HAWTHORN BANCSHARES, INC. (HWBK) Risk Factors

Item 1A. Risk Factors.

Risk Factors

We are identifying important risks and uncertainties that could affect the Company's results of operations, financial condition or business and that could cause them to differ materially from the Company's historical results of operations, financial condition or business, or those contemplated by forward-looking statements made herein or elsewhere, by, or on behalf of, the Company. Factors that could cause or contribute to such differences include, but are not limited to, those factors described below. The risk factors highlighted below are not necessarily the only ones that the Company faces.

Risks Relating to Our Business and Market

Because we primarily serve Central and West Central Missouri, as well as the Kansas City MSA, a decline in the local economic conditions could lower the Company's profitability.

The profitability of the Company is dependent on the profitability of the Bank, which operates out of central and west-central Missouri and extends into the Kansas City MSA. The financial condition of the Bank is affected by slowing or recessionary economic conditions and business activity prevailing in the portion of Missouri in which its operations are located. Although our customers' business and financial interests may extend well beyond our market areas, the financial conditions of both the Company and the Bank would be adversely affected by deterioration in the general economic and real estate climate in our markets.

An increase in unemployment, a decrease in profitability of regional businesses or real estate values, or an increase in interest rates are among the factors that could weaken the local economy. With a weaker local economy:

•customers may not want or need the products and services of the Bank;

•borrowers may be unable to repay their loans;

•the value of the collateral security of the Bank's loans to borrowers may decline;

•the number of loan delinquencies and foreclosures may increase; and

•the overall quality of the Bank's loan portfolio may decline.

Originating mortgage loans and consumer loans are a significant source of profits for the Bank. If individual customers in the local area do not want or need these loans, profits may decrease. Although the Bank could make other investments, the Bank may earn less revenue on these investments than on loans. Additionally, the Bank's losses on loans may increase if borrowers are unable to make payments on their loans.

Interest rate changes may reduce the profitability of the Company and the Bank.

The primary source of earnings for the Bank is net interest income. To be profitable, the Bank has to earn more money in interest and fees on loans and other interest-earning assets than it pays as interest on deposits and other interest-bearing liabilities and as other expenses. If prevailing interest rates decrease, the amount of interest the Bank earns on loans and investment securities may decrease more rapidly than the amount of interest the Bank has to pay on deposits and other interest-bearing liabilities. This would result in a decrease in the profitability of the Company and the Bank.

Changes in the level or structure of interest rates also affect:

•the Bank's ability to originate loans;

•the value of the Bank's loan and securities portfolios;

•the Bank's ability to realize gains from the sale of loans and securities;

•the average life of the Bank's deposits; and

•the Bank's ability to obtain deposits.

Fluctuations in interest rates will ultimately affect both the level of income and expense recorded on a large portion of the Bank's assets and liabilities, and the fair value of all interest-earning assets, other than interest-earning assets that mature in the short term. The Bank's interest rate management strategy is designed to stabilize net interest income and preserve capital over a broad range of interest rate movements by matching the interest rate sensitivity of assets and liabilities. Although the Company believes that the Bank's current mix of loans, mortgage-backed securities, investment securities and deposits is reasonable, significant fluctuations in interest rates may have a negative effect on the profitability of the Bank.

Our business depends on our ability to successfully manage credit risk.

10

The operation of our business requires us to manage credit risk. As a lender, the Bank is exposed to the risk that borrowers will be unable to repay their loans according to their terms, and that the collateral securing repayment of their loans, if any, may not be sufficient to ensure repayment. In addition, there are risks inherent in making any loan, including risks with respect to the period of time over which the loan may be repaid, risks relating to proper loan underwriting, risks resulting from changes in economic and industry conditions and risks inherent in dealing with individual borrowers. In order to successfully manage credit risk, we must, among other things, maintain disciplined and prudent underwriting standards and ensure that our loan officers follow those standards. The weakening of these standards for any reason, such as an attempt to attract higher yielding loans, a lack of discipline or diligence by our employees in underwriting and monitoring loans, the inability of our employees to adequately adapt policies and procedures to address changes in economic or other conditions affecting borrowers (such as the current inflationary environment and elevated interest rates) and the quality of our loan portfolio, may result in loan defaults, foreclosures and additional charge-offs and may necessitate that we significantly increase our allowance for credit losses, each of which could adversely affect our net income. As a result, our inability to successfully manage credit risk could have a material adverse effect on our business, financial condition or results of operations.

The Company's profitability depends on the Bank's asset quality and lending risks.

Success in the banking industry largely depends on the quality of loans and other assets. A significant source of risk for us arises from the possibility that losses will be sustained because borrowers, guarantors and related parties may fail to perform in accordance with the terms of their loans. The Bank's loan officers are actively encouraged to identify deteriorating loans. Loans are also monitored and categorized through an analysis of their payment status. The Bank's failure to timely and accurately monitor the quality of its loans and other assets could have a materially adverse effect on the operations and financial condition of the Company and the Bank. There is a degree of credit risk associated with any lending activity. The Bank attempts to minimize its credit risk through loan diversification. Although the Bank's loan portfolio is varied, with no undue concentration in any one industry, substantially all of the loans in the portfolio have been made to borrowers in central, west central, and southwest Missouri. Therefore, the loan portfolio is susceptible to factors affecting the central, west central, and southwest Missouri area, as well as the Kansas City MSA, and the level of non-performing assets is heavily dependent upon local conditions. There can be no assurance that the level of the Bank's non-performing assets will not increase above current levels. High levels of non-performing assets could have a materially adverse effect on the operations and financial condition of the Company and the Bank.

The provision for probable credit losses may need to be increased.

The Bank makes a provision for credit losses based upon management's estimate of probable losses in the loan portfolio and its consideration of prevailing economic and environmental conditions. The amount of future loan losses is susceptible to changes in economic, operating and other conditions, including changes in interest rates, which may be beyond the Company's control, and these losses may exceed current estimates. We cannot fully predict the amount or timing of losses or whether the loss allowance will be adequate in the future. The Bank may need to increase the provision for credit losses through additional provisions in the future if, among other things, the financial condition of any of its borrowers deteriorates, if its borrower fails to perform its obligations to it, or if real estate values decline. Furthermore, various regulatory agencies, as an integral part of their examination process, periodically review the Bank's loan portfolio, provision for credit losses, and real estate acquired by foreclosure. Such agencies may require the Bank to recognize additions to the provision for credit losses based on their judgments of information available to them at the time of the examination. Any additional provision for probable credit losses, whether required as a result of regulatory review or initiated by the Company itself, may materially alter the financial outlook of the Company and the Bank and may have a material adverse effect on the Company's financial condition and results of operations.

Adverse market conditions in the U.S. economy and the markets in which we operate could adversely impact the Company's business.

Unfavorable or uncertain economic and market conditions, including slowing or recessionary economic conditions, reduced availability of commercial credit, rising inflation, and increasing unemployment may negatively impact the credit performance of commercial and consumer credit, resulting in additional write-downs. Concerns over the stability of the financial markets and the economy may result in decreased lending by financial institutions to their customers and to each other. Market turmoil may lead to increased commercial and consumer deficiencies, lack of customer confidence, increased market volatility and widespread reduction in general business activity. Competition among depository institutions for deposits has increased significantly. Financial institutions may experience decreased access to deposits or borrowings due to unfavorable or uncertain economic and market conditions.

Emerging financial technologies such as digital assets, stablecoins, and distributed ledger systems may reduce the demand for traditional banking services and create new competitive pressures that adversely affect our business.

The rapid development and increasing regulatory acceptance of financial technologies such as digital assets (including cryptocurrencies and tokenized money), stablecoins and distributed ledger technologies ("DLT") could materially alter the

11

financial services sector. These technologies enable near-instantaneous value transfer, programmable money and peer-to-peer settlement mechanisms, many of which may operate outside the traditional banking system.

Large technology companies, fintech platforms and digital asset service providers are increasingly offering products that compete with core banking functions, such as payments, custody, lending and liquidity management. Many of the providers of these emerging financial technology providers are not subject to the same regulatory or capital constraints as depository institutions. The adoption of digital financial infrastructure by governments or central banks, such as central bank digital currencies ("CBDCs"), or by major corporate platforms could accelerate these shifts.

Our ability to compete with larger institutions or well-capitalized technology entrants in developing or integrating emerging financial technologies is limited by our size, risk profile and depository institution regulatory obligations. A failure to adapt to or participate in these emerging ecosystems—either directly or through strategic partnerships—could erode the Bank’s traditional banking functions, reduce the Bank’s share of customer deposits and fee income, and adversely affect the Company’s long-term growth prospects and financial condition.

Recent federal legislation, including the GENIUS Act enacted in July 2025, established new regulatory requirements for payment stablecoins issued by banking organizations and their subsidiaries. Compliance with these requirements involves maintaining adequate asset reserves, extensive reporting obligations, independent audits and increased supervisory oversight. The Company’s potential involvement in issuing or supporting payment stablecoins could expose us to regulatory compliance risks, increased operational costs and evolving legal uncertainties. Additionally, rapid changes in digital asset regulation or adverse regulatory interpretations could adversely affect our business strategies and prospects in this emerging market, which could materially impact our financial condition and results of operations.

Smaller commercial borrowers may have fewer financial resources, which may impair their ability to repay loans.

We provide lending to many small- and medium-sized businesses, which generally have fewer financial resources than larger entities (in terms of capital or borrowing capacity). Accordingly, these businesses may be more vulnerable to economic downturns, often need substantial additional capital to expand or compete, and may experience substantial volatility in operating results, any of which may impair the borrower's ability to repay a loan. If these or other borrowers are harmed by adverse business conditions in the markets in which we operate, it may result in an adverse effect to the business, financial condition and results of operations of the Company or the Bank.

The soundness of other financial institutions could adversely affect us.

The Company's ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services institutions are interrelated as a result of trading, clearing, counterparty or other relationships. We have exposure to many different industries and counterparties, and we routinely execute transactions with counterparties in the financial industry, including brokers and dealers, commercial banks, investment banks, mutual and hedge funds, and other institutional clients. As a result, defaults by, or even rumors or questions about, one or more financial services institutions, or the financial services industry generally, could lead to market-wide liquidity problems and could lead to losses or defaults by us or by other institutions. Many of these transactions expose us to credit risk in the event of default of a counterparty or client. In addition, the Company's credit risk may be exacerbated when the collateral held by us cannot be realized upon or is liquidated at prices not sufficient to recover the full amount of the loan or derivative exposure due us. There is no assurance that any such losses would not materially and adversely affect the Company's results of operations.

The bank failures of Silicon Valley Bank and First Republic Bank in California and Signature Bank in New York during 2023 caused a degree of panic and uncertainty in the investor community and among bank customers generally. Any future bank failures may reduce customer confidence, affect sources of funding and liquidity, increase regulatory requirements and costs, adversely affect financial markets and/or have a negative reputational ramification for the banking industry, including the Company.

Liquidity risk could impair our ability to fund operations and meet our obligations as they become due, and failure to maintain sufficient liquidity could materially adversely affect our growth, business, profitability and financial condition.

Liquidity is essential to our business. Liquidity risk is the potential that we will be unable to meet our obligations as they become due because of an inability to liquidate assets or obtain adequate funding at a reasonable cost, in a timely manner and without adverse conditions or consequences. We require sufficient liquidity to fund asset growth, meet customer loan requests, customer deposit maturities and withdrawals, payments on our debt obligations as they become due and other cash commitments under both normal operating conditions and other unpredictable circumstances, including events causing industry or general financial market stress. Liquidity risk can increase due to a number of factors, including an over-reliance on a particular source of

12

funding or market-wide phenomena such as market dislocation and major disasters. Factors that could detrimentally impact access to liquidity sources include, but are not limited to, a decrease in the level of our business activity as a result of a slowdown in our market, adverse regulatory actions against us, or changes in the liquidity needs of our depositors. Market conditions or other events could also negatively affect the level or cost of funding, affecting our ongoing ability to accommodate liability maturities and deposit withdrawals, meet contractual obligations, and fund asset growth and new business transactions at a reasonable cost, in a timely manner, and without adverse consequences. Our inability to raise funds through deposits, borrowings, the sale of loans, other sources, and our ability to maintain sufficient deposits, could have a substantial negative effect on our business, and could result in the closure of the Bank. Our access to funding sources in amounts adequate to finance our activities or on acceptable terms could be impaired by factors that affect our organization specifically or the financial services industry or economy in general. Any substantial, unexpected, and/or prolonged change in the level or cost of liquidity could impair our ability to fund operations and meet our obligations as they become due and could have a material adverse effect on our business, financial condition and results of operations.

We rely on customer deposits, including brokered deposits, and to a lesser extent on advances from the Federal Home Loan Bank ("FHLB") and federal funds purchased to fund our operations. Although we have historically been able to replace customer deposit withdrawals, maturing deposits, and advances if desired, we may not be able to replace such funds in the future if our financial condition, the financial condition of the FHLB or market conditions were to change. FHLB borrowings and other current sources of liquidity may not be available or, if available, sufficient to provide adequate funding for operations.

Deterioration in the housing market could cause further increases in delinquencies and non-performing assets, including loan charge-offs, and depress the Company's income and growth.

The volume of one-to-four family residential mortgages and home equity lines of credit may decrease during economic downturns as a result of, among other things, a decrease in real estate values, an increase in unemployment, a slowdown in housing price appreciation or increases in interest rates. These factors could reduce earnings and consequently the Company's financial condition because:

•borrowers may not be able to repay their loans;

•the value of the collateral securing loans may decline further;

•the quality of the Company's loan portfolio may decline further; and

•customers may not want or need the Company's products and services.

Any of these scenarios could cause an increase in delinquencies and non-performing assets, require us to charge-off a higher percentage of loans, increase substantially the provision for losses on loans, or make fewer loans, which would reduce income.

The FDIC's changes in the calculation of deposit insurance premiums and ability to levy special assessments could increase the Company's non-interest expense and may reduce its profitability.

Our deposits are insured up to applicable limits by the DIF and are subject to deposit insurance assessments to maintain deposit insurance. As an FDIC-insured institution, we are required to pay quarterly deposit insurance premium assessments to the FDIC. Growth in insured deposits at FDIC-insured financial institutions in recent years caused the ratio of the DIF to total insured deposits to fall below the current statutory minimum, and the FDIC has approved an increase in the base assessment rates to increase the likelihood that the reserve ratio of the DIF reaches the statutory minimum level by the statutory deadline.

The FDIC has the statutory authority to impose special assessments on insured depository institutions in an amount, and for such purposes, as the FDIC may deem necessary. The FDIC issued a final rule in November 2023 to implement a special assessment to recover the significant losses incurred by the FDIC in connection with the 2023 bank failures, but that special assessment did not apply to the Bank.

Although we cannot predict what the insurance assessment rates will be in the future, either a deterioration in our risk-based capital ratios or further adjustments to the base assessment rates could have a material adverse impact on our business, financial condition, results of operations and cash flows. The change in the calculation methodology for deposit insurance premiums and the possible emergency special assessments could increase non-interest expense and may adversely affect the Company's profitability.

We may elect or be compelled to seek additional capital in the future, but that capital may not be available when it is needed.

We are required by regulatory authorities to maintain adequate levels of capital to support operations. In addition, we may elect to raise additional capital to support the growth of the Company's business or to finance acquisitions, if any, or we may elect

13

to raise additional capital for other reasons. Should we elect or be required by regulatory authorities to raise additional capital, we may seek to do so through the issuance of, among other things, common stock or securities convertible into common stock, which could dilute your ownership interest in the Company. Although we remain "well-capitalized", the future cost and availability of capital may be adversely affected by illiquid credit markets, economic conditions and a number of other factors, many of which are outside of the Company's control. Accordingly, we cannot assure you of the ability to raise additional capital if needed or on terms acceptable to us. If we cannot raise additional capital when needed or on terms acceptable to us, it may have a material adverse effect on the Company's financial condition and results of operations.

If we are unable to successfully compete for customers in the Company's market area, the Company's financial condition and results of operations could be adversely affected.

The Bank faces substantial competition in making loans, attracting deposits and providing other financial products and services. The Bank has numerous competitors for customers in its market area. Such competition for loans comes principally from:

•other commercial banks;

•savings banks;

•savings and loan associations;

•mortgage banking companies;

•finance companies; and

•credit unions.

Competition for deposits comes principally from:

•other commercial banks;

•savings banks;

•savings and loan associations;

•credit unions;

•brokerage firms;

•insurance companies; and

•mutual funds, including money market mutual funds and corporate and government securities funds.

Many of these competitors have greater financial resources and name recognition, more locations, more advanced technology and more financial products to offer than the Bank. Competition from larger institutions may increase due to an acceleration of bank mergers and consolidations in Missouri and the rest of the nation. In addition, the Gramm-Leach-Bliley Act removes many of the remaining restrictions in federal banking law against cross-ownership between banks and other financial institutions, such as insurance companies and securities firms. The law will likely further increase the number and financial strength of companies that compete directly with the Bank. In addition, competition from emerging financial technology companies, including crypto currencies, stable coins and other digital assets, may also increase if current adoption and usage trends continue.

The profitability of the Bank depends on its continued ability to attract new customers and compete in its service areas. Increased competition in our markets from new competitors, as well as the expanding operations of existing competitors, may result in:

•interest rate changes to various types of accounts;

•a decrease in the amounts of the Bank's loans and deposits;

•reduced spreads between loan rates and deposit rates; and

•loan terms that are less favorable to the Bank.

Any of these results could have a material adverse impact on the Bank's market share of deposits and loans in the Bank's service areas. If the Bank is unable to successfully compete, its financial condition and results of operations will be adversely affected.

We face strong competition from financial service companies and other companies that offer banking and wealth management services, which could adversely affect our business.

Many competitors offer the same, or a wider variety of, banking and wealth management services within the Company’s market areas. These competitors include national banks, regional banks and other community banks. The Company also faces

14

competition from many other types of financial institutions, including savings and loan institutions, finance companies, brokerage firms, insurance companies, credit unions, mortgage banks and online lenders, and other financial intermediaries. In addition, a number of out-of-state financial intermediaries have entered the Company’s primary market areas. Also, as discussed above, technology and other changes have lowered barriers to entry and made it possible for non-banks, or financial technology companies, to offer products and services traditionally provided by banks. We may not be able to compete successfully against current and future competitors. If we are unable to attract and retain banking and wealth management customers, we may be unable to grow our loan and deposit portfolios or our wealth management commissions, which could adversely affect our business, results of operations and financial condition.

Our wealth management fees may decrease as a result of poor investment performance, in either relative or absolute terms, which could decrease our revenues and net earnings.

The Company’s wealth management business derives a significant amount of its revenues from investment management fees based on assets under management. The Company’s ability to maintain or increase assets under management is subject to a number of factors, including investors’ perception of the Company’s past performance, in either relative or absolute terms, general market and economic conditions, and competition from other investment management firms or substitutes. A decline in the fair value of the assets under management would decrease the Company’s trust and wealth management fee income.

Investment performance is one of the most important factors in retaining existing clients and competing for new wealth management clients. Poor investment performance could reduce the Company’s revenues and impede the growth of the Company’s wealth management business. For example, existing clients may withdraw funds from the Company’s wealth management business in favor of better performing products or firms; asset-based management fees could decline from a decrease in assets under management; the Company’s ability to attract funds from existing and new clients might diminish; and the Company’s portfolio managers may depart, to join a competitor or otherwise.

Even when market conditions are generally favorable, the Company’s investment performance may be adversely affected by the investment style of its portfolio managers and the particular investments that they make or recommend. Ultimately, the Company may not be able to compete successfully against current and future competitors. If the Company is unable to attract and retain banking and wealth management customers, it may be unable to grow its loan and deposit portfolios or its wealth management commissions, which could adversely affect its business, results of operations and financial condition.

We may experience difficulties in managing growth and in effectively integrating newly acquired companies.

As part of the Company's general strategy, it may continue to acquire banks and businesses that it believes provide a strategic fit with its business. To the extent that the Company does grow, there can be no assurances that we will be able to adequately and profitably manage such growth. Acquiring other banks and businesses will involve risks commonly associated with acquisitions, including:

•potential exposure to liabilities of the banks and businesses acquired;

•difficulty and expense of integrating the operations and personnel of the banks and businesses acquired;

•difficulty and expense of instituting the necessary systems and procedures, including accounting and financial reporting systems, to manage the combined enterprises on a profitable basis;

•potential disruption to existing business and operations;

•potential diversion of the time and attention of management; and

•impairment of relationships with and the possible loss of key employees and customers of the banks and businesses acquired.

The success of the Company's internal growth strategy will depend primarily on the ability of the Bank to generate an increasing level of loans and deposits at acceptable risk levels and on acceptable terms without significant increases in non-interest expenses relative to revenues generated. There is no assurance that we will be successful in implementing the Company's internal growth strategy.

The Bank is a community bank and our ability to maintain the Bank's reputation is critical to the success of our business and the failure to do so could materially adversely affect our performance.

The Bank is a community bank, and its reputation is one of the most valuable components of our business. As such, we strive to conduct our business in a manner that enhances our reputation. This is done, in part, by recruiting, hiring and retaining employees who share our core values of being an integral part of the communities we serve, delivering superior service to our customers and caring about our customers and associates. However, employee error or employee and customer misconduct could subject us to financial losses or regulatory sanctions and seriously harm our reputation. Misconduct by our employees could

15

include hiding unauthorized activities from us, improper or unauthorized activities on behalf of our clients or improper use of confidential information. It is not always possible to prevent employee error or misconduct, and the precautions we take to prevent and detect this activity may not be effective in all cases. Because the nature of the financial services business involves a high volume of transactions, certain errors may be repeated or compounded before they are discovered and successfully rectified. If our reputation is negatively affected, by the actions of our employees or otherwise, our business and, therefore, our operating results could be materially adversely affected.

Fraudulent activity could damage our reputation, disrupt our business, increase our costs and cause losses.

Financial institutions are inherently exposed to operational risk in the form of theft and other fraudulent activity by employees, clients and other third parties targeting us and our customers or data. Such activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering, and other dishonest acts. Information security breaches and cybersecurity-related incidents may include fraudulent or unauthorized access to systems used by us, our customers or third-party vendors, denial or degradation of service attacks, and malware or other cyberattacks. Although the Company devotes substantial resources to maintaining effective policies and internal controls to identify and prevent such incidents, given the increasing sophistication of possible perpetrators, the Company or the Bank may experience financial losses or reputational harm as a result of fraud. In addition, we may be required to make significant capital expenditures in order to modify and enhance our protective measures or to investigate and remediate fraudulent activity. Although we have not experienced any material business or reputational harm as a result of fraudulent activities in the past, the occurrence of fraudulent activity could damage our reputation, disrupt our business, increase our costs and cause losses in the future.

The Company's success largely depends on the efforts of its executive officers.

The success of the Company and the Bank has been largely dependent on the efforts of a limited number of executive officers and key employees. These individuals are expected to continue to perform their services. However, the loss of the services of any of these individuals could have a materially adverse effect on the Company and the Bank.

If we fail to maintain an effective system of internal control over financial reporting, we may not be able to accurately report our financial results or prevent fraud, and, as a result, investors and depositors could lose confidence in our financial reporting, which could adversely affect our business, the trading price of our stock, and our ability to attract additional deposits.

We are required to include in our annual reports filed with the SEC a report from our management regarding internal control over financial reporting. As a result, we documented and evaluated our internal control over financial reporting in order to satisfy the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 and SEC rules and regulations, which require an annual management report on our internal control over financial reporting, including, among other matters, management's assessment of the effectiveness of internal control over financial reporting. Failure or circumvention of our system of internal control could have an adverse effect on our business, profitability, and financial condition, and could result in regulatory actions and loss of investor confidence. Additionally, if we fail to identify and correct any significant deficiencies or material weaknesses in the design or operating effectiveness of our internal control over financial reporting or fail to prevent fraud, current and potential stockholders and depositors could lose confidence in our financial reporting, which could adversely affect our business, financial condition and results of operations, the trading price of our stock and our ability to attract additional deposits.

Severe weather, natural disasters, pandemics, and other external events could significantly impact our business.

Severe weather, including tornadoes, droughts, hailstorms and other natural disasters, pandemics, such as the outbreak of COVID-19, acts of war or terrorism and other adverse external events could have a significant impact on our ability to conduct business. Such events could affect the stability of our deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue or cause us to incur additional expenses. Operations in our markets could be disrupted by both the evacuation of large portions of the population as well as damage or lack of access to our banking and operation facilities. Geopolitical relations and events, including international trade relations and global military conflicts, may increase volatility in commodity and energy prices, create supply chain issues and cause instability in financial markets, which may adversely affect us and our clients. Although management has established business continuity plans and procedures, the occurrence of any such events could have a material adverse effect on our business, financial condition and results of operations.

Climate change and responses to climate change may adversely impact our business, financial condition and results of operations.

Concerns over the long-term impacts of climate change have led and may continue to lead to governmental efforts to mitigate those impacts. Consumers and businesses are also changing their behavior and business preferences as a result of these concerns. New governmental regulations or guidance relating to climate change, as well as changes in consumers' and businesses' behaviors

16

and business preferences, may cause us and our customers to experience cost increases, asset value reductions, operating process changes and delays in completion of projects. To the extent that climate change and responses to climate change negatively impact the businesses and financial condition of our customers, the credit risk associated with loans and other credit exposures to those customers may increase. In addition, weather events related to climate change could adversely affect our business and the businesses of our customers.

Risks Relating to Our Regulatory Environment

We may be adversely affected by changes in laws and regulations affecting the financial services industry.

Banks and bank holding companies such as the Company are subject to regulation by both federal and state bank regulatory agencies. The regulations, which are designed to protect bank customers and promote certain social policies, include limitations on the operations of banks and bank holding companies, such as minimum capital requirements and restrictions on dividend payments. The regulatory authorities have extensive discretion in connection with their supervision and enforcement activities and their examination policies, including the imposition of restrictions on the operation of a bank, the classification of assets by an institution and requiring an increase in a bank's allowance for credit losses. These regulations are not necessarily designed to maximize the profitability of banking institutions. Future changes in the banking laws and regulations and tax and accounting rules applicable to financial institutions could have a material adverse effect on the operations and financial condition of the Company and the Bank.

As a financial holding company, we are subject to extensive regulation and supervision and undergo periodic examinations by our regulators, who have extensive discretion and authority to prevent or remedy unsafe or unsound practices or violations of law by banks and financial holding companies. Failure to comply with applicable laws, regulations or policies could result in sanctions by regulatory agencies, civil monetary penalties and/or damage to our reputation, which could have a material adverse effect on us. Although we have policies and procedures designed to mitigate the risk of any such violations, there can be no assurance that such violations will not occur.

Current or proposed regulatory or legislative changes to laws applicable to the financial industry may impact the profitability of our business activities and may change certain of our business practices, including our ability to offer new products, obtain financing, attract deposits, make loans and achieve satisfactory interest spreads, and could expose us to additional costs, including increased compliance costs. In addition, political developments, including the possible implementation of policies proposed by the current presidential administration, including tariffs, mass deportations and tax or financial regulations or the appointment of new personnel in regulatory agencies, add uncertainty to the implementation, scope and timing of regulatory reforms. These changes may also require us to invest significant management attention and resources to make any necessary changes to operations in order to comply and could therefore materially and adversely affect our business, financial condition and results of operations.

The Federal Reserve may require the Company to commit capital resources to support the Bank.

As a matter of policy, the Federal Reserve expects a bank holding company to act as a source of financial and managerial strength to its subsidiary banks. The Federal Reserve may charge the bank holding company with engaging in unsafe and unsound practices for failure to adequately commit resources to a subsidiary bank. Accordingly, we may be required to make capital injections into a troubled subsidiary bank, even if such contribution creates a detriment to the Company or its stockholders. If we do not have sufficient resources on hand to fund the capital injection, we may be required to borrow funds or raise capital. Any such loans are subordinate in right of payment to deposits and to certain indebtedness of the subsidiary bank. In the event of bankruptcy of the bank holding company, claims based upon any commitments to fund capital injections are entitled to a priority of payment over claims made by general unsecured creditors, including holders of indebtedness. Thus, any borrowings incurred by the Company to make required capital injections to the Bank are difficult and expensive, and will adversely impact our financial condition, results of operations and future prospects.

The short-term and long-term impact of the changing regulatory capital requirements and new capital rules is uncertain.

The Company and the Bank are subject to various regulatory capital requirements. The federal banking agencies have substantially amended the regulatory capital rules applicable to us and the Bank in the past and may do so again in the future. The amendments implement the Basel III Rules and changes required by the Dodd-Frank Act. The amended rules include new minimum risk-based capital and leverage ratios, which became effective in January 2015 (with certain phase-ins), and refined the definition of what constitutes "capital" for purposes of calculating those ratios.

The application of more stringent capital requirements to us and the Bank could, among other things, result in lower returns on invested capital, require the raising of additional capital, and result in regulatory actions if we were to be unable to comply with such requirements. Implementation of changes to asset risk weightings for risk-based capital calculations, items

17

included or deducted in calculating regulatory capital and/or additional capital conservation buffers could result in management modifying its business strategy and could further limit the Company's ability to make distributions, including paying out dividends or buying back shares.

Non-compliance with the USA PATRIOT Act, Bank Secrecy Act, Real Estate Settlement Procedures Act, Truth-in-Lending Act, Community Reinvestment Act, Fair Lending Laws or other laws and regulations could result in fines or sanctions and curtail expansion opportunities.

Financial institutions are required under the USA PATRIOT and Bank Secrecy Acts to develop programs to prevent financial institutions from being used for money-laundering and terrorist activities. Financial institutions are also obligated to file suspicious activity reports with the U.S. Treasury Department's Office of Financial Crimes Enforcement Network if such activities are detected. These rules also require financial institutions to establish procedures for identifying and verifying the identity of customers seeking to open new financial accounts. Failure or the inability to comply with the USA PATRIOT Act and Bank Secrecy Act statutes and regulations could result in fines or penalties, curtailment of expansion opportunities, enforcement actions, intervention or sanctions by regulators and costly litigation or expensive additional controls and systems. During the last few years, several banking institutions have received large fines for non-compliance with these laws and regulations. In addition, the U.S. Government imposed and will continue to expand laws and regulations relating to residential and consumer lending activities that create significant new compliance burdens and financial risks.

Regulations relating to privacy, information security and data protection could increase our costs, affect or limit how we collect and use personal information and adversely affect our business opportunities.

We are subject to various privacy, information security and data protection laws, including requirements concerning security breach notification, and we could be negatively impacted by these laws. For example, our business is subject to the Gramm-Leach-Bliley Act which, among other things: (i) imposes certain limitations on our ability to share non-public personal information about our clients with non-affiliated third parties; (ii) requires that we provide certain disclosures to clients about our information collection, sharing and security practices and afford clients the right to "opt out" of any information sharing by us with non-affiliated third parties (with certain exceptions); and (iii) requires that we develop, implement and maintain a written comprehensive information security program containing safeguards that are appropriate based on our size and complexity, the nature and scope of our activities and the sensitivity of client information we process, as well as plans for responding to data security breaches. Many state and federal banking regulators, states and foreign countries have also enacted data security breach notification requirements with varying levels of individual, consumer, regulatory or law enforcement notifications in certain circumstances in the event of a security breach. Moreover, legislators and regulators in the U.S. and other countries are increasingly adopting or revising privacy, information security and data protection laws that potentially could have a significant impact on our current and planned privacy, data protection and information security-related practices, our collection, use, sharing, retention and safeguarding of client or employee information, and some of our current or planned business activities. This could also increase our costs of compliance and business operations and could reduce income from certain business initiatives. This includes increased privacy-related enforcement activity at the federal level by the Federal Trade Commission, as well as at the state level.

Compliance with any current or future laws and regulations noted above (including those regarding security breach notification) could result in higher compliance costs and could restrict our ability to provide certain products and services, which could have a material adverse effect on our business, financial conditions or results of operations. Our failure to comply with any such laws could result in potentially significant regulatory or governmental investigations or actions, litigation, fines, sanctions and damage to our reputation, which could have a material adverse effect on our business, financial condition or results of operations.

The Company is subject to a number of federal and state laws and regulations requiring notifications and disclosures regarding certain cybersecurity incidents, which could be triggered as a result of incidents discussed above. In addition, the Company must consider and address cybersecurity considerations as part of its risk management processes. See Item 1C. Cybersecurity for additional information.

We are subject to numerous laws designed to protect consumers, including the Community Reinvestment Act and fair lending laws, and failure to comply with these laws could lead to a wide variety of sanctions.

The Community Reinvestment Act, the Equal Credit Opportunity Act, the Fair Housing Act and other fair lending laws and regulations impose nondiscriminatory lending requirements on financial institutions. The U.S. Department of Justice and other federal agencies are responsible for enforcing these laws and regulations. A successful regulatory challenge to an institution's performance under the Community Reinvestment Act or fair lending laws and regulations could result in a wide variety of sanctions, including damages and civil money penalties, injunctive relief, restrictions on mergers and acquisitions activity,

18

restrictions on expansion and restrictions on entering new business lines. Private parties may also have the ability to challenge an institution's performance under fair lending laws in private class action litigation. Such actions could have a material adverse effect on our business, financial condition, results of operations and future prospects. We may be subject to liability for potential violations of predatory lending laws, which could adversely impact our results of operations, financial condition and business.

We are subject to a number of other laws and regulations, which may adversely affect the operation of our business and increase our costs.

We are extensively regulated under U.S. federal and state law and are subject to a number of laws and regulations in addition to banking laws and regulations, including securities, insurance and tax laws and regulations. As a company whose stock is publicly traded, we are subject to various federal and state securities laws, including the Securities Act of 1933, as amended, the Exchange Act and the Sarbanes-Oxley Act of 2002, and we file periodic reports with the Securities and Exchange Commission. In addition, because our common stock is listed with The Nasdaq Stock Market LLC, we are subject to the listing rules of that exchange. The Company and its subsidiaries are subject to federal and state income taxes and Missouri franchise taxes and are potentially subject to audits by the Internal Revenue Service and state income and franchise tax examinations by the Missouri Department of Revenue. Any failure by us to comply with any laws or regulations, any change in such laws or regulations or the position of any regulatory agency with respect thereto, or any adverse result in any regulatory investigation or examination, including any tax audit or examination, could adversely affect our business, financial condition and results of operations.

Technology and Vendor Risks

We are subject to security and operational risks relating to our use of technology that could damage our reputation and our business.

We rely heavily on communications and information systems to conduct our business. Furthermore, we have access to large amounts of confidential financial information and control substantial financial assets, including those belonging to our customers, to whom we offer remote access, and we regularly transfer substantial financial assets by electronic means. Our operations are dependent upon our ability to protect our computer equipment against damage from physical theft, fire, power loss, telecommunications failure or a similar catastrophic event, as well as from security breaches, denial of service attacks, viruses, worms and other disruptive problems caused by hackers. Any failure, interruption or breach in security of our systems could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on our financial condition and results of operations. Although we intend to continue to implement security technology and establish operational procedures to prevent such damage, our security measures may not be successful.

In addition, advances in computer capabilities, new discoveries in the field of cryptography or other developments could result in a compromise or breach of the algorithms we and our third-party service providers use to encrypt and protect customer transaction data. A failure of such security measures could have a material adverse effect on our financial condition and results of operations. We also face the risk of operational disruption, failure, termination or capacity constraints caused by third parties that facilitate our business activities by providing technology such as software applications, as well as financial intermediaries. Such parties could also be the source of an attack on, or breach of, our operational systems, data or infrastructure.

We also face the potential risk of loss due to fraud, including commercial checking account fraud, automated teller machine ("ATM") skimming and trapping, write-offs necessitated by debit card fraud, and other forms of online banking fraud, which are becoming more sophisticated and present new challenges as mobile banking increases, as well as employee fraud. Employee errors could also subject us to financial claims for negligence. We maintain a system of internal controls and insurance coverage to mitigate against operational risks, including data processing system failures and errors and customer or employee fraud. Should our internal controls fail to prevent or detect an occurrence, and if any resulting loss is not insured or exceeds applicable insurance limits, such failure could have a material adverse effect on our business, financial condition and results of operations.

The operation of our business, including customer interaction, is increasingly done via electronic means, and this has increased our risks related to cybersecurity.

We rely on the successful and uninterrupted functioning of our information technology and telecommunications systems to conduct our business. This includes internally developed systems, the systems of third-party service providers, and digital and mobile technologies. Any failure, interruption or breach in security of these systems could result in failures or disruptions in our customer relationship management, general ledger, deposit, loan and other systems, and could damage our reputation, result in loss of customer business, subject us to regulatory scrutiny, or expose us to civil litigation and possible financial liability. We are exposed to the risk of cyber-attacks in the normal course of business, which can result from deliberate attacks or unintentional events. We have observed an increased level of attention in the industry focused on cyber-attacks that include, but are not limited

19

to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data, or causing operational disruption. Cyber-attacks may also be carried out in a manner that does not require gaining unauthorized access, such as by causing denial-of-service attacks on websites. Cyber-attacks may be carried out by third parties or insiders using techniques that range from highly sophisticated efforts to electronically circumvent network security or overwhelm websites to more traditional intelligence gathering and social engineering aimed at obtaining information necessary to gain access. The objectives of cyber-attacks vary widely and can include theft of financial assets, intellectual property, or other sensitive information, including the information belonging to our banking customers. Cyber-attacks may also be directed at disrupting our operations.

We may incur substantial costs and suffer other negative consequences if we fall victim to successful cyber-attacks. Such negative consequences could include remediation costs that may include liability for stolen assets or information and repairing system damage that may have been caused; increased cybersecurity protection costs that may include organizational changes, deploying additional personnel and protection technologies, training employees, and engaging third party experts and consultants; lost revenues resulting from unauthorized use of proprietary information or the failure to retain or attract customers following an attack; litigation; and reputational damage adversely affecting customer or investor confidence.

We continually encounter technological change, and we cannot predict how changes in technology will affect our business.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology driven by products and services, which include developments in:

•telecommunications;

•data processing;

•automation;

•internet-based banking;

•telebanking; and

•debit cards and so-called "smart cards."

The effective use of technology increases efficiency and enables financial institutions to better serve customers and to reduce costs. Our future success depends, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology driven products and services or be successful in marketing these products and services to our customers. Failure to successfully keep pace with technological change affecting the financial services industry could have a material adverse impact on our business and, in turn, our financial condition and results of operations.

The development and use of artificial intelligence presents risks and challenges that may adversely impact our business.

The Company or its third-party (or fourth party) vendors, clients or counterparties may develop or incorporate artificial intelligence ("AI") technology in certain business processes, services, or products. The development and use of AI presents risks and challenges to the Company’s business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving, both in the U.S. and internationally, and includes regulatory schemes targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment, and other laws applicable to the use of AI. These evolving laws and regulations could require changes in the Company’s implementation of AI technology and increase the Company’s compliance costs and the risk of non-compliance. AI models, particularly generative AI models, may produce output or take action that is incorrect, that reflects biases included in the data on which they are trained, that results in the release of private, confidential, or proprietary information, that infringes on the intellectual property rights of others, or that is otherwise harmful. In addition, the complexity of many AI models makes it difficult to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output, eliminating bias, and complying with regulations that require documentation or explanation of the basis on which decisions are made. Further, the Company may rely on AI models developed by third parties, and, to that extent, would be dependent in part on the manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which the Company may have limited visibility. Any of these risks could expose the Company to liability or adverse legal or regulatory consequences and harm the Company’s reputation and the public perception of its business or the effectiveness of its security measures.

20

We rely on others to provide key components of our business infrastructure.

Third-party vendors provide key components of our business infrastructure such as internet connections, network access and core application processing. While we have selected these third-party vendors carefully, we do not control their actions. If these third-party vendors experience financial, operational or technological difficulties, perform their services poorly or terminate their services, and we are unable to replace them with other service providers, our operations could be interrupted. Any problems caused by these third parties, including as a result of their not providing us their services for any reason or their performing their services poorly, could adversely affect our ability to deliver products and services to our customers or otherwise conduct our business efficiently and effectively. If a service interruption were to continue for a significant period of time, our business, financial condition and results of operations could be adversely affected, perhaps materially. Replacing these third-party vendors could also entail significant delay and additional expenses.

Risks Related to Our Common Stock

The price of our common stock could fluctuate significantly, and this could make it difficult for you to resell shares of our common stock at times or at prices you find attractive.

The stock market and, in particular, the market for financial institution stocks, has experienced significant volatility during the recent changes in economic and industry conditions. In some cases, the markets have produced downward pressure on stock prices for certain issuers without regard to those issuers' underlying financial strength. As a result, the trading volume in our common stock could fluctuate more than usual and cause significant price variations to occur. This could make it difficult for you to resell shares of our common stock at times or at prices you find attractive.

The trading price of the shares of our common stock will depend on many factors that could change from time to time and could be beyond our control. Among the factors that could affect our stock price are those identified under the heading "Forward-Looking Statements" in Item 7, Management's Discussion and Analysis of Financial Condition and Results of Operations, of this report and as follows:

•actual or anticipated quarterly fluctuations in our operating results and financial condition;

•changes in financial estimates or publication of research reports and recommendations by financial analysts or actions taken by rating agencies with respect to our common stock or those of other financial institutions;

•failure to meet analysts' revenue or earnings estimates;

•speculation in the press or investment community generally or relating to our reputation, our market area, our competitors or the financial services industry in general;

•strategic actions by us or our competitors, such as acquisitions, restructurings, dispositions or financings;

•actions by our current stockholders, including sales of common stock by existing stockholders and/or directors and executive officers;

•fluctuations in the stock price and operating results of our competitors;

•future sales of our equity, equity-related or debt securities;

•changes in the frequency or amount of dividends or share repurchases;

•proposed or adopted regulatory changes or developments;

•investigations, proceedings or litigation that involve or affect us;

•trading activities in our common stock, including short-selling;

•domestic and local economic factors unrelated to our performance; and

•general market conditions and, in particular, developments related to market conditions for the financial services industry.

A significant decline in our stock price could result in substantial losses for individual stockholders and could lead to costly and disruptive securities litigation.

The trading volume in our common stock has been low, and the sale of a substantial number of shares of our common stock in the public market could depress the price of our common stock and make it difficult for you to sell your shares.

Our common stock is listed to trade on The Nasdaq Global Select Market but is thinly traded. As a result, you may not be able to sell your shares of common stock on short notice. Additionally, thinly traded stock can be more volatile than stock trading in an active public market. The sale of a substantial number of shares of our common stock at one time could temporarily depress the market price of our common stock, making it difficult for you to sell your shares and impairing our ability to raise capital.

21

Our common stock is not insured by any governmental entity.

Our common stock is not a deposit account or other obligation of any bank and is not insured by the FDIC or any other governmental entity.