Stellar Bancorp, Inc. (STEL) Business

ITEM 1. BUSINESS

The disclosures set forth in this item are qualified by “Item 1A. Risk Factors,” the section captioned “Cautionary Notice Regarding Forward-Looking Statements” in the forepart of this report, “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations— Cautionary Notice Regarding Forward-Looking Statements” and other cautionary statements set forth elsewhere in this Annual Report on Form 10-K.

General

The Company is a Texas corporation and registered bank holding company headquartered in Houston, Texas.

On January 27, 2026, the Company entered into an Agreement and Plan of Merger (the “Merger Agreement”) with Prosperity Bancshares, Inc., a Texas corporation (“Prosperity”). The Merger Agreement provides that, upon the terms and subject to the conditions set forth therein, the Company will merge with and into Prosperity (the “Merger”), with Prosperity continuing as the surviving corporation in the Merger. Immediately following the Merger, Stellar Bank will merge with and into Prosperity’s wholly owned banking subsidiary, Prosperity Bank (the “Bank Merger”). Prosperity Bank will continue as the surviving bank in the Bank Merger. Upon the terms and subject to the conditions set forth in the Merger Agreement, at the effective time of the Merger (the “Effective Time”), each share of common stock, par value $0.01 per share, of the Company (“Stellar Common Stock”) outstanding immediately prior to the Effective Time, other than certain shares held by Prosperity or the Company and shares held by a holder of Stellar Common Stock who has properly exercised applicable dissenters’ rights in respect of such share, will be converted into the right to receive (i) 0.3803 shares of common stock, par value $1.00 per share, of Prosperity and (ii) an amount in cash equal to $11.36. The closing of the Merger is expected to occur in the second quarter of 2026, subject to customary conditions, including approval of the Company’s shareholders and regulatory approvals. See Part I, Item 1A, “Risk Factors,” Part II, Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” and Note 18 – Subsequent Events in the accompanying notes to the consolidated financial statements.

On October 1, 2022, Allegiance Bancshares, Inc. (“Allegiance”) and CBTX, Inc. (“CBTX”) merged (the “Merger”) with CBTX as the surviving corporation that was renamed Stellar Bancorp, Inc. and the ticker symbol changed to “STEL.” Immediately following the Merger, CommunityBank of Texas, N.A. (“CommunityBank”), a national banking association and a wholly-owned subsidiary of CBTX, merged with and into Allegiance Bank, a wholly-owned subsidiary of Allegiance, with Allegiance Bank as the surviving bank. In connection with the operational conversion, Allegiance Bank changed its name to Stellar Bank on February 18, 2023. After the Merger, Stellar Bank became one of the largest banks based in Houston, Texas.

We refer to the Houston-The Woodlands-Sugar Land metropolitan statistical area (“MSA”) and the Beaumont-Port Arthur MSA combined, as the Houston region (the “Houston region”) and we refer to the Houston region and the Dallas MSA as our market (“market”). As of December 31, 2025, we operated 52 service banking centers, with 35 banking centers in the Houston MSA, 16 banking centers in the Beaumont MSA and one banking center in Dallas, Texas.

Through Stellar Bank, the Company provides a diversified range of commercial banking services primarily to small- to medium-sized businesses, professionals and individual customers within our market. We believe the size, growth and increasing economic diversity of our market, when combined with our community banking strategy, provides us with excellent opportunities for long-term, sustainable growth. Our community banking strategy, which is described in more detail below, is designed to foster strong customer relationships while benefitting from a platform and scale that is competitive with larger regional and national banks. We believe this strategy presents a significant market advantage for serving small- to medium-sized business customers and further enables us to attract talented bankers.

As of December 31, 2025, the Company had total assets of $10.81 billion, total loans of $7.30 billion, total deposits of $9.02 billion and total shareholders’ equity of $1.67 billion.

1

Business Strategy

The Company’s objective is to grow and strengthen its banking franchise through its community banking strategy and strategic acquisitions. The Company is a leading provider of customized commercial banking services to small- and medium-sized businesses in our market by providing superior customer service and by leveraging the strength and capabilities of local management.

Community Banking Strategy

Our community banking strategy leverages local delivery of the customer service associated with community banking combined with the products, efficiencies and scale associated with larger banks. We are able to establish and foster strong relationships with customers through superior service. We operate full-service banking centers and employ experienced bankers that are able to respond to customer needs quickly with local decision making. We support banking center operations with a centralized credit approval process, loan operations, information technology, core data processing, accounting, finance, treasury and treasury management support, deposit operations and executive and board oversight. We emphasize lending to and banking with small- to medium-sized businesses, with which we believe we can establish stronger relationships through excellent service and provide lending that can be priced on terms that are more attractive to the Company than would be achieved by lending to larger businesses. We believe this approach produces a competitive advantage by delivering an extraordinary customer experience and fostering a culture dedicated to achieving superior external and internal service levels.

We will leverage our community banking strategy to organically grow our banking franchise through:

•increasing the productivity of existing bankers, as measured by loans, deposits and fee income per banker, while enhancing profitability by leveraging our existing operating platform;

•identifying and hiring additional seasoned bankers who will thrive within a locally focused community banking model;

•focusing on local decision-making, allowing us to provide customers with timely decisions on loan requests, which we believe allows us to effectively compete with larger financial institutions; and

•broadening our financial services offerings and technology adoption to better serve our customer base’s evolving needs while increasing operational efficiency.

Strategic Acquisitions

We intend to continue to expand our presence through organic growth and a disciplined acquisition strategy. We generally focus on like-minded community banks in Texas with similar strategies to our own when evaluating acquisition opportunities and will also consider strategic non-bank acquisition opportunities that complement our growth strategy. We believe that our management’s experience in assessing, executing and integrating target institutions will allow us to capitalize on acquisition opportunities.

Competitive Strengths

We believe that we are well positioned to execute our community banking strategy because of the following competitive strengths:

•Experienced, growth-focused senior management team—Our senior management team has a demonstrated track record of managing profitable organic growth, improving operating efficiencies, maintaining a strong risk management culture, implementing a community and service-focused approach to banking and successfully executing and integrating acquisitions.

•Scalable banking and operational platform designed to foster and accommodate significant growth—We believe in the value of scale in banking and our operating platform and strategy is designed for growth. We have made extensive investments in the technology and systems necessary to build a scalable corporate infrastructure with the capacity to support continued growth. Our size better positions us to effectively invest in technology and be more future-focused than smaller banks. We believe that our scalable operating platform will effectively support growth, resulting in greater efficiency and enhanced profitability as we grow.

•Community-focused, full-service customer relationships—We believe that our community banking strategy facilitates strong relationships with our customers. We are focused on delivering a wide variety of high-quality, relationship-driven commercial and community-oriented banking products and services tailored to meet the needs of small- to medium-sized businesses, professionals and individuals in our market. We actively solicit the deposit business of our consumer and commercial loan customers and seek to deepen these relationships with additional products and services.

2

•Local decision making authority—Acquisitions of many local financial institutions in our market by larger, more regionally focused competitors have led to a reduced number of locally-based competitors, and we believe this has created an underserved base of small- to medium-sized businesses, professionals and individuals that are interested in banking with a company headquartered in, and with decision-making authority based in our market. We seek to develop comprehensive, long-term banking relationships with customers and offer an array of products and services to support our loan and deposit activities. Our products and services are tailored to address the needs of our targeted customers and we believe positions us well to compete effectively and build strong customer relationships.

•Focus on seasoned bankers—We believe our management team’s long-standing presence and experience in our market gives us valuable insight into the local market and the ability to successfully develop and recruit talented bankers. Our team of seasoned bankers has been the driver of our organic growth. Our officer compensation structure, which includes equity grants and various incentive programs, attracts talented bankers and motivates them to increase the size of their loan and deposit portfolios and generate fee income while maintaining strong credit quality.

•Disciplined underwriting and credit administration—Our management, bankers and credit administration team emphasize a strong culture of risk management that is supported by comprehensive policies and procedures for credit underwriting, funding and administration that enable us to maintain sound asset quality. The Company’s underwriting methodology emphasizes analysis of cash flow coverage, loan to collateral value and obtaining personal guaranties. We intend to continue to emphasize and adhere to these procedures and controls, which we believe have helped to minimize our level of loan charge-offs.

•Quality loan portfolio—Our focus on loans to small- to medium-sized businesses results in a more diffused portfolio of loan relationships, which we believe reduces the risk relative to a dependence on significantly larger lending relationships. As of December 31, 2025, our average funded loan size was approximately $533 thousand.

Community Banking Services

Lending Activities

We offer a wide range of commercial and retail lending services, including commercial loans, loans to small businesses guaranteed by the Small Business Administration (the “SBA”), mortgage loans, home equity loans, personal loans and automobile loans, among others, specifically designed for small- to medium-sized businesses and companies, professionals and individuals generally located within Texas and primarily in our market. We also offer factoring services through American Prudential Capital, Inc., a wholly owned subsidiary of the Bank. See “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations—Financial Condition—Loan Portfolio” for a more detailed discussion of the Company’s lending activities.

Deposit Products

Deposits are our principal source of funds for use in lending and other general banking purposes. We offer a variety of deposit products and services with the goal of attracting a wide variety of customers, with an emphasis on small- to medium-sized businesses. The types of deposit accounts that the Company offers are typical of most commercial banks and consist of checking accounts, commercial accounts, money market accounts, savings accounts and other time deposits of various types and terms. We actively pursue business checking accounts by offering our business customers competitive rates and convenient services such as telephone, mobile and online banking. Our deposits are insured by the Federal Deposit Insurance Corporation (the “FDIC”) to the fullest extent permitted by law. See “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations—Financial Condition—Deposits” for a more detailed discussion of the Company’s deposits.

Other Banking Services

We offer basic banking products and services, which we believe are attractively priced, easily understood, convenient and readily accessible to our customers. In addition to banking during normal business hours, we offer extended drive-through hours, ATMs, mobile banking and banking by telephone, mail and online. Customers can conveniently access their accounts by phone, through a mobile application for smartphones and tablets, as well as through online banking that allows customers to obtain account balances, make deposits, transfer funds, pay bills online and receive electronic delivery of statements. We also provide safe deposit boxes, debit cards, cash management and wire transfer services, night depository, direct deposits, cashier’s checks and letters of credit. We have established relationships with correspondent banks and other independent financial institutions to provide other services requested by customers, including loan participations sold when the requested loan amount exceeds the lending limits in our lending policies.

3

Competition

We compete in the highly competitive commercial banking industry through the Bank and firmly believe that the Bank’s presence in the community and philosophy of personalized service enhances our ability to attract and retain customers. The Bank faces strong direct competition for deposit funds, lending opportunities, talented bankers, acquisition candidates and other financial-related services.

We compete primarily with other commercial banks, savings banks, savings and loan associations, credit unions, finance companies, mutual funds, insurance companies, brokerage and investment banking firms, asset-based nonbank lenders and certain other nonfinancial entities, including retail stores that may maintain their own credit programs and certain governmental organizations, all of which are actively engaged in providing various types of loans and other financial services that may offer more favorable financing than we are able to offer. Although some of our competitors are situated locally, others have statewide or nationwide presence. We believe that we are able to compete with other financial institutions because of our experienced banking professionals, the range and quality of products that we offer, our responsive decision-making with respect to loans and our emphasis on customer service, thereby establishing strong customer relationships and building customer loyalty that distinguishes us from our competitors.

We rely heavily on the continued business our bankers generate and the efforts of our officers and directors to solicit and refer potential customers, and we expect this reliance to continue for the foreseeable future. We believe that our strong market share position in our geographic areas of operation is a reflection of our ability to effectively compete with the larger banks in our market, most of which are based out of state.

Human Capital Overview

Our ability to serve our customers and communities is driven by the strength and engagement of our workforce. We are committed to attracting, developing, and retaining talented individuals who contribute to our long-term success. Our culture emphasizes collaboration, integrity, and accountability, fostering an environment where employees at all levels can thrive.

As of December 31, 2025, we had 1,053 employees. None of our workforce is currently represented by a collective bargaining unit or bound by a collective bargaining agreement.

Workforce Engagement

We believe in the value of broad employee participation and perspectives across our organization. Our internal employee listening program is designed to measure employee experience throughout the employee lifecycle. Annually, we conduct an Engagement survey, and a follow up Pulse survey. These surveys are the bedrock of our listening program, which are supplemented by a series of on-boarding surveys and other event-driven listening opportunities. Strategic employee listening is aligned with the goals of the organization, and provides indicators of our culture, illuminating insights into the strengths and opportunities we have.

We actively recruit and promote individuals based on their skills, contributions, and leadership potential, ensuring we attract top talent that reflects the communities we serve. We regularly assess workforce trends and engagement to maintain a strong and dynamic employee base.

As of December 31, 2025, the race and gender diversity of our workforce was as follows:

(1)    Of the 1,053 employee headcount, 37 did not disclose their race, therefore, the percentage of non-white employees in the table is based on 1,016 employees.

4

Learning and Development

The basis of our culture is empowering people to thrive, and during 2025 we continued to create and deliver learning opportunities and programs designed to fulfill that purpose. “Interstellar,” our management development journey, continued in 2025, offered with Situational Leadership (SLII®) as a foundational course and “Finding Top Talent” as a course designed to prepare managers to enhance the new employee experience. These programs are designed for all managers to create their own learning journey by selecting coursework that is appropriate for their skill development needs.

We continued the deployment of our successful cultural foundation program, “The Stellar Odyssey”, as part of our new employee experience. This program has contributed to statistically significant increases in our employee engagement, which increased again in 2025, achieving an index of 88% up from 82% in 2024. We also initiated our “Service and Beyond” class, as part of our Stellar Service Standards program launch, a program designed to enhance the customer service mindset, behaviors and skills.

Our Officer Development and Internship Program (“ODP”) continued to grow in 2025, both through the recruitment of more talented ODP associates and expanding the number of candidates for our internship program. The internship program includes meaningful project work, assignments and networking, along with a research case and presentation. The internship program serves as a talent pipeline for the ODP, wherein we engage high-potential college students as interns and then offer positions to them to return as full-time employees upon graduation.

We continue to invest in the growth and development of our employees as part of our short and long-term succession strategy to ensure we are sustaining the appropriate leadership and management pipelines for continuity purposes. Our strategy also includes developing individuals for key and critical roles to ensure we are prepared to meet our growth goals.

Compensation and Benefits

We are committed to providing a comprehensive and competitive compensation and benefits program designed to attract, retain, and develop top talent. Our approach ensures that employees are recognized for their contributions while also supporting their long-term financial security, health, and professional growth.

Our compensation structure includes competitive base salaries supplemented by performance-based incentives, including an annual bonus program for all employees and long-term incentive awards for senior leadership. Additionally, we offer a 401(k) Plan with employer matching contributions to help employees build financial security for retirement.

To support the overall well-being of our employees, we provide a robust suite of benefits, including:

•Healthcare and Insurance: Comprehensive medical, dental, and vision coverage, with options for health savings accounts and flexible spending accounts.

•Work-Life Balance: Paid time-off, family leave, and flexible scheduling options where applicable.

•Employee Support Programs: Access to an Employee Assistance Program that provides resources for mental health, financial counseling, and personal development.

•Tuition Reimbursement: Financial assistance for eligible employees pursuing undergraduate, graduate, and continuing education programs that align with career development at Stellar Bank. Employees may receive reimbursement for tuition, course fees, and books, subject to annual limits and a service commitment following completion of their education.

Our compensation and benefits program reflects our commitment to fostering a supportive, rewarding, and high-performance work environment, ensuring employees feel valued and empowered to succeed.

Available Information

The Company’s website address is www.stellar.bank. We make available free of charge on or through our investor relations website our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and all amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended (“Exchange Act”), as soon as reasonably practicable after such materials are electronically filed with or furnished to the Securities and Exchange Commission (“SEC”). Information contained on our website is not incorporated by reference into this Annual Report on Form 10-K and is not part of this or any other report that we file with or furnish to the SEC.

5

Regulation and Supervision

The U.S. banking industry is highly regulated under federal and state law. These laws and regulations affect the operations and performance of the Company and its subsidiaries.

Statutes, regulations and policies limit the activities in which we may engage and how we conduct certain permitted activities. Further, the bank regulatory system imposes reporting and information collection obligations. We incur significant costs related to compliance with these laws and regulations. Banking statutes, regulations and policies are continually under review by federal and state legislatures and regulatory agencies, and a change in them, including changes in how they are interpreted or implemented, could have a material adverse effect on our business, financial condition or results of operation.

The material statutory and regulatory requirements that are applicable to us and our subsidiaries are summarized below. The description below is not intended to summarize all laws and regulations applicable to us and our subsidiaries, and is based upon the statutes, regulations, policies, interpretive letters and other written guidance that are in effect as of the date of this Annual Report on Form 10-K.

Bank Holding Company and Bank Regulation

The Company is a legal entity separate and distinct from the Bank and its other subsidiaries. As a bank holding company, the Company is regulated under the Bank Holding Company Act of 1956, as amended (“BHC Act”), and it and its subsidiaries are subject to inspection, examination and supervision by the Board of Governors of the Federal Reserve System (“Federal Reserve”). As a bank holding company of a Texas state-chartered bank, the Company is also subject to supervision, regulation, examination and enforcement by the Texas Department of Banking (“TDB”).

The Bank is a Texas-chartered banking association, the deposits of which are insured by the FDIC’s Deposit Insurance Fund, up to applicable legal limits. Effective April 14, 2025, the Bank became a member of the Federal Reserve System. As a result, the Bank’s primary federal regulator is now the Federal Reserve and the TDB continues to be the Bank’s primary state regulator.

Broad Supervision, Examination and Enforcement Powers

The primary objectives of the U.S. bank regulatory system are to protect depositors by ensuring the financial safety and soundness of banking organizations, facilitate the conduct of sound monetary policy and promote fairness and transparency for financial products and services. To that end, the banking regulators have broad regulatory, examination and enforcement authority and regularly examine the operations of banking organizations.

The regulators have various formal and informal enforcement actions available if they determine that the financial condition, capital resources, asset quality, earnings prospects, management, liquidity or other aspects of a banking organization’s operations are unsatisfactory. The regulators may also take action if they determine that the banking organization or its management is violating or has violated any law or regulation or has engaged in unsafe or unsound banking practices. The regulators have the power to, among other things:

•require affirmative actions to correct any violation or practice;

•issue administrative orders that can be judicially enforced;

•direct increases in capital;

•direct the sale of subsidiaries or other assets;

•limit dividends and distributions;

•restrict growth;

•assess civil monetary penalties;

•remove officers and directors; and

•terminate deposit insurance.

6

The Dodd-Frank Act

The Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”) mandates certain requirements on the financial services industry, including, among many other things: (1) enhanced resolution authority with respect to troubled or failing banks and their holding companies, (2) increased regulatory examination fees, (3) the creation of the Consumer Financial Protection Bureau (the “CFPB”), and (4) numerous other provisions designed to improve supervision and oversight of, and strengthen safety and soundness within, the financial services sector.

Interchange Fees

Under the Durbin Amendment to the Dodd-Frank Act (“Durbin Amendment”), the Federal Reserve adopted rules establishing standards for assessing whether the interchange fees that may be charged with respect to certain electronic debit transactions are “reasonable and proportional” to the costs incurred by issuers for processing such transactions. Interchange fees, or “swipe” fees, are charges that merchants pay to us and other card-issuing banks for processing electronic payment transactions. Federal Reserve rules applicable to financial institutions that have assets of $10 billion or more, such as the Bank, provide that the maximum permissible interchange fee for an electronic debit transaction is the sum of 21 cents per transaction plus 5 basis points multiplied by the value of the transaction. An upward adjustment of no more than 1 cent to an issuer’s debit card interchange fee is allowed if the card issuer develops and implements policies and procedures reasonably designed to achieve certain fraud-prevention standards. The Federal Reserve also has rules governing routing and exclusivity that require issuers to offer two unaffiliated networks for routing transactions on each debit or prepaid product. In August 2025, the U.S. District Court for the District of North Dakota ruled to vacate the Federal Reserve’s current interchange rules but simultaneously stayed its own vacatur pending appeal to the circuit court. The outcome of this litigation could significantly and adversely affect the fees banks can charge on debit card transactions.

The Volcker Rule

The Volcker Rule under the Dodd-Frank Act restricts banks and their affiliates from engaging in proprietary trading and investing in and sponsoring certain hedge funds and private equity funds. Since neither the Company nor the Bank engages in the types of trading or investing covered by the Volcker Rule, the Volcker Rule does not currently have any effect on our operations.

Source of Strength

Under Federal Reserve policy and federal regulations, bank holding companies are required to act as a source of financial and managerial strength to their subsidiary banks. Under this requirement, the Company is expected to commit resources to support the Bank, including at times when the Company may not be in a financial position to provide such resources. Any capital loans by a bank holding company to any of its subsidiary banks are subordinate in right of payment to depositors and to certain other indebtedness of such subsidiary banks. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Notice and Approval Requirements Related to Control

Federal and state banking laws impose notice, application, approval or non-objection and ongoing regulatory requirements on any shareholder or other person that controls or seeks to acquire direct or indirect “control” of an FDIC-insured depository institution. These laws include the BHC Act, the Change in Bank Control Act and the Texas Banking Act. Among other things, these laws require regulatory filings by a shareholder or other person that seeks to acquire direct or indirect “control” of an FDIC-insured depository institution. The determination whether a person “controls” a depository institution or its holding company is based on all of the facts and circumstances surrounding the investment. As a general matter, a person is deemed to control a depository institution or other company if the person owns or controls 25% or more of any class of voting stock. Subject to rebuttal, a person may be presumed to control a depository institution or other company if the person owns or controls 10% or more of any class of voting stock and other regulatory criteria are met. Ownership by affiliated persons, or persons acting in concert, is typically aggregated for these purposes.

The Federal Reserve’s rules provide a framework for when a company controls a bank holding company or bank under the BHC Act. In particular, the rules set forth tiered presumptions of control in the Federal Reserve’s regulations. Under the BHC Act, a company controls a bank holding company if it controls 25% or more of any class of voting securities of the bank holding company. A company that controls less than 5% of any class of voting securities of a bank holding company is presumed not to control the bank holding company. In instances in which a company owns at least 5% but less than 25%, the Federal Reserve considers the full facts and circumstances of the relationship between the company and the bank holding company to determine whether the company controls

7

the bank holding company. As part of its determination as to control, the Federal Reserve considers, among other things, level of ownership of voting and non-voting securities, board representation, business relationships, senior management interlocks, contractual limits on major operational or policy decisions, proxies on issues, threats to dispose of securities and management agreements. The rules also provide several additional examples of presumptions of control and noncontrol, along with various ancillary provisions such as definitions of terms used in the presumptions.

Permissible Activities and Investments

Banking laws generally restrict our ability to engage in or acquire more than 5% of the voting shares of a company engaged in activities other than those determined by the Federal Reserve to be so closely related to banking as to be a proper incident thereto. The Gramm-Leach-Bliley Financial Modernization Act of 1999 (the “GLB Act”) expanded the scope of permissible activities for a bank holding company that qualifies as a financial holding company. Under the regulations implementing the GLB Act, a financial holding company may engage in additional activities that are financial in nature or incidental or complementary to a financial activity. Those activities include, among other activities, certain insurance and securities activities. Qualifications for becoming a financial holding company include, among other things, meeting certain specified capital standards and achieving certain management ratings in examinations. Bank holding companies and their subsidiaries must be well-capitalized and well-managed in order for the bank holding company and its nonbank affiliates to engage in the expanded financial activities permissible only for a financial holding company. The Company has not elected to pursue financial holding company status.

In addition, as a general matter, we must receive prior regulatory approval before establishing or acquiring a depository institution or, in certain cases, a nonbank entity.

The Texas Constitution, as amended in 1986, provides that a Texas-chartered bank has the same rights and privileges that are or may be granted to national banks domiciled in Texas. To the extent that the Texas laws and regulations may have allowed state-chartered banks to engage in a broader range of activities than national banks, the Federal Deposit Insurance Corporation Improvement Act of 1991 (“FDICIA”), has operated to limit this authority. The FDICIA provides that no state bank or subsidiary thereof may engage as a principal in any activity not permitted for national banks, unless the institution complies with applicable capital requirements and the FDIC determines that the activity poses no significant risk to the Deposit Insurance Fund of the FDIC. In general, statutory restrictions on the activities of banks are aimed at protecting the safety and soundness of depository institutions.

Branching

Texas law provides that a Texas-chartered bank can establish a branch anywhere in Texas provided that the branch is approved in advance by the TDB. The branch must also be approved by the Federal Reserve. The regulators consider a number of factors, including financial history, capital adequacy, earnings prospects, character of management, needs of the community and consistency with corporate powers. The Dodd-Frank Act permits insured state banks to engage in de novo interstate branching if the laws of the state where the new branch is to be established would permit the establishment of the branch if it were chartered by such state.

Regulatory Capital Requirements and Capital Adequacy

The bank regulators view capital levels as important indicators of an institution’s financial soundness. As a general matter, FDIC-insured depository institutions and their holding companies are required to maintain minimum capital relative to the amount and types of assets they hold. The final supervisory determination on an institution’s capital adequacy is based on the regulator’s assessment of numerous factors. As a bank holding company and a state-chartered member bank, the Company and the Bank are subject to both risk-based and leverage regulatory capital requirements.

The Company and the Bank are required to comply with applicable capital adequacy standards adopted by the Federal Reserve and the FDIC (the “Basel III Capital Rules”). The Basel III Capital Rules, among other things, require the Company to maintain an additional capital conservation buffer, composed entirely of Common Equity Tier 1 (“CET1”), of 2.50%, effectively resulting in minimum ratios of (1) CET1 to risk-weighted assets of 7.00%, (2) Tier 1 capital to risk-weighted assets of 8.50%, (3) total capital (that is, Tier 1 plus Tier 2) to risk-weighted assets of 10.50% and (4) Tier 1 capital to average quarterly assets as reported on consolidated financial statements (known as the “leverage ratio”) of 4.00%. As of December 31, 2025, the Company’s ratio of CET1 to risk-weighted assets was 14.18%, Tier 1 capital to risk-weighted assets was 14.31%, Total capital to risk-weighted assets was 15.73% and Tier 1 capital to average tangible quarterly assets was 11.52%.

8

Banking institutions that fail to meet the effective minimum ratios once the capital conservation buffer is taken into account, as detailed above, will be subject to constraints on capital distributions, including dividends and share repurchases, and certain discretionary executive compensation. The severity of the constraints depends on the amount of the shortfall and the institution’s “eligible retained income” (that is, four quarter trailing net income, net of distributions and tax effects not reflected in net income).

The Basel III Capital Rules also changed the capital categories for insured depository institutions for purposes of prompt corrective action as discussed below under “Prompt Corrective Action”. Under the Basel III Capital Rules, to be well capitalized, an insured depository institution is required to maintain a minimum CET1 capital ratio of at least 6.5%, a Tier 1 risk-based capital ratio of at least 8.0%, a total risk-based capital ratio of at least 10.0%, and a leverage ratio of at least 5.0%. In addition, the Basel III Capital Rules established more conservative standards for including an instrument in regulatory capital and impose certain deductions from and adjustments to the measure of CET1 capital.

Under the Basel III Capital Rules, banking organizations were provided a one-time option in their initial regulatory financial report filed after January 1, 2015, to remove certain components of accumulated other comprehensive income from the computation of common equity regulatory capital. We elected to opt-out of the requirement to include most components of accumulated other comprehensive income in regulatory capital. Accordingly, amounts reported as accumulated other comprehensive income/loss related to securities available for sale do not increase or reduce regulatory capital and are not included in the calculation of risk-based capital and leverage ratios. For banking organizations with less than $15 billion in total assets, existing trust preferred securities and cumulative perpetual preferred stock continue to be included in regulatory capital while other instruments are disallowed. The Basel III Capital Rules also provide additional constraints on the inclusion of minority interests, mortgage servicing assets, deferred tax assets and certain investments in the capital of unconsolidated financial institutions in Tier 1 capital, as well as providing stricter risk weighting rules to these assets.

The Basel III Capital Rules also provide stricter rules related to the risk weighting of past due and certain commercial real estate loans, as well as on some equity investment exposures, and replace the existing credit rating approach for determining the risk weighting of securitization exposures with an alternative approach.

The federal banking agencies’ risk-based and leverage ratios are minimum supervisory ratios generally applicable to banking organizations that meet certain specified criteria. The federal bank regulatory agencies may set capital requirements for a particular banking organization that are higher than the minimum ratios when circumstances warrant. Federal Reserve guidelines also provide that banking organizations experiencing internal growth or making acquisitions will be expected to maintain strong capital positions substantially above the minimum supervisory levels, without significant reliance on intangible assets.

Prompt Corrective Action

Under the Federal Deposit Insurance Act (the “FDIA”), the federal bank regulatory agencies must take prompt corrective action against undercapitalized U.S. depository institutions. U.S. depository institutions are assigned one of five capital categories: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized,” and are subjected to different regulation corresponding to the capital category within which the institution falls. A depository institution is deemed to be “well capitalized” if it has a total risk-based capital ratio of 10.0% or greater, a CET1 capital ratio of 6.5% or greater, a Tier 1 risk-based capital ratio of 8.0% or greater, a leverage ratio of 5.0% or greater and the institution is not subject to an order, written agreement, capital directive or prompt corrective action directive to meet and maintain a specific level for any capital measure. A depository institution is deemed to be “adequately capitalized” if it has a total risk-based capital ratio of 8.0% or greater, a common equity Tier 1 capital ratio of 4.5% or greater, a Tier 1 risk-based capital ratio of 6.0% or greater, a leverage ratio of 4.0% or greater, and does not meet the criteria for a “well capitalized” bank. A depository institution is “undercapitalized” if it has a total risk-based capital ratio of less than 8.0%, a common equity Tier 1 capital ratio less than 4.5%, a Tier 1 risk-based capital ratio of less than 6.0% or a leverage ratio of less than 4.0%. Under certain circumstances, a well-capitalized, adequately capitalized or undercapitalized institution may be treated as if the institution were in the next lower capital category. A banking institution that is undercapitalized is required to submit a capital restoration plan. The capital restoration plan will not be accepted by the regulators unless each company having control of the undercapitalized institution guarantees the subsidiary’s compliance with the capital restoration plan up to a certain specified amount.

Failure to meet capital guidelines could subject the institution to a variety of enforcement remedies by federal bank regulatory agencies, including termination of deposit insurance upon notice and hearing, restrictions on certain business activities and appointment of the FDIC as conservator or receiver. As of December 31, 2025, the Bank met the requirements to be “well capitalized” under the prompt corrective action regulations.

9

The prompt corrective action regulations do not apply to bank holding companies. However, the Federal Reserve is authorized to take appropriate action at the bank holding company level, based upon the undercapitalized status of the bank holding

company’s depository institution subsidiaries.

Regulatory Limits on Dividends, Distributions and Repurchases

As a bank holding company, we are subject to certain restrictions on paying dividends under applicable federal and Texas laws and regulations. The Federal Reserve has issued a policy statement that provides that a bank holding company should not pay dividends unless (1) its net income over the last four quarters (net of dividends paid) has been sufficient to fully fund the dividends, (2) the prospective rate of earnings retention appears to be consistent with the capital needs, asset quality and overall financial condition of the bank holding company and its subsidiaries and (3) the bank holding company will continue to meet minimum required capital adequacy ratios. Accordingly, a bank holding company should not pay cash dividends that exceed its net income or that can only be funded in ways that weaken the bank holding company’s financial health, such as by borrowing. The Dodd-Frank Act and Basel III capital requirements impose additional restrictions on the ability of banking institutions to pay dividends.

Substantially all of our income, and a principal source of our liquidity, are dividends from the Bank. The ability of the Bank to pay dividends to us is restricted by federal and state laws, regulations and policies.

Capital adequacy requirements serve to limit the amount of dividends that may be paid by the Bank. Under the FDIA, an insured depository institution such as the Bank is prohibited from making capital distributions, including the payment of dividends, if, after making such distribution, the institution would become “undercapitalized.” The Federal Reserve may further restrict the payment of dividends by requiring the Bank to maintain a higher level of capital than would otherwise be required in order to be adequately capitalized for regulatory purposes. Payment of dividends by the Bank also may be restricted at any time at the discretion of the appropriate regulator if it deems the payment to constitute an unsafe and unsound banking practice. As noted above, the capital conservation buffer created under the Basel III Capital Rules could also have the effect of limiting the payment of capital distributions from the Bank.

In certain circumstances, the Company’s repurchases of its common stock may be subject to a prior approval or notice requirement under other regulations, policies or supervisory expectations of the Federal Reserve. Any redemption or repurchase of preferred stock or subordinated debt remains subject to the prior approval of the Federal Reserve.

Reserve Requirements

Although the Federal Reserve currently maintains reserve requirement ratios at zero percent, it retains the authority to impose reserve requirements against a bank’s transaction accounts. In addition, reserves must be maintained on certain non-personal time deposits. These reserves must be maintained in the form of vault cash or in an account at a Federal Reserve Bank.

Limits on Transactions with Affiliates and Insiders

Insured depository institutions are subject to restrictions on their ability to conduct transactions with affiliates and other related parties. Section 23A of the Federal Reserve Act imposes quantitative limits, qualitative requirements, and collateral requirements on certain transactions by an insured depository institution with, or for the benefit of, its affiliates. Transactions covered by Section 23A include loans, extensions of credit, investment in securities issued by an affiliate and acquisitions of assets from an affiliate. Section 23B of the Federal Reserve Act requires that most types of transactions by an insured depository institution with, or for the benefit of, an affiliate be on terms, substantially the same or at least as favorable to the insured depository institution as if the transaction were conducted with an unaffiliated third-party.

The Dodd-Frank Act generally enhances the restrictions on transactions with affiliates under Section 23A and 23B of the Federal Reserve Act, including an expansion of the definition of “covered transactions” and a clarification regarding the amount of time for which collateral requirements regarding covered credit transactions must be satisfied. The ability of the Federal Reserve to grant exemptions from these restrictions is also narrowed by the Dodd-Frank Act, including by requiring coordination with other bank regulators.

The Federal Reserve’s Regulation O imposes restrictions and procedural requirements in connection with the extension of credit by an insured depository institution to directors, executive officers, principal shareholders and their related interests.

10

Brokered Deposits

The FDIA restricts the use of brokered deposits by certain depository institutions. Under the applicable regulations, a “well capitalized insured depository institution” may solicit and accept, renew or roll over any brokered deposit without restriction. An “adequately capitalized insured depository institution” may not accept, renew or roll over any brokered deposit unless it has applied for and been granted a waiver of this prohibition by the Federal Reserve. An “undercapitalized insured depository institution” may not accept, renew or roll over any brokered deposit. The Federal Reserve may, on a case-by-case basis and upon application by an adequately capitalized insured depository institution, waive the restriction on brokered deposits upon a finding that the acceptance of brokered deposits does not constitute an unsafe or unsound practice with respect to such institution.

In addition, the FDIA prohibits an insured depository institution from offering interest rates on any deposits significantly higher than the prevailing rate in the bank’s normal market area or nationally (depending upon where the deposits are solicited), unless it is well capitalized or is adequately capitalized and receives a waiver from the Federal Reserve.

Concentrated Commercial Real Estate Lending Guidance

The federal banking agencies have promulgated guidance governing financial institutions with concentrations in commercial real estate lending. The guidance provides that a bank has a concentration in commercial real estate lending if (1) total reported loans for construction, land development, and other land represent 100% or more of total capital or (2) total reported loans secured by multifamily and non-farm non-residential properties and loans for construction, land development and other land represent 300% or more of total capital and the bank’s commercial real estate loan portfolio has increased 50% or more during the prior 36 months. Owner-occupied commercial real estate loans are excluded from this second category. If a concentration is present, management must employ heightened risk management practices that address the following key elements: board and management oversight and strategic planning, portfolio management, development of underwriting standards, risk assessment and monitoring through market analysis and stress testing and maintenance of increased capital levels as needed to support the level of commercial real estate lending.

Deposit Insurance and Deposit Insurance Assessments

The FDIC is an independent federal agency that insures the deposits of federally insured depository institutions up to applicable limits. The FDIC also has certain regulatory, examination and enforcement powers with respect to FDIC-insured institutions. The deposits of the Bank are insured by the FDIC up to applicable limits. As a general matter, the maximum deposit insurance amount is $250 thousand per depositor. FDIC-insured depository institutions are required to pay deposit insurance assessments to the FDIC. Deposit insurance assessments are based on average total assets minus average tangible equity. Institutions assigned to higher risk categories (that is, institutions that pose a higher risk of loss to the Deposit Insurance Fund) pay assessments at higher rates than institutions that pose a lower risk. For larger institutions with more than $10 billion in assets such as Stellar Bank, the FDIC uses a performance score and a loss-severity score that are used to calculate an initial assessment rate. In calculating these scores, the FDIC uses a bank’s capital level and supervisory ratings and certain financial measures to assess an institution’s ability to withstand asset-related stress and funding-related stress. The FDIC has the ability to make discretionary adjustments to the total score based upon significant risk factors that are not adequately captured in the calculations.

In November 2023, the FDIC issued a final rule to implement a special assessment to recover losses to the Deposit Insurance Fund incurred as a result of recent bank failures and the FDIC’s use of the systemic risk exception to cover certain deposits that were otherwise uninsured. The special assessment was based on estimated uninsured deposits as of December 31, 2022 (excluding the first $5.0 billion) and was assessed at a quarterly rate of 3.36 basis points, over eight quarterly assessment periods, beginning in the first quarter of 2024. Under the final rule, the estimated loss pursuant to the systemic risk determination will be periodically adjusted, and the FDIC has retained the ability to cease collection early, extend the special assessment collection period and impose a final shortfall special assessment on a one-time basis. The extent to which any such additional future assessments will impact our future deposit insurance expense is currently uncertain.

Depositor Preference

The FDIA provides that, in the event of the “liquidation or other resolution” of an insured depository institution, the claims of depositors of the institution (including the claims of the FDIC as subrogee of insured depositors) and certain claims for administrative expenses of the FDIC as a receiver will have priority over other general unsecured claims against the institution. If the Company invests in or acquires an insured depository institution that fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors, including the Company, with respect to any extensions of credit they have made to such insured depository institution.

11

Anti-Money Laundering and OFAC

Under federal law, financial institutions must maintain anti-money laundering programs that include established internal policies, procedures and controls, a designated compliance officer, an ongoing employee training program and testing of the program by an independent audit function. Financial institutions are also prohibited from entering into specified financial transactions and account relationships and must meet enhanced standards for due diligence and customer identification in their dealings with non-U.S. financial institutions and non-U.S. customers. Financial institutions must take reasonable steps to conduct enhanced scrutiny of account relationships to guard against money laundering and to report any suspicious transactions, and law enforcement authorities have been granted increased access to financial information maintained by financial institutions. Bank regulators routinely examine institutions for compliance with these obligations and they must consider an institution’s compliance with such obligations in connection with the regulatory review of applications, including applications for mergers and acquisitions. The regulatory authorities have imposed cease and desist orders and civil money penalty sanctions against institutions found to be violating these obligations.

The U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) is responsible for helping to ensure that U.S. entities do not engage in transactions with certain prohibited parties, as defined by various Executive Orders and Acts of Congress. OFAC publishes lists of persons, organizations and countries suspected of aiding, harboring or engaging in terrorist acts, known as Specially Designated Nationals and Blocked Persons. If the Company or the Bank finds a name on any transaction, account or wire transfer that is on an OFAC list, the Company or the Bank must freeze or block such account or transaction, file a suspicious activity report and notify the appropriate authorities.

On January 1, 2021, Congress passed the National Defense Authorization Act for Fiscal Year 2021 (“NDAA”), which enacted the most significant overhaul of the Bank Secrecy Act (“BSA”), and related anti-money laundering laws since the Patriot Act. The Anti-Money Laundering Act of 2020 (“AMLA”), which amends the BSA, was included in the NDAA. Among other things, it codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the U.S. Department of the Treasury to promulgate priorities for anti-money laundering and countering the financing of terrorism; requires the development of standards for testing technology and internal processes for BSA compliance; expands enforcement- and investigation-related authority, including increasing available sanctions for certain BSA violations; and expands BSA whistleblower incentives and protections. Notable amendments include (1) significant changes to the collection of beneficial ownership information and the establishment of a beneficial ownership registry, which requires corporate entities (generally, any corporation, LLC, or other similar entity with 20 or fewer employees and annual gross income of $5 million or less) to report beneficial ownership information to FinCEN (which will be maintained by Financial Crimes Enforcement Network (“FinCEN”), and made available upon request to financial institutions), (2) enhanced whistleblower provisions, which provide that one or more whistleblowers who voluntarily provide original information leading to the successful enforcement of violations of the AML laws in any judicial or administrative action brought by the Secretary of the Treasury or the Attorney General resulting in monetary sanctions exceeding $1 million (including disgorgement and interest but excluding forfeiture, restitution, or compensation to victims) will receive not more than 30 percent of the monetary sanctions collected and will receive increased protections, (3) increased penalties for violations of the BSA, (4) improvements to existing information sharing provisions that permit financial institutions to share information relating to SARs with foreign branches, subsidiaries, and affiliates (except those located in China, Russia, or certain other jurisdictions) for the purpose of combating illicit finance risks and (5) expanded duties and powers of FinCEN. Many of the statutory provisions in the AMLA will require additional rulemakings, reports and other measures, and the impact of the AMLA will depend on, among other things, rulemaking and implementation guidance. In June 2021, the Financial Crimes Enforcement Network, a bureau of the U.S. Department of the Treasury, issued the priorities for anti-money laundering and countering the financing of terrorism policy required under the AMLA. The priorities include corruption, cybercrime, terrorist financing, fraud, transnational crime, drug trafficking, human trafficking and proliferation financing.

Consumer Laws and Regulations

Banking organizations are subject to numerous laws and regulations intended to protect consumers. These laws include, among others:

•Truth in Lending Act;

•Truth in Savings Act;

•Electronic Funds Transfer Act;

•Expedited Funds Availability Act;

•Equal Credit Opportunity Act;

•Fair and Accurate Credit Transactions Act;

•Fair Housing Act;

•Fair Credit Reporting Act;

12

•Fair Debt Collection Act;

•Gramm-Leach-Bliley Act;

•Home Mortgage Disclosure Act;

•Right to Financial Privacy Act;

•Real Estate Settlement Procedures Act;

•laws regarding unfair and deceptive acts and practices; and

•usury laws.

Many states and local jurisdictions have consumer protection laws analogous to, and in addition to, those listed above. These federal, state and local laws regulate the manner in which financial institutions deal with customers when taking deposits, making loans or conducting other types of transactions. Failure to comply with these laws and regulations could give rise to regulatory sanctions, customer rescission rights, action by state and local attorneys general and civil or criminal liability.

Consumer Financial Protection Bureau. We are subject to a number of federal and state consumer protection laws that extensively govern our relationship with our customers. These laws include the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Truth in Lending Act, the Truth in Savings Act, the Electronic Fund Transfer Act, the Expedited Funds Availability Act, the Home Mortgage Disclosure Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Fair Debt Collection Practices Act, the Service Members Civil Relief Act and these laws’ respective state-law counterparts, as well as state usury laws and laws regarding unfair and deceptive acts and practices. These and other federal laws, among other things, require disclosures of the cost of credit and terms of deposit accounts, provide substantive consumer rights, prohibit discrimination in credit transactions, regulate the use of credit report information, provide financial privacy protections, prohibit unfair, deceptive and abusive practices, restrict our ability to raise interest rates and subject us to substantial regulatory oversight. Violations of applicable consumer protection laws can result in significant potential liability from litigation brought by customers, including actual damages, restitution and attorneys’ fees. Federal bank regulators, state attorneys general and state and local consumer protection agencies may also seek to enforce consumer protection requirements and obtain these and other remedies, including regulatory sanctions, customer rescission rights, action by the state and local attorneys general in each jurisdiction in which we operate and civil money penalties. Failure to comply with consumer protection requirements may also result in our failure to obtain any required bank regulatory approval for merger or acquisition transactions we may wish to pursue or our prohibition from engaging in such transactions even if approval is not required.

The CFPB is a federal agency responsible for implementing, examining and enforcing compliance with federal consumer protection laws. The CFPB has broad rulemaking authority for a wide range of consumer financial laws that apply to all banks, including, among other things, laws relating to fair lending and the authority to prohibit “unfair, deceptive or abusive” acts and practices. Abusive acts or practices are defined as those that materially interfere with a consumer’s ability to understand a term or condition of a consumer financial product or service or take unreasonable advantage of a consumer’s (1) lack of financial savvy, (2) inability to protect himself in the selection or use of consumer financial products or services, or (3) reasonable reliance on a covered entity to act in the consumer’s interests. The CFPB can issue cease-and-desist orders against banks and other entities that violate consumer financial laws. The CFPB may also institute a civil action against an entity in violation of federal consumer financial law in order to impose a civil penalty or injunction. The CFPB has examination and enforcement authority over all banks with more than $10 billion in assets, as well as their affiliates. Banking regulators take into account compliance with consumer protection laws when considering approval of a proposed transaction.

Mortgage loan origination. The Dodd-Frank Act authorized the CFPB to establish certain minimum standards for the origination of residential mortgages, including a determination of the borrower’s ability to repay a residential mortgage loan. Under the Dodd-Frank Act, financial institutions may not make a residential mortgage loan unless they make a “reasonable and good faith determination” that the consumer has a “reasonable ability” to repay the loan. The Dodd-Frank Act allows borrowers to raise certain defenses to foreclosure, but provides a full or partial safe harbor from such defenses for loans that are “qualified mortgages.” The CFPB has promulgated rules to, among other things, specify the types of income and assets that may be considered in the ability to repay determination, the permissible sources for verification and the required methods of calculating the loan’s monthly payments. The rules extend the requirement that creditors verify and document a borrower’s income and assets to include all information that creditors rely on in determining repayment ability. The rules also provide further examples of third-party documents that may be relied on for such verification, such as government records and check cashing or funds transfer service receipts. The rules also define “qualified mortgages,” imposing both underwriting standards—for example, a borrower’s debt to income ratio may not generally exceed 43% and limits on the terms of their loans. Points and fees are subject to a relatively stringent cap, and the terms include a wide array of payments that may be made in the course of closing a loan. Certain loans, including interest only loans and negative amortization loans, cannot be qualified mortgages.

13

The Community Reinvestment Act

The Community Reinvestment Act (“CRA”) and related regulations are intended to encourage banks to help meet the credit needs of their service areas, including low- and moderate-income neighborhoods, consistent with safe and sound operations. The bank regulators examine and assign each bank a public CRA rating. The CRA requires bank regulators to take into account the bank’s record in meeting the needs of its service area when considering an application by a bank to establish or relocate a branch or to conduct certain mergers or acquisitions. The Federal Reserve is required to consider the CRA records of a bank holding company’s controlled banks when considering an application by the bank holding company to acquire a banking organization or to merge with another bank holding company. When we or the Bank apply for regulatory approval to engage in certain transactions, the regulators will consider the CRA record of target institutions and our depository institution subsidiaries. An unsatisfactory CRA record could substantially delay approval or result in a withdrawal or denial of an application. The regulatory agency’s assessment of the institution’s record is made available to the public. The Bank received an overall CRA rating of “satisfactory” on its most recent CRA examination.

Incentive Compensation Guidance

The Federal Reserve reviews, as part of its regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Company, that are not “large, complex banking organizations.” These reviews are tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

In July 2010, the federal banking agencies issued guidance on incentive compensation policies that applies to all banking organizations supervised by the agencies, including the Company and the Bank. Pursuant to the guidance, to be consistent with safety and soundness principles, a banking organization’s incentive compensation arrangements should: (1) provide employees with incentives that appropriately balance risk and reward, (2) be compatible with effective controls and risk management and (3) be supported by strong corporate governance including active and effective oversight by the banking organization’s board of directors. Monitoring methods and processes used by a banking organization should be commensurate with the size and complexity of the organization and its use of incentive compensation.

Section 956 of the Dodd-Frank Act requires the federal bank regulatory agencies and the SEC to establish joint regulations or guidelines prohibiting incentive-based payment arrangements at specified regulated entities that encourage inappropriate risk-taking by providing an executive officer, employee, director or principal shareholder with excessive compensation, fees or benefits or that could lead to material financial loss to the entity. The federal bank regulatory agencies issued such proposed rules in April 2011 and issued a revised proposed rule in June 2016 implementing the requirements and prohibitions set forth in Section 956. The revised proposed rule would apply to all banks, among other institutions, with at least $1 billion in average total consolidated assets, for which it would go beyond the existing guidance to (1) prohibit certain types and features of incentive-based compensation arrangements for senior executive officers, (2) require incentive-based compensation arrangements to adhere to certain basic principles to avoid a presumption of encouraging inappropriate risk, (3) require appropriate board or committee oversight, (4) establish minimum recordkeeping and (5) mandate disclosures to the appropriate federal banking agency.

Cybersecurity

Federal bank regulatory agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third-parties in the provision of financial services. State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Many states, including Texas, have also recently implemented or modified their data breach notification, information security and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually monitoring developments in the states in which our customers are located.

The SEC requires public companies to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, processes, strategy, and governance. The rules also generally require public companies to disclose on Form 8-K any cybersecurity incident it determines to be material within four business days of such determination and to describe the material aspects of the incident’s nature, scope, and timing, as well as its

14

material impact or reasonably likely material impact on the company. See “Item 1C. Cybersecurity” for a discussion of the Company’s cybersecurity risk management, strategy and governance.

The federal banking regulators regularly issue new guidance and standards, and update existing guidance and standards, regarding cybersecurity intended to enhance cyber risk management among financial institutions. Financial institutions are expected to

comply with such guidance and standards and to accordingly develop appropriate security controls and risk management processes. If

we fail to observe such regulatory guidance or standards, we could be subject to various regulatory sanctions, including financial

penalties. Banking organizations are required to notify their primary banking regulator within 36 hours of determining that a “computer-security incident” has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss, or its operations that would impact the stability of the United States.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs, and many states, including Texas, have also recently implemented or modified their data breach notification, information security and data privacy requirements. The Company expects this trend of state-level activity in those areas to continue and are continually monitoring developments in the stated in which its customers are located.

Changes in Laws, Regulations or Policies

Federal, state and local legislators and regulators regularly introduce measures or take actions that would modify the regulatory requirements applicable to banks, their holding companies and other financial institutions. Changes in laws, regulations or regulatory policies could adversely affect the operating environment for us in substantial and unpredictable ways, increase or decrease our cost of doing business, impose new restrictions on the way in which the Company conducts its operations or modify significant operational constraints that might impact the Company’s profitability. Whether new legislation will be enacted and, if enacted, the effect that it, or any implementing regulations, would have on the Company and its subsidiaries’ business, financial condition or results of operations cannot be predicted. A change in laws, regulations or regulatory policies may have a material adverse effect on the Company’s business and results of operations.

Effect on Economic Environment

The policies of regulatory authorities, including the monetary policy of the Federal Reserve, have a significant effect on the operating results of bank holding companies and their subsidiaries. Among the means available to the Federal Reserve to affect the money supply are open market operations in U.S. government securities, changes in the discount rate on member bank borrowings and changes in reserve requirements with respect to deposits. These means are used in varying combinations to influence overall growth and distribution of bank loans, investments and deposits, and their use may affect interest rates charged on loans or paid for deposits. Federal Reserve monetary policies have materially affected the operating results of commercial banks in the past and are expected to continue to do so in the future. The Company cannot predict the nature of future monetary policies and the effect of such policies on its business and earnings.