GLACIER BANCORP, INC. (GBCI) Business

Item 1. Business

General

Glacier Bancorp, Inc., headquartered in Kalispell, Montana, is a Montana corporation incorporated in 2004 as a successor corporation to the Delaware corporation originally incorporated in 1990. The terms “Company,” “we,” “us” and “our” mean Glacier Bancorp, Inc. and its subsidiaries, when appropriate. The Company is a publicly-traded company and its common stock trades on the New York Stock Exchange (“NYSE”) under the symbol: GBCI. We provide a full range of banking services to individuals and businesses from 281 locations in Montana, Idaho, Utah, Washington, Wyoming, Colorado, Arizona, Nevada, and Texas through our wholly-owned bank subsidiary, Glacier Bank (the “Bank”). We offer a wide range of banking products and services, including: 1) retail banking; 2) business banking; 3) real estate, commercial, agriculture and consumer loans; and 4) mortgage origination and loan servicing. We serve individuals, small to medium-sized businesses, community organizations and public entities. For information regarding our lending, investment and funding activities, see “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations.”

The Company includes the parent holding company and the Bank. As of December 31, 2025, the Bank consists of eighteen bank divisions and a corporate division. The bank divisions operate under separate names, management teams and advisory directors and consist of the following:

The corporate division includes the Bank’s investment portfolio and wholesale borrowings, and other centralized functions. We consider the Bank to be our sole operating segment.

The Bank has subsidiary interests in variable interest entities (“VIE”) for which the Bank has both the power to direct the VIE’s significant activities and the obligation to absorb losses or right to receive benefits of the VIE that could potentially be significant to the VIE. These subsidiary interests are included in the Company’s consolidated financial statements. The Bank also has subsidiary interests in VIEs for which the Bank does not have a controlling financial interest and is not the primary beneficiary. These subsidiary interests are not included in the Company’s consolidated financial statements.

The Bank also has non-bank subsidiaries which hold certain bank investments. These non-bank subsidiaries are either consolidated or accounted for under the equity method depending on whether the Bank has a controlling interest or significant influence over the entity.

The parent holding company owns non-bank subsidiaries that have issued trust preferred securities which qualify as Tier 2 regulatory capital instruments. The trust subsidiaries are not included in our consolidated financial statements. Our investments and

4

subordinated debentures to the consolidated trust subsidiaries are included in other assets and subordinated debentures, respectively, on our statements of financial condition.

As of December 31, 2025, the Company and its subsidiaries were not engaged in any operations in foreign countries.

Recent Acquisitions

Our strategy is to profitably grow our business through internal growth and selective acquisitions. We continue to look for expansion opportunities primarily in existing and new markets in the Mountain West region and Southwest region. We have completed the following acquisitions during the last five fiscal years:

For additional information on recently completed acquisition and subsequent event, see Note 23 to the Consolidated Financial Statements in “Item 8. Financial Statements and Supplementary Data.”

Market Area and Competition

We have 281 locations, which consist of 236 branches and 45 loan or administration offices, in 108 counties within nine states including Montana, Idaho, Utah, Washington, Wyoming, Colorado, Arizona, Nevada, and Texas. The market area’s diversified economic base primarily focuses on tourism, construction, mining, energy, manufacturing, agriculture, service industries, and health care. The tourism industry is highly influenced by national parks, ski resorts, significant lakes and rural scenic areas.

Commercial banking is a highly competitive business and operates in a rapidly changing environment. There are a large number of depository institutions including commercial banks, savings and loans, and credit unions in the markets in which we have locations. Competition is also increasing for deposit and lending services from internet-based competitors. Non-depository financial service institutions, primarily in the securities, insurance and retail industries, have also become competitors for retail savings, investment funds and lending activities. In addition to offering competitive interest rates, the principal methods used by the Bank to attract deposits include the offering of a variety of services including online banking, mobile banking and convenient office locations and business hours. The primary factors in competing for loans are interest rates and rate adjustment provisions, loan maturities, loan fees, relationships with customers and the quality of service.

The following table summarizes our number of locations, the number of counties we serve and the percentage of Federal Deposit Insurance Corporation (“FDIC”) insured deposits we have in those counties for each of the nine states we operate in. Percent of deposits are based on the FDIC summary of deposits survey as of June 30, 2025 and does not include any bank division acquired after such date.

5

Human Capital

As of December 31, 2025, we employed 4,188 persons, 3,927 of whom were employed full time. No employees were represented by a collective bargaining group. We believe our employees are united by our commitment to serve our customers and communities and that our customers are best served by a staff of competent, caring employees who are customer oriented. Our employees are one of our most valuable assets. We consider our employee relations to be excellent.

We strive to provide a safe and gratifying workplace for our employees. We promote and support a work environment free from any form of harassment, discrimination, bullying, or retaliation. We are also committed to assisting with reasonable workplace accommodations for individuals with disabilities, for known limitations related to pregnancy, and for religious beliefs or practices that conflict with a job requirement. We also encourage employee growth and development in a variety of ways, including through formal and informal training, continuing education, relationships with colleagues and internal mentors, and by making a variety of resources available.

The Company has established a Training Committee charged with creating company-wide training expectations for employees to encourage adherence to internal policies and procedures and compliance with the variety of laws and regulations applicable to our operations. We also strive to offer multidisciplinary educational opportunities for employees to improve their knowledge and skills for their current positions, as well as to create opportunities to advance within the organization. Other targeted development opportunities are available for group leaders and promising employees, such as tuition support for employees seeking additional degrees or certifications through our Tuition Reimbursement program.

Our employee’s overall health and well-being is a top priority. It is our goal for all employees to work hard and experience a high quality work life, but we also encourage employees to be active participants in our communities, and to enjoy quality time with their families and cultivate their independent interests. We have developed several programs to encourage a safe and healthy workplace, including:

•GBCI Injury and Illness Prevention Program

•Work-life Balance Employee Assistance Program

•WellSteps program offering assessments, goal setting tools, activities, incentives, and rewards

•The appointment of Safety & Wellness Ambassadors

•Quarterly Wellness Campaign

•Workstation Ergonomics Assessments

Through our Injury and Illness Prevention Program, we have established protocols for minimizing work place injuries and incidents. Instilling safety as a standard of practice is facilitated by a Safety Committee at each of our banking divisions and by Safety & Wellness Ambassadors at each location.

We also believe employee retention is critical to our success, and we are proud of our track record when it comes to retaining employees, including many employees at institutions we acquire. Retention strategies are woven into all our compensation and retirement programs, and even our efforts at expansion. We provide our qualifying employees with a comprehensive benefit program, including health, dental and vision insurance, life and accident insurance, short- and long-term disability coverage, and paid time off. In addition we offer a profit sharing and 401(k) plan, short-term cash incentive plan, deferred compensation plans, and a supplemental executive retirement plan for certain employees (“SERP”). For select management-level employees, we also offer our long-term incentive plan, which is an equity-based compensation plan that is designed to encourage achievement of long-term financial goals as determined by the Company’s Board of Directors (the “Board”) from time to time, and to further retention through long-term vesting of certain awards earned. See Note 14 in the Consolidated Financial Statements in “Item 8. Financial Statements and Supplementary Data” for detailed information regarding employee benefit plans and eligibility requirements.

Board of Directors and Committees

The Board has established, among others, an Audit Committee, a Compensation and Human Capital Committee, a Nominating/Corporate Governance Committee, and a Risk Oversight Committee. Additional information regarding Board committees is set forth under the heading “Meetings and Committees of the Board of Directors - Committees and Committee Membership” in the Company’s 2026 Annual Meeting Proxy Statement (“2026 Proxy Statement”) and is incorporated herein by reference.

Website Access

Copies of our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934 are available free of charge through our website (www.glacierbancorp.com) as soon as reasonably practicable after we have filed the material with, or furnished it to, the United States Securities and Exchange Commission (“SEC”). Copies can also be obtained by accessing the SEC’s website (www.sec.gov).

6

Supervision and Regulation

We are subject to extensive regulation under federal and state law. This section provides a general overview of the federal and state regulatory framework that applies to us and our industry. In general, this framework is designed to protect depositors, the federal Deposit Insurance Fund (“DIF”), and the federal and state banking systems (rather than to protect shareholders specifically). Importantly, this section is not intended to summarize all laws and regulations that may apply to us from time to time. Any descriptions of statutory or regulatory provisions in this section do not purport to be complete and are qualified by reference to those provisions.

Banking laws and regulations, as well as related regulatory policies and priorities, continue to be subject to change by Congress, state legislatures, and federal and state regulators. We cannot predict changes in statutes, regulations, or regulatory policies applicable to us (including their interpretation or implementation), and certain changes could have a material effect on our business and operations. In recent years, changes to applicable statutes, regulations, and regulatory policies have been constant and sometimes contradictory. The pace of change has been exacerbated by the volatile political climate and conflicting initiatives between federal and state governments. Continued efforts to monitor and comply with new and changing statutory and regulatory requirements add to the complexity and cost of our business and operations.

We are subject to regulation and supervision by numerous federal and state agencies. With respect to the Company, these agencies include the Federal Reserve, the Montana Department of Administration’s Division of Banking and Financial Institutions (“MT Division of Banking”), and the State of Montana, generally. In addition, the Company is also subject to the disclosure and regulatory requirements of the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended, which are both administered by the SEC. The Bank is subject to regulation and supervision by the FDIC, the MT Division of Banking, and, for branches outside of the State of Montana, the respective regulatory agencies in those states. Because we are an institution with more than $10 billion in assets, we are also subject to regulation and supervision by the Consumer Financial Protection Bureau (“CFPB”), the scope of which has varied widely depending on the priorities of the executive branch of the federal government.

Federal and State Regulation of the Company

General. The Company is a “bank holding company” under the Bank Holding Company Act of 1956, as amended (“BHCA”). In general, the BHCA limits the business of a bank holding company to owning or controlling banks and engaging in, or retaining or acquiring ownership in a company engaged in, other activities closely related to the business of banking. As a bank holding company, the Company is subject to regulation, supervision, and examination by the Federal Reserve, and it must file reports and information with the Federal Reserve from time to time. Further, because the Bank is a “regional banking organization” under Montana law, the Company is also subject to regulation, supervision, and examination by the MT Division of Banking.

Holding Company Bank Ownership. The BHCA requires every bank holding company to obtain the prior approval of the Federal Reserve before: 1) acquiring, directly or indirectly, ownership or control of any voting shares of another bank or bank holding company if, after such acquisition, it would own or control more than 5 percent of such shares; 2) acquiring all or substantially all of the assets of another bank or bank holding company; or 3) merging or consolidating with another bank holding company.

Holding Company Control of Non-banks. With some exceptions, the BHCA prohibits a bank holding company from acquiring or retaining direct or indirect ownership or control of more than 5 percent of the voting shares of any company that is not a bank or bank holding company, or from engaging directly or indirectly in activities other than those of banking, managing, or controlling banks, or providing services for its subsidiaries. The principal exceptions to these prohibitions involve certain non-bank activities that, by federal statute, agency regulation, or order, have been identified as activities closely related to the business of banking or managing or controlling banks.

Transactions with Affiliates. Under the Federal Reserve Act, bank subsidiaries of a bank holding company are subject to restrictions on extensions of credit to the bank holding company or its subsidiaries, on investments in securities, and on the use of securities as collateral for loans to any borrower. In addition to those activities, credit exposure arising from derivative transactions, securities lending, and borrowing transactions is also covered by the regulations. These regulations and restrictions may limit the Company’s ability to obtain funds from the Bank for its cash needs, including funds for payments of dividends, interest on borrowings, and operational expenses.

Tying Arrangements. Federal law prohibits certain tie-in arrangements in connection with any extension of credit, sale or lease of property, or furnishing of services. For example, with certain exceptions, we may not condition an extension of credit to a customer on either 1) a requirement that the customer obtain additional services from us; or 2) an agreement by the customer to refrain from obtaining other services from a competitor.

Support of Bank Subsidiaries. Under federal law, the Company is required to act as a source of financial and managerial strength to the Bank. This means that the Company is required to commit, as necessary, capital and resources to support the Bank, including at times when the Company may not be in a financial position to provide such resources or when it may not be in the Company's or its shareholders' best interests to do so. Any capital loans a bank holding company makes to its bank subsidiaries are subordinate to deposits and to certain other indebtedness of the bank subsidiaries.

7

Restrictions under State Corporate Law. As a Montana corporation, the Company is subject to certain limitations and restrictions under applicable Montana corporate law. For example, Montana corporate law includes limitations and restrictions relating to indemnification of directors, distributions to shareholders, transactions involving directors, officers, or interested shareholders, and requires the observance of certain corporate formalities, including the maintenance of books, records, and minutes.

Federal and State Regulation of the Bank

General. The Bank is subject to primary supervision, periodic examination, and regulation by the FDIC and the MT Division of Banking. These agencies have the authority to prohibit the Bank from engaging in what they believe constitutes unsafe or unsound banking practices. The federal laws that apply to the Bank regulate, among other things, the scope of the Bank’s business, its investments, its reserves against deposits, the availability of deposited funds, lending and community reinvestment activities, insider credit transactions, and safety and soundness standards. In addition to federal and Montana law, the Bank is also subject to the laws of various states within the Bank’s footprint.

Consumer Protection. A variety of federal and state consumer protection laws and regulations govern the Bank’s interactions with consumers, including the manner in which the Bank takes deposits, makes and collects loans, and provides other services. During the past year, certain federal regulators have communicated a desire to reduce the regulatory burden for financial institutions. However, some regulators in the states in which we operate were increasingly active in proposing, enacting, and enforcing consumer protection regulations. Any failure to comply with these laws and regulations may subject the Bank to various penalties, including but not limited to enforcement actions, injunctions, fines, civil monetary penalties, criminal penalties, punitive damages, and the loss of certain contractual rights. The Bank is closely monitoring changes (and challenges) to these laws and regulations and has established a comprehensive compliance system to support efforts to maintain compliance.

Community Reinvestment. The Community Reinvestment Act of 1977 (“CRA”) requires federal bank regulators to evaluate the record of a financial institution in meeting the credit needs of its local communities, including low- and moderate- income neighborhoods, consistent with the safe and sound operation of the institution. Importantly, certain agencies consider a bank’s community reinvestment record when evaluating mergers, acquisitions, and applications to open a branch or facility. In some cases, a bank's failure to comply with the CRA, or CRA protests filed by interested parties during comment periods, can result in the denial or delay of such transactions. The Bank received a “satisfactory” rating in its most recent CRA examination.

Insider Credit Transactions. Banks are subject to restrictions on their ability to extend credit to executive officers, directors, principal shareholders, and their related interests. In general, a covered transaction must 1) be made on substantially the same terms (including interest rates and collateral); 2) follow credit underwriting procedures that are at least as stringent as those prevailing at the time the credit is underwritten for comparable transactions with persons not related to the lending bank; and 3) not involve more than the normal risk of nonpayment or present other unfavorable features. Banks are also subject to lending limits and restrictions on overdrafts and loans to insiders. A violation of these restrictions may result in the assessment of substantial civil monetary penalties, regulatory enforcement actions, and other regulatory sanctions.

Regulation of Management. With respect to management personnel, federal law sets forth circumstances under which officers or directors of a bank may be removed by the bank's federal supervisory agency. In some cases, federal law also prohibits a bank’s management personnel from serving as directors or in other management positions of another financial institution, depending upon such institution’s asset size and location.

Safety and Soundness Standards. Banks are subject to certain non-capital safety and soundness standards. These standards cover, among other things, internal controls, information systems and internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, compensation, fees and benefits, operational and managerial standards, asset quality, earnings, and stock valuation. In part, a bank must implement a comprehensive written information security program with administrative, technical, and physical safeguards appropriate to its size and complexity and the nature and scope of its activities. This program must be designed to maintain the security and confidentiality of customer information, protect against any unanticipated threats or hazards to the security or integrity of such information, protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer, and properly dispose of consumer information. If a bank fails to meet these standards, it may be required to submit a compliance plan or be subject to regulatory sanctions. The Bank has established comprehensive policies and risk management procedures to preserve its safety and soundness.

Interstate Banking and Branching

Federal regulators can approve or reject a bank’s application to establish de novo branches in states other than the bank's home state and regulate the closure of interstate branches. In general, an application for a de novo branch is approved if the host state's banks could establish a branch at the same location. As part of their review, regulators are generally required to consult with community organizations before permitting an interstate bank to close a branch in a low-income area. Banks are also prohibited from using their interstate branches primarily for deposit production, and certain agencies have implemented a loan-to-deposit ratio screen to enforce compliance with this prohibition.

Dividends

A principal source of the Company’s cash is from dividends received from the Bank, which are subject to regulation and limitation. An agency may prohibit a bank or bank holding company from paying dividends in a manner that would constitute an unsafe or

8

unsound banking practice. For example, regulators have stated that paying dividends that deplete an institution's capital base to an inadequate level would be an unsafe and unsound banking practice, and dividends should only be paid out of current operating earnings. Current guidance from the Federal Reserve has noted that dividends per share on the Company’s common stock generally should not exceed earnings per share, measured over the previous four fiscal quarters. Further, a bank may not pay cash dividends if such payments could reduce the amount of its capital below that necessary to meet minimum regulatory capital requirements. In addition to federal law, Montana law also places restrictions on a bank’s ability to declare and pay dividends.

The final phase of implementation of Basel regulations, known as the ”Basel III Endgame,” imposes limitations on the Bank's ability to pay dividends. In general, the Basel III Endgame limits a bank's ability to pay dividends unless its common equity conservation buffer exceeds the minimum required capital ratio by at least 2.5 percent of risk-weighted assets. Although rules implementing the final phase of Basel regulations have been proposed in the past, they have not yet been adopted. Federal banking regulators recently stated that revised proposed rules will be published in early 2026.

The Federal Reserve has also issued a policy statement on the payment of cash dividends by a bank holding company. In general, it notes that, although no specific regulations restrict dividend payments by bank holding companies (other than state corporate laws), a bank holding company should not pay cash dividends unless its earnings for the past year are sufficient to cover both the cash dividends and a prospective rate of earnings retention that is consistent with its capital needs, asset quality, and overall financial condition. A bank holding company's ability to pay dividends may also be restricted if a subsidiary bank becomes undercapitalized. These types of laws and policies may limit our ability to pay dividends or otherwise engage in capital distributions.

Consumer Financial Protection Bureau. The CFPB has rulemaking, supervision, and enforcement authority for a wide range of consumer protection laws. In recent years, the CFPB focused on certain types of fees commonly charged by financial institutions, consumer complaints, the use of artificial intelligence (“AI”), paycheck advance products, data privacy, digital payment applications, and open banking. However, the CFPB recently communicated a desire to reduce regulatory burdens for banks in a variety of ways, such as by limiting supervisory exams and focusing on actual consumer complaints. The future of the CFPB is uncertain due to several legal challenges to its structure and funding.

Interchange Fees. Our ability to charge debit card interchange fees is subject to a cap. This cap is currently equal to $0.21 plus 5 basis points of the transaction value, subject to certain adjustments. Although there have been recent proposals to reduce this cap, they have yet to be implemented. Any future changes to this cap could affect the Bank’s fee revenue and non-interest income.

Capital Adequacy

We are subject to various regulatory capital requirements. These requirements measure assets, liabilities, and certain off-balance sheet items against regulatory guidelines. Capital amounts and classifications are subject to qualitative judgments by regulators about components and risk weighting, among other factors. These requirements, which are applied independently to the Company and the Bank, are intended to confirm that an institution has adequate capital given the risk levels of its assets and off-balance sheet financial instruments.

Under federal law, minimum capital standards include: 1) a common equity Tier 1 capital to risk-based assets ratio of 4.5 percent; 2) a Tier 1 capital to risk-based assets ratio of 6 percent; 3) a total capital to risk-based assets ratio of 8 percent; and 4) a Tier 1 capital to total assets leverage ratio of 4 percent. Federal regulations also require a capital conservation buffer designed to absorb losses during periods of economic stress. Failure to comply with these requirements may result in constraints on an institution’s capital distributions (e.g., dividends, equity repurchases, and certain bonus compensation for executive officers). The regulations also adjust risk-weights of certain assets and phase out certain instruments as qualifying capital. For additional information regarding trust preferred securities and their impact to regulatory capital, see Note 13 to the Consolidated Financial Statements in “Item 8. Financial Statements and Supplementary Data.”

A federal prompt corrective action framework is in place to, under certain circumstances, place restrictions on an institution if its capital levels begin to show signs of weakness. Under this framework, an institution is required to meet the following increased capital level requirements to qualify as “well capitalized”: 1) a Tier 1 common equity capital ratio of at least 6.5 percent; 2) a Tier 1 capital ratio of at least 8 percent; 3) a total capital ratio of at least 10 percent; 4) a Tier 1 leverage ratio of at least 5 percent; and 5) not be subject to any order or written directive requiring a specific capital level. In addition to “well capitalized,” the regulations contain other capital classifications, such as “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized” (each of which are based on differing capital ratios). Importantly, if an institution is deemed “undercapitalized,” it may be subject to certain mandatory restrictions (e.g., restrictions on capital distributions and growth). Further, if an institution is deemed “significantly undercapitalized” or “critically undercapitalized,” it may be subject to additional restrictions. Regardless of an institution’s initial classification, it may nevertheless be downgraded if it is determined to be in an unsafe or unsound condition, or if it receives an unsatisfactory examination rating.

The application of these regulations may result in lower returns on invested capital, which may require raising additional capital or regulatory action if the Bank were unable to comply with such requirements. In addition, management may be required to modify its business strategy due to the changes to the asset risk-weights for risk-based capital calculations and the requirement to meet the capital conservation buffer. The imposition of liquidity requirements in connection with these rules could also cause the Bank to increase its holdings of liquid assets, change its business strategy, and make other changes to the terms of its funding.

9

Regulatory Oversight and Examination

Inspections. The Federal Reserve conducts periodic inspections of bank holding companies. In general, inspections are designed to ascertain whether the financial strength of a bank holding company is maintained on an ongoing basis and to determine the effects or consequences of transactions between a bank holding company and its affiliates, including its bank subsidiaries. The type and frequency of an inspection may vary depending on a bank holding company’s asset size, complexity, and rating at its last inspection.

Examinations. A bank is subject to periodic examination by its primary federal and state regulators, such as the FDIC and the MT Division of Banking. Examinations typically alternate between the federal and state bank regulators and, in some cases, may occur on a combined schedule. The frequency of examinations is linked to the size of an institution and recent examination findings. However, regulators are authorized to examine an institution as frequently as they deem necessary based on the condition of the institution or certain triggering events. In addition to the FDIC and the MT Division of Banking, we are also subject to examination by the CFPB. The CFPB typically uses a prioritization framework to determine the focus its examination efforts. This framework evaluates risks to consumers from specific product lines at both the market level and the institution level, and takes into consideration the size of the institution.

Commercial Real Estate Ratios. Federal banking regulators have issued risk management guidance with respect to commercial real estate concentrations. The purpose of the guidance is to aid banks in developing risk management practices and capital levels commensurate with the level and nature of their concentrations. The guidance largely focuses on a bank’s exposure to CRE loans that are dependent on the cash flow from the real estate collateral and likely sensitive to conditions in the commercial real estate market. The regulators typically allocate supervisory resources to institutions that have significant CRE loan concentration risk.

Corporate Governance and Accounting

The Sarbanes-Oxley Act of 2002 (“SOX Act”) addresses, among other things, corporate governance, auditing and accounting, disclosure of corporate information, and penalties for non-compliance. For example, the SOX Act 1) requires certain executive officers to certify as to the accuracy and completeness of periodic reports filed with the SEC and to certain matters relating to disclosure and accounting controls; 2) imposes specific and enhanced corporate disclosure requirements; 3) accelerates the time frame for reporting insider transactions and periodic disclosures; and 4) requires companies to adopt and disclose information about corporate governance practices. As a publicly reporting company with the SEC, the Company is subject to the requirements of the SOX Act and related rules and regulations issued by the SEC and the NYSE.

Anti-Money Laundering and Anti-Terrorism

The federal Bank Secrecy Act (“BSA”) requires all financial institutions to establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. The BSA also sets forth various recordkeeping and reporting requirements (such as reporting suspicious activities that might signal criminal activity), due diligence and "know your customer" requirements, and whistleblower incentives and protections. If an individual or institution fails to comply with the BSA, it can result in severe consequences, including civil penalties, criminal fines, and, in some cases, imprisonment.

The Financial Crimes Enforcement Network of the U.S. Department of the Treasury (“FinCEN”) administers the BSA and determines policy priorities for anti-money laundering and countering the financing of terrorism. The priorities currently include corruption, cybercrime, terrorist financing, fraud, transnational crime, drug trafficking, human trafficking, and proliferation financing.

The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act (the “PATRIOT Act”) was also enacted to combat terrorism. In relevant part, the PATRIOT Act 1) prohibits banks from providing correspondent accounts directly to foreign shell banks; 2) imposes due diligence requirements on banks opening or holding accounts for foreign financial institutions or wealthy foreign individuals; 3) requires banks to establish an anti-money laundering compliance program; and 4) eliminates civil liability for persons who file suspicious activity reports. The PATRIOT Act grants the government power to investigate terrorism, which may include expanded access to bank records. Federal and state agencies commonly take into consideration an institution’s compliance with the BSA when reviewing and ruling on applications involving mergers, acquisitions, and similar transactions. We have established comprehensive compliance programs designed to comply with the requirements of the BSA and the PATRIOT Act.

Financial Services Modernization

In 1999, the Gramm-Leach-Bliley Financial Services Modernization Act (“GLBA”) introduced significant changes to the banking legal landscape. For instance, the GLBA 1) repealed historical restrictions on preventing banks from affiliating with securities firms; 2) provided a uniform framework for the activities of banks, savings institutions, and their holding companies; 3) broadened the activities that may be conducted by national banks and banking subsidiaries of bank holding companies; 4) provided an enhanced framework for protecting the privacy of consumer information; and 5) addressed a variety of other matters affecting both day-to-day operations and long-term activities of financial institutions. The Bank is subject to the privacy provisions of the GLBA, which requires, among other things, privacy policy disclosures and opt out options.

10

Deposit Insurance

FDIC Insured Deposits. The Bank's deposits are insured under the Federal Deposit Insurance Act, which is designed to protect customers in the event of a bank’s failure. In general, the FDIC insures deposits up to $250,000 per depositor, per FDIC-insured bank, per account ownership category.

FDIC Insurance. The Bank pays quarterly deposit insurance assessments to the FDIC. The amount of these assessments is based on its deposit base and the FDIC’s applicable assessment rate. In the Bank’s case, the FDIC uses a “scorecard” methodology to determine the assessment rate. This methodology seeks to capture both the probability that an institution will fail and how such a failure may impact the DIF. The FDIC recently noted that current rate schedules will remain in effect until the DIF reserve ratio meets or exceeds two percent, at which time many expect to see lower assessment rates. The FDIC also has the authority to implement special assessments to recover losses to the DIF caused by systemic risks. For example, in the wake of a number of bank failures in 2023, the FDIC instituted a special assessment payable in installments, the last of which will be due the first quarter of 2026. Importantly, an institution may not pay a dividend if it is in default on its federal deposit insurance assessments. The Bank is not in default on any such assessments.

Safety and Soundness. Under certain circumstances, the FDIC may terminate the deposit insurance of an insured depository institution. For example, termination may occur if the FDIC determines (after a hearing) that an institution has engaged (or is engaging) in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, order, or condition imposed under an agreement with the FDIC. Management is not aware of any circumstances that would result in termination of the Bank's deposit insurance.

Recent and Proposed Legislation

The political climate of the past several years has led to rapid changes to the regulatory environment affecting the banking industry. Opposing federal and state regulatory priorities and legislation have also significantly impacted the industry. For example, although the federal banking regulators have eased their focus on consumer protection matters, many states (including some within the Bank’s footprint) are expanding the scope of consumer and other protections and increasing the intensity of their enforcement efforts. Further, some states are shifting their focus towards certain consumer protection matters that are no longer being prioritized by federal regulators, such as fees, loan servicing, discriminatory practices, data privacy, cybersecurity, and AI.

We cannot predict the impact that any legal or regulatory initiatives and related uncertainty may have on our operations, competitive situation, financial conditions, or results of operations. Recent history has demonstrated that new legislation or changes to existing laws or regulations will often result in an increase to the general costs of doing business. Although the Trump Administration has announced a desire to reduce regulatory burdens, the impact of the changing regulatory environment remains to be seen.

Effects of Federal Government Monetary Policy

The Company’s earnings and growth are affected not only by general economic conditions, but also by the fiscal and monetary policies of the federal government, particularly the Federal Reserve. The Federal Reserve implements national monetary policy to promote maximum employment, stable prices, and moderate long-term interest rates. Through its open market operations in U.S. government securities, control of the discount and interest rates, and deposit reserve requirements, the Federal Reserve influences the availability and cost of money and credit and, ultimately, a range of economic variables including employment, output, and the prices of goods and services. The Federal Reserve’s most recent decrease to the federal funds rate occurred in December 2025. The Federal Reserve noted that, although economic activity has expanded at a moderate pace, inflation remains elevated and the unemployment rate has increased. New appointments to the Board of Governors or increased political pressure on the Federal Reserve could also result in further changes in monetary policy. Changes in monetary policy, including changes in the federal funds rate, can affect net interest income and margin, overall profitability, and shareholders’ equity. We cannot predict the impact that any future changes in monetary policy may have on us.

Cybersecurity

Federal banking regulators regularly issue new (and update existing) guidance in an effort to enhance cyber risk management. Financial institutions are expected to comply with such guidance and to develop appropriate security controls and risk management processes. If we fail to observe such regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.

Federal law requires a bank to notify its primary banking regulator within 36 hours after determining that a covered computer-security incident has occurred. This may include, among other types of incidents, an incident that has materially disrupted or degraded a bank’s ability to carry out banking operations to a material portion of its customer base in the ordinary course of business.

In addition to federal law, an increasing number of states have established regulations requiring financial institutions to implement cybersecurity programs. Many states (including all of the states within the Bank’s footprint) have also implemented data breach notification, information security, and/or data privacy regulations that may impose additional requirements on our operations. We are continually monitoring developments in the states in which our customers are located in an effort to maintain compliance with applicable cybersecurity-related requirements.

11

Risks and exposures related to cybersecurity attacks, including litigation and enforcement risks, are expected to be elevated for the foreseeable future due to the rapidly evolving nature and sophistication of technology. These risks have increased for many reasons, including widespread use of internet banking, mobile banking, AI, and other technology-based products and services.

In addition to guidance and standards implemented by federal and state banking regulators, the SEC also requires an annual disclosure of registrants’ cybersecurity risk management, strategy, and governance practices. The SEC also enforces its own set of cybersecurity incident requirements. These requirements include disclosure of material cybersecurity incidents (including a description of the nature, scope, timing, and impact of the incident), within four business days after the incident.

Debanking

In August 2025, President Trump issued an Executive Order designed to end a practice it has labeled as “debanking.” Debanking occurs when a bank adversely restricts or modifies its products or services on the basis of a customer’s political or religious beliefs, or on the basis of the customer’s lawful business activities that the bank disagrees with or disfavors for political reasons. We endeavor to make all of our banking decisions on the basis of individualized, objective, and risk-based analyses, and we do not believe that we have engaged in debanking.

Corporate, Social, and Environmental Responsibility

We strive to engage in the banking business in a responsible manner, and we recognize that our activities impact the communities where we operate. We believe that it is consistent with our community banking model to be good stewards of our franchise, active in the communities we serve, and with a particular focus on the development and well-being of our employees.