FIVE STAR BANCORP (FSBC) Business

Item 1. Business

Our Company

Headquartered in the greater Sacramento metropolitan area of California, Five Star Bancorp is a bank holding company that operates through its wholly owned subsidiary, Five Star Bank, a California state-chartered non-member bank. The Bank began operations on December 20, 1999. Bancorp was incorporated on September 16, 2002 and became the sole shareholder of the Bank on June 2, 2003. Our executive offices are located at 3100 Zinfandel Drive, Suite 100, Rancho Cordova, California 95670 and our telephone number is (916) 626-5000. Our website address is https://www.fivestarbank.com. Information on our website should not be considered a part of this Annual Report on Form 10-K.

The Company provides a broad range of banking products and services to small and medium-sized businesses, professionals, and individuals primarily in Northern California through nine branch offices. The Bank opened a full-service branch in Walnut Creek in September 2025. The Bank’s deposits are insured in whole or in part by the FDIC. The Bank’s loans and deposits are primarily within Northern California, and the Bank’s primary funding source is deposits from customers. Our mission is to strive to become the top business bank in all markets we serve through exceptional service, deep connectivity, and customer empathy. We are dedicated to serving real estate, agricultural, faith-based, and small to medium-sized enterprises. We aim to consistently deliver value that meets or exceeds expectations of our shareholders, customers, employees, business partners, and community. We refer to our mission as “purpose-driven and integrity-centered banking.” At December 31, 2025, we had total assets of $4.8 billion, total loans held for investment of $4.1 billion, and total deposits of $4.2 billion.

In May 2021, the Company completed its IPO, in connection with which the Company terminated its status as a Subchapter S corporation as of May 5, 2021 and became a taxable C Corporation.

Unless otherwise indicated, references in this report to “we,” “our,” “us,” “the Company,” or “Bancorp” refer to Five Star Bancorp and our consolidated subsidiary. All references to “the Bank” or “Five Star” refer to Five Star Bank, our wholly owned subsidiary.

Our Market

The Company, through the Bank, provides financial services to customers who are predominately small and middle-market businesses, professionals, and individuals primarily in the Northern California region. Our primary loan products are commercial real estate loans, land development loans, construction loans, and operating lines of credit and our primary deposit products are checking accounts, savings accounts, money market accounts, and term certificate accounts.

Our principal geographic market is the Roseville/Sacramento/Rancho Cordova/Elk Grove area (the “Greater Sacramento Area”). The Greater Sacramento Area has a profitable and productive economy driven by the governmental, education, technology, health care, agricultural, and manufacturing sectors. Since 2016, our market share of the total deposits in the Greater Sacramento Area has increased significantly, according to the FDIC Deposit Market Share Reports. We believe that our market growth confirms the quality of the purpose-driven and integrity-centered banking that we strive to deliver to our customers.

During 2025, we continued our expansion into the San Francisco Bay Area, including the opening of a full service branch in Walnut Creek in September 2025. We hired three business development officers, three loan officers, and four additional staff to support these operations during 2025 as part of our expansion.

Our Products and Services

Lending Activities

We focus primarily on commercial lending, with an emphasis on commercial real estate. We offer a variety of loans to small and medium-sized businesses, professionals, and individuals, including commercial real estate, commercial, commercial land and construction, and farmland loans. Although a substantial portion of our loan portfolio consists of commercial real estate loans within our market, our portfolio is diverse and includes SBA loans to customers nationwide. To a lesser extent, we also offer residential real estate and construction loans and consumer loans.

3

Commercial real estate loans: As of December 31, 2025, we had $3.3 billion in total commercial real estate loans, representing 81.08% of total loans before deferred fees. These loans are viewed primarily as cash flow loans and secondarily as loans secured by real estate. These loans are generally collateralized by first liens on real estate and amortized over a period of years. We monitor and evaluate commercial real estate loans based on collateral, geography, and risk grade criteria. Our commercial real estate lending typically involves higher loan principal amounts, and the repayment of these loans is generally largely dependent on the successful operation of the property securing the loan or the business conducted on the property securing the loan. Commercial real estate loans may be more adversely affected by conditions in the real estate markets or in the general economy. The properties securing our commercial real estate portfolio are diverse in terms of type and industry. This diversity helps reduce our exposure to adverse economic events that affect any single market or industry.

Commercial land and construction loans: As of December 31, 2025, we had $98.1 million in commercial land and construction loans, representing 2.40% of total loans before deferred fees. We make loans to established builders to construct residential properties, loans to developers of commercial real estate investment properties and residential developments, and, to a lesser extent, loans to individual clients for construction of single-family homes in our market. On rare occasions, we also make loans for the acquisition of undeveloped land subject to heightened underwriting requirements. Construction loans are typically disbursed as construction progresses and carry either fixed or variable interest rates generally based on the borrowers’ ability to repay the loans from the cash flow of their businesses. The terms of our commercial land and construction loans vary depending on factors such as the type and size of the development and the financial strength of the borrower/guarantor. Loans are typically structured with an interest-only construction period and mature at the completion of construction.

Residential real estate and construction loans: As of December 31, 2025, we had $46.0 million in residential real estate and construction loans, representing 1.13% of total loans before deferred fees. Residential real estate loans are underwritten based upon income, credit history, and collateral. To monitor and manage residential loan risk, policies and procedures are developed and modified, as needed. We believe that this activity, coupled with relatively small loan amounts that are spread across many individual borrowers, minimizes risk. Underwriting standards for home loans are heavily influenced by statutory requirements, which include, but are not limited to, a maximum loan-to-value percentage, collection remedies, the number of such loans a borrower can have at one time, and documentation requirements.

Farmland loans: As of December 31, 2025, we had $59.6 million in farmland loans, representing 1.46% of total loans before deferred fees. We are a strong agricultural lender, with both lines of credit and term loans. Farmland loans are generally made to producers and processors of crops and livestock. Repayment is primarily from the sale of an agricultural product or service. Farmland loans are secured by real property and are susceptible to changes in market demand for specific commodities. This may be exacerbated by, among other things, industry changes, changes in the individual financial capacity of the business owner, general economic conditions, and changes in business cycles, as well as adverse weather conditions.

Commercial loans: As of December 31, 2025, we had $292.2 million in commercial loans, representing 7.16% of total loans before deferred fees. Commercial loans are underwritten after evaluating the borrower’s ability to operate profitably and prudently expand its business. Underwriting standards are designed to promote relationship banking rather than transactional banking. Commercial loans are primarily made based on the identified cash flows of the borrower and secondarily on the underlying collateral provided by the borrower. The cash flows of borrowers, however, may not be as expected, and the collateral securing these loans may fluctuate in value. Most commercial loans are secured by the assets being financed or other business assets, such as accounts receivable or inventory, and may incorporate a personal guarantee; however, some short-term loans may be made on an unsecured basis. In the case of loans secured by accounts receivable, the availability of funds for the repayment of these loans may be substantially dependent on the ability of the borrower to collect amounts due from its customers.

SBA loans: As of December 31, 2025, our total commercial SBA portfolio held for investment was $34.3 million, representing 0.84% of total loans before deferred fees. In 2025, we sold 10 SBA 7(a) loans with government-guaranteed portions totaling approximately $3.3 million. We participate in the SBA 7(a) program in order to meet the needs of our small business community as well as customers nationwide. As an approved participant in the SBA Preferred Lender Program, we enable our clients to obtain SBA loans without being subject to the potentially lengthy SBA approval process necessary for lenders that are not SBA Preferred Lenders. The SBA presently guarantees 75% to 90% of the principal amount of qualifying loans originated under the 7(a) loan program. The guarantee is conditional and covers a portion of the risk of payment default by the borrower, but not the risk of improper closing and servicing by the lender. As such, prudent underwriting and closing processes are essential to

4

effective utilization of the 7(a) program. We typically sell the SBA-guaranteed portion of the SBA loans we originate in the secondary market.

Consumer and other loans: As of December 31, 2025, we had $275.5 million in consumer and other loans, representing 6.77% of total loans before deferred fees. These loans consist primarily of loans purchased in a loan purchase program with a non-bank lender, generally made to professionals for the purpose of large personal or household purchases. The loans are unsecured, fixed rate loans. These loans also include loans purchased or originated through financing partnerships which are no longer active. Under those financing programs, we made a variety of loans in relatively small amounts to individuals for personal purposes, primarily for home repairs and improvements. Consumer loans are underwritten based on the individual borrower’s income, current debt level, past credit history, and the value of any available collateral. The terms of consumer loans vary considerably based upon the loan type, nature of collateral, and size of the loan. The performance of consumer loans is affected by the local and regional economy as well as the rates of personal bankruptcies, job loss, divorce, and other individual-specific characteristics. We do not expect these consumer and other loans to make up a significant portion of our lending activity.

Lending Philosophy

In keeping with our mission of purpose-driven and integrity-centered banking, we seek credit arrangements that serve our local community and provide attractive risk-adjusted returns to us. We pursue our objectives while remaining mindful of liquidity, flexibility, and risk considerations by exercising controls on non-interest expenses and close management of our assets and liabilities. We periodically set guidelines designed to maintain stability of our loan-to-deposit ratio, minimize past-due and non-accrual loans, and achieve an optimal loan mix and concentration. We seek well-margined and collateralized loan opportunities to borrowers with extensive professional asset operating experience.

Lending Policy and Procedures

We have established common documentation, policies, and standards for lending based on the type of loan. A thorough credit analysis precedes commercial and real estate loan decisions, and we follow well-established and proven procedures when approving consumer loans.

We have established a Management Loan Committee and a Director Loan Committee. Our Management Loan Committee is comprised of our Chief Executive Officer, our Chief Credit Officer, certain other members of management, and select senior loan officers and is primarily responsible for day-to-day implementation and oversight of our loan approval procedures. Our board of directors approves, from time to time, a delegated lending authority to members of the Management Loan Committee. The amount of authority delegated to each member of the committee varies based on years of direct lending experience, responsibility, and performance. The authority limits also vary by collateral type.

Concentrations of Credit Risk

Although we have a diversified loan portfolio, a substantial portion is secured by commercial and residential real estate located in Northern California. As of December 31, 2025, approximately 56.89% of our real estate loans measured by dollar amount were secured by collateral located in California, a majority of which is in Northern California. Additionally, we have a high concentration of real estate related loans, which represented approximately 86.07% of total loans before deferred fees at December 31, 2025. Although management believes such concentrations have no more than the normal risk of collectability, a substantial decline in the economy in general, or a decline in real estate values in our primary market in particular, could have an adverse impact on the collectability of these loans. Personal and business incomes represent the primary source of repayment for the majority of these loans.

Deposit Products

Representing 97.49% of our total liabilities as of December 31, 2025, deposits are our primary source of funding for our business operations. As of December 31, 2025, we held total deposits of $4.2 billion, including $1.1 billion in non-interest-bearing deposits.

We offer a comprehensive array of deposit products for small and medium-sized businesses, professionals, and individuals, including a variety of checking and savings accounts, time deposits, and money market accounts. We also provide a wide range of deposit services, including debit cards, remote deposit capture, online banking, mobile banking, and direct deposit services.

5

We obtain most of our deposits from individuals, small and medium-sized businesses, and municipalities in our market. We solicit deposits through our relationship-driven team of dedicated and accessible bankers, as well as through community-focused marketing. We emphasize obtaining deposit relationships at loan origination. We provide a high level of customer service to our depositors. We have invested in personnel, business and compliance processes, and technology that enable us to acquire, as well as efficiently and effectively serve a wide array of business deposit accounts, while continuing to provide the level of customer service for which we are known.

As of December 31, 2025, our 53 largest deposit relationships, each accounting for more than $10.0 million, totaled $2.0 billion, or 47.82% of our total deposits. This includes $789.6 million of our total deposits held by municipalities, of which we conduct a monthly review. Our management maintains our liquidity position and lines of credit with correspondent banks to mitigate the risk of large withdrawals by this group of large depositors.

Investment Securities

As of December 31, 2025, the carrying value of our investment portfolio, which represented 2.04% of total assets, totaled $96.9 million and had an average effective yield of 2.03% and an estimated modified duration of approximately 6.06 years. The primary objectives of the investment portfolio are to provide a source of liquidity and provide collateral that can be readily sold or pledged for public deposits or other business purposes. At December 31, 2025, 49.73% and 40.41% of our investment portfolio consisted of mortgage-backed securities and obligations of states and political subdivisions, respectively. The remainder of our securities portfolio is invested in U.S. government agencies, collateralized mortgage obligations, and corporate bonds. We regularly evaluate the composition of our investment portfolio as the interest rate yield curve changes and may sell or pledge investment securities from time to time to adjust our exposure to interest rates or to provide liquidity to meet loan demand. Due to loan growth, we are holding the majority of our on-balance sheet liquidity in the Federal Reserve Bank to provide readily available funds for loan growth and deposit activities in the normal course of business for our existing clients.

Competition

The banking business is highly competitive, and we face strong competition from many other financial institutions and financial services providers. Our principal competitors are commercial and community banks, credit unions, savings and loan associations, mortgage banking firms and online mortgage lenders, and commercial and consumer finance companies, including large national financial institutions that operate in our market. Our profitability depends in large part upon our continued ability to successfully compete with these institutions for lending opportunities, deposit funds, financial products, bankers, and potential acquisition targets.

We conduct business through nine branches in our key market of Northern California. We opened a full service branch in Walnut Creek in September 2025. Many other commercial and community banks, savings institutions, credit unions, and other financial institutions maintain a physical presence in our primary market area, and some maintain only a virtual presence. Many of these competitors are larger than we are, have significantly more resources, greater brand recognition, and more extensive and established branch networks or geographic footprints than we do, and may be able to attract customers more effectively than we can. Because of their scale, many of these competitors can be more aggressive on loan and deposit pricing than we can and may better afford and make broader use of media advertising, support services, and electronic technology than we do. Also, many of our non-bank competitors have fewer regulatory constraints and may have lower cost structures. To offset these competitive disadvantages, we concentrate marketing efforts in the local markets we service with local advertisements and personal contacts. We depend on our reputation of having greater personal service than our competitors, as well as consistency, flexibility, our ability to make credit and other business decisions quickly, and our deep knowledge of competitor strengths and weaknesses.

Based on the FDIC Summary of Deposits as of June 30, 2025, the Bank ranks sixth in the Sacramento-Roseville-Folsom metropolitan statistical area (“MSA”) by deposit market share with deposits of $3.1 billion and four branches. As of June 30, 2025, total market deposits in the Sacramento-Roseville-Folsom MSA were $94.7 billion, of which $77.3 billion, or approximately 81.55%, was held by five money center banks across 174 branches. We are the 39th largest insured depository institution in California by deposits as of June 30, 2025.

Information Technology Systems

We have made, and continue to make, significant investments in our information technology systems and staff for our banking and lending operations and treasury management activities. We believe this investment will support our continued growth and enable us to enhance our capabilities to offer new products, improve overall customer experience, improve

6

profitability through efficiencies, and provide scalability for future growth. We utilize nationally recognized software vendors and their cloud/hosted models, which allow us to outsource the processing of our data. Our internal network and e-mail systems are administered by a managed service provider specializing in financial institutions, and we maintain our production infrastructure in a data center facility near Reno, Nevada. This site provides for power and connectivity redundancy, and we maintain a disaster recovery program, including a cloud-based recovery environment.

The majority of our other systems, including our electronic funds transfer, transaction processing, and online banking services are hosted by third-party service providers. The scalability of this infrastructure will support our growth strategy. In addition, the tested capability of these vendors to automatically switch over to standby systems should allow us to recover our systems and provide business continuity quickly in case of a disaster.

Emerging Growth Company Status

We qualify as an “emerging growth company” under the Jumpstart Our Business Startups Act of 2012 (the “JOBS Act”). An emerging growth company may take advantage of reduced reporting requirements and is relieved of certain other significant requirements that are otherwise generally applicable to public companies. Among other factors, as an emerging growth company:

•we may discuss our results of operations for only two years in the section entitled “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” provided that we reference disclosure where the third year of our results of operations may be found;

•we are exempt from the requirement to provide an opinion from our auditors on the design and operating effectiveness of our internal control over financial reporting pursuant to the Sarbanes-Oxley Act of 2002, as amended (the “Sarbanes-Oxley Act”);

•we may choose not to comply with any new requirements adopted by the PCAOB requiring mandatory audit firm rotation or a supplement to the auditor’s report providing additional information about the audit and our audited financial statements;

•we are permitted to provide less extensive disclosure regarding our executive compensation arrangements pursuant to the rules applicable to smaller reporting companies and with which emerging growth companies may comply, which means we are not required to include a compensation discussion and analysis and other disclosures regarding our executive compensation in this Annual Report on Form 10-K; and

•we are not required to hold nonbinding advisory votes on executive compensation or golden parachute arrangements.

We may take advantage of these provisions for up to five years unless we earlier cease to qualify as an emerging growth company. We would cease to be an emerging growth company upon the earliest of: (i) the first fiscal year following the fifth anniversary of our IPO; (ii) the first fiscal year after our annual gross revenues are $1.235 billion or more; (iii) the date on which we have, during the previous three-year period, issued more than $1.0 billion in non-convertible debt securities; or (iv) the date on which we are deemed to be a large accelerated filer under the rules of the SEC. We have elected to adopt the reduced disclosure requirements described above regarding the number of periods for which we are providing audited financial statements and selected financial data, and our executive compensation arrangements. In addition, we take advantage of the reduced reporting and other requirements under the JOBS Act with respect to the periodic reports we file with the SEC and proxy statements that we use to solicit proxies from our shareholders. Accordingly, the information contained herein may be different than the information you receive from other public companies in which you invest.

The JOBS Act exempts emerging growth companies from compliance with new or revised financial accounting standards until private companies (that is, those that have not had a registration statement declared effective under the Securities Act of 1933, as amended, or do not have a class of securities registered under the Securities Exchange Act of 1934, as amended (the “Exchange Act”)) are required to comply with the new or revised financial accounting standards. The JOBS Act provides that a company can elect to opt out of this extended transition period and comply with the requirements that apply to non-emerging growth companies, but any such election to opt out is irrevocable. We have elected not to opt out of such extended transition period, which means that when a standard is issued or revised and it has different application dates for public or private companies, we, as an emerging growth company, can adopt the new or revised standard at the time private companies adopt the new or revised standard. However, we may early adopt certain accounting standards, as the JOBS Act does not preclude an emerging growth company from adopting a new or revised accounting standard early than the time that such standard applies to private companies to the extent early adoption is permitted. As such, our consolidated

7

financial statements may not be comparable with those of a public company that is not an emerging growth company, or those of a public company that is an emerging growth company that has opted out of using the extended transition period, because of the potential differences in accounting standards used.

Risk Management

We believe that effective risk management and control processes are critical to our safety and soundness, our ability to predict and manage the challenges that we face, and, ultimately, our long-term corporate success. Risk management refers to the activities by which we identify, measure, monitor, evaluate, and manage the risks we face in the course of our banking activities. These include liquidity, interest rate, credit, operational, compliance, regulatory, strategic, financial, and reputational risk exposures. Our board of directors, both directly and through its committees, is responsible for overseeing our risk management processes, including quarterly enterprise risk management assessments and annual assessments in the following areas: (i) cyber; (ii) Bank Secrecy Act of 1970 (“Bank Secrecy Act”)/anti-money laundering; and (iii) third-party risk, with each of the committees of our board of directors assuming a different and important role in overseeing the management of the risks we face.

The Audit Committee of our board of directors is responsible for overseeing risks associated with financial matters (particularly financial reporting, accounting practices and policies, disclosure controls and procedures, and internal control over financial reporting). The Compensation Committee of our board of directors has primary responsibility for risks and exposures associated with our compensation policies, plans, and practices regarding executive compensation, board compensation, and our compensation structure generally. Our Compensation Committee, in conjunction with our President and Chief Executive Officer and other members of our management, as appropriate, reviews our incentive compensation arrangements to ensure these programs are consistent with applicable laws and regulations, including safety and soundness requirements, and do not encourage imprudent or excessive risk-taking by our employees. The Governance and Nominating Committee of our board of directors oversees risks associated with the independence of our board of directors and potential conflicts of interest.

Our senior management is responsible for implementing our risk management processes by assessing and managing the risks we face, including strategic, operational, regulatory, investment, and execution risks, on a day-to-day basis, and reporting to our board of directors regarding our risk management processes. Our senior management is also responsible for creating and recommending to our board of directors for approval appropriate risk appetite metrics reflecting the aggregate levels and types of risk we are willing to accept in connection with the operation of our business and pursuit of our business objectives.

The role of our board of directors in our risk oversight is consistent with our leadership structure, with our President and Chief Executive Officer and the other members of senior management having responsibility for assessing and managing our risk exposure, and our board of directors and its committees providing oversight in connection with those efforts. We believe this division of risk management responsibilities presents a consistent, systemic, and effective approach for identifying, managing, and mitigating risks throughout our operations.

Human Capital

To facilitate talent attraction and retention, we strive to create an inclusive, safe, and healthy workplace with opportunities for our employees to grow and develop in their careers, supported by strong compensation, benefits, and health and welfare programs.

Employee Profile

As of December 31, 2025, we had 233 full-time employees and five part-time employees. None of our employees are covered by a collective bargaining agreement. We consider our relationship with our employees to be good and have not experienced interruptions of operations due to labor disagreements.

Compensation and Benefits

We provide a competitive compensation and benefits program to help meet the needs of our employees. In addition to salaries, this program includes annual bonus opportunities, a 401(k) plan with an employer matching contribution, healthcare and insurance benefits, health reimbursement accounts, paid time off and family leave, and an employee assistance program.

8

Learning and Development

We invest in the growth and development of our employees by providing a multi-dimensional approach to learning that empowers, intellectually grows, and professionally develops our colleagues under the leadership of a Director of Employee Engagement. We facilitate the educational and professional development of our employees through support to attend conferences and obtain degrees, licenses, and certifications while employed by us.

Commitment to Environmental, Social, and Governance

We are executing an Environmental, Social, and Governance strategy designed to promote positive change that focuses on the environmental impacts of our business and the geographical service areas in which we serve, social factors in the communities we serve, and the governance of our board of directors.

Environmental: Climate change impacts our customers, communities, employees, and shareholders. We are committed to developing policies and procedures that can contribute to reducing the effects of climate change, including funding customer business ventures that create a positive environmental impact through agriculture or technology. We continue to sponsor and support environmental impact initiatives by partnering with our customers that aid in the efforts of a clean and sustainable community. Additionally, we equip customers with technology tools designed to reduce their carbon footprint by reducing in-branch customer visits.

We have taken steps designed to help reduce our own carbon footprint by utilizing e-signatures to conduct business to reduce paper consumption, occupying sustainable facilities when possible, and encouraging our employees to work remotely, where possible. We recognize that reducing the effects of climate change and helping to drive the transformation to a lower carbon environment are ongoing efforts, and plan to continually seek out opportunities that can positively impact the effect that climate change has on the environment.

Social: We work to create positive social impacts in the communities in which our business operates, including by assisting unhoused populations, supporting affordable housing projects, and prioritizing non-profit donations. We believe it is our shared responsibility to build a strong foundation of community by fostering a culture of belonging and inclusion. We also remain focused on investing and economically developing the geographical service areas in which we serve, as well as on their sustainability.

Governance: The Governance and Nominating Committee is committed to diversity on our board of directors and compliance with applicable rules, regulations, and guidance regarding the composition of our leadership. Members of our board of directors represent diverse backgrounds, including diversity of race, ethnicity, gender, and other demographics. We are committed to ethical business practices and accounting transparency, as evidenced through our involvement in the community and results of examinations by regulators.

Dedication to Community Impact and Inclusion

Community Impact and Inclusion is essential in our workplace. We have an Executive Vice President, Chief Operating Officer and a Vice President, Director of Community Impact and Inclusion who lead our efforts in this area. Our Human Resources department is focused on our commitment to inclusion through hiring practices and employee training. We are committed to ensuring that all employees feel a sense of belonging in the workplace and that processes and programs are impartial, fair, and provide equal opportunity for every individual. We also have a history of serving customers in the non-profit community who are dedicated to the success of under-resourced and vulnerable populations, the empowerment of women, and the continued vitality of the environment.

Available Information

The Company’s annual reports on Form 10-K, quarterly reports on Form 10-Q, proxy statements, current reports on Form 8-K, amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act, and other filings with the SEC are available free of charge at https://investors.fivestarbank.com under the heading “Financials & Filings,” as soon as reasonably practicable after the Company electronically files such material with, or furnishes it to, the SEC. These reports are also available for free on the SEC’s website at https://www.sec.gov. The information contained on the Company’s website as referenced in this Annual Report on Form 10-K should not be considered a part of this report.

9

Supervision and Regulation

General

Federal and state banking laws impose a comprehensive system of supervision, examination, regulation, and enforcement on the operations of insured banks and their holding companies. Supervision and regulation of banks, their holding companies, and affiliates is intended primarily for the protection of depositors and customers, the Deposit Insurance Fund (the “DIF”) of the FDIC, and the U.S. banking and financial system, rather than holders of our capital stock. As a result, our growth, earnings performance, and operations may be affected by the requirements of federal and state statutes and by the regulations and policies of various bank regulatory agencies, including the DFPI, the FDIC, the Federal Reserve, and the CFPB. Furthermore, tax laws administered by the IRS and state taxing authorities, accounting rules developed by the FASB, securities laws administered by the SEC and state securities authorities, anti-money laundering laws enforced by the Treasury Department, and SBA regulations with respect to small business loans, have an impact on our business. These statutes, regulations, and policies are continually under the review of the United States Congress and state legislatures, as well as federal and state regulatory agencies, and the nature and extent of future legislative, regulatory, or other developments affecting financial institutions are impossible to predict with any certainty. Any change in the statutes, regulations or regulatory policies applicable to us, including changes in their interpretation, expectations or implementation, could have a material effect on our business and operations.

The following is a summary of material elements of the regulatory and supervisory framework applicable to us and the Bank. It does not describe all of the statutes, regulations, and regulatory policies that apply, nor does it provide complete summaries of the statutes, regulations, and policies referenced therein.

Supervision and Regulation of the Company

We are a bank holding company registered under the Bank Holding Company Act of 1956, as amended (the “BHC Act”). As a result, we are primarily subject to the supervision, examination, and reporting requirements of the BHC Act, Federal Deposit Insurance Act (the “FDI Act”), and the regulations of the Federal Reserve and FDIC.

Federal law subjects bank holding companies, such as the Company, to restrictions on the types of activities in which they may engage and to a range of supervisory requirements and activities, including regulatory enforcement actions for violations of laws and regulations. Violations of laws and regulations, or other unsafe and unsound practices, may result in regulatory agencies imposing fines, penalties, or cease and desist orders, or taking other enforcement actions. Under certain circumstances, these agencies may enforce these remedies directly against officers, directors, employees, and other parties participating in the affairs of a bank or bank holding company.

Federal Oversight over Mergers and Acquisitions, Investments, and Activities

The BHC Act requires a bank holding company to obtain the prior approval of the Federal Reserve before: (i) it may acquire direct or indirect ownership or control of any voting shares of any bank if, after such acquisition, the bank holding company will directly or indirectly own or control 5% or more of the voting shares of the bank; (ii) it or any of its subsidiaries, other than a bank, may acquire all or substantially all of the assets of any bank; or (iii) it may merge or consolidate with any other bank holding company.

Before approving any such transaction, the Federal Reserve is required by the BHC Act to consider a number of factors, including the transaction’s competitive impact, the financial and managerial resources and future prospects of the bank holding companies and banks concerned, the convenience and needs of the community to be served, and the effectiveness of the parties in combating money laundering activities.

Provisions of the FDI Act known as the Bank Merger Act impose similar approval standards for an insured depository institution to merge with another insured depository institution or a non-insured institution. On September 17, 2024, the United States Department of Justice (the “DOJ”) withdrew its 1995 Bank Merger Guidelines and announced that it will instead evaluate the competitive impact of bank mergers using its 2023 Merger Guidelines that the DOJ applies to mergers in all industries. Compared to the 1995 Bank Merger Guidelines, the 2023 Merger Guidelines set forth more stringent concentration limits and add several largely qualitative bases on which the DOJ may challenge a merger. While the effect of changes in the DOJ’s bank merger antitrust policy for particular transactions remains unclear, the changes may make it more difficult and/or costly for us to obtain regulatory approval for an acquisition or otherwise result in more onerous conditions to obtain approval for an acquisition.

10

The BHC Act, as amended by the interstate banking provisions of the Riegle-Neal Interstate Banking and Branching Efficiency Act of 1994 (the “Riegle-Neal Act”), permits us to acquire a bank located in any other state, regardless of state law to the contrary, subject to certain deposit concentration limits, aging requirements, and other restrictions. The Riegle-Neal Act also generally permits national- and state-chartered banks to branch interstate through acquisitions of banks in other states. Bank holding companies must be “well-capitalized” and “well-managed” to obtain federal bank regulatory approval of an interstate acquisition without regard to state law prohibiting the transaction.

The BHC Act also generally requires Federal Reserve approval for a bank holding company’s acquisition of a company that is not an insured depository institution. Bank holding companies generally may engage, directly or indirectly, only in managing or controlling banks, and such other activities as are determined by the Federal Reserve to be closely related to banking, and certain other permissible nonbanking activities. Bank holding companies generally must notify the Federal Reserve before acquiring a company that is not an insured depository institution or engaging in a permissible nonbanking activity, and the Federal Reserve considers several factors in reviewing such a notice. The Federal Reserve may order a bank holding company or its subsidiaries to terminate any of these activities or to terminate its ownership or control of any subsidiary when it has reasonable cause to believe that the bank holding company’s continued ownership, activity, or control constitutes a serious risk to the financial safety, soundness, or stability of it or any of its bank subsidiaries.

The Gramm-Leach-Bliley Act (the “GLB Act”) allows a bank holding company that satisfies certain criteria to elect to become a financial holding company, which would allow such company to engage in activities that are financial in nature, incidental to such activities, or complementary to such activities. We have not elected financial holding company status.

The FDIC has the authority to approve applications by state non-member banks to establish de novo branches, including, under the Riegle-Neal Act, in states other than the bank’s home state if the law of the state in which the branch is located, or is to be located, would permit establishment of the branch if the bank were a state bank chartered by that state.

Certain acquisitions of our voting stock may be subject to regulatory approval or notice under federal law. Investors are responsible for ensuring that they do not, directly or indirectly, acquire shares of our stock in excess of the amount that can be acquired without regulatory approval under the Change in Bank Control Act and the BHC Act, which prohibit any person or company from acquiring control of the Company without, in most cases, the prior written approval of the Federal Reserve.

Source of Strength

The FDI Act and Federal Reserve regulations require a bank holding company to serve as a source of financial and managerial strength to its bank subsidiaries. As a result, a bank holding company may be expected to commit resources to support its bank subsidiary, including at times when the holding company may not be inclined or in a financial position to provide it.

Capital Adequacy

Bank holding companies and banks are subject to various regulatory capital requirements administered by federal and state bank regulatory agencies. Capital adequacy regulations and prompt corrective action regulations involve quantitative measures of assets, liabilities, and certain off-balance sheet items calculated under regulatory accounting practices, as well as qualitative judgments by the regulators about components of capital, risk-weightings, and other factors. The Federal Reserve and the FDIC, the primary federal regulators of the Company and Bank, respectively, have substantially similar generally applicable risk-based capital ratio and leverage ratio requirements.

Under the generally applicable capital requirements of the Federal Reserve and the FDIC, the Company and the Bank are required to meet a common equity Tier 1 capital to risk-weighted assets ratio of at least 7.0% (a minimum of 4.5% plus a capital conservation buffer of 2.5%), a Tier 1 capital to risk-weighted assets ratio of at least 8.5% (a minimum of 6.0% plus a capital conservation buffer of 2.5%), a total capital to risk-weighted assets ratio of at least 10.5% (a minimum of 8.0% plus a capital conservation buffer of 2.5%), and a Tier 1 leverage ratio of at least 4.0%. In addition, insured depository institutions such as the Bank, unlike bank holding companies, are subject to further capital requirements to be deemed “well-capitalized” under the prompt corrective action provisions of the FDI Act and implementing regulations of the federal banking agencies, as described in the section entitled “—Supervision and Regulation of the Bank—Prompt Corrective Action” below.

For purposes of calculating the denominator of the risk-based capital ratios, a banking institution’s assets and some of its specified off-balance sheet commitments and obligations are assigned to various risk categories. For purposes of calculating the numerator of the capital ratios, capital, at both the holding company and bank levels, is classified in one of

11

three tiers depending on the “quality” and loss-absorbing features of the capital instrument. Common equity Tier 1 capital is predominantly comprised of common stock instruments (including related surplus) and retained earnings, net of treasury stock, and after making necessary capital deductions and adjustments. Tier 1 capital is comprised of common equity Tier 1 capital and additional Tier 1 capital, which includes non-cumulative perpetual preferred stock and similar instruments meeting specified eligibility criteria (including related surplus). Total capital is comprised of Tier 1 capital and Tier 2 capital, which includes certain subordinated notes with a minimum original maturity of five years (including related surplus) and a limited amount of allowance for credit losses. Newly issued trust preferred securities and cumulative perpetual preferred stock may not be included in Tier 1 capital, but generally may be included in Tier 2 capital, provided they do not include features that are disallowed by the capital rules, such as the acceleration of principal other than in the event of a bankruptcy, insolvency, or receivership of the issuer.

Failure to meet minimum capital requirements could subject a banking organization to a variety of enforcement remedies. A banking organization’s failure to exceed the capital conservation buffer with common equity Tier 1 capital would result in limitations on the banking organization’s ability to make capital distributions and discretionary bonus payments.

At December 31, 2025, common equity Tier 1 capital, Tier 1 capital, and total capital of the Company on a consolidated basis equaled 10.58%, 10.58%, and 13.33% of its total risk-weighted assets, respectively, and its Tier 1 leverage ratio on a consolidated basis was 9.70%. At December 31, 2025, the Bank exceeded its minimum capital requirements with common equity Tier 1 capital, Tier 1 capital, and total capital equal to 11.89%, 11.89%, and 12.92% of its total risk-weighted assets, respectively, and a Tier 1 leverage ratio of 10.89%. As a result, the Bank was “well-capitalized” for prompt corrective action purposes based on the ratios and guidelines described above.

Payment of Dividends and Stock Repurchases

The Company is limited in its ability to pay dividends or repurchase its stock by the Federal Reserve, including if doing so would be an unsafe or unsound banking practice. When a bank holding company intends to declare or pay a dividend that could raise safety and soundness concerns, it generally will be required to inform and consult with the Federal Reserve in advance. It is the policy of the Federal Reserve that a bank holding company should generally pay dividends on common stock only out of earnings, and only if prospective earnings retention is consistent with the company’s capital needs and overall current and prospective financial condition. Additionally, bank holding companies should inform and consult with the Federal Reserve in advance of declaring and paying a dividend that exceeds earnings for the period for which the dividend is being paid.

According to guidance from the Federal Reserve, a bank holding company’s dividend policies will be assessed against, among other things, its ability to achieve applicable capital ratio requirements. If a bank holding company does not achieve applicable capital ratio requirements, it may not be able to pay dividends.

A bank holding company is also required to give the Federal Reserve prior written notice before purchasing or redeeming its equity securities if the gross consideration for the purchase or redemption, when aggregated with the net consideration paid by the Company for all such purchases or redemptions during the preceding twelve months, is equal to 10% or more of the Company’s consolidated net worth. The Federal Reserve may disapprove such a purchase or redemption if it determines that the proposal would constitute an unsafe or unsound practice or would violate any law, regulation, Federal Reserve order, or any condition imposed by or written agreement with the Federal Reserve. This prior notice requirement does not apply to any bank holding company that meets certain “well-capitalized” and “well-managed” standards and is not the subject of any unresolved supervisory issues.

In addition, a bank holding company is required to consult with the Federal Reserve before redeeming any equity or other capital instrument included in Tier 1 or Tier 2 capital prior to stated maturity if such redemption could have a material effect on the level or composition of the organization’s capital base.

Examinations

Bank holding companies and banks are subject to regular examination by their respective regulatory agencies, which results in examination reports and ratings that, while not publicly available, can impact the conduct and growth of their businesses. These examinations may consider not only compliance with applicable laws and regulations, but also capital levels, asset quality and risk, management ability and performance, earnings, liquidity, sensitivity to market risk, and various other factors. The regulatory agencies generally have broad authority to impose restrictions and limitations on the operations of a regulated entity when an agency determines, among other things, that such operations are unsafe or

12

unsound, fail to comply with applicable law, or are otherwise inconsistent with laws and regulations or with the supervisory policies of these agencies.

Anti-Money Laundering Initiatives and Sanctions Compliance

The Company and Bank are subject to extensive regulations aimed at combating money laundering and terrorist financing. The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (the “Patriot Act”) substantially broadened the scope of U.S. anti-money laundering laws and regulations by imposing significant compliance and due diligence obligations, creating new crimes and penalties, and expanding the extra-territorial jurisdiction of the United States. Treasury Department regulations implementing the Patriot Act impose obligations on financial institutions to maintain appropriate policies, procedures, and controls to detect, prevent, and report money laundering and terrorist financing and to verify the identity of their customers. In addition, the Anti-Money Laundering Act of 2020 (the “AML Act”), enacted in January 2021, includes the most substantial changes to U.S. anti-money laundering law since the Patriot Act. Among other things, the AML Act creates new beneficial ownership reporting requirements for certain entities doing business in the United States, requires the Treasury Department’s Financial Crimes Enforcement Network to establish national anti-money laundering priorities and combating the financing of terrorism priorities, increases anti-money laundering whistleblower awards and expands whistleblower protections, and enhances penalties for Bank Secrecy Act and anti-money laundering violations. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal and financial consequences for the institution.

The Treasury Department’s Office of Foreign Assets Control (“OFAC”) is responsible for helping to ensure that U.S. entities do not engage in transactions with certain prohibited parties, as defined by various Executive Orders and Acts of Congress. OFAC publishes lists of persons, organizations, and countries suspected of aiding, harboring, or engaging in terrorist acts, known as Specially Designated Nationals and Blocked Persons. OFAC administers and enforces applicable economic and trade sanctions programs. These sanctions are usually targeted against foreign countries, terrorists, international narcotics traffickers, and those believed to be involved in the proliferation of weapons of mass destruction. These regulations generally require either the blocking of accounts or other property of specified entities or individuals, but they may also require the rejection of certain transactions involving specified entities or individuals. The Company maintains policies, procedures, and other internal controls designed to comply with anti-money laundering requirements and sanctions programs.

Sarbanes-Oxley Act

The Sarbanes-Oxley Act represents a comprehensive revision of laws affecting corporate governance, accounting obligations, and corporate reporting. The Sarbanes-Oxley Act is applicable to all companies with equity securities registered, or that file reports, under the Exchange Act. In particular, the act established: (i) requirements for audit committees, including independence, expertise, and responsibilities; (ii) responsibilities regarding financial statements for the chief executive officer and chief financial officer of the reporting company and new requirements for them to certify the accuracy of periodic reports; (iii) standards for auditors and regulation of audits; (iv) disclosure and reporting obligations for the reporting company and its directors and executive officers; and (v) civil and criminal penalties for violations of the federal securities laws. The legislation also established a new accounting oversight board to enforce auditing standards and restrict the scope of services that accounting firms may provide to their publicly traded company audit clients.

Supervision and Regulation of the Bank

The Bank is a commercial bank chartered under the laws of the state of California and is primarily subject to the supervision, examination, and reporting requirements of the FDIC and the DFPI. Almost every area of the operations and financial condition of the Bank is subject to extensive regulation and supervision and to various requirements and restrictions under federal and state law, including loans, reserves, investments, issuance of securities, establishment of branches, capital adequacy, liquidity, earnings, dividends, management practices, and the provision of services. The FDIC and the DFPI regularly examine the Bank’s operations and have the authority to approve or disapprove mergers, the establishment of branches, and similar corporate actions. Both regulatory agencies have the power to take enforcement action to prevent the development or continuance of unsafe or unsound banking practices or other violations of law. The Bank is subject to supervision, examination, enforcement, and reporting requirements under the FDI Act, the California Financial Code, regulations of the FDIC and the DFPI, and certain of the requirements imposed by the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”). The Company and the Bank are also subject to a wide range of consumer protection laws and regulations.

13

California Law

California law governs the chartering and regulation of California commercial banks like ours, including organizational and capital requirements, fiduciary powers, investment authority, banking offices and electronic terminals, declaration of dividends, changes of control and mergers, out of state activities, interstate branching and banking, debt offerings, borrowing limits, and limits on loans to one borrower. The DFPI is charged with the Bank’s supervision and regulation. The DFPI may take possession of a bank if certain conditions exist, such as insufficient shareholders’ equity, unsafe or unauthorized operations, or violations of law.

Under California law, we may engage in the general business of banking, including, but not limited to, accepting deposits, making secured and unsecured loans, purchasing and holding real property for our own use, and issuing, advising, and confirming letters of credit. The amount a bank generally may borrow may not exceed the amount of its shareholders’ equity without the consent of the DFPI.

Restrictions on Lending, Insider Transactions, and Affiliate Transactions

California law limits California banks in the amount they may lend to one borrower and the amount they may lend to insiders. Under California law, with limited exceptions, unsecured loans to one person may not exceed 15% of the sum of a bank’s shareholders’ equity, allowance for credit losses, capital notes, and debentures. Additionally, both secured and unsecured loans to one person (excluding certain secured lending and letters of credit) at any given time generally may not exceed 25% of the sum of a bank’s shareholders’ equity, allowance for credit losses, capital notes, and debentures.

Section 22(g) of the Federal Reserve Act, as implemented by the Federal Reserve’s Regulation O, governs and restricts extensions of credit by a member bank to an executive officer, director, or principal shareholder of the bank and its affiliates. By making these provisions applicable to state non-member banks, the FDI Act and FDIC regulations impose these restrictions on the Bank’s purchases or sales of assets from or to insiders of the Bank and the Company. In general, extensions of credit to insiders: (i) may not exceed certain dollar limitations; (ii) must be made on substantially the same terms, including interest rates and collateral, as those prevailing at the time for comparable transactions with third parties; and (iii) must not involve more than the normal risk of repayment or present other unfavorable features. Additionally, California law imposes insider lending limits that are similar to the restrictions of the Federal Reserve’s Regulation O.

Sections 23A and 23B of the Federal Reserve Act, which the FDI Act makes applicable to a state non-member bank like ours in the same manner and to the same extent as if it were a member bank, establish parameters for an insured bank to conduct “covered transactions” with its affiliates, generally: (i) limiting the extent to which the bank or its subsidiaries may engage in “covered transactions” with any one affiliate to an amount not greater than 10% of the bank’s capital stock and surplus, and limiting the aggregate of all such transactions with all affiliates to an amount not greater than 20% of the bank’s capital stock and surplus; and (ii) requiring that all such transactions be on terms substantially the same, or at least as favorable, to the bank or subsidiary as those that would be provided to a non-affiliate. In addition, an insured bank’s loans to affiliates generally must be fully collateralized. The term “covered transaction” includes the making of loans to the affiliate, purchase of assets from the affiliate, issuance of a guarantee on behalf of the affiliate, and several other types of transactions.

Concentrations in Lending

In 2006, the federal bank regulatory agencies released guidance advising financial institutions of the risks posed by commercial real estate lending concentrations and reinforcing that financial institutions should implement sound risk management processes to identify, monitor, and control risks associated with commercial real estate concentrations. Higher allowances for credit losses and capital levels may also be required. The commercial real estate guidance provides that further supervisory analysis of an institution’s commercial real estate loan concentrations is warranted when its concentrations exceed either: (i) total reported loans for construction, land development, and other land of 100% or more of a bank’s total risk-based capital; or (ii) total reported loans secured by multifamily and non-farm non-residential properties and loans for construction, land development, and other land of 300% or more of a bank’s total risk-based capital, where the outstanding balance of the institution’s commercial real estate portfolio has also increased by 50% or more during the prior 36 months. We have exposures to loans secured by commercial real estate due to the nature of our market and the loan needs of both our retail and commercial customers. We believe that our long-term experience in commercial real estate lending, underwriting policies, internal controls, and other policies currently in place, as well as our loan and credit monitoring and administration procedures, are generally appropriate to managing our concentrations as required under the commercial real estate guidance.

14

Prompt Corrective Action

The FDI Act identifies five capital categories for insured depository institutions: well-capitalized, adequately capitalized, undercapitalized, significantly undercapitalized, and critically undercapitalized. Under the banking agencies’ prompt corrective action framework, an insured depository institution is subject to differential regulation corresponding to the capital category within which the institution falls. For an insured depository institution to be “well-capitalized” under this framework, it must have a common equity Tier 1 capital ratio of at least 6.50%, a Tier 1 capital ratio of at least 8.00%, a total capital ratio of at least 10.00%, and a leverage ratio of at least 5.00%, and must not be subject to any written agreement, order or capital directive, or prompt corrective action directive issued by its primary federal or state banking regulator to meet and maintain a specific capital level for any capital measure. These limitations apply to the Bank, and not to the Company on a standalone basis.

The FDI Act requires the federal banking agencies to take prompt corrective action whenever an insured depository institution does not meet minimum capital requirements. Failure to meet the capital guidelines could also subject an insured depository institution to capital raising requirements. In addition, an insured depository institution is generally prohibited from making capital distributions, including paying dividends or paying management fees to a holding company, if the institution would thereafter be undercapitalized. Finally, failure to meet statutorily mandated capital guidelines or more restrictive ratios separately established for an insured depository institution could subject the institution to a variety of enforcement remedies available to federal regulatory authorities, including issuance of a capital directive, the termination of deposit insurance by the FDIC, a prohibition on accepting or renewing brokered deposits, limitations on the rates of interest that the institution may pay on its deposits, and other restrictions on its business.

The FDI Act also requires the federal banking agencies to prescribe certain noncapital standards for safety and soundness relating generally to operations and management, asset quality, and executive compensation, and permits regulatory action against an insured depository institution that does not meet such standards.

Payment of Dividends

The principal source of the Company’s cash flow is dividends from the Bank. There are various legal and regulatory provisions that limit the amount of dividends the Bank can pay to the Company without regulatory approval. Under the California Financial Code, the Bank may not make any distribution to shareholders that exceeds the lesser of its retained earnings or its net income for the last three fiscal years, less the amount of any distributions made by the Bank to shareholders of the Bank during such period. However, with prior approval of the DFPI, the Bank may make a distribution to shareholders that exceeds such amounts, subject to limits set forth in the California Financial Code. Moreover, an institution’s failure to exceed the capital conservation buffer set forth in the federal banking agencies’ capital rules with common equity Tier 1 capital would result in limitations on an institution’s ability to make capital distributions and discretionary bonus payments. In addition, an insured depository institution is generally prohibited from making capital distributions, including paying dividends or paying management fees to a holding company, if the institution would thereafter be undercapitalized. Finally, the FDI Act prohibits an insured depository institution from paying dividends on its capital stock if it is in default of its payment of deposit insurance assessments to the FDIC.

Reserve Requirements

Federal Reserve rules require depository institutions, such as the Bank, to maintain reserves against their transaction accounts. In response to the COVID-19 pandemic, the Federal Reserve reduced reserve requirement ratios to 0.00% effective March 26, 2020. Increases to the reserve requirement would decrease the amount of the Bank’s assets that it may make available for lending and investment activities. Currently, the Federal Reserve has no plans to re-impose reserve requirements. However, the Federal Reserve may adjust reserve requirement ratios in the future if conditions warrant. Balances maintained by or on behalf of depository institutions in accounts at Federal Reserve Banks continue to receive interest when reserve requirement ratios are set to 0.00%. All balances earned the interest on excess reserves rate through July 28, 2021. Thereafter, all balances earn the Interest on Reserve Balances (the “IORB”) rate. The IORB rate is the rate of interest paid by the Federal Reserve Bank on balances maintained by or on behalf of an eligible institution in an account at a Federal Reserve Bank. The Board of Governors votes on the level of the IORB rate at each Federal Open Market Committee meeting that is consistent with the announced monetary policy stance. The amount of interest on reserve balances is calculated by multiplying the IORB rate on a day by the end of day balance maintained in an account on that day.

15

Consumer Protection Laws

While consumer lending is not currently a significant focus of our business, we are subject to numerous laws and regulations intended to protect consumers, in addition to those discussed above, when lending or offering deposit products to consumers. These laws include, among others: the Truth in Lending Act, the Truth in Savings Act, the Electronic Fund Transfer Act, the Expedited Funds Availability Act, the Equal Credit Opportunity Act, the Fair and Accurate Credit Transactions Act, the Fair Housing Act, the Fair Credit Reporting Act, the Fair Debt Collection Act, the GLB Act, the Home Mortgage Disclosure Act, the Right to Financial Privacy Act, the Real Estate Settlement Procedures Act, laws regarding unfair and deceptive acts and practices, and usury and other fair lending laws and regulations, including state laws and regulations.

Because the Bank has assets of not more than $10 billion, its primary federal regulator, the FDIC, examines and enforces the Bank’s compliance with consumer financial protection laws. However, the CFPB has rulemaking authority, including with respect to regulations prohibiting unfair, deceptive, or abusive acts or practices. Additionally, the CFPB may participate in examinations of banks with not more than $10 billion in assets on a “sampling basis” and may refer potential enforcement actions against such banks to their primary federal regulators.

Many states and local jurisdictions have consumer protection laws analogous, and in addition, to those listed above. These include, for instance, the California Unfair Competition Law, which broadly prohibits any unlawful, unfair, or fraudulent business act or practice, and false, deceptive, or misleading advertising. Violations of applicable consumer protection laws can result in significant potential liability, including actual damages, restitution, and injunctive relief, from litigation brought by customers, state attorneys general, and other plaintiffs, as well as enforcement actions by banking regulators.

Financial Privacy Laws

The GLB Act and California Consumer Privacy Act impose requirements related to the privacy of customer financial information. Among other things, these laws require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a nonaffiliated third party. The California Consumer Privacy Act grants California residents the rights to know about personal information collected about them, to delete certain of this personal information, to opt out of the sale of personal information, and to non-discrimination for exercising these rights. The privacy provisions of these laws may affect how consumer information is transmitted through diversified financial companies and conveyed to outside vendors.

On October 22, 2024, the CFPB issued a final rule to implement Section 1033 of the Dodd-Frank Act. Under the final rule, financial institutions such as the Bank that offer a consumer product or service covered by the rule would be required, upon request, to make available to a consumer or third party authorized by the consumer certain information the Bank has concerning such a product or service. Industry organizations challenged the final rule in court. On July 29, 2025, the district court granted a motion by the CFPB to stay the proceedings while the CFPB conducts a rulemaking to revise the final rule substantially. On August 22, 2025, the CFPB issued an advance notice of proposed rulemaking to solicit comments and data on several issues as part of a reconsideration of the final rule. On October 29, 2025, the district court issued a preliminary injunction preventing the CFPB from enforcing the final rule until the CFPB has completed its reconsideration of the rule.

Branching

Under California law, the Bank may open branch offices throughout California with the prior approval of the DFPI. In addition, with prior DFPI approval, the Bank may acquire branches of existing banks located in California. Under federal law, the Bank may establish branch offices with the prior approval of the FDIC. Federal law allows a bank to branch into a new state through the establishment of a new branch if, among other factors, the bank is “well-managed” and “well-capitalized” and, under the laws of the state in which the branch is to be located, a state bank chartered by that state would be permitted to establish the branch.

FDIC Deposit Insurance Assessments

The deposits of the Bank are insured by the DIF as administered by the FDIC and, accordingly, are subject to deposit insurance assessments to maintain the DIF at minimum levels required by statute. The Dodd-Frank Act increased the minimum reserve ratio requirement for the DIF to 1.35% of total estimated insured deposits or the comparable percentage of the deposit assessment base. The DIF reserve ratio fell to below the statutory minimum of 1.35% during the COVID-19 pandemic. The FDIC adopted a restoration plan in September 2020, which it amended in June 2022, to restore the DIF

16

reserve ratio to at least 1.35% by September 30, 2028. On October 18, 2022, the FDIC adopted a final rule to increase initial base deposit insurance assessment rates for insured depository institutions by two basis points, beginning with the first quarterly assessment period of 2023. The increased assessment rate schedules will remain in effect unless and until the reserve ratio of the DIF meets or exceeds 2.00%. As a result of the new rule, the FDIC insurance costs of insured depository institutions, including the Bank, generally increased.

The FDIC uses a risk-based assessment system that imposes insurance premiums as determined by multiplying an insured bank’s assessment base by its assessment rate. A bank’s deposit insurance assessment base is generally equal to its total assets minus its average tangible equity during the assessment period. For a depository institution that has been insured for more than five years and that has total consolidated assets of less than $10.0 billion, such as the Bank, the FDIC determines the assessment rate within a range of base assessment rates based on the bank’s CAMELS composite rating, considering other factors and adjustments. The CAMELS rating system is a supervisory rating system developed to classify a bank’s overall condition by considering capital adequacy, assets, management capability, earnings, liquidity, and sensitivity to market and interest rate risk.

Insurance of deposits may be terminated by the FDIC upon a finding that a bank has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order, or condition imposed by the bank’s federal regulatory agency. In addition, the FDI Act provides that, in the event of the liquidation or other resolution of an insured depository institution, the claims of depositors of the institution, including the claims of the FDIC as subrogee of insured depositors, and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution, including those of its parent bank holding company.

Community Reinvestment Act (“CRA”)

The CRA requires that, in connection with examinations of insured depository institutions within their respective jurisdictions, the federal banking agencies must evaluate the record of each financial institution in meeting the credit needs of its local community, including low- and moderate-income neighborhoods. A bank’s CRA performance is also considered in evaluating applications seeking approval for mergers, acquisitions, and new offices or facilities, and a CRA rating of less than “Satisfactory” may adversely affect the ability of a bank or its parent company to engage in such transactions. The Bank received a rating of “Satisfactory” at its most recent CRA evaluation, dated as of July 22, 2024 and covering activities from 2021 through the evaluation date. The FDIC’s evaluation of the Bank’s record of performance under the CRA is publicly available.

On October 24, 2023, the federal banking agencies issued a final rule revising their framework for evaluating banks’ records of community reinvestment under the CRA. On July 16, 2025, these agencies issued a notice of proposed rulemaking to rescind the October 2023 final rule and restore the CRA framework that existed prior to the October 2023 final rule. The Bank’s most recent performance evaluation was conducted using the CRA framework that existed prior to the October 2023 final rule.

FHLB Membership

The Bank is a member of the FHLB, which is one of 11 regional Federal Home Loan Banks that administer the home financing credit function of banking institutions. Each Federal Home Loan Bank is funded primarily from proceeds derived from the sale of consolidated obligations of the Federal Home Loan Bank system and makes advances to members in accordance with policies and procedures established by the Board of Directors of the Federal Home Loan Bank and subject to the oversight of the Federal Housing Finance Agency. All advances from a Federal Home Loan Bank are required to be fully secured by sufficient collateral as determined by the Federal Home Loan Bank. In addition, all long-term advances are required to provide funds for residential home financing.

Cybersecurity

Federal banking agencies pay close attention to the cybersecurity practices of banks and their holding companies and affiliates. The interagency council of the agencies, the FFIEC, has issued several policy statements and other guidance for banks as new cybersecurity threats arise. The FFIEC has recently focused on such matters as compromised customer credentials and business continuity planning. Examinations by the banking agencies now include review of an institution’s information technology and its ability to thwart cyber-attacks.

17

Banking organizations are required to notify their primary federal regulator of significant computer security incidents within 36 hours of determining that such an incident has occurred. In addition, the SEC enacted rules, effective as of December 18, 2023, requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on annual basis material information regarding their cybersecurity risk management, strategy, and governance.