Investar Holding Corp (ISTR) Business

Item 1. Business

General

Investar Holding Corporation, a Louisiana corporation incorporated in 2009, is a financial holding company headquartered in Baton Rouge, Louisiana that conducts its operations primarily through its wholly-owned subsidiary, Investar Bank, National Association, a national bank chartered by the OCC. The Bank was originally chartered as a Louisiana commercial bank in 2006 and converted to a national bank in July 2019. Through the Bank, the Company offers a wide range of commercial banking products tailored to meet the needs of individuals, professionals, and small to medium-sized businesses. Our primary areas of operation are south Louisiana, including Baton Rouge, New Orleans, Lafayette, Lake Charles, and their surrounding areas; Texas, including Houston and its surrounding area, and, as of January 1, 2026, north Dallas and Wichita Falls and their surrounding areas; and Alabama, including York and Oxford and their surrounding areas. These markets are served from our executive and operations center located in Baton Rouge and from 36 full-service branches located throughout our market areas. We have experienced significant growth since the Bank was chartered, completing eight whole-bank acquisitions and establishing additional branches in our market areas.

As of December 31, 2025, on a consolidated basis, the Company had total assets of $2.8 billion, net loans of $2.1 billion, total deposits of $2.4 billion, and stockholders’ equity of $301.1 million.

Our strategy focuses on consistent, quality earnings through the optimization of our balance sheet by originating and renewing high quality, primarily variable-rate, loans and allowing higher risk credit relationships to run off. Our strategy also includes growth through acquisitions, including whole-bank acquisitions, strategic branch acquisitions and asset acquisitions. Over time, management believes that we have significant opportunities for growth and franchise expansion, both organically and through strategic acquisitions. Although the financial services industry is rapidly changing and intensely competitive, and likely to remain so, we believe that the Bank competes effectively as a local community bank and possesses the availability of local access and responsive customer service, coupled with competitively-priced products and services, necessary to successfully compete with other financial institutions for individual and small to medium-sized business customers.

All cross-references to the “Notes” in this Form 10-K refer to the Notes to Consolidated Financial Statements contained in Item 8. Financial Statements and Supplementary Data. The information set forth in this Annual Report on Form 10-K is as of March 16, 2026, unless otherwise indicated herein.

Operations

General. We offer a full range of commercial and retail lending products throughout our market areas, including business loans to small to medium-sized businesses as well as loans to individuals. Our business lending products include owner-occupied commercial real estate loans, construction loans and commercial and industrial loans, such as term loans, equipment financing and lines of credit, while our loans to individuals include first and second mortgage loans, installment loans, and lines of credit. For business customers, we target small to medium-sized businesses and professional organizations such as law firms, accounting firms and medical practices.

Management considers all of our operations to be aggregated in one reportable operating segment. For additional information regarding segment reporting, see Note 1. Summary of Significant Accounting Policies – Segment Reporting.

Lending Activities. Income generated by our lending activities represents a substantial portion of our total revenue. For the years ended December 31, 2025, 2024 and 2023, income from our lending activities comprised 83%, 81% and 84%, respectively, of our total revenue. Over the last three fiscal years, we have increased our focus on commercial real estate loans and commercial and industrial loans.

5

Table of Contents

Lending to Businesses. Our lending to small to medium-sized businesses falls into three general categories for the years ended December 31, 2025, 2024 and 2023:

Construction lending entails significant additional risks compared to commercial real estate or residential real estate lending due to the dynamics of construction projects, changes in interest rates, the long-term financing market, and state and local government regulations. One such risk is that loan funds are advanced upon the security of the property under construction, which is of uncertain value prior to the completion of construction. Thus, it is more difficult to accurately evaluate the total loan funds required to complete a project and to calculate related loan-to-value ratios. We attempt to minimize the risks associated with construction lending by limiting loan-to-value ratios as described above. In addition, as to speculative development loans, we generally make such loans only to borrowers that have a positive pre-existing relationship with us. We also manage risk by using specific underwriting policies and procedures for these types of loans and by avoiding concentrations in any one business or industry.

6

Table of Contents

Lending to Individuals. We make the following types of loans to our individual customers:

Deposits. We offer a broad base of deposit products and services to our individual and business clients, including savings, checking, and money market accounts, as well as a variety of certificates of deposit and individual retirement accounts. We also offer a reciprocal deposit product, Assured Checking, that allows customers to deposit funds in excess of the FDIC’s $250,000 insurance limit and have the funds insured by the FDIC. We offer debit cards, internet banking, mobile banking with smartphone deposit capability as well as debit card protection settings. For our business clients, we offer a competitive suite of treasury management products which include, but are not limited to, remote deposit capture, virtual vaults, positive pay, Automated Clearing House origination, credit card processing, wire transfer, investment sweep accounts, and enhanced business internet banking.

Other Banking Services. The Bank’s other banking services include cashiers’ checks, direct deposit of payroll and Social Security checks, night depository, bank-by-mail, ATMs with deposit automation, debit cards, corporate credit cards, mobile wallet payment options, electronic statements, electronic banking for consumer and business customers, and Zelle® for consumers. In addition, the Bank has options for contactless banking, including ITMs and online account opening. ITMs are an upgrade on traditional ATM technology that allow customers to virtually interact directly with Bank staff. Online account opening allows a consumer to open a number of available checking, savings, and certificate of deposit accounts online. The Bank does not offer trust services or insurance products.

7

Table of Contents

Acquisition Activity

General. From time to time we evaluate potential acquisition opportunities including whole-bank acquisitions and strategic branch acquisitions. We believe there are many banking institutions that continue to face credit challenges, capital constraints and liquidity issues and that lack the scale and management expertise to manage the increasing regulatory burden. Our management team has a long history of identifying targets, assessing and pricing risk and executing acquisitions in a creative, yet disciplined, manner. We seek acquisitions that provide meaningful financial benefits, long-term organic growth opportunities and expense reductions, without compromising our risk profile. Additionally, we seek banking markets with favorable competitive dynamics and potential consolidation opportunities.

Recent Acquisitions. All of our acquisition activity is evaluated and overseen by a standing Mergers and Acquisitions Committee of our Board. Acquisitions completed since January 1, 2023 are discussed below.

Acquisition of Wichita Falls Bancshares, Inc. On January 1, 2026, the Company completed its acquisition of WFB and its wholly-owned subsidiary, FNB, headquartered in Wichita Falls, Texas with six additional branches serving the surrounding areas. All of the issued and outstanding shares of WFB common stock were converted into aggregate merger consideration consisting of $7.2 million in cash and 3,955,272 shares of Company common stock for an aggregate transaction value of $112.9 million. This value is based on the Company’s closing stock price on December 31, 2025 of $26.72 per common share. On the date of the acquisition, WFB had $1.2 billion in total assets, including $1.0 billion in gross loans, and $1.0 billion in deposits. The Company is currently evaluating the fair value of the acquired assets and liabilities assumed that will be recorded in the consolidated financial statements.

Divestiture and Sale or Closure Activity

Sale of Two Branches to First Community Bank. On January 27, 2023, the Bank sold certain assets, deposits and other liabilities associated with its Alice and Victoria, Texas locations to First Community Bank, a Texas state bank located in Corpus Christi, Texas. The Bank sold approximately $13.9 million in loans and $14.5 million in deposits.

Branch Closures and Land Sales. During the last three fiscal years, we closed two branches. One of the branches had been acquired, and the closures involved anticipated synergies that resulted in significant cost savings. We continue to evaluate opportunities to reduce our physical branch footprint and further improve efficiency through digital initiatives.

De Novo Branches or Conversion Activity

In the fourth quarter of 2024, we converted an existing loan and deposit production office in our Texas market to a full-service branch location. In the third quarter of 2023, we converted an existing loan and deposit production office in our Alabama market to a cashless branch designed to provide a digital banking experience. We do not expect to open de novo branches in 2026.

Competition

We face competition in all major product and geographic areas in which we conduct our operations. Through the Bank, we compete for available loans and deposits with state, regional and national banks, as well as savings and loan associations, credit unions, finance companies, mortgage companies, insurance companies, brokerage firms and investment companies. All of these institutions compete in the delivery of services and products through availability, quality and pricing, both with respect to interest rates on loans and deposits and fees charged for banking services. Many of our competitors are larger and have substantially greater resources than we do, including higher total assets and capitalization, greater access to capital markets, and a broader offering of financial services. As larger institutions, many of our competitors can offer more attractive pricing than we can offer and have more extensive branch networks from which they can offer their financial services products.

8

Table of Contents

While we continually strive to offer competitive pricing for our banking products, we believe that our community bank approach to customers, focusing on quality customer service, and maintaining strong customer relationships affords us the best opportunity to successfully compete with other institutions. In addition, as a smaller institution, we think we can be flexible in developing and implementing new products and services. Further, in recent years there has been consolidation activity involving banks with a presence in our markets. In our view, mergers and other business combinations within our markets provide us with growth opportunities. Many acquisitions, especially when local institutions are acquired by institutions based outside our markets, result not only in customer disruption, but also in a loss of market knowledge and relationships that we believe provide us the opportunity to acquire customers seeking a personalized approach to banking. Furthermore, acquisition activity typically creates opportunities to hire talented personnel from the combining institutions.

The following table sets forth certain information about our total deposits, and our share of total deposits, in specified locations, and is shown as of June 30, 2025, which is the latest date for which such information is available.

Supervision and Regulation

General. Banking is highly regulated under federal and state law. The following is a brief summary of certain aspects of that regulation that are material to us and does not purport to be a complete description of all regulations that affect us or all aspects of those regulations. To the extent particular statutory and regulatory provisions are described, the description is qualified in its entirety by reference to the particular statute or regulation.

We are a financial holding company registered under the Bank Holding Company Act of 1956, as amended, and are subject to supervision, regulation and examination by the Federal Reserve. The Bank is a national bank chartered under the laws of the U.S. by the OCC and is subject to supervision, regulation and examination by the OCC. This system of supervision and regulation establishes a comprehensive framework for our operations and, consequently, can have a material impact on our growth and earnings performance.

The primary goals of the bank regulatory scheme are to maintain a safe and sound banking system and to facilitate the conduct of sound monetary policy. This system is intended primarily for the protection of the FDIC’s deposit insurance funds, bank depositors, and the public, rather than our shareholders and creditors. The banking agencies have broad enforcement power over bank holding companies and banks, including the authority, among other things, to enjoin “unsafe or unsound” practices, require affirmative action to correct any violation or practice, issue administrative orders that can be judicially enforced, direct increases in capital, direct the sale of subsidiaries or other assets, limit dividends and distributions, restrict growth, assess civil monetary penalties, remove officers and directors, and, with respect to banks, terminate deposit insurance or place the bank into conservatorship or receivership. In general, these enforcement actions may be initiated for violations of laws and regulations or unsafe or unsound practices.

The Dodd-Frank Act. The Dodd-Frank Act, enacted on July 21, 2010, and regulations adopted pursuant to it, significantly altered the regulation of financial institutions and the financial services industry.

9

Table of Contents

The Dodd-Frank Act, among other things:

Some of these provisions have had and may continue to have the consequence of increasing our expenses, decreasing our revenues, and changing our operations.

Certain aspects of the Dodd-Frank Act are subject to ongoing implementation (such as the final rulemaking discussed below on small business lending data collection); further, in the past certain provisions implemented by federal agencies have been legislatively revised or rescinded, and Congress may do so again in the future. Additionally, the future implementation and enforcement of regulations may be affected by the current administration, which has made significant changes in the leadership of the various bank regulatory agencies and may continue to do so.

In early February 2025, the CFPB’s Acting Director issued directives to cease virtually all CFPB activities, including supervision, examinations, rulemaking, enforcement actions, and pending investigations. Since this time, the CFPB has remained largely dormant with limited rulemaking issuances or other activity. In November 2025, the Acting Director notified a federal court that the CFPB cannot request funds from the Federal Reserve under Dodd-Frank to fund its operations pursuant to a legal opinion issued by the Department of Justice’s Office of Legal Counsel. In December 2025, the federal court rejected this legal interpretation. In January 2026, the Acting Director notified the federal court that he had requested funding from the Federal Reserve to fund its operations for the first quarter of 2026. We cannot predict when or how these matters involving the CFPB will be resolved.

While we cannot predict what effect any presently contemplated or future changes in the laws or regulations, their interpretations or enforcement would have on us, these changes could be materially adverse to our financial condition and results of operations.

Small Business Lending Data Collection and Reporting. On March 30, 2023, the CFPB issued a final rule implementing Section 1071 of the Dodd-Frank Act. The final rule requires financial institutions to collect and report data to the CFPB on small business loan applicants, including demographic data, lending decisions and the price and terms of credit. The purpose of the rulemaking is to increase transparency and combat discrimination in small business lending. The CFPB issued a Notice of Proposed Rulemaking in November 2025 that would make certain changes to the rule, including reducing the number of data points banks must collect and report as well as extending the compliance deadline to January 1, 2028.

Open Banking Rule. On October 22, 2024, the CFPB issued its final rule implementing Section 1033 of the Dodd-Frank Act with respect to personal financial data rights, more commonly known as the “Open Banking Rule.” The final rule, among other things, requires banks, credit unions, and other financial service providers to make a consumer’s data available upon request to the consumer and their authorized third parties in a secure and reliable manner, and establishes obligations for third parties accessing consumers’ data, including data security and privacy protections. According to the CFPB, the rule is designed to foster competition and innovation in the financial services industry by making it easier for consumers to switch financial providers and for new companies to offer innovative products and services. The rule is in a current state of flux as a federal court has issued a preliminary injunction prohibiting the CFPB from enforcing the rule until the CFPB can complete its reconsideration of the rule. In August 2025, the CFPB issued an advance notice of proposed rulemaking seeking comments as it evaluates issuing a proposed rule that would replace the current rule.

Interchange Fees. As noted above, the Dodd-Frank Act directed the Federal Reserve to establish interchange fees for debit cards under a restrictive “reasonable and proportional cost” per transaction standard (known as the “Durbin Amendment”). The Federal Reserve issued final rules implementing the Durbin Amendment in 2011, which capped interchange fees on debit cards. In October 2023, the Federal Reserve requested comment on a proposal to significantly lower the maximum interchange fee that a debit card issuer can receive for a debit card transaction. The proposed rule also includes a process that would result in automatic revisions to the interchange fee cap every two years without public comment. The proposed rule is pending and has not been finalized. While the current interchange fee cap on debit cards are, and the proposed rules would be only applicable to banks with over $10 billion in total assets, banks with under $10 billion in total assets such as the Bank could potentially indirectly face fee pressure in operating debit card programs should the proposal be adopted in its current form.

The Volcker Rule. On December 10, 2013, the Federal Reserve and the other federal banking regulators as well as the SEC each adopted a final rule implementing Section 619 of the Dodd-Frank Act, commonly referred to as the “Volcker Rule.” Generally speaking, the final rule prohibited a bank and its affiliates from engaging in proprietary trading and from sponsoring certain “covered funds” or from acquiring or retaining any ownership interest in such covered funds. Most private equity, venture capital and hedge funds are considered “covered funds” as are bank trust preferred collateralized debt obligations. The final rule required banking entities to divest disallowed securities by July 21, 2015, subject to extension upon application. The Economic Growth, Regulatory Relief, and Consumer Protection Act that was enacted in 2018 amended Section 619 of the Dodd-Frank Act to exempt from the Volcker Rule any insured depository institution that has $10.0 billion or less in total consolidated assets and whose total trading assets and trading liabilities are 5.0% or less of total consolidated assets; therefore, the Bank is currently exempt from the Volcker Rule.

Brokered Deposits. The Bank has increased its level of brokered deposits in recent years. FDIC regulations governing brokered deposits (which apply to all insured depository institutions) define the term “brokered deposit” as “any deposit that is obtained, directly or indirectly, from or through the mediation or assistance of a ‘deposit broker.’” Generally, the banking agencies view brokered deposits as a more volatile funding source than core deposits. Only well-capitalized banks are permitted to accept, renew or roll over brokered deposits without a waiver from the FDIC (which historically has been challenging to obtain). On July 30, 2024, the FDIC issued a notice of proposed rulemaking that, among other things, would revise the brokered deposit rule to expand the types of deposits that fall within the definition of brokered deposit. The FDIC’s new leadership withdrew this proposed rule on March 3, 2025.

10

Table of Contents

Regulatory Capital Requirements

Capital Adequacy. The Federal Reserve Board monitors the capital adequacy of the Company, on a consolidated basis, and the OCC monitors the capital adequacy of the Bank. The regulatory agencies use a combination of risk-based guidelines and a leverage ratio to evaluate capital adequacy and consider these capital levels when taking action on various types of applications and when conducting supervisory activities related to safety and soundness. The risk-based capital standards are designed to make regulatory capital requirements more sensitive to differences in risk profiles among financial institutions and their holding companies, to account for off-balance sheet exposure, and to minimize disincentives for holding liquid assets. A financial institution’s assets and off-balance sheet items, such as letters of credit and unfunded loan commitments, are assigned to broad risk categories, each with appropriate risk weights. Regulatory capital, in turn, is classified in one of two tiers. “Tier 1” capital includes two components: (1) common equity Tier 1 capital and (2) additional Tier 1 capital. Common equity Tier 1 capital consists solely of common stock (plus related surplus), retained earnings and limited amounts of minority interests that are in the form of common stock. Additional Tier 1 capital includes other perpetual instruments historically included in Tier 1 capital, such as non-cumulative perpetual preferred stock. “Tier 2” capital includes, among other things, qualifying subordinated debt and allowances for credit losses, subject to limitations. The resulting capital ratios represent capital as a percentage of total risk-weighted assets and off-balance sheet items. Pursuant to the regulatory capital rules, the Company has made an election not to include unrealized gains and losses in the investment securities portfolio for purposes of calculating “Tier 1” capital and “Tier 2” capital.

Under the current regulatory framework, we are required to maintain the following minimum regulatory capital ratios:

In addition to these minimum regulatory capital ratios, the regulations establish a capital conservation buffer with respect to the first three capital ratios listed above. Specifically, banking organizations must hold common equity Tier 1 capital in excess of their minimum risk-based capital ratios by at least 2.5% of risk-weighted assets in order to avoid limits on capital distributions (including dividend payments, discretionary payments on Tier 1 instruments, and stock buybacks) and certain discretionary bonus payments to executive officers. Thus, when including the 2.5% capital conservation buffer, a bank holding company and bank’s minimum ratio of common equity Tier 1 capital to total risk-weighted assets becomes 7%, its minimum ratio of Tier 1 capital to total risk-weighted assets becomes 8.5%, and its minimum ratio of total capital to total risk-weighted assets becomes 10.5%.

We were in compliance with all applicable minimum regulatory capital requirements, including the capital conservation buffer, as of December 31, 2025.

The required capital ratios set forth above are minimums, and the Federal Reserve and the OCC may determine that a banking organization, based on its size, complexity or risk profile, must maintain a higher level of capital in order to operate in a safe and sound manner. Risks such as concentration of credit risks and the risk arising from non-traditional activities, as well as the institution’s exposure to a decline in the economic value of its capital due to changes in interest rates, and an institution’s ability to manage those risks are important factors that are to be taken into account by the federal banking agencies in assessing an institution’s overall capital adequacy.

The federal banking agencies finalized a rule in 2019 that allows bank holding companies and banks with less than $10.0 billion in total consolidated assets, limited amounts of certain assets and off-balance sheet exposures, and a leverage ratio of greater than 9% to elect to use the CBLR framework. A community banking organization electing to use the CBLR framework would have a simplified capital regime and would be considered well-capitalized as long as it had a leverage ratio of greater than 9%. The federal banking agencies issued a notice of proposed rulemaking in December 2025 that would, among other things, lower the 9% leverage ratio requirement to 8%. We have not elected to use the CBLR framework, and it is uncertain if we will elect to use the CBLR framework in the future.

Furthermore, U.S. federal banking agencies’ rules permit bank holding companies and banks to phase-in, for regulatory capital purposes, the day-one impact of the CECL accounting rule in retained earnings over a period of three years commencing with time of adoption of the standard. We adopted the CECL accounting rule effective January 1, 2023. We did not make the election to phase in the impact of the CECL accounting rule on our regulatory capital calculations because the adoption did not have a significant impact on our regulatory capital ratios. For further discussion of the new CECL accounting rule, see Note 1. Summary of Significant Accounting Policies – Allowance for Credit Losses, and also see “Our allowance for credit losses may prove to be insufficient to absorb losses inherent in our loan portfolio, and we may be required to further increase our provision for credit losses. If our actual credit losses exceed our allowance for credit losses, our net income will decrease.” in Item 1A. Risk Factors.

11

Table of Contents

Prompt Corrective Action Regulations. Under the prompt corrective action regulations, the OCC is required and authorized to take supervisory actions against undercapitalized banks. For this purpose, a bank is placed in one of the following five categories based on its capital: well-capitalized, adequately capitalized, undercapitalized, significantly undercapitalized, and critically undercapitalized. Under the prompt corrective action regulations, as currently in effect, to be well-capitalized, a bank must have a leverage capital ratio of at least 5%, a common equity Tier 1 capital ratio of at least 6.5%, a Tier 1 risk-based capital ratio of at least 8%, and a total risk-based capital ratio of at least 10%, and must not be subject to any order or written agreement or directive by a federal banking agency to meet and maintain a specific capital level for any capital measure.

Federal banking regulators are required to take various mandatory supervisory actions and are authorized to take other discretionary actions with respect to banks in the three undercapitalized categories that, if undertaken, could have a material adverse effect on the bank's operations or financial condition. The severity of the action depends upon the capital category in which the bank is placed. Generally, subject to a narrow exception, banking regulators must appoint a receiver or conservator for a bank that is critically undercapitalized. The federal banking agencies have specified by regulation the relevant capital level for each category. A bank that is categorized as undercapitalized, significantly undercapitalized, or critically undercapitalized is required to submit an acceptable capital restoration plan to its appropriate federal banking agency. An undercapitalized bank also is generally prohibited from increasing its average total assets, making acquisitions, establishing any branches or engaging in any new line of business, except under an accepted capital restoration plan or with OCC approval. The regulations also establish procedures for downgrading a bank to a lower capital category based on supervisory factors other than capital. Additionally, only a well-capitalized depository bank may accept or renew brokered deposits without prior regulatory approval and banks that are less than well-capitalized are subject to restrictions on the interest rates that can be paid on deposits.

Furthermore, a bank holding company must guarantee that a subsidiary depository institution meets its capital restoration plan, subject to various limitations. The controlling holding company’s obligation to fund a capital restoration plan is limited to the lesser of 5% of an undercapitalized subsidiary’s assets at the time it became undercapitalized or the amount required to meet regulatory capital requirements.

The capital classification of a bank affects the frequency of regulatory examinations, the bank’s ability to engage in certain activities, and the deposit insurance premiums paid by the bank. As of December 31, 2025, the Bank met the requirements to be categorized as well-capitalized under the prompt corrective action framework as currently in effect.

Acquisitions by Bank Holding Companies

Federal laws, including the Bank Holding Company Act and the Change in Bank Control Act, impose additional prior notice or approval requirements and ongoing regulatory requirements on any investor that seeks to acquire direct or indirect “control” of an FDIC-insured depository institution or bank holding company. We must obtain the prior approval of the Federal Reserve before (1) acquiring more than 5% of the voting stock of any bank or other bank holding company, (2) acquiring all or substantially all of the assets of any bank or bank holding company, or (3) merging or consolidating with any other bank holding company. The Federal Reserve may determine not to approve any of these transactions if it would result in or tend to create a monopoly or substantially lessen competition or otherwise function as a restraint of trade, unless the anti-competitive effects of the proposed transaction are clearly outweighed by the public interest in meeting the convenience and needs of the community to be served. The Federal Reserve is also required to consider the financial and managerial resources and future prospects of the bank holding companies and banks concerned, the convenience and needs of the community to be served, and the record of a bank holding company and its subsidiary bank(s) in combating money laundering activities and their record of CRA performance. In addition, a failure to implement and maintain adequate compliance programs could cause the Federal Reserve or other banking regulators not to approve an acquisition when regulatory approval is required or to prohibit an acquisition even if approval is not required.

If the Bank seeks to acquire another depository institution or branches of another depository institution, it is required to obtain the prior approval of the OCC. In reviewing the application, the OCC will consider, among other things, the Bank’s capital level, its financial and managerial resources and future prospects, the impact of the transaction on the Bank’s safety and soundness, the impact of the transaction on competition in the relevant geographic market, its record in combating money laundering activities, the impact on the convenience and needs of the communities served, and the Bank’s record of Community Reinvestment Act performance.

12

Table of Contents

Scope of Permissible Bank Holding Company Activities

In general, the Bank Holding Company Act limits the activities permissible for bank holding companies to the business of banking, managing or controlling banks, and such other activities as the Federal Reserve has determined to be so closely related to banking as to be properly incident thereto.

A bank holding company may elect to be treated as a financial holding company and receive expanded powers if it and its depository institution subsidiaries are “well-capitalized” and “well managed,” and its subsidiary banks controlled by it have at least a “satisfactory” Community Reinvestment Act rating. We have elected for the Company to be treated as a financial holding company. As a financial holding company, we may engage in a range of activities that are (1) financial in nature or incidental to such financial activity or (2) complementary to a financial activity and that do not pose a substantial risk to the safety and soundness of a depository institution or to the financial system generally. These activities include securities dealing, underwriting and market making, insurance underwriting and agency activities, merchant banking and insurance company portfolio investments. Expanded financial activities of financial holding companies generally will be regulated according to the type of such financial activity: banking activities by banking regulators; securities activities by securities regulators; and insurance activities by insurance regulators.

The Bank Holding Company Act does not place territorial limitations on permissible non-banking activities of bank holding companies. The Federal Reserve has the power to order any bank holding company or its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the Federal Reserve has reasonable grounds to believe that continuation of such activity or such ownership or control constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company.

Source of Strength Doctrine for Bank Holding Companies

Under longstanding Federal Reserve policy that has been codified by the Dodd-Frank Act, we are expected to act as a source of financial strength to, and to commit resources to support, the Bank. This support may be required at times when we may not be inclined to provide it. In addition, any capital loans that we make to the Bank are subordinate in right of payment to deposits and to certain other indebtedness of the Bank. In the event of our bankruptcy, any commitment by us to a federal bank regulatory agency to maintain the capital of the Bank will be assumed by the bankruptcy trustee and entitled to a priority of payment.

Dividends

As a bank holding company, we are subject to certain restrictions on dividends under applicable banking laws and regulations. The Federal Reserve has issued a policy statement that provides that a bank holding company should not pay dividends unless: (1) its net income over the last four quarters (net of dividends paid) has been sufficient to fully fund the dividends; (2) the prospective rate of earnings retention appears to be consistent with the capital needs, asset quality and overall financial condition of the bank holding company and its subsidiaries; and (3) the bank holding company will continue to meet minimum required capital adequacy ratios. Accordingly, a bank holding company should not pay cash dividends that exceed its net income or that can only be funded in ways that weaken the bank holding company’s financial health, such as by borrowing. The Dodd-Frank Act imposes, and Basel III effected, additional restrictions on the ability of banking institutions to pay dividends (including failure to maintain capital above the Basel III capital conservation buffer). The Federal Reserve may further restrict the payment of dividends by engaging in supervisory action to restrict dividends or by requiring us to maintain a higher level of capital than would otherwise be required under any applicable minimum capital requirements.

Our ability to pay dividends depends in part upon the receipt of dividends from the Bank. The Bank is also subject to certain restrictions on dividends under federal laws, regulations and policies. In general, under OCC regulations, the Bank may pay dividends to us without the approval of the OCC only if the amount of the dividend does not exceed the Bank’s net income earned during the current year (net of dividends paid) combined with its retained net income (net of dividends paid) of the immediately preceding two years. The Bank must obtain the approval of the OCC for any amount in excess of this threshold. Further, a national bank may not pay a dividend in excess of its undivided profits. In addition, under federal law, the Bank may not pay any dividend to us if it is undercapitalized or the payment of the dividend would cause it to become undercapitalized. The Bank is also restricted from paying dividends if it fails to maintain capital above the Basel III capital conservation buffer. The OCC may further restrict the payment of dividends by requiring the Bank to maintain a higher level of capital than would otherwise be required to be adequately capitalized for regulatory purposes. Moreover, if, in the opinion of the OCC, the Bank is engaged in an unsound practice (which could include the payment of dividends even within the legal requirements noted above), the OCC may require the Bank to cease such practice. The OCC has indicated that paying dividends that deplete a depository institution’s capital base to an inadequate level would be an unsafe banking practice.

13

Table of Contents

Restrictions on Transactions with Affiliates and Loans to Insiders

Federal law strictly limits the ability of banks to engage in transactions with their affiliates, including their parent bank holding companies. Sections 23A and 23B of the Federal Reserve Act, and Federal Reserve Regulation W, impose quantitative limits, qualitative standards, and collateral requirements on certain transactions by a bank with, or for the benefit of, its affiliates, and generally require those transactions to be on terms at least as favorable to the bank as transactions with non-affiliates and to be consistent with safe and sound practices. The Dodd-Frank Act significantly expanded the coverage and scope of the limitations on affiliate transactions within a banking organization, including an expansion of the types of transactions that are covered transactions to include credit exposures related to derivatives, repurchase agreements and securities lending arrangements and an increase in the amount of time for which collateral requirements regarding covered transactions must be satisfied.

Federal law also limits a bank’s authority to extend credit to its directors, executive officers and 10% shareholders, as well as to entities controlled by such persons. Among other things, extensions of credit to insiders are required to be made on terms that are substantially the same as and follow credit underwriting procedures that are not less stringent than those prevailing for comparable transactions with unaffiliated persons. Also, the terms of such extensions of credit may not involve more than the normal risk of repayment or present other unfavorable features and may not exceed certain limitations on the amount of credit extended to such persons, individually and in the aggregate, which limits are based, in part, on the amount of the bank’s capital.

Incentive Compensation Guidance

The federal banking agencies have issued comprehensive guidance on incentive compensation policies. This guidance is designed to ensure that a financial institution’s incentive compensation structure does not encourage imprudent risk taking, which may undermine the safety and soundness of the institution. The guidance, which applies to all employees that have the ability to materially affect an institution’s risk profile, either individually or as part of a group, is based upon three primary principles: (1) balanced risk-taking incentives; (2) compatibility with effective controls and risk management; and (3) strong corporate governance.

An institution’s supervisory ratings will incorporate any identified deficiencies in an institution’s compensation practices, and it may be subject to an enforcement action if the incentive compensation arrangements pose a risk to the safety and soundness of the institution. Further, regulations may limit discretionary bonus payments to bank executives if the institution’s regulatory capital ratios fail to exceed certain thresholds.

Deposit Insurance Assessments

FDIC insured banks are required to pay deposit insurance assessments to the FDIC. The amount of the assessment is based on the size of the bank’s assessment base, which is equal to its average consolidated total assets less its average tangible equity, and its risk classification under an FDIC risk-based assessment system. Institutions assigned to higher risk classifications (that is, institutions that pose a higher risk of loss to the Deposit Insurance Fund) pay assessments at higher rates than institutions that pose a lower risk. An institution’s risk classification is assigned based on certain financial data and the level of supervisory concern that the institution poses to the regulators. In addition, the FDIC can impose special assessments in certain instances. Action by the FDIC to replenish the Deposit Insurance Fund when needed could result in higher assessment rates, which could reduce our profitability or otherwise negatively impact our operations. The FDIC issued a final rule in October 2022 increasing deposit insurance assessments beginning in the first quarterly assessment period of 2023. On November 16, 2023, the FDIC Board of Directors approved a final rule to implement a special assessment on banks with over $5 billion in total assets to recover the loss to the Deposit Insurance Fund associated with protecting uninsured depositors following the closures of Silicon Valley Bank and Signature Bank. The Federal Deposit Insurance Act requires the FDIC to take this action in connection with the systemic risk determination announced on March 12, 2023. While we are not subject to this special assessment, we may be required to pay higher FDIC insurance premiums in the future if there are additional bank or financial institution failures or if the FDIC otherwise determines to increase assessment rates.

Branching and Interstate Banking

Under federal law, the Bank is permitted to establish additional branch offices within Louisiana, subject to the approval of the OCC. As a result of the Dodd-Frank Act, the Bank may also establish additional branch offices outside of Louisiana, subject to prior regulatory approval, so long as the laws of the state where the branch is to be located would permit a state bank chartered in that state to establish a branch. The Bank may also establish offices in other states by merging with banks or by purchasing branches of other banks in other states, subject to certain restrictions.

Community Reinvestment Act

The Bank is required under the Community Reinvestment Act, or CRA, and related OCC regulations to help meet the credit needs of its communities, including low and moderate-income borrowers. In connection with its examination of the Bank, the OCC assesses our record of compliance with the CRA. The Bank’s failure to comply with the provisions of the CRA could, at a minimum, result in denial of certain corporate applications, such as branches or mergers, or in restrictions on its or the Company’s activities. The Bank received an “Outstanding” CRA rating on its most recent CRA Performance Evaluation. The CRA requires all FDIC-insured institutions to publicly disclose their rating.

On October 24, 2023, the federal banking agencies adopted a final rule to modernize the CRA regulations. Under the final rule, (1) the federal banking agencies will evaluate bank performance across the varied activities they conduct and communities in which they operate in order to encourage banks to expand access to credit, investment, and banking services in low- and moderate-income communities, (2) the CRA regulations are updated to evaluate lending outside traditional assessment areas generated by the growth of non-branch delivery systems, such as online and mobile banking, branchless banking, and hybrid models, (3) a new metrics-based approach was adopted to evaluate bank retail lending and community development financing, using benchmarks based on peer and demographic data and (4) CRA evaluations and data collection are tailored according to bank size and type. In addition, the final rule exempts small and intermediate banks from new data requirements that apply to banks with assets of at least $2 billion and limits certain new data requirements to large banks with assets greater than $10 billion. Most of the new rule’s requirements were originally scheduled to become applicable on January 1, 2026, with the remaining requirements, including the data reporting requirements, becoming applicable on January 1, 2027. However, a federal court issued an injunction in March 2024 that indefinitely extended the compliance date until the injunction is lifted. Further, in July 2025, the federal banking agencies issued a notice or proposed rulemaking to rescind the October 2023 final rulemaking and replace it with the prior CRA regulation.

14

Table of Contents

Concentrated Commercial Real Estate Lending Regulations

The federal bank regulatory agencies have promulgated guidance governing financial institutions with concentrations in commercial real estate lending. The guidance provides that a bank has a concentration in commercial real estate lending if (i) total reported loans for construction, land development, and other land represent 100% or more of total capital or (ii) total reported loans secured by multifamily and nonfarm nonresidential properties and loans for construction, land development, and other land represent 300% or more of total capital and the bank’s commercial real estate loan portfolio has increased 50% or more during the prior 36 months. Owner-occupied loans are excluded from this second category. If a concentration is present, management must employ heightened risk management practices that address, among other things, board and management oversight and strategic planning, portfolio management, development of underwriting standards, risk assessment and monitoring through market analysis and stress testing, and maintenance of increased capital levels as needed to support the level of commercial real estate lending. At December 31, 2025, the Company did not have a concentration in commercial real estate as defined by the regulatory guidance.

Financial Privacy and Cybersecurity Requirements

Federal law and regulations limit a financial institution’s ability to share consumer financial information with unaffiliated third parties. Specifically, these provisions require all financial institutions offering financial products or services to retail customers to provide such customers with the financial institution’s privacy policy and provide such customers the opportunity to “opt out” of the sharing of personal financial information with unaffiliated third parties. The sharing of information for marketing purposes is also subject to limitations. The Bank currently has a privacy protection policy in place.

Federal law and regulations also establish certain information security guidelines that require each financial institution, under the supervision and ongoing oversight of its board of directors or an appropriate committee thereof, to develop, implement, and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information, to protect against anticipated threats or hazards to the security or integrity of such information, and to protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. These federal guidelines require a financial institution to (i) identify reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer information systems; (ii) assess the likelihood and potential damage of these threats, taking into consideration the sensitivity of customer information; and (iii) assess the sufficiency of policies, procedures, customer information systems, and other arrangements in place to control risks. Under the federal guidelines, financial institutions have to provide notice to affected customers of a data breach under certain circumstances.

The federal guidelines also impose requirements on financial institutions with respect to overseeing their service providers, including (i) exercising appropriate due diligence in selecting its service providers; (ii) requiring its service providers by contract to implement appropriate measures designed to meet the objectives of the federal guidelines; and (iii) where indicated by its risk assessment, monitor its service providers to confirm that they have satisfied their obligations as required by the guidelines. The federal banking regulations also require a bank to notify its primary federal regulator within 36 hours of the occurrence of a computer-security incident that rises to the level of a “notification incident.” A “notification incident” is defined as a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, a banking organization’s (1) ability to carry out banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base, in the ordinary course of business; (2) business line(s), including associated operations, services, functions, and support, that upon failure would result in a material loss of revenue, profit, or franchise value; or (3) operations, including associated services, functions and support, as applicable, the failure or discontinuance of which would pose a threat to the financial stability of the U.S. A “computer-security incident” is defined as an occurrence that results in actual harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits.

Federal banking regulators regularly issue guidance regarding cybersecurity intended to enhance cyber risk management. A financial institution is expected to implement multiple lines of defense against cyberattacks. Financial institutions are also expected to implement procedures designed to address the risks posed by potential cyber threats, and to allow the institution to respond and recover effectively after a cyberattack. The Company has adopted procedures designed to comply with the regulatory cybersecurity guidance.

Consumer Laws and Regulations

The Bank is subject to numerous laws and regulations intended to protect consumers in transactions with the Bank, including, among others, laws regarding unfair, deceptive and abusive acts and practices, usury laws, and other federal consumer protection statutes. These federal laws include the ECOA, the Electronic Fund Transfer Act, the Fair Credit Reporting Act, the Fair Debt Collection Practices Act, the Real Estate Settlement Procedures Act of 1974, the S.A.F.E. Mortgage Licensing Act of 2008, the Truth in Lending Act and the Truth in Savings Act, among others. Many states have consumer protection laws analogous, and in addition, to those enacted under federal law. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must deal with customers when taking deposits, making loans and conducting other types of transactions. Failure to comply with these laws and regulations could give rise to regulatory sanctions, customer rescission rights, action by state and local attorneys general and civil or criminal liability.

The ECOA and the Fair Housing Act prohibit lenders from discriminating in their lending practices on the basis of characteristics specified in those statutes. A failure to comply with the ECOA or the Fair Housing Act could result in enforcement actions by a bank’s principal federal regulatory agency, as well as by other federal regulatory agencies or the Department of Justice.

In addition, the Dodd-Frank Act created the CFPB that has broad authority to regulate and supervise retail financial services activities of banks and various non-bank providers. The CFPB has authority to promulgate regulations, issue orders, guidance and policy statements, conduct examinations and bring enforcement actions with regard to consumer financial products and services. In general, however, banks with assets of $10 billion or less, such as the Bank, will continue to be examined for consumer compliance by their primary federal bank regulator.

15

Table of Contents

Mortgage Lending Rules

The Dodd-Frank Act authorized the CFPB to establish certain minimum standards for the origination of residential mortgages, including a determination of the borrower’s ability to repay. Under the Dodd-Frank Act, financial institutions may not make a residential mortgage loan unless they make a “reasonable and good faith determination” that the consumer has a “reasonable ability” to repay the loan. The Dodd-Frank Act allows borrowers to raise certain defenses to foreclosure but provides a full or partial safe harbor from such defenses for loans that are “qualified mortgages.” The CFPB’s rules, among other things, specify the types of income and assets that may be considered in the ability-to-repay determination, the permissible sources for verification, and the required methods of calculating the loan’s monthly payments. The rules extend the requirement that creditors verify and document a borrower’s income and assets to include all information that creditors rely on in determining repayment ability. The rules also provide further examples of third-party documents that may be relied on for such verification, such as government records and check cashing or funds transfer service receipts. The rules also define “qualified mortgages,” imposing both underwriting standards and limits on the terms of their loans. Points and fees are subject to a relatively stringent cap, and the terms include a wide array of payments that may be made in the course of closing a loan. Certain loans, including interest-only loans and negative amortization loans, cannot be qualified mortgages.

Anti-Money Laundering and OFAC

Under federal law (including the Bank Secrecy Act and the USA PATRIOT Act), financial institutions must maintain anti-money laundering programs that include: established internal policies, procedures and controls; a designated compliance officer; an ongoing employee training program; and testing of the program by an independent audit function. Financial institutions are also prohibited from entering into specified financial transactions and account relationships and must meet enhanced standards for due diligence and customer identification in their dealings with foreign financial institutions and foreign customers. Financial institutions must take reasonable steps to conduct enhanced scrutiny of account relationships to guard against money laundering and to report any suspicious transactions, and law enforcement authorities have been granted increased access to financial information maintained by financial institutions.

The Office of Foreign Assets Control, or OFAC, is responsible for helping to ensure that U.S. entities do not engage in transactions with certain prohibited parties, as defined by various Executive Orders and Acts of Congress. OFAC publishes lists of persons and organizations suspected of aiding, harboring or engaging in terrorist acts, known as Specially Designated Nationals and Blocked Persons. Generally, if the Bank identifies a transaction, account or wire transfer relating to a person or entity on an OFAC list, it must freeze the account or block the transaction, file a suspicious activity report and notify the appropriate authorities.

Bank regulators routinely examine institutions for compliance with these obligations and they must consider an institution’s compliance in connection with the regulatory review of applications, including applications for banking mergers and acquisitions. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing and comply with OFAC sanctions, or to comply with relevant laws and regulations, could have serious legal, reputational and financial consequences for the institution.

Safety and Soundness Standards

Federal bank regulatory agencies have adopted guidelines that establish general standards relating to internal controls and information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth and compensation, fees and benefits. Additionally, the agencies have adopted regulations that provide the authority to order an institution that has been given notice by an agency that it is not satisfying any of these safety and soundness standards to submit a compliance plan. If, after being so notified, an institution fails to submit an acceptable compliance plan or fails in any material respect to implement an acceptable compliance plan, the agency must issue an order directing action to correct the deficiency and may issue an order directing other actions of the types to which an undercapitalized institution is subject under the “prompt corrective action” provisions of the Federal Deposit Insurance Act. If an institution fails to comply with such an order, the agency may seek to enforce such order in judicial proceedings and to impose civil money penalties.

Bank holding companies are also not permitted to engage in unsound banking practices. For example, the Federal Reserve’s Regulation Y requires a holding company to give the Federal Reserve prior notice of any redemption or repurchase of its own equity securities, if the consideration to be paid, together with the consideration paid for any repurchases in the preceding year, is equal to 10% or more of the company’s consolidated net worth. The Federal Reserve may oppose the transaction if it believes that the transaction would constitute an unsafe or unsound practice or would violate any law or regulation. As another example, a holding company could not impair its subsidiary bank’s soundness by causing it to make funds available to non-banking subsidiaries or their customers if the Federal Reserve believed it not prudent to do so. The Federal Reserve has broad authority to prohibit activities of bank holding companies and their nonbanking subsidiaries that represent unsafe and unsound banking practices or that constitute violations of laws or regulations.

16

Table of Contents

Effect of Governmental Monetary Policies

The commercial banking business is affected not only by general economic conditions but also by U.S. fiscal policy and the monetary policies of the Federal Reserve. Some of the instruments of monetary policy available to the Federal Reserve include changes in the discount rate on member bank borrowings, the fluctuating availability of borrowings at the “discount window,” open market operations, the imposition of and changes in reserve requirements against member banks’ deposits and assets of foreign branches, and the imposition of and changes in reserve requirements against certain borrowings by banks and their affiliates. These policies influence to a significant extent the overall growth of bank loans, investments, and deposits and the interest rates charged on loans or paid on deposits. For example, during 2022 and in 2023 the Federal Open Market Committee of the Federal Reserve increased the target rate range for trading in the federal funds market (known as the federal funds target rate or the federal funds rate) multiple times, increasing market interest rates. From September 2024 to December 2024, the Federal Reserve decreased the federal funds rate three times, and from September 2025 to December 2025, it was decreased an additional three times. The federal funds rate is the rate at which commercial banks borrow and lend their excess reserves to each other overnight. We cannot predict the nature of future fiscal and monetary policies and the effect of these policies on our future business and earnings.

Future Legislation and Regulatory Reform

New laws, regulations and policies are regularly proposed that contain wide-ranging proposals for altering the structures, regulations and competitive relationships of financial institutions operating in the U.S. In addition, existing laws, regulations and policies are continually subject to modification or changes in interpretation. We cannot predict whether or in what form any law, regulation or policy will be adopted or modified or the extent to which our operations and activities, financial condition, results of operations, strategic plans or future prospects may be affected by its adoption or modification.

The cumulative effect of these laws and regulations, and frequent changes to them, add significantly to the cost of our operations and thus has a negative impact on profitability. There has also been a tremendous expansion in recent years of financial service providers that are not subject to the same level of regulation, examination and oversight as we are. Those providers, because they are not so highly regulated, may have a competitive advantage over us and may continue to draw large amounts of funds away from traditional banking institutions, with a continuing adverse effect on the banking industry in general.

Human Capital Resources

Our business is built on relationships with our customers, our community, and most of all, our employees. We are committed to providing quality service and products to the consumers and businesses within the markets we serve. We strive to create superior shareholder value by attracting and retaining exceptional employees who are highly motivated and well trained.

Our compensation strategy provides a total rewards structure that reflects position responsibilities, is competitive with the external market, and is capable of attracting, retaining, and motivating our employees. We provide a comprehensive benefits package for eligible employees that includes group health (medical, dental, and vision) insurance including a health savings account option, paid time off, short- and long-term disability insurance, life insurance and a 401(k) plan in which we provide a matching contribution. We also offer eligible employees participation in our ESOP as well as our LTIP in order to better align employee and shareholder interests.

We provide employees with robust training programs that promote employee development and effectiveness by providing high-quality curriculums designed to meet individual, departmental and Bank-wide objectives. This includes mentorships, 1-on-1 job shadowing, classroom training, internships, and computer-based training.

We believe employing a diverse and inclusive workforce strengthens our ability to serve our customers and our communities, which is a key component of our success. To that end, we are a proud equal opportunity employer committed to attracting, retaining and promoting employees regardless of sex, sexual orientation, gender identity, race, color, national origin, age, religion and physical ability. We do not tolerate illegal discrimination or harassment and encourage employees to immediately report any violations to management and human resources.

As of December 31, 2025, we had 319 full-time and eight part-time employees. None of our employees are represented by any collective bargaining unit or are parties to a collective bargaining agreement. We believe that our relations with our employees are good.

Available Information

Our filings with the SEC, including Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and all amendments thereto, are available on our website as soon as reasonably practicable after the reports are filed with or furnished to the SEC. Copies can be obtained free of charge in the “Investors” section of our website at www.investarbank.com. Our SEC filings are also available through the SEC’s website www.sec.gov. Copies of these filings are also available by writing to us at the following address:

Investar Holding Corporation

P.O. Box 84207

Baton Rouge, Louisiana 70884-4207