What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2026-02-26 compared with 2025-03-07 · 70 added, 75 removed, 516 unchanged (22% of the section changed)

24 unchanged sentences

We intend to focus on growing into these markets as we identify specific opportunities to recruit talented and entrepreneurial teams of local bankers who fit our culture and banking strategy.

Prior to the expansion into the Houston market from the TCBI merger, each of our expansions into new markets to date has been accomplished organically.

Except for the acquisition of Texas Citizens Bancorp, Inc.

("TCBI"), and our expansion into the Houston market, each of our entries into new markets to date have been accomplished organically.

• Disciplined Acquisition Strategy.

8 unchanged sentences

(vii) the acquisition of Waterstone LSP, LLC, which operates in Katy, Texas, on January 31, 2024;

and (viii) the acquisition of Oakwood Bancshares, Inc., which operates in the Dallas, Texas area, on October 1, 2024, the last two of which are described in further detail below.

(viii) the acquisition of Oakwood Bancshares, Inc., which operates in the Dallas, Texas area, on October 1, 2024;

and (ix) the acquisition of Progressive Bancorp, Inc., which operates in north Louisiana, on January 1, 2026, the last three of which are described in further detail below.

We will carefully consider acquisition opportunities that we believe are consistent with our strategic vision and provide attractive risk-adjusted returns to our shareholders.

5 unchanged sentences

Oakwood Bancshares, Inc.

On October 1, 2024, we consummated the merger of Oakwood, the parent bank holding company for Oakwood Bank, with and into us, with us continuing as the surviving corporation pursuant to the terms of that certain Agreement and Plan of Reorganization (the "Reorganization Agreement"), dated April 25, 2024, by and between us and Oakwood.

Immediately following consummation of the Oakwood acquisition, Oakwood Bank merged with and into us, with us surviving the merger.

Pursuant to the terms of the Reorganization Agreement, upon consummation of the Oakwood acquisition, we issued 3,973,134 shares of our common stock to the former shareholders of Oakwood.

On October 1, 2024, we consummated the merger of Oakwood, the parent bank holding company for Oakwood Bank, with and into Business First, with Business First continuing as the surviving corporation pursuant to the terms of that certain Agreement and Plan of Reorganization (the "Oakwood Reorganization Agreement"), dated April 25, 2024, by and between Business First and Oakwood.

Immediately following consummation of the Oakwood acquisition, Oakwood Bank merged with and into b1BANK, with b1BANK surviving the merger.

Pursuant to the terms of the Oakwood Reorganization Agreement, upon consummation of the Oakwood acquisition, we issued 3,973,134 shares of our common stock to the former shareholders of Oakwood.

As of September 30, 2024, Oakwood had $863.6 million in total assets, $700.2 million in loans and $741.3 in total deposits.

Progressive Bancorp, Inc.

(“Progressive”).

On January 1, 2026, we consummated the merger of Progressive, the parent bank holding company for Progressive Bank, with and into Business First, with Business First continuing as the surviving corporation pursuant to the terms of that certain Agreement and Plan of Reorganization (the "Progressive Reorganization Agreement"), dated July 7, 2025, by and between Business First and Progressive.

Immediately following consummation of the Progressive acquisition, Progressive Bank merged with and into b1BANK, with b1BANK surviving the merger.

Pursuant to the terms of the Progressive Reorganization Agreement, upon consummation of the Progressive acquisition, we issued 3,192,367 shares of our common stock to the former shareholders of Progressive.

As of December 31, 2025, Progressive had $773.8 million in total assets, $597.2 million in loans and $684.9 million in total deposits.

Our Competitive Strengths

13 unchanged sentences

In our experience, developing credit underwriting expertise “on the front lines” promotes quality loan generation and maximizes efficiency.

Further, our emphasis on asset/liability management training allows our local banking teams to

understand the importance of quality core deposit funding, which we believe is vital to our continued loan growth.

Further, our emphasis on asset/liability management training allows our local banking teams to understand the importance of quality core deposit funding, which we believe is vital to our continued loan growth.

In this sense, we view b1BANK as a network of true community banks, not as a typical regional financial institution that makes important credit and strategic decisions at the corporate level without input from its local bankers.

19 unchanged sentences

We believe our investments in technology will also allow us to maintain our “high tech/high touch” approach without the need for an extensive network of brick and mortar locations.

Our banking operations are currently organized into three regions in Louisiana, which include the largest metropolitan areas in the state, the Dallas/Fort Worth metroplex, and Houston, which we service through our banking centers and loan production offices.

centers and loan production offices.

We will continue to look for talented teams of bankers in markets and potential acquisitions that fit our model going forward.

2 unchanged sentences

We offer, among other products, checking, savings and money market accounts, certificates of deposit, commercial and consumer loans, mortgage loans, real estate loans, and other installment and term loans.

banking, electronic funds transfers through ACH services, domestic and foreign wire transfers, traveler’s checks, cash management, vault services, loan and deposit sweep accounts, SBA products, interest-rate swaps and lock box services.

In addition, b1BANK offers our customers wealth management products, drive-through banking facilities, automated teller machines, night depository, personalized checks, credit cards, debit cards, internet banking, electronic funds transfers through ACH services, domestic and foreign wire transfers, traveler’s checks, cash management, vault services, loan and deposit sweep accounts, SBA products, interest-rate swaps and lock box services.

Lending Activities

22 unchanged sentences

Loan proceeds are disbursed based on the percentage of completion and only after the project has been inspected by an experienced construction lender or third-party inspector.

Risks associated with construction and development loans include fluctuations in the value of real estate, project completion risk and change in market trends.

Risks associated with construction and development loans include fluctuations in the value of real estate, project completion risk and change in

market trends.

We are also exposed to risk based on the ability of the construction loan borrower to finance the loan or sell the property upon completion of the project, which may be affected by changes in secondary market terms and criteria for permanent financing since the time that we funded the loan.

4 unchanged sentences

The interest rates on our commercial real estate loans may be fixed or adjustable, although rates typically are not fixed for a period exceeding five years.

generally charge an origination fee for our services.

We generally charge an origination fee for our services.

We typically require personal guarantees from the principal owners of the business supported by a review of the principal owners’ personal financial statements and global debt service obligations.

27 unchanged sentences

All commercial loans require a minimum of two approvers (the banker and at least one other individual with higher authority).

When using the Matrix authority, senior lenders have authority up to $500,000, market leaders have authority up to $750,000, regional market presidents have authority up to $1.5 million, the chief banking officer and regional credit officers have authority up to $2.5 million, regional chairmen have authority up to $2.0 million and the Chief Executive Officer, President, Chief Financial Officer, and Chief Credit Officer each have authority up to $2.5 million.

Generally, relationships $2.0 million and below are approved within the Centralized Credit Underwriting department which is comprised of credit individuals who are independent of the lending division.

The Chief Executive Officer, President, Chief Credit Officer, Chief Financial Officer, Chief Banking Officer and regional credit officers have authority up to $2.5 million, regional chairman have authority up to $2.0 million.

A combination of the Chief Banking Officer and Chief Credit Officer (or their assigns) may approve up to $10.0 million.

All relationships exceeding $10.0 million are approved by the Executive Loan Committee.

All relationships exceeding $60.0 million or borrowers exceeding $20.0 million are required to be approved by the Director’s Loan

Committee, which is comprised of board members.

All relationships exceeding $60.0 million or borrowers exceeding $20.0 million are required to be approved by the Director’s Loan Committee, which is comprised of board members.

Loans may be approved using the Incremental authority when the relationship has already been approved using the Matrix authority, with senior lenders being able to approve up to $250,000, market leaders being able to approve up to $350,000, regional presidents and higher authorities up to $1.5 million, cumulatively.

53 unchanged sentences

As of December 31, 2025, we proudly employ 821 full-time and 21 part-time employees (for a total of 842 employees).

Our employees reside coast to coast, with personnel located in Louisiana, Mississippi, Texas, and 10 other states with remote employees.

Full-time equivalents (FTEs) as of December 31, 2024, were 859, which includes employees from the Oakwood acquisition that closed on October 1, 2024.

Our employees reside in Louisiana, Mississippi, Texas, and 9 other states with remote employees.

Full-time equivalents (FTEs) as of December 31, 2025, were 831.

All banking centers and loan production offices are in Louisiana and Texas, and our subsidiary registered investment advisor (RIA), SSW, is in Mississippi.

Our Chief Human Resources Officer reports directly to the Chief of Staff and manages all aspects of the employee experience, including talent acquisition, diversity and inclusion, learning and development, talent management, compensation, and benefits.

Our Chief Human Resources Officer reports directly to the Chief Administrative Officer and manages all aspects of the employee experience, including talent acquisition, diversity and inclusion, learning and development, talent management, compensation, and benefits.

The board of directors is regularly updated on our talent development and human capital management strategies.

2 unchanged sentences

For 2025, we managed an average of $7.4 million in loans held for investment and $8.1 million in deposits per FTE.

We have an organization-wide focus to improve recruitment and retention of women and ethnic minorities.

In 2024, we completed a third year of our Intern Insights Program, which focuses on creating a pipeline between young diverse talent and the banking industry.

Specifically, recruiting efforts focused on junior year finance and accounting majors at Southern University and A&M College in Baton Rouge, a historically black university, for our Intern Insights Program.

We continue to recruit and retain women and minorities.

In 2025, our Intern Insights Program, which creates a pipeline between diverse talent and the banking industry, experienced significant growth and success as we hosted twelve interns from four Louisiana universities.

Furthermore, in 2025, we continued the use of online exit surveys to provide feedback and help increase retention of women and ethnic minorities.

18 unchanged sentences

Sourcing tools are reviewed and modified as needed to ensure that we experience continued improvement.

In 2024, our Talent Development team made significant strides in enhancing and expanding our training initiatives.

Our goals were to directly benefit our clients by elevating service standards through strategic development programs.

Key among these was the integration of Submittable, which is an online platform used to streamline the submission and review processes into our internal application for external learning and development programs.

This innovative platform revolutionized how employees applied for external development programs, streamlining our application process, and improving how managers and executives review and provide feedback on applications.

Further advancements were made in our “Learning b1:

Manager Orientation” program, which underwent significant improvements with the introduction of personalized coaching sessions.

These sessions provided targeted guidance to enhance leadership skills among managers, leading to more efficient teams and, consequently, better internal and external client interactions and service quality.

Additionally, our specialized training programs, namely the “Transaction Dispute Reporting for the Frontline” and the “Mastering Currency Transaction Reports:

Compliance and Best Practices,” significantly enhanced client service and compliance standards.

These programs equipped our staff with essential skills for efficient dispute handling and deepened their understanding of critical compliance areas such as CTR’s, thereby ensuring secure, compliant client transactions and maintaining client trust in us.

In 2024, we continued the enhancement in our Emergenetics training program.

This enhancement is aimed at maximizing the impact of cognitive and behavioral diversity in leadership and team collaboration.

By refining the Emergenetics training, we enabled our leaders to more effectively understand and utilize each team member’s unique strengths.

This approach fostered a more dynamic, inclusive, and effective leadership style, significantly impacting our

ability to exceed client expectations through superior team performance and decision-making.

The enhancement of this innovative training program underscored our ongoing commitment to organizational excellence and superior client service.

In 2025, Talent Development continues to strengthen leadership capability across the organization through redesigned and targeted development experiences.

The “Leading b1” manager program has been fully reimagined and relaunched as a 2.5-day workshop.

It covers immersive leadership experience focused on coaching, performance management, and leading through change.

Talent Development partnered with business leaders to strengthen operational consistency, risk awareness, and compliance across the organization.

Key initiatives included standardized training for frontline practices, system readiness training for retail operations, and targeted programs addressing fraud prevention and compliance.

One training to note was “The First Domino:

Stopping Fraud in its Tracks”.

Talent Development remains a key partner in positioning b1BANK to adapt, perform, and grow in a dynamic financial services environment.

Our average tenure is 6.5 years of service.

During 2025, we had 82 internal employee promotions, 147 external hires, and 9 rehired employees.

Employee turnover for 2024 was 13.3%.

Employee turnover for 2025 was 21.0%, which includes the positions that were eliminated following the Oakwood conversion.

Available Information

25 unchanged sentences

Financial holding companies may also engage in activities that are considered to be financial in nature, as well as those incidental or complementary to financial activities, including certain insurance underwriting activities.

The Company and the Bank must each remain well capitalized and well managed and the Bank must receive a Community Reinvestment

Act (“CRA”) rating of at least “satisfactory” at its most recent examination in order for us to maintain our status as a financial holding company.

In addition, the Federal Reserve has the power to order a financial holding company or its subsidiaries to terminate any activity or terminate its ownership or control of any subsidiary, when it has a reasonable cause to believe that continuation of such activity or such ownership or control constitutes a serious risk to the financial safety, soundness, or stability of any bank subsidiary of that financial holding company.

The Company and the Bank must each remain well capitalized and well managed and the Bank must receive a Community Reinvestment Act (“CRA”) rating of at least “satisfactory” at its most recent examination in order for us to maintain our status as a financial holding company.

In addition, the Federal Reserve has the power to order a financial holding company or its

subsidiaries to terminate any activity or terminate its ownership or control of any subsidiary, when it has a reasonable cause to believe that continuation of such activity or such ownership or control constitutes a serious risk to the financial safety, soundness, or stability of any bank subsidiary of that financial holding company.

As a bank holding company with respect to the Bank, the Company is also subject to regulation under the Bank Holding Company Act of 1956 (the "BHC Act") and to supervision, examination and enforcement by the Federal Reserve.

18 unchanged sentences

An institution would be subject to limitations on certain activities including payment of dividends, share repurchases and discretionary bonuses to executive officers if its capital level is below the buffered ratio.

Additionally, the Federal Reserve has issued supervisory guidance advising bank holding companies to eliminate, defer, or reduce dividends paid on common stock and share repurchases under certain circumstances, including where the company’s prospective rate of earnings is not consistent with the company’s capital needs or the company will not meet, or is in danger of not meeting, minimum regulatory capital adequacy ratios.

The Federal Reserve has recently supplemented this guidance to reiterate the need for bank holding companies to consult with the Federal Reserve sufficiently in advance of the proposed payment of a dividend in certain circumstances.

As of December 31, 2025, the Company’s capital meets or exceeds these capital requirements, including the buffer.

6 unchanged sentences

Bank regulators are required to take prompt corrective action to resolve problems associated with insured depository institutions whose capital declines below certain levels.

the event an institution becomes undercapitalized, it must submit a capital restoration plan.

In the event an institution becomes undercapitalized, it must submit a capital restoration plan.

The capital restoration plan will not be accepted by the regulators unless each company having control of the undercapitalized institution guarantees the subsidiary’s compliance with the capital restoration plan up to a certain specified amount.

29 unchanged sentences

Under longstanding Federal Reserve policy which has been codified by the Dodd-Frank Act, the Company is expected to act as a source of financial strength to, and to commit resources to support, the Bank.

This support may be required at times when we may not be inclined to provide it.

This support may be

required at times when we may not be inclined to provide it.

In addition, any capital loans that the Company makes to the Bank are subordinate in right of payment to deposits and to certain other indebtedness of the Bank.

As discussed above, in

certain circumstances, the Company could also be required to guarantee the capital restoration plan of the Bank, if it became undercapitalized for purposes of the Federal Reserve’s prompt corrective action regulations.

As discussed above, in certain circumstances, the Company could also be required to guarantee the capital restoration plan of the Bank, if it became undercapitalized for purposes of the Federal Reserve’s prompt corrective action regulations.

In the event of our bankruptcy, any commitment by us to a federal bank regulatory agency to maintain the capital of the Bank under a capital restoration plan would be assumed by the bankruptcy trustee and entitled to a priority of payment.

30 unchanged sentences

In addition, its deposits are insured by the FDIC to the maximum extent permitted by law.

As a result, the Bank is subject to extensive regulation,

supervision and examination by the Louisiana Office of Financial Institutions and the FDIC.

As a result, the Bank is subject to extensive regulation, supervision and examination by the Louisiana Office of Financial Institutions and the FDIC.

Finally, we are also subject to secondary oversight by state banking authorities in other states in which we may maintain banking offices.

2 unchanged sentences

Capital Adequacy Requirements.

The FDIC and Louisiana Office of Financial Institutions monitor the capital adequacy of the Bank by using a combination of risk-based guidelines and leverage ratios similar to those applied at the holding company level.

The FDIC and Louisiana Office of Financial Institutions (the "Louisiana OFI") monitor the capital adequacy of the Bank by using a combination of risk-based guidelines and leverage ratios similar to those applied at the holding company level.

These agencies consider the bank’s capital levels when taking action on various types of applications and when conducting supervisory activities related to the safety and soundness of the bank and the banking system.

9 unchanged sentences

Pursuant to section 201(b) of EGRRCPA, the federal bank regulatory agencies adopted a final rule in 2019 imposing a minimum community bank leverage ratio requirement of 9.0%, which was reduced on a temporary basis under the CARES Act in 2020-2021.

As previously mentioned, the Company and Bank elected to adopt the CBLR framework for the year ended December 31, 2020 and elected to revert to the risk weighted ratios for the years ended December 31, 2024, 2023 , 2022 and 2021.

Corrective Measures for Capital Deficiencies.

5 unchanged sentences

Banks that are adequately, but not well, capitalized may not accept, renew or rollover brokered deposits except with a waiver from the Federal Reserve and are subject to restrictions on the interest rates that can be paid on its deposits.

The FDIC’s prompt corrective action regulations also generally prohibit a bank from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the bank would thereafter be undercapitalized.

The FDIC’s prompt corrective action regulations also generally prohibit a bank from making any capital distributions

(including payment of a dividend) or paying any management fee to its parent holding company if the bank would thereafter be undercapitalized.

Undercapitalized institutions are also subject to growth limitations, may not accept, renew or rollover brokered deposits, and are required to submit a capital restoration plan.

The agencies may not accept such a plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring

the bank’s capital.

The agencies may not accept such a plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the bank’s capital.

Significantly undercapitalized depository institutions may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become adequately capitalized, requirements to reduce total assets, and cessation of receipt of deposits from correspondent banks.

3 unchanged sentences

As a result of the Dodd-Frank Act, the Bank may also establish additional branch offices outside of Louisiana, subject to prior regulatory approval, so long as the laws of the state where the branch is to be located would permit a state bank chartered in that state to establish a branch.

Any new branch, whether located inside or outside of Louisiana, must also be approved by the FDIC, as the Bank’s primary federal regulator.

In 2025, the FDIC, the Bank’s primary federal regulator, approved a final rule to streamline the process for the establishment and relocation of domestic branches.

Although new branches must still be approved by the FDIC, provides that most branch establishment or relocation filings that qualify for expedited processing will be deemed approved within three business days after submission.

Additionally, the final rule significantly reduces the volume of information required to be submitted in branch establishment or relocation filings.

The Bank may also establish offices in other states by merging with banks or by purchasing branches of other banks in other states, subject to certain restrictions.

19 unchanged sentences

The Bank is subject to certain restrictions on dividends under federal and state laws, regulations and policies.

In general, the Bank may pay dividends to the Company without the approval of the Louisiana Office of Financial Institutions so long as the amount of the dividend does not exceed the Bank’s net profits earned during the current year combined with its retained net profits of the immediately preceding year.

In general, the Bank may pay dividends to the Company without the

approval of the Louisiana Office of Financial Institutions so long as the amount of the dividend does not exceed the Bank’s net profits earned during the current year combined with its retained net profits of the immediately preceding year.

The Bank is required to obtain the approval of the Louisiana Office of Financial Institutions for any amount in excess of this threshold.

1 unchanged sentence

The FDIC may further restrict the payment of dividends by engaging in supervisory action to restrict dividends or by requiring the Bank to maintain a higher level of capital than would otherwise be required to be adequately capitalized for regulatory purposes.

Under the Basel III

regulatory capital framework, the failure to maintain an adequate capital conservation buffer, as discussed above, may also result in dividend restrictions.

Under the Basel III regulatory capital framework, the failure to maintain an adequate capital conservation buffer, as discussed above, may also result in dividend restrictions.

Moreover, if, in the opinion of the FDIC, the Bank is engaged in an unsound practice (which could include the payment of dividends), the FDIC may require, generally after notice and hearing, the Bank to cease such practice.

26 unchanged sentences

At least semiannually, the FDIC will update its loss and income projections for the Deposit Insurance Fund and, if needed, will increase or decrease assessment rates, following notice-and-comment rulemaking, if required.

If there are additional bank or financial institution failures or if the FDIC otherwise determines to increase assessment rates, the Bank may be required to pay higher FDIC insurance premiums.

If there are additional

bank or financial institution failures or if the FDIC otherwise determines to increase assessment rates, the Bank may be required to pay higher FDIC insurance premiums.

Any future increases in FDIC insurance premiums may have a material and adverse effect on our earnings.

Financial Modernization.

Under the GLB Act, banks may establish financial subsidiaries and engage, subject to limitations on investment, in activities that are financial in nature, other than insurance underwriting as principal, insurance company portfolio investment, real estate development, real estate investment, annuity issuance and merchant banking

To do so, a bank must be well capitalized, well managed and have a CRA rating from its primary federal regulator of satisfactory or better.

27 unchanged sentences

Many states and local jurisdictions have consumer protection laws analogous, and in addition, to those enacted under federal law.

These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must deal with customers when taking deposits, making loans and conducting other types of transactions.

These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must deal with customers when taking deposits, making loans and

conducting other types of transactions.

Failure to comply with these laws and regulations could give rise to regulatory sanctions, customer rescission and registration rights, action by state and local attorneys general and civil or criminal liability.

2 unchanged sentences

The Dodd-Frank Act gives the CFPB authority to supervise and examine depository institutions with more than $10.0 billion in assets for compliance with these federal consumer laws.

authority to supervise and examine depository institutions with $10.0 billion or less in assets for compliance with federal consumer laws remains largely with those institutions’ primary regulators.

The authority to supervise and examine depository institutions with $10.0 billion or less in assets for compliance with federal consumer laws remains largely with those institutions’ primary regulators.

However, the CFPB may participate in examinations of these smaller institutions on a “sampling basis” and may refer potential enforcement actions against such institutions to their primary regulators.

6 unchanged sentences

Under the Dodd-Frank Act and related rules, financial institutions may not make a residential mortgage loan unless they make a “reasonable and good faith determination” that the consumer has a “reasonable ability” to repay the loan.

The Dodd-Frank Act allows borrowers to raise certain defenses to foreclosure but provides a full or partial safe harbor from such defenses for loans that are “qualified mortgages.” The rules define “qualified mortgages,” imposing both underwriting standards – for example, a borrower’s debt-to-income ratio may not exceed 43.0% – and limits on the terms of their loans.

Certain loans, including interest-only loans and negative amortization loans, cannot be qualified mortgages.

EGRRCPA, among other matters, expanded the definition of qualified mortgages for banks with less than $10 billion in assets.

The Dodd-Frank Act allows borrowers to raise certain defenses to foreclosure but provides a full or partial safe harbor from such defenses for loans that are “qualified mortgages.” The rules define “qualified mortgages” to have certain specified characteristics and prohibit certain loans, including interest only loans and negative amortization loans, from being qualified mortgages.

In 2021, the CFPB replaced the previous debt-to-income limitations with a revised qualified mortgage definition.

The revised qualified mortgage definition is based on the relationship of the loan’s annual percentage rate to the average prime offer rate.

Additionally, the CFPB has issued rules to implement requirements of the Dodd-Frank Act pertaining to mortgage loan origination and integrated mortgage disclosure rules.

Anti-Money Laundering and OFAC.

13 unchanged sentences

The federal banking regulators have adopted rules that limit the ability of banks and other financial institutions to disclose non-public information about consumers to non-affiliated third parties.

These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a non-affiliated third party.

These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain

personal information to a non-affiliated third party.

These regulations affect how consumer information is transmitted through financial services companies and conveyed to outside vendors.

25 unchanged sentences

Those providers, because they are not so highly regulated, may have a competitive advantage over us and may continue to draw large amounts of funds away from traditional banking institutions, with a continuing adverse effect on the banking industry in general.

Cybersecurity

We are subject to guidance and standards, as directed by federal law and prescribed by federal regulators, which necessitate the responsibility to secure nonpublic, confidential customer and consumer information and provide notice to such entities in the event their data is disclosed due to a security breach.

Under certain circumstances, federal and state regulators must also be notified in the event of a data breach as mandated by applicable state laws and federal regulations.

Financial institutions are expected to comply with such guidance and standards and to accordingly establish and employ appropriate information security and cybersecurity programs and associated risk management processes.

Cybersecurity risks are expected to increase due to the rapid evolution and sophistication of cybersecurity attacks and the accessibility of resources required for their execution.

In turn, Congress, multiple states, and federal regulators frequently issue new guidance and standards and are currently considering the enactment of additional or enhanced laws or

regulations which could impose increased obligations for companies responsible for the safeguarding of nonpublic, customer and consumer information, specifically financial institutions.

On November 23, 2021, federal banking agencies issued a joint final rule requiring financial institutions to provide notification to their primary federal regulator as soon as possible and no later than 36 hours after a “computer-security incident” has been determined to be a “notification event,” as those terms are defined under the final rule.

Additionally, the rule requires bank service providers to contact each affected banking organization customer as soon as possible once the bank service provider determines it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to such banking organizations for four or more hours.

On May 16, 2024, the SEC adopted an amendment to Regulation S-P requiring a covered institution to provide notice as soon as practicable, but not later than 30 days after becoming aware that an incident involving unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred.

The notice must include details about the incident, the breached data, and how affected individuals can respond to the breach to protect themselves.

Future Legislation and Regulatory Reform

5 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business