What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-02-27 compared with 2025-02-28 · 120 added, 71 removed, 350 unchanged (35% of the section changed)

10 unchanged sentences

We are operating in an uncertain economic environment.

Our business and financial performance are vulnerable to weak economic conditions in the financial markets generally and specifically in the state of Wisconsin, the principal market in which we conduct business.

Our business and financial performance are vulnerable to weak economic conditions in the financial markets generally and specifically in the states of Wisconsin and Illinois, the principal markets in which we conduct business.

A deterioration in economic conditions in the global and financial markets as well as our primary market areas caused by inflation, recession, pandemics, outbreaks of hostilities or other international or domestic occurrences, unemployment, trade policies and tariffs, plant or business closings or downsizing, changes in securities markets or other factors could result in the following consequences, any of which could materially and adversely affect our business:

3 unchanged sentences

lower demand for our products and services;

reduced low cost or noninterest-bearing deposits;

reduced low cost or noninterest-bearing deposits or increased volatility in customer deposit balances;

intangible asset impairment;

and collateral for loans made by us, especially real estate, may decline in value, in turn reducing our customers’ ability to repay outstanding loans, and reducing the value of assets and collateral associated with our existing loans.

In addition, regulatory scrutiny of the industry has increased and could continue to increase, leading to increased regulation of the industry that could lead to a higher cost of compliance, limit our ability to pursue business opportunities and increase our exposure to litigation or fines.

Additionally, all of our operating locations are within the state of Wisconsin, and a significant majority of our loans and deposits are made to borrowers or received from depositors who live and/or primarily conduct business in Wisconsin.

Additionally, all our operating locations are within the states of Wisconsin and Illinois, and a significant majority of our loans and deposits are made to borrowers or received from depositors who live and/or primarily conduct business in Wisconsin and Illinois.

Therefore, our success will depend in large part upon the general economic conditions in this area, which we cannot predict with certainty.

This geographic concentration imposes risks from lack of geographic diversification, as adverse economic developments in Wisconsin, among other things, could affect the volume of loan originations, increase the level of nonperforming assets, increase the rate of foreclosure losses on loans and reduce the value of our loans and loan servicing portfolio.

Any regional or local economic downturn that affects Wisconsin or existing or prospective borrowers or property values in such areas may affect us and our profitability more significantly and adversely than our competitors whose operations are less geographically concentrated.

Moreover, the financial markets and the global economy may also be adversely affected by the current or anticipated impact of military conflict or trade wars.

This geographic concentration imposes risks from lack of geographic diversification, as adverse economic developments in Wisconsin or Illinois, among other things, could affect the volume of loan originations, increase the level of nonperforming assets, increase the rate of foreclosure losses on loans and reduce the value of our loans and loan servicing portfolio.

Any regional or local economic downturn that affects Wisconsin or Illinois or existing or prospective borrowers or property values in such areas may affect us and our profitability more significantly and adversely than our competitors whose operations are less geographically concentrated.

In addition, the financial markets and the global economy may also be adversely affected by the current or anticipated impact of military conflict or trade wars.

Sanctions or tariffs imposed by the United States and other countries in response to such conflict could further adversely impact the financial markets and the global economy, and any economic countermeasures by the affected countries or others could exacerbate market and economic instability.

1 unchanged sentence

Net interest income, which is the difference between the interest income that we earn on interest-earning assets and the interest expense that we pay on interest-bearing liabilities, is a major component of our income and our primary source of revenue from our operations.

Narrowing of interest rate spreads could adversely affect our earnings and financial condition.

We cannot control or predict with certainty changes in interest rates.

Regional and local economic conditions, competitive pressures, and the policies of regulatory authorities, including monetary policies of the Federal Reserve Board (“FRB”), affect interest income and interest expense.

Beginning in early 2022, in response to growing signs of inflation, the FRB increased interest rates rapidly and made a number of adjustments to monetary policy and liquidity, including quantitative tightening and other balance sheet actions.

Beginning in the third quarter of 2024, the FRB began slowly decreasing interest rates, with future interest rate changes, either increases or decreases uncertain, and dependent on the Federal Reserve's assessment of economic conditions and inflation.

Narrowing interest rate spreads could adversely affect our earnings and financial condition.

We cannot control or predict changes in interest rates with certainty.

We are currently operating in an environment in which the Federal Reserve has shifted toward reducing interest rates, although modestly, with cuts implemented in September, October and December 2025, with future interest rate changes, either increases or decreases uncertain, and dependent on the Federal Reserve's assessment of economic conditions and inflation.

Further, the FRB has increased the benchmark rapidly and has announced an intention to take further actions to mitigate rising inflationary pressures.

Rising interest rates can have a negative impact on our business by reducing the amount of money our clients borrow or by adversely affecting their ability to repay outstanding loan balances that may increase due to adjustments in their variable rates.

In addition, as interest rates rise, we may have to offer more attractive interest rates to depositors to compete for deposits, or pursue other sources of liquidity, such as wholesale funds.

In addition, as interest rates rise, we may have to offer more attractive interest rates to depositors to compete for deposits, or pursue other sources of liquidity, such as wholesale funds, and may experience changes in the market value of our interest-earnings assets, including our investment securities portfolio.

On the other hand, decreasing interest rates reduce our yield on our variable rate loans and on our new loans, which reduces our net interest income.

In addition, lower interest rates may reduce our realized yields on investment securities which would reduce our net interest income and cause downward pressure on net interest margin in future periods.

A significant reduction in our net interest income could have a material adverse impact on our capital, financial condition and results of operations.

A significant reduction in our net interest income could have a material adverse impact on our capital, financial

condition and results of operations.

We are unable to predict changes in interest rates, which are affected by factors beyond our control, including inflation, deflation, recession, unemployment, money supply, and other changes in financial markets.

8 unchanged sentences

Conversely, these assets generally increase in value in a rising interest rate environment to the extent that prepayments are slower than previously estimated.

An increase in the size of our mortgage servicing rights portfolio may increase our interest rate risk.

An increase in the size of our mortgage servicing rights portfolio may increase our interest rate risk and may result in increased volatility in reported earnings due to non-cash fair value adjustments.

Depending on the interest rate environment, it is possible that the fair value of our mortgage servicing rights may be reduced in the future.

4 unchanged sentences

Additionally, inflation may lead to a decrease in consumer and clients’ purchasing power and negatively affect the need or demand for our products and services.

If significant inflation continues, our business could be negatively affected by, among other things, increased default rates leading to credit losses which could decrease our appetite for new credit

If significant inflation continues, our business could be negatively affected by, among other things, increased default rates leading to credit losses which could decrease our appetite for new credit extensions.

Inflationary pressures may also adversely affect the valuation of certain balance sheet assets.

These inflationary pressures could result in missed earnings and budgetary projections causing our stock price to suffer.

5 unchanged sentences

Also, we compete for funding with other banks and similar companies, many of which are substantially larger, and have more capital and other resources.

In addition to bank level liquidity management, we must manage liquidity at holding company for various needs including potential capital infusions into subsidiaries, the servicing of debt, the payment of dividends on our common stock, and share repurchases.

The primary source of liquidity for us consists of dividends from the Bank which are governed by certain rules and regulations of our supervising agencies.

1 unchanged sentence

If Bank First does not receive dividends from the Bank as needed, its liquidity could be adversely affected, and it may not be able to continue to execute its current capital plan to return capital to its shareholders.

In addition to dividends from the Bank, we have historically had access to a number of alternative sources of liquidity, including the capital markets, but there is no assurance that we will be able to obtain such liquidity on terms that are favorable to us, or at all.

If our access to these traditional and alternative sources of liquidity is diminished or only available on unfavorable terms, then our overall liquidity and financial condition will be adversely affected.

6 unchanged sentences

This could result in a failure to maintain adequate liquidity and higher funding costs, reducing our net interest margin and net interest income.

In addition, our access to deposits may be affected by the liquidity needs of our depositors.

In addition, our access to deposits may be affected by the liquidity needs of our depositors and by changes in customer confidence, market sentiment or perceptions regarding the financial services industry.

In particular, a substantial majority of our liabilities in 2025 were checking accounts and other liquid deposits, which are payable on demand or upon several days' notice, while by comparison, a substantial majority of our assets were loans, which cannot be called or sold in the same time frame.

Moreover, our clients could withdraw their deposits in favor of alternative investments.

Moreover, our clients could withdraw their deposits in favor of alternative investments or non-bank financial products.

While we have historically been able to replace maturing deposits and advances as necessary, we may not be able to replace such funds in the future, especially if a large number of our depositors seek to withdraw their accounts, regardless of the reason.

7 unchanged sentences

Any increases in the provision or allowance for credit losses will result in a decrease in our net income and, potentially, capital, and may have a material adverse effect on our financial condition or results of operations.

In addition, we expect that the allowance for credit losses under the CECL standard to be more volatile and as such could have an impact on our results of operations.

In addition, we expect that the allowance for credit losses under the CECL standard to be more volatile and sensitive to changes in economic conditions, portfolio composition, and model assumptions, and as such could have an impact on our results of operations.

For a discussion of changes in accounting standards and regulatory capital implications, see “Business—Supervision and Regulation—Capital Requirements.”

1 unchanged sentence

Making any loan involves various risks, including risks inherent in dealing with individual borrowers, risks of nonpayment, risks resulting from uncertainties as to the future value of collateral and cash flows available to service debt, and risks resulting from changes in economic and market conditions.

Our credit risk approval and monitoring procedures may fail to identify or reduce these credit risks, as some of these risks are outside of our control, and they cannot completely eliminate all credit risks related to our loan portfolio.

If the overall economic climate, including employment rates, real estate markets, interest rates and general economic growth, in the United States, generally, or Wisconsin, specifically, experiences material disruption, our borrowers may experience difficulties in repaying their loans, the collateral we hold may decrease in value or become illiquid, and the levels of nonperforming loans, charge-offs and delinquencies could rise and require additional provisions for credit losses, which would cause our net income and return on equity to decrease.

Our credit risk approval and monitoring procedures may fail to

identify or reduce these credit risks, as some of these risks are outside of our control, and they cannot completely eliminate all credit risks related to our loan portfolio.

Changes in the composition, growth or concentration of our loan portfolio may also increase our exposure to credit risk.

If the overall economic climate, including employment rates, real estate markets, interest rates and general economic growth, in the United States, generally, or Wisconsin or Illinois specifically, experiences material disruption, our borrowers may experience difficulties in repaying their loans, the collateral we hold may decrease in value or become illiquid, and the levels of nonperforming loans, charge-offs and delinquencies could rise and require additional provisions for credit losses, which would cause our net income and return on equity to decrease.

The future effects of the continued elevated inflationary and interest rate environment on economic activity could negatively affect the collateral values associated with our existing loans, the ability to liquidate the real estate collateral securing our residential and commercial real estate loans, our ability to maintain loan origination volume and to obtain additional financing, the future demand for or profitability of our lending and services, and the financial condition and credit risk of our customers.

1 unchanged sentence

If borrowers fail to repay their loans, our financial condition and results of operations would be adversely affected.

Additionally, potential future actions such as the proposed consumer credit card interest rate cap may lead to unprofitable products, especially for riskier borrowers, and could lead to cutting credit lines or eliminating cards, increased reliance on fees and increased debt burdens for those needing credit most, thereby having the potential to negatively impact bank asset quality.

We face strong competition from financial services companies and other companies that offer banking services.

We conduct our banking operations primarily in Wisconsin.

We conduct our banking operations primarily in Wisconsin and Illinois.

Many of our competitors offer the same, or a wider variety of, banking services within our market areas, and we compete with them for the same customers.

5 unchanged sentences

We compete with many forms of payments offered by both bank and non-bank providers, including a variety of new and evolving alternative payment mechanisms, systems and products, such as aggregators and web-based and wireless payment platforms or technologies, digital or “crypto” currencies, prepaid systems and payment services targeting users of social networks, communications platforms and online gaming.

Our future success may depend, in part, on our ability to use technology competitively to offer products and services

that provide convenience to customers and create additional efficiencies in our operations.

Competition is increasingly focused on digital capabilities, customer experience, speed, and convenience, and failure to meet evolving customer expectations may adversely affect our competitive position.

Our future success may depend, in part, on our ability to use technology competitively to offer products and services that provide convenience to customers and create additional efficiencies in our operations.

In addition, some competitors may offer banking and payment services through embedded or platform-based models that reduce the need for customers to maintain traditional banking relationships.

If we are unable to attract and retain banking clients, we may be unable to continue to grow our loan and deposit portfolios, and our business, financial condition and results of operations may be adversely affected.

2 unchanged sentences

The impact of the existing regulatory framework and any future changes to it could negatively affect our ability to compete with these institutions, which could have a material adverse effect on our results of operations and prospects.

Further, as a result of the GENIUS Act, passed in 2025 to provide a regulatory framework for stablecoins in the U.S., increased competition may emerge from issuers of stablecoins and providers of related technology.

Because a significant portion of our loan portfolio is comprised of real estate loans, negative changes in the economy affecting real estate values and liquidity could impair the value of collateral securing our real estate loans and result in loan and other losses.

6 unchanged sentences

Collateral may have to be sold for less than the outstanding balance of the loan, which could result in losses on such loans.

In addition, declines in real estate or disruptions in credit markets could impair borrowers’ ability to refinance or extend loans at maturity, increasing the risk of default or loss.

Such declines and losses could have a material adverse impact on our business, results of operations and growth prospects.

Certain real estate sectors or property types may be more adversely affected by economic downturns, changes in interest rates, or shifts in market demand, which could further increase credit risk.

If real estate values decline, it is also more likely that we would be required to increase our ACL-Loans, which could adversely affect our financial condition, results of operations and cash flows.

Our future success is largely dependent upon our ability to successfully execute our business strategy.

Our future success, including our ability to achieve our growth and profitability goals, is dependent on the ability of our management team to execute on our long-term business strategy, which requires them to, among other things:

maintain and enhance our reputation;

16 unchanged sentences

Furthermore, our strategic initiatives may result in an increase in expense, divert management attention, take away from other opportunities that may have proved more successful, negatively impact operational effectiveness or impact employee morale.

Pursuing multiple strategic initiatives simultaneously, including acquisitions, technology investments or geographic expansion, may place additional strain on management, personnel, systems, and controls.

Additionally, there can be no assurance that we will ultimately realize the anticipated benefits of these strategic initiatives, or that these strategic initiatives will positively impact our organization.

We depend on our executive officers and other key individuals to continue the implementation of our long-term business strategy and could be harmed by the loss of their services and our inability to make up for such loss with qualified replacements.

We believe that our continued growth and future success will depend in large part on the skills of our management team and our ability to motivate and retain these individuals and other key individuals.

The loss of any of their service could reduce our ability to successfully implement our long-term business strategy, our business could suffer and the value of our common stock could be materially adversely affected.

banking and financial services professionals.

The loss of any of their service could reduce our ability to successfully implement our long-term business strategy, disrupt key client or business relationships, or result in a loss of institutional knowledge, our business could suffer and the value of our common stock could be materially adversely affected.

There can be no assurance that we would be able to identify and retain qualified replacements on a timely basis or on terms acceptable to us.

The success of our operating model depends on our ability to attract and retain talented bankers and associates in each of our markets.

7 unchanged sentences

While we continue to focus on organic growth opportunities, we may pursue attractive bank or non-bank acquisition and consolidation opportunities that arise in our core markets and beyond.

The number of financial institutions headquartered in Wisconsin, the Midwest United States, and across the country continues to decline through merger and other consolidation activity.

The number of financial institutions headquartered in Wisconsin, Illinois the Midwest United States, and across the country continues to decline through merger and other consolidation activity.

In the event that attractive acquisition opportunities arise, we would likely face competition for such acquisitions from other banking and financial companies, many of which have significantly greater resources and may have more attractive valuations.

This competition could either prevent us from being able to complete attractive acquisition opportunities or increase prices for potential acquisitions which could reduce our potential returns and reduce the attractiveness of these opportunities.

In addition, the completion of acquisitions is subject to regulatory approvals, which may be delayed, conditioned or denied, and regulatory conditions may reduce the anticipated benefits of a transaction.

Furthermore, our pursuit of acquisitions may disrupt our business, and any equity that we issue as merger consideration may have the effect of diluting the value of your investment.

14 unchanged sentences

significant problems related to the conversion of the financial and customer data of the entity;

integration of acquired customers into our financial and customer product

integration of acquired customers into our financial and customer product systems;

potential changes in banking or tax laws or regulations that may affect the target company;

2 unchanged sentences

As with any merger of financial institutions, there also may be business disruptions that cause us to lose customers or cause customers to move their business to other financial institutions.

Pursuing acquisitions concurrently with other strategic initiatives may place additional strain on management, personnel, systems

and controls.

Failure to successfully integrate businesses that we acquire could have an adverse effect on our profitability, return on equity, return on assets, or our ability to implement our strategy, any of which in turn could have a material adverse effect on our business, financial condition, and results of operations.

The implementation of new lines of business or new products and services may subject us to additional risk.

We continuously evaluate our service offerings and may implement new lines of business or offer new products and

services within existing lines of business in the future.

There are substantial risks and uncertainties associated with these

In developing and marketing new lines of business and/or new products and services, we undergo a process to

assess the risks of the initiative, and invest considerable time and resources to build internal controls, policies and

procedures to mitigate those risks, including hiring experienced management to oversee the implementation of the

New initiatives may also require enhancements to our technology systems, data management processes, or

operational infrastructure, and delays or deficiencies in these areas could hinder successful implementation or increase

operational risk.

Initial timetables for the introduction and development of new lines of business and/or new products or

services may not be achieved, and price and profitability targets may not prove feasible.

External factors, such as

compliance with regulations, competitive alternatives, and shifting market preferences, may also impact the successful

implementation of a new line of business and/or a new product or service.

Furthermore, any new line of business and/or

new product or service could require the establishment of new key and other controls and have a significant impact on our

existing system of internal controls.

Failure to successfully manage these risks in the development and implementation of

new lines of business and/or new products or services could have a material adverse effect on our business and, in turn,

our financial condition and results of operations.

The fair value of our investment securities may decline.

11 unchanged sentences

Accordingly, we may not be able to effectively implement new technology-driven products and services or be successful in marketing such products and services to our clients, which could impair our growth and profitability.

We also rely in part on third-party vendors and service providers for certain technology solutions, and any failure or disruption involving these vendors could further limit our ability to compete effectively.

In addition, some of our competitors are subject to less regulation and/or more favorable tax treatment, which may put us at a competitive disadvantage.

3 unchanged sentences

We may not be able to successfully implement and integrate such system enhancements and initiatives, which could adversely impact our ability to comply with a number of legal and regulatory requirements, which could result in sanctions from regulatory authorities.

Systems conversions or enhancements may also result in data inaccuracies, service disruptions, or other operational issues that could negatively affect our customers or internal processes.

In addition, these projects could have higher than expected costs and/or result in operating inefficiencies, which could increase the costs associated with the implementation as well as ongoing operations.

Failure to properly utilize system enhancements that are implemented in the future could result in impairment charges that adversely impact our financial condition and results of operations, could result in significant costs to remediate or replace the defective components, and could impact our ability to compete.

In addition, we may incur significant training, licensing, maintenance, consulting, and amortization expense during and after implementation, and any such costs may

continue for an extended period of time.

In addition, we may incur significant training, licensing, maintenance, consulting, and amortization expense during and after implementation, and any such costs may continue for an extended period of time.

As such, we cannot guarantee that the anticipated long-term benefits of these system enhancements and operational initiatives will be realized.

We rely extensively on information technology systems to operate our business and an interruption or security breach may disrupt our business operations, result in reputational harm, and have an adverse effect on our operations.

We rely extensively on information technology systems to operate our business and an interruption or security incident may disrupt our business operations, result in reputational harm, and have an adverse effect on our operations.

As a complex financial institution, we rely extensively on our information technology systems to operate our business, including to process, record, and monitor a large number of client transactions on a continuous basis.

7 unchanged sentences

and, as described below, cyber-attacks.

While we have policies, procedures, and systems designed to prevent or limit the effect of possible failures, interruptions, or breaches in security of information systems and business continuity programs designed to provide services in the case of such events, there is no guarantee that these safeguards or programs will address all of the threats that continue to evolve.

While we have policies, procedures, and systems designed to prevent or limit the effect of possible failures, interruptions, or compromises in the security of information systems and business continuity programs designed to provide services in the case of such events, there is no guarantee that these safeguards or programs will address all of the threats that continue to evolve.

The development and use of artificial intelligence (AI) presents risks and challenges that may adversely impact our business.

2 unchanged sentences

The legal and regulatory environment relating to AI is uncertain and rapidly evolving, both in the U.S.

and internationally, and includes regulatory schemes targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment, and other laws applicable to the use of AI.

and internationally, and includes regulatory schemes targeted specifically at AI as well as provisions in intellectual property, privacy, security, consumer protection, employment, and other laws applicable to the use of AI.

These evolving laws and regulations could require changes in the Company’s implementation of AI technology and increase the Company’s compliance costs and the risk of non-compliance.

2 unchanged sentences

This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output, eliminating bias, and complying with regulations that require documentation or explanation of the basis on which decisions are made.

Further, the Company may rely on AI models developed by third parties, and, to that extent, would be dependent in part on the manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which the Company may have limited visibility.

Further, the Company may rely on AI models developed by third parties, and, to that extent, would be dependent in part on the

manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which the Company may have limited visibility.

Any of these risks could expose the Company to liability or adverse legal or regulatory consequences and harm the Company’s reputation and the public perception of its business or the effectiveness of its security measures.

System failure or breaches of our network security, or the security of our third-party data processing partner, including as a result of cyberattacks, could subject us to increased operating costs as well as litigation and other liabilities.

Negative public perception or loss of customer trust arising from the actual or perceived misuse or failure of AI technologies could adversely affect the Company’s relationships with customers or other stakeholders.

System failure or compromises of our network security, or the security of our third-party data processing partner, including as a result of cyberattacks, could subject us to increased operating costs as well as litigation and other liabilities.

The computer systems and network infrastructure we use, including those we maintain with our service providers and vendors may be vulnerable to physical theft, fire, power loss, telecommunications failure or a similar catastrophic event, as well as cyberattacks, including through, for example, phishing attempts, brute force attacks, denial of service attacks, viruses or other malicious code, exploiting software vulnerabilities (including “zero-day attacks”), ransomware or other malware and supply chain attacks, and other disruptive problems caused by criminal threat actors.

Any damage or failure that causes breakdowns or disruptions in our client relationship management, general ledger, deposit, loan and other systems could

damage our reputation, result in a loss of client business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on us.

Any damage or failure that causes breakdowns or disruptions in our client relationship management, general ledger, deposit, loan and other systems could damage our reputation, result in a loss of client business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on us.

Cyberattacks and other technology disruptions could also jeopardize the security of information stored in and transmitted through our computer systems and network infrastructure, and those we maintain with our services providers and vendors.

Information security risks have generally increased in recent years in part because of the proliferation of new technologies, the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, activists, and other external parties.

Information security risks have generally increased in recent years in part because of the proliferation of new technologies, including artificial intelligence, the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, activists, and other external parties.

Our operations rely on the secure processing, transmission and storage of confidential information in our computer systems and networks.

Although we believe we have appropriate information security procedures and controls in place, our technologies, systems, networks, and our clients’ devices may become the target of cyberattacks that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of our or our clients’ confidential, proprietary and other information, or otherwise disrupt our or our clients’ business operations.

Although we believe we have appropriate information security procedures and controls in place, our technologies, systems, networks, devices, and our clients’ devices may become the target of cyberattacks that could result in the unauthorized access, release, gathering, monitoring, misuse, loss or destruction of our or our clients’ confidential, proprietary and other information, or otherwise disrupt our or our clients’ business operations.

As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities.

1 unchanged sentence

We are under continuous threat of loss due to hacking and cyberattacks especially as we continue to expand client capabilities to utilize internet and other remote channels to transact business.

While we are not aware of any material cybersecurity incidents on our computer or other information technology systems, there can be no assurance that we will not be the victim of successful cyberattacks in the future that could cause us to suffer material losses.

While we are not aware of any actual or reasonably likely material cybersecurity incidents on our computer or other information technology systems, there can be no assurance that we will not be the victim of successful cyberattacks in the future that could cause us to suffer material losses.

The occurrence of any cyberattack could result in potential liability to clients, reputational damage, disclosure obligations, the disruption of our operations, and regulatory concerns, all of which could adversely affect our business, financial condition or results of operations.

6 unchanged sentences

If our internal controls fail to prevent or detect an occurrence, or if any resulting loss is not insured or exceeds applicable insurance limits, it could have a material adverse effect on our business, financial condition and results of operations.

In addition, we rely heavily upon information supplied by third parties, including the information contained in credit applications, property appraisals, title information, equipment pricing and valuation and employment and income documentation, in deciding which loans we will originate, as well as the terms of those loans.

In addition, we rely heavily upon information supplied by third parties, including the information contained in credit applications, property appraisals, title information, equipment

pricing and valuation and employment and income documentation, in deciding which loans we will originate, as well as the terms of those loans.

If any of the information upon which we rely is misrepresented, either fraudulently or inadvertently, and the misrepresentation is not detected prior to asset funding, the value of the asset may be significantly lower than expected, or we may fund a loan that we would not have funded or on terms we would not have extended.

5 unchanged sentences

In addition to cybersecurity risks, new techniques have made it easier for bad actors to obtain and use client personal information, mimic signatures, and otherwise create false documents that look genuine.

Fraud schemes are broad

and can include debit card/credit card fraud, check fraud, NSF fraud, mechanical devices attached to ATM machines, social engineering and phishing attacks to obtain personal information, impersonation of our clients through the use of falsified or stolen credentials, employee fraud, information fraud, and other malfeasance.

Fraud schemes are broad and can include debit card/credit card fraud, check fraud, NSF fraud, mechanical devices attached to ATM machines, social engineering and phishing attacks to obtain personal information, impersonation of our clients through the use of falsified or stolen credentials, employee fraud, information fraud, and other malfeasance.

Criminals are turning to new sources to steal personally-identifiable information in order to impersonate our clients to commit fraud.

Fraudulent activity may also originate outside of our systems, including through merchants, payment networks, counterparties or third-party service providers, which may limit our ability to prevent or detect such activity.

Our anti-fraud actions are both preventative (anticipating lines of attack, educating employees and clients, making operational changes) and responsive (remediating actual attacks).

4 unchanged sentences

If our risk management framework proves ineffective, we could suffer unexpected losses, we may have to expend resources detecting and correcting the failure in our systems, and we may be subject to potential claims from third parties and government agencies.

In certain circumstances, we may also face legal, regulatory or reputational pressure to reimburse customers for fraud losses, even where we are not legally obligated to do so.

We may also suffer reputational damage.

4 unchanged sentences

Our enterprise risk management framework seeks to achieve an appropriate balance between risk and return, which is critical to optimizing shareholder value.

We have established processes and procedures intended to identify, measure, monitor, report, and analyze the types of risk to which we are subject, including strategic, market, credit, liquidity, capital, cybersecurity, operational, regulatory compliance, litigation, and reputational.

However, as with any risk management framework, there are inherent limitations to our risk management strategies as there may exist, or develop in the future, risks that we have not appropriately anticipated or identified.

5 unchanged sentences

This is done, in part, by recruiting, hiring, and retaining and providing growth opportunities for employees who share our core values of being an integral part of the communities we serve, delivering superior service to our clients, caring about our clients and employees, and investing in our information technology and other systems.

If our reputation is negatively affected by the actions of our employees or otherwise, including as a result of operational errors, clerical or record-keeping errors, or those resulting from faulty or disabled computer or telecommunications systems or a successful cyberattack against us or other unauthorized release or loss of client information, our reputation, business, and our operating results may be materially adversely affected.

If our reputation is negatively affected by the actions of our employees or otherwise, including as a result of

operational errors, clerical or record-keeping errors, or those resulting from faulty or disabled computer or telecommunications systems or a successful cyberattack against us or other unauthorized release or loss of client information, or by the actions or failures of third-party service providers or business partners, our reputation, business, and our operating results may be materially adversely affected.

Damage to our reputation could also negatively impact our credit ratings and impede our access to the capital markets.

In addition, negative publicity or adverse public perception, whether or not factually accurate, may spread rapidly and be difficult to remediate, which could further exacerbate reputational harm.

We rely on other companies to provide key components of our business infrastructure.

2 unchanged sentences

While we have ongoing programs to review third party vendors and assess risk, we do not control their actions.

Any problems caused by these third parties, including those resulting from disruptions in communication services provided by a vendor, issues at a third-party vendor of a vendor, failure of a vendor to handle current or higher volumes, cyber-attacks and security breaches at a vendor, failure of a vendor to provide services for any reason, or poor performance of services, could adversely affect our ability to deliver products and

services to our clients and otherwise conduct our business.

Financial or operational difficulties of a third-party vendor could also hurt our operations if those difficulties interfere with the vendor's ability to serve us.

14 unchanged sentences

Most recently there has been an increase in class action lawsuits filed claiming deceptive practices or violations of account terms in connection with non-sufficient fees or overdraft charges and violations of the Fair Labor Standards Act (FLSA).

We may also be subject to regulatory investigations, examinations or enforcement actions that could result in fines, penalties, customer remediation requirements, or other supervisory actions.

We manage these risks through internal controls, personnel training, insurance, litigation management, our compliance and ethics processes, and other means.

21 unchanged sentences

Failure to comply with laws, regulations or policies could result in sanctions by regulatory agencies, civil money penalties and/or reputation damage, which could have a material adverse effect on our business, financial condition and results of operations.

In addition, the potential erosion of Federal Reserve independence could negatively impact financial markets and impact our profitability.

While the Company has policies and procedures designed to prevent any such violations, there can be no assurance that such violations will not occur.

2 unchanged sentences

Federal regulatory agencies, including the Federal Reserve and the OCC, periodically conduct examinations of our business, including our compliance with laws and regulations.

If, as a result of an examination, an agency was to determine that the financial, capital resources, asset quality, earnings prospects, management, liquidity, or other aspects of any of our operations had become unsatisfactory, or violates any law or regulation, such agency may take certain remedial or enforcement actions it deems appropriate to correct any deficiency.

If, as a result of an examination, an agency was to determine whether the financial, capital resources, asset quality, earnings prospects, management, liquidity, or other aspects of any of our operations had become unsatisfactory, or violates any law or regulation, such agency may take certain remedial or enforcement actions it deems appropriate to correct any deficiency.

Remedial or enforcement actions include the power to enjoin “unsafe or unsound” practices, to require affirmative actions to correct any conditions resulting from any violation or practice, to issue an administrative order that can be judicially enforced against a bank, to direct an increase in the bank’s capital, to restrict the bank’s growth, to assess civil monetary penalties against a bank’s officers or directors, and to remove officers and directors.

The CFPB also has authority to take enforcement actions, including cease-and-desist orders or civil monetary penalties, if it finds that we offer consumer financial products and services in violation of federal consumer financial protection laws.

The CFPB also has authority to take enforcement actions, including cease-and-desist orders or civil

monetary penalties, if it finds that we offer consumer financial products and services in violation of federal consumer financial protection laws.

If we were unable to comply with future regulatory directives, or if we were unable to comply with the terms of any future supervisory requirements to which we may become subject, then we could become subject to a variety of supervisory actions and orders, including cease-and-desist orders, prompt corrective actions, memoranda of understanding and other regulatory enforcement actions.

3 unchanged sentences

The terms of any supervisory action and associated consequences with any failure to comply with any supervisory action could have a material negative effect on our business, operating flexibility and overall financial condition.

Further, bank failures, such as the ones occurring in 2023, have and may in the future diminish public confidence in small and regional banks’ abilities to safeguard deposits in excess of federally insured limits, which could prompt customers to maintain their deposits with larger financial institutions.

Further, bank failures have and may in the future diminish public confidence in small and regional banks’ abilities to safeguard deposits in excess of federally insured limits, which could prompt customers to maintain their deposits with larger financial institutions.

Concerns over rapid, large-scale deposit movement have and could in the future heighten regulatory scrutiny surrounding liquidity and increase competition for deposits and the resulting cost of funding, which could create pressure on net interest margin and results of operations.

In addition, bank failures have and could in the future prompt the FDIC to increase deposit insurance costs.

Increases in funding, deposit insurance or other

costs as a result of these types of events have and could in the future materially adversely affect our financial condition and results of operations.

Increases in funding, deposit insurance or other costs as a result of these types of events have and could in the future materially adversely affect our financial condition and results of operations.

Further, the disruption following these types of events have and could in the future generate significant market trading volatility among publicly traded bank holding companies and, in particular, regional banks like the Company.

16 unchanged sentences

A capital injection may be required at times when we do not have the resources to provide it, and therefore we may be required to borrow the funds.

In the event of a bank holding company’s bankruptcy, the bankruptcy trustee will assume any commitment by the holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank.

In the event of a bank holding company’s bankruptcy, the bankruptcy trustee will assume any commitment by the holding company to a federal bank regulatory agency to maintain

the capital of a subsidiary bank.

Moreover, bankruptcy law provides that claims based on any such commitment will be entitled to a priority of payment over the claims of the holding company’s general unsecured creditors, including the holders of its note obligations.

Thus, any borrowing that must be done by the holding company in order to make the required capital injection becomes more difficult and expensive and will adversely impact the holding company’s cash flows, financial condition, results of operations and prospects.

Regulatory authorities have broad discretion in enforcing “source of strength” obligations, and any borrowing that must be done by the holding company in order to make the required capital injection becomes more difficult and expensive and will adversely impact the holding company’s cash flows, financial condition, results of operations and prospects.

The Company may be subject to more stringent capital requirements.

2 unchanged sentences

If the Bank fails to meet these minimum capital guidelines and other regulatory requirements, our financial condition would be materially and adversely affected.

We may also be required to satisfy additional capital

adequacy standards as determined by the Federal Reserve.

We may also be required to satisfy additional capital adequacy standards as determined by the Federal Reserve.

These requirements, and any other new regulations, could adversely affect our ability to pay dividends, or could require us to reduce business levels or to raise capital, including in ways that may adversely affect our financial condition or results of operations.

7 unchanged sentences

The monetary policies and regulations of the Federal Reserve have had a significant effect on the operating results of commercial banks in the past and are expected to continue to do so in the future.

Rapid, significant or unexpected changes in Federal Reserve policy may increase interest rate volatility and make it more difficult to manage our business and plan for future growth.

The effects of such policies upon our business, financial condition and results of operations cannot be predicted.

ESG, anti-ESG, DEI, and anti-DEI risks could adversely affect our reputation and shareholder, employee, client and third-party relationships and may negatively affect our stock price .

Our business faces increasing public scrutiny related to ESG and DEI activities.

We risk damage to our brand and reputation if we fail to act responsibly in a number of areas, such as diversity, equity, inclusion, environmental stewardship, human capital management, support for our local communities, corporate governance and transparency, or fail to consider ESG factors in our business operations.

Furthermore, as a result of our diverse base of clients and business partners, we may face potential negative publicity based on the identity of our clients or business partners and the public’s (or certain segments of the public’s) view of those entities.

Such publicity may arise from traditional media sources or from social media and may increase rapidly in size and scope.

If our client or business partner relationships were to become intertwined in such negative publicity, our ability to attract and retain clients, business partners, and employees may be negatively impacted, and our stock price may also be negatively impacted.

Additionally, we may face pressure to not do business in certain industries that are viewed as harmful to the environment or are otherwise negatively perceived, which could impact our growth.

Additionally, investors and shareholder advocates are placing ever increasing emphasis on how corporations address ESG issues in their business strategy when making investment decisions and when developing their investment theses and proxy recommendations.

In response to ESG developments (including, in particular DEI initiatives), there are increasing instances of “anti-ESG” legislation and anti-DEI executive orders, adverse media coverage, regulation, and litigation that could have unintended impacts on ordinary banking operations and increase litigation or reputational risk related to actions we choose to take and impact the results of our operations.

We may incur meaningful costs with respect to our ESG efforts and if such efforts are negatively perceived, our reputation and stock price may suffer.

Our deposit insurance premiums could be substantially higher in the future, which could have a material adverse effect on our future earnings.

3 unchanged sentences

We are generally unable to control the amount of premiums that we are required to pay for FDIC insurance.

The FDIC may also impose special assessments, increase assessment rates, or require prepayments from insured institutions from time to time.

Any future additional assessments, increases or required prepayments in FDIC insurance premiums could reduce our profitability, may limit our ability to pursue certain business opportunities or otherwise negatively impact our operations.

3 unchanged sentences

Private parties may also have the ability to challenge an institution’s performance under fair lending laws in private class action litigation.

A successful challenge to our performance under the fair lending laws and regulations could adversely impact our rating under the Community Reinvestment Act and result in a wide variety of sanctions, including the required payment of damages and civil money penalties, injunctive relief, imposition of restrictions on merger and acquisition activity and restrictions on expansion activity, which could negatively impact our reputation, business, financial condition and results of operations.

We could face a risk of noncompliance and enforcement action with the Bank Secrecy Act and other anti-money laundering statutes and regulations.

A successful challenge to our performance under the fair lending laws and regulations could adversely impact our rating under the Community Reinvestment Act and result in a wide variety of sanctions, including the required payment of damages and civil money penalties, injunctive relief, costly remediation or monitoring requirements, imposition of restrictions on merger and

acquisition activity and restrictions on expansion activity, which could negatively impact our reputation, business, financial condition and results of operations.

We could face the risk of noncompliance and enforcement action with the Bank Secrecy Act and other anti-money laundering statutes and regulations.

The Bank Secrecy Act of 1970, the USA PATRIOT Act and other laws and regulations require financial institutions, among other duties, to institute and maintain effective anti-money laundering programs and file suspicious activity and currency transaction reports as appropriate.

7 unchanged sentences

See “Business-Supervision and Regulation.”

Tax law changes and interpretations may have a negative impact on our earnings.

Recently enacted tax legislation, including the 2017 Tax Cuts and Jobs Act and the 2025 One Big Beautiful Bill Act, has

significantly affected us, our customers, and the U.S.

economy, and may continue to do so.

These laws modify or extend

prior tax provisions and accelerate the phase-out of certain incentives under the Inflation Reduction Act of 2022.

legislative, administrative, or judicial tax changes could also alter the tax treatment of corporations in ways that negatively

impact us directly or indirectly through effects on our customers.

Although lower tax rates may provide some benefit, the

extent of any advantage will depend on competitive and market factors.

In addition, tax authorities have become more

aggressive in challenging tax positions taken by financial institutions.

If tax authorities disagree with our interpretations or

tax planning strategies, we could face additional taxes, interest, penalties, or be required to modify our business practices,

any of which could materially adversely affect our business, financial condition, or results of operations.

Risks related to our common stock

10 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors