-based lending, accounts receivable financing, equipment financing, floorplan financing, and SBA lending. These C&I lending niches are described below.

C&I Lending - Asset-Based Lending

We provide asset-based lending to small- to medium-sized companies. Our asset-based lending team serves clients on a nationwide basis through business development officers located in several states. We primarily provide revolving lines of credit and term loans for financial and strategic acquisitions, capital expenditures, working capital, bank debt refinancing, debt restructuring, and corporate turnaround strategies. As an asset-based lender with strong underwriting standards, our team is positioned to provide cost-effective financing solutions to companies which do not have the established, stable cash flows necessary to qualify for traditional commercial lending products. These borrowing relationships generally range between $2 million and $25 million with terms of 24 to 60 months. Asset-based lending typically generates higher yields than traditional commercial lending. This line of business complements our

1

Table of Contents

traditional commercial loan portfolio and provides us with more diverse income opportunities. As of December 31, 2025, asset-based lending represented approximately 4.9% of our total gross loans and leases receivable.

C&I Lending - Accounts Receivable Financing

Our Accounts Receivable Financing team serves clients nationwide by purchasing accounts receivable on full recourse and limited non-recourse basis. We provide working capital to support client growth and other client cash flow needs. Accounts receivable financing typically generates higher yields than traditional commercial lending and complements our traditional commercial loan portfolio. These financings generally range between $100,000 and $20 million with terms of 12 to 24 months. As of December 31, 2025, accounts receivable financing represented approximately 1.3% of our total gross loans and leases receivable.

C&I Lending - Equipment Financing

The Bank finances a broad range of equipment, through loans and leases, to address the financing needs of commercial clients in a variety of industries. Our Equipment Finance team provides financing solutions nationwide for manufacturing equipment, industrial assets, construction equipment, agriculture equipment, medical equipment, and a variety of other commercial equipment. These financings generally range between $10,000 and $1 million with terms of 12 to 84 months.

Our Equipment Finance team seeks to position itself as the preferred point of sale financing choice utilized by equipment vendors and their purchasing customers. Our online application and proprietary credit scoring architecture enable us to provide small ticket vendor equipment financings through a nationwide distribution channel. The Equipment Finance team also partners with a select group of third-party origination sources that specialize in small ticket equipment finance transactions. These equipment vendors and third-party originators specialize primarily in healthcare, manufacturing, automotive repair, technology equipment, agriculture, construction, and specialty vehicles. Small ticket vendor equipment financing typically generates higher yields than traditional commercial lending. As of December 31, 2025, equipment financing represented approximately 9.9% of our total gross loans and leases receivable.

C&I Lending - Floorplan Financing

We offer floorplan financing for larger, well established, independent car dealerships nationwide. These floorplan programs generally range from $1,000,000 to $20 million with a typical term of 12 months. Floorplan financing typically generates higher yields than traditional commercial lending. As of December 31, 2025, floorplan financing represented approximately 4.7% of our total gross loans and leases receivable.

C&I Lending - SBA Lending and Servicing

SBA loans are made through programs designed by the federal government to assist the small business community in obtaining financing. We are an approved participant in the SBA’s Preferred Lender Program (“PLP”). The PLP is part of the SBA's effort to streamline the procedures necessary to provide financial assistance to the small business community. Under this program, the SBA delegates the final credit decision, most servicing, liquidation authority and responsibility to PLP lenders. We leverage this program authority and capacity to package, underwrite, process, service, and liquidate, if necessary, SBA loans nationwide.

Our SBA loans fall into three categories: loans originated under the SBA’s 7(a) term loan program; loans originated under the SBA’s 504 program; and SBA Express loans and lines of credit. Specific program guidelines vary based on the SBA loan program; however, all loans must be underwritten, originated, monitored, and serviced according to the SBA’s Standard Operating Procedures in order to maintain the guaranty, if any, under the SBA program. Except for loans originated under the SBA’s 504 program, the SBA generally provides a guaranty to the lender ranging from 50% to 90% of loan the balance as an inducement to the lender to originate the loan.

The majority of our SBA loans are originated using the 7(a) term loan program. This program typically provides a guaranty of 75% of the loan balance. In the event of default on the loan, the lender may request that the SBA purchase the guaranteed portion of the loan for an amount equal to the outstanding principal plus accrued interest permissible under SBA guidelines. In addition, the SBA will share on a pro-rata basis in certain costs of collection, subject to SBA rules and limits, as well as the proceeds of liquidation.

2

Table of Contents

The Bank's SBA lending is designed to generate new business opportunities for the Bank by meeting the needs of clients that cannot be met with conventional bank loans. We earn interest income from these loans, generally at variable rates higher than those of our traditional commercial loans. We have a history of recognizing gains on the sale of the guaranteed portion of the loans. These financings generally range between $200,000 and $5 million with terms of 10 to 25 years. As of December 31, 2025, the on-balance sheet portion of SBA loans represented approximately 1.9% of our total gross loans and leases receivable.

Treasury Management Services

FBB provides comprehensive treasury management services for clients to manage their cash and liquidity, including a variety of deposit accounts, accounts receivable collection services, electronic payment solutions, fraud detection and protection, information reporting, reconciliation, data integration solutions, and account balance optimization solutions. For our clients involved in international trade, the Bank offers international payment services, foreign exchange, and trade letters of credit.

Company Retirement Plan Services

FBB acts as fiduciary and investment manager for corporate clients, creating and executing asset allocation strategies tailored to each corporation’s unique situation. FBB also acts as a discretionary trustee and investment fiduciary, sharing responsibility for monitoring assets to match the client’s specifications. FBB only offers non-proprietary funds which removes any potential conflicts of interest and provides cost-effective company retirement plans with a competitive return. As of December 31, 2025, FBB had $482.5 million of company retirement plan assets under management and administration.

Private Wealth Management

FBB acts as fiduciary and investment manager for individual clients, creating and executing asset allocation strategies tailored to each client’s unique situation. FBB has full fiduciary powers and offers trust and estate administration, financial planning, and investment management, and acts in a trustee or agent capacity. FBB also provides access to brokerage and custody-only services, for which it administers and safeguards assets. As of December 31, 2025, FBB had $3.332 billion of private wealth assets under management and administration.

The Bank also offers private banking to its private wealth clients. As of December 31, 2025, private wealth loans represented approximately 2.0% of total gross loans and leases receivable.

Bank Consulting Services

FBB provides outsourced treasury services to assist banks and other financial institutions with balance sheet management. These services include balance sheet, investment portfolio, and asset liability management services.

Competition

FBB encounters competition across all of our commercial banking products and services. Such competition includes banks, savings institutions, mortgage banking companies, credit unions, finance companies, equipment finance companies, mutual funds, insurance companies, brokerage firms, investment banking firms, and FinTech companies. The Bank also competes with regional and national financial institutions, many of which have greater liquidity, higher lending limits, greater access to capital, more established market recognition, and more resources than the Bank. We believe the experience, expertise, and responsiveness of our banking professionals, as well as our focus on fostering long-lasting relationships, sets us apart from our competitors.

3

Table of Contents

Human Capital Management

Our human capital management strategy is foundational to our long-term performance. In 2025, our workforce expanded to 371 employees across onsite, hybrid, and remote roles, demonstrating our ability to attract specialized talent and support continued growth. In alignment with executing our five-year strategic plan, we remain focused on protecting and strengthening our culture and preparing our workforce to thrive in the workplace of the future.

Our Culture

•
Demonstrated our commitment to being Ideal Team Players(1) by fostering a culture rooted in employees who are humble, hungry, and (people) smart.



•
Sustained employee engagement scores that consistently exceed industry benchmarks, reflecting a highly committed and aligned workforce.





•
Earned 2025 Top Workplace recognition for the fifth consecutive year, along with Culture Excellence awards across nine categories.



•
Achieved a 10.4% employee turnover rate, outperforming the 2025 industry average of 17.4% as reported by McLagan(2) and underscoring our ability to attract and retain top talent.

(1) Patrick Lencioni, The Ideal Team Player: How to Recognize and Cultivate the Three Essential Virtues.(Jossey-Bass, 2016).

(2) Source: McLagan, a part of the Human Capital Solutions practice at Aon plc, 2025

Investing in our Employees

•
Achieved an 11.8% Career Path Ratio (the percentage of employees promoted or advancing internally during the year), exceeding our annual goal of 10.0%, and demonstrating strong internal mobility and advancement opportunities.



•
Maintained a competitive total rewards program incorporating market‑based pay and comprehensive benefits to support employees' financial well-being, health, and long-term success.



•
Provided employees with extensive artificial intelligence tools training to enhance productivity and proficiency, modernize workflows, and improve operational efficiency across the Company.

Our Commitment

Since our inception, our commitment to employees, clients, and communities has been the foundation of our long-term success. Our Belief Statement expresses this: At FBB, we believe visionary, determined entrepreneurs and investors create a thriving economy and, in turn, social and economic advancement for their employees, investors, families and communities. Built by driven entrepreneurs, FBB has the experience to create both wealth and a wealth of good in the world.

Subsidiaries

First Business Bank

FBB is a state bank chartered in 1909 in Wisconsin under the name Kingston State Bank. In 1990, FBB relocated its home office to Madison, Wisconsin, and began focusing on providing high-quality banking services to small- to medium-sized businesses located in Madison and the surrounding area. FBB’s business banking products and services include commercial loans, commercial real estate loans, asset-based loans, accounts receivable financing, SBA lending and servicing, floorplan financing, equipment loans and leases, commercial deposit accounts, company retirement solutions, and treasury management services. FBB offers a variety of deposit accounts and loans to business owners, executives, professionals, and high net worth individuals. FBB also offers private wealth management services and bank consulting services. FBB has four full-service banking locations in Madison, Brookfield, and Appleton, Wisconsin, and Leawood, Kansas.

As of December 31, 2025, FBB had six wholly-owned subsidiaries and total gross loans and leases receivable of $3.375 billion, total deposits of $3.380 billion, and total stockholders’ equity of $423.8 million.

4

Table of Contents

Corporate Information

Our principal executive offices are located at 401 Charmany Drive, Madison, Wisconsin 53719 and our telephone number is (608) 238-8008. We maintain an Internet website at www.firstbusiness.bank. The contents of our website are not incorporated by reference into this Form 10-K. This Form 10-K and all of our other filings under the Securities Exchange Act of 1934, as amended (the “Exchange Act”), are available free of charge through that website, including copies of our proxy statement, annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and any amendments to those reports, as soon as reasonably practicable after we file those materials with, or furnish them to, the Securities and Exchange Commission (“SEC”).

Markets

Although certain of our commercial banking products and services are marketed nationwide, our primary markets are Wisconsin, Kansas, and Missouri. Specifically, our three primary markets in Wisconsin are South Central Wisconsin, Southeast Wisconsin, and Northeast Wisconsin. We serve these markets primarily through our offices in Madison, Brookfield, and Appleton, respectively. We serve the greater Kansas City Metro through our Leawood, Kansas office. Each of our primary markets provides a unique set of economic and demographic characteristics which provide us with a variety of strategic opportunities. A brief description of each of our primary markets is as follows.

South Central Wisconsin

As the capital of Wisconsin and home of the University of Wisconsin-Madison, the greater Madison area, specifically Dane County and surrounding counties, offers an appealing economic environment populated by a highly educated workforce. While the economy of South Central Wisconsin is driven in large part by the government and education sectors, there is also a diverse array of industries outside of these segments. South Central Wisconsin is home to technology and research and development-related companies, which benefit from the area’s strong governmental and academic ties, as well as several major health care systems and hospitals, which provide healthcare services to South Central Wisconsin.

Southeast Wisconsin

The Milwaukee metropolitan area has a diverse economic base with a highly skilled labor force and strong manufacturing sector. The most prominent economic sectors include manufacturing, financial services, health care, diversified service companies, and education. The area is home to several major hospitals, providing healthcare services to the greater Southeast Wisconsin market, several large academic institutions including the University of Wisconsin-Milwaukee and Marquette University, and a wide variety of small- to medium-sized firms with representatives in nearly every industrial classification.

Northeast Wisconsin

The cities of Appleton, Green Bay, and Oshkosh, Wisconsin serve as the primary population centers in our Northeast Wisconsin market and provide an attractive market to a variety of industries, including transportation, utilities, packaging, and diversified services, with the most significant economic drivers being the manufacturing, packaging, and paper goods industries.

Kansas City Metro

The greater Kansas City Metro includes 15 counties and more than 50 communities in Missouri and Kansas, including a central business district located in Kansas City, Missouri and communities on both sides of the state line. The area is known for the diversity of its economic base, with major employers in manufacturing and distribution, architecture and engineering, technology, telecommunications, financial services, and bioscience, as well as local and federal government.

5

Table of Contents

EXECUTIVE OFFICERS OF THE REGISTRANT

The following contains certain information about the executive officers of FBFS. There are no family relationships between any directors or executive officers of FBFS.

Corey A. Chambas, age 63, has served as a director of FBFS since July 2002, as Chief Executive Officer ("CEO") since December 2006 and as President from February 2005 until January 2023. He served as Chief Operating Officer of FBFS from February 2005 to September 2006 and as Executive Vice President from July 2002 to February 2005. He served as Chief Executive Officer of FBB from July 1999 to September 2006 and as President of FBB from July 1999 to February 2005. Mr. Chambas has over 40 years of commercial banking experience. Prior to joining FBFS in 1993, he was a Vice President of Commercial Lending with M&I Bank, now known as BMO Bank, N.A. , in Madison, Wisconsin. Mr. Chambas announced his intention to retire as CEO effective May 2, 2026.

Brian D. Spielmann, age 43, has served as Chief Financial Officer ("CFO") of FBFS since April 2023. Mr. Spielmann also serves as the Chief Financial Officer of the Bank. He also currently serves as a director of our FBSF subsidiary. Mr. Spielmann had been serving as the Corporation’s Deputy Chief Financial Officer and Chief Accounting Officer since May 2022. Mr. Spielmann joined FBFS in 2006 and has held various positions including Chief Accounting Officer, Director of Finance, Financial Reporting Manager, and Senior Financial Accountant.

David R. Seiler, age 61, has served as Chief Operating Officer ("COO") of FBFS since April 2016 and as President of FBFS since January 2023. He also currently serves as a director for our FBSF subsidiary. FBFS has announced that Mr. Seiler will be named President and Chief Executive Officer effective upon Mr. Chambas' retirement. Mr. Seiler has over 30 years of financial services experience including his previous position as Managing Director (formerly Senior Vice President/Manager) of the Correspondent Banking Division with BMO Bank, N.A. in Milwaukee, Wisconsin which he held from 2007 to 2016. Prior to that, he held the position of Senior Vice President/Team Leader, Correspondent Real Estate Division from 2005 to 2007 and Vice President, Relationship Manager, Commercial Real Estate from 2002 to 2005.

Bradley A. Quade, age 60, has served as Chief Credit Officer ("CCO") of FBFS and the Bank since April 2020 and as Executive Vice President of FBFS since May 2024. Mr. Quade had been serving as the Corporation’s Chief Credit Officer since October 2019. He also currently serves as a director for our FBFS subsidiary. Mr. Quade has over 35 years of experience in banking at publicly traded and privately-owned institutions and has led successful lending teams in commercial banking, investment real estate, equipment leasing, and treasury management. Prior to joining FBFS, Mr. Quade held the position of Senior Vice President with Johnson Bank in Milwaukee, Wisconsin.

Jodi A. Chandler, age 61, has served as Chief Human Resources Officer of FBFS and the Bank since January 2010. Prior to that, she held the position of Senior Vice President-Human Resources for several years. She has been an employee of FBFS for over 30 years.

Laura M. Garcia, age 53, has served as Chief Risk Officer ("CRO") for FBFS and the Bank since March 2022. Prior to joining FBFS, she held the position of Head of North American Risk and Compliance, Managing Director for BMO Bank, N.A. in Chicago, Illinois, from 2018 to 2022. Ms. Garcia has over 30 years of experience in the financial services industry, centered in commercial banking, credit, compliance, and risk management.

James E. Hartlieb, age 55, has served as President of FBB since 2015 and as Chief Executive Officer of FBB and a director of FBB since January 2023. Mr. Hartlieb joined FBB in 2009 as Senior Vice President of Greater Dane County. He also currently serves as a director of our FBSF subsidiary. Mr. Hartlieb has over 30 years of financial services experience. Prior to joining FBB, Mr. Hartlieb held the position of Regional President with AMCORE Bank in Madison, Wisconsin, which he held from 1998 to 2009.

Daniel S. Ovokaitys, age 52, has served as Chief Information Officer ("CIO") of FBFS and the Bank since June 2014. Prior to joining FBFS, Mr. Ovokaitys held the position of Head of Corporate IT (North/South America) for Merz Pharmaceuticals, located in Frankfurt, Germany, from 2010 to 2014. He also served as Director of IT for Aurora Health Care from 2006 to 2010 and Manager of IT for the American Transmission Company from 2000 to 2006.

6

Table of Contents

Niamh M. Kristufek, age 49, has served as President -Specialty Finance of FBFS and the Bank since January 2025. Prior to joining FBFS, she held the position of Head, U.S. Specialty Sales at BMO Bank, N.A. in Chicago, Illinois from June to December 2024 and Head of U.S. Business Banking for BMO Bank, N.A. from August 2018 to September 2024. She is also currently the Board Chair for Envision Unlimited, a non-profit located in Chicago, Illinois.

SUPERVISION AND REGULATION

Below is a brief description of certain laws and regulations that relate to us and the Bank. This narrative does not purport to be complete and is qualified in its entirety by reference to applicable laws and regulations.

General

Federal Deposit Insurance Corporation (“FDIC”)-insured institutions, like the Bank, their holding companies, and their affiliates are extensively regulated under federal and state law. As a result, our growth and earnings performance may be affected not only by management decisions and general economic conditions, but also by the requirements of federal and state statutes and by the regulations and policies of various bank regulatory agencies, including the Board of Governors of the Federal Reserve System (“Federal Reserve”), the Bank’s state regulator, the Wisconsin Department of Financial Institutions (“WDFI”), and the Bank's primary federal regulator, the FDIC, and the Consumer Financial Protection Bureau ("CFPB"). Furthermore, taxation laws administered by the Internal Revenue Service (“IRS”) and state taxing authorities, accounting rules developed by the Financial Accounting Standards Board (“FASB”), securities laws administered by the SEC and state securities authorities, and anti-money laundering laws enforced by the U.S. Department of the Treasury (“Treasury”) have an impact on our business. The effect of these statutes, regulations, regulatory policies, and accounting rules are significant to our operations and results.

Federal and state banking laws impose a comprehensive system of supervision, regulation, and enforcement on the operations of FDIC-insured institutions, their holding companies, and affiliates that is intended primarily for the protection of the FDIC-insured deposits and depositors of banks, rather than shareholders. These laws, and the regulations of the bank regulatory agencies issued under them, affect, among other things, the scope of our business, the kinds and amounts of investments the Corporation and the Bank may make, limits on the Bank’s loans to any one borrower, reserve requirements, required capital levels relative to assets, the nature and amount of collateral for loans, the establishment of branches, the ability to merge with, consolidate with, and acquire other financial institutions and related businesses, dealings with the Corporation’s and the Bank’s insiders and affiliates, and payment of dividends.

The supervisory framework for U.S. banking organizations subjects banks and bank holding companies to regular examination by their respective regulatory agencies, which results in examination reports and ratings that are not publicly available and can impact the conduct and growth of their business. These examinations consider not only compliance with applicable laws and regulations, but also capital levels, asset quality and risk, management ability and performance, earnings, liquidity, information technology, and various other factors. The regulatory agencies generally have broad discretion to impose restrictions and limitations on the operations of a regulated entity where the agencies determine, among other things, that such operations are unsafe or unsound, fail to comply with applicable law, or are otherwise inconsistent with laws and regulations.

The Role of Capital

Regulatory capital represents the net assets of a banking organization available to absorb losses. While capital has historically been one of the key measures of the financial health of both bank holding companies and banks, its role became fundamentally more important in the wake of the global financial crisis, as the banking regulators recognized that the amount and quality of capital held by banks prior to the crisis was insufficient to absorb losses during periods of severe stress. Certain provisions of the Dodd-Frank Act and Basel III, discussed below, establish capital standards for banks and bank holding companies that are meaningfully more stringent than those in place previously.

Minimum Required Capital Levels. Banks have been required to hold minimum levels of capital based on guidelines established by the bank regulatory agencies since 1983. The minimums have been expressed in terms of ratios of “capital” divided by “total assets.” As discussed below, bank capital measures have become more sophisticated over the years and have focused more on the quality of

7

Table of Contents

capital and the risk of assets. Bank holding companies have historically had to comply with less stringent capital standards than their bank subsidiaries and have been able to raise capital with hybrid instruments such as trust preferred securities. The Dodd-Frank Act mandated the Federal Reserve to establish minimum capital levels for holding companies on a consolidated basis as stringent as those required for FDIC-insured institutions. A result of this change is that the proceeds of hybrid instruments, such as trust preferred securities, were excluded from capital over a phase-out period; however, if such securities were issued prior to May 19, 2010 by bank holding companies with less than $15 billion of assets, they may be retained, subject to certain restrictions.

The Basel III Rule. In July 2013, the U.S. federal banking agencies approved the implementation of the Basel III regulatory capital reforms in pertinent part, and, at the same time, promulgated rules effecting certain changes required by the Dodd-Frank Act (the “Basel III Rule”). In contrast to capital requirements historically, which were in the form of guidelines, the Basel III Rule was released in the form of enforceable regulations by each of the regulatory agencies. The Basel III Rule is applicable to all banking organizations that are subject to minimum capital requirements, including federal and state banks and savings and loan associations, as well as to bank and savings and loan holding companies, other than “small bank holding companies” who are relieved from compliance with the Basel III Rule. Historically we have been disqualified from taking advantage of the relief since we have securities registered with the SEC. Moreover, our asset size now exceeds the small bank holding company threshold. Banking organizations became subject to the Basel III Rule on January 1, 2015, and its requirements were fully phased-in as of January 1, 2019.

The Basel III Rule increased the required quantity and quality of capital and, for nearly every class of assets, it requires a more complex, detailed and calibrated assessment of risk and calculation of risk-weight amounts. The Basel III Rule also introduced the concept of Common Equity Tier 1 Capital, which consists primarily of common stock, related surplus (net of treasury stock), retained earnings, and Common Equity Tier 1 minority interests subject to certain regulatory adjustments. The Basel III Rule also changed the definition of capital by establishing more stringent criteria that instruments must meet to be considered Additional Tier 1 Capital (primarily non-cumulative perpetual preferred stock that meets certain requirements) and Tier 2 Capital (primarily other types of preferred stock and subordinated debt, subject to limitations). A number of instruments that historically qualified as Tier 1 Capital under Basel I do not qualify under Basel III, or their qualifications changed. For example, noncumulative perpetual preferred stock, which qualified as simple Tier 1 Capital under Basel III, does not qualify as Common Equity Tier 1 Capital, but qualifies as Additional Tier 1 Capital. The Basel III Rule also constrained the inclusion of minority interests, mortgage-servicing assets, and deferred tax assets in capital and requires deductions from Common Equity Tier 1 Capital in the event that such assets exceed a certain percentage of a banking institution’s Common Equity Tier 1 Capital.

The Basel III Rule currently requires minimum capital ratios as follows:

•
A ratio of minimum Common Equity Tier 1 Capital equal to 4.5% of risk-weighted assets;

•
A ratio of minimum Tier 1 Capital equal to 6% of risk-weighted assets;

•
A ratio of minimum Total Capital (Tier 1 plus Tier 2) equal to 8% of risk-weighted assets; and

•
A minimum leverage ratio of Tier 1 Capital to total quarterly average assets equal to 4% in all circumstances.

Institutions that seek the freedom to make capital distributions (including for dividends and repurchases of stock) and pay discretionary bonuses to executive officers without restriction must also maintain 2.5% in Common Equity Tier 1 Capital attributable to a capital conservation buffer. The purpose of the conservation buffer is to ensure that banking institutions maintain a buffer of capital that can be used to absorb losses during periods of financial and economic stress. Factoring in the conservation buffer increases the minimum ratios depicted above to 7% for Common Equity Tier 1 Capital, 8.5% for Tier 1 Capital and 10.5% for Total Capital.

Through subsequent rulemaking, the federal banking agencies provided certain forms of relief to banking organizations that are not subject to the capital regulation's advanced approaches, such as the Corporation. For instance, non-advanced approaches institutions are subject to simpler regulatory capital requirements for Mortgage Servicing Assets (“MSA”), certain Deferred Tax Assets (“DTA”) arising from temporary differences, investments in the capital of unconsolidated financial institutions, and requirements for the amount of capital issued by a consolidated subsidiary of a banking organization and held by third parties (sometimes referred to as a minority interest) that is includable in regulatory capital. Specifically, such institutions may deduct from Common Equity Tier 1 Capital any amount of MSAs, temporary difference DTAs, and investments in the capital of unconsolidated financial institutions that individually exceeds 25 percent of Common Equity Tier 1 Capital.

8

Table of Contents

On July 27, 2023, the federal banking agencies issued a proposed rule to implement the final components of the Basel III standards set by the Basel Committee on Banking Supervision in 2017, referred to as the Basel III Endgame; based on our asset size the Basel III standards do not apply to the Corporation and the Bank.

Well-Capitalized Requirements. The ratios described above are minimum standards in order for banking organizations to be considered “adequately capitalized.” Bank regulatory agencies uniformly encourage banks to hold more capital and be “well-capitalized” and, to that end, federal law and regulations provide various incentives for banking organizations to maintain regulatory capital at levels in excess of minimum regulatory requirements. For example, a banking organization that is well-capitalized may: (i) qualify for exemptions from prior notice or application requirements otherwise applicable to certain types of activities; (ii) qualify for expedited processing of other required notices or applications; and (iii) accept, roll-over, or renew brokered deposits. Higher capital levels could also be required if warranted by the particular circumstances or risk profiles of individual banking organizations. For example, the Federal Reserve’s capital guidelines contemplate that additional capital may be required to take adequate account of, among other things, interest rate risk, or the risks posed by concentrations of credit, nontraditional activities, or securities trading activities. Further, any banking organization experiencing or anticipating significant growth would be expected to maintain capital ratios, including tangible capital positions (i.e., Tier 1 Capital less all intangible assets), well above the minimum levels.

Under the capital regulations of the FDIC, in order to be well‑capitalized, a banking organization must maintain:

•
A Common Equity Tier 1 Capital ratio to risk-weighted assets of 6.5% or more;

•
A ratio of Tier 1 Capital to total risk-weighted assets of 8% or more;

•
A ratio of Total Capital to total risk-weighted assets of 10% or more; and

•
A leverage ratio of Tier 1 Capital to total adjusted average quarterly assets of 5% or greater.

As of December 31, 2025: (i) the Bank is not subject to a directive from the WDFI or the FDIC to increase its capital; and (ii) the Bank was well-capitalized, as defined by FDIC regulations. The Corporation had regulatory capital in excess of the Federal Reserve’s requirements as of December 31, 2025.

Prompt Corrective Action. The concept of an institution being “well-capitalized” is part of a regulatory enforcement regime that provides the federal banking regulators with broad power to take “prompt corrective action” to resolve the problems of institutions based on the capital level of each particular institution. The extent of the regulators’ powers depends on whether the institution in question is “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” or “critically undercapitalized,” in each case as defined by regulation. Depending upon the capital category to which an institution is assigned, the regulators’ corrective powers include: (i) requiring the institution to submit a capital restoration plan; (ii) limiting the institution’s asset growth and restricting its activities; (iii) requiring the institution to issue additional capital stock (including additional voting stock) or to sell itself; (iv) restricting transactions between the institution and its affiliates; (v) restricting the interest rate that the institution may pay on deposits; (vi) ordering a new election of directors of the institution; (vii) requiring that senior executive officers or directors be dismissed; (viii) prohibiting the institution from accepting deposits from correspondent banks; (ix) requiring the institution to divest certain subsidiaries; (x) prohibiting the payment of principal or interest on subordinated debt; and (xi) ultimately, appointing a receiver for the institution.

9

Table of Contents

Community Bank Capital Simplification. Community banks have long raised concerns with bank regulators about the regulatory burden, complexity, and costs associated with certain provisions of the Basel III Rule. In response, Congress provided a potential Basel III “off-ramp” for certain institutions, like us, under Section 201 of the Regulatory Relief Act. Pursuant to authority granted thereunder, on September 17, 2019, the agencies adopted a final rule, effective on January 1, 2020, providing that banks and bank holding companies that have less than $10 billion in total consolidated assets and meet other qualifying criteria, including a “Community Bank Leverage Ratio” (“CBLR”) calculated by dividing Tier 1 capital by average total consolidated assets of greater than 9%, will be eligible to opt into the CBLR framework. By opting into the framework, qualifying banks and bank holding companies maintaining a CBLR greater than 9% will be considered to have satisfied the generally applicable risk-based and leverage capital requirements in the agencies’ capital rules and, if applicable, will be considered to have met the well-capitalized ratio requirements for purposes of section 38 of the Federal Deposit Insurance Act. In addition to the consolidated assets and CBLR requirements described above, a qualifying bank or bank holding company must also have (i) total off-balance sheet exposures (excluding derivatives other than sold credit derivatives and unconditionally cancellable commitments) of 25% or less of total consolidated assets, and (ii) the sum of total trading assets and trading liabilities of 5% or less of total consolidated assets.

The Corporation and the Bank opted out of the CBLR framework for each reporting period in 2025 and has the option to opt into the framework for future reporting periods. The decision to opt into or out of the CBLR framework is monitored on an ongoing basis.

First Business Financial Services, Inc.

General. As the sole shareholder of the Bank, we are a bank holding company. As a bank holding company, we are registered with, and subject to regulation, supervision, and enforcement by, the Federal Reserve under the Bank Holding Company Act of 1956, as amended (“BHCA”). We are legally obligated to act as a source of financial strength to the Bank and to commit resources to support the Bank in circumstances where we might not otherwise do so. Under the BHCA, we are subject to periodic examination by the Federal Reserve. We are required to file with the Federal Reserve periodic reports of our operations and such additional information regarding the Corporation and our subsidiaries as the Federal Reserve may require.

Acquisitions and Activities. The primary purpose of a bank holding company is to control and manage banks. The BHCA generally requires the prior approval of the Federal Reserve for any merger involving a bank holding company or any acquisition by a bank holding company of another bank or bank holding company. Subject to certain conditions (including deposit concentration limits established by the BHCA), the Federal Reserve may allow a bank holding company to acquire banks located in any state of the United States. In approving interstate acquisitions, the Federal Reserve is required to give effect to applicable state law limitations on the aggregate amount of deposits that may be held by the acquiring bank holding company and its FDIC-insured institution affiliates in the state in which the target bank is located (provided that those limits do not discriminate against out-of-state institutions or their holding companies) and state laws that require that the target bank has been in existence for a minimum period of time (not to exceed five years) before being acquired by an out-of-state bank holding company. Furthermore, in accordance with the Dodd-Frank Act, bank holding companies must be well-capitalized and well-managed in order to effect interstate mergers or acquisitions. For a discussion of the capital requirements, see The Role of Capital above.

The BHCA generally prohibits the Corporation from acquiring direct or indirect ownership or control of more than 5% of the voting shares of any company that is not a bank and from engaging in any business other than that of banking, managing and controlling banks or furnishing services to banks and their subsidiaries. This general prohibition is subject to a number of exceptions. The principal exception allows bank holding companies to engage in, and to own shares of companies engaged in, certain businesses deemed by the Federal Reserve to be “so closely related to banking ... as to be a proper incident thereto.” This authority permits the Corporation to engage in a variety of banking-related businesses, including the ownership and operation of a savings association, or any entity engaged in consumer finance, equipment leasing, the operation of a computer service bureau (including software development), and mortgage banking and brokerage services. The BHCA does not place territorial restrictions on the domestic activities of non-bank subsidiaries of bank holding companies.

Bank holding companies that meet certain eligibility requirements prescribed by the BHCA and elect to operate as financial holding companies may engage in, or own shares in companies engaged in, a wider range of non-banking activities, including securities and insurance underwriting and sales, merchant banking, and any other activity that the Federal Reserve, in consultation with the Secretary of the Treasury, determines by regulation or order is financial in nature or incidental to any such financial activity or that the Federal

10

Table of Contents

Reserve determines by order to be complementary to any such financial activity and does not pose a substantial risk to the safety or soundness of FDIC-insured institutions or the financial system generally. The Corporation has not elected to operate as a financial holding company.

Change in Control. Federal law also prohibits any person or company from acquiring “control” of an FDIC-insured depository institution or its holding company without prior notice to the appropriate federal bank regulator. “Control” is conclusively presumed to exist upon the acquisition of 25% or more of the outstanding voting securities of a bank or bank holding company but may arise under certain circumstances between 10% and 24.99% ownership. On January 30, 2020, the Federal Reserve issued a final rule clarifying and expanding upon the Federal Reserve’s position on determinations of whether a company has the ability to exercise a controlling influence over another company. In particular, the final rule is intended to provide a better understanding of the facts and circumstances that the Federal Reserve considers most relevant when assessing whether control exists.

Dividend Payments. We are a legal entity separate and distinct from the Bank and our other subsidiaries. Our primary source of cash, other than securities offerings, is dividends from the Bank. Our ability to pay dividends to our shareholders may be affected by both general corporate law considerations and policies of the Federal Reserve applicable to bank holding companies. As a Wisconsin corporation, we are subject to the limitations of Wisconsin law, which allows us to pay dividends unless, after giving effect to a dividend, any of the following would occur: (i) we would not be able to pay our debts as they become due in the usual course of business or (ii) our total assets would be less than the sum of our total liabilities plus any amount that would be needed if we were to be dissolved at the time of the dividend payment, to satisfy the preferential rights upon dissolution of shareholders whose rights are superior to the rights of the shareholders receiving the distribution.

As a general matter, the Federal Reserve has indicated that the board of directors of a bank holding company should eliminate, defer, or significantly reduce dividends to shareholders if: (i) the company’s net income available to shareholders for the past four quarters, net of dividends previously paid during that period, is not sufficient to fully fund the dividends; (ii) the prospective rate of earnings retention is inconsistent with the company’s capital needs and overall current and prospective financial condition; or (iii) the company will not meet, or is in danger of not meeting, its minimum regulatory capital adequacy ratios. Moreover, under the Dodd-Frank Act and the requirements of the Federal Reserve, the Corporation, as a bank holding company, is required to serve as a source of financial strength to the Bank and to commit resources to support the Bank. In addition, consistent with its “source of strength” policy, the Federal Reserve has stated that, as a matter of prudent banking, a bank holding company should not maintain a level of cash dividends to its shareholders that places undue pressure on the capital of its bank subsidiaries, or that can be funded only through additional borrowings or other arrangements that may undermine the bank holding company’s ability to serve as a source of strength. The appropriate federal regulatory authorities have indicated that paying dividends that deplete a bank’s capital base to an inadequate level would be an unsafe and unsound banking practice and that banking organizations should generally pay dividends only out of current operating earnings.

The Federal Reserve possesses enforcement powers over bank holding companies and their non-bank subsidiaries to prevent or remedy actions that represent unsafe or unsound practices or violations of applicable statutes and regulations. Among these powers is the ability to proscribe the payment of dividends by banks and bank holding companies. In addition, under the Basel III Rule, institutions that seek the freedom to pay dividends have to maintain 2.5% in Common Equity Tier 1 Capital attributable to the capital conservation buffer. See The Role of Capital above for additional information.

Monetary Policy. The monetary policy of the Federal Reserve has a significant effect on the operating results of financial or bank holding companies and their subsidiaries. Among the tools available to the Federal Reserve to affect the money supply are open market transactions in U.S. government securities, changes in the discount rate on bank borrowings, and changes in reserve requirements against bank deposits. These means are used in varying combinations to influence overall growth and distribution of bank loans, investments and deposits, and their use may affect interest rates charged on loans or paid on deposits.

Federal Securities Regulation. The Corporation’s common stock is registered with the SEC under the Exchange Act and traded on the Nasdaq Global Select Market. Consequently, we are subject to the information, proxy solicitation, insider trading, and other restrictions and requirements of the SEC under the Exchange Act and the listing requirements of the Nasdaq Global Select Market.

11

Table of Contents

Corporate Governance. The Dodd-Frank Act addressed many investor protection, corporate governance, and executive compensation matters that affect most U.S. publicly traded companies. The Dodd-Frank Act increased shareholder influence over boards of directors by requiring companies to give shareholders a nonbinding vote on executive compensation and so-called “golden parachute” payments, and by authorizing the SEC to promulgate rules that would allow shareholders to nominate and solicit voters for their own candidates using a company’s proxy materials. The legislation also directed the Federal Reserve to promulgate rules prohibiting excessive compensation paid to executives of bank holding companies, regardless of whether such companies are publicly traded.

The Bank

General. The Bank is a Wisconsin state-chartered bank. The deposit accounts of the Bank are insured by the FDIC’s Deposit Insurance Fund (“DIF”) to the maximum extent provided under federal law and FDIC regulations. As a Wisconsin-chartered FDIC-insured bank, the Bank is subject to the examination, supervision, reporting, and enforcement requirements of the WDFI, the chartering authority for Wisconsin banks, and the FDIC, designated by federal law as the primary federal regulator of insured state banks that, like the Bank, are not members of the Federal Reserve System (nonmember banks).

Deposit Insurance. As an FDIC-insured institution, the Bank is required to pay deposit insurance premium assessments to the FDIC. Deposits are insured up to applicable limits by the FDIC and such insurance is backed by the full faith and credit of the United States Government. Under the Dodd-Frank Act, a permanent increase in deposit insurance was authorized to $250,000 per depositor, per insured depository institution for each account ownership category.

The FDIC has adopted a risk-based assessment system whereby FDIC-insured institutions pay insurance premiums at rates based on their risk classification. For institutions like the Bank that are not considered large and highly complex banking organizations, assessments are now based on examination ratings and financial ratios. At least semi-annually, the FDIC updates its loss and income projections for the DIF and, if needed, increases or decreases the assessment rates, following notice and comment on proposed rulemaking. The assessment base against which an FDIC-insured institution’s deposit insurance premiums paid to the DIF has been calculated since effectiveness of the Dodd-Frank Act is based on its average consolidated total assets less its average tangible equity. This method shifted the burden of deposit insurance premiums toward those large depository institutions that rely on funding sources other than U.S. deposits. The assessment rate schedule can change from time to time, at the discretion of the FDIC, subject to certain limits.

On October 18, 2022, the FDIC adopted a final rule increasing the initial base deposit insurance rate schedules by 2 basis points, beginning with the first quarterly assessment period of 2023, which will remain in effect until the level of the DIF reserve ratios to insured deposits meets the FDIC's long-term goals.

There was a sharp decline in the DIF in 2023 following the failures of Silicon Valley Bank, Signature Bank and First Republic Bank in the first half of 2023, coupled with strong insured deposit growth. On November 16, 2023, the FDIC issued a final rule to implement a special assessment to recover the loss in the DIF associated with protecting uninsured depositors following these bank failures. Under the final rule, the assessment base for an insured depository institution will be equal to the institution’s estimated uninsured deposits as of December 31, 2022, adjusted to exclude the first $5 billion in estimated uninsured deposits. Our estimated level of uninsured deposits was below that threshold, and therefore, the Bank was not subject to the special assessment.

The FDIC is authorized to conduct examinations of and require reporting by FDIC-insured institutions. It is also authorized to terminate a depository bank’s deposit insurance upon a finding by the FDIC that the bank’s financial condition is unsafe or unsound or that the institution has engaged in unsafe or unsound practices or has violated any applicable rule, regulation, order or condition enacted or imposed by the bank’s regulatory agency. The termination of deposit insurance for the Bank would have a material adverse effect on our earnings, operations and financial condition.

Supervisory Assessments. All Wisconsin banks are required to pay supervisory assessments to the WDFI to fund the operations of that agency. The amount of the assessment is calculated on the basis of the Bank’s total assets.

Liquidity Requirements. Liquidity is a measure of the ability and ease with which bank assets may be converted to cash. Liquid assets are those that can be converted to cash quickly if needed to meet financial obligations. To remain viable, FDIC-insured institutions

12

Table of Contents

must have enough liquid assets to meet their near-term obligations, such as withdrawals by depositors. Basel III also includes a liquidity framework that requires FDIC-insured institutions to measure their liquidity against specific liquidity tests. One test, referred to as the Liquidity Coverage Ratio, is designed to ensure that the banking entity has an adequate stock of unencumbered high-quality liquid assets that can be converted easily and immediately in private markets into cash to meet liquidity needs for a 30-calendar day liquidity stress scenario. The other test, known as the Net Stable Funding Ratio, is designed to promote more medium- and long-term funding of the assets and activities of FDIC-insured institutions over a one-year horizon. These tests provide an incentive for banks and holding companies to increase their holdings in Treasury securities and other sovereign debt as a component of assets, increase the use of long-term debt as a funding source, and rely on stable funding such as core deposits. Management defines core deposits as other than wholesale or brokered deposits.

Dividend Payments. The primary source of funds for the Corporation is dividends from the Bank. Under Wisconsin law, the board of directors of a bank may declare and pay a dividend from its undivided profits in an amount it considers expedient. The board of directors must provide for the payment of all expenses, losses, required reserves, taxes, and interest accrued or due from the bank before the declaration of dividends from undivided profits. If dividends declared and paid in either of the two preceding years exceeded net income for either of those two years respectively, the bank may not declare or pay any dividend in the current year that exceeds year-to-date net income except with the written consent of the WDFI. The FDIC and the WDFI may prohibit the payment of dividends by the Bank if either or both determine such payment would constitute an unsafe or unsound practice. In addition, under the Basel III Rule, institutions that seek the freedom to pay dividends will have to maintain 2.5% in Common Equity Tier 1 Capital attributable to the capital conservation buffer. See The Role of Capital above.

State Bank Investments and Activities. The Bank is permitted to make investments and engage in activities directly or through subsidiaries as authorized by Wisconsin law. Under federal law and FDIC regulations, FDIC-insured state banks are prohibited, subject to certain exceptions, from making or retaining equity investments of a type, or in an amount, which are not permissible for a national bank. Federal law and FDIC regulations also prohibit FDIC-insured state banks and their subsidiaries, subject to certain exceptions, from engaging as principal in any activity that is not permitted for a national bank unless the bank meets, and continues to meet, its minimum regulatory capital requirements and the FDIC determines that the activity would not pose a significant risk to the DIF. These restrictions have not had, and are not currently expected to have, a material impact on the operations of the Bank.

Affiliate Transactions. The Bank is subject to certain restrictions imposed by federal law on “covered transactions” between the Bank and its “affiliates.” The Corporation, its subsidiaries, and any companies under common control are affiliates of the Bank for purposes of these restrictions. Covered transactions subject to the restrictions include extensions of credit to the affiliate, investments in the stock or other securities of the affiliate, issuance of a guarantee on behalf of an affiliate, and the acceptance of the stock or other securities of the affiliate as collateral for loans made by the Bank. The Dodd-Frank Act enhanced the requirements for certain transactions with affiliates, including an expansion of the definition of “covered transactions” and an increase in the amount of time for which collateral requirements regarding covered transactions must be maintained.

Insider Transactions. Certain limitations and reporting requirements are also placed on extensions of credit by the Bank to its directors and officers, to directors and officers of the Corporation and its subsidiaries, to principal shareholders of the Corporation, and to “related interests” of such directors, officers, and principal shareholders. In addition, federal law and regulations may affect the terms upon which any person who is a director or officer of the Corporation or the Bank, or a principal shareholder of the Corporation, may obtain credit from banks with which the Bank maintains a correspondent relationship.

Safety and Soundness Standards/Risk Management. The federal banking agencies have adopted operational and managerial standards to promote the safety and soundness of FDIC-insured institutions. The standards apply to internal controls, information systems, internal audit systems, risk mitigation, bank operations, compliance, credit underwriting, interest rate exposure, asset growth, compensation, fiduciary risk, asset quality, and earnings.

In general, the safety and soundness standards prescribe the goals to be achieved in each area, and each institution is responsible for establishing its own procedures to achieve those goals. While regulatory standards do not have the force of law, if an institution operates in an unsafe and unsound manner, the FDIC-insured institution’s primary federal regulator may require the institution to submit a plan for achieving and maintaining compliance. If an FDIC-insured institution fails to submit an acceptable compliance plan or fails in any material respect to implement a compliance plan that has been accepted by its primary federal regulator, the regulator is

13

Table of Contents

required to issue an order directing the institution to cure the deficiency. Until the deficiency cited in the regulator’s order is cured, the regulator may restrict the FDIC-insured institution’s rate of growth, require the FDIC-insured institution to increase its capital, restrict the rates the institution pays on deposits, or require the institution to take any action the regulator deems appropriate under the circumstances. Noncompliance with safety and soundness may also constitute grounds for other enforcement action by the federal bank regulatory agencies, including cease and desist orders and civil money penalty assessments.

The bank regulatory agencies have emphasized the importance of sound risk management processes and strong internal controls when evaluating the activities of the FDIC-insured institutions they supervise. Properly managing risks has been identified as critical to the conduct of safe and sound banking activities and has become even more important as new technologies, product innovation, and the size and speed of financial transactions have changed the nature of banking markets. The agencies have identified a spectrum of risks facing a banking institution including, but not limited to, credit, market, liquidity, operational, compliance, and reputational risk. In particular, recent regulatory pronouncements have focused on operational risk, which arises from the potential that inadequate information systems, operational problems, breaches in internal controls or failures of internal controls due to human error, insufficient staffing, or insufficiently trained or skilled personnel, fraud, or unforeseen catastrophes will result in unexpected losses. New products and services, third-party risk, incentive compensation, and cybersecurity are critical sources of risk that FDIC-insured institutions are expected to address in the current environment. The Bank is expected to have active board and senior management oversight; adequate policies, procedures, and limits; adequate risk measurement, monitoring, and management information systems; and comprehensive internal controls.

Branching Authority. Wisconsin banks, such as the Bank, have the authority under Wisconsin law to establish branches anywhere in the State of Wisconsin, subject to receipt of all required regulatory approvals. The establishment of new interstate branches has historically been permitted only in those states the laws of which expressly authorize such expansion. The Dodd-Frank Act permits well-capitalized and well-managed banks to establish new interstate branches or acquire individual branches of a bank in another state (rather than the acquisition of an out-of-state bank in its entirety) without impediments. Federal law permits state and national banks to merge with banks in other states subject to: (i) regulatory approval; (ii) federal and state deposit concentration limits; and (iii) state law limitations requiring the merging bank to have been in existence for a minimum period of time (not to exceed five years) prior to the merger.

Brokered Deposits. On December 19, 2018, the FDIC adopted a final rule on the treatment of reciprocal deposits pursuant to the Regulatory Relief Act. The final rule, effective March 6, 2019, exempts certain reciprocal deposits from being considered as brokered deposits for certain insured institutions. In particular, well-capitalized and well-rated institutions are not required to treat reciprocal deposits as brokered deposits up to the lesser of 20% of their total liabilities or $5 billion. Institutions that are not both well-capitalized and well-rated may also exclude reciprocal deposits from their brokered deposits under certain circumstances.

On December 15, 2020, the FDIC issued a final rule on brokered deposits. The rule aims to clarify and modernize the FDIC’s existing regulatory framework for brokered deposits. Among other things, the rule establishes bright-line standards for determining whether an entity meets the definition of a “deposit broker,” and identifies a number of business relationships (or “designated exceptions”) that automatically meet the “primary purpose” exception. The rule also establishes a transparent application process for entities that seek a “primary purpose” exception but do not meet one of the “designated exceptions.” The new rule also reflects technological changes across the banking industry and removes regulatory disincentives that limit banks’ ability to serve their customers. Full compliance with the amended brokered deposits regulation was required by January 1, 2022.

In August 2024, the FDIC published a proposed a rule to revise the FDIC’s regulations concerning brokered deposits, which would have significantly reversed the FDIC’s position on what constitutes a brokered deposit and narrowed the exceptions to the definition of the term “deposit broker.” The FDIC withdrew the proposed rule in March 2025.

Community Reinvestment Act (“CRA”) Requirements. The CRA requires the Bank to have a continuing and affirmative obligation in a safe and sound manner to help meet the credit needs of the entire community, including low- and moderate-income (“LMI”) neighborhoods. Federal regulators regularly assess the Bank’s record of meeting the credit and investment needs of its communities. An institution’s CRA assessment may be used by its regulators in their evaluation of certain applications, including a merger, acquisition, or the establishment of a branch office. An unsatisfactory rating may be used as a basis for denial of such an application.

14

Table of Contents

On October 24, 2023, the federal banking agencies jointly issued a final rule to strengthen and modernize the existing CRA regulations. In 2025, the federal banking agencies proposed to formally rescind the 2023 rule and reinstate the prior CRA framework, with certain updates for current asset thresholds. The agencies are now proceeding with a formal notice-and-comment rulemaking to repeal the 2023 rule.

Anti-Money Laundering/Counting the Financing of Terrorism ("CFT"). The Bank is subject to several federal laws that are designed to combat money laundering and countering the financing of terrorism, and restrict transactions with persons, companies, or foreign governments sanctioned by United States authorities. This category of laws includes the Bank Secrecy Act, the Money Laundering Control Act, the USA PATRIOT Act (collectively, “AML/CFT laws”) and implementing regulations as administered by the United States Treasury Department’s Office of Foreign Assets Control (“sanctions laws”).

As implemented by federal banking and securities regulators and the Department of the Treasury, AML/CFT laws obligate depository institutions to verify their customers’ identity, conduct customer due diligence, report on suspicious activity, file reports of transactions in currency, and conduct enhanced due diligence on certain accounts. In addition, the Financial Crimes Enforcement Network (“FinCEN”), promulgated customer due diligence and customer identification rules that required banks to identify and verify the identity of beneficial owners of all legal entity customers (with certain exclusions) at the time a new account is opened (subject to certain exemptions). Sanctions laws prohibit persons of the United States from engaging in any transaction with a restricted person or restricted country. Depository institutions are required by their respective federal regulators to maintain policies and procedures in order to ensure compliance with the above obligations. Federal regulators regularly examine AML/CFT and sanctions compliance programs to ensure their adequacy and effectiveness. Non–compliance with sanctions laws and/or AML/CFT laws or failure to maintain an adequate AML/CFT compliance program can lead to significant monetary penalties and reputational damage, and federal regulators evaluate the effectiveness of an applicant in combating money laundering when determining whether to approve a proposed bank merger, acquisition, restructuring, or other expansionary activity.

In June 2024, FinCEN issued a proposed rule to strengthen and modernize financial institutions’ AML/CFT programs. Key requirements of the proposed rule include (i) conducting periodic risk assessments to measure AML/CFT risks; (ii) designating a qualified AML/CFT office; and (iii) periodic testing of the AML/CFT program by an independent internal or external party. The proposed rule would also require that a financial institution’s AML/CFT program be established, maintained, and enforced by persons in the United States who are accessible to, and subject to oversight and supervision by, the Secretary of the Treasury and the appropriate federal functional regulator. This proposed rule was finalized effective January 1, 2026.

Privacy and Cybersecurity. The Bank is subject to many U.S. federal and state laws and regulations governing requirements for maintaining policies and procedures to protect non-public personal information of their consumers. These laws require the Bank to periodically disclose their privacy policies and practices relating to sharing such information and permit consumers to opt out of their ability to share information with unaffiliated third parties under certain circumstances. The laws also impact the Bank’s ability to share certain information with affiliates and non-affiliates for marketing and/or non-marketing purposes, or to contact clients with marketing offers.

Given the increased focus on privacy and data security in the United States and internationally, laws and regulations related to the same are evolving. Multiple states and Congress are considering additional laws or regulations that could create or alter individual privacy rights and impose additional obligations on banks and related financial services companies in possession of or with access to personal data.

The Bank is required to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of customer records and information. On November 18, 2021, the FDIC, the Federal Reserve System, and the OCC (collectively, the agencies) issued a joint final rule, to establish computer-security incident notification requirements for banking organizations and their bank service providers.

Specifically, the rule requires banking organizations to notify their primary federal regulator as soon as possible and no later than 36 hours after the discovery of a “computer-security incident” that rises to the level of a "notification incident," as those terms are defined under the final rule. Banks’ service providers are required under the rule to notify any affected bank to or on behalf of which the

15

Table of Contents

service provider provides services "as soon as possible" after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank for as much as four hours.

The federal banking agencies have also adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of the board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services. Recent cyberattacks against banks and other financial institutions that resulted in unauthorized access to confidential customer information have prompted the federal banking regulators to issue more extensive guidance on cybersecurity risk management. Financial institutions are expected to design multiple layers of security controls to establish lines of defense and ensure that their risk management processes address the risks posed by compromised customer credentials, including security measures to authenticate customers accessing internet-based services. A financial institution also should have a robust business continuity program to recover from a cyberattack and procedures for monitoring the security of third-party service providers that may have access to nonpublic data at the institution.

Additionally, recent and ongoing developments may impact FBB’s data security- and privacy-related controls and risk profile. On October 22, 2024, the CFPB adopted a final rule regarding personal financial data rights that is designed to promote “open banking.” The final rule requires, among other things, that data providers, including any financial institution, make available to consumers and certain authorized third parties upon request certain covered transactions, account, and payment information. Financial institutions with assets between $3 billion and $10 billion, including FBB, are required to comply with the final rule by April 1, 2029. On the same day the final rule was released, certain industry participants filed a complaint against the CFPB challenging the final rule, which challenge threatened the certainty or timing of the final rule’s implementation. In August 2025, the CFPB issued an advanced notice of proposed rulemaking soliciting comments to reconsider the implementation of the final rule and focused on four primary areas: (i) defining who may act as a consumer-authorized recipient of financial data; (ii) allocating the cost of data access; (iii) managing information security risks; and (iv) safeguarding consumer privacy. Comments were due on this proposal on October 21, 2025. In November 2025, a federal judge issued an injunction delaying the compliance dates of the final rule, citing uncertainty about the ability to enact a final rule prior to the earliest compliance deadlines. In December 2025, the CFPB signaled that it may issue an interim final rule to address immediate needs with the broader rulemaking continues.

Concentrations in Commercial Real Estate. Concentration risk exists when FDIC-insured institutions deploy too many assets to any one industry or segment. A concentration in commercial real estate is one example of regulatory concern. The interagency Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices guidance (“CRE Guidance”) provides supervisory criteria, including the following numerical indicators, to assist bank examiners in identifying banks with potentially significant commercial real estate loan concentrations that may warrant greater supervisory scrutiny: (i) commercial real estate loans exceeding 300% of capital and increasing 50% or more in the preceding three years; or (ii) construction and land development loans exceeding 100% of capital. The CRE Guidance does not limit banks’ levels of commercial real estate lending activities, but rather guides institutions in developing risk management practices and levels of capital that are commensurate with the level and nature of their commercial real estate concentrations. On December 18, 2023, the federal banking agencies issued a statement to reinforce prudent risk-management practices related to CRE lending, having observed substantial growth in many CRE asset and lending markets, increased competitive pressures, rising CRE concentrations in banks, and an easing of CRE underwriting standards. The federal bank agencies reminded FDIC-insured institutions to maintain underwriting discipline and exercise prudent risk-management practices to identify, measure, monitor, and manage the risks arising from CRE lending. In addition, FDIC-insured institutions must maintain capital commensurate with the level and nature of their CRE concentration risk.

Consumer Financial Services. The CFPB has broad rulemaking authority for a wide range of consumer protection laws that apply to all providers of consumer products and services, including the Bank, as well as the authority to prohibit “unfair, deceptive or abusive” acts and practices. The CFPB has examination and enforcement authority over providers with more than $10 billion in assets. FDIC-insured institutions with $10 billion or less in assets, like the Bank, continue to be examined by their applicable bank regulators.

Because abuses in connection with residential mortgages were a significant factor contributing to the financial crisis, many new rules issued by the CFPB and required by the Dodd-Frank Act addressed mortgage and mortgage-related products, their underwriting, origination, servicing, and sales. The Dodd-Frank Act significantly expanded underwriting requirements applicable to loans secured by 1-4 family residential real property and augmented federal law combating predatory lending practices. In addition to numerous

16

Table of Contents

disclosure requirements, the Dodd‑Frank Act imposed new standards for mortgage loan originations on all lenders, including banks and savings associations, in an effort to strongly encourage lenders to verify a borrower’s ability to repay, while also establishing a presumption of compliance for certain “qualified mortgages.” The Regulatory Relief Act provided relief in connection with mortgages for banks with assets of less than $10 billion, and, as a result, mortgages the Bank makes are now considered to be qualified mortgages if they are held in portfolio for the life of the loan.

Current Expected Credit Loss (“CECL”) Treatment. In June 2016, the FASB issued an accounting standard update, “Financial Instruments-Credit Losses (Topic 326), Measurement of Credit Losses on Financial Instruments,” which replaces the current “incurred loss” model for recognizing credit losses with an “expected loss” model referred to as the CECL model. Under the CECL model, we are required to present certain financial assets carried at amortized cost, such as loans held for investment and held-to-maturity debt securities, at the net amount expected to be collected. The measurement of expected credit losses is based on information about past events, including historical experience, current conditions, and reasonable and supportable forecasts that affect the collectability of the reported amount.

On December 21, 2018, the federal banking agencies issued a joint final rule revising their regulatory capital rules to (i) address the impending implementation of the CECL accounting standard under GAAP; (ii) provide an optional three-year phase-in period for the day-one adverse regulatory capital effects that banking organizations were expected to experience upon enacting CECL; and (iii) require the use of CECL in stress tests beginning with the 2020 capital planning and stress testing cycle for certain banking organizations. The final rule took effect on April 1, 2019; however, on August 26, 2020, the federal bank regulatory agencies issued a final rule allowing institutions that adopted the CECL accounting standard in 2020 the option to mitigate the estimated capital effects of CECL for two years, followed by the three-year transition period already provided by the joint final rule. We elected to use the 2020 Capital Transition Relief as permitted under the applicable regulations. As a result, the three-year phase-in period described above commenced in 2023.

Digital Asset Regulation. The federal banking agencies have issued interpretive guidance and statements regarding the engagement by banking organizations in certain digital asset activities. On August 16, 2022, the Federal Reserve released supervisory guidance encouraging all banking organizations supervised by the agency to notify its lead supervisory point of contact at the Federal Reserve prior to engaging in any digital asset-related activity. Prior to engaging in any such activities, banking organizations are expected to ensure their proposed activities are legally permissible under relevant state and federal laws, and ensure they have implemented adequate systems, risk management, and internal controls to ensure that the activities are conducted in a safe and sound manner consistent with applicable laws, including consumer protection laws. On April 7, 2022, the FDIC issued a financial institution letter also requiring its supervised institutions to provide notice and obtain supervisory feedback prior to engaging in any crypto-related activities.

On January 3, 2023, the federal banking agencies issued additional guidance in the form of a joint statement addressing digital asset-related risks to banking organizations. That statement noted the recent volatility and exposure of vulnerabilities in the digital asset sector and indicated that the agencies are continuing to assess whether or how the digital asset-related activities of banking organizations can be conducted in a safe and sound manner and in compliance with all applicable laws and regulations. The statement stressed that each agency has developed, and expects banking organizations to follow, supervisory processes for evaluating proposed and existing digital asset activities.

On February 23, 2023, the federal banking agencies issued a joint statement addressing liquidity risks to banking organizations resulting from crypto-asset market vulnerabilities. The joint statement noted that deposits placed by a crypto-asset-related entity and deposits that constitute stablecoin-related reserves may pose heightened liquidity risks to banking organizations due to the unpredictability of the scale and timing of deposit inflows and outflows. The statement stressed that banking organizations should establish and maintain effective risk management and controls commensurate with the level of liquidity risks from such funding sources. In December 2025, the Federal Reserve rescinded the 2023 policy statement in response to an evolving understanding of the risks of the crypto-asset sector and intending to promote innovation in the industry, and adopted a new policy statement setting forth a principles-based approach to the exercise of its authority, which permits insured state member banks to engage in activities permitted for national banks or otherwise authorized by the FDIC for state banks.

In July 2025, President Trump signed into law the Guiding and Establishing National Innovations for US Stablecoins Act of 2025 (the “Genius Act”) establishing a regulatory framework for stablecoins in the United States. In December 2025, the FDIC issued a notice

17

Table of Contents

of proposed rulemaking seeking comments to application procedures for FDIC-supervised institutions seeking to issue payment stablecoins through an approved subsidiary.

Impact of Presidential and Congressional Elections on Recent Rulemaking. Control of the White House and Congress shifted to the Republican Party in January 2025 as a result of the November 2024 Presidential and Congressional elections. President Trump and many Republican members of Congress have advocated for a significant reduction of financial services regulation, potentially including amendments to the Dodd-Frank Act and other federal banking laws, and structural changes to the CFPB. The current Administration and Congress may also cause broader economic changes due to changes in governing ideology and governing style. In consideration of these factors, it is possible, though uncertain, that Congress and/or the relevant federal agencies may seek to roll back or modify some or much of the rulemaking and regulatory guidance issued under the Biden administration in addition to those already discussed above. Further a change in the leadership of the FDIC, OCC and CFPB has occurred; however, the impact of each such change in the leadership on the regulatory, enforcement, and supervisory priorities of each agency are still not fully known at this time. It is therefore unclear at the present time what additional effect the aforementioned changes will have on the banking industry.