FIRSTSUN CAPITAL BANCORP (FSUN) Business

Item 1. Business

In this report, unless the context suggests otherwise, references to the “Company” or “FirstSun” refers to FirstSun Capital Bancorp, a Delaware corporation, and references to “we,” “us,” and “our” refer to the combined business of FirstSun Capital Bancorp and its wholly-owned subsidiaries, including Sunflower Bank, National Association (“Sunflower Bank” or the “Bank”), Sunflower Wealth Advisors LLC, and FEIF Capital Partners, LLC.

Overview

We are a financial holding company headquartered in Denver, Colorado, providing a full spectrum of deposit, lending, treasury management, wealth management and online banking products and services through our two primary operating subsidiaries—Sunflower Bank, a national banking association headquartered in Dallas, Texas, that operates as Sunflower Bank, N.A. and First National 1870, a division of Sunflower Bank, N.A., and Sunflower Wealth Advisors LLC, a registered investment advisor organized under the laws of the State of Kansas that provides discretionary investment management to retail and institutional accounts. FirstSun has a third wholly-owned subsidiary, FEIF Capital Partners, LLC, a Delaware limited liability company, which is planned to serve as the investment manager of a prospective credit fund.

Sunflower Bank was founded in 1892 and offers a full range of specialized financial services to business customers as well as relationship-focused services to meet personal, business and wealth management financial objectives for its customers throughout Texas, Kansas, Colorado, New Mexico, Arizona, California and Washington and a mortgage lending platform with capabilities in 44 states. Our product line includes commercial and industrial loans and commercial real estate loans, residential mortgage and other consumer loans, a variety of commercial, consumer and private banking deposit products, including noninterest-bearing accounts, interest-bearing demand products, savings accounts, money market accounts and certificates of deposit. Additionally, Sunflower Bank provides treasury management products and services and together with Sunflower Wealth Advisors offers wealth management and trust products including private banking, personal trust and agency accounts, employee benefit and retirement related trust and agency accounts, investment management and advisory agency accounts, and foundation and endowment trust and agency accounts.

As of December 31, 2025, we had consolidated total assets of $8.5 billion, total net loans held-for-investment of $6.6 billion, total deposits of $7.1 billion and total stockholders’ equity of $1.2 billion.

Pending Merger with First Foundation Inc.

On October 27, 2025, we entered into a merger agreement with First Foundation, the holding company of First Foundation Bank, headquartered in Irvine, California, as amended by amendment no. 1 to the merger agreement dated February 6, 2026. Under the merger agreement, First Foundation will merge with and into FirstSun, with FirstSun continuing as the surviving entity. Immediately following the merger, First Foundation Bank will merge with and into Sunflower Bank, with Sunflower Bank continuing as the surviving bank. The consummation of the proposed merger will expand our markets in California and Texas, as well as add new markets in Florida, Nevada and Hawaii.

The merger agreement, as amended, was unanimously approved by the boards of directors of FirstSun and First Foundation, and is subject to customary closing conditions, including receipt of remaining required regulatory approvals. The stockholders of FirstSun and First Foundation approved the merger agreement and transactions contemplated thereby at special stockholders’ meetings held on February 27, 2026. The merger is expected to close early in the second quarter of 2026.

History and Growth

We were originally incorporated in the State of Kansas on November 9, 1981, as Handi-Bancshares, Inc., to serve as the holding company of Sunflower Bank (formerly The First National Bank and Trust Company of Salina), before we changed our name to Sunflower Financial, Inc. in 2008. We subsequently changed our name to FirstSun Capital Bancorp and simultaneously reincorporated under the laws of the State of Delaware in June 2017. The subsequent name change and reincorporation were completed pursuant to the merger agreement entered into on July 28, 2016, by and among FirstSun, Strategic Growth Bank Incorporated, which we refer to as “SGB,” Strategic Growth Bancorp Incorporated, which we refer to as “Strategic” and First National Bancorp Incorporated, which we refer to as “FNB,” and together with SGB and Strategic, as the “SGB parties.”

7

Table of Contents

On June 19, 2017, we completed our merger with the SGB parties. Under the merger agreement for the SGB mergers, FirstSun also acquired Guardian Mortgage Company, Inc., which we refer to as “Guardian,” a former subsidiary of Strategic. Guardian was merged with and into Sunflower Bank. With the SGB mergers, we acquired two branches in El Paso, Texas and 21 branches in New Mexico and Colorado, as well as residential mortgage loan origination and servicing activities in 13 states. We also relocated our headquarters from Salina, Kansas to Denver, Colorado.

On April 1, 2022, FirstSun completed its merger with Pioneer Bancshares, Inc. (“Pioneer”). Pioneer’s wholly-owned subsidiary, Pioneer Bank, SSB, a Texas state savings bank, was merged with and into the Bank, with the Bank continuing as the surviving bank. With the merger, we acquired 19 branches in Texas.

In November 2023, the Bank relocated its main office from Denver, Colorado, to Dallas, Texas.

In December 2024, we made the decision to rebrand our mortgage division as Sunflower Bank Mortgage Lending and cease operating under the Guardian Mortgage tradename.

In June 2025, we made the decision to rebrand our registered investment advisor as Sunflower Wealth Advisors LLC and cease operating under the Logia Portfolio Management tradename.

In November 2025, we established Sunflower Insurance Solutions Inc., a wholly owned subsidiary of Sunflower Bank, N.A. Sunflower Insurance Solutions will offer life, long-term care and disability coverage, alongside estate planning and generational wealth transfer solutions.

Our Market Areas

We currently operate our principal executive office at 1400 16th Street, Suite 250, Denver, Colorado 80202, with Sunflower Bank’s main office at 8117 Preston Road, Suite 220, Dallas, Texas 75225. We have a model of delivering relationship-driven banking services with local decision-making to communities throughout Texas, Kansas, Colorado, New Mexico, Arizona, California and Washington. The Bank’s national lines of business include specialty commercial services and a mortgage lending platform with capabilities in 44 states.

Our Business Strategy

Our goal is to build a premier regional bank serving our key markets, primarily through our organic growth strategy of investing in people, technology and infrastructure to create a top-tier banking platform. Our business is focused on providing specialized commercial and consumer banking services to our clients, with an emphasis on key Southwest and Western growth markets. Upon completion of our proposed merger with First Foundation, we will expand our markets in California and Texas, and also add new markets in Florida, Nevada and Hawaii. Our commitment to serving local communities has led to a high-quality core deposit franchise focused in higher growth metropolitan markets as well as stable, non-metropolitan markets that provides a low-cost funding base for our lending opportunities. In addition, our mortgage, wealth management, private banking and treasury management offerings provide revenue diversification and generate fee income. Lastly, we believe our experience as an acquirer with a successful track record of integrating and re-positioning acquired companies complements and will further fuel our organic growth strategy.

Leverage our Relationships and Service Capabilities to Drive Organic Growth. From our modest beginning in 1892, our founders understood that our success would be closely tied to that of the communities in which we operate, and that long-term value creation would require an uncompromising commitment to service and the establishment of enduring relationships with our clients. That vision continues to drive us today, as our 1,177 full-time equivalent employee base, as of December 31, 2025, serves our business and consumer customers throughout Texas, Kansas, Colorado, New Mexico, Arizona, California and Washington. Our core competencies include a relationship-centered and multi-line sales approach, a focus on collaboration across a highly skilled and seasoned team of bankers and a dynamic ability to provide our clients with the highest quality services and solutions. This strategy has enabled us to attract commercial and industrial business customers across our traditional and expanded geographic footprint. The objective is to be a trusted advisor to our clients as they build their businesses with our resources, support and advice.

Continue to Grow our Core Deposit Franchise. The strength of our deposit franchise is derived from strong, lasting relationships with our clients and a focus on being an integral part of the communities where we do business. Our deposit footprint has provided, and we believe will continue to provide, principal support for the growth of our loan portfolio. A key element of our funding strategy is a focus on commercial and consumer banking relationships in our markets, including our historically stable, lower growth markets in Kansas and New Mexico. Additionally, we believe our growing treasury management business will continue to benefit our attractive funding base.

8

Table of Contents

Continue our Greater Texas and Southern California Market Expansion Strategy. The greater Texas market has been a top strategic priority for our organization from an organic and acquisition perspective. We deployed our organic growth strategy in the Dallas, Texas market beginning in late 2019 with a commercial team lift-out that by December 2020 generated significant loans and deposits, making Dallas our fastest growing loan market over this period. In addition to our organic expansion in Dallas, we closed our merger with Pioneer on April 1, 2022, which further increased our Texas loan and deposit portfolios. The Bank’s headquarters was relocated to Dallas, Texas in November 2023. We anticipate continuing to grow our Texas loan and deposit customer base. Beyond our greater Texas strategy, we have also expanded our presence in Southern California markets. With a team of bankers hired during 2024, we now deliver relationship banking to communities around Southern California. In early 2025, we established two new depository branches, one in each of San Diego and Los Angeles, California to support our team of bankers in these areas and further service customers and businesses in these communities. We plan to continue to explore opportunities to serve this market.

Engage in Opportunistic M&A. An important component of the FirstSun story is our expertise and experience in mergers and acquisitions. Our executive team has extensive experience with successful acquisitions and integrations. We plan to continue to evaluate acquisitions that we believe are strategic and could produce attractive returns for our stockholders. These could include fee-based businesses, whole bank or branch acquisitions that we believe would improve or expand our market position into geographies with attractive demographics and business trends, expand our existing branch network in existing or new markets, enhance our earnings power or product and service offerings, or expand our wealth management activities.

Competition

The financial services industry is highly competitive and we compete for loans, deposits and customer relationships in our geographic footprint. We compete with commercial banks, credit unions, savings institutions, mortgage banking firms, consumer finance companies, securities brokerage firms, insurance companies, money market funds and other mutual funds, loan production offices and other providers of financial services, including nontraditional financial technology companies or FinTech companies, as well as super-regional, national and international financial institutions that operate offices in our market areas and elsewhere. Many of our nonbank competitors which are not subject to the same extensive federal regulations that govern bank holding companies and banks, may have certain competitive advantages.

We compete for loans principally through the quality of our client service and our responsiveness to client needs in addition to competing on interest rates and loan fees. Management believes that our long-standing presence in the community and personal one-on-one service philosophy enhances our ability to compete favorably in attracting and retaining individual and business customers. We actively solicit deposit-related clients and compete for deposits by offering personal attention, competitive interest rates, and professional services made available through experienced bankers and multiple delivery channels that fit the needs of our markets. In wealth management and trust services, we compete with a variety of custodial banks as well as a diverse group of investment managers.

We believe the financial services industry will likely continue to become more competitive as further technological advances enable more financial institutions to provide expanded financial services without having a physical presence in our markets. We have focused on providing value-added products and services to our clients, which we are able to do because of our close relationships with them. We believe our ability to provide flexible, sophisticated products and a customer-centric process to our customers and clients allows us to stay competitive in the financial services environment.

Our Banking Services

Our operations are managed along two reportable operating segments consisting of Banking and Mortgage Operations.

Our Banking segment has been, and is, the cornerstone of our operations and our primary segment, through which we provide a full range of deposit and lending products. We are dedicated to serving the banking needs of businesses, professionals and individuals in our markets through our approach of personalized, relationship-based service. We strive to become trusted advisers to our clients and achieve long-term relationships. We deliver a wide range of banking products and services tailored to meet the needs of our clients across our geographic footprint.

Our Mortgage Operations segment offers full-service residential mortgage products, including conforming residential loans and services through our mortgage division. Additionally, our Mortgage Operations segment includes the servicing of residential mortgage loans and the packaging and securitization of loans to governmental agencies.

9

Table of Contents

For further information, see “Segments” in “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations” and Note 21 - Segment Information in the notes to consolidated financial statements included in “Item 8. Financial Statements and Supplementary Data” elsewhere in this report.

Lending Activities

We offer a range of lending services, including commercial and industrial, commercial real estate, residential real estate, public finance, consumer and other loans. Our customers are generally commercial businesses, professional services and retail consumers within our market areas. For further information, see “Loans” in “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations” and Note 3 - Loans in the notes to consolidated financial statements included in “Item 8. Financial Statements and Supplementary Data” elsewhere in this report.

Commercial and Industrial Loans

Our commercial and industrial loans are typically made to small- and medium-sized manufacturing, service, wholesale and retail businesses for working capital and operational needs and business expansions, including the purchase of capital equipment. Commercial and industrial loans include our specialty lending verticals such as structured finance products, asset based lending and family office. Commercial and industrial also includes our healthcare, SBA and other small business lending products. Commercial and industrial loans generally include lines of credit and loans with maturities of five years or less. Because we have long standing ties to the businesses and professionals operating in our geographic footprint, we seek to tailor our commercial and industrial loan programs to meet the needs of our clients.

Growing our commercial and industrial loan portfolio is an important area of emphasis for us and we intend to continue to grow this portfolio.

Commercial and industrial loans are generally made with operating cash flows as the primary source of repayment, but may also include collateralization by inventory, accounts receivable, equipment and personal guarantees. As a result, the repayment risk is subject to the ongoing business operations of the borrower. Any interruption or discontinuance of operating cash flows from the business, which may be influenced by events not under the control of the borrower such as economic events and changes in governmental regulations, could materially affect the ability of the borrower to repay the loan. Further, commercial and industrial loans may be secured by the collateral described above, which if the business is unsuccessful, typically have values insufficient to satisfy the loan without a loss.

SBA loans. We participate in the SBA 7(a) program in order to meet the needs of our small business community as well as customers nationwide. As an approved participant in the SBA Preferred Lender’s Program, we enable our clients to obtain SBA loans without being subject to the potentially lengthy SBA approval process necessary for lenders that are not SBA Preferred Lenders. Presently, pursuant to the Consolidated Appropriations Act, 2021, the SBA guaranteed 90% of the principal amount of each qualifying SBA loan originated under the SBA’s 7(a) loan program. After this date, the SBA will guarantee 75% to 85% of the principal amount of qualifying loans originated under the 7(a) loan program. The guarantee is conditional and covers a portion of the risk of payment default by the borrower, but not the risk of improper closing and servicing by the lender. As such, prudent underwriting and closing processes are essential to effective utilization of the 7(a) program.

Commercial and Residential Real Estate Loans

Real estate loans are subject to the same general risks as other loans and are particularly sensitive to fluctuations in the value of real estate. Fluctuations in the value of real estate, as well as other factors arising after a loan has been made, could negatively affect a borrower’s cash flow, creditworthiness and ability to repay the loan. When we make new real estate loans, we obtain a security interest in real estate whenever possible, in addition to any other available collateral, to increase the likelihood of the ultimate repayment of the loan. To control concentration risk, we monitor collateral type and industry concentrations within this portfolio.

Our real estate loans generally fall into one of two broad categories: commercial real estate loans or residential real estate loans.

•Commercial Real Estate Loans. Our commercial real estate (“CRE”) loans consist of both owner-occupied and non-owner occupied commercial real estate loans, construction and land loans, as well as multifamily loans. The real estate securing our existing commercial real estate loans includes a wide variety of property types, such as offices, warehouses, production facilities, health care facilities, hotels, mixed-use residential/commercial, retail centers, restaurants, assisted living facilities and self-storage facilities. Non-owner occupied CRE loans were

10

Table of Contents

62.5% of the Company’s risk-based capital, or 11.1% of total loans as of December 31, 2025. Non-owner occupied CRE loans associated with office space were $48.9 million, or 0.7% of total loans as of December 31, 2025. Owner occupied CRE loans associated with office space were $215.5 million, or 3.2% of total loans as of December 31, 2025. We are primarily focused on growing the owner-occupied portion of our commercial real estate loan portfolio.

Commercial real estate loans are often larger and involve greater risks than other types of lending. Adverse developments affecting commercial real estate values in our market areas could increase the credit risk associated with these loans, impair the value of property pledged as collateral for these loans, and affect our ability to sell the collateral upon foreclosure without a loss. Furthermore, adverse developments affecting the business operations of the borrowers of our owner-occupied commercial real estate loans could significantly increase the credit risk associated with these loans. Due to the larger average size of commercial real estate loans, we face the risk that losses incurred on a small number of commercial real estate loans could have a material adverse impact on our financial condition and results of operations.

•Residential Real Estate Loans. Our residential real estate loans consist of 1-4 family loans, home equity loans and multi-family loans. The residential real estate loans described below exclude mortgage loans that are held-for-sale.

Like our commercial real estate loans, our residential real estate loans are secured by real estate, the value of which may fluctuate significantly over a short period of time as a result of market conditions in the area in which the real estate is located. Adverse developments affecting real estate values in our market areas could therefore increase the credit risk associated with these loans, impair the value of property pledged as collateral on loans and affect our ability to sell the collateral upon foreclosure without a loss or additional losses. We primarily make our residential real estate loans to qualified individuals and investors in accordance with our real estate lending policies, which detail maximum loan to value ratios and maturities. The repayment of these loans are also affected by a borrower’s adverse personal circumstances.

Public Finance Loans

We offer public finance loans consisting primarily of loans to our charter school and municipal based customers.

Consumer Loans

We offer a variety of consumer loans, such as installment loans to individuals for personal, family and household purposes, including car, boat and other recreational vehicle loans. Our consumer loans typically are part of an overall client relationship designed to support the individual consumer borrowing needs of our commercial and industrial loan and deposit clients, and are well diversified across our markets. Consumer loans typically have shorter terms, lower balances, higher yields and higher risks of default than residential real estate mortgage loans. Consumer loan collections are dependent on the borrower’s continuing financial stability and are therefore more likely to be affected by adverse personal circumstances, such as the loss of employment, unexpected medical costs or divorce. These loans are often secured by the underlying personal property, which typically has insufficient value to satisfy the loan without a loss due to damage to the collateral and general depreciation.

Mortgage Banking Activities

We offer full-service residential mortgage products and services through our mortgage division, with offices strategically located throughout our bank branches, as well as in other locations both in and outside our community banking footprint.

We intend to continue to take advantage of opportunities to profitably grow our mortgage business as they present themselves, including by continuing to strategically expand our retail-based mortgage business outside of our community banking geographic footprint, improving the client experience through an enhanced fulfillment process, attracting experienced loan officers and improving profitability through centralized efficiencies. We maintain a high-degree of scalability to control costs in the event of a downturn in our mortgage business. Our mortgage loan office leases are primarily shorter-term in nature and the majority of our mortgage-related compensation is in the form of variable compensation.

We look to originate quality mortgage loans with a focus on purchase money mortgages. In accordance with our lending policy, each loan undergoes a detailed underwriting process which incorporates uniform underwriting standards and oversight that satisfies secondary market standards as outlined by our investors to the size and complexity of the lending

11

Table of Contents

relationship. Mortgage loans are subject to the same uniform lending policies referenced below and consist primarily of loans with relatively stronger borrower credit scores, with an average FICO score of 743 in 2025.

The residential mortgage industry is highly competitive and we compete with other community banks, regional banks, national banks, credit unions, mortgage companies, financial service companies and online mortgage companies. Due to the highly competitive nature of the residential mortgage industry, we expect to face industry-wide competitive pressures related to changing market conditions that will reduce our pricing margins and mortgage revenues generally, especially in a rising rate environment.

Our mortgage banking business is also directly impacted by the interest rate environment, increased regulations, consumer demand, driven in large part by general economic conditions and the real estate markets, and investor demand for mortgage securities. In general, mortgage production, especially refinancing activity, declines in rising interest rate environments.

Sale of residential mortgages. We sell a large majority of the residential mortgage loans we originate through our mortgage banking business to Fannie Mae, Freddie Mac or, to a lesser extent, an array of private national mortgage investors. As part of our overall asset/liability management objectives, we may also retain certain residential loans that we originate and, in such an instance, would bear the risk of default with respect to these loans. To reduce the interest rate risk associated with commitments made to borrowers for mortgage loans that have not yet been closed and that we intend to sell in the secondary markets, we routinely enter into commitments (considered to be derivatives) to hedge the interest rate risk. Derivative instruments are recognized at fair value in our consolidated balance sheets as either assets or liabilities. We monitor our interest rate risk position daily to maintain appropriate coverage of our loan commitments made to borrowers.

Loan servicing. We service residential mortgage loans for investors under contracts. We receive a fee for performing mortgage servicing activities on mortgage loans that are not owned by us and are not included on our consolidated balance sheet. This process involves collecting monthly mortgage payments on behalf of investors, reporting information to those investors on a timely basis and maintaining custodial escrow accounts for the payment of principal and interest to investors, and property tax and insurance premiums on behalf of borrowers.

As compensation for our loan servicing activities, we receive a base servicing fee of approximately 0.25% per year of the loan balances serviced, plus any late charges collected from the delinquent borrowers and other fees incidental to the services provided. In the event of a default by the borrower, we receive no servicing fees until the default is cured. In times when interest rates are rising or at high levels, servicing mortgage loans can represent a steady source of noninterest income and can, at times, offset decreases in mortgage banking gains. Conversely, in times when interest rates are falling or at very low levels, servicing mortgage loans can become comparatively less profitable due to the rapid payoff of loans and the negative impact due to the change in fair value of the servicing asset. We account for our residential mortgage loan servicing rights at fair value. The amount of loan servicing rights initially recorded is based on the fair value of the loan servicing rights determined on the date when the underlying loan is sold. Our determination of fair value and the amount we record is based on a valuation model using discounted cash-flow analysis and available market pricing. Third-party valuations of the loan servicing rights portfolio are obtained on a regular basis and are used to determine the fair value of the servicing rights at the end of the reporting period. Estimates of fair value reflect, among other things, the following variables:

•anticipated prepayment speeds;

•product type (i.e., conventional, government, balloon);

•fixed or adjustable rate of interest;

•interest rate;

•servicing costs per loan;

•discounted yield rate;

•estimate of ancillary income; and

•geographic location of the loan.

We monitor the level of our investment in mortgage servicing rights in relation to our other mortgage banking activities in order to limit our exposure to significant fluctuations in loan servicing income. We use a hedging program to seek to mitigate the volatility from changes in the fair value of our mortgage servicing rights. Nonetheless, we remain exposed to significant potential volatility in the value of our mortgage servicing rights. Accordingly, in the future, we may sell loan servicing rights depending on a variety of factors, including capital sufficiency, the size of the mortgage servicing rights portfolio relative to total assets and current market conditions.

12

Table of Contents

Deposit Products

We obtain most of our deposits from individuals, small and medium-sized businesses and municipalities in our markets. We solicit deposits through our relationship-driven team of dedicated and accessible bankers and through community-focused marketing. We emphasize obtaining deposit relationships at loan origination. We provide a high level of customer service to our depositors. We have invested in personnel, business and compliance processes and technology that enable us to acquire, and efficiently and effectively serve, a wide array of business deposit accounts, while continuing to provide the level of customer service for which we are known. We currently offer a comprehensive range of business deposit products and services to assist with the banking needs of our business customers, including a variety of remote deposit and cash management products along with commercial transaction accounts.

Wealth Management

We offer our clients a comprehensive suite of services that include private banking, wealth planning, investment management, trust and retirement plan services through our team of wealth advisors, trust specialists and investment professionals. Our holistic and personalized approach delivers a customized asset management solution focused on the client’s personal, family and multi-generational needs. Our asset management solutions are focused on seeking to generate the highest net after tax returns for our clients relative to their appropriate risk level.

Credit Administration and Loan Review

Certain credit risks are inherent in making loans. These include repayment risks, risks resulting from uncertainties in the future value of collateral, risks resulting from changes in economic and industry conditions and risks inherent in dealing with individual borrowers. We seek to control credit risk both through disciplined underwriting of each transaction, as well as active credit management processes and procedures to manage risk and minimize loss throughout the life of a loan. We seek to maintain a broadly diversified loan portfolio in terms of type of customer, type of loan product, geographic area and industries in which our business customers are engaged. We have developed tailored underwriting criteria and credit management processes for each of the various loan product types we offer our customers.

Underwriting. In evaluating each potential loan relationship, we adhere to a disciplined underwriting evaluation process that includes the following:

•understanding the customer’s financial condition and ability to repay the loan;

•verifying that the primary and secondary sources of repayment are adequate in relation to the amount and structure of the loan;

•observing appropriate loan-to-value guidelines for collateral-secured loans;

•maintaining our targeted levels of diversification for the loan portfolio as to type of borrower; and

•ensuring that each loan is properly documented with perfected liens on collateral.

Loan Approval Authority. Our lending activities follow written, non-discriminatory, underwriting standards and loan origination procedures established by our board of directors and management. We have established several levels of lending authority that have been delegated by the board of directors to our Chief Executive Officer, Chief Credit Officer and other personnel in accordance with our loan policy. Authority limits are based on the total exposure of the borrower and are conditioned on the loan conforming to the policies contained in the loan policy. Any loan policy exceptions are fully disclosed to the approving authority.

Ongoing Credit Risk Management. In addition to the tailored underwriting process described above, we perform ongoing risk monitoring and review processes for credit exposures. An internal loan review team that utilizes a mix of internal and external resources perform regular loan reviews and confirm loan classifications. We strive to identify potential problem loans early in an effort to aggressively seek resolution of these situations before they create a loss. We record any necessary charge-offs promptly and maintain adequate allowance levels for probable credit losses incurred in the loan portfolio.

In general, whenever a particular loan or overall borrower relationship is downgraded from a pass grade to a watch or substandard grade based on one or more standard loan grading factors, our relationship manager (who is typically the loan officer) and credit team members engage in active evaluation of the asset to determine the appropriate resolution strategy. Management regularly reviews the status of the watch list and classified assets portfolio as well as the larger credits in the portfolio.

Concentrations of Credit Risk. Diversification of risk is a key factor in prudent asset management. Our loan portfolio is balanced between our metropolitan and community markets and by type, thereby diversifying our loan concentration. Our

13

Table of Contents

granular loan portfolio reflects a balanced mix of consumer and commercial clients across these markets that we think provides a natural hedge to industry and market cycles. In addition, risk from concentration is actively managed by management and reviewed by our board of directors, and exposures relating to borrower, industry and commercial real estate categories are tracked and measured against established policy limits and guidelines.

Lending Limits. Our lending activities are subject to a variety of lending limits imposed by federal law. In general, Sunflower Bank is subject to a legal lending limit on loans to a single borrower of 15% of its capital and unimpaired surplus, or 25% if the loan is fully secured. The dollar amounts of the Bank’s lending limit increases or decreases as its capital increases or decreases. We are able to sell participations in larger loans to other financial institutions, which allows us to better manage the risk and exposure involved with larger loans and to meet the lending needs of our customers requiring extensions of credit in excess of regulatory limits.

Sunflower Bank’s legal lending limit as of December 31, 2025, on loans to a single borrower was $168.0 million (15%) and $279.9 million (25%), for fully secured loans.

Human Capital Resources

We are committed to provide, develop and retain a high performing and highly qualified workforce that fosters a healthy, safe and productive work environment for our employees to maximize individual and organizational potential and position us as an employer of choice.

Employee Profile. As of December 31, 2025, we had 1,186 total employees and 1,177 full-time equivalent employees, primarily located throughout Texas, Kansas, Colorado, New Mexico, Arizona, California and Washington. Our employees are not covered by a collective bargaining agreement. We consider our relationship with our employees to be good and have not experienced interruptions of operations due to labor disagreements.

Compensation and Benefits. We believe our competitive compensation and benefits package, along with our positive and inclusive work environment, bring out the best in our employees. We have designed our compensation program around the philosophy of mutual respect and the continued success of our organization. We know that our most valuable asset is our people. We offer competitive benefits to our employees and their families. These programs include a 401(k) plan with an employer matching contribution, healthcare and insurance benefits, flexible spending accounts, paid time off, tuition reimbursement, volunteer and parenting leave and an employee assistance program.

We annually review benefit programs and compensation programs to seek to ensure that we remain competitive in our markets to meet the needs of our employees and their families.

Learning and Development. Our goal is to better equip our managers and leaders with the most effective resources and tools to succeed in their roles. We want to create strong leaders with a platform that allows open communication, provides consistency across regions as well as fosters growth and development. Our goal is to establish strong leaders who will be able to effectively engage their employees to meet and reinforce the mission and goals of Sunflower Bank. We have internal programs for emerging managers and leaders that are designed to train and enhance the skills of our employees to promote career advancement from within our company. In addition, we facilitate the educational and professional development of our employees through financial support to attend conferences and obtain degrees, licenses and certifications while employed by us.

Employee Engagement Surveys. We are committed to seeking to ensure that all of our employees feel a sense of belonging in the workplace and that they are given an opportunity to share their opinions and be heard by management and our leaders. We believe that engaged employees are the foundation of a successful company. Our employee engagement surveys serve as a learning tool and provide us with the information to allow us to identify areas of strength and opportunities for improvement to seek to ensure continued satisfaction and retention of our employees.

In addition to our employee engagement surveys, we have additional tools that employees can provide feedback to co-workers, departments, and other areas of Sunflower Bank besides management or leadership through our Intranet and HRIS. These tools provide positive feedback and success stories for all employees to share.

Implications of Being an Emerging Growth Company

FirstSun qualifies as an “emerging growth company” under the Jumpstart Our Business Startups Act of 2012, or the “JOBS Act.” An emerging growth company may take advantage of reduced reporting requirements and is relieved of certain other

14

Table of Contents

significant requirements that are otherwise generally applicable to public companies. Among other things, as an emerging growth company:

•FirstSun is exempt from the requirement to obtain an attestation from its auditors on management’s assessment of FirstSun’s internal control over financial reporting under the Sarbanes-Oxley Act of 2002, or the “Sarbanes-Oxley Act”;

•FirstSun will be permitted an extended transition period for complying with new or revised accounting standards affecting public companies and such new or revised accounting standards will not be applicable to FirstSun until such time as they are applicable to private companies;

•FirstSun is permitted to provide reduced disclosure regarding its executive compensation arrangements pursuant to the rules applicable to smaller reporting companies, which means FirstSun does not have to include a compensation discussion and analysis and certain other disclosures regarding its executive compensation arrangements; and

•FirstSun is not required to hold non-binding stockholder advisory votes on executive compensation or golden parachute arrangements.

FirstSun has taken advantage of certain reduced reporting obligations in this Annual Report on Form 10-K. Accordingly, the information contained herein may be different than the information you receive from other public companies in which you hold securities.

We expect that we will cease to qualify as an emerging growth company beginning with our Annual Report on Form 10-K for the year ended December 31, 2026.

Supervision and Regulation

General

FirstSun and Sunflower Bank are subject to extensive banking regulations that impose restrictions on and provide for general regulatory oversight of their operations. These laws generally are intended to protect consumers and depositors, rather than FirstSun stockholders.

The following discussion is not intended to be a complete list of all the activities regulated by the banking laws or of the impact of such laws and regulations on our operations. It is intended only to briefly summarize some material provisions. The following summary is qualified by reference to the statutory and regulatory provisions discussed. These statutes and regulations are subject to change, and additional statutes, regulations, and corresponding guidance may be adopted. We are unable to predict these future changes or the effects, if any, that these changes could have on our business, revenues, and results of operations.

In the past year, the scope of the laws and regulations and the intensity of the supervision to which we are subject have decreased in response to the Trump administration’s deregulatory policies. We expect that our business will remain subject to extensive regulation and supervision despite the recent deregulatory environment.

Legislative and Regulatory Developments

Although the 2008 financial crisis has now passed, the legislative and regulatory response, including the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), will continue to have an impact on our operations.

The Dodd-Frank Wall Street Reform and Consumer Protection Act

The Dodd-Frank Act was signed into law in July 2010 and impacts financial institutions in numerous ways, including:

•The creation of a Financial Stability Oversight Council responsible for monitoring and managing systemic risk;

•Granting additional authority to the Federal Reserve to regulate certain types of nonbank financial companies;

•Granting new authority to the FDIC as liquidator and receiver;

•Changing the manner in which deposit insurance assessments are made;

•Requiring regulators to modify capital standards;

•Establishing the Consumer Financial Protection Bureau (the “CFPB”);

•Capping interchange fees that certain banks charge merchants for debit card transactions;

•Imposing more stringent requirements on mortgage lenders; and

•Limiting banks’ proprietary trading activities.

15

Table of Contents

There are many provisions in the Dodd-Frank Act mandating regulators to adopt new regulations and conduct studies upon which future regulation may be based. While some have been issued, many remain to be issued. Governmental intervention and new regulations could materially and adversely affect our business, financial condition and results of operations.

Bank Holding Company Regulation

FirstSun owns 100% of the outstanding capital stock of Sunflower Bank, and, therefore, we are considered to be a bank holding company registered under the federal Bank Holding Company Act of 1956 (the “BHC Act”). As a result, we are primarily subject to the supervision, examination and reporting requirements of the Federal Reserve under the BHC Act and its regulations promulgated thereunder.

Permitted Activities

FirstSun is a bank holding company, and has elected to be a financial holding company, which permits us to engage in expanded financial activities as a bank holding company. Under the BHC Act, a bank holding company is generally permitted to engage in, or acquire direct or indirect control of more than 5% of the voting shares of any company engaged in, the following activities:

•banking or managing or controlling banks;

•furnishing services to or performing services for our subsidiaries; and

•any activity that the Federal Reserve determines to be so closely related to banking as to be a proper incident to the business of banking.

Activities that the Federal Reserve has found to be so closely related to banking as to be a proper incident to the business of banking include, but are not limited to:

•factoring accounts receivable;

•making, acquiring, brokering or servicing loans and usual related activities;

•leasing personal or real property;

•operating a non-bank depository institution, such as a savings association;

•trust company functions;

•financial and investment advisory activities;

•conducting discount securities brokerage activities;

•underwriting and dealing in government obligations and money market instruments;

•providing specified management consulting and counseling activities;

•performing selected data processing services and support services;

•acting as agent or broker in selling credit life insurance and other types of insurance in connection with credit transactions; and

•performing selected insurance underwriting activities.

The Federal Reserve has the authority to order a bank holding company or its subsidiaries to terminate any of these activities or to terminate its ownership or control of any subsidiary when it has reasonable cause to believe that the bank holding company’s continued ownership, activity or control constitutes a serious risk to the financial safety, soundness or stability of it or any of its bank subsidiaries.

Financial Holding Company

A bank holding company that qualifies and elects to be treated as a “financial holding company,” such as FirstSun, may engage in a broader array of activities. In summary, a financial holding company can engage in activities that are financial in nature or incidental or complementary to financial activities, including insurance underwriting, sales and brokerage activities, providing financial and investment advisory services, underwriting services and limited merchant banking activities.

In order to remain a financial holding company, FirstSun must continue to be considered well managed and well capitalized by the Federal Reserve, and the Bank must continue to be considered well managed and well capitalized by the Office of the Comptroller of the Currency (the “OCC”) and have at least a “satisfactory” rating under the Community Reinvestment Act.

16

Table of Contents

Expansion Activities

The BHC Act requires a bank holding company to obtain the prior approval of the Federal Reserve before merging with another bank holding company, acquiring substantially all the assets of any bank or bank holding company, or acquiring directly or indirectly any ownership or control of more than 5% of the voting shares of any bank. In addition, the prior approval of the OCC is required for a national bank to merge with another bank or purchase the assets or assume the deposits of another bank. In determining whether to approve a proposed bank acquisition, federal bank regulators will consider, among other factors, the effect of the acquisition on competition, the public benefits expected to be received from the acquisition, the projected capital ratios and levels on a post-acquisition basis, and the acquiring institution’s record of addressing the credit needs of the communities it serves, including the needs of low and moderate income neighborhoods, consistent with the safe and sound operation of the bank, under the Community Reinvestment Act (discussed below).

In 2024, the OCC issued a revised statement of policy on bank merger transactions that introduced additional requirements for reviewing applications under the Bank Merger Act (the “BMA”) and adding a policy statement on the OCC’s substantive approach to evaluating bank mergers under the BMA. However, in May 2025, the OCC rescinded its 2024 policy statement on its review of applications under the BMA and restored the streamlined application and expedited review procedures for evaluating applications under the BMA. Additionally, the DOJ announced its withdrawal from the 1995 Bank Merger Competitive Review Guidelines, indicating that it would apply its 2023 Merger Guidelines to the banking industry.

Change in Control

Two statutes, the BHC Act and the Change in Bank Control Act, together with regulations promulgated under them, require some form of regulatory review before any company may acquire “control” of a bank or a bank holding company. Under the BHC Act, control is deemed to exist if a company acquires 25% or more of any class of voting securities of a bank holding company; controls the election of a majority of the members of the board of directors; or exercises a controlling influence over the management or policies of a bank or bank holding company. On January 30, 2020, the Federal Reserve issued a final rule (which became effective September 30, 2020) that clarified and codified the Federal Reserve’s standards for determining whether one company has control over another. The final rule established four categories of tiered presumptions of noncontrol that are based on the percentage of voting shares held by the investor (less than 5%, 5-9.9%, 10-14.9% and 15-24.9%) and the presence of other indicia of control. As the percentage of ownership increases, fewer indicia of control are permitted without falling outside of the presumption of noncontrol. These indicia of control include nonvoting equity ownership, director representation, management interlocks, business relationship and restrictive contractual covenants. Under the final rule, investors can hold up to 24.9% of the voting securities and up to 33% of the total equity of a company without necessarily having a controlling influence.

Under the Change in Bank Control Act, a person or company is generally required to file a notice with the Federal Reserve if it will, as a result of the transaction, own or control 10% or more of any class of voting securities or direct the management or policies of a bank or bank holding company and either if the bank or bank holding company has registered securities or if the acquirer would be the largest holder of that class of voting securities after the acquisition. Transactions subject to the BHC Act are exempt from Change in Bank Control Act requirements.

Source of Strength

There are a number of obligations and restrictions imposed by law and regulatory policy on bank holding companies with regard to their depository institution subsidiaries that are designed to minimize potential loss to depositors and to the FDIC insurance funds in the event that the depository institution becomes in danger of defaulting under its obligations to repay deposits. Under a policy of the Federal Reserve and the Dodd-Frank Act, a bank holding company is required to serve as a source of financial strength to its subsidiary depository institutions and to commit resources to support such institutions in circumstances where it might not do so absent such policy. Under the Federal Deposit Insurance Corporation Improvement Act of 1991, to avoid receivership of its insured depository institution subsidiary, a bank holding company is required to guarantee the compliance of any insured depository institution subsidiary that may become “undercapitalized” within the terms of any capital restoration plan filed by such subsidiary with its appropriate federal banking agency up to the lesser of (a) an amount equal to 5% of the institution’s total assets at the time the institution became undercapitalized, or (b) the amount which is necessary (or would have been necessary) to bring the institution into compliance with all applicable capital standards as of the time the institution fails to comply with such capital restoration plan.

The Federal Reserve also has the authority under the BHC Act to require a bank holding company to terminate any activity or relinquish control of a nonbank subsidiary (other than a nonbank subsidiary of a bank) upon the Federal Reserve’s determination that such activity or control constitutes a serious risk to the financial soundness or stability of any subsidiary

17

Table of Contents

depository institution of the bank holding company. Further, federal law grants federal bank regulatory authorities’ additional discretion to require a bank holding company to divest itself of any bank or nonbank subsidiary if the agency determines that divestiture may aid the depository institution’s financial condition.

The Federal Deposit Insurance Act also provides that amounts received from the liquidation or other resolution of any insured depository institution by any receiver must be distributed (after payment of secured claims) to pay the deposit liabilities of the institution prior to payment of any other general or unsecured senior liability, subordinated liability, general creditor or stockholder.

Any capital loans by a bank holding company to any of its subsidiary banks are subordinate in right of payment to deposits and to certain other indebtedness of such subsidiary bank. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to a priority of payment.

Capital Requirements

The Federal Reserve imposes certain capital requirements on bank holding companies under the BHC Act, including a minimum leverage ratio and a minimum ratio of “qualifying” capital to risk-weighted assets. These requirements are essentially the same as those that apply to such holding company’s bank subsidiary and are described below under “Bank Regulation—Capital and Related Requirements.”

Dividend Payments to Stockholders

Our ability to pay dividends to our stockholders may be affected by both general corporate law considerations and policies of the Federal Reserve applicable to bank holding companies. FirstSun is a Delaware corporation and subject to the limitations of the Delaware General Corporation Law, which we refer to as the “DGCL.” The DGCL allows FirstSun to pay dividends only out of its surplus (as defined and computed in accordance with the provisions of the DGCL) or if FirstSun has no such surplus, out of its net profits for the fiscal year in which the dividend is declared and/or the preceding fiscal year.

In addition, as a general matter, the Federal Reserve has indicated that the board of directors of a bank holding company should eliminate, defer or significantly reduce dividends to stockholders if: (a) the company’s net income available to stockholders for the past four quarters, net of dividends previously paid during that period, is not sufficient to fully fund the dividends; (b) the prospective rate of earnings retention is inconsistent with the company’s capital needs and overall current and prospective financial condition; or (c) the company will not meet, or is in danger of not meeting, its minimum regulatory capital adequacy ratios. Under Federal Reserve policy, bank holding companies are expected to inform the Federal Reserve reasonably in advance of declaring or paying a dividend that exceeds earnings for the period (e.g., quarter) for which the dividend is being paid or that could result in a material adverse change to the organization’s capital structure. The Federal Reserve also possesses enforcement powers over bank holding companies and their non-bank subsidiaries to prevent or remedy actions that represent unsafe or unsound practices or violations of applicable statutes and regulations. Among these powers is the ability to proscribe the payment of dividends by banks and bank holding companies. In addition, under the Basel III rules, financial institutions that seek to pay dividends must maintain the 2.5% capital conservation buffer. See “Bank Regulation—Capital and Related Requirements” below.

Stock Buybacks and Other Capital Redemptions

Under Federal Reserve policies and regulations, bank holding companies must seek regulatory approval prior to any redemption that would reduce the bank holding company’s consolidated net worth by 10% or more, prior to the redemption of most instruments included in Tier 1 or Tier 2 capital with features permitting redemption at the option of the issuing bank holding company, or prior to the redemption of equity or other capital instruments included in Tier 1 or Tier 2 capital prior to stated maturity, if such redemption could have a material effect on the level or composition of the organization’s capital base. Bank holding companies are also expected to both inform the Federal Reserve reasonably in advance of a redemption or repurchase of common stock if such buyback results in a net reduction of the company’s outstanding amount of common stock below the amount outstanding at the beginning of the fiscal quarter, and to consult with the Federal Reserve generally prior to engaging in stock buybacks.

Bank Regulation

Sunflower Bank is a national banking association with its main office in Dallas, Texas, which is subject to regulation and supervision primarily by the OCC and secondarily by the Federal Reserve and the FDIC. We are subject to requirements

18

Table of Contents

and restrictions under federal law, including requirements to maintain reserves against deposits, restrictions on the types and amounts of loans that may be granted and the interest that may be charged thereon and limitations on the types of investments that may be made and the types of services that may be offered. Various consumer laws and regulations also affect the operations of Sunflower Bank. The OCC regularly examines Sunflower Bank’s operations and has the authority to approve or disapprove mergers, the establishment of branches and similar corporate actions. The OCC also has the power to prevent the continuance or development of unsafe or unsound banking practices or other violations of law. Sunflower Bank is also subject to numerous state and federal statutes and regulations that affect its business, activities, and operations.

Branching

National banks are required by the National Bank Act to adhere to branching laws applicable to state banks in the states in which they are located. Under Texas law, the Riegle-Neal Act and the Dodd-Frank Act, and with the prior approval of the OCC, Sunflower Bank may open branch offices within or outside of Texas, where our Bank headquarters was relocated to in 2023, provided that a state bank chartered by the state in which the branch is to be located would also be permitted to establish a branch in Texas. In addition, with prior regulatory approval, Sunflower Bank may acquire branches of existing banks located in Texas or other states.

Capital and Related Requirements

We are subject to comprehensive capital adequacy requirements intended to protect against losses that we may incur. Regulatory capital rules, which we refer to as Basel III, impose minimum capital requirements for bank holding companies and banks. The Basel III rules apply to all state and national banks and savings and loan associations regardless of size and bank holding companies and savings and loan holding companies other than “small bank holding companies,” generally holding companies with consolidated assets of less than $3 billion. More stringent requirements are imposed on “advanced approaches” banking organizations—those organizations with $250 billion or more in total consolidated assets, $10 billion or more in total foreign exposures, or that have opted into the Basel II capital regime.

The rules include certain higher risk-based capital and leverage requirements than those previously in place. Specifically, we are required to maintain the following minimum capital requirements:

•a common equity Tier 1 (“CET1”) risk-based capital ratio of 4.5%;

•a Tier 1 risk-based capital ratio of 6%;

•a total risk-based capital ratio of 8%; and

•a leverage ratio of 4%.

Under Basel III, Tier 1 capital includes two components: CET1 capital and additional Tier 1 capital. The highest form of capital, CET1 capital, consists solely of common stock (plus related surplus), retained earnings, accumulated other comprehensive income, otherwise referred to as AOCI, and limited amounts of minority interests that are in the form of common stock. Additional Tier 1 capital is primarily comprised of noncumulative perpetual preferred stock, Tier 1 minority interests and grandfathered trust preferred securities. Tier 2 capital generally includes the allowance for credit losses up to 1.25% of risk-weighted assets, qualifying preferred stock, subordinated debt and qualifying tier 2 minority interests, less any deductions in Tier 2 instruments of an unconsolidated financial institution. AOCI is presumptively included in CET1 capital and often would operate to reduce this category of capital. When implemented, Basel III provided a one-time opportunity for covered banking organizations to opt out of much of this treatment of AOCI. We made this opt-out election.

In addition, in order to avoid restrictions on capital distributions or discretionary bonus payments to executives, under Basel III, a banking organization must maintain a “capital conservation buffer” on top of its minimum risk-based capital requirements. This buffer must consist solely of Tier 1 Common Equity, but the buffer applies to all three risk-based measurements (CET1, Tier 1 capital and total capital). The following effective minimum capital plus capital conservation buffer ratios are applicable: (a) a CET1 capital ratio of 7.0%, (b) a Tier 1 risk-based capital ratio of 8.5%, and (c) a total risk-based capital ratio of 10.5%.

The capital rules require that goodwill and other intangible assets (other than mortgage servicing assets), net of associated deferred tax liabilities (“DTLs”), be deducted from CET1 capital. Additionally, deferred tax assets (“DTAs”) that arise from net operating loss and tax credit carryforwards, net of associated DTLs and valuation allowances, are fully deducted from CET1 capital. However, DTAs arising from temporary differences that could not be realized through net operating loss carrybacks, along with mortgage servicing assets and “significant” (defined as greater than 10% of the issued and

19

Table of Contents

outstanding common stock of the unconsolidated financial institution) investments in the common stock of unconsolidated “financial institutions” are partially includible in CET1 capital, subject to deductions defined in the rules.

The OCC also considers interest rate risk (arising when the interest rate sensitivity of Sunflower Bank’s assets does not match the sensitivity of its liabilities or its off-balance sheet position) in the evaluation of the bank’s capital adequacy. Banks with excessive interest rate risk exposure are required to hold additional amounts of capital against their exposure to losses resulting from that risk. Through the risk-weighting of assets, the regulators also require banks to incorporate market risk components into their risk-based capital. Under these market risk requirements, capital is allocated to support the amount of market risk related to a bank’s lending and trading activities.

Sunflower Bank’s capital categories are determined solely for the purpose of applying the “prompt corrective action” rules described below and they are not necessarily an accurate representation of its overall financial condition or prospects for other purposes. Failure to meet capital guidelines could subject a bank or bank holding company to a variety of enforcement remedies, including issuance of a capital directive, the termination of deposit insurance by the FDIC, a prohibition on accepting brokered deposits, and certain other restrictions on its business. See “Prompt Corrective Action” below.

Banks and holding companies that have less than $10 billion in total consolidated assets and meet other qualifying criteria, including a leverage ratio of greater than 9%, off-balance-sheet exposures of 25% or less of total consolidated assets and trading assets plus trading liabilities of 5% or less of total consolidated assets, are deemed “qualifying community banking organizations” are eligible to opt into the “community bank leverage ratio framework.” A qualifying community banking organization that elects to use the community bank leverage ratio framework and that maintains a leverage ratio of greater than 9% is considered to have satisfied the generally applicable risk-based and leverage capital requirements under the Basel III rules and, if applicable, is considered to have met the “well capitalized” ratio requirements for purposes of its primary federal regulator’s prompt corrective action rules, discussed below. In November 2025, federal banking regulators proposed changes to increase flexibility under the community bank leverage ratio framework, including lowering the leverage ratio threshold from 9% to 8%. Public comments on the proposal were open through January 30, 2026; the ultimate scope and timing of any final rule is uncertain. We have not elected to use the community bank leverage ratio framework.

In July 2023, the banking agencies released proposed rules, referred to as the “Basel III Endgame,” to implement major changes to the capital rules for banking organizations with $100 billion or more in assets intended to bring the U.S. capital rules into conformance with the current international capital standards issued by the Basel Committee on Banking Supervision. It is expected that the proposal, if enacted, would significantly increase capital requirements for banking organizations with $100 billion or more in assets, which could indirectly impact smaller institutions, such as FirstSun and the Bank, if larger banking organizations make changes in response to the increased capital requirements. The timeline for finalization of these rules has been delayed and implementation remains uncertain.

Prompt Corrective Action

As an insured depository institution, we are required to comply with the capital requirements promulgated under the Federal Deposit Insurance Corporation Improvement Act of 1991 (“FDICIA”). The FDICIA requires each federal banking agency to take prompt corrective action (“PCA”) to resolve the problems of insured depository institutions, including those that fall below one or more prescribed minimum capital ratios. The law requires each federal banking agency to promulgate regulations defining the following five categories in which an insured depository institution will be placed, based on the level of capital ratios: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” or “critically undercapitalized.” As of December 31, 2025, we maintained capital ratios that exceeded the minimum ratios established for a “well capitalized” institution.

The following is a list of the criteria for each PCA capital category:

Well Capitalized—The institution exceeds the required minimum level for each relevant capital measure. A well-capitalized institution:

•has total risk-based capital ratio of 10% or greater; and

•has a Tier 1 risk-based capital ratio of 8% or greater; and

•has a common equity Tier 1 risk-based capital ratio of 6.5% or greater; and

•has a leverage capital ratio of 5% or greater; and

•is not subject to any order or written directive to meet and maintain a specific capital level for any capital measure.

20

Table of Contents

Adequately Capitalized—The institution meets the required minimum level for each relevant capital measure. The institution may not make a capital distribution if it would result in the institution becoming undercapitalized. An adequately capitalized institution:

•has a total risk-based capital ratio of 8% or greater; and

•has a Tier 1 risk-based capital ratio of 6% or greater; and

•has a common equity Tier 1 risk-based capital ratio of 4.5% or greater; and

•has a leverage capital ratio of 4% or greater.

Undercapitalized—The institution fails to meet the required minimum level for any relevant capital measure. An undercapitalized institution:

•has a total risk-based capital ratio of less than 8%; or

•has a Tier 1 risk-based capital ratio of less than 6%; or

•has a common equity Tier 1 risk-based capital ratio of less than 4.5%; or

•has a leverage capital ratio of less than 4%.

Significantly Undercapitalized—The institution is significantly below the required minimum level for any relevant capital measure. A significantly undercapitalized institution:

•has a total risk-based capital ratio of less than 6%; or

•has a Tier 1 risk-based capital ratio of less than 4%; or

•has a common equity Tier 1 risk-based capital ratio of less than 3%; or

•has a leverage capital ratio of less than 3%.

Critically Undercapitalized—The institution fails to meet a critical capital level set by the appropriate federal banking agency. A critically undercapitalized institution has a ratio of tangible equity to total assets that is equal to or less than 2%.

Depending upon the capital category to which an institution is assigned, the primary federal regulators’ corrective powers include: (a) requiring the institution to submit a capital restoration plan; (b) limiting the institution’s asset growth and restricting its activities; (c) requiring the institution to issue additional capital stock (including additional voting stock) or to sell itself; (d) restricting transactions between the institution and its affiliates; (e) restricting the interest rate that the institution may pay on deposits; (f) ordering a new election of directors of the institution; (g) requiring that senior executive officers or directors be dismissed; (h) prohibiting the institution from accepting deposits from correspondent banks; (i) requiring the institution to divest certain subsidiaries; (j) prohibiting the payment of principal or interest on subordinated debt; and (k) ultimately, appointing a receiver for the institution.

Dividend Payments to FirstSun

The primary source of funds for FirstSun is dividends from Sunflower Bank. Under the National Bank Act, a national bank may pay dividends out of its undivided profits in such amounts and at such times as the bank’s board of directors deems prudent. Without prior OCC approval, however, a national bank may not pay dividends in any calendar year that, in the aggregate, exceed the bank’s year-to-date net income plus the bank’s retained net income for the two preceding years. The payment of dividends by any FDIC-insured institution is affected by the requirement to maintain adequate capital pursuant to applicable capital adequacy guidelines and regulations, and an FDIC-insured institution generally is prohibited from paying any dividends if, following payment thereof, the institution would be undercapitalized. As described above, the Bank exceeded its capital requirements under applicable guidelines as of December 31, 2025. Notwithstanding the availability of funds for dividends, the OCC may prohibit the payment of dividends by the Bank if it determines such payment would constitute an unsafe or unsound practice. In addition, under the Basel III Rule, institutions that seek the freedom to pay dividends will have to maintain the 2.5% capital conservation buffer. See “Capital and Related Requirements” above.

Community Reinvestment Act and Fair Lending Requirements

Sunflower Bank is subject to certain fair lending requirements and reporting obligations involving its home mortgage lending operations. Each bank is also subject to certain requirements and reporting obligations under the Community Reinvestment Act, or “CRA.” The CRA generally requires federal banking agencies to evaluate the record of a financial institution in meeting the credit needs of its local communities, including low- and moderate-income neighborhoods. The CRA further requires the agencies to take into account a bank’s record of meeting community credit needs when evaluating applications for, among other things, new branches or mergers. Sunflower Bank received a “Satisfactory” CRA

21

Table of Contents

Assessment Rating from the OCC in its most recent examination. In addition to substantive penalties and corrective measures that may be required for a violation of certain fair lending laws, the federal banking agencies may take compliance with such laws and CRA into account when regulating and supervising other activities of the bank, including in acting on expansionary proposals.

On October 24, 2023, the federal banking agencies issued a final rule to amend the regulations implementing the CRA. The rule significantly expanded the number of areas in which a bank is evaluated, materially changing the tests used to evaluate a bank in those areas and expands the data a bank must collect and report. The final rule was expected to take effect April 1, 2024, with the majority of its operative provisions to become effective January 1, 2026. However, in March 2024, a federal judge granted an injunction to extend the CRA final rule’s effective date, and in July 2025, the federal banking agencies issued a proposal, which, if finalized, will rescind the October 2023 final rule and revert to the CRA framework that existed prior to the October 2023 final rule. Implementation of the October 2023 final rule, which was subject to an injunction and has not taken effect, would have materially changed the CRA framework, including imposing additional costs and changing how CRA performance would be assessed.

Fair Lending Requirements

We are subject to certain fair lending requirements and reporting obligations involving lending operations. A number of laws and regulations provide these fair lending requirements and reporting obligations, including, at the federal level, the Equal Credit Opportunity Act, or the “ECOA,” as amended by the Dodd-Frank Act, and Regulation B, as well as the Fair Housing Act, or the “FHA,” and regulations implementing the FHA. ECOA and Regulation B prohibit discrimination in any aspect of a credit transaction based on a number of prohibited factors, including race or color, religion, national origin, sex, marital status, age, the applicant’s receipt of income derived from public assistance programs, and the applicant’s exercise, in good faith, of any right under the Consumer Credit Protection Act. ECOA and Regulation B include lending acts and practices that are specifically prohibited, permitted, or required, and these laws and regulations proscribe data collection requirements, legal action statute of limitations, and disclosure of the consumer’s ability to receive a copy of any appraisal(s) and valuation(s) prepared in connection with certain loans secured by dwellings. FHA prohibits discrimination in all aspects of residential real-estate related transactions based on prohibited factors, including race or color, national origin, religion, sex, familial status, and handicap. In April 2025, President Trump issued Executive Order 14281 directing federal agencies to eliminate the use of disparate impact liability in their enforcement and supervisory activities. Following the Executive Order, the OCC removed references to “disparate impact” from its fair lending guidance. However, federal fair lending statutes and existing judicial precedent have historically recognized both disparate treatment and disparate impact theories of liability, and the ultimate impact of the Executive Order on supervisory and enforcement practices remains uncertain.

In addition to prohibiting discrimination in credit transactions on the basis of prohibited factors, these laws and regulations can cause a lender to be liable for policies that result in a disparate treatment of or have a disparate impact on a protected class of persons. If a pattern or practice of lending discrimination is alleged by a regulator, then the matter may be referred by the agency to the DOJ, for investigation. In December 2012, the DOJ and CFPB entered into a Memorandum of Understanding under which the agencies have agreed to share information, coordinate investigations, and have generally committed to strengthen their coordination efforts. In addition to substantive penalties and corrective measures that may be required for a violation of certain fair lending laws, the federal banking agencies may take compliance with fair lending requirements into account when regulating and supervising other activities of the bank, including in acting on expansionary proposals.

Consumer Protection Regulations

The activities of the Bank are subject to a variety of statutes and regulations designed to protect consumers. Bank regulatory agencies have increasingly used a general consumer protection statute to address “unethical” or otherwise “bad” business practices that may not necessarily fall directly under the purview of a specific banking or consumer finance law. The law of choice for enforcement against such business practices has been Section 5 of the Federal Trade Commission Act—the primary federal law that prohibits “unfair or deceptive acts or practices” and unfair methods of competition in or affecting commerce (“UDAP” or “FTC Act”). “Unjustified consumer injury” is the principal focus of the FTC Act. Prior to the Dodd-Frank Act, there was little formal guidance to provide insight to the parameters for compliance with the UDAP law. However, the UDAP provisions have been expanded under the Dodd-Frank Act to apply to “unfair, deceptive or abusive acts or practices” (“UDAAP”). The CFPB has brought a variety of enforcement actions for violations of UDAAP provisions and CFPB guidance continues to evolve.

22

Table of Contents

Interest and other charges collected or contracted for by the Bank are subject to state usury laws and federal laws concerning interest rates. The loan operations of the Bank are also subject to federal laws applicable to credit transactions, such as:

•the Truth-In-Lending Act, or “TILA,” and Regulation Z, governing disclosures of credit and servicing terms to consumer borrowers and including substantial requirements for mortgage lending and servicing, as mandated by the Dodd-Frank Act;

•the Home Mortgage Disclosure Act and Regulation C, requiring financial institutions to provide information to enable the public and public officials to determine whether a financial institution is fulfilling its obligation to help meet the housing needs of the communities they serve;

•ECOA and Regulation B, prohibiting discrimination on the basis of race, color, religion, or other prohibited factors in any aspect of a credit transaction;

•the Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactions Act and Regulation V, as well as the rules and regulations of the FDIC governing the use of consumer reports, provision of information to credit reporting agencies, certain identity theft protections and certain credit and other disclosures;

•the Fair Debt Collection Practices Act and Regulation F, governing the manner in which consumer debts may be collected by collection agencies and intending to eliminate abusive, deceptive, and unfair debt collection practices;

•the Real Estate Settlement Procedures Act, or “RESPA,” and Regulation X, which governs various aspects of residential mortgage loans, including the settlement and servicing process, dictates certain disclosures to be provided to consumers, and imposes other requirements related to compensation of service providers, insurance escrow accounts, and loss mitigation procedures;

•The Secure and Fair Enforcement for Mortgage Licensing Act, the “SAFE Act,” which mandates a nationwide licensing and registration system for residential mortgage loan originators. The SAFE Act also prohibits individuals from engaging in the business of a residential mortgage loan originator without first obtaining and maintaining annual registration as either a federal or state licensed mortgage loan originator;

•The Homeowners Protection Act, or the PMI Cancellation Act, provides requirements relating to private mortgage insurance on residential mortgages, including the cancellation and termination of PMI, disclosure and notification requirements, and the requirement to return unearned premiums;

•The Fair Housing Act prohibits discrimination in all aspects of residential real-estate related transactions based on race or color, national origin, religion, sex, and other prohibited factors;

•The Servicemembers Civil Relief Act and Military Lending Act, providing certain protections for servicemembers, members of the military, and their respective spouses, dependents and others; and

•Section 106(c)(5) of the Housing and Urban Development Act requires making home ownership available to eligible homeowners.

The deposit operations of the Bank are also subject to federal laws, such as:

•the Federal Deposit Insurance Act which, among other things, limits the amount of deposit insurance available per insured depositor category to $250,000 and imposes other limits on deposit-taking;

•the Right to Financial Privacy Act, which imposes a duty to maintain the confidentiality of consumer financial records and prescribes procedures for complying with administrative subpoenas of financial records;

•the Electronic Funds Transfer Act and Regulation E, which governs the rights, liabilities, and responsibilities of consumers and financial institutions using electronic fund transfer services, and which generally mandates disclosure requirements, establishes limitations on liability applicable to consumers for unauthorized electronic fund transfers, dictates certain error resolution processes, and applies other requirements relating to automatic deposits to and withdrawals from deposit accounts;

•The Expedited Funds Availability Act and Regulation CC, setting forth requirements to make funds deposited into transaction accounts available according to specified time schedules, disclose funds availability policies to customers, and relating to the collection and return of checks and electronic checks, including the rules regarding the creation or receipt of substitute checks; and

•the Truth in Savings Act and Regulation DD, which requires depository institutions to provide disclosures so that consumers can make meaningful comparisons about depository institutions and accounts.

The CFPB is an independent regulatory authority housed within the Federal Reserve. The CFPB has broad authority to regulate the offering and provision of consumer financial products and services. The CFPB has the authority to supervise and examine depository institutions with more than $10 billion in assets for compliance with federal consumer laws. The authority to supervise and examine depository institutions with $10 billion or less in assets, such as us, for compliance with federal consumer laws remains largely with those institutions’ primary regulators. However, the CFPB may participate in examinations of these smaller institutions on a “sampling basis” and may refer potential enforcement actions against such

23

Table of Contents

institutions to their primary regulators. As such, the CFPB may participate in examinations of the Bank. In addition, states are permitted to adopt consumer protection laws and regulations that are stricter than the regulations promulgated by the CFPB, and state attorneys general are permitted to enforce consumer protection rules adopted by the CFPB against certain institutions.

The CFPB has issued a number of significant rules that impact nearly every aspect of the lifecycle of consumer financial products and services, including rules regarding residential mortgage loans. These rules implement Dodd-Frank Act amendments to ECOA, TILA and RESPA. Among other things, the rules adopted by the CFPB require banks to: (i) develop and implement procedures to ensure compliance with a “reasonable ability-to-repay” test; (ii) implement new or revised disclosures, policies and procedures for originating and servicing mortgages, including, but not limited to, pre-loan counseling, early intervention with delinquent borrowers and specific loss mitigation procedures for loans secured by a borrower’s principal residence, and mortgage origination disclosures, which integrate existing requirements under TILA and RESPA; (iii) comply with additional restrictions on mortgage loan originator hiring and compensation; and (iv) comply with new disclosure requirements and standards for appraisals and certain financial products. The CFPB may issue regulations that impact products and services offered by Sunflower Bank. The CFPB has engaged in rulemakings that affect, among other things, credit card late fees, overdraft fees, data collection and reporting requirements for small business lenders such as Sunflower Bank, and personal financial data rights, including a final rule announced on December 12, 2024, that would, among other requirements, limit the overdraft fees that banks with greater than $10 billion in assets could charge.

Bank regulators take into account compliance with consumer protection laws when considering approval of any proposed expansionary proposals, including merger proposals.

In 2025, the Trump administration initiated a major reduction in force (“RIF”) at the CFPB, which represented nearly 90% of the agency’s total workforce. However, the RIF is the subject of litigation, and the staffing cuts are currently stayed pending the U.S. Court of Appeals for the D.C. Circuit reviewing the case en banc. The impact of these developments on banking organizations subject to CFPB regulation and supervision is still uncertain. States and state attorneys general may increase regulatory, investigative and enforcement activity with respect to consumer protection, in response to changes in regulation, supervision and enforcement of consumer protection laws by federal regulators.

Anti-Money Laundering and the USA Patriot Act

Financial institutions must maintain anti-money laundering programs that include established internal policies, procedures, and controls; a designated compliance officer; an ongoing employee training program; and testing of the program by an independent audit function. The program must comply with the anti-money laundering provisions of the Bank Secrecy Act, or the “BSA.” FirstSun and the Bank are also prohibited from entering into specified financial transactions and account relationships and must meet enhanced standards for due diligence and “knowing your customer” in their dealings with foreign financial institutions, foreign customers, and other high-risk customers. Financial institutions must take reasonable steps to conduct enhanced scrutiny of account relationships to guard against money laundering and to report any suspicious transactions, and certain laws provide law enforcement authorities with increased access to financial information maintained by banks. Financial institutions must comply with requirements regarding risk-based procedures for conducting ongoing customer due diligence, which requires the institutions to take appropriate steps to understand the nature and purpose of customer relationships and identify and verify the identity of the beneficial owners of legal entity customers.

Anti-money laundering obligations have been substantially strengthened as a result of the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act, which we refer to as the “USA PATRIOT Act.” Bank regulators routinely examine institutions for compliance with these obligations and are required to consider compliance in connection with the regulatory review of applications. The regulatory authorities have been active in imposing cease and desist orders and money penalty sanctions against institutions that have not complied with these requirements.

The USA PATRIOT Act amended the Bank Secrecy Act and provides, in part, for the facilitation of information sharing among governmental entities and financial institutions for the purpose of combating terrorism and money laundering by enhancing anti-money laundering and financial transparency laws, as well as enhanced information collection tools and enforcement mechanics for the U.S. government, including: (a) requiring standards for verifying customer identification at account opening; (b) rules to promote cooperation among financial institutions, regulators, and law enforcement entities in identifying parties that may be involved in terrorism or money laundering; (c) reports by nonfinancial trades and businesses filed with the U.S. Treasury Department’s Financial Crimes Enforcement Network for transactions exceeding $10,000; (d) filing suspicious activities reports if a bank believes a customer may be violating U.S. laws and regulations; and (e)

24

Table of Contents

requires enhanced due diligence requirements for financial institutions that administer, maintain, or manage private bank accounts or correspondent accounts for non-U.S. persons. Bank regulators routinely examine institutions for compliance with these obligations and are required to consider compliance in connection with the regulatory review of applications.

On January 1, 2021, Congress enacted the National Defense Authorization Act for Fiscal Year 2022, or “NDAA.” Among other things, the NDAA included the Anti-Money Laundering Act of 2020, which provides for one of the most significant overhauls of the BSA and related anti-money laundering laws since the USA Patriot Act. Notably, changes include:

•expansion of coordination and information sharing efforts among the agencies tasked with administering anti-money laundering and countering the financing of terrorism requirements, including the Financial Crimes Enforcement Network, or “FinCEN,” the primary federal banking regulators, federal law enforcement agencies, national security agencies, the intelligence community, and financial institutions;

•providing additional penalties with respect to violations of BSA and enhancing the powers of FinCEN;

•significant updates to the beneficial ownership collection rules and the creation of a registry of beneficial ownership which will track the beneficial owners of reporting companies which may be shared with law enforcement and financial institutions conducting due diligence under certain circumstances;

•improvements to existing information sharing provisions that permit financial institutions to share information relating to SARs with foreign branches, subsidiaries, and affiliates (except those located in China, Russia, or certain other jurisdictions) for the purpose of combating illicit finance risks; and

•enhanced whistleblower protection provisions, allowing whistleblower(s) who provide original information which leads to successful enforcement of anti-money laundering laws in certain judicial or administrative actions resulting in certain monetary sanctions to receive up to 30% of the amount that is collected in monetary sanctions as well as increased protections.

Under the USA PATRIOT Act, FinCEN may provide federal banking agencies with lists of individuals suspected of involvement in terrorist activities. The Bank may be required to search its records for relationships or transactions involving individuals on such lists and, if identified, must file a suspicious activity report and notify FinCEN in accordance with applicable regulations.

Anti-money laundering legislation also led to the enactment of the Corporate Transparency Act (“CTA”), which requires certain entities to report beneficial ownership information to FinCEN. The CTA has been subject to legal challenges that created uncertainty regarding its implementation and enforcement. In February 2025, a federal court lifted a prior nationwide injunction that had temporarily blocked enforcement of the CTA, and in March 2025, FinCEN announced that it was eliminating beneficial ownership reporting requirements for domestic reporting companies. FinCEN has indicated that it continues to evaluate potential modifications to the CTA’s implementation in light of regulatory burden and public interest considerations.

The National Defense Authorization Act for Fiscal Year 2025, enacted December 2024, further reflects continued congressional focus on BSA/AML and national security priorities, including coordination among government agencies in monitoring and addressing illicit finance risks.

The Office of Foreign Assets Control

The Office of Foreign Assets Control, or “OFAC,” an office within the U.S. Department of the Treasury, is responsible for administering and enforcing U.S. economic and trade sanctions programs based on U.S. foreign policy and national security objectives. These sanctions, which are implemented through Executive Orders and Acts of Congress, generally prohibit or restrict U.S. persons, including banks, from engaging in transactions with sanctioned individuals, entities, or countries. OFAC publishes lists of designated persons and organizations subject to sanctions, including those suspected of aiding, harboring or engaging in terrorist acts; owned or controlled by, or acting on behalf of sanctioned jurisdictions, and narcotics traffickers. If a bank identifies a prohibited party or transaction involving a person or entity on an OFAC list, it must block or reject the transaction and comply with applicable reporting requirements.

Following Russia’s invasion of Ukraine in February 2022, President Biden expanded sanctions authorities under Executive Order 14024, pursuant to which OFAC imposed extensive sanctions targeting Russian financial institutions, sovereign debt transactions, and related parties, while increasing focus on sanctions evasion. In March 2022, FinCEN issued an alert advising financial institutions to exercise heightened vigilance for potential sanctions evasion and suspicious activity.

Globally, the Financial Action Task Force (“FATF”) periodically updates its lists of jurisdictions subject to increased monitoring, which may affect due diligence requirements for international transactions. BSA/AML compliance and

25

Table of Contents

sanctions oversight remain significant areas of supervisory and enforcement focus for federal banking regulators and FinCEN and require ongoing attention by financial institutions.

Financial Privacy and Cybersecurity

Under privacy protection provisions of the Gramm-Leach-Bliley Act of 1999, and related regulations, we are limited in our ability to disclose non-public information about consumers to nonaffiliated third parties. These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a nonaffiliated third-party. Federal banking agencies, including the OCC, have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of the board of directors. These guidelines, along with related regulatory materials, increasingly focus on cybersecurity resilience, incident response preparedness and oversight of third-party relationships used in the provision of financial services.

Consumers must be notified in the event of a data breach under applicable federal and state laws. Under federal regulations, banking organizations are required to notify their primary federal regulator as soon as possible and no later than 36 hours after the discovery of a “computer-security incident” that rises to the level of a “notification incident” within the meaning attributed to those terms by the federal regulation. Banks’ service providers are required under the federal regulation to notify any affected bank to or on behalf of which the service provider provides services “as soon as possible” after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank for as much as four hours.

The CFPB issued a final rule in October 2024 implementing Section 1033 of the Consumer Financial Protection Act, requiring covered institutions to provide consumers with access to certain financial data upon request. Although the rule became effective in January 2025, a federal court issued a nationwide injunction in October 2025 blocking enforcement, and the CFPB subsequently initiated a reconsideration process addressing, among other matters, the scope of authorized representatives, potential fees, and data security considerations, and the ultimate scope and timing of any revised rule remain uncertain.

See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity and Item 1C. Cybersecurity for a further discussion of risk management strategies and governance processes related to cybersecurity.

Deposit Premiums and Assessments

Sunflower Bank’s deposits are insured by the Deposit Insurance Fund (“DIF”) of the FDIC up to $250,000, the maximum amount permitted by law. The FDIC uses the DIF to protect against the loss of insured deposits if an FDIC-insured bank or savings association fails. As an FDIC-insured bank, we must pay deposit insurance assessments to the FDIC based on our average total assets minus our average tangible equity.

As an institution with less than $10 billion in assets, our assessment rates are based on the level of risk we pose to the FDIC’s DIF. For established smaller institutions, such as us, the total base assessment rate is calculated by using supervisory ratings as well as (a) an initial base assessment rate (ranging between five and 32 basis points), (b) an unsecured debt adjustment (which can be positive or negative), and (c) a brokered deposit adjustment.

Upon consummation of our proposed merger with First Foundation, our assets will exceed $10 billion. For banks with over $10 billion in assets, the FDIC uses a performance score and loss-severity score to calculate the bank’s initial FDIC assessment rate. In calculating these scores, the FDIC uses the bank’s capital level and regulatory supervisory ratings and certain financial measures to assess the bank’s ability to withstand asset-related and funding related stress, and make certain adjustments based on risk factors that are not adequately captured in these calculations.

In addition to the ordinary assessments described above, the FDIC has the ability to impose special assessments in certain instances. For example, in November 2023, following the closures of Silicon Valley Bank and Signature Bank and in connection with its systemic risk determination announced on March 12, 2023, the FDIC announced a special deposit insurance assessment rate of 13.4 basis points beginning in the first quarterly assessment period of 2024, adjusted to exclude the first $5 billion in deposits for an anticipated total of eight quarterly assessment periods.

The FDIC may terminate the deposit insurance of any insured depository institution if it determines after a notice and hearing that the institution has engaged in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC.

26

Table of Contents

CRE Guidance

In December 2015, the federal banking regulators released a statement entitled “Interagency Statement on Prudent Risk Management for Commercial Real Estate Lending,” or the “CRE Guidance.” In the CRE Guidance, the federal banking regulators (a) expressed concerns with institutions that ease CRE underwriting standards, (b) directed financial institutions to maintain underwriting discipline and exercise risk management practices to identify, measure and monitor lending risks, and (c) indicated that they will continue to pay special attention to CRE lending activities and concentrations. The federal banking regulators previously issued guidance in December 2006, entitled “Interagency Guidance on Concentrations in CRE Lending, Sound Risk Management Practices,” which stated that an institution that is potentially exposed to significant CRE concentration risk should employ enhanced risk management practices. Specifically, the guidance states that such institutions that are potentially exposed to significant CRE concentration risk and may warrant greater supervisory scrutiny are those institutions which have (i) total CRE loans representing 300% or more of the institution’s total capital and (ii) the outstanding balance of such institution’s CRE loan portfolio has increased by 50% or more during the prior 36 months. Since 2023, the OCC, FDIC and Federal Reserve have issued multiple reminders and risk bulletins emphasizing prudent CRE risk management due to rising interest rates, declining office valuations and stress in certain property sectors.

Effect of Governmental Monetary Policies

Our earnings are affected by domestic economic conditions and the monetary policies of the U.S. and its agencies. The Federal Open Market Committee’s monetary policies have had, and are likely to continue to have, an important effect on the operating results of banks through its power to implement national monetary policy in order, among other things, to curb inflation or combat a recession. The monetary policies of the Federal Reserve have major effects on the levels of bank loans, investments and deposits through its open market operations in U.S. government securities and through its regulation of the discount rate on borrowings of member banks and the reserve requirements against member bank deposits. We cannot predict the nature or effect of future changes in such monetary policies.

Fair Access to Financial Services

In recent years, certain states have enacted, or have proposed to enact, statutes, regulations or policies that prohibit financial institutions from denying or canceling products or services to a person or business, or otherwise discriminating against a person or business in making available products or services, on the basis of certain social or political factors or other activities. In August 2025, President Trump signed Executive Order 14331, “Guaranteeing Fair Banking Access for All Americans,” which states that it is the policy of the United States that no American should be denied access to financial services because of their constitutionally or statutorily protected beliefs, affiliations, or political views. The Executive Order directs the Treasury Secretary and federal banking regulators to address politicized or unlawful debanking activities.

Future Legislation and Regulation

Congress may enact legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied or interpreted. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of the proposed legislation has in the past and may in the future affect the regulatory structure under which we operate and may significantly increase our costs, impede the efficiency of our internal business processes, require us to increase our regulatory capital or modify our business strategy, or limit our ability to pursue business opportunities in an efficient manner. Our business, financial condition, results of operations or prospects may be adversely affected, perhaps materially, as a result.

Available Information

We file reports with the Securities and Exchange Commission (the “SEC”) including annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and proxy statements, as well as any amendments to those reports and statements. The SEC maintains an internet site that contains reports, proxy and information statements and other information regarding issuers that file electronically with the SEC at http://www.sec.gov. Our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, proxy statements and amendments to those reports and statements filed or furnished pursuant to section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”) are also accessible at no cost on our internet website at http://ir.firstsuncb.com after they are electronically filed with the SEC. No information contained on our website is intended to be included as part of, or incorporated by reference into, this Annual Report on Form 10-K.