What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2025-03-07 compared with 2024-03-01 · 72 added, 68 removed, 519 unchanged (21% of the section changed)

33 unchanged sentences

(v) the acquisition of Smith Shellnut Wilson, LLC, which operates out of the Jackson, Mississippi area, on April 1, 2021;

and (vi) the acquisition of Texas Citizens Bancorp, Inc., which operates in Houston, on March 1, 2022, the last two of which are described in further detail below.

(vi) the acquisition of Texas Citizens Bancorp, Inc., which operates in Houston, Texas, on March 1, 2022;

(vii) the acquisition of Waterstone LSP, LLC, which operates in Katy, Texas, on January 31, 2024;

and (viii) the acquisition of Oakwood Bancshares, Inc., which operates in the Dallas, Texas area, on October 1, 2024, the last two of which are described in further detail below.

We will carefully consider acquisition opportunities that we believe are consistent with our strategic vision and provide attractive risk-adjusted returns to our shareholders.

Recent Acquisition Activity

Smith Shellnut Wilson, LLC ( “ SSW ” ).

On March 22, 2021, we, through b1BANK, entered into a definitive agreement to acquire SSW, a registered investment advisor with approximately $3.5 billion in assets under management, specializing in managing investment portfolios for corporations, foundations and individuals.

The acquisition of SSW was consummated on April 1, 2021.

At March 31, 2021, SSW reported $3.6 million in total assets and $2.3 million in total liabilities.

Texas Citizens Bancorp, Inc.

On October 20, 2021, we entered into a definitive agreement to acquire Texas Citizens Bancorp, Inc.

(“TCBI”), the parent bank holding company for Texas Citizens Bank, National Association, headquartered in Pasadena, Texas.

The acquisition was consummated on March 1, 2022.

As a result of the TCBI acquisition, we added six banking locations in the Houston, Texas market, and as of February 28, 2022, reported total assets of $534.2 million, loans of $349.5 million and total deposits of $477.2 million.

Waterstone LSP, LLC ("Waterstone").

On January 31, 2024, we completed the acquisition, through b1BANK, of Waterstone, headquartered in Katy, Texas.

Waterstone offers community banks and small businesses a range of small business administration ("SBA") lending services including planning, pre-qualification, packaging, closing and disbursements, servicing and liquidations.

Upon consummation of the acquisition, we paid $3.3 million in cash to the former owners of Waterstone.

Oakwood Bancshares, Inc.

On October 1, 2024, we consummated the merger of Oakwood, the parent bank holding company for Oakwood Bank, with and into us, with us continuing as the surviving corporation pursuant to the terms of that certain Agreement and Plan of Reorganization (the "Reorganization Agreement"), dated April 25, 2024, by and between us and Oakwood.

Immediately following consummation of the Oakwood acquisition, Oakwood Bank merged with and into us, with us surviving the merger.

Pursuant to the terms of the Reorganization Agreement, upon consummation of the Oakwood acquisition, we issued 3,973,134 shares of our common stock to the former shareholders of Oakwood.

As of September 30, 2024, Oakwood had $863.6 million in total assets, $700.2 million in loans and $741.3 in total deposits.

Our Competitive Strengths

13 unchanged sentences

In our experience, developing credit underwriting expertise “on the front lines” promotes quality loan generation and maximizes efficiency.

Further, our emphasis on asset/liability management training allows our local banking teams to understand the importance of quality core deposit funding, which we believe is vital to our continued loan growth.

Further, our emphasis on asset/liability management training allows our local banking teams to

understand the importance of quality core deposit funding, which we believe is vital to our continued loan growth.

In this sense, we view b1BANK as a network of true community banks, not as a typical regional financial institution that makes important credit and strategic decisions at the corporate level without input from its local bankers.

19 unchanged sentences

We believe our investments in technology will also allow us to maintain our “high tech/high touch” approach without the need for an extensive network of brick and mortar locations.

Our banking operations are currently organized into five regions in Louisiana, which include the largest metropolitan areas in the state, the Dallas/Fort Worth metroplex, and Houston, which we service through our banking centers and loan production offices.

Our banking operations are currently organized into three regions in Louisiana, which include the largest metropolitan areas in the state, the Dallas/Fort Worth metroplex, and Houston, which we service through our banking centers and loan production offices.

We will continue to look for talented teams of bankers in markets and potential acquisitions that fit our model going forward.

2 unchanged sentences

We offer, among other products, checking, savings and money market accounts, certificates of deposit, commercial and consumer loans, mortgage loans, real estate loans, and other installment and term loans.

In addition, b1BANK offers our customers wealth management products, drive-through banking facilities, automated teller machines, night depository, personalized checks, credit cards, debit cards, internet banking, electronic funds transfers through ACH services, domestic and foreign wire transfers, traveler’s checks, cash management, vault services, loan and deposit sweep accounts, and lock box services.

banking, electronic funds transfers through ACH services, domestic and foreign wire transfers, traveler’s checks, cash management, vault services, loan and deposit sweep accounts, SBA products, interest-rate swaps and lock box services.

Lending Activities

29 unchanged sentences

The interest rates on our commercial real estate loans may be fixed or adjustable, although rates typically are not fixed for a period exceeding five years.

We generally charge an origination fee for our services.

generally charge an origination fee for our services.

We typically require personal guarantees from the principal owners of the business supported by a review of the principal owners’ personal financial statements and global debt service obligations.

22 unchanged sentences

We seek to achieve an appropriate balance between prudent, disciplined underwriting and flexibility in our decision-making and responsiveness to our customers.

As of December 31, 2023, the Board has set the “in-house” household lending limit was $60.0 million with an additional borrower “in-house” lending limit of $20.0 million as of such date.

As of December 31, 2024, the Board set the “in-house” household lending limit at $60.0 million with an additional borrower “in-house” lending limit of $20.0 million as of such date.

Our credit underwriters are based throughout our footprint and service all of our markets from those locations.

1 unchanged sentence

We approve loans under four types of authority, Matrix (which includes Executive and Directors’ Loan Committees), Incremental, Small Business, and Consumer authority.

With the exception of loans secured by cash deposited with us, all commercial loans require a minimum of two approvers (the banker and at least one other individual with higher authority).

When using the Matrix authority, senior lenders have authority up to $500,000, market presidents have authority up to $750,000, regional market presidents have authority up to $1.5 million, the chief banking officer and regional credit managers have authority up to $2.5 million, regional chairmen have authority up to $2.0 million and the Chief Executive Officer, Chief Financial Officer, and Chief Credit Officer each have authority up to $2.5 million.

All commercial loans require a minimum of two approvers (the banker and at least one other individual with higher authority).

When using the Matrix authority, senior lenders have authority up to $500,000, market leaders have authority up to $750,000, regional market presidents have authority up to $1.5 million, the chief banking officer and regional credit officers have authority up to $2.5 million, regional chairmen have authority up to $2.0 million and the Chief Executive Officer, President, Chief Financial Officer, and Chief Credit Officer each have authority up to $2.5 million.

A combination of the Chief Banking Officer and Chief Credit Officer (or their assigns) may approve up to $10.0 million.

All relationships exceeding $10.0 million are approved by the Executive Loan Committee.

All relationships exceeding $10.0 million are required to be approved by the Director’s Loan Committee, which is comprised of board members.

All relationships exceeding $60.0 million or borrowers exceeding $20.0 million are required to be approved by the Director’s Loan

Committee, which is comprised of board members.

Loans may be approved using the Incremental authority when the relationship has already been approved using the Matrix authority, with senior lenders being able to approve up to $250,000, market leaders being able to approve up to $350,000, regional presidents and higher authorities up to $1.5 million, cumulatively.

33 unchanged sentences

Other Products and Services

In addition to traditional banking activities and the other products and services specified above, we provide a broad array of financial services to our customers, including debit and credit card products, treasury and cash management services, merchant services, employee and payroll benefits solutions (including payroll cards and bank-at-work benefits) automated clearing house services, lock-box services, remote deposit capture services, receivables factoring, correspondent banking services (offered by our Financial Institutions Group) and other treasury services.

Business First Bancshares, Inc.

1 unchanged sentence

b1BANK, formerly known as Business First Bank, and Coastal Commerce Statutory Trust I.

In addition, b1BANK has two direct, wholly-owned subsidiaries, Business First Insurance, LLC and SSW, which are indirect subsidiaries of Business First Bancshares, Inc.

In addition, b1BANK has four direct, wholly-owned subsidiaries, Business First Insurance, LLC, Smith Shellnut Wilson ("SSW"), Waterstone, and b1Securities, which are indirect subsidiaries of Business First Bancshares, Inc.

Business First Insurance, LLC is currently inactive and does not engage in any material business activities.

13 unchanged sentences

As of December 31, 2024, we proudly employ 849 full-time and 23 part-time employees (for a total of 872 employees).

Our employees reside coast to coast, with personnel located in Alabama (remote), Arkansas (remote), Illinois (remote), Kentucky (remote), Louisiana, Mississippi, Nevada (remote), North Carolina (remote), South Dakota (remote), Tennessee (remote), Texas, and Virginia (remote).

Full-time equivalents (FTEs) as of December 31, 2023, were 761.

All banking centers and loan production offices are in Louisiana and Texas, and our subsidiary registered investment advisor (RIA), Smith Shellnut Wilson, LLC, or SSW, is in Mississippi.

Our Chief Human Resources Officer reports directly to the Chief Administrative Officer and manages all aspects of the employee experience, including talent acquisition, diversity and inclusion, learning and development, talent management, compensation, and benefits.

Our employees reside coast to coast, with personnel located in Louisiana, Mississippi, Texas, and 10 other states with remote employees.

Full-time equivalents (FTEs) as of December 31, 2024, were 859, which includes employees from the Oakwood acquisition that closed on October 1, 2024.

All banking centers and loan production offices are in Louisiana and Texas, and our subsidiary registered investment advisor (RIA), SSW, is in Mississippi.

Our Chief Human Resources Officer reports directly to the Chief of Staff and manages all aspects of the employee experience, including talent acquisition, diversity and inclusion, learning and development, talent management, compensation, and benefits.

The board of directors is regularly updated on our talent development and human capital management strategies.

3 unchanged sentences

We have an organization-wide focus to improve recruitment and retention of women and ethnic minorities.

In 2023, we completed a second year of our Intern Insights Program which focuses on creating a pipeline between young diverse talent and the banking industry.

In 2024, we completed a third year of our Intern Insights Program, which focuses on creating a pipeline between young diverse talent and the banking industry.

Specifically, recruiting efforts focused on junior year finance and accounting majors at Southern University and A&M College in Baton Rouge, a historically black university, for our Intern Insights Program.

1 unchanged sentence

As of December 31, 2024, our colleagues had the following attributes:

520 total (67.5%)

166 total (21.6%)

Female Minority (3)

Employees 580 total (67.4%) 152 total (26.0%)

Officials and Managers (1)

113 total (58.3%)

33 total (17.0%)

116 total (59.0%) 27 total (23.0%)

Executive Officers (2)

3 total (21.4%)

1 total (7.1%)

3 total (50.0%) 0 total (0.0%)

(1) Based on EEO-1 job classifications.

1 unchanged sentence

(3) Includes Hispanic/Latino, Black/African American, Asian, American Indian/Alaska Native, Native Hawaiian/Other Pacific Islander

In addition to our continued Diversity Equity and Inclusion (“DEI”) efforts, we have emphasized merit-based promotions in an effort to promote from within, foster talent development of our best human capital resources, and increase the our organic growth.

In addition to our continued Diversity Equity and Inclusion (“DEI”) efforts, we have emphasized merit-based promotions to promote from within, and foster talent development of our best human capital resources.

Compensation and Benefits .

We provide pay, benefits, and services that not only meet the varying needs of our employees but are in line with our equilibrium for competitive compensation.

We provide competitive pay, benefits, and services that meet the varying needs of our employees.

Compensation and benefits include market-competitive pay, health insurance options, a health reimbursement account (HRA), a flexible spending account (FSA), dependent care, employer-paid life insurance, voluntary life insurance, dental and vision insurance, employer-paid short-term disability, employer-paid long-term disability, employee assistance programs, employee discounts on our products, critical illness insurance, accident insurance, hospital indemnity insurance, pet insurance, identity and fraud protection, MetLife legal plan, paid time off, (including paid volunteer leave), training and professional development opportunities, and an employer-paid financial wellness program.

1 unchanged sentence

Attraction, Development and Retention .

We measure the success of our talent acquisition strategy on quality of acquisition, diversity of new colleagues and retention.

We measure the success of our talent acquisition strategy on quality of acquisition, diversity in the workplace, and the retention of our employees.

Each of these metrics is tracked for all key business lines.

Sourcing strategies and support structures are modified to ensure that performance targets are met consistently.

Sourcing tools are reviewed and modified as needed to ensure that we experience continued improvement.

In 2024, our Talent Development team made significant strides in enhancing and expanding our training initiatives.

8 unchanged sentences

These programs equipped our staff with essential skills for efficient dispute handling and deepened their understanding of critical compliance areas such as CTR’s, thereby ensuring secure, compliant client transactions and maintaining client trust in us.

This year also marked a notable enhancement in our Emergenetics training program.

In 2024, we continued the enhancement in our Emergenetics training program.

This enhancement is aimed at maximizing the impact of cognitive and behavioral diversity in leadership and team collaboration.

By refining the Emergenetics training, we enabled our leaders to more effectively understand and utilize each team member’s unique strengths.

This approach fostered a more dynamic, inclusive, and effective leadership style, significantly impacting our ability to exceed client expectations through superior team performance and decision-making.

This approach fostered a more dynamic, inclusive, and effective leadership style, significantly impacting our

ability to exceed client expectations through superior team performance and decision-making.

The enhancement of this innovative training program underscored our ongoing commitment to organizational excellence and superior client service.

3 unchanged sentences

Available Information

The Company files reports and other information with the Securities and Exchange Commission, or SEC, under the Securities Exchange Act of 1934, as amended.

The Company files reports and other information with the Securities and Exchange Commission (the "SEC") under the Securities Exchange Act of 1934, as amended.

The SEC maintains an Internet site that contains reports, proxy and information statements and other information about issuers, like the Company, who file electronically with the SEC.

23 unchanged sentences

Financial holding companies may also engage in activities that are considered to be financial in nature, as well as those incidental or complementary to financial activities, including certain insurance underwriting activities.

The Company and the Bank must each remain well capitalized and well managed and the Bank must receive a Community Reinvestment Act (“CRA”) rating of at least “satisfactory” at its most recent examination in order for us to maintain our status as a financial holding company.

The Company and the Bank must each remain well capitalized and well managed and the Bank must receive a Community Reinvestment

Act (“CRA”) rating of at least “satisfactory” at its most recent examination in order for us to maintain our status as a financial holding company.

In addition, the Federal Reserve has the power to order a financial holding company or its subsidiaries to terminate any activity or terminate its ownership or control of any subsidiary, when it has a reasonable cause to believe that continuation of such activity or such ownership or control constitutes a serious risk to the financial safety, soundness, or stability of any bank subsidiary of that financial holding company.

As a bank holding company with respect to the Bank, the Company is also subject to regulation under the Bank Holding Company Act of 1956, or the BHC Act, and to supervision, examination and enforcement by the Federal Reserve.

As a bank holding company with respect to the Bank, the Company is also subject to regulation under the Bank Holding Company Act of 1956 (the "BHC Act") and to supervision, examination and enforcement by the Federal Reserve.

The BHC Act and other federal laws subject bank holding companies to particular restrictions on the types of activities in which they may engage, and to a range of supervisory requirements and activities, including regulatory enforcement actions for violations of laws and regulations.

1 unchanged sentence

Financial Services Industry Reform.

In 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act, or Dodd-Frank Act was enacted.

In 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act (the "Dodd-Frank Act") was enacted.

The Dodd-Frank Act broadly affected the financial services industry by implementing changes to the financial regulatory landscape aimed at strengthening the sound operation of the financial services sector.

In addition, the Dodd-Frank Act addressed many investor protection, corporate governance and executive compensation matters affecting publicly-traded companies.

However, the Jumpstart our Business Startups Act of 2012, or JOBS Act, provided certain exceptions to these requirements for so long as a publicly-traded qualifies as an emerging growth company.

However, the Jumpstart our Business Startups Act of 2012 (the "JOBS Act") provided certain exceptions to these requirements for so long as a publicly-traded qualifies as an emerging growth company.

In 2018, the Economic Growth, Regulatory Relief, and Consumer Protection Act (“EGRRCPA”) revised certain aspects of the Dodd-Frank Act.

3 unchanged sentences

Regulatory capital rules pursuant to the Basel III requirements, released in July 2013 and effective January 1, 2015, implemented higher minimum capital requirements for bank holding companies and banks.

These rules include a new common equity Tier 1, or CET1, capital requirement and establish criteria that instruments must meet to be considered common equity Tier 1 capital, additional Tier 1 capital or Tier 2 capital.

These rules include a new common equity Tier 1 ("CET1") capital requirement and establish criteria that instruments must meet to be considered common equity Tier 1 capital, additional Tier 1 capital or Tier 2 capital.

The revised capital rules require banks and bank holding companies to maintain a minimum CET1 capital ratio of 4.5% of risk-based assets, a total Tier 1 capital ratio of 6.0% of risk-based assets, a total capital ratio of 8.0% of risk-based assets and a leverage ratio of 4.0% of average assets.

9 unchanged sentences

The CBLR framework is an optional framework that is designed to reduce burden by removing the requirements for calculating and reporting risk-based capital ratios for qualifying community banking organizations that opt into the framework.

For the year ended December 31, 2020, the Company and Bank elected to adopt the CBLR framework.

For the years ended December 31, 2023, 2022 and 2021, the Company and Bank elected to revert to the risk-weighted ratios.

We have not elected to use the CBLR framework since the year ended December 31, 2020.

Imposition of Liability for Undercapitalized Subsidiaries.

Bank regulators are required to take prompt corrective action to resolve problems associated with insured depository institutions whose capital declines below certain levels.

In the event an institution becomes undercapitalized, it must submit a capital restoration plan.

the event an institution becomes undercapitalized, it must submit a capital restoration plan.

The capital restoration plan will not be accepted by the regulators unless each company having control of the undercapitalized institution guarantees the subsidiary’s compliance with the capital restoration plan up to a certain specified amount.

11 unchanged sentences

Control Acquisitions.

Federal and state laws, including the BHC Act and the Change in Bank Control Act, or CBCA, impose additional prior notice or approval requirements and ongoing regulatory requirements on any investor that seeks to acquire direct or indirect “control” of an FDIC-insured depository institution or bank holding company.

Federal and state laws, including the BHC Act and the Change in Bank Control Act (the "CBCA"), impose additional prior notice or approval requirements and ongoing regulatory requirements on any investor that seeks to acquire direct or indirect “control” of an FDIC-insured depository institution or bank holding company.

Whether an investor “controls” a depository institution is based on all of the facts and circumstances surrounding the investment.

17 unchanged sentences

In addition, any capital loans that the Company makes to the Bank are subordinate in right of payment to deposits and to certain other indebtedness of the Bank.

As discussed above, in certain circumstances, the Company could also be required to guarantee the capital restoration plan of the Bank, if it became undercapitalized for purposes of the Federal Reserve’s prompt corrective action regulations.

As discussed above, in

certain circumstances, the Company could also be required to guarantee the capital restoration plan of the Bank, if it became undercapitalized for purposes of the Federal Reserve’s prompt corrective action regulations.

In the event of our bankruptcy, any commitment by us to a federal bank regulatory agency to maintain the capital of the Bank under a capital restoration plan would be assumed by the bankruptcy trustee and entitled to a priority of payment.

10 unchanged sentences

In approving acquisitions or the addition of activities, the Federal Reserve considers, among other things, whether the acquisition or the additional activities can reasonably be expected to produce benefits to the public, such as greater convenience, increased competition, or gains in efficiency, that outweigh such possible adverse effects as undue concentration of resources, decreased or unfair competition, conflicts of interest or unsound banking practices.

Notwithstanding the foregoing, the Gramm-Leach-Bliley Act, also known as the Financial Services Modernization Act of 1999, effective March 11, 2000, or the GLB Act, amended the BHC Act and eliminated the barriers to affiliations among banks, securities firms, insurance companies and other financial service providers.

Notwithstanding the foregoing, the Gramm-Leach-Bliley Act, also known as the Financial Services Modernization Act of 1999, effective March 11, 2000 (the "GLB Act"), amended the BHC Act and eliminated the barriers to affiliations among banks, securities firms, insurance companies and other financial service providers.

The GLB Act permitted bank holding companies to become financial holding companies and thereby affiliate with securities firms and insurance companies and engage in other activities that are financial in nature.

17 unchanged sentences

In addition, its deposits are insured by the FDIC to the maximum extent permitted by law.

As a result, the Bank is subject to extensive regulation, supervision and examination by the Louisiana Office of Financial Institutions and the FDIC.

As a result, the Bank is subject to extensive regulation,

supervision and examination by the Louisiana Office of Financial Institutions and the FDIC.

Finally, we are also subject to secondary oversight by state banking authorities in other states in which we may maintain banking offices.

16 unchanged sentences

Corrective Measures for Capital Deficiencies.

The federal banking regulators are required by the Federal Deposit Insurance Act, or FDI Act, to take “prompt corrective action” with respect to capital-deficient institutions that are FDIC-insured.

The federal banking regulators are required by the Federal Deposit Insurance Act (the "FDI Act") to take “prompt corrective action” with respect to capital-deficient institutions that are FDIC-insured.

For this purpose, a financial institution is placed in one of the following five capital tiers:

5 unchanged sentences

Undercapitalized institutions are also subject to growth limitations, may not accept, renew or rollover brokered deposits, and are required to submit a capital restoration plan.

The agencies may not accept such a plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the bank’s capital.

The agencies may not accept such a plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring

the bank’s capital.

Significantly undercapitalized depository institutions may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become adequately capitalized, requirements to reduce total assets, and cessation of receipt of deposits from correspondent banks.

29 unchanged sentences

The FDIC may further restrict the payment of dividends by engaging in supervisory action to restrict dividends or by requiring the Bank to maintain a higher level of capital than would otherwise be required to be adequately capitalized for regulatory purposes.

Under the Basel III regulatory capital framework, the failure to maintain an adequate capital conservation buffer, as discussed above, may also result in dividend restrictions.

Under the Basel III

regulatory capital framework, the failure to maintain an adequate capital conservation buffer, as discussed above, may also result in dividend restrictions.

Moreover, if, in the opinion of the FDIC, the Bank is engaged in an unsound practice (which could include the payment of dividends), the FDIC may require, generally after notice and hearing, the Bank to cease such practice.

29 unchanged sentences

Financial Modernization.

Under the GLB Act, banks may establish financial subsidiaries and engage, subject to limitations on investment, in activities that are financial in nature, other than insurance underwriting as principal, insurance company portfolio investment, real estate development, real estate investment, annuity issuance and merchant banking activities.

To do so, a bank must be well capitalized, well managed and have a CRA rating from its primary federal regulator of satisfactory or better.

17 unchanged sentences

These regulations also provide for regulatory assessment of a bank’s record in meeting the needs of its assessment area when considering applications to establish branches, merger applications and applications to acquire the assets and assume the liabilities of another bank.

The Financial Institution Reform Recovery and Enforcement Act, or FIRREA requires federal banking agencies to make public a rating of a bank’s performance under the CRA.

The Financial Institution Reform Recovery and Enforcement Act (the "FIRREA") requires federal banking agencies to make public a rating of a bank’s performance under the CRA.

In the case of a bank holding company, the CRA performance record of the banks involved in the transaction are reviewed in connection with the filing of an application to acquire ownership or control of shares or assets of a bank or to merge with any other bank holding company.

12 unchanged sentences

The Dodd-Frank Act gives the CFPB authority to supervise and examine depository institutions with more than $10.0 billion in assets for compliance with these federal consumer laws.

The authority to supervise and examine depository institutions with $10.0 billion or less in assets for compliance with federal consumer laws remains largely with those institutions’ primary regulators.

authority to supervise and examine depository institutions with $10.0 billion or less in assets for compliance with federal consumer laws remains largely with those institutions’ primary regulators.

However, the CFPB may participate in examinations of these smaller institutions on a “sampling basis” and may refer potential enforcement actions against such institutions to their primary regulators.

10 unchanged sentences

Anti-Money Laundering and OFAC.

Under federal law, including the Bank Secrecy Act, or BSA, and the USA PATRIOT Act of 2001, certain financial institutions, such as the Bank, must maintain anti-money laundering programs that include established internal policies, procedures and controls;

Under federal law, including the Bank Secrecy Act (the "BSA"), and the USA PATRIOT Act of 2001, certain financial institutions, such as the Bank, must maintain anti-money laundering programs that include established internal policies, procedures and controls;

a designated BSA officer;

3 unchanged sentences

Financial institutions must take reasonable steps to conduct enhanced scrutiny of account relationships to guard against money laundering and to report any suspicious transactions, and law enforcement authorities have been granted increased access to financial information maintained by financial institutions.

The Financial Crimes Enforcement Network, or FinCEN, issued final rules under the BSA in July 2016 that clarify and strengthen the due diligence requirements for banks with regard to their customers.

The Office of Foreign Assets Control, or OFAC, administers laws and Executive Orders that prohibit U.S.

The Financial Crimes Enforcement Network ("FinCEN"), issued final rules under the BSA in July 2016 that clarify and strengthen the due diligence requirements for banks with regard to their customers.

The Office of Foreign Assets Control("OFAC") administers laws and Executive Orders that prohibit U.S.

entities from engaging in transactions with certain prohibited parties.

10 unchanged sentences

Federal Home Loan Bank ( “ FHLB ” ) System.

The FHLB system, of which the Bank is a member, consists of 11 regional FHLBs governed and regulated by the Federal Housing Finance Board, or FHFB.

The FHLB system, of which the Bank is a member, consists of 11 regional FHLBs governed and regulated by the Federal Housing Finance Board ("FHFB").

The FHLBs serve as reserve or credit facilities for member institutions within their assigned regions.

24 unchanged sentences

Cybersecurity risks are expected to increase due to the rapid evolution and sophistication of cybersecurity attacks and the accessibility of resources required for their execution.

In turn, Congress, multiple states, and federal regulators frequently issue new guidance and standards and are currently considering the enactment of additional or enhanced laws or regulations which could impose increased obligations for companies responsible for the safeguarding of nonpublic, customer and consumer information, specifically financial institutions.

In turn, Congress, multiple states, and federal regulators frequently issue new guidance and standards and are currently considering the enactment of additional or enhanced laws or

regulations which could impose increased obligations for companies responsible for the safeguarding of nonpublic, customer and consumer information, specifically financial institutions.

On November 23, 2021, federal banking agencies issued a joint final rule requiring financial institutions to provide notification to their primary federal regulator as soon as possible and no later than 36 hours after a “computer-security incident” has been determined to be a “notification event,” as those terms are defined under the final rule.

Additionally, the rule requires bank service providers to contact each affected banking organization customer as soon as possible once the bank service provider determines it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to such banking organizations for four or more hours.

On March 15, 2023, the SEC issued proposed amendments that would require registered broker-dealers, investment companies, investment advisors, and transfer agents to adopt written policies and procedures for an incident response program to address unauthorized access to or use of customer information.

Additionally, the proposed amendments would also require, with certain limited exceptions, covered institutions to provide notice to individuals whose sensitive customer information was or is reasonably likely to have been accessed or used without authorization.

The proposal would require a covered institution to provide this notice as soon as practicable but not later than 30 days after the covered institution becomes aware that an incident involving unauthorized access to, or use of customer information has occurred or is reasonably likely to have occurred.

On July 26, 2023, the SEC adopted rules requiring registrants to disclose the occurrence of cybersecurity incidents once such incidents are determined to be material in nature.

Additionally, the rule requires the annual disclosure of material information regarding cybersecurity risk management, strategy, and governance.

On October 30, 2023, the current Presidential Administration issued an Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence, emphasizing the need for transparency, accountability and fairness in the secure development and use of artificial intelligence (“AI”).

The order seeks to address AI risks by providing eight guiding principles and priorities, including the development of standards, tools, and tests to help ensure AI systems are safe, secure, and trustworthy and the development of an advanced cybersecurity program to develop tools to identify and address vulnerabilities in critical software.

On May 16, 2024, the SEC adopted an amendment to Regulation S-P requiring a covered institution to provide notice as soon as practicable, but not later than 30 days after becoming aware that an incident involving unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred.

The notice must include details about the incident, the breached data, and how affected individuals can respond to the breach to protect themselves.

Future Legislation and Regulatory Reform

5 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business