grepcent / static financial knowledge base

SOUTHSIDE BANCSHARES INC (SBSI) Business

Verbatim Item 1 Business section from SOUTHSIDE BANCSHARES INC's latest 10-K. Filing date: 2026-02-27. Accession: 0000705432-26-000034.

This page reproduces the company's own Item 1 Business text from the linked SEC filing. It is filer text, not grepcent analysis, scoring, or investment advice.

Informational only - not investment advice. See Disclaimer.

Extracted from Item 1 Business to the first Item 1A/1B/1C/2 boundary after HTML sanitization. Confidence: high. Source form: 10-K. Character span: 70210-150930.

Back to SBSI company profile

ITEM 1.    BUSINESS

FORWARD-LOOKING INFORMATION

The disclosures set forth in this item are qualified by the section captioned “Cautionary Notice Regarding Forward-Looking Statements” in “Item 7.  Management’s Discussion and Analysis of Financial Condition and Results of Operations” of this Annual Report on Form 10-K and other cautionary statements set forth elsewhere in this report.

GENERAL

Southside Bancshares, Inc., incorporated in Texas in 1982, is a bank holding company for Southside Bank, a Texas state bank headquartered in Tyler, Texas that was formed in 1960.  We operate through 53 branches, 12 of which are located in grocery stores, in addition to wealth management and trust services, and/or loan production, brokerage or other financial services offices.

At December 31, 2025, our total assets were $8.51 billion, total loans were $4.82 billion, total deposits were $6.87 billion and total equity was $847.6 million.  For the years ended December 31, 2025 and 2024, our net income was $69.2 million and $88.5 million, respectively. For the years ended December 31, 2025 and 2024, diluted earnings per common share was $2.29 and $2.91, respectively.  We have paid a cash dividend to shareholders every year since 1970 (including dividends paid by Southside Bank prior to the incorporation of Southside Bancshares).

We are a community-focused financial institution that offers a full range of financial services to individuals, businesses, municipal entities and nonprofit organizations in the communities that we serve. These services include consumer and commercial loans, deposit accounts, wealth management, trust and brokerage services.

Our consumer loan services include 1-4 family residential loans, home equity loans, home improvement loans, automobile loans and other consumer related loans.  Commercial loan services include short-term working capital loans for inventory and accounts receivable, short- and medium-term loans for equipment or other business capital expansion, commercial real estate loans and municipal loans.  We also offer construction loans for 1-4 family residential and commercial real estate.

We offer a variety of deposit accounts with a wide range of interest rates and terms, including savings, money market, interest and noninterest bearing checking accounts and CDs.

Our trust and wealth management services include investment management, administration of irrevocable, revocable and testamentary trusts, estate administration, and custodian services, primarily for individuals and, to a lesser extent, partnerships and corporations.  Additionally, we offer retirement and employee benefit accounts, including but not limited to, IRAs, 401(k) plans and profit-sharing plans. At December 31, 2025, our wealth management and trust assets under management were approximately $1.65 billion.

Our business strategy includes evaluating expansion opportunities through acquisitions of financial institutions in market areas that could complement our existing franchise. We generally seek merger partners that are culturally similar, have experienced management teams and possess either significant market presence or have potential for improved profitability through financial management, economies of scale or expanded services.

We and our subsidiaries are subject to comprehensive regulation, examination and supervision by the SEC, the Federal Reserve, the TDB and the FDIC and are subject to numerous laws and regulations relating to internal controls, the extension of credit, making of loans to individuals, deposits and all other facets of our operations.

Our primary executive offices are located at 1201 South Beckham Avenue, Tyler, Texas 75701 and our telephone number is 903-531-7111.  Our website can be found at www.southside.com.  Our public filings with the SEC may be obtained free of charge on either our website, https://investors.southside.com/ under the topic Financials, or the SEC’s website, www.sec.gov, as soon as reasonably practicable after filing with the SEC. We include our website address throughout the filing only as textual references. The information contained on our website is not incorporated in this document by reference.

4

Table of Contents

MARKET AREA

We are headquartered in Tyler, Texas. The Tyler metropolitan area has an estimated population of 245,000 and is located approximately 90 miles east of Dallas, Texas and 90 miles west of Shreveport, Louisiana.

We consider our primary market areas to be East Texas, Southeast Texas, as well as the greater Dallas-Fort Worth, Austin and Houston, Texas areas. Our expectation is that our presence in all of the market areas we serve should grow in the future. In addition, we continue to explore new markets in which we believe we can successfully expand.

The principal economic activities in our market areas include medical services, retail, education, financial services, technology, distribution, manufacturing, government and to a lesser extent, oil and gas industries.  These economic activities support a growing regional system of medical service, retail and education centers. Tyler, Dallas-Fort Worth, Austin and Houston are home to several nationally recognized health care systems that represent all major specialties.

Our 53 branches, 37 drive-thru facilities and two LPOs are located in and around Arlington, Austin, Bullard, Chandler, Cleburne, Cleveland, Dallas, Diboll, Euless, Fort Worth, Frisco, Granbury, Grapevine, Gresham, Gun Barrel City, Hawkins, Hemphill, Houston, Irving, Jacksonville, Jasper, Lindale, Longview, Lufkin, Nacogdoches, Palestine, Pineland, San Augustine, Splendora, The Woodlands, Tyler, Watauga, Weatherford and Whitehouse. Our advertising is designed to target the market areas we serve.  The type and amount of advertising in each location is determined based on our market share in that area, combined with overall cost by market.

Additionally, our customers may access various banking services through a wide network of ATMs, ITMs, automated telephone, internet and mobile banking products. Customers can apply for loans, open deposit accounts, access account information and conduct various other transactions online from their smart phones or computers.

RECENT DEVELOPMENTS

We expect to open traditional branch locations at Bellwood Park in Tyler, Texas and The Woodlands in the first quarter of 2026.

THE BANKING INDUSTRY IN TEXAS

The banking industry is affected by general economic conditions such as interest rates, inflation, recession, unemployment and other factors beyond our control. During the last 30 years the Texas economy has continued to diversify, decreasing the overall impact of fluctuations in oil and gas prices; however, the oil and gas industry is still a significant component of the Texas economy. Continued tariff announcements and ongoing tariff negotiations have caused some uncertainty related to inflation levels and its impact on the overall economy. While it is too early to discern the likely outcome of these tariff announcements and negotiations, the current economic conditions and growth prospects for our markets continue to reflect a solid and positive outlook. Higher inflation levels and interest rate fluctuations could have a negative impact on both our consumer and commercial borrowers in the future. Overall, however, the Texas markets we serve remain healthy.

COMPETITION

The activities we are engaged in are highly competitive.  Financial institutions such as credit unions, fintech companies, consumer finance companies, insurance companies, brokerage companies and other financial institutions with varying degrees of regulatory restrictions compete vigorously for a share of the financial services market. Fintech, brokerage and insurance companies continue to become more competitive in the financial services arena and pose an ever-increasing challenge to banks. Legislative changes also greatly affect the level of competition we face. Federal legislation allows credit unions to use their expanded membership capabilities, combined with tax-free status, to compete more openly for traditional bank business. The tax-free status granted to credit unions provides them with a significant competitive advantage. Many of the largest banks operating in Texas, including some of the largest banks in the country, have offices in our market areas with capital resources, broader geographic markets and legal lending limits substantially in excess of those available to us. We face competition from institutions that offer products and services we do not or cannot currently offer. Some institutions we compete with offer interest rate levels on loan and deposit products that we are unwilling to offer due to interest rate risk and overall profitability concerns. We expect the level of competition in the financial services market to continue to increase.

HUMAN CAPITAL RESOURCES

At December 31, 2025, we employed approximately 781 full time equivalent persons. None of our employees are represented by any unions or similar groups. We consider the relationship with our employees to be good, which we believe to be reflected in the average tenure of our employees exceeding eight years, with the tenure of 33% of our employees exceeding

5

Table of Contents

ten years. As of December 31, 2025, women and ethnic minorities represented approximately 68% and 41% of our workforce, respectively.

During 2025, Southside was awarded “Best Banks to Work For” by American Banker for the fourth consecutive year, “Best Companies to Work For in Fort Worth” for the third consecutive year, and for the first time, received the distinction of “Best Place to Work in Texas” by the Best Companies Group. These awards identify organizations that excel at creating positive and supportive workplaces for employees. We continuously work toward an outstanding workplace with competitive benefits for employees through our initiatives outlined below.

The health, safety and wellness of our employees is a top priority for Southside. In 2025, we continued to focus on the health and wellness of our employees through several company-wide efforts including a wellness program that allows employees to earn cash rewards, as well as wellness communications and webinars throughout the year. We maintain a comprehensive employee handbook, code of business conduct, as well as other policies, including a harassment policy, whistleblower policy and a human rights policy statement, to promote a safe and supportive workplace culture.

We believe employees to be our greatest asset and that our future success depends on our ability to attract, retain and develop employees. Professional development is a key priority, which is facilitated through our many corporate initiatives including extensive training programs, corporate mentoring, leadership programs, educational reimbursement and corporate and personal development coaching. We recognize and award employees through several different initiatives centered around service to Southside and initiatives that impact workplace culture and the communities we serve.

Effective communication is critical to supporting our employees and is carried out through our weekly newsletters, executive announcements, quarterly Town Hall meetings and our corporate intranet.

As part of our effort to attract and retain employees, we offer a broad range of benefits, including, but not limited to, 15-30 days of annual paid time off based on length of employment, sick leave, parental leave, participation in our ESOP, 401(k) match for eligible employees and up to 20 hours of paid time off annually to volunteer. We believe our compensation packages and benefits are competitive with others in our industry. For additional information regarding our employee benefit plans, see “Note 10 - Employee Benefits” to our consolidated financial statements included in this report.

6

Table of Contents

SUPERVISION AND REGULATION

General

Banking is a complex, highly regulated industry.  As a bank holding company under federal law, the Company is subject to regulation, supervision and examination by the Federal Reserve. As a Texas-chartered state bank, Southside Bank is subject to regulation, supervision and examination by the TDB, as its chartering authority, and by the FDIC, as its primary federal regulator and deposit insurer.  This system of regulation and supervision provides a comprehensive legal framework for our operations and is intended primarily for the protection of bank depositors, the FDIC’s DIF and the public, rather than our shareholders and creditors.

In addition to the system of regulation and supervision outlined above, the CFPB has authority to supervise and examine depository institutions with more than $10 billion in assets for compliance with these federal consumer laws. The CFPB also has rulemaking authority for a range of consumer financial protection laws (such as TILA, the Electronic Fund Transfer Act and RESPA, among others). The authority to supervise and examine depository institutions with $10 billion or less in assets (such as Southside Bank) for compliance with federal consumer laws remains largely with those institutions’ primary regulators.  However, the CFPB may participate in examinations of these smaller institutions on a “sampling basis” and may refer potential enforcement actions against such institutions to their primary regulators.  Accordingly, the CFPB may participate in examinations of Southside Bank, and could supervise and examine other direct or indirect subsidiaries of the Company that offer consumer financial products or services. Notwithstanding ongoing, legal, budgetary and structural challenges affecting the CFPB, the CFPB remains an active federal regulatory agency with continuing supervisory and enforcement authority and retains its broad authority to pursue enforcement actions, including investigations, civil actions and cease and desist proceedings. The CFPB may also refer civil and criminal findings to the Department of Justice for prosecution.

The earnings of Southside Bank and, therefore, the earnings of the Company, are affected by general economic conditions, changes in federal and state laws and regulations and actions of various regulatory authorities, including those referenced above.

Significant changes to federal and state laws, changes in the interpretation or application of such laws by regulators, and/or the enactment of new legislation or adoption of new regulations could (i) materially impact the profitability of our business, the value of assets we hold, or the value of collateral available for our loans; (ii) require changes to our business practices; (iii) force us to discontinue certain business lines; and/or (iv) otherwise expose us to additional costs, taxes, liabilities, enforcement actions and reputational risk.  The likelihood, timing and scope of any such change of law, and the impact that any such change may have on us, are impossible to determine with any certainty.

Set forth below are brief descriptions of the significant federal and state laws and regulations to which we are currently subject.  These descriptions do not purport to be complete and are qualified in their entirety by reference to the particular statutory or regulatory provisions.

Holding Company Regulation

The Company is registered as a bank holding company with the Federal Reserve under the BHCA and qualifies for and has elected to be treated as a financial holding company. As such, we are subject to comprehensive supervision and regulation by the Federal Reserve and are subject to its regulatory reporting requirements. The Company is required to file annual and other reports with, and furnish information to, the Federal Reserve, which makes periodic inspections of the Company.

Violations of laws and regulations, or other unsafe and unsound practices, may result in regulatory agencies imposing fines or penalties, cease and desist orders, or taking other enforcement actions. Under certain circumstances, these agencies may enforce these remedies directly against officers, directors, employees, and other parties participating in the affairs of a bank or bank holding company. Like all bank holding companies, we are regulated extensively under federal and state law. Under federal and state laws and regulations pertaining to the safety and soundness of insured depository institutions, state banking regulators, the Federal Reserve, and separately the FDIC as the insurer of bank deposits have the authority to compel or restrict certain actions on our part if they determine that we have insufficient capital or other resources, or are otherwise operating in a manner that may be deemed inconsistent with safe and sound banking practices. Under this authority, our regulators can require us or our subsidiaries to enter into informal or formal supervisory agreements, including board resolutions, memoranda of understanding, written agreements, and consent or cease and desist orders pursuant to which we would be required to take identified corrective actions to address cited concerns and to refrain from taking certain actions.

If we become subject to, and are unable to comply with, the terms of any regulatory actions or directives, supervisory agreements or orders, we could become subject to additional, heightened supervisory actions and orders, possibly including prompt corrective action restrictions or other regulatory actions, including prohibitions on the payment of dividends on our common stock and preferred stock. If our regulators were to take such supervisory actions, then we could, among other things, become subject to significant restrictions on our ability to develop new business, as well as restrictions on our existing business,

7

Table of Contents

and we could be required to raise additional capital, dispose of certain assets and liabilities within a prescribed period of time, or both. The terms of any such action could have a material negative effect on our business, reputation, operating flexibility, financial condition, and the value of our stock.

Permitted Activities. Under the BHCA, a bank holding company is limited to managing or controlling banks, furnishing services to or performing services for our subsidiaries, and engaging in other activities that the Federal Reserve determines by regulation or order to be the business of banking, managing, or controlling banks, furnishing services to or performing services for its subsidiaries and certain other activities determined by the Federal Reserve to be closely related to banking. In determining whether a particular activity is permissible, the Federal Reserve must consider whether the performance of such an activity reasonably can be expected to produce benefits to the public that outweigh possible adverse effects. Possible benefits include greater convenience, increased competition, and gains in efficiency. Possible adverse effects include undue concentration of resources, decreased or unfair competition, conflicts of interest and unsound banking practices. Examples of activities the Federal Reserve has previously determined are closely related to banking include:

◦factoring accounts receivable;

◦making, acquiring, brokering or servicing loans and usual related activities;

◦leasing personal or real property;

◦operating a nonbank depository institution, such as a savings association;

◦performing trust company functions;

◦conducting financial and investment advisory activities;

◦conducting discount securities brokerage activities;

◦underwriting and dealing in government obligations and money market instruments;

◦providing specified management consulting and counseling activities;

◦performing selected data processing services and support services;

◦acting as agent or broker in selling credit life insurance and other types of insurance in connection with credit transactions;

◦performing selected insurance underwriting activities;

◦providing certain community development activities (such as making investments in projects designed primarily to promote community welfare); and

◦issuing and selling money orders and similar consumer-type payment instruments.

The Federal Reserve has the authority to order a bank holding company or its subsidiaries to terminate any of these activities or to terminate its ownership or control of any subsidiary when the Federal Reserve has reasonable cause to believe that the bank holding company’s continued ownership, activity or control constitutes a serious risk to the financial safety, soundness or stability of it or any of its bank subsidiaries.

Under the BHCA, a bank holding company meeting certain eligibility requirements may elect to become a “financial holding company.” More specifically, a bank holding company may elect to become a financial holding company if the bank holding company is well-capitalized and is well managed and each of its banking subsidiaries is well-capitalized, is well managed and has at least a “Satisfactory” rating under the CRA. As a financial holding company, the Company and companies under its control may engage directly or indirectly in activities that are “financial in nature,” as defined by the GLBA and Federal Reserve interpretations, and therefore may engage in a broader range of activities than those permitted for bank holding companies and their subsidiaries under the BHCA. Financial holding companies and their subsidiaries also may engage in additional activities that are determined by the Federal Reserve, in consultation with the U.S. Department of the Treasury, to be “financial in nature or incidental to” a financial activity or are determined by the Federal Reserve unilaterally to be “complementary” to financial activities. In addition, a financial holding company is allowed to conduct permissible new financial activities or acquire permissible non-bank financial companies with after-the-fact notice to the Federal Reserve. Should a financial holding company fail to meet the requirements necessary to maintain its designation as a financial holding company, such failure could result in material restrictions on the activities of the financial holding company and may also adversely affect the financial holding company’s ability to engage in mergers and acquisitions, as well as loss of financial holding company status. Restrictions on the activities of a financial holding company may not necessarily be made available to the public.

8

Table of Contents

While the company has elected to be treated as a financial holding company, we do not currently engage in financial activities beyond those permissible for a bank holding company. However, if we undertake expanded financial activities (i.e., those that are not permissible for a bank holding company) and we subsequently fail to continue to meet any of the prerequisites for “financial holding company” status, including those described above, the Federal Reserve may, among other things, place limitations on our ability to conduct these broader financial activities or, if the deficiencies persist, require us to divest the banking subsidiary or the businesses engaged in activities permissible only for financial holding companies

Capital Adequacy. Each of the federal banking agencies, including the Federal Reserve and the FDIC, has issued substantially similar risk-based and minimum leverage capital guidelines applicable to the banking organizations they supervise.

Under existing capital standards, the Company and the Bank are required to maintain certain capital levels based on ratios of capital to total assets and capital to risk-weighted assets. The required capital ratios are minimums, and the federal banking agencies may determine that a banking organization based on its size, complexity, or risk profile must maintain a higher level of capital in order to operate in a safe and sound manner. Risks such as concentration of credit risks and the risk arising from nontraditional activities, as well as the institution’s exposure to a decline in the economic value of its capital due to changes in interest rates, and an institution’s ability to manage those risks, are important factors in assessing an institution’s overall capital adequacy. The following is a brief description of the relevant provisions of these capital rules and their potential impact on our capital levels.

The Company and the Bank are subject to the following risk-based capital ratios: a CET1 risk-based capital ratio, a Tier 1 risk-based capital ratio, which includes CET1 and additional Tier 1 capital, and a total risk-based capital ratio, which includes Tier 1 and Tier 2 capital. CET1 is primarily comprised of the sum of common stock instruments and related surplus net of treasury stock plus retained earnings less certain adjustments and deductions, including with respect to goodwill, intangible assets, mortgage servicing assets, and deferred tax assets subject to temporary timing differences. Additional Tier 1 capital is primarily comprised of noncumulative perpetual preferred stock. Tier 2 capital consists of instruments disqualified from Tier 1 capital, including qualifying subordinated debt and a limited amount of loan loss reserves up to a maximum of 1.25% of risk-weighted assets, subject to certain eligibility criteria. The capital rules also define the risk-weights assigned to assets and off-balance sheet items to determine the risk-weighted asset components of the risk-based capital rules, including, for example, certain “high volatility” commercial real estate, past due assets, structured securities, and equity holdings.

In addition to the minimum leverage ratio and the capital conversion buffer discussed above, the Company and the Bank are also subject to the following minimum capital ratios: 4.5% CET1 capital to risk-weighted assets; 6% Tier 1 capital to risk-weighted assets; and 8% total capital to risk-weighted assets.

In addition, the capital rules required a “capital conservation buffer” of 2.5% above each of the minimum risk-based capital ratio requirements (CET1, Tier 1, and total capital), which is designed to absorb losses during periods of economic stress. These buffer requirements must be met for a bank or bank holding company to be able to pay dividends, engage in share buybacks, or make discretionary bonus payments to executive management without restriction.

The leverage capital ratio, which serves as a minimum capital standard, is the ratio of Tier 1 capital to quarterly average total consolidated assets, net of goodwill, certain other intangible assets, and certain required deduction items. The required minimum leverage ratio for all banks and bank holding companies is 4%.

The FDICIA, among other things, requires the federal bank regulatory agencies to take “prompt corrective action” regarding depository institutions that do not meet minimum capital requirements. FDICIA establishes five regulatory capital tiers: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” A depository institution’s capital tier will depend upon how its capital levels compare to various relevant capital measures and certain other factors, as established by regulation. FDICIA generally prohibits a depository institution from making any capital distribution (including payment of a dividend) or paying any management fee to its holding company if the depository institution would thereafter be undercapitalized. FDICIA imposes progressively more restrictive restraints on operations, management, and capital distributions depending on the category in which an institution is classified. Undercapitalized depository institutions are subject to restrictions on borrowing from the Federal Reserve. In addition, undercapitalized depository institutions may not accept brokered deposits absent a waiver from the FDIC, are subject to growth limitations, and are required to submit capital restoration plans for regulatory approval. A depository institution's holding company must guarantee any required capital restoration plan up to an amount equal to the lesser of 5 percent of the depository institution's assets at the time it becomes undercapitalized or the amount of the capital deficiency when the institution fails to comply with the plan. Federal banking agencies may not accept a capital plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the depository institution's capital. If a depository institution fails to submit an acceptable plan, it is treated as if it is significantly undercapitalized.

9

Table of Contents

To be well-capitalized, the Bank must maintain at least the following capital ratios:

• 6.5% CET1 to risk-weighted assets;

• 8% Tier 1 capital to risk-weighted assets;

• 10% Total capital to risk-weighted assets; and

• 5% leverage ratio.

The Federal Reserve has not yet revised the well-capitalized standard for bank holding companies to reflect the higher capital requirements imposed under the current capital rules applicable to banks. For purposes of the Federal Reserve’s Regulation Y, including determining whether a bank holding company meets the requirements to be a financial holding company, bank holding companies, such as the Company, must maintain a Tier 1 risk-based capital ratio of 6% or greater and a total risk-based capital ratio of 10% or greater to be well-capitalized. Also, the Federal Reserve may require bank holding companies, including the Company, to maintain capital ratios substantially in excess of mandated minimum levels depending upon general economic conditions and a bank holding company’s particular condition, risk profile, and growth plans.

Failure to be well-capitalized or to meet minimum capital requirements could result in certain mandatory and possible additional discretionary actions by regulators that, if undertaken, could have an adverse material effect on our operations or financial condition. Failure to meet minimum capital requirements could also result in restrictions on the Company’s or the Bank’s ability to pay dividends or otherwise distribute capital or to receive regulatory approval of applications or other restrictions on its growth.

In 2025, the Company’s and the Bank’s regulatory capital ratios were above the applicable well-capitalized standards and met the capital conservation buffer. Based on current estimates, we believe that the Company and the Bank will continue to exceed all applicable well-capitalized regulatory capital requirements and the capital conservation buffer in 2026.

Certain regulatory capital ratios of the Company and Southside Bank, as of December 31, 2025, are shown in the following table.

Capital Adequacy Ratios
Southside Bancshares, Inc.Southside Bank
Common equity tier 1 risk-based capital ratio12.87%16.66%
Tier 1 risk-based capital ratio13.88%16.66%
Total risk-based capital ratio18.54%17.50%
Leverage ratio9.72%11.67%

Eligible community banks and holding companies with less than $10 billion in consolidated assets may opt into the CBLR framework. A “qualifying community banking organization” is one that has (i) less than $10 billion in total consolidated assets; (ii) a leverage ratio greater than 9%; (iii) off-balance sheet exposures of 25% or less of total consolidated assets; and (iv) trading assets and liabilities of 5% or less of total consolidated assets. Qualifying banks that meet these thresholds and elect the CBLR framework, are exempt from the agencies’ current capital framework, including the risk-based capital requirements and capital conservation buffer, and are deemed well-capitalized under the agencies’ prompt corrective action regulations. The Bank has not elected to use the CBLR framework at this time.

Source of Strength.  A bank holding company, such as us, is required to act as a source of financial and managerial strength to its subsidiary banks and to commit resources to their support. This support may be required at times when the bank holding company may not have the resources to provide it or when doing so is not otherwise in the interests of the Company or its shareholders or creditors. Regulators may require a bank holding company to make capital injections into a troubled subsidiary bank and may charge the bank holding company with engaging in unsafe and unsound practices if the bank holding company fails to commit resources to such a subsidiary bank or if it undertakes actions that the Federal Reserve believes might jeopardize the bank holding company’s ability to commit resources to such subsidiary bank. As a result, a bank holding company may be required to contribute additional capital to its subsidiaries. The appropriate federal banking agency for the depository institution (in the case of the Bank, the FDIC) may require reports from us to assess our ability to serve as a source of strength and to enforce compliance with the source of strength requirements by requiring us to provide financial assistance to the Bank in the event of financial distress. Capital loans from the Company to the Bank would be unsecured and subordinated to the Bank’s depositors and certain other debts of the Bank.

10

Table of Contents

In addition, if a bank holding company enters into bankruptcy or becomes subject to the orderly liquidation process established by the Dodd-Frank Act, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank would be assumed by the bankruptcy trustee or the FDIC, as appropriate, and entitled to a priority of payment.  Furthermore, the FDIA provides that any insured depository institution generally will be liable for any loss incurred by the FDIC in connection with the default of, or any assistance provided by the FDIC to, a commonly controlled insured depository institution.  The Bank is an FDIC-insured depository institution and thus subject to these requirements. See also Bank Regulation - Prompt Corrective Action and Undercapitalization.

Dividends.  The Company is a legal entity separate and distinct from its subsidiaries. Under the laws of the State of Texas, we, as a business corporation, may declare and pay dividends. The principal source of funds for our payment of dividends to our shareholders are cash on hand and dividends from the Bank. The Company’s ability to declare and pay dividends is limited by and subject to various general regulatory policies and requirements relating to the payment of dividends, including requirements to maintain adequate capital above regulatory minimums. The Federal Reserve has indicated that depository institutions and their holding companies should generally pay dividends only out of current operating earnings. Under a Federal Reserve policy adopted in 2009, the board of directors of a bank holding company must consider certain factors to ensure that its dividend level is prudent relative to maintaining a strong financial position, and is not based on overly optimistic earnings scenarios, such as potential events that could affect its ability to pay, while still maintaining a strong financial position. As a general matter, the Federal Reserve has indicated that the board of directors of a bank holding company should consult with the Federal Reserve and eliminate, defer or significantly reduce the bank holding company’s dividends if:

• its net income available to shareholders for the past four quarters, net of dividends previously paid during that period, is not sufficient to fully fund the dividends;

• its prospective rate of earnings retention is not consistent with its capital needs and overall current and prospective financial condition; or

• it will not meet, or is in danger of not meeting, its minimum regulatory capital adequacy ratios.

The ability of the Company to pay dividends, and the contents of the Company’s dividend policy, is subject to changes of law, as well as possible supervisory restrictions imposed by the Federal Reserve. The Federal Reserve also has authority to prohibit a bank holding company from making capital distributions if they would be deemed to be an unsafe or unsound practice. In addition, the Company’s ability to make capital distributions, including paying dividends and repurchasing shares, is subject to the Company complying with the automatic restrictions on capital distributions under the Federal Reserve’s “Capital Rules” discussed above – see Holding Company Regulation - Capital Adequacy.

Incentive Compensation. The Dodd-Frank Act required the federal banking agencies and the SEC to establish joint rules or guidelines for financial institutions with more than $1 billion in assets, such as the Company and the Bank, which prohibit incentive compensation arrangements that the agencies determine to encourage inappropriate risks by the institution. In 2016, the federal banking agencies and the SEC proposed rules that would, depending upon the assets of the institution, directly regulate incentive compensation arrangements and would require enhanced oversight and recordkeeping. As of December 31, 2025, these rules have not been implemented, although the SEC did adopt final rules implementing the clawback provisions of the Dodd-Frank Act in 2022 and the NYSE did adopt corresponding listing standards for clawback policies in 2023. The Company and the Bank have undertaken efforts to ensure that our incentive compensation plans do not encourage inappropriate risks, consistent with three key principles: incentive compensation arrangements should appropriately balance risk and financial rewards, be compatible with effective controls and risk management, and be supported by strong corporate governance.

Change in Control.  Federal law restricts the amount of voting stock in a bank holding company or a bank that a person may acquire without the prior approval of banking regulators. Subject to certain exceptions, under the BHCA, the CBCA and the regulations promulgated thereunder, persons who intend to acquire direct or indirect control of a depository institution or a bank holding company are required to obtain the prior approval of the Federal Reserve.  With respect to the Company, “control” is conclusively presumed to exist where an acquiring party directly or indirectly owns, controls or has the power to vote at least 25% of our voting securities.  Under the Federal Reserve’s CBCA regulations, a rebuttable presumption of control would arise with respect to an acquisition where, after the transaction, the acquiring party owns, controls or has the power to vote at least 10%. The overall effect of such laws is to make it more difficult to acquire a bank holding company and a bank by tender offer or similar means than it might be to acquire control of another type of corporation. Consequently, shareholders of the Company may be less likely to benefit from the rapid increases in stock prices that may result from tender offers or similar efforts to acquire control of other companies. Investors should be aware of these requirements when acquiring shares of our stock.

Acquisitions.  The BHCA provides that a bank holding company must obtain the prior approval of the Federal Reserve to (i) acquire direct or indirect ownership or control of more than five percent of the outstanding shares of any class of voting securities of any bank or bank holding company, (ii) acquire all or substantially all of the assets of another bank or bank holding

11

Table of Contents

company or (iii) merge or consolidate with any other bank holding company. The Federal Reserve, with the input of the Department of Justice, may not approve any such transaction that would result in a monopoly or would be in furtherance of any combination or conspiracy to monopolize or attempt to monopolize the business of banking in any section of the United States, or the effect of which may be substantially to lessen competition or to tend to create a monopoly in any section of the country, or that in any other manner would be in restraint of trade unless the anticompetitive effects of the proposed transaction are clearly outweighed in the public interest by the probable effect of the transaction in meeting the convenience and needs of the community to be served. The Federal Reserve is also required to consider (i) the financial and managerial resources of the companies involved, including pro forma capital ratios, (ii) the risk to the stability of the United States banking or financial system, (iii) the convenience and needs of the communities to be served, including performance under the CRA and (iv) the effectiveness of the company in combatting money laundering.

Regulatory Examination.  Federal and state banking agencies require the Company and the Bank to prepare annual reports on financial condition and to conduct an annual audit of financial affairs in compliance with minimum standards and procedures.  The Bank, and in some cases the Company and any nonbank affiliates, must undergo regular on-site examinations by the appropriate regulatory agency, which will examine for adherence to a range of legal and regulatory compliance responsibilities.  A bank regulator conducting an examination has complete access to the books and records of the examined institution, and the results of the examination are confidential.

Enforcement Authority.  The Federal Reserve has broad enforcement powers over bank holding companies and their nonbank subsidiaries, as well as “institution-affiliated parties,” including management, employees, agents, independent contractors and consultants, such as attorneys and accountants and others who participate in the conduct of the institution’s affairs, and has authority to prohibit activities that represent unsafe or unsound banking practices or constitute knowing or reckless violations of laws or regulations.  These powers may be exercised through the issuance of cease-and-desist orders, civil money penalties or other actions.  Civil money penalties can be as high as $1,000,000 for each day the activity continues and criminal penalties for some financial institution crimes may include imprisonment for 20 years.  Regulators have flexibility to commence enforcement actions against institutions and institution-affiliated parties, and the FDIC has the authority to terminate deposit insurance.  When issued by a banking agency, cease-and-desist and similar orders may, among other things, require affirmative action to correct any harm resulting from a violation or practice, including restitution, reimbursement, indemnifications or guarantees against loss. A financial institution may also be ordered to restrict its growth, dispose of certain assets, rescind agreements or contracts, refrain from declaring or paying dividends, or take other actions determined to be appropriate by the ordering agency.  The federal banking agencies also may remove a director or officer from an insured depository institution (or bar them from the industry) if a violation is willful or reckless.

Bank Regulation

The Bank is a Texas-chartered commercial bank, the deposits of which are insured up to the applicable limits by the FDIC.  The Bank is not a member of the Federal Reserve.  The Bank is subject to extensive regulation, examination and supervision by the TDB, as its chartering authority, and by the FDIC, as its primary federal regulator and deposit insurer.  In addition, as discussed in more detail below, the Bank is subject to regulation and supervision by the CFPB which may participate in examinations of the Bank regarding the Bank’s offering of consumer financial products and services.  The federal and state laws applicable to banks regulate, among other things, the scope of their activities and investments, lending and deposit-taking activities, borrowings, maintenance of retained earnings and reserve accounts, distribution of earnings and payment of dividends. Further, the Dodd-Frank Act permits states to adopt consumer protection laws and regulations that are stricter than those regulations promulgated by the CFPB, and state attorneys general are permitted to enforce certain federal consumer financial protection laws.

Broadly, regulations applicable to the Bank include limitations on loans to a single borrower and to its directors, officers and employees, restrictions on the opening and closing of branch offices, the maintenance of required capital ratios, the granting of credit under equal and fair conditions, the disclosure of the costs and terms of such credit, requirements to maintain reserves against deposits and loans, limitations on the types of investment that may be made by the Bank and requirements governing risk management practices. Certain of these laws and regulations are referenced above under “Supervision and Regulation – Holding Company Regulation.”

Permitted Activities and Investments.  Under the FDIA, the activities and investments of state nonmember banks are generally limited to those permissible for national banks, notwithstanding state law.  With FDIC approval, a state nonmember bank may engage in activities not permissible for a national bank if the FDIC determines that the activity does not pose a significant risk to the DIF and that the bank meets its minimum capital requirements.  Similarly, under Texas law, a state bank may engage in those activities permissible for national banks domiciled in Texas.  The TDB may permit a Texas state bank to engage in additional activities so long as the performance of the activity by the bank would not adversely affect the safety and soundness of the bank.

12

Table of Contents

Volcker Rule Section 619 of the Dodd-Frank Act prohibits insured depository institutions and their affiliates from proprietary trading and acquiring certain interests in hedge or private equity funds. The Volker Rule contains certain exemptions from the prohibition and permits the retention of certain ownership interests. Subsequent amendments to the Volcker Rule exempt from coverage those banks with (i) total consolidated assets equal to $10 billion or less; and (ii) total trading assets and liabilities equal to 5 percent or less of total consolidated assets. Based on this amendment, the Bank is exempt from the Volcker Rule’s restrictions and prohibitions.

Brokered Deposits.  The Bank also may be restricted in its ability to accept, renew or roll over brokered deposits, depending on its capital classification.  Subject to certain exceptions, deposits are “brokered” if they are placed at a bank through the intervention of a third party in the business of facilitating the placement of deposits with FDIC-insured banks. Only “well-capitalized” banks are permitted to accept, renew or roll over brokered deposits.  The FDIC may, on a case-by-case basis, permit banks that are adequately capitalized to accept brokered deposits if the FDIC determines that acceptance of such deposits would not constitute an unsafe or unsound banking practice with respect to the bank.  Undercapitalized banks generally may not accept, renew or roll over brokered deposits. On December 15, 2020, the FDIC approved a final rule, effective April 1, 2021, setting forth a new framework for determining when deposits accepted by an insured depository institution qualify as “brokered deposits.” The new rule also clarifies when a third party may qualify as a “deposit broker,” and identifies several business relationships between banks and third parties that are exempt from the brokered deposit restrictions. On July 15, 2022, the FDIC released guidance regarding how banks should treat the placement of deposits by third parties under “sweep arrangements” with broker-dealers. On July 30, 2024, the FDIC approved a notice of proposed rulemaking relating to the agency’s brokered deposit rules which would inter alia rollback certain aspects and exceptions to the brokered deposit rules originally introduced by the 2020 rule; however, this proposed rule was later withdrawn on March 3, 2025.

Loans to One Borrower.  Under Texas law, without the approval of the TDB and subject to certain limited exceptions for loans secured by livestock, stored agricultural products, or readily marketable collateral, the maximum aggregate amount of loans that the Bank is permitted to make to any one borrower is 25% of Tier 1 capital. For purposes of applying this limit, loans to one borrower may be combined with loans to another borrower (i) when proceeds of the loan are to be used for the direct benefit of the other borrower, to the extent of the proceeds so used, (ii) when a “common enterprise” is deemed to exist between the borrowers, (iii) the expected source of repayment for each loan or extension of credit is the same for each person, or (iv) the Texas banking commissioner determines that a loan should be attributed to another person in accordance with state law.

Insider Loans.  Under Regulation O of the Federal Reserve, as made applicable to state nonmember banks by section 18(j)(2) of the FDIA, the Bank is subject to quantitative restrictions on extensions of credit to its executive officers and directors, the executive officers and directors of the Company, any owner of 10% or more of its stock or the stock of the Company and certain entities affiliated with any such persons.  In general, any such extensions of credit must (i) not exceed certain dollar limitations, (ii) be made on substantially the same terms, including interest rates and collateral, as those prevailing at the time for comparable transactions with third parties and (iii) not involve more than the normal risk of repayment or present other unfavorable features.  Additional restrictions are imposed on extensions of credit to executive officers.  Certain extensions of credit also require the approval of a bank’s board of directors.

Deposit Insurance and Assessments.  The Bank’s deposits are insured by the FDIC’s DIF up to the limits under applicable law, which currently are set at $250,000 per depositor, per insured bank, for each account ownership category. As an FDIC-insured bank, the Bank is subject to FDIC assessments for its deposit insurance. The FDIC calculates quarterly deposit insurance assessments based on the Bank’s average total consolidated assets less its average tangible equity and applies one of four risk categories determined by reference to its capital levels, supervisory ratings, and certain other factors. The assessment rate schedule can change from time to time, at the discretion of the FDIC, subject to certain limits.

As of June 30, 2020, the DIF reserve ratio fell to 1.30%, below the statutory minimum of 1.35%. the FDIC, as required under the FDIA, established a plan on September 15, 2020 to restore the DIF reserve ratio to meet or exceed the statutory minimum of 1.35% within eight years. To that end, on October 18, 2022, the FDIC adopted an amended restoration plan to increase the likelihood that the reserve ratio would be restored to at least 1.35% by September 30, 2028. The FDIC’s amended restoration plan increased the initial base deposit insurance assessment rate schedule uniformly by two basis points beginning with the first quarterly assessment period of 2023. The FDIC could further increase the deposit insurance assessments for certain insured depository institutions, including the Bank, if the DIF reserve ratio is not restored as projected.

As a result of bank failures in March and May 2023, the DIF reserve ratio fell to 1.10 percent as of June 30, 2023. However, the FDIC projected that the reserve ratio will still reach the statutory minimum of 1.35 percent by the statutory deadline of September 30, 2028, as a result of the FDIC’s prior assessment rate adjustment. On November 16, 2023, the FDIC approved a final rule to implement a special assessment to recover the loss to the DIF associated with the 2023 bank failures. The special assessment is targeted primarily at larger banks with significant uninsured deposit levels. Specifically, the assessment base for the special assessment is equal to a bank’s estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion, to be collected at an annual rate of approximately 13.4 basis points for an anticipated

13

Table of Contents

total of eight quarterly assessment periods, beginning with the first quarterly assessment period of 2024. As of December 31, 2022, the Bank had less than $5 billion in estimated uninsured deposits.

Under the FDIA, the FDIC may terminate deposit insurance upon a finding that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order, or condition imposed by a bank’s federal regulatory agency. In addition, the FDIA provides that, in the event of the liquidation or other resolution of an insured depository institution, the claims of depositors of the institution, including the claims of the FDIC as subrogee of insured depositors, and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution, including those of the parent bank holding company.

Capital Adequacy.

See Holding Company Regulation - Capital Adequacy.

Standards for Safety and Soundness.  The FDIA requires the federal banking regulatory agencies to prescribe, by regulation or guideline, operational and managerial standards for all insured depository institutions relating to: (i) internal controls; (ii) information systems and internal audit systems; (iii) loan documentation; (iv) credit underwriting; (v) interest rate risk exposure; and (vi) asset quality.  The agencies also must prescribe standards for asset quality, earnings and stock valuation, as well as standards for compensation, fees and benefits.  The federal banking agencies have adopted regulations and Interagency Guidelines Establishing Standards for Safety and Soundness to implement these required standards.  These guidelines set forth the safety and soundness standards that the federal banking agencies use to identify and address problems at insured depository institutions before capital becomes impaired.  If the FDIC determines that the Bank fails to meet any standards prescribed by the guidelines, it may require the Bank to submit an acceptable plan to achieve compliance, consistent with deadlines for the submission and review of such safety and soundness compliance plans.

Incentive Compensation.

See “Holding Company Regulation – Incentive Compensation.”

Dividends.  All dividends paid by the Bank are paid to the Company, as the sole shareholder of the Bank.  The ability of the Bank, as a Texas state bank, to pay dividends is restricted under federal and state law and regulations. The FDICIA and the regulations of the FDIC generally prohibit an insured depository institution from making a capital distribution (including payment of dividend) if, thereafter, the institution would not be at least adequately capitalized.  Under Texas law, the Bank generally may not pay a dividend reducing its capital and surplus without the prior approval of the Texas Banking Commissioner.  All dividends must be paid out of net profits then on hand, after deducting expenses, including losses and provisions for loan losses. Certain contractual restricts also may limit the ability of the Bank to pay dividends to the Company.

The Bank’s general dividend policy is to pay dividends at levels consistent with maintaining liquidity and preserving applicable capital ratios and servicing obligations.  The Bank’s dividend policies are subject to the discretion of its board of directors and will depend upon such factors as future earnings, financial conditions, cash needs, capital adequacy, compliance with applicable statutory and regulatory requirements and general business conditions.  The exact amount of future dividends paid by the Bank will be a function of its general profitability (which cannot be accurately estimated or assured), applicable tax rates in effect from year to year and the discretion of its board of directors.

Transactions with Affiliates.  The Bank is subject to restrictions on extensions of credit and certain other transactions between the Bank and the Company or any non-bank affiliate. Generally, these covered transactions with either the Company or any affiliate are limited to 10% of the Bank’s capital and surplus, and all such transactions between the Bank and the Company and any non-bank affiliates combined are limited to 20% of the Bank’s capital and surplus. Loans and other extensions of credit from the Bank to the Company or any affiliate generally are required to be secured by eligible collateral in specified amounts. In addition, any transaction between the Bank and the Company or any affiliate are required to be on an arm’s length basis.

Anti-Tying Regulations.  In general, a bank may not extend credit, lease, sell property, or furnish any services or fix or vary the consideration for these products or services on the condition that either: (i) the customer obtain or provide some additional credit, property, or services from or to the bank, the bank holding company or subsidiaries thereof or (ii) the customer not obtain credit, property, or service from a competitor, except to the extent reasonable conditions are imposed to assure the soundness of the credit extended.  A bank may, however, offer combined-balance products and may otherwise offer more favorable terms if a customer obtains two or more traditional bank products.  The law also expressly permits banks to engage in other forms of tying and authorizes the Federal Reserve to grant additional exceptions by regulation or order. Also, certain foreign transactions are exempt from the general rule.

Community Reinvestment Act.  Under the CRA, the Bank has a continuing and affirmative obligation, consistent with safe and sound banking practices, to help meet the needs of our entire community, including low- and moderate-income neighborhoods.

14

Table of Contents

On a periodic basis, the FDIC is charged with preparing a written evaluation of our record of meeting the credit needs of the entire community and assigning a rating - outstanding, satisfactory, needs to improve or substantial noncompliance.  Banks are rated based on their actual performance in meeting community credit needs.  The FDIC will take that rating into account in its evaluation of any application made by the bank for, among other things, approval of the acquisition or establishment of a branch or other deposit facility, an office relocation, a merger or the acquisition of shares of capital stock of another financial institution.  A bank’s CRA rating may be used as the basis to deny or condition an application.  In addition, as discussed above, a bank holding company may not become a financial holding company unless each of its subsidiary banks has a CRA rating of at least “satisfactory.”  As of September 30, 2024, the most recent exam date, the Bank has a CRA rating of “satisfactory.”

In 2023 the Federal Reserve, OCC, and FDIC issued a final rule to modernize their respective CRA regulations. The revised rules would substantially alter the methodology for assessing compliance with the CRA, with material aspects taking effect January 1, 2026, and revised data reporting requirements taking effect January 1, 2027. The revised CRA regulations have been subject to an injunction since March 29, 2024. On July 16, 2025, the Federal Reserve, OCC, and FDIC issued a joint proposal to rescind the 2023 modernization rule. The agencies continue to apply the CRA rules as they existed before the 2023 modernization, considering the injunction and pending finalization of the rescission of the modernization rule.

Branch Banking.  Pursuant to the Texas Finance Code, all banks located in Texas are authorized to branch statewide.  Accordingly, a bank located anywhere in Texas has the ability, subject to regulatory approval, to establish branch facilities near any of our facilities and within our market area.  Similarly, under applicable Federal law, out-of-state banks are permitted to establish branches in Texas. If other banks were to establish branch facilities near our facilities, it is uncertain whether these branch facilities would have a material adverse effect on our business.

De novo interstate branching by the Bank is also subject to the Federal interstate branching rules.  All branching in which the Bank may engage remains subject to regulatory approval and adherence to applicable legal and regulatory requirements.

Consumer Protection Regulation.  The activities of the Bank are subject to a variety of statutes and regulations designed to protect consumers.  Interest and other charges collected or contracted for by banks are subject to state usury laws and federal laws concerning interest rates.  Loan operations are also subject to federal laws and regulations applicable to credit transactions, such as, but not necessarily limited to:

•the Truth in Lending Act and Regulation Z, governing disclosures of credit terms to consumer borrowers;

•the Home Mortgage Disclosure Act and Regulation C, requiring financial institutions to provide information to enable the public and public officials to determine whether a financial institution is fulfilling its obligation to help meet the housing needs of the community it serves;

•the Equal Credit Opportunity Act and Regulation B, prohibiting discrimination on the basis of race, creed or other prohibited factors in extending credit;

•the Fair Credit Reporting Act and Regulation V, governing the use and provision of information to consumer reporting agencies;

•the Fair Debt Collection Act, governing the manner in which consumer debts may be collected by collection agencies; and

•the guidance of the various federal agencies charged with the responsibility of implementing such federal laws.

Deposit and other operations also are subject to:

•the Truth in Savings Act and Regulation DD, governing disclosure of deposit account terms to consumers;

•the Right to Financial Privacy Act, which imposes a duty to maintain confidentiality of consumer financial records and prescribes procedures for complying with administrative subpoenas of financial records; and

•the Electronic Fund Transfer Act and Regulation E, which governs automatic deposits to and withdrawals from deposit accounts and customers’ rights and liabilities arising from the use of ATMs and other electronic banking services, which the CFPB has expanded to include a new compliance regime that governs consumer-initiated cross border electronic transfers.

The foregoing laws and regulations are amended periodically. We cannot predict the extent to which new or modified regulations focused on consumer financial protection, whether adopted by the TDB, the CFPB, or the federal banking agencies will have on our businesses. Any such new laws may materially adversely affect our business, financial condition or results of operations.

Commercial Real Estate Lending.  Lending operations that involve a significant concentration of commercial real estate loans are subject to enhanced scrutiny by federal banking regulators. CRE loans generally include land development,

15

Table of Contents

construction loans, land and lot loans to individuals, loans secured by multi-family property and nonfarm nonresidential real property where the primary source of repayment is derived from rental income associated with the property.  The guidance prescribes the following guidelines for examiners to help identify institutions that are potentially exposed to concentration risk and may warrant greater supervisory scrutiny:

•total reported loans for construction, land development and other land represent 100 percent or more of the institution’s total risk-based capital, or

•total CRE loans represent 300 percent or more of the institution’s total risk-based capital and the outstanding balance of the institution’s CRE loan portfolio has increased by 50 percent or more during the prior 36 months.

In addition, Federal regulations requiring risk retention of assets may impact our business by reducing the amount of our CRE lending and increasing the cost of borrowing. A loan originator or a securitizer of asset-backed securities is required to retain a percentage of the credit risk of securitized assets.  On June 29, 2023, in response to the increased risks on CRE loans created by the COVID-19 pandemic, the federal banking regulators published a “Final Interagency Policy Statement on Prudent Commercial Real Estate Loan Accommodations and Workouts.” It builds on the “Interagency Statement on Prudent Risk Management for Commercial Real Estate Lending” released in December 2015 and reaffirms risk management practices that financial institutions should exercise when entering into a loan agreement with a borrower. In the CRE Guidance, the federal banking regulators (i) expressed concerns with institutions that ease commercial real estate underwriting standards, (ii) directed financial institutions to maintain underwriting discipline and exercise risk management practices to identify, measure and monitor lending risks, and (iii) indicated that they will continue to pay special attention to commercial real estate lending activities and concentrations going forward. On December 18, 2023, the FDIC issued an advisory on Managing Commercial Real Estate Concentrations in a Challenging Economic Environment.

Anti-Money Laundering.  The Bank is subject to the regulations of the FinCEN, a bureau of the U.S. Department of the Treasury, which implements the Bank Secrecy Act, as amended by the USA PATRIOT Act and the Anti-Money Laundering Act of 2020.  The USA PATRIOT Act gives the federal government the power to address terrorist threats through enhanced domestic security measures, expanded surveillance powers, increased information sharing and broadened anti-money laundering requirements.  Title III of the USA PATRIOT Act includes measures intended to encourage information sharing among banks, regulatory agencies and law enforcement bodies.  Further, certain provisions of Title III impose affirmative obligations on a broad range of financial institutions, including state-chartered banks like the Bank. The Anti-Money Laundering Act of 2020 expanded the coverage of the Bank Secrecy Act to include new categories of “financial institutions,” expanding the types of monetary transactions that must be monitored and reported, and increasing the enforcement authority of the U.S. Department of Justice with respect to federal anti-money laundering laws.

The Bank Secrecy Act, USA PATRIOT Act, and Anti-Money Laundering Act of 2020, along with the related FinCEN regulations, impose numerous requirements with respect to financial institution operations, including the following:

•establishment of AML programs, including adoption of written procedures and an ongoing employee training program, designation of a compliance officer and auditing of the program;

•establishment of a program specifying procedures for obtaining information from customers seeking to open new accounts, including verifying the identity of customers within a reasonable period of time;

•establishment of enhanced due diligence policies, procedures and controls designed to detect and report money laundering, for financial institutions that administer, maintain or manage private bank accounts or correspondent accounts for non-U.S. persons;

•prohibitions on correspondent accounts for foreign shell banks and compliance with recordkeeping obligations with respect to correspondent accounts of foreign banks;

•filing of suspicious activity reports if a bank believes a customer may be violating U.S. laws and regulations; and

•requirements that bank regulators consider bank holding and bank compliance with federal AML laws in connection with proposed merger or acquisition transactions.

In addition, under applicable FinCEN regulations, covered financial institutions, subject to certain exclusions and exemptions, are required to identify and verify the identity of beneficial owners of legal entity customers. On August 13, 2020, the federal banking agencies issued a joint statement addressing the circumstances under which an agency will issue a mandatory “cease-and-desist” order to a regulated financial institution for failure to comply with its AML obligations, emphasizing that the “effectiveness” of a bank’s AML program will be the key factor in the agency's decision. Sanctions for violations of the USA PATRIOT Act can be imposed in an amount equal to twice the sum involved in the violating transaction up to $1 million.

16

Table of Contents

On June 30, 2021, FinCEN published the first set of “national AML priorities,” as required by the Bank Secrecy Act, which include, but are not limited to, cybercrime, terrorist financing, fraud, and drug/human trafficking. On June 28, 2024, FinCEN issued a proposed rule that was drafted to implement the new AML program requirements in line with the national AML priorities. Thereafter, on August 9, 2024, the federal banking regulators published a notice of proposed rulemaking that would update the requirements each agency has issued for its supervised institutions to establish, implement, and maintain effective, risk-based, and reasonably designed AML programs. As of December 31, 2025, the proposed rules have yet to be finalized.

Bank regulators routinely examine institutions for compliance with anti-money laundering obligations and have been active in imposing cease and desist and other regulatory orders, and money penalty sanctions, against institutions found to be violating these obligations. In addition, the Federal Bureau of Investigation can send bank regulatory agencies lists of the names of persons suspected of involvement in terrorist activities. The Bank can be requested to search its records for any relationships or transactions with persons on those lists and be required to report any identified relationships or transactions.

OFAC.  OFAC is responsible for helping to ensure that U.S. entities, including banks, do not engage in transactions with certain prohibited parties, as defined by various Executive Orders and Acts of Congress.  OFAC publishes, and routinely updates, lists of names of persons and organizations suspected of aiding, harboring or engaging in terrorist acts, including the Specially Designated Nationals List.  If we find a name on any transaction, account or wire transfer that is on an OFAC list, we must undertake certain specified activities, which could include blocking or freezing the account or transaction requested, and we must notify the appropriate authorities.

Privacy and Data Security; Cybersecurity.  Under the financial privacy provisions of the GLBA, financial institutions, including the Bank, are generally prohibited from disclosing consumer nonpublic personal information to non-affiliated third parties unless the consumer has been given the opportunity to object and has not objected to such disclosure.  Financial institutions are further required, subject to certain exceptions, to disclose their privacy policies to customers annually. Generally, the Bank must disclose its privacy policy for collecting and protecting NPI to consumers, permit consumers to “opt out” of having NPI disclosed to non-affiliated third parties, with some exceptions, and allow consumers to opt out of receiving marketing solicitations based on information about the consumer received from another affiliate. Many states have also recently implemented or modified their data privacy laws, and some may apply to financial institutions. For example, in California, the California Privacy Rights Act became effective on January 1, 2023, and provides new protections for the Bank customers who reside in that state. The Bank is required to comply with state laws regarding consumer privacy if they are more protective than the GLBA.

In addition, federal and state banking agencies have prescribed standards for maintaining the security and confidentiality of consumer information, to which the Bank is subject. Pursuant to these standards, the Bank is required to have an information security program to safeguard the confidentiality and security of customer information and to ensure proper disposal. The Bank is also subject to state and federal laws for notifying individuals and regulators in the event of a security breach affecting their personal information. Under federal law, customers must be notified when a financial institution becomes aware of unauthorized access of sensitive customer information and misuse has occurred or is reasonably possible.

More broadly, on November 23, 2021, the federal banking regulators imposed a new cybersecurity-related notification rule that would require banking organizations, including the Company and the Bank, to notify their primary federal regulator as soon as possible (but within 36 hours) of incidents that have materially disrupted or degraded, or are reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. The rule also imposes requirements on bank service providers to notify their affected banking organization customers of certain computer-security incidents. This rule became effective on April 1, 2022. Additionally, effective as of December 2023, the SEC issued a new rule that requires registrants to disclose material cybersecurity incidents within four business days. At the state level, as of January 2, 2020, Texas state banks are required to notify the TDB of “cybersecurity incidents” within specified timeframes.

Debit Interchange Fees. Interchange fees are fees that merchants pay to credit card companies and card-issuing banks such as the Bank for processing electronic payment transactions on their behalf. The maximum permissible interchange fee that an issuer may receive for an electronic debit transaction is the sum of 21 cents per transaction and 5 basis points multiplied by the value of the transaction, subject to an upward adjustment of 1 cent if an issuer certifies that it has implemented policies and procedures reasonably designed to achieve the fraud-prevention standards set forth by the Federal Reserve. In addition, the legislation prohibits card issuers and networks from entering into arrangements requiring that debit card transactions be processed on a single network or only two affiliated networks and allows merchants to determine transaction routing. On October 25, 2023, the Federal Reserve proposed to lower the maximum interchange fee that a large debit card issuer can receive for a debit card transaction. The proposal would also establish a regular process for updating the maximum amount every other year going forward. We continue to monitor the development of these proposed rule revisions.

17

Table of Contents

Anti-Bribery Laws. Federal law prohibits offering or giving a bank official or any third party (or for the bank official to solicit or receive for himself or a third party) “anything of value” other than what is given or offered to the bank itself. Further, the Foreign Corrupt Practices Act makes it unlawful to make payments to foreign government officials to assist in obtaining or retaining business. The Company and the Bank have implemented a Code of Business Ethics that governs the behavior of its officers and employees.

Regulatory Examination.

See “Holding Company Regulation - Regulatory Examination.”

Enforcement Authority.  The Bank and its “institution-affiliated parties,” including management, employees, agents, independent contractors and consultants, such as attorneys and accountants and others who participate in the conduct of the institution’s affairs, are subject to potential civil and criminal penalties for violations of law, regulations or written orders of a government agency.  Violations can include failure to timely file required reports, filing false or misleading information or submitting inaccurate reports.  Civil penalties may be as high as $25,000 per day or, in especially egregious examples, $1,000,000 a day for such violations, and criminal penalties for some financial institution crimes may include imprisonment for 20 years.  Regulators have flexibility to commence enforcement actions against institutions and institution-affiliated parties, and the FDIC has the authority to terminate deposit insurance.  When issued by a banking agency, cease and desist orders may, among other things, require affirmative action to correct any harm resulting from a violation or practice, including restitution, reimbursement, indemnifications or guarantees against loss.  A financial institution may also be ordered to restrict its growth, dispose of certain assets, rescind agreements or contracts, or take other actions determined to be appropriate by the ordering agency.  The federal banking agencies also may remove a director or officer from an insured depository institution (or bar them from the industry) if a violation is willful or reckless.

Governmental Monetary Policies.  The commercial banking business is affected not only by general economic conditions but also by the monetary policies of the Federal Reserve.  Changes in the discount rate on member bank borrowings, control of borrowings, open market operations, the imposition of and changes in reserve requirements against member banks, deposits and assets of foreign branches, the imposition of and changes in reserve requirements against certain borrowings by banks and their affiliates and the placing of limits on interest rates which member banks may pay on time and savings deposits are some of the instruments of monetary policy available to the Federal Reserve.  These monetary policies influence to a significant extent the overall growth of all bank loans, investments and deposits and the interest rates charged on loans or paid on time and savings deposits.  The nature of future monetary policies and the effect of such policies on the Bank’s future business and earnings, therefore, cannot be predicted accurately.

Other Regulatory Matters.  The Company and its affiliates are subject to oversight by the SEC, the NYSE, various state securities regulators and other regulatory authorities.  The Company and its subsidiaries have from time to time received requests for information from regulatory authorities in various states, including state attorneys general, securities regulators and other regulatory authorities, concerning their business practices.  Such requests are considered incidental to the normal conduct of business.

Future Legislation and Regulation. Congress may enact legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of the proposed legislation could affect the regulatory structure under which we operate and may significantly increase our costs, impede the efficiency of our internal business processes, require us to increase our regulatory capital or modify our business strategy, or limit our ability to pursue business opportunities in an efficient manner. Our business, financial condition, results of operations or prospects may be adversely affected, perhaps materially, as a result.