Bancorp, Inc. (TBBK) Risk Factors

ITEM 1A. RISK FACTORS.

Investing in our common stock involves risk. The following risk factors, the information set forth under “Cautionary Note Regarding Forward-Looking Statements” and all of the other information contained in this Annual Report on Form 10-K should be read carefully in connection with evaluating our business. The risks and uncertainties described below could materially and adversely affect our business, financial condition and results of operations and cash flows in future periods and are not the only risks facing our Company. Additional risks and uncertainties not currently known to us or that we currently do not view as material may also become materially adverse to our business in future periods or if circumstances change.

Our risk factors are organized into sections, and a summary of the content of the sections is as follows:

Business and Strategy – contains discussion of risks related to our strategic goals, growth, new lines of business, products and services, digital delivery channels, acquisitions, artificial intelligence, and liquidity management.

Regulatory and Compliance—contains discussion of risks related to the impact of government regulation or changes in regulation, personal data protection and privacy law compliance, our enterprise risk-management framework, processes and strategies, and the consequences if our balance sheet grows above $10 billion as of December 31 of any calendar year.

Competition—contains discussion of competitive markets we operate in.

Economic—contains discussion of the impact on our business of periods of negative economic conditions, U.S. federal government shutdown, and changes in interest rates.

Fintech Solutions Business—contains discussion of concentration of partner relationships, regulatory and legal requirements specific to the industry, the impact of changes in rules or standards or rates of the payment networks, fraud risk, the risk of no longer being classified as non-brokered, fund transfer and payment related risks, risk related to partner agreements, and compliance risk related to unclaimed funds.

Credit Solutions Business—contains discussion of lending risks, model risk, credit fraud and regulatory risks related to partner agreements for marketing and servicing loans, risks specific to real estate bridge lending, and SBA lending program risks.

Operations—contains discussion of risks of interruptions or failures in technology, cybersecurity risk, third-party outsourcing risk, and key employee risk.

Taxes and Accounting—contains discussion of accounting estimates risk, change in accounting policy or standard risk, and internal control risk.

Ownership of Our Common Stock—contains discussion of risk related to the Bank’s ability to dividend to the holding company and impact on our ability to return capital, share repurchase program risks, the impact of anti-takeover provisions, and the required judicial forum for disputes.

21

Business and Strategy

We cannot assure you that we will be able to accomplish our strategic goals as necessary to meet our financial targets.

Our future earnings, and ability to meet our financial targets, will reflect our level of success in accomplishing our strategic goals, including: (i) growing our Fintech Solutions business, and generating non-interest income from Fintech Solutions products; (ii) developing new partner relationships, and retaining and growing existing relationships; (iii) funding our loan and investment portfolio with low-cost, stable deposits and optimizing our balance sheet allocation; and (iv) using our robust infrastructure as a platform for growth, and developing AI tools to increase efficiency in our expense base.

We may be unable to achieve these strategic goals, in whole or in part, or achieve the goals within our intended timelines, and the achievement of these goals may not have the intended benefit to our financial results, due to many factors including, but not limited to:

any failures to grow our product offerings, expand our platform or grow our program sponsorship balances;

our ability to attract new partnerships, or retain or grow existing relationships;

any disruption in our ability to source low-cost, stable deposits;

our decisions around balancing our loan and investment portfolio to optimize earnings while supporting the growth of our business may not yield our anticipated net margin;

our ability to manage credit risk to intended levels; and

our decisions around investments in our infrastructure, redeployment of, or reduction in resources, and use of AI may not have the beneficial impact that we intended to our processes, efficiency, and results.

In addition, many external factors may also impair our ability to accomplish our strategic goals, including but not limited to changes in market or economic conditions, changes to regulations impacting our business, and competition, among other factors.

We could encounter challenges in managing strong growth across various aspects of our business simultaneously and may require diverting resources or otherwise incurring additional costs, and potentially limit our ability to expand our operations successfully.

Our future profitability will depend in part on our continued ability to grow; however, we may not be able to sustain our historical growth rate or be able to grow. Our future success will depend on the ability of our officers and key employees to continue to implement and improve our operational, financial and management controls, reporting systems and procedures and manage a growing number of customer relationships. We may not implement improvements to our management information and control systems in an efficient or timely manner and may discover deficiencies in existing systems and controls. Consequently, any future growth may place a strain on our administrative and operational infrastructure. Any such strain could increase our costs, reduce or eliminate our profitability and reduce the price at which our common stock trades.

New lines of business, and new products and services may result in exposure to new risks and the value and earnings related to existing lines of business are subject to market conditions.

The Bank has introduced, and in the future may introduce, new products and services to differing markets either alone or in conjunction with third-parties. New lines of business, products or services could have a significant impact on the effectiveness of our system of internal controls or the controls of third-parties and could reduce our revenues and potentially generate losses. There are material inherent risks and uncertainties associated with offering new products and services, especially when new markets are not fully developed, or when the laws and regulations regarding a new product are not mature. New products and services, or entrance into new markets, may require substantial time, resources and capital, and profitability targets may not be achieved. Factors outside of our control, such as developing laws and regulations, regulatory orders, competitive product offerings and changes in commercial and consumer demand for products or services may also materially impact the successful launch and implementation of new products or services. Failure to manage these risks, or failure of any product or service offerings to be successful and profitable, could have a material adverse effect on our financial condition and results of operations.

22

We are dependent upon digital delivery channels for our banking and fintech services, and are subject to the risks associated with those channels.

We utilize digital delivery channels and other automated electronic processing in our banking and fintech services and do not have physical locations, in contrast to the internet banking services of an established traditional bank. Several factors contribute to the unique challenges that internet-based banks and fintech focused banks face. These include concerns for the security of personal information, the absence of personal relationships between bankers and ultimate customers, the absence of loyalty to a traditional hometown bank, the customer’s difficulty in understanding and assessing the substance and financial strength of an internet-based bank, a lack of confidence in the likelihood of success and permanence of internet-based banks and many individuals’ unwillingness to trust their personal assets to a relatively new technological medium such as the internet.

Many traditional financial institutions offer the option of internet-based banking and financial services to their existing and prospective customers. The public may perceive traditional financial institutions as being safer, more responsive, more comfortable to deal with and more accountable as providers of their banking and financial services, including their internet-based banking services. We may be unable to offer internet-based banking services and relationship features that provide sufficient advantages to compete successfully with established traditional financial institutions.

Moreover, both the internet and the financial services industry are undergoing rapid technological changes, with frequent introductions of new technology-driven products and services. In addition to improving the ability to serve customers, the effective use of technology increases efficiency and enables financial institutions to reduce costs. Our ability to compete will depend, in part, upon our ability to address the needs of our partners and customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Some of our competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our partners and customers. Such products may also prove costly to develop or acquire.

Potential acquisitions may disrupt our business and dilute stockholder value.

From time to time, we evaluate merger and acquisition opportunities and conduct due diligence activities and negotiations related to possible transactions with other financial institutions and financial services companies. Acquiring other banks or businesses involves various risks including, but not limited to potential exposure to unknown or contingent liabilities of the target entity, difficulty and expense of integrating the operations and personnel of the target entity, and potential increases to applicable banking or tax laws or regulations that impact the target entity. Acquisitions typically involve the payment of a premium over book and market values, and, therefore, some dilution of our tangible book value and net income per common share may occur in connection with any future transaction. Furthermore, any failures to realize the projected benefits from an acquisition, including revenue increases, cost savings, increases in geographic or product presence, and/or other operational synergies could have a material adverse effect on our financial condition and results of operations.

The development and use of artificial intelligence (“AI”) presents risks and challenges that may adversely impact our business.

We or our third-party vendors, partners, clients or counterparties may develop or incorporate AI technology in certain business processes, services or products. The developments and use of AI presents several potential risks and challenges to our business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving in the U.S. and internationally, and includes regulatory schemes targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment and other laws applicable to the use of AI. These evolving laws and regulations could require changes in our implementation of AI technology and increase our compliance costs and the risk of non-compliance. AI models, particularly generative AI models, may product output or take action that is incorrect, that reflects biases included in the data on which they are trained, that results in the release of private, confidential or proprietary information, that infringes on the intellectual property rights of others, or that is otherwise harmful. In addition, the complexity of many AI models makes it difficult to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output, eliminating bias, and complying with regulations that require documentation or explanation of the basis on which decisions are made. Further, we may rely on AI models developed by third-parties, and, to that extent, would be dependent in part on the manner in which those third-parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models and the effectiveness of the steps these third-parties have taken to limit the risks associated with the output of their models, matters over which we may have limited visibility. Any of these risks could expose

23

us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures.

Ineffective liquidity management could adversely affect our financial condition and results of operation.

Liquidity is essential to our business. We rely on different sources of funding to meet our potential liquidity demands. Our primary sources of funds are deposits, derived principally through our Fintech Solutions business, borrowings, principal and interest payments on loans and leases and mortgage-backed securities, and maturing investment securities. We also utilize wholesale deposit sources to provide temporary funding when necessary or when favorable terms are available. Our access to deposits may be negatively impacted by, among other factors, periods of low interest rates or higher interest rates which could promote increased competition for deposits, borrowings, and the sale of loans and other sources which could have a substantial negative effect on our liquidity. Our access to funding sources in amounts adequate to finance our activities or on terms which are acceptable to us could be impaired by factors that affect us specifically, or the financial services industry or economy generally. Additionally, negative news about us or the banking industry in general could negatively impact market or customer perceptions of our company, which could lead to a loss of depositor confidence and an increase in deposit withdraws, particularly among those with uninsured deposits. Any decline in available funding in amounts adequate to finance our activities or on terms which are acceptable could adversely impact our ability to originate loans, invest in securities, meet our expenses or fulfill our obligations, such as repaying our borrowings or meeting deposit withdrawal demands, any of which could, in turn, have a material adverse effect on our business, financial condition and results of operations. See “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operation - Liquidity and Capital Resources” of this Form 10-K.

Regulatory and Compliance

We are subject to and may be affected by extensive government regulation or material changes in the regulatory landscape.

We are subject to extensive federal and state regulation and supervision, which has increased in recent years as a result of stress to the financial system. Our subsidiary, The Bancorp Bank, N.A., is a national bank that is also subject to broad federal regulation and oversight extending to all of its operations by its primary federal regulator, the OCC, and by its deposit insurer, the FDIC. Banking regulations are primarily intended to protect customers, depositors’ funds, the federal deposit insurance funds and the banking system as a whole, rather than our stockholders. These regulations affect the Bank’s lending practices, capital structure and requirements, investment activities, dividend policy, product offerings, expansionary strategies and growth, among other things. For example, under capital adequacy guidelines and the regulatory framework for prompt corrective action, we and the Bank must meet specific capital guidelines that involve quantitative measures of their assets, liabilities and certain off-balance sheet items as calculated under regulatory accounting practices. The capital amounts and classification of the Company and the Bank are also subject to qualitative judgments by regulators about components, risk weightings and other factors. Moreover, capital requirements may be modified based upon regulatory rules or by regulatory discretion at any time due to a variety of factors, including deterioration in asset quality. A failure by either the Bank or the Company to meet regulatory capital requirements will result in the imposition of limitations on our operations and could, if capital levels drop significantly, result in our being required to cease operations. Regulatory capital requirements must also be satisfied such that mandated capital ratios are maintained as the Bank grows, or growth may be required to be curtailed. Moreover, a failure by either the Bank or the Company to comply with regulatory requirements regarding lending practices, investment practices, customer relationships, anti-money laundering detection and prevention, and other operational practices, as discussed further under Item 1, “Business – Regulation and Supervision,” could result in regulatory sanctions, third-party liabilities, and could damage our business and reputation.

The Bank continues to closely monitor its performance in alignment with its CRA strategic plan to meet the specified lending, service and investment requirements contained therein. There can be no assurance that we will maintain a satisfactory rating, and if not maintained, the Bank would be subject to certain business restrictions as required by the CRA and FDIC regulations.

The legal and regulatory landscape is frequently changing as Congress and regulatory agencies adopt or amend laws, or change interpretation of existing statutes, regulations or policies. These changes could affect the Company and the Bank in substantial and unpredictable ways and could have a material adverse effect on our financial condition and results of operations. For example, the Bank pays assessment fees both to the OCC and the FDIC, and the level of such assessments reflects the condition of the Bank. If the condition of the Bank were to deteriorate, the level of such assessments could increase significantly, having a material adverse effect on the Company’s financial condition and results of operations. Additionally, any change in regulators or policy changes within current

24

regulators may increase our operating costs and impact our business strategy, governance structure, financial condition or results of operations.

Failure to comply with personal data protection and privacy laws can adversely affect our business.

We are subject to a variety of continuously evolving and developing laws and regulations in numerous jurisdictions regarding personal data protection and privacy. These laws and regulations may be interpreted and applied differently from state to state, and can create inconsistent or conflicting requirements. Our efforts to comply with these laws and regulations, including the CCPA as well as comprehensive privacy legislation passed in other states, impose significant costs and challenges that are likely to continue to increase over time, particularly as additional jurisdictions continue to adopt similar regulations. Failure to comply with these laws and regulations or to otherwise protect personal data from unauthorized access, use or other processing, could in the future result in litigation, claims, legal or regulatory proceedings, inquiries or investigations, damage to our reputation, fines or penalties, all of which can adversely affect our business.

Our enterprise-wide risk management framework, processes and strategies must be effective.

Our enterprise-wide risk management framework, processes and strategies must be effective, otherwise losses may result. We manage asset quality, liquidity, market sensitivity, operational, regulatory, third-party vendor and partner relationship risks and other risks through various processes and strategies throughout the organization. However, our risk management measures may not be fully effective in identifying and mitigating risk exposure in all market environments or against all types of risk, including risks that are unidentified or unanticipated, even if the frameworks for assessing risk are properly designed and implemented. Some of our methods of managing risk are based upon the use of observed historical market behavior and management’s judgment. These methods may not accurately predict future exposures, which could be significantly greater than historical measures indicate. If our risk management judgments and strategies are not effective, or unanticipated risks arise, our income could be reduced or we could sustain losses.

We will be subject to heightened regulatory requirements and experience adverse business consequences if our total assets exceed $10 billion as of December 31 of any calendar year.

If our total assets exceed $10 billion at December 31 of any calendar year, we will become subject to heightened regulatory requirements and our operating results may suffer. As of December 31, 2025, our total assets were $9.35 billion. Although we intend to manage our balance sheet to remain below $10 billion in total assets, growth in deposits and associated asset growth could cause us to exceed that threshold as of a calendar-year end. If we have total consolidated assets of $10 billion or more at calendar year-end, the exemption for small issuers ceases to apply as of July 1 of the following calendar year, although the exemption can be regained if our consolidated assets fall below the $10 billion threshold at calendar year-end in the future.

Banks with $10 billion or more in total assets are subject to additional regulatory requirements and supervisory oversight. Among other things, such institutions are examined directly by the Consumer Financial Protection Bureau with respect to federal consumer financial laws; are subject to reduced dividends on the Bank’s holdings of FRB common stock; are subject to limits on interchange fees pursuant to the Durbin Amendment to the Dodd-Frank Act; are subject to certain enhanced prudential standards; are no longer treated as a “small institution” for FDIC deposit insurance assessment purposes; and are not eligible to elect the Community Bank Leverage ratio. Further, loss of the small issuers exemption could result in the termination of certain beneficial fee-sharing prepaid card programs that are available to us while we remain below $10 billion in total assets.

Compliance with these additional requirements would increase our regulatory obligations and may require additional personnel, enhanced internal controls, and other significant expenditures, which could have a material adverse effect on our business, financial condition and results of operations.

25

Competition

We operate in highly competitive markets, and our partnership marketing strategy has been adopted by other institutions with which we compete.

We face substantial competition in all areas of our operations from a variety of different competitors, including commercial banks and their holding companies, credit unions, leasing companies, consumer finance companies, factoring companies, insurance companies, money market mutual funds and card issuers, online lenders, financial technology companies and other non-traditional competitors. See Item 1, “Business—Competition.”

We face national and even global competition with respect to our other products and services, including payment acceptance products and services, private label banking, fleet leasing, government guaranteed lending and payment solutions. Our commercial partners and banking customers for these products and services are located throughout the United States, and the competition is strong in each category.

We encounter competition from some of the largest financial institutions in the world as well as smaller specialized regional banks and financial service companies. Increased competition with any of these product or service offerings could result in reduced pricing and lower profit margins, fragmented market share and a failure to enjoy economies of scale, loss of customer and depositor base, and other risks that individually, or in the aggregate, could have a material adverse effect on our financial condition and results of operations. Further, some of the financial services organizations with which we compete are not subject to the same degree of regulation as federally-insured and regulated financial institutions such as ours. As a result, those competitors may be able to access funding and provide various services more easily or at less cost than we can.

Several online banking operations as well as the online banking programs of traditional banks have instituted partnership marketing strategies similar to ours. As a consequence, we have encountered competition in this area and anticipate that we will continue to do so in the future. This competition may increase our costs, reduce our revenues or revenue growth or make it difficult for us to compete effectively in obtaining partner relationships.

Economic

Periods of weak economic, slow growth, and/or inflationary conditions in the U.S. economy have had, and could have significant adverse effects on our business performance, growth prospects, and operating results.

Periods of weak economic, slow growth, and/or inflationary conditions in the U.S. economy have had, and could have significant adverse effects on our business performance, growth prospects, and operating results. Unfavorable economic trends including slowing growth, inflation, declines in real estate values and other changes or instability in the macroeconomic environment may cause declines in the availability of credit, change consumer spending behavior, lead to reductions in the value of real estate-related assets, and impair the ability of certain borrowers to repay their obligations. In recent periods, the U.S. economy has been subject to low rates of growth in general and, in particular localities, recession-like conditions have occurred. These negative trends can cause economic pressure on consumers and businesses and diminish confidence in the financial markets, which may result in elevated credit losses, decreased activity and demand for our products and services, and adversely affect our business, financial condition, and results of operations.

Further, our general business and economic climate has been subject to uncertainty due to events of actual and threatened U.S. government shutdowns, concerns around downgrades to the credit rating of the U.S. government, and uncertainty surrounding the impacts of actual or potential emerging U.S. government policies. Concerns around government actions, policies or related impacts could create financial turmoil and uncertainty, which could weigh heavily on the macroeconomic climate and global banking system. It is possible that any such impact could have a material adverse effect on our business, results of operations and financial condition.

Prolonged periods of inflation may impact our profitability should higher borrowing costs stress borrower repayment, or should our non-interest expense increases not be adequately offset by revenue increases. Higher costs of living for borrowers could also negatively and materially impact loan performance and loan demand. In addition, weak economic conditions can also impact consumer spending and related fees in our payments businesses.

26

A prolonged U.S. federal government shutdown or default by the United States on government obligations could harm our results of operations.

Any prolonged disruption of U.S. federal government operations could materially and adversely affect our business, financial condition and results of operations. Our results of operations, including revenue, non-interest income, expenses and net interest income, could be adversely affected in the event of widespread financial and business disruption due to a default by the United States on U.S. government obligations or a prolonged failure to maintain significant U.S. federal government operations, particularly those pertaining to the SBA. Any such failure to maintain such U.S. federal government operations would impede our ability to originate SBA loans and our ability to sell such loans, which could in turn adversely impact our results of operations.

Changes in interest rates could reduce our income and asset valuations, and adversely affect our business, results of operations and financial condition.

A significant portion of our income and cash flows depends on our net interest margin, or the difference between the interest rates we earn on interest-earning assets, such as loans and investment securities, and the interest rates we pay on interest-bearing liabilities, such as deposits and borrowings. Net interest margin is affected by changes in market interest rates, because different types of assets and liabilities may react differently, and at different times, to market interest rate changes. When interest-bearing liabilities mature or reprice more quickly than interest-earning assets in a period, an increase in market rates of interest could reduce net interest income. Similarly, when interest-earning assets mature or reprice more quickly than interest-bearing liabilities, falling interest rates could reduce net interest income. These rates are highly sensitive to many factors beyond our control, including competition, general economic conditions and monetary and fiscal policies of various governmental regulatory agencies, including the Federal Reserve and the target Federal Funds rate.

We seek to manage our risk from changes in market interest rates by adjusting the rates, maturity, repricing, and balances of our different types of interest-earning assets and interest-bearing liabilities, but these interest rate risk management techniques are not capable of fully eliminating such risks and they may not be as effective as we intend. In particular, rapid increases or decreases in interest rates could have unusually adverse effects on our net interest margin, net interest income and results of operations, to the extent our interest rate risk management techniques are insufficient to mitigate these risks in a timely manner.

The impact of interest rates on our investment portfolio and consolidated financial results, including AOCI, can also affect our ability to maintain our capital ratios within our target ranges as well as the amount and timing of our future share repurchases.

See further discussion of the effects of interest rate changes on the market value of our portfolio and net interest income in Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Asset and Liability Management.”

Fintech Solutions Business

There is a significant concentration of deposits and non-interest income that are sourced through partner relationships in our Fintech Solutions business.

We derive a significant percentage of our deposits and non-interest-income from the partner relationship agreements of our Fintech Solutions business. We have multi-year, contractual relationships with partners through which we provide program sponsorship or the issuance of debit, credit and prepaid cards, we deliver payment services processing, and we originate fintech loans. We recognize non-interest income from these fintech services, primarily total fintech fees and fintech loan credit enhancement income. Also, from these fintech services we source our deposits, which are comprised primarily of millions of small transaction-based consumer balances, the vast majority of which are FDIC-insured.

There is a significant concentration of deposits and non-interest income that are sourced through these partner relationships.

Concentration based on Deposit Balances: Of our total deposits at year-end 2025, the top three partner relationships accounted for $3.83 billion (47%) and the next three largest accounted for $1.35 billion (17%). Those same partners, based on largest deposit concentration, also contributed to our noninterest income for the year ended December 31, 2025, with the top three accounting for total fintech fees of $61.6 million (44%) and all fintech credit enhancement income $169.3 million. The next three partners contributed $27.9 million (20%) to total fintech fees.

27

Concentration based on Income: Of our total non-interest income for the year ended December 31, 2025, the top three partner relationships accounted for total fintech fees of $83.5 million (59%) and all fintech credit enhancement income, or $169.3 million. The next three largest partners accounted for $14.1 million (10%) of total fintech fees. Those same partners, based on largest income concentration, also contribute to deposits at year end, with the top three accounting for $2.02 billion (25%) of deposits and the next three contributing $1.85 billion (23%) of deposits.

We may terminate relationships for various reasons, such as a partner’s failure to implement or maintain sufficient compliance and operational controls, increased financial or regulatory risk, or material changes in applicable law or our business.

Also, a partner could elect to reduce their volumes under our agreement, or terminate or not renew their agreements with us for reasons including the availability of more favorable terms from another provider or dissatisfaction with the level or quality of our services. Further, certain of our partners have been, and in the future may be, acquired by other entities, which could result in the transfer of their business to the acquiror or other institutions upon expiration of their current contractual agreements. In addition, our partner’s products, business strategies, and bank partnership strategies could shift, and, as such, could impact the volumes under our agreement.

If one of these significant relationships were to be terminated or there is a significant decrease in deposits or transactions associated with any of these business relationships, it could materially reduce our deposits and revenues and have a negative impact on our ability to fund our business.

Regulatory and legal requirements applicable to the prepaid and debit card industry are unique and can be subject to frequent change.

Achieving and maintaining compliance with frequently changing legal and regulatory requirements applicable to prepaid and debit card products requires a significant investment in qualified personnel, hardware, software and other technology platforms, external legal counsel and consultants and other infrastructure components. These investments may not ensure compliance or otherwise mitigate risks involved in this business. Our failure to satisfy regulatory mandates applicable to prepaid financial products could result in actions against us by our regulators, legal proceedings being instituted against us by consumers, each of which could reduce our earnings or result in losses, make it more difficult to conduct our operations, or prohibit us from conducting specific operations. Other risks related to prepaid cards include competition for prepaid, debit and other payment mediums, possible changes in the rules of networks, such as Visa and Mastercard and others, in which the Bank operates, changes in network fees or interchange rates and state regulations related to prepaid cards, including those regarding escheatment. The enactment of Dodd-Frank required the Federal Reserve Board to implement regulations that have substantially limited interchange fees for many issuers. While interchange rates are exempt from the limitations imposed by Dodd-Frank for institutions with less than $10 billion in assets such as ourselves, new legislation could result in changes to the rates we are able to charge. There can be no assurance that such possible future legislation or changes by the payment networks will not substantially impact our revenues.

Changes in rules or standards set by the payment networks, or changes in debit network fees or products or interchange rates, could adversely affect our business, financial position and results of operations.

We are subject to network rules that could subject us to a variety of fines or penalties that may be levied by the card networks for acts or omissions by us or businesses that work with us, including card processors and Fintech Program Managers. Furthermore, a substantial portion of our operating revenues is derived directly or indirectly from interchange fees. The amount of prepaid, debit card and related fees that we earn is highly dependent on the interchange rates that the payment networks set and adjust from time to time.

The enactment of Dodd-Frank required the Federal Reserve Board to implement regulations that have substantially limited interchange fees for many issuers. While the interchange rates that may be earned by us are exempt from the limitations imposed by Dodd-Frank, federal legislators and regulatory authorities have become increasingly focused on interchange, and continue to propose new legislation that could result in significant adverse changes to the rates we are able to charge and there can be no assurance that future regulation or changes by the payment networks will not substantially impact our interchange revenues. If interchange rates decline, whether due to actions by the payment networks or future regulation, we would likely need to change our fee structure to offset the loss of interchange revenues. However, our ability to make these changes is limited by the terms of our contracts and other commercial factors, such as price competition. To the extent we increase the pricing of our products and services, we might find it more difficult to acquire consumers and to maintain or grow card usage and customer retention, and we could suffer reputational damage and become subject to greater regulatory scrutiny. We also might have to discontinue certain products or services. As a result, our total operating revenues, operating results, prospects for future growth and overall business could be materially and adversely affected.

28

The potential for fraud in the card payment industry is significant and could adversely affect our business and results of operations.

Issuers of prepaid and debit cards and other companies have suffered significant losses in recent years with respect to the theft of cardholder data that has been illegally exploited for personal gain. The theft of such information is regularly reported and affects individuals and businesses. Losses from various types of fraud have been substantial for certain card industry participants. We also rely upon third-parties for transaction processing services, which subjects us and our customers to risks related to the vulnerabilities of those third-parties. The Bank in many cases has indemnification agreements with third-parties; however, such indemnifications may not fully cover losses. Fraudulent activity could also result in the imposition of regulatory sanctions, including significant monetary fines, which could adversely affect our business, results of operations and financial condition. Although fraud has not had a material impact on the profitability of the Bank, it is possible that such activity could adversely impact the Bank in the future.

If our prepaid and debit card and other deposit accounts generated by third-parties were no longer classified as non-brokered, our FDIC insurance expense might increase.

In December 2014, the FDIC issued guidance classifying prepaid deposit accounts and other deposit accounts obtained in cooperation with third-parties as brokered, resulting in the vast majority of the Bank’s deposits being classified as brokered. However, in December 2020, the FDIC adopted a regulation which resulted in the reclassification of the majority of the Bank’s deposits from brokered to non-brokered beginning June 30, 2021, and a decrease in FDIC insurance expense. Such reclassifications and the resulting FDIC insurance expense decrease are dependent upon ongoing consideration by regulators, including recertification requirements for certain accounts. Should the Bank’s capital ratios fall below well-capitalized levels, it would be prohibited from accepting, renewing or rolling over brokered deposits without the consent of the FDIC. Without such consent, the Bank could not operate its business lines as presently conducted.

We face fund transfer and payments-related risks.

As a financial institution, we bear fund transfer risks of different types, which result from large transaction volumes and large dollar amounts of incoming and outgoing money transfers. Loss exposure may result if money is transferred from the bank before it is received, or legal rights to reclaim monies transferred are asserted, including payments made to merchants for payment clearing, while customers have statutory periods to reverse their payments. Exposure also results from payments made prior to receipt of offsetting funds, as accommodations to customers. We are subject to unique settlement risks as our transfers may be larger than typical financial institutions of our size. Transfers could also be made in error or as a result of fraud. Additionally, as with other financial institutions, we may incur legal liability or reputational risk, if we unknowingly process payments for companies in violation of money laundering laws or other regulations or immoral activities.

Agreements between the Bank and its partners related to marketing and servicing fintech loans may subject the Bank to unique compliance, oversight, and other risks.

The Bank has entered into agreements with an unaffiliated partner who provides marketing and servicing assistance with consumer fintech loans originated by the Bank, and may enter into agreements with additional unaffiliated partners in the future related to fintech loans. While we retain responsibility for compliance with applicable laws and regulations and maintain policies, procedures and monitoring designed to oversee these relationships, reliance on third parties exposes us to heightened compliance, oversight, operational, credit and reputational risks.

These programs are subject to extensive and evolving federal and state laws, regulations and supervisory expectations, including those relating to consumer protection, unfair, deceptive or abusive acts or practices, fair lending, privacy and data protection, anti-money laundering, debt collection and other compliance requirements. Regulatory agencies have increased their scrutiny of bank–fintech partnerships and third-party risk management practices. If a third-party fails to comply with applicable laws, regulations or regulatory guidance, or if regulators determine that our oversight, governance or control framework is inadequate, we could be subject to supervisory findings, enforcement actions, civil money penalties, consumer protection litigation, or other adverse consequences.

Certain program structures may also be subject to legal challenge or regulatory scrutiny, including with respect to licensing, rate exportation, “true lender” theories or other matters, which could result in litigation, reputational harm, monetary liabilities or the need to modify, suspend or terminate programs. In addition, these arrangements create risks related to model performance, credit quality, data integrity, information security, business continuity and the financial condition of our partners.

29

Although our agreements typically include contractual protections, including indemnification and credit enhancement provisions, such protections may be limited in scope, subject to dispute, or insufficient to fully protect us from losses or liabilities. The termination of, or disruption in, one or more significant partner relationships, whether due to regulatory developments, performance issues or other factors, could adversely affect loan originations, servicing operations, fee income and overall financial performance. Any of these risks could have a material adverse effect on our business, financial condition and results of operations.

Unclaimed funds from deposit accounts or represented by unused value on prepaid cards present compliance and other risks.

Unclaimed funds held in deposit accounts or represented by unused balances on prepaid cards may be subject to state escheatment laws where the Bank is the actual holder of the funds and when, after a period of time as set forth in applicable state law, the rightful owner of the funds cannot be readily located and/or identified. The Bank implements controls to comply with state unclaimed property laws and regulations, however these laws and regulations are often open to interpretation, particularly when being applied to unused balances on prepaid card products. State regulators may choose to initiate collection or other litigation action against the Bank for unreported abandoned property, and such actions may seek to assess fines and penalties.

Credit Solutions Business

We are subject to lending risks.

There are risks inherent in making all loans. These risks include interest rate changes over the time period in which loans may be repaid and changes in economic conditions nationwide or in the localities in which our borrowers operate. Weak economic conditions have caused increases in our delinquent and defaulted loans in recent years. We cannot assure you that we will not experience increases in delinquencies and defaults, or that any such increases will not be material. On a consolidated basis, an increase in non-performing loans could result in an increase in our provision for credit losses or in loan charge-offs and consequent reductions in our earnings. For our commercial fleet and equipment leasing business line, while we have access to underlying collateral, the value of such collateral can be impacted by many factors including age and condition, market prices and applicable economic conditions. For closed end leases, any deficiency between the residual value of the lease and net sales price results in a loss.

The Bank seeks to mitigate the risks inherent in its loan portfolio by adhering to specific underwriting practices. These practices vary depending on the facts and circumstances of each loan and the type of loan.

Rapid excessive movements in the market value of collateral underlying our loans may not be sufficiently offset by the excess collateral, and losses could result.

Although the Bank believes that its underwriting criteria are appropriate for the various kinds of loans it makes, the Bank may incur losses on loans that meet its underwriting criteria, and these losses may exceed the amounts set aside as reserves in the Bank’s allowance for credit losses.

Should cash flow and available cash reserves prove inadequate to cover debt service on these loans, repayment will primarily depend upon the sponsor’s ability to service the debt, or the value of the property in disposition. Low occupancy or rental rates may negatively impact loan repayment.

The quantitative models we use to manage certain accounting and risk management functions may not be effective, which may cause adverse effects on our results of operations and financial condition.

We use quantitative models to help manage certain aspects of our business and to assist with certain business decisions, including estimating probable loan losses, measuring the fair value of financial instruments when reliable market prices are unavailable and estimating the effects of changing interest rates and other market measures on our financial condition and results of operations. Our modeling methodologies rely on many assumptions, historical analyses and correlations. These assumptions may be incorrect, particularly in times of market distress, and the historical correlations on which we rely may no longer be relevant. Additionally, as businesses and markets evolve, our measurements may not accurately reflect this evolution. Even if the underlying assumptions and historical correlations used in our models are adequate, our models may be deficient due to errors in computer code, bad data, misuse of data, fraud or the use of a model for a purpose outside the scope of the model’s design. We rely on models in a number of critical areas, including liquidity stress testing, interest rate sensitivity analysis, allowance for credit losses estimation and compliance

30

monitoring, and regulators increasingly expect the use of robust model governance in these areas. In addition to technical flaws, misunderstanding or misuse of model outputs could result in suboptimal decision-making, regulatory scrutiny or financial loss.

As a result, our models may not capture or fully express the risks we face, may suggest that we have sufficient capitalization when we do not, or may lead us to misjudge the business and economic environment in which we will operate. If our models fail to produce reliable results on an ongoing basis, we may not make appropriate risk management or other business or financial decisions. Furthermore, strategies that we employ to manage and govern the risks associated with our use of models may not be effective or fully reliable, and as a result, we may realize losses or other lapses.

Banking regulators continue to focus on the models used by banks and bank holding companies in their businesses. The failure or inadequacy of a model may result in increased regulatory scrutiny on us or may result in an enforcement action or proceeding against us by one of our regulators.

Agreements between the Bank and its partners to market and service Bank-originated consumer loans may subject the Bank to credit, fraud and other risks, as well as claims from regulatory agencies and our partners that, if successful, could negatively impact the Bank's current and future business.

The Bank has entered into various agreements with unaffiliated partners, whereby the partners will market and service consumer loans underwritten and originated by the Bank. These agreements present potential increased credit, operational, and reputational risks. Because some loans originated under such programs are unsecured, in the event a borrower does not repay the loan in accordance with its terms or otherwise defaults on the loan, the Bank may not be able to recover from the borrower an amount sufficient to pay any remaining balance on the loan. We may also become subject to claims by regulatory agencies, customers, or other third-parties due to the conduct of the partners with which the Bank operates such lending programs if such conduct is deemed to not comply with applicable laws in connection with the marketing and servicing of loans originated pursuant to these programs. In addition, regulatory agencies or plaintiffs might allege that the Bank’s partner is the “true lender” rather than the Bank, which could lead to enforcement actions, unfavorable interpretations under state consumer protection or usury laws, or other adverse consequences. If a regulatory agency, consumer advocate group, or other third party were to bring successful action against the Bank or any of the partners with which the Bank operates such lending programs, there could be a material adverse effect on our financial condition and results of operations.

We are exposed to credit risks specific to the population of real estate bridge loans, including risks related to the real estate collateral value and risks related to the execution of the properties’ business plan.

Real estate bridge lending (“REBL”) is $2.26 billion, or 31% of our total loan portfolio, as of December 31, 2025. When REBL loans default, we foreclose upon the real estate collateral, recognize the estimated fair value of the property in Other real estate owned (“OREO”) on our Consolidated Balance Sheets, which was $60.7 million as of December 31, 2025. REBL are transitional commercial mortgage loans, made to improve and rehabilitate existing properties, primarily multi-family apartment buildings, and there are unique risks related to this loan population resulting from several factors, including the larger size of loan balances, the dependence on the success of the property owners’ business plan, the property owners’ ability to obtain subsequent funding at the end of their loan term, risks related to the market values of the collateral real estate properties, and risks related to other real estate owned.

REBL are dependent upon the successful operation of the borrower’s business. If the operating company suffers difficulties, including reduction in occupancy and/or profitability, the borrower’s ability to repay the loan may be impaired. Loans secured by properties where repayment is dependent upon payment of rent by third-party tenants or the sale of the property may be impacted by loss of tenants, lower lease rates needed to attract new tenants or the inability to sell a completed project in a timely fashion and at a profit. A number of factors may affect a borrower’s ability to make or refinance a balloon payment at the end of the loan term, including the financial condition of the borrower, the prevailing local economic conditions, and the prevailing interest rate environment. If the borrower is delinquent or unable to repay or refinance the loan, we may record increases to our allowance based on any difference between the current market value of the property (net of costs to sell) and our carrying amount of the loan.

We are exposed to potential losses based on changes in the real estate property values underlying the REBL portfolio. While we underwrite these loans based on our required loan-to-value levels, if real estate property values decline and the estimated property value is below our current carrying amount of the loan (net of allowance), our net income could be negatively impacted from increases our allowance or impairment losses on real estate owned. While we historically have not realized charge-offs or realized losses on foreclosed properties related to REBL, there can be no assurances that we will not have significant losses in the future.

31

Maintenance expense for real estate owned properties can be significant and may not be offset by related revenues. National bank regulations permit the holding of OREO for five years, with the possibility of an additional five year holding upon regulatory approval. Depending upon market conditions at the time of sale, there can be no assurance that the carrying value will be offset by the sales price, which would result in a loss.

The success of our SBA lending program is dependent upon the continued availability of SBA loan programs, our status as a Preferred Lender under the SBA loan programs, our ability to comply with applicable SBA lending requirements and our ability to successfully manage related risks.

Our Credit Solutions operations are subject to additional risks including, with respect to our SBA loans, the risk that the U.S. government’s partial guaranty on SBA loans is withdrawn due to noncompliance with regulations. Our SBA lending program is dependent upon the federal government. As an SBA Preferred Lender, we enable our clients to obtain SBA loans without being subject to the potentially lengthy SBA approval process necessary for lenders that are not SBA Preferred Lenders. The SBA periodically reviews the lending operations of participating lenders to assess, among other things, whether the lender exhibits prudent risk management. When weaknesses are identified, the SBA may request corrective actions or impose enforcement actions, including revocation of the lender’s Preferred Lender status. If we lose our status as an SBA Preferred Lender, we may lose some or all of our customers to lenders who are SBA Preferred Lenders, which could have a material adverse effect on our financial results. Also, in the event of a loss resulting from default and a determination by the SBA that there is a deficiency in the manner in which a loan was originated, funded or serviced by us, the SBA may require us to repurchase the previously sold portion of the loan, deny its liability under the guaranty, reduce the amount of the guaranty or, if it has already paid under the guaranty, seek recovery of the principal loss related to the deficiency from us.

Additionally for a borrower to be eligible to receive an SBA loan, the lender must establish that the borrower would not be able to secure a bank loan without the credit enhancements provided by a guaranty under the SBA program. Accordingly, the SBA loans in our portfolio generally have weaker credit characteristics than the rest of our portfolio and may be at greater risk of default in the event of deterioration in economic conditions or the borrower’s financial condition. For instance, in the case of 7(a) Program loans, if businesses to which we lend generate inadequate cash flow to repay principal and interest, and borrowers are otherwise unable to repay the loan, losses may result if related collateral is sold for less than the unguaranteed balance of the loan. Because these loans are generally at variable rates, higher rate environments will increase required payments from borrowers, with increased payment default risk. As a result of a wide variety of collateral with very specific uses, markets for resale of the collateral may be limited, which could adversely affect amounts realized upon sale and therefore our financial results.

Further, any changes to the SBA program, including changes to the level of guarantee provided by the federal government on SBA loans, may also have a material adverse effect on our business. The SBA program is funded through annual appropriations approved by Congress matching funding requirements for loans approved within the budget year. Should those appropriations be reduced or cease, our ability to make SBA loans will be curtailed or terminated.

Operations

Interruptions or failures in our technology solutions, or those of our third-party service providers, could impact or interrupt our ability to service our customers, clients and partners.

Our operations depend on our ability, as well as that of our service providers, to protect our computer systems and network infrastructure against interruptions in service due to damage from fire, power loss, telecommunications failure, software or hardware defects, physical attacks, computer hacking or similar events.

Our operations also depend upon our ability to replace a third-party provider if it experiences difficulties that interrupt our operations or if an operationally essential third-party service terminates. Any damage to, or failure of, or delay in our processes or systems generally, or those of our service providers, or an improper action by our employees, agents or third-party vendors, could result in interruptions in our service. Service interruptions impacting customers may adversely affect our ability to obtain or retain customers and could result in regulatory sanctions. Moreover, if a customer were unable to access their account or complete a financial transaction due to a service interruption, we could be subject to a claim by the customer for their loss. While our accounts and other agreements contain disclaimers of liability for these kinds of losses, we cannot predict the outcome of litigation if a customer were to make a claim against us. If we face system interruptions or failures, our business interruption insurance may not be adequate to cover the losses or damages that we incur. In addition, our insurance costs may also increase substantially in the future to cover the costs our insurance carriers may incur.

32

Cybersecurity risks, including the loss of data or disruption in our operations, could result in a loss of customers, cause disclosure of confidential information, adversely affect our operations, cause reputational damage, and create significant legal and financial exposure.

Our operations are dependent upon our ability to ensure secure transmission of confidential information over public networks and other mediums, and protect the computer systems, software and networks utilized by us, and our third-party service providers, against cyber-attacks, cybersecurity breaches and other disruptive problems. We devote significant resources and management focus to ensuring the integrity of our systems through information security and business continuity programs. However, our measures, including encryption, authentication technology, firewalls, and penetration testing may not be effective and may not prevent or detect future potential losses or liabilities from system failures or breaches or cyber-attacks, cybersecurity breaches, or other disruptions.

Our computer systems, software and networks, and those of our third-party service providers may be targeted in cyberattacks, such as external or internal security breaches, hacking, acts of vandalism, computer viruses or malware, ransomware intrusion, denial-of-service attacks, data corruption attempts, or other similar events.

The systems we use rely on encryption and authentication technology to provide secure transmission of confidential information. Cyberattacks may expose security vulnerabilities in our systems or the systems of third-parties that could result in the unauthorized gathering, monitoring, misuse, release, loss, or destruction of confidential, proprietary, or sensitive information. As cyber threats continue to evolve, including as a result of artificial intelligence, we may be required to expend significant resources to modify or enhance protective measures or to investigate and remediate any information security vulnerabilities or incidents.

We seek to continuously monitor for and nimbly react to any and all such malicious cyber activity, and we develop our systems to protect our technology infrastructure and data from misuse, misappropriation or corruption.

Failures in, or breaches of, our computer systems, software and networks, or those of our third-party vendors or other service providers could disrupt our business or operations or those of our partners and clients, could result serious negative consequences including, but not limited to:

the disclosure or misuse of confidential or proprietary information;

misappropriation or exposure of our intellectual property, funds and those of our partners and clients;

damage to our reputation,

the loss of customers and business,

a loss of confidence in the security of our systems, products and services,

litigation exposure, regulatory fines, penalties, or regulatory enforcement action; and

increases to our costs and/or other financial losses

Any such consequences could adversely impact our results of operations and financial condition. In addition, we may not have adequate insurance coverage to compensate for losses from a cybersecurity event. Although we, with the help of third-party service providers, intend to continue to implement security technology and establish operational procedures to prevent system failures or security breaches, these measures may not be successful.

We are subject to risks associated with the third-parties to whom we outsource many essential services, including risks related to our agreements and oversight of their activities.

We obtain essential technological, marketing and customer services support for our systems from third-party providers. For example, we outsource our check processing, check imaging, transaction processing, electronic bill payment, statement rendering, and other services to third-party vendors.

If one or more of these key external parties were not able to perform their functions for a period of time, perform them at an acceptable service level or handle increased volumes, or if one of them experiences a disruption in its own business or technology from any cause, our business operations could be constrained, disrupted, or otherwise negatively affected. Even a temporary disruption in services could result in our losing customers, incurring liability for any damages our customers may sustain, or losing revenues. Our agreements with such third-parties may also indirectly subject us to credit risk, fraud and other risks, which could adversely impact our profitability.

33

Our agreements with each service provider are for contracted durations and generally cancelable with cause by either party upon specified notice periods. If one of our third-party service providers terminates its agreement with us and we are unable to replace it with another service provider, our operations may be interrupted. Moreover, there can be no assurance that a replacement service provider will provide its services at the same or a lower cost than the service provider it replaces.

Additionally, our regulators or auditors may require us to increase the level and manner of our oversight of these third-parties. Although we have added significant compliance staff and have used outside consultants, our internal and external compliance examiners continually evaluate our practices and must be satisfied with the results of our third-party oversight activities. We cannot assure you that we will satisfy all related requirements. Not maintaining a compliance management system which is deemed adequate could result in sanctions against the Bank. Our ongoing review and analysis of our compliance management system and implementation of any changes resulting from that review and analysis would likely result in increased non-interest expense.

The loss or transition of key members of our senior management team or key staff in the Bank's divisions, or our inability to attract and retain qualified personnel, could adversely affect our business.

The universe of management and staff for certain of our niche lending and payments businesses is significantly smaller than that for most financial institutions’ lines of business, while our businesses may also be more complex to manage. Our ability to retain and attract new professional management with sufficient experience and expertise, and successfully execute our succession plans can significantly impact our performance. If key personnel were to leave us and equally knowledgeable or skilled personnel are unavailable within the Company, or could not be sourced in the market, our ability to manage our business may be hindered or impaired.

Taxes and Accounting

Our financial statements are based in part on assumptions and estimates made by our management. Our earnings may decrease if amounts realized vary significantly from our estimates, or from updates to assumptions.

Pursuant to accounting principles generally accepted in the United States, we utilize certain assumptions and estimates in preparing our financial statements, including but not limited to, when estimating the allowance for credit losses, determining the fair values of certain assets and liabilities, and when recording accruals, reserves and other estimated realizable amounts for assets. If the assumptions or estimates underlying our financial statements are incorrect, we may experience significant losses from updates to the assumptions, or if the ultimate realization of value is materially different than the amounts reflected in our balance sheets as of any particular date.

Allowance for credit loss. We maintain an allowance for credit losses to provide for current and future expected losses inherent in our loan portfolio. Significant judgment is required to determine the appropriate level of the allowance, and our estimate is based upon currently available information. The allowance is determined by management after analyzing many factors including historical loan losses, current trends in delinquencies and charge-offs, our assessment of collection risks, plans for problem loan resolution, and the estimated value of the real estate and other assets serving as collateral. Our estimate includes relevant information from internal and external sources, including reasonable forecasts for economic conditions.

If our assumptions are incorrect or if there is a significant deterioration in economic conditions, our allowance for credit losses may not be sufficient to cover expected credit losses in our loan and lease portfolio, resulting in unanticipated losses and additions to our allowance for credit losses. Material additions to our allowance for credit losses could materially decrease our net income.

Fair value. A substantial portion of our assets are recorded at fair value or include nonrecurring fair value measurements in measuring the carrying value of assets for impairment. Assets that are measured at fair value include commercial loans at fair value, and Investment securities available for sale. Assets that include fair value measurements in determining impairment or proper carrying value include estimates related to real estate owned property, estimates of the values of collateral used in measuring the allowance for collateral-dependent receivables, and the residual value of leased vehicles and equipment.

The fair value measurements are based upon significant estimates and assumptions made by our management, based on market information where available, and based on the best information available as of the measurement date. The use of different estimates or assumptions in connection with the valuation of these assets could produce materially different fair values, or our fair value estimates may not be realized in an actual sale or settlement, either of which could have a material adverse effect on our consolidated financial position, results of operations or cash flows.

34

Other Estimates. Our financial statements include other estimates, including accruals for legal and regulatory contingencies, estimates related to tax positions, and our estimate of the recoverable amount of our receivable for the credit enhancement related to our fintech agreements. If the assumptions or estimates are subsequently proven incorrect or inaccurate, there could be a material adverse effect on our business, financial position, results of operations or cashflows.

For additional information on the key areas for which assumptions and estimates are used in preparing our financial statements, see “Part II—Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations—Critical Accounting Policies and Estimates” in this Form 10-K.

Changes in accounting policies or accounting standards, or changes in how accounting standards are interpreted or applied, could materially affect how we report our financial results and condition.

Our accounting policies are fundamental to determining and understanding our financial results and condition. From time to time, the Financial Accounting Standards Board (the "FASB") and the SEC change the financial accounting and reporting standards that govern the preparation of our financial statements. In addition, those that set accounting standards and those that interpret the accounting standards (such as the FASB, the SEC, banking regulators, and our outside auditors) may change or even reverse their previous interpretations or positions on how these standards should be applied. Changes in financial accounting and reporting standards and changes in current interpretations may be beyond our control, are difficult to predict, and could materially affect how we report our financial results and condition. We may be required to apply a new or revised standard retroactively or apply an existing standard differently and retroactively, which may result in us being required to restate prior period financial statements, which restatements may reflect material changes. Such changes could also require us to incur additional personnel and technology costs and affect our business and cost of operations.

If we fail to maintain effective internal control over financial reporting, our ability to accurately and timely report our financial results may be impacted, which could result in a loss of investor confidence and adversely impact our stock price and our business.

We are required to maintain an effective system of internal controls to provide reasonable assurance that transactions and activities are conducted in accordance with established policies and procedures and are completely and accurately reported in our financial statements. These internal control systems are subject to various inherent limitations, including cost, judgments used in decision-making, assumptions about the likelihood of future events, the soundness of our systems, the possibility of human error, and the risk of fraud. Moreover, controls may become inadequate because of changes in conditions or processes and the risk that the degree of compliance with policies or procedures may deteriorate over time. Because of these limitations, any system of internal operating controls may not be successful in preventing all errors or fraud or in making all material information known in a timely manner to the appropriate levels of management. From time-to-time, control deficiencies and losses from operational malfunctions or fraud have occurred and may occur in the future.

For example, in connection with the preparation of our Form 10-K for the year ended December 31, 2024, as amended, we identified control deficiencies related to: (i) the completion of all closing procedures prior to the filing of a required periodic report with the SEC; and (ii) the evaluation of the accounting and financial reporting associated with the credit enhancement contained within a third-party agreement and the impact on the allowance for credit losses for consumer fintech loans. As of December 31, 2024, management concluded that these control deficiencies constituted material weaknesses in our disclosure controls and procedures and internal control over financial reporting. As discussed in Part II, Item 9A. Controls and Procedures, our management has since remediated the material weakness and concluded that our internal control over financial reporting was effective as of December 31, 2025.

Control deficiencies or material weaknesses in our internal controls over financial reporting may be discovered in the future and could result in material weaknesses, cause us to fail to meet our periodic reporting obligations or result in material misstatements in our financial statements. Any such failure could also adversely affect our liquidity, our access to capital markets, the perceptions of our creditworthiness, and we may be unable to maintain compliance with applicable securities laws and the rules and listing standards of the NASDAQ. In addition, we may be subject to litigation or investigations requiring management resources and payment of legal and other expenses which may negatively impact results of operations and financial condition, could negatively affect investor confidence in the accuracy and completeness of our financial statements, and could adversely impact our stock price.

35

Ownership of Our Common Stock

The Bank’s ability to pay dividends is subject to regulatory limitations which, to the extent we require such dividends in the future, may affect our ability to pay our obligations and return capital to shareholders.

As a holding company, we are a separate legal entity from the Bank and our other subsidiaries, and we do not have significant operations of our own. We have historically depended on the Bank’s cash and liquidity, as well as its’ dividends to our corporate parent entity, to pay our operating expenses and fund any returns of capital to shareholders.

Various federal provisions limit the amount of dividends that subsidiary banks can pay to their holding companies without regulatory approval. Without the prior approval of the OCC, a dividend may not be paid if the total of all dividends declared by a bank in any calendar year is in excess of the current year’s net income combined with the retained net income of the two preceding years. Additionally, a dividend may not be paid in excess of a bank’s retained earnings. In addition to these explicit limitations, it is possible, depending upon the financial condition of the Bank and other factors, that regulatory agencies could take the position that payment of dividends by the Bank would constitute an unsafe or unsound banking practice and may, therefore, seek to prevent the Bank from paying such dividends.

Although we believe we have sufficient existing liquidity for our needs for the foreseeable future, there is risk that we may not be able to service our obligations as they become due, fund share repurchases, pay dividends on our common stock, or fulfill our trust preferred security obligations. Even if the Bank has the capacity to pay dividends, it is not obligated to pay the dividends, and its Board of Directors may determine, as it has in the past, to retain some or all of its earnings to support or increase its capital base.

We have historically returned capital to shareholders through share repurchase programs. There can be no assurances that this will continue into the future or that this is the optimal use of our capital.

During 2025, we repurchased 5.6 million shares of our Common stock for an aggregate $375.0 million through an open market repurchase program. These repurchases reduced our market capitalization and public float, which is the number of shares of our Common stock that are owned by non-affiliated stockholders and available for trading in the securities markets, which may reduce the volume of trading in our shares and result in reduced liquidity and volatility in our stock price. The market price of our Common stock has been and may continue to be volatile which may affect your ability to sell our Common stock at an advantageous price. For example, the closing market price of our Common stock on the NASDAQ Global Select Market Exchange fluctuated between $40.93 per share and $80.34 per share during 2025 and may continue to fluctuate. Market price fluctuations in our Common stock may be due to factors both within and outside of our control, including our strategic actions, industry and regulatory matters or other material public announcements, as well as a variety of additional factors including, without limitation, those set forth under these “Risk Factors” and "Cautionary Note Regarding Forward-Looking Statements."

For 2026, our Board of Directors provided a new authorization for up to $200.0 million of share repurchases. We have no obligation to repurchase shares under this authorization, and any share repurchase program may be extended, modified, suspended or discontinued at any time. Any repurchases would utilize cash that we will not be able to use in other ways, or to meet other potential demands, and may not prove to be the best use of our capital. There can be no assurance that we will repurchase any, or the full amount authorized under any share repurchase program, or that any past or future repurchases will have a positive impact on our stock price.

Anti-takeover provisions of our certificate of incorporation, bylaws and Delaware law may make it more difficult for holders of our common stock to receive a change in control premium.

Certain provisions of our certificate of incorporation and bylaws could make a merger, tender offer or proxy contest more difficult, even if such events were perceived by many of our stockholders as beneficial to their interests. These provisions include, in particular, our ability to issue shares of our common stock and preferred stock with such provisions as our Board may approve without further shareholder approval. In addition, as a Delaware corporation, we are subject to Section 203 of the Delaware General Corporation Law which, in general, prevents an interested stockholder, defined generally as a person owning 15% or more of a corporation’s outstanding voting stock, from engaging in a business combination with our company for three years following the date that person became an interested stockholder unless certain specified conditions are satisfied.

36

Our Amended and Restated Bylaws provide that certain courts in the State of Delaware or the federal district courts of the United States will be the sole and exclusive forum for substantially all disputes between us and our stockholders, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers, or employees.

Our Amended and Restated Bylaws provide that, unless we consent in writing to the selection of an alternative forum, the Court of Chancery located within the State of Delaware will be the sole and exclusive forum for any derivative action or proceeding brought on our behalf, any action asserting a claim of breach of a fiduciary duty owed by any current or former director, officer, other employee or stockholder to us or our stockholders, any action asserting a claim arising pursuant to any provision of the General Corporation Law of the State of Delaware, our certificate of incorporation or our bylaws (as either may be amended or restated) or as to which the General Corporation Law of the State of Delaware confers jurisdiction on the Court of Chancery of the State of Delaware, or any action asserting a claim governed by the internal affairs doctrine of the law of the State of Delaware. However, if the Court of Chancery within the State of Delaware lacks jurisdiction over such action, the action may be brought in the United States District Court for the District of Delaware. Additionally, unless we consent in writing to the selection of an alternative forum, the federal district courts of the United States of America shall be the exclusive forum for the resolution of any complaint asserting a cause of action arising under the Securities Act of 1933, as amended (the “Securities Act”). The exclusive forum provisions will be applicable to the fullest extent permitted by applicable law, subject to certain exceptions. Section 27 of the Exchange Act creates exclusive federal jurisdiction over all suits brought to enforce any duty or liability created by the Exchange Act or the rules and regulations thereunder. As a result, the exclusive forum provisions will not apply to suits brought to enforce any duty or liability created by the Exchange Act or any other claim for which the federal courts have exclusive jurisdiction. There is, however, uncertainty as to whether a court would enforce the exclusive forum provisions, and investors cannot waive compliance with the federal securities laws and the rules and regulations thereunder. Furthermore, Section 22 of the Securities Act creates concurrent jurisdiction for state and federal courts over all suits brought to enforce any duty or liability created by the Securities Act or the rules and regulations thereunder.