Oak Valley Bancorp (OVLY) Business

ITEM 1.  BUSINESS

Overview of the Business

Oak Valley Bancorp. Oak Valley Bancorp (the “Company”) serves as the parent bank holding company of Oak Valley Community Bank (the “Bank”), a California state-chartered bank. The Bank and the Company may be generally referred to as “we”, “us” or “our”). The Company was incorporated under the laws of the State of California on May 31, 1990, and began operations in Oakdale, California on May 28, 1991.

The Company’s only assets are the outstanding capital stock of the Bank, which the Company wholly owns, cash and income tax benefits receivable classified as other assets.

Oak Valley Community Bank. The Bank commenced operations in May 1991.  The Bank is an insured bank under the Federal Deposit Insurance Act and is a member of the Federal Reserve.  The Bank is subject to regulation, supervision and regular examination by the California Department of Financial Protection and Innovation (“DFPI”), the Federal Deposit Insurance Commission (“FDIC”) and the Federal Reserve Board (“FRB”). Since its formation, the Bank has provided basic banking services to individuals and business enterprises in Oakdale, California and the surrounding areas. The focus of the Bank is to offer a range of commercial banking services designed for both individuals and small to medium-sized businesses in the two main areas of service of the Bank: the Central Valley and the Eastern Sierras. The three branches in the Eastern Sierras operate as Eastern Sierra Community Bank, a division of the Bank.

The Bank offers a complement of business checking and savings accounts for its business customers.  The Bank also offers commercial and real estate loans, as well as lines of credit.  Real estate loans are generally of a short-term nature for both residential and commercial lending purposes.  Longer-term real estate loans are generally made with adjustable interest rates and contain customary provisions for acceleration.  Traditional residential mortgages are available to Bank customers through a third party.

The Bank offers other services for both individuals and businesses including online banking, remote deposit capture, mobile banking, merchant services, night depository, extended hours, wire transfer of funds, note collection, and automated teller machines in a national network.  The Bank does not currently offer international banking or trust services although the Bank may make such services available to the Bank’s customers through financial institutions with which the Bank has correspondent banking relationships.  The Bank does not offer stock transfer services, nor does it directly issue credit cards.

Expansion

Branch Expansion.    Since opening the doors of our main Oakdale branch in 1991, our network of branches have been expanded geographically. As of December 31, 2025, we maintained nineteen full-service branch offices (in addition to our corporate headquarters) located in the cities of Oakdale, Sonora, Modesto, Bridgeport, Mammoth Lakes, Bishop, Escalon, Patterson, Turlock, Ripon, Stockton, Manteca, Tracy, Sacramento, Roseville and Lodi in California. We intend to continue our growth strategy in future years through the opening of additional branches and loan production offices as demand dictates and resources permit.

Business Segments

Management has determined that because all of the banking products and services offered by the Company are available in each branch of the Bank, all branches are located within the same economic environment, and management does not allocate resources based on the performance of different lending or transaction activities, it is appropriate to aggregate the Bank branches and report them as a single operating segment.  No customer accounts for more than 10 percent of revenues for the Company or the Bank.

Primary Market Area

We conduct business from our main office in Oakdale, a city of approximately 23,000 residents located in Stanislaus County, California. Oakdale is approximately 15 miles from Modesto and sits at the foothills of the Sierra Nevada Mountains, at the edge of the California Central Valley agricultural area.  Through our branches, we serve customers in the Central Valley, from Fresno to Sacramento, and in foothill locations. We also reach into the Highway 395 corridor in the Eastern Sierras and in the towns of Bishop, Mammoth and Bridgeport.  Approximately 99% of our loans and 90% of our deposits are generated from the Central Valley. The Central Valley area includes Stanislaus, San Joaquin, Tuolumne, Sacramento, and Placer counties and has a total population of over 5 million.

4

Table of Contents

Lending Activities

General.    Our loan policies set forth the basic guidelines and procedures by which we conduct our lending operations. These policies address the types of loans available, underwriting and collateral requirements, loan terms, interest rate and yield considerations, compliance with laws and regulations and our internal lending limits. Our Board of Directors reviews and approves our loan policies on an annual basis. We supplement our own supervision of the loan underwriting and approval process with periodic loan audits by experienced external loan specialists who review credit quality, loan documentation and compliance with laws and regulations. We engage in a full complement of lending activities, including:

● commercial real estate loans,

● commercial business lending and trade finance,

● Small Business Administration lending, and

● consumer loans, including automobile loans, home mortgages, credit lines and other personal loans.

As part of our efforts to achieve long-term stable profitability and respond to a changing economic environment in the California Central Valley, we constantly evaluate a variety of options to augment our traditional focus by broadening the services and products we provide. Possible avenues of growth include more branch locations, expanded suite of technology-based services and new types of lending.

Loan Procedures.    Loans are recommended for approval by the Senior Loan Committee, made up of our Board of Directors and designated executive officers of the bank, by joint management authority or by loan officers, to the extent of their lending authority. Our Board of Directors authorizes our lending limits. Our President and Chief Credit Officer are responsible for evaluating the authority limits for individual credit officers and recommending lending limits for all other officers to the Board of Directors for approval.

We grant individual lending authority to our Chief Executive Officer, Chief Credit Officer, Credit Administrator and to certain department managers and loan officers. Our highest management lending authority, known as Joint Authority, includes all amounts above the individual officer loan authority limits and below the Senior Loan Committee limits of: $5,000,000 for real estate secured loans, $2,500,000 for loans secured by collateral other than real estate and cash, $1,500,000 for unsecured loans, or when the borrower’s aggregate total outstanding commitment exceeds $5,000,000. These loans require joint approval from two of the following officers: Chief Executive Officer, President, Chief Credit Officer, Senior Lending Officer or Credit Administrator.

As of December 31, 2025, the Bank’s authorized legal lending limits were $35.4 million for unsecured loans plus an additional $23.6 million for specific secured loans. Legal lending limits are calculated in conformance with California law, which prohibits a bank from lending to any one individual or entity or its related interests an aggregate amount which exceeds 15% of primary capital plus the allowance for credit losses on an unsecured basis, plus an additional 10% on a secured basis. The Bank’s primary capital plus allowance for credit losses as of December 31, 2025 totaled $236.0 million.

We seek to mitigate the risks inherent in our loan portfolio by adhering to certain underwriting practices. The review of each loan application includes analysis of the applicant’s prior credit history, income level, cash flow and financial condition, tax returns, cash flow projections, and the value of any collateral to secure the loan, based upon reports of independent appraisers and audits of accounts receivable or inventory pledged as security. In the case of real estate loans over a specified amount, the review of collateral value includes an appraisal report prepared by an independent, Bank-approved, appraiser.

Real Estate Loans.    We offer commercial real estate loans to finance the acquisition of new or the refinancing of existing commercial properties, such as office buildings, industrial buildings, warehouses, hotels, shopping centers, automotive industry facilities and multiple dwellings. As of December 31, 2025, consumer and commercial real estate loans constituted 91% of our loan portfolio, of which 97% were commercial real estate loans.

Commercial real estate loans typically have 10-year maturities with up to 25-year amortization of principal and interest and loan-to-value ratios of not more than 75% of the appraised value or purchase price, whichever is lower. We usually impose a prepayment penalty during the period within 3 to 5 years of the date of the loan.

5

Table of Contents

Construction loans are comprised of loans on commercial, residential and income-producing properties that generally have terms of 1 year, with options to extend for additional periods to complete construction and to accommodate the lease-up period. We usually require 15% equity capital investment by the developer and loan-to-value ratios of not more than 75% of anticipated completion value.

Mini-perm loans finance the purchase and/or ownership of commercial properties, including owner-occupied and income-producing properties. We also offer mini-perm loans as take-out financing with our construction loans. Mini-perm loans are generally made with an amortization schedule ranging from 20 to 25 years, with a lump sum balloon payment due in 3 to 5 years.

Equity lines of credit are revolving lines of credit with repayment term and are collateralized by junior deeds of trust on residential real properties. They generally bear a rate of interest that floats with our base rate or the prime rate, and have maturities of 25 years (10-year interest only with 15-year amortization).

We purchase participation interests in loans made by other financial institutions from time to time. These loans are subject to the same underwriting criteria and approval process as loans made directly by us.

Our real estate loans are typically collateralized by first or junior deeds of trust on specific commercial properties and equity lines of credit, and are subject to corporate or individual guarantees from financially capable parties, as available. The properties collateralizing real estate loans are principally located in our primary market areas of the California Central Valley and the Eastern Sierra.  Real estate loans typically bear interest rates that float with an established index.

Our real estate portfolio is subject to certain risks, including (i) downturns in the California economy, (ii) significant interest rate fluctuations, (iii) reduction in real estate values in the California Central Valley, (iv) increased competition in pricing and loan structure, and (v) environmental risks, including natural disasters.  As a result of the high concentration of the real estate loan in our loan portfolio, potential difficulties in the real estate markets could cause significant increases in nonperforming loans, which would reduce our profits.  A decline in real estate values could cause some of our mortgage loans to become inadequately collateralized, which would expose us to a greater risk of loss.  Additionally, a decline in real estate values could adversely affect our portfolio of commercial real estate loans and could result in a decline in the origination of such loans. However, we strive to reduce the exposure to such risks and seek to continue to maintain high quality in our real estate loans by (a) reviewing each loan request and each loan renewal individually, (b) using a joint approval system for the approval of each loan request for loans over a certain dollar amount, (c) adhering to written loan policies, including, among other factors, minimum collateral requirements, maximum loan-to-value ratio requirements, cash flow requirements and personal guarantees, (d) performing secondary appraisals from time to time, (e) conducting external independent credit review, and (f) conducting environmental reviews, where appropriate. We review each loan request on the basis of our ability to recover both principal and interest in view of the inherent risks.   We monitor and stress test our entire portfolio, evaluating debt coverage ratios and loan-to-value ratios, on a quarterly basis.  We monitor trends and evaluate exposure derived from simulated stressed market conditions.  The portfolio is stratified by owner classification (either owner-occupied or non-owner occupied), product type, geography and size.

As of December 31, 2025, the aggregate loan-to-value of the entire commercial real estate portfolio was 44.9%, based on the most recent appraisals as of the time of origination or renewal.  Historical data suggests that the Bank continues to maintain strong loan-to-value which has served as a cushion against precipitous reductions in real estate values during economic downturns.  Non-owner occupied commercial real estate comprised 69.9% of the Bank’s total commercial real estate commitments, as of December 31, 2025.  The loan-to-value on the non-owner occupied CRE segment was 45.6%, as of December 31, 2025.  The highest concentration by product type is CRE Retail, which comprised 29.4% of total CRE loan commitments, as of December 31, 2025.

Our portfolio diversity in terms of both product types and geographic distribution, combined with strong debt coverage ratios, a low aggregate loan-to-value and a reasonable percentage of owner-occupied properties, mitigate the risks associated with excessive commercial real estate concentration. These elements contribute strength to our overall real estate portfolio in the event of any weakness in the real estate market.

Commercial Business Lending.    We offer commercial loans to sole proprietorships, partnerships and corporations, with an emphasis on the real estate related industry. These commercial loans include business lines of credit and commercial term loans to finance operations, to provide working capital or for specific purposes, such as to finance the purchase of assets, equipment or inventory. Since a borrower’s cash flow from operations is generally the primary source of repayment, our policies provide specific guidelines regarding required debt coverage and other important financial ratios.

Lines of credit are extended to businesses or individuals based on the financial strength and integrity of the borrower and are secured primarily by real estate, accounts receivable and inventory, and have a maturity of one year or less. Such lines of credit bear an interest rate that floats with the prime rate, constant maturity treasury or another established index.

6

Table of Contents

Commercial term loans are typically made to finance the acquisition of fixed assets, refinance short-term debts or to finance the purchase of businesses. Commercial term loans generally have terms from one to five years. They may be collateralized by the asset being acquired or other available assets and bear interest rates, which either floats with the prime rate, or another established index or is fixed for the term of the loan.

Our portfolio of commercial loans is also subject to certain risks, including (i) downturns in the California economy, (ii) significant interest rate fluctuations; and (iii) the deterioration of a borrower’s or guarantor’s financial capabilities. We attempt to reduce the exposure to such risks through (a) reviewing each loan request and renewal individually, (b) requiring a joint signature approval system, (c) mandating strict adherence to written loan policies, and (d) performing external independent credit review. In addition, we monitor loans based on short-term asset values as required on a monthly or quarterly basis. In general, during the term of the relationship, we receive and review the financial statements of our borrowing customers on an ongoing basis, and we promptly respond to any deterioration that we note.

Small Business Administration Lending Services.    Small Business Administration (“SBA”) lending, forms an important part of our business. Our SBA lending service places an emphasis on minority-owned businesses. Our SBA market area includes the geographic areas encompassed by our full-service banking offices in the California Central Valley and in the Eastern Sierra. As an SBA lender, we enable borrowers to obtain SBA loans in order to acquire new businesses, expand existing businesses, and acquire locations in which to do business.

Consumer Loans.    Consumer loans include personal loans, auto loans, home improvement loans, home mortgage loans, revolving lines of credit and other loans typically made by banks to individual borrowers. We provide consumer loan products in an effort to diversify our product line.

Our consumer loan portfolio is subject to certain risks, including:

● amount of credit offered to consumers in the market,

● interest rate increases, and

● consumer bankruptcy laws which allow consumers to discharge certain debts.

We attempt to reduce the exposure to such risks through the direct approval of all consumer loans by:

● reviewing each loan request and renewal individually,

● using a dual signature system of approval,

● strictly adhering to written credit policies, and

● performing external independent credit review.

7

Table of Contents

Deposit Activities

Our primary sources of funds are deposits and loan repayments. Scheduled loan repayments are a relatively stable source of funds, whereas deposit inflows, outflows and unscheduled loan prepayments (which are influenced significantly by general interest rate levels, interest rates available on other investments, competition, economic conditions and other factors) are not as stable. Customer deposits also remain a primary source of funds, but these balances may be influenced by adverse market changes in the industry. We may resort to other borrowings, on an as needed basis, as follows:

● on a short-term basis to compensate for reductions in deposit inflows at less than projected levels, and

● on a longer-term basis to support expanded lending activities and to match the maturity of repricing intervals of assets.

We offer a variety of accounts for depositors, which are designed to attract both short-term and long-term deposits. These accounts include certificates of deposit (“CDs”), regular savings accounts, money market accounts, checking accounts, savings accounts, health savings accounts and individual retirement accounts. These accounts generally earn interest at rates established by management based on competitive market factors and management’s desire to increase or decrease certain types or maturities of deposits. As needs arise, we augment these customer deposits with brokered deposits. The more significant deposit accounts offered by us are described below:

Certificates of Deposit.    We offer several types of CDs with a maximum maturity of five years. The substantial majority of our CDs have a maturity of one to twelve months and pay compounded interest typically credited monthly or at maturity.

Regular Savings Accounts.    We offer savings accounts that allow for unlimited ATM and in-branch deposits and withdrawals. Interest is compounded daily and paid monthly.

Money Market Account.    Money market accounts pay a variable interest rate that is tiered depending on the balance maintained in the account. Minimum opening balances vary. Interest is compounded daily and paid monthly.

Checking Accounts.    Checking accounts are generally non-interest and interest-bearing accounts, respectively, and may include service fees based on activity and balances.

Other Sources of Funds

Federal Home Loan Bank Borrowings.    To supplement our deposits as a source of funds for lending or investment, we have the option to borrow funds in the form of advances from the Federal Home Loan Bank (“FHLB”). FHLB advances can be used as part of our interest rate risk management, primarily to extend the duration of funding to match the longer-term fixed rate loans held in the loan portfolio as part of our growth strategy.

As a member of the FHLB system, we are required to invest in FHLB stock based on a predetermined formula. FHLB stock is a restricted equity security that can only be sold to other FHLB members or redeemed by the FHLB. As of December 31, 2025, we owned $6,307,000 in FHLB stock.

Advances from the FHLB are typically secured by our entire real estate loan portfolio, which includes residential and commercial loans.  As of December 31, 2025, our borrowing limit with the FHLB was approximately $402 million.

Internet and Mobile Banking

We offer Internet banking services, which allows our customers to access their deposit accounts through the Internet. Customers are able to obtain transaction history and account information, transfer funds between accounts, make person-to-person payments and make online bill payments. We intend to improve and develop our Internet banking products and delivery channels as the need arises and our resources permit. Mobile Banking offers many of the same services as internet banking but also includes mobile check deposit.

Other Services

We offer ATMs located at branch offices, and customer access to an ATM network. Additionally, we offer remote deposit capture service to allow commercial deposit customers the convenience of scanning check deposits for quicker access to deposited funds.

8

Table of Contents

Marketing

Our marketing relies principally upon local advertising and promotional activity and upon personal contacts by our directors, officers and shareholders to attract business and to acquaint potential customers with our personalized services. We emphasize a high degree of personalized client service in order to be able to provide for each customer’s banking needs. Our marketing approach emphasizes the advantages of dealing with an independent, locally managed and state-chartered bank to meet the particular needs of consumers, professionals and business customers in the community. Our management continually evaluates all of our banking services with regard to their profitability and efforts and makes determinations based on these evaluations whether to continue or modify our business plan, where appropriate.

We do not currently have any plans to develop any new lines of business, which would require a material amount of capital investment on our part.

Competition

Regional Branch Competition.    We consider our primary service area to be composed of the counties of San Joaquin, Stanislaus, Tuolumne, Sacramento, Placer, Inyo and Mono Counties, of California.  The banking business in California generally, and in our primary service area, specifically, is competitive with respect to both loans and deposits and is dominated by a relatively small number of major banks, which have many offices operating over wide geographic areas.  These include Wells Fargo Bank, Bank of America, JP Morgan Chase Bank, U.S. Bank, BMO Bank and Citibank. We compete for deposits and loans principally with these banks, as well as with savings and loan associations, thrift and loan associations, credit unions, mortgage companies, insurance companies, offerors of money market accounts and other lending institutions.

Among the advantages of these institutions are their ability to finance extensive advertising campaigns and to allocate their investment assets to regions of highest yield and demand, their ability to offer certain services, such as international banking and trust services, which are not offered directly by the Company and, the ability by virtue of their greater total capitalization, to have substantially higher lending limits than we do.   In addition, as a result of increased consolidation and the passage of interstate banking legislation, there is and will continue to be increased competition among banks, savings and loan associations and credit unions for the deposit and loan business of individuals and businesses.

As of June 30, 2025, our primary service areas contained 277 banking offices, with approximately $90.8 billion in total deposits. As of June 30, 2025, we had total deposits of approximately $1.7 billion, which represented approximately 1.9% of the total deposits in the Bank’s primary service area. There can be no assurance that the Bank will maintain its competitive position against current and potential competitors, especially those with greater resources than the Bank. The four largest competing banks had 132 total branches and deposits averaged approximately $499 million per office as of June 30, 2025 within the Bank’s primary service area.

In order to compete with major financial institutions in our primary service areas, we use to the fullest extent the flexibility that our independent status permits.  This includes an emphasis on specialized services, local promotional activity, and personal contacts by our officers, directors and employees.  In the event that there are customers whose needs exceed our lending limits, we may arrange for such loans on a participation basis with other financial institutions.  We also assist customers who require other services that we do not offer by obtaining such services from correspondent banks.  However, no assurance can be given that our continued efforts to compete with other financial institutions will be successful.

In addition to other banks, our competitors include savings institutions, credit unions, and numerous non-banking institutions, such as finance companies, leasing companies, insurance companies, brokerage firms, and investment banking firms. In recent years, increased competition has also developed from specialized finance and non-finance companies that offer money market and mutual funds, wholesale finance, credit card, and other consumer finance services, including online banking services and personal finance software. Strong competition for deposit and loan products affects the rates of those products as well as the terms on which they are offered to customers.

Other Competitive Factors.     General competitive trends in the industry include increased consolidation and competition. Strong competitors, other than financial institutions, have entered banking markets with focused products targeted at highly profitable customer segments. Many of these competitors are able to compete across geographic boundaries and provide customers with increasing access to meaningful alternatives to banking services in nearly all significant products areas. Mergers between financial institutions have placed additional pressure on banks within the industry to streamline their operations, reduce expenses, and increase revenues to remain competitive. Competition has also intensified due to the federal and state interstate banking laws, which permit banking organizations to expand geographically, and the California market has been particularly attractive to out-of-state institutions. The Financial Modernization Act, which has made it possible for full affiliations to occur between banks and securities firms, insurance companies, and other financial companies, is also expected to intensify competitive conditions.

9

Table of Contents

Technological innovations have also resulted in increased competition in the financial services industry. Such innovations have, for example, made it possible for non-depository institutions to offer customers automated transfer payment services that were previously considered traditional banking products. In addition, many customers now expect a choice of several delivery systems and channels, including telephone, mail, home computer, mobile devices, ATMs, self-service branches and/or in-store branches.

Business Concentration.    No individual or single group of related accounts is considered material in relation to our total assets or deposits, or in relation to our overall business. However, approximately 91% of our loan portfolio held for investment as of December 31, 2025 consisted of real estate-related loans, including construction loans, mini-perm loans, real estate mortgage loans and commercial loans secured by real estate. Moreover, our business activities are currently focused primarily in Central California, with the majority of our business concentrated in San Joaquin, Stanislaus, Tuolumne, Sacramento, Placer, Inyo and Mono Counties.  Consequently, our results of operations and financial condition are dependent upon the general trends in the Central California economies and, in particular, the residential and commercial real estate markets. In addition, the concentration of our operations in Central California exposes us to greater risk than other banking companies with a wider geographic base in the event of catastrophes, such as earthquakes, fires and floods in this region.

Employees

As of December 31, 2025, we had 245 employees (217 full-time employees and 28 part-time employees). None of our employees are currently represented by a union or covered by a collective bargaining agreement. We consider our relations with our employees to be good.

Human Capital Management

We believe that our human capital is a key asset and a competitive advantage for our success as a community bank. We invest in our human capital by attracting, developing, and retaining talented and diverse employees who share our vision, mission, and values. We foster a culture of premier service, teamwork, performance, community involvement, and integrity, and we reward our employees for their contributions and achievements. We also provide our employees with opportunities for professional growth, learning, and development, as well as competitive compensation and benefits. We are committed to maintaining a safe, healthy, and inclusive work environment that respects and values the diverse backgrounds of our employees and customers. We comply with all applicable laws and regulations regarding labor and employment practices, and we support the principles of equal opportunity, nondiscrimination, and fair labor standards.

Economic Conditions and Legislative and Regulatory Developments

As is the case with financial institutions with our size and scope, our profitability primarily depends on interest rate differentials. Interest rates are highly sensitive to many factors that are beyond our control and cannot be predicted, such as inflation, recession and unemployment, and the impact that future changes in domestic and foreign economic conditions might have on the Company.  A more detailed discussion of the Company’s interest rate risks and the mitigation of those risks is included in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations, in this Annual Report on Form 10-K.

Our business is also influenced by the monetary and fiscal policies of the federal government and the policies of regulatory agencies.  The Federal Reserve Board implements national monetary policies (with objectives such as maintaining price stability, stimulating growth and reducing unemployment) through its open-market operations in U.S. Government securities, by adjusting the required level of reserves for depository institutions subject to its reserve requirements, and by varying the target Federal funds and discount rates applicable to borrowings by depository institutions. The actions of the Federal Reserve Board in these areas influence the growth of bank loans, investments, and deposits and also affect interest earned on interest-earning assets and interest paid on interest-bearing liabilities. The nature and impact of any future changes in monetary and fiscal policies on us cannot be predicted.

From time to time, federal and state legislation is enacted that may have the effect of materially increasing the cost of doing business, limiting or expanding permissible activities, or affecting the competitive balance between banks and other financial services providers. In light of recent conditions in the United States economy and the financial services industry, the Trump administration, Congress, the regulators and various states continue to focus attention on the financial services industry. Additional proposals that affect the industry have been and will likely continue to be introduced. The Company cannot predict whether any of these proposals will be enacted or adopted or, if they are, the effect they would have on our business, the Company's operations or financial condition.

10

Table of Contents

Supervision and Regulation in General

The banking and financial services business in which we engage is highly regulated. Such regulation is intended, among other things, to protect depositors insured by the FDIC and the entire banking system. These regulations affect our lending practices, consumer protections, capital structure, investment practices and dividend policy.

The Company is a legal entity separate and distinct from the Bank.  The Company and the Bank are each subject to supervision and regulation by a number of federal and state agencies and regulatory bodies, as outlined below.

The Company is subject to regulation under the Bank Holding Company Act of 1956, as amended (“BHCA”). As a bank holding company, the Company is regulated and is subject to inspection, examination and supervision by the Federal Reserve Board. It is also subject to the California Financial Code (the “Financial Code”), as well as limited oversight by the DFPI and the FDIC. Under the Federal Reserve Board’s regulations, a bank holding company is required to serve as a source of financial and managerial strength to its subsidiary banks. The BHCA regulates the activities of holding companies including acquisitions, mergers, and consolidations and, together with the Gramm-Leach Bliley Act of 1999, the scope of allowable banking activities.

As a California-state chartered bank, the Bank is subject to primary supervision, examination and regulation by the DFPI and the Federal Reserve Board. The Federal Reserve Board is the primary federal regulator of state member banks. The Bank is also subject to regulation by the FDIC, which insures the Bank’s deposits as permitted by law. If, as a result of an examination of a bank, the Federal Reserve Board determines that the financial condition, capital resources, asset quality, earnings prospects, management, liquidity or other aspects of its operations are unsatisfactory, or that it or its management is violating or has violated any law or regulation, various remedies are available to the Federal Reserve Board. Such remedies include the power to: enjoin “unsafe or unsound” practices; require affirmative action to correct any conditions resulting from any violation or practice; issue an administrative order that can be judicially enforced; direct an increase in capital; restrict growth; assess civil monetary penalties; remove officers and directors; institute a receivership; and, ultimately terminate the bank’s deposit insurance, which would result in a revocation of its charter. The DFPI separately holds many of the same remedial powers.

The commercial banking business is also influenced by the monetary and fiscal policies of the federal government and the policies of the Board of Governors of the Federal Reserve System, also known as the FRB or the Federal Reserve Board. As a member of the Federal Reserve System, we are subject to certain regulations of the Board of Governors of the Federal Reserve System. The regulations of these agencies govern most aspects of our business, including the filing of periodic reports, and activities relating to dividends, investments, loans, borrowings, capital requirements, certain check-clearing activities, branching, mergers and acquisitions, reserves against deposits, and numerous other areas. Supervision, legal action and examination of us by the FRB is generally intended to protect depositors and is not intended for the protection of our shareholders. The Federal Reserve Board implements national monetary policies (with objectives such as curbing inflation and combating recession) by its open-market operations in U.S. government securities, by adjusting the required level of reserves for financial intermediaries subject to its reserve requirements, and by varying the discount rates applicable to borrowings by depository institutions. The actions of the Federal Reserve Board in these areas influence the growth of bank loans, investments and deposits and affects interest rates charged on loans and paid on deposits. Indirectly such actions may also impact the ability of non-bank financial institutions to compete with us. The nature and impact of any future changes in monetary policies cannot be predicted.

The laws, regulations and policies affecting financial services businesses are continuously under review by Congress and state legislatures and by federal and state regulatory agencies. From time to time, legislation is enacted which has the effect of increasing the cost of doing business, limiting or expanding permissible activities, or affecting the competitive balance between banks and other financial intermediaries. Proposals to change the laws and regulations governing the operations and taxation of banks, bank holding companies and other financial intermediaries are frequently made in Congress, in the California legislature and by various bank regulatory agencies and other professional agencies. Changes in the laws, regulations or policies that impact us cannot necessarily be predicted, but they may have a material effect on our business and earnings.

The federal and state bank regulatory agencies may respond to concerns and trends identified in examinations by taking enforcement actions against, and entering into cease and desist orders, consent orders and memoranda of understanding with, financial institutions, that would require action by management and boards of directors to address credit quality, liquidity, risk management and capital adequacy concerns, as well as other safety and soundness or compliance issues. Banks and bank holding companies are also subject to examination and potential enforcement actions by their state regulatory agencies.

11

Table of Contents

Bank Holding Company and Bank Regulation

Bank holding companies and their subsidiaries are subject to significant regulation and restrictions by federal and state laws and regulatory agencies.  Federal and state laws, regulations and restrictions, which may affect the cost of doing business, limit permissible activities and expansion or impact the competitive balance between banks and other financial services providers, are intended primarily for the protection of depositors and the FDIC deposit insurance fund, and secondarily for the stability of the U.S. banking system. They are not intended for the benefit of shareholders of financial institutions. The following discussion of key statutes and regulations to which the Company and the Bank are subject is a summary and does not purport to be complete nor does it address all applicable statutes and regulations. This discussion is qualified in its entirety by reference to the statutes and regulations referred to in this discussion.

The wide range of requirements and restrictions contained in both federal and state banking laws include:

12

Table of Contents

The following discussion summarizes certain significant laws, rules and regulations affecting both the Company and the Bank. The Bank addresses the many state and federal regulations it is subject to through a comprehensive compliance program that addresses the various risks associated with these issues. The following discussion is not meant to cover all applicable rules and regulations and it is qualified in its entirety by reference to such laws, rules and regulations which may change from time to time.

The Dodd-Frank Wall Street Reform and Consumer Protection Act

The Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”), enacted in 2010 has broadly affected the financial services industry by creating resolution authorities, requiring ongoing stress testing of capital, mandating higher capital and liquidity requirements, increasing regulation of executive and incentive-based compensation and requiring numerous other provisions aimed at strengthening the sound operation of the financial services sector depending, in part, on the size of the financial institution. Among other things, the Dodd-Frank Act provides for:

As required by the Dodd-Frank Act, federal regulators have adopted regulations to (i) increase capital requirements on banks and bank holding companies pursuant to Basel III, and (ii) implement the so-called “Volcker Rule” of the Dodd-Frank Act, which significantly restricts certain activities by covered bank holding companies, including restrictions on proprietary trading and private equity investing.

13

Table of Contents

In addition to the Dodd-Frank Act, other legislative and regulatory proposals affecting banks have been made both domestically and internationally. Among other things, these proposals include significant additional capital and liquidity requirements and limitations on size or types of activity in which banks may engage.

Legislation is introduced from time to time in the United States Congress that may affect our operations. In addition, the regulations governing us may be amended from time to time. Any legislative or regulatory changes in the future could adversely affect our operations and financial condition.

Volcker Rule

The “Volcker Rule” prohibits insured depository institutions and companies affiliated with insured depository institutions (“banking entities”) from engaging in short-term proprietary trading of certain securities, derivatives, commodity futures and options on these instruments, for their own account. The Volker Rule also imposes limits on banking entities’ investments in, and other relationships with, hedge funds or private equity funds. Certain collateralized debt obligations, securities backed by trust preferred securities are exempted.

The Volker Rule provides exemptions for certain activities, including market making, underwriting, hedging, trading in government obligations, insurance company activities, and organizing and offering hedge funds or private equity funds. The Volker Rule also clarifies that certain activities are not prohibited, including acting as agent, broker, or custodian.

The compliance requirements under the Volker Rule vary based on the size of the banking entity and the scope of activities conducted. Banking entities with significant trading operations will be required to establish a detailed compliance program and their CEOs will be required to attest that the program is reasonably designed to achieve compliance with the final rule. Independent testing and analysis of an institution’s compliance program will also be required. The Volker Rule reduces the burden on smaller, less-complex institutions by limiting their compliance and reporting requirements. Additionally, a banking entity that does not engage in covered trading activities will not need to establish a compliance program. The Company and the Bank held no investment positions at December 31, 2025 or 2024 that were subject to the final rule.  Therefore, while these new rules may require us to conduct certain internal analysis and reporting, we believe that they will not require any material changes in our operations or business.

Capital Adequacy Requirements

Banks and bank holding companies are subject to various capital requirements administered by state and federal banking agencies. Capital adequacy guidelines involve quantitative measures of assets, liabilities and certain off-balance-sheet items calculated under regulatory accounting practices. Capital amounts and classifications are also subject to qualitative judgments by regulators about components, risk weighting and other factors.

The federal banking agencies have adopted risk-based minimum capital guidelines intended to provide a measure of capital that reflects the degree of risk associated with a banking organization’s operations for both transactions reported on the balance sheet as assets and transactions which are recorded as off balance sheet items. Under these guidelines, nominal dollar amounts of assets and credit equivalent amounts of off balance sheet items are multiplied by one of several risk adjustment percentages, which range from 0% for assets with low credit risk, such as federal banking agencies, to 100% for assets with relatively high credit risk. The higher the category, the more risk a bank is subject to and thus the more capital that is required.

The regulatory agencies’ risk-based capital guidelines are based upon capital accords of the internal Basel Committee on Bank Supervision (“Basel Committee”), a committee of central banks and bank supervisors/regulators from the major industrialized countries that develops broad policy guidelines, which each country’s supervisors can use to determine the supervisory policies they apply to their home jurisdiction. The U.S. regulatory capital rules implementing the Basel III regulatory capital framework provide for a minimum common equity Tier 1 ratio (4.5% of risk-weighted assets), a minimum Tier 1 risk-based capital requirement (6.0% of risk-weighted assets) and a minimum non-risk-based leverage ratio (4.00% eliminating a 3.00% exception for higher rated banks) as well as an additional capital conservation buffer of 2.5% of risk weighted assets over each of the required capital ratios , which must be met to avoid limitations on the ability of the Bank to pay dividends, repurchase shares or pay discretionary bonuses. The additional “countercyclical capital buffer” is also required for larger and more complex institutions. The rules assign higher risk weighting to exposures that are more than 90 days past due or are on nonaccrual status and certain commercial real estate facilities that finance the acquisition, development or construction of real property.

14

Table of Contents

In addition to the risk-based guidelines, federal banking regulators require banking organizations to maintain a minimum amount of Tier 1 capital to total average assets, referred to as the leverage ratio. Banks that have received the highest rating of the five categories used by regulators to rate banks and are not anticipating or experiencing any significant growth must maintain a ratio of Tier 1 capital (net of all intangibles) to adjusted total assets, or “Leverage Capital Ratio”, of at least 3%. All other institutions are required to maintain a leverage ratio of at least 100 to 200 basis points above the 3% minimum, for a minimum of 4% to 5%. Pursuant to federal regulations, banks must maintain capital levels commensurate with the level of risk to which they are exposed, including the volume and severity of problem loans.

Federal banking regulators may set capital requirements higher than the minimums described above for financial institutions whose circumstances warrant it. For example, a financial institution experiencing or anticipating significant growth may be expected to maintain capital positions substantially above the minimum supervisory levels without significant reliance on intangible assets.

A bank may be treated as though it were in the next lower capital category if, after notice and the opportunity for a hearing, the appropriate federal agency finds an unsafe or unsound condition or practice so warrants, but no bank may be treated as “critically undercapitalized” unless its actual capital ratio warrants such treatment.

At each successively lower capital category, an insured bank is subject to increased restrictions on its operations. For example, a bank is generally prohibited from paying management fees to any controlling persons or from making capital distributions, if to do so would make the Bank “undercapitalized.” Asset growth and branching restrictions apply to undercapitalized banks, which are required to submit written capital restoration plans meeting specified requirements (including a guarantee by the parent holding company, if any). “Significantly undercapitalized” banks are subject to broad regulatory authority, including among other things, capital directives, forced mergers, restrictions on the rates of interest they may pay on deposits, restrictions on asset growth and activities, and prohibitions on paying certain bonuses without FRB approval. Even more severe restrictions apply to critically undercapitalized banks. Most importantly, except under limited circumstances, the appropriate federal banking agency is required to appoint a conservator or receiver for an insured bank not later than 90 days after the Bank becomes critically undercapitalized.

In addition to measures taken under the prompt corrective action provisions, insured banks may be subject to potential actions by federal regulators for unsafe or unsound practices in conducting their businesses or for violations of any law, rule, regulation or any condition imposed in writing by the agency or any written agreement with the agency. Enforcement actions may include the issuance of cease and desist orders, termination of insurance of deposits (in the case of a bank), the imposition of civil money penalties, the issuance of directives to increase capital, formal and informal agreements, or removal and prohibition orders against “institution-affiliated” parties.

The Basel IV framework was introduced in 2017 and focuses on the denominator of the capital ratio or the measurement of a bank’s risk positions, especially in credit, market, counterparty and operational risk for banks with over $100 billion in assets and has market risk provisions for banks with significant trading activity. Although U.S. regulators originally targeted implementation of Basel IV to begin on July 1, 2025, subject to a three-year transition period with full compliance expected by July 1, 2028, the federal banking agencies indicated in September 2025 that they intend to unveil a re-proposal of the Basel IV capital rules by early 2026. Accordingly, the previously established implementation dates for Basel IV are no longer definitive, and the timing, scope, and final form of the re-proposed Basel IV framework remains uncertain.

Although, Basel IV seeks to regulate banks with over $100 billion in assets and likely will not be applicable to the Company if implemented in its proposed form, proposed rules which would affect banks below $100 billion in assets have been proposed in the past and the final form of the rules is still undetermined. Its implementation may also cause changes in the financial markets which may affect the Company.1

Dividends

The payment of cash dividends by the Bank to the Company is subject to restrictions set forth in the Financial Code.  Prior to any distribution from the Bank to the Company, a calculation is made to ensure compliance with the provisions of the Financial Code and to ensure that the Bank remains within capital guidelines set forth by the DFPI and the FRB. In the event that the intended distribution from the Bank to the Company exceeds the restriction in the Financial Code, advance approval from the FRB is required. Management anticipates that there will be sufficient earnings at the Bank level to provide dividends to the Company to meet its cash requirements for 2026.

1 https://www.fdic.gov/news/speeches/2023/spjul2723b.html. https://www.federalreserve.gov/aboutthefed/boardmeetings/fact-sheet-basel-20230727.pdf.

15

Table of Contents

Safety and Soundness Standards

Federal banking agencies have also adopted guidelines establishing safety and soundness standards for all insured depository institutions. Those guidelines relate to internal controls, information systems, internal audit systems, loan underwriting and documentation, compensation and interest rate exposure. In general, the standards are designed to assist the federal banking agencies in identifying and addressing problems at insured depository institutions before capital becomes impaired. If an institution fails to meet these standards, the appropriate federal banking agency may require the institution to submit a compliance plan and institute enforcement proceedings, if an acceptable compliance plan is not submitted.

Compensation

Federal banking agencies have issued joint guidance on incentive compensation designed to ensure that the incentive compensation policies of banking organizations such as the Company are consistent with the safety and soundness of the organization and its subsidiary banks. In 2016, as required by the Dodd-Frank Act, the federal bank regulatory agencies and the SEC proposed revised rules on incentive-based payment arrangements at specified regulated entities having at least $1 billion of total assets. These guidelines prohibit excessive compensation as an unsafe and unsound practice and describe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director, or principal stockholder.

Deposit Insurance and FDIC Insurance Assessments

Our deposits are insured by the FDIC to the maximum amount permitted by law, which is currently $250,000 per depositor.

As insurer, the FDIC imposes deposit insurance premiums and is authorized to conduct examinations of and to require reporting by FDIC-insured institutions.

The FDIC assesses deposit insurance premiums quarterly on each FDIC-insured institution based on annualized rates. Each institution with $10 billion or more in assets is assessed under a scorecard method using supervisory ratings, financial ratios and other factors. Such institutions are also subject to a temporary surcharge required by the Dodd-Frank Act. As required by the Dodd-Frank Act, deposit insurance premiums are assessed on the amount of an institution’s total assets minus its Tier 1 capital. Smaller institutions are assessed by a method using supervisory ratings and financial ratios.

Community Reinvestment Act

We are subject to certain requirements and reporting obligations involving the CRA. The CRA generally requires federal banking agencies to evaluate the record of financial institutions in meeting the credit needs of local communities, including low and moderate-income neighborhoods. The CRA further requires that a record be kept of whether a financial institution meets its community credit needs, which record will be taken into account when evaluating applications for, among other things, domestic branches, consummating mergers or acquisitions, or holding company formations. In measuring a bank’s compliance with its CRA obligations, the regulators now utilize a performance-based evaluation system, which bases CRA ratings on the Company’s actual lending service and investment performance, rather than on the extent to which the institution conducts needs assessments, documents community outreach activities or complies with other procedural requirements. In connection with its assessment of CRA performance, the FRB assigns a rating of “outstanding,” “satisfactory,” “needs to improve” or “substantial noncompliance.” Our CRA performance is evaluated by the FRB under the intermediate small bank requirements. The FRB’s last CRA performance examination was performed on us and completed in January of 2023 and we received an overall “Outstanding” CRA Assessment Rating.

On May 5, 2022, the FDIC, Office of the Comptroller of the Currency (“OCC”) and the Federal Reserve issued a joint notice of proposed rulemaking to strengthen and modernize the CRA regulatory framework. On October 24, 2023, the federal bank regulatory agencies jointly issued a final rule to modernize CRA regulations consistent with the following key goals: (1) to encourage banks to expand access to credit, investment, and banking services in low to moderate income communities; (2) to adapt to changes in the banking industry, including internet and mobile banking and the growth of non-branch delivery systems; (3) to provide greater clarity and consistency in the application of the CRA regulations, including adoption of a new metrics-based approach to evaluating bank retail lending and community development financing; and (4) to tailor CRA evaluations and data collection to bank size and type, recognizing differences in bank size and business models may impact CRA evaluations and qualifying activities. Most of the final CRA rules requirements were to become applicable beginning January 1, 2026, with certain requirements, including the data reporting requirements, applicable as of January 1, 2027. However, on March 29, 2024, a federal court enjoined the enforcement of the new CRA regulations. On July 16, 2025, the OCC, the FRB, and the FDIC issued a joint Notice of Proposed Rulemaking proposing to rescind the new CRA regulations and replace it with regulations substantively identical to those in effect on March 29, 2024, as originally adopted by the agencies in 1995 and reinstated by the OCC in 2021. As a result, the previous CRA regulations continue to govern. We will continue to monitor for updates related to the CRA regulatory framework and are currently evaluating the impact of the modified CRA regulations, but do not anticipate any resulting material impact to its operations or compliance objectives, if implemented.

16

Table of Contents

Anti-Money Laundering Regulations

A series of banking laws and regulations beginning with the Bank Secrecy Act in 1970 require banks to prevent, detect, and report illicit or illegal financial activities to the federal government to prevent money laundering, international drug trafficking, and terrorism. Under the USA Patriot Act, financial institutions are subject to prohibitions against specified financial transactions and account relationships as well as enhanced due diligence and “know your customer” standards in their dealings with high risk customers, foreign financial institutions, and foreign individuals and entities. We have extensive controls to comply with these requirements.

On September 29, 2022, the Financial Crimes Enforcement Network (“FinCEN”) issued a final rule establishing a beneficial ownership information (“BOI”) reporting requirement under the Corporate Transparency Act (“CTA”), which was passed as part of the Anti-Money Laundering Act of 2020. The CTA aims to combat money laundering, securities and tax fraud, terrorism financing, human and drug trafficking, counterfeiting, and other corrupt, nefarious activities by preventing bad actors from concealing their ownership of U.S. entities to advance their illicit operations. The rule, which became effective January 1, 2024, as originally contemplated, would have required most entities created in or registered to do business in the United States, subject to certain exceptions, to report information about their beneficial owners to FinCEN. Although FinCEN originally set a deadline of January 1, 2025, for entities to file BOI reports, on March 26, 2025, FinCEN issued an Interim Final Rule that removed the requirement for U.S. companies and U.S. persons to report BOI to FinCEN under the CTA, meaning only foreign entities formed outside the U.S. that are registered to do business in the U.S. are currently subject to the CTA’s BOI reporting obligations. On February 20, 2024, the CTA’s access rule, which implements the CTA’s access and safeguard provisions, took effect, under which a reporting company’s BOI is deemed confidential but can be disclosed by FinCEN to six categories of recipients, including financial institutions that are subject to customer due diligence obligations and have received the reporting company’s consent to access its BOI. As a result of the Interim Final Rule, while the CTA’s access rule remains in effect, its practical applicability is limited to BOI submitted to FinCEN by foreign reporting companies that continue to have reporting obligations under the CTA. Overall, the status of the CTA and related BOI reporting requirements remains in flux due to ongoing litigation and regulatory developments concerning the constitutionality and implementation of the CTA. Legislation to repeal the CTA has also been brought before Congress, and it is unclear the extent to which the CTA will be enforced. The Interim Final Rule stated that FinCEN was accepting comments to the Interim Final Rule through May 27, 2025, would evaluate the rule Interim Final Rule’s exemptions to BOI reporting in light of the comments received, and expected to issue a final rule addressing BOI requirements under the CTA during 2025. However, as of December 2025, FinCEN was still in the process of reviewing comments to the Interim Final Rule, and no final rule has been issued by FinCEN to date. Although we are not currently subject to the CTA’s BOI reporting requirements as a result of the Interim Final Rule, we will continue to monitor FinCEN’s guidance, and any final rules or other regulatory developments relating to the CTA and will assess the applicability of any resulting reporting obligations.

On March 2, 2025, the Treasury Department announced it will not enforce any penalties or fines associated with the BOI reporting rule under the existing regulatory deadlines, and further not enforce any penalties or fines against U.S. citizens or domestic reporting companies or their beneficial owners after the rule changes take effect.

In 2024, federal regulators, including the Federal Reserve and the OCC, proposed amendments to update the requirements to establish, implement and maintain effective, risk-based and reasonably designed anti-money laundering programs, including the identification, evaluation and documentation of money laundering risks. We continue to monitor for updates related to the CTA and Anti-Money Laundering Act of 2020.

17

Table of Contents

Privacy, Data Security and Cybersecurity

We are, or may become, subject to a variety of continuously evolving and developing laws and regulations in the United States at the federal, state and local level regarding privacy, data protection and data security, including those related to the collection, storage, handling, use, disclosure, transfer, security and other processing of personal information. For example, the GLBA of 1999 imposed requirements on financial institutions with respect to consumer privacy. The GLBA generally prohibits disclosure of consumer information to non-affiliated third parties unless the consumer has been given the opportunity to object and has not objected to such disclosure. Financial institutions are further required to disclose their privacy policies to consumers annually. The GLBA also directs federal regulators to prescribe standards for the security of consumer information. We are subject to such standards, as well as standards for notifying consumers in the event of a security breach. We must disclose our privacy policy to consumers and permit consumers to “opt out” of having certain personal financial information disclosed to unaffiliated third parties. We are required to have an information security program to safeguard the confidentiality and security of customer information and to ensure proper disposal. Customers must be notified when unauthorized disclosure involves sensitive customer information that may be misused.

Data privacy and data security are areas of increasing state legislative focus. For example, the California Consumer Protection Act of 2018 (the “CCPA”), which became effective on January 1, 2020, applies to for-profit businesses that conduct business in California and meet certain revenue or data collection thresholds. The CCPA gives California residents the right to, among other things, request disclosure of information collected about them and whether that information has been sold to others, request deletion of personal information (subject to certain exceptions), opt out of the sale of their personal information, and not be discriminated against for exercising these rights. In 2020, the California Privacy Rights Act (“CPRA”) was approved and became effective on January 1, 2023. The CPRA amended the CCPA by adding additional consumer privacy rights and obligations for businesses. It also established the California Privacy Protection Agency and tasked it with responsibilities including implementing and enforcing the law. In addition, the CPRA significantly modifies the CCPA, including by expanding California residents’ rights with respect to certain sensitive personal information. We will continue to monitor developments related to the CPRA. The full impact of the CPRA on our business is yet to be determined.

Like other lenders, we use credit bureau data in their underwriting activities. Use of such data is regulated under the Fair Credit Reporting Act (“FCRA”), and the FCRA also regulates reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information between affiliates and using affiliate data for marketing purposes. Similar state laws may impose additional requirements on us.

Cybersecurity also remains an area of significant regulatory focus, and state regulators have also been increasingly active in implementing cybersecurity standards and regulations. In November 2021, the Federal Reserve, OCC, and FDIC issued a final rule that, among other things, requires all banking organizations in the United States to notify their primary federal regulators of certain material computer-security incidents as soon as possible and no later than 36 hours after determining that the incident has occurred.

The enactment of the Cyber Incident Reporting for Critical Infrastructure Act (the “CIRCIA”) in 2022, once rulemaking is complete, will require, among other things, certain companies to report significant cyber incidents to the Cybersecurity and Infrastructure Agency (the “CISA”) within 72 hours from the time the company reasonably believes the incident occurred (and within 24 hours of making a ransom payment as a result of a ransomware attack). On April 4, 2024, the CISA proposed a rule under the CIRCIA that would clarify the scope of cyber incidents to be reported and would further define covered entities subject to CIRCIA to expressly include companies in the financial services industry that are required to report cyber incidents to their primary federal regulators.

The SEC recently issued a Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure rule, which became effective in December of 2023, and which requires that a registered company file a Form 8-K to disclose the occurrence of a material cybersecurity incident within four business days of determining that such an incident has occurred. The rule also requires that a registered company include certain information regarding its information security program as part of its annual Form 10-K filing, including a discussion of its processes for assessing, identifying, and managing material risks from cybersecurity threats and a description of oversight and management of cybersecurity threats at the board and management levels.

Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually monitoring developments, particularly if the CFPB is no longer enforcing federal financial institution consumer privacy laws and regulations since it was instructed to cease all supervision, investigations, enforcement, rulemaking, and stakeholder activities in February 2025.  We continue to monitor these developments and integrate applicable requirements into our operation and compliance frameworks.

In February 2024, the National Institute of Standards and Technology (“NISTU”) released Cybersecurity Framework 2.0, expanding its original guidance to emphasize cybersecurity governance and supply chain risk management. While we are not mandated to adopt this updated framework, our cybersecurity policies, governance structures, vendor risk management practices, and employee training programs align substantively with the principles of the NIST Cybersecurity Framework 2.0. We continue to leverage this framework as a guiding best practice to enhance our cybersecurity posture and manage risks effectively.

18

Table of Contents

Mergers and Acquisitions

On September 17, 2024, the Board of Directors of the FDIC approved a final Statement of Policy on Bank Merger Transactions (“FDIC Statement of Policy”), and the OCC approved a final rule updating its regulations for business combinations involving national banks and federal savings associations (“OCC Final Rule”). The OCC Final Rule also includes a policy statement mirroring the FDIC Statement of Policy regarding the Bank Merger Act statutory factors, but also describes the general principles the OCC applies when reviewing bank merger applications (“OCC Statement of Policy”).

In September 2024, the Department of Justice (the “DOJ”) withdrew its 1995 Bank Merger Guidelines and issued the 2024 Banking Addendum to 2023 Merger Guidelines (the “2024 Banking Addendum”). The DOJ clarified that it will assess competition considerations in connection with bank and bank holding company mergers using its 2023 Merger Guidelines, which is the general merger review framework the DOJ now uses to evaluate transactions in all segments of the economy, and 2024 Banking Addendum. The 2024 Banking Addendum provides guidance on how the DOJ will assess competition in the context of bank and bank holding company mergers. An analysis under the 2023 Merger Guidelines and 2024 Banking Addendum may include consideration of theories of harm and relevant markets not considered under the 1995 Bank Merger Guidelines, which focused primarily on concentrations of deposits and branches.

Other Consumer Protection Laws and Regulations

Bank regulatory agencies are increasingly focusing on compliance with consumer protection laws and regulations.

Interest and other charges collected or contracted for by the Bank are subject to state usury laws and federal laws concerning interest rates. The Bank’s operations are also subject to federal laws applicable to credit transactions, and consumer protection statutes and regulations, such as the:

On March 5, 2024, the Consumer Financial Protection Bureau (CFPB) issued a final rule amending provisions in Regulation Z that govern credit card late fee charges, significantly lowering the safe harbor amount for past due fees that large credit card issuers. The final rule is currently stayed as a result of ongoing litigation. In addition, in October 2024, the CFPB issued a final rule that will require certain financial institutions to share certain data on certain consumer financial products and services upon request of the consumer that could significantly impact our costs and our ability to protect and secure such information. In February 2025, the Acting Director of the CFPB instructed staff to cease supervision and examination activities, pause pending investigation and enforcement actions, and not approve or issue any proposed or final rules. We continue to monitor CFPB development and the implementation of new rules. While it is presently unclear if, when and to what extent the CFPB will resume its activities, other governmental authorities, including state attorneys general or banking regulators, may seek to increase their regulation, supervision, and enforcement of providers of consumer financial products and services in response to changes at the CFPB. Moreover, changes at the CFPB may lead to federal legislative efforts to alter the framework for consumer financial services regulation.

The operations of the Bank are also subject to the:

19

Table of Contents

Due to heightened regulatory concern related to compliance with consumer protection laws and regulations generally, we may incur additional compliance costs or be required to expend additional funds for investments in the local communities we serve.

Restriction on Transactions between Member Banks and their Affiliates

Transactions between the Company and the Bank are quantitatively and qualitatively restricted under Sections 23A and 23B of the Federal Reserve Act and Federal Reserve Regulation W. Section 23A places restrictions on the Bank’s “covered transactions” with the Company, including loans and other extensions of credit, investments in the securities of, and purchases of assets from the Company. Section 23B requires that certain transactions, including all covered transactions, be on market terms and conditions. Federal Reserve Regulation W combines statutory restrictions on transactions between the Bank and the Company with FRB interpretations in an effort to simplify compliance with Sections 23A and 23B.

Securities Laws and Corporate Governance

The Company is subject to the disclosure and regulatory requirements of the 1933 Act and the 1934 Act, both as administered by the SEC. As a company listed on the Nasdaq Global Select Market, the Company is subject to Nasdaq listing standards for listed companies.

As discussed above, we are also subject to the Sarbanes-Oxley Act of 2002, provisions of the Dodd-Frank Act, and other federal and state laws and regulations which address, among other issues, required executive certification of financial presentations, corporate governance requirements for board audit committees and their members, and disclosure of controls and procedures and internal control over financial reporting, auditing and accounting, executive compensation, and enhanced and timely disclosure of corporate information. Nasdaq has also adopted corporate governance rules, which are intended to allow shareholders and investors to more easily and efficiently monitor the performance of companies and their directors.

Finally, the Company is subject to the provisions of the California General Corporation Law, while the Bank is also subject to the Financial Code provisions.

Environmental Regulations

In the course of our business, we may foreclose and take title to real estate, and could be subject to environmental liabilities with respect to these properties. We may be held liable to a governmental entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination, or may be required to investigate or clean up hazardous or toxic substances, or chemical releases at a property. The costs associated with investigation or remediation activities could be substantial. In addition, as the owner or former owner of a contaminated site, we may be subject to common law claims by third parties based on damages and costs resulting from environmental contamination emanating from the property. If we ever become subject to significant environmental liabilities, our business, financial condition, liquidity and results of operations could be materially and adversely affected.

Climate-related Developments

Climate change and the risks it may pose to financial institutions is an area of increased focus by the federal and state legislative bodies and regulators, including the federal banking agencies. In the future, new regulations or guidance may be issued, or other regulatory or supervisory actions may be taken, in this area by the federal banking agencies or other regulatory agencies, or new statutory requirements may be adopted. For example, the federal banking agencies have issued principles for climate-related financial risk management, which are designed to support the identification and management of climate-related financial risks at regulated institutions with more than $100 billion in total consolidated assets. On March 6, 2024, the SEC adopted new rules that require public companies to disclose substantial information about the material impacts of climate-related risks on their business, financial condition, and governance. These new rules would require disclosure of a range of climate-related matters. Various states and private parties have challenged the rules. The litigation was consolidated in the U.S. Eighth Circuit Court of Appeals, and the SEC previously stayed effectiveness of the rules pending completion of that litigation. Furthermore, the SEC notified the court that the SEC would cease its involvement in the defense of the rule, leaving it uncertain as to whether it will become effective.

20

Table of Contents

Other Pending and Proposed Legislation

Other legislative and regulatory initiatives which could affect us and the banking industry, in general, are pending and additional initiatives may be proposed or introduced before the United States Congress, the California legislature and other governmental bodies in the future. Such proposals, if enacted, may further alter the structure, regulation and competitive relationship among financial institutions, and may subject us to increased regulation, disclosure and reporting requirements. In addition, the various banking regulatory agencies often adopt new rules and regulations to implement and enforce existing legislation. We cannot predict whether, or in what form, any such legislation or regulations may be enacted or the extent to which our business would be affected thereby.

Available Information

The Company maintains an Internet website at www.ovcb.com. The Company makes available its annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and amendments to such reports filed or furnished pursuant to Section 13(a) or 15(d) of the 1934 Act and other information related to the Company free of charge, through this site as soon as reasonably practicable after it electronically files those documents with, or otherwise furnishes them to, the SEC. The SEC maintains a website, http://www.sec.gov, that contains the reports, proxy and information statements and other information we file with them. The Company’s website also contains its Committee Charters, Code of Ethics, Code of Conduct and Corporate Governance Guidelines. We also use our website as a tool to disclose important information about the company and comply with our disclosure obligations under Regulation Fair Disclosure. The Company’s internet website and the information contained therein or connected thereto are not intended to be incorporated into this annual report on Form 10-K.

In addition, copies of our filings are available by requesting them in writing or by phone from:

Corporate Secretary

Oak Valley Bancorp

125 North Third Avenue

Oakdale, California

209-844-7578