Bank7 Corp. 10-K

Item 1. Business Company Overview We are Bank7 Corp., a bank holding company headquartered in Oklahoma City, Oklahoma. Through our wholly-owned subsidiary, Bank7, we operate twelve full-service branches in Oklahoma, Texas, and Kansas. We were formed in 2004 in connection with our acquisition of First National Bank of Medford, which was renamed Bank7 (the “Bank”). We are focused on serving business owners and entrepreneurs by delivering fast, consistent and well-designed banking solutions. As of December 31, 2022, we had total assets of $1.58 billion, total loans of $1.26 billion, total deposits of $1.43 billion and total shareholders’ equity of $144.1 million. Our website is: www.bank7.com. We make available free of charge through our website, our annual report on Form 10-K, our quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports as soon as reasonably practicable after they have been electronically filed or furnished with the Securities and Exchange Commission. Information included on our website is not incorporated into this filing. Products and Services The Bank is a full-service commercial bank. We focus on the development of deep business relationships with our commercial customers and their principals. We also focus on providing customers with exceptional service and meeting their banking needs through a wide variety of commercial and retail financial services. The Bank has a particular focus in the following loan categories (i) commercial real estate lending, (ii) hospitality lending, (iii) energy lending, and (iv) commercial and industrial lending. Although it is a very small segment of the Bank, we also provide consumer lending services to individuals for personal and household purposes, including secured and unsecured term loans and home improvement loans. Consumer lending services include (i) residential real estate loans and mortgage banking services, (ii) personal lines of credit, (iii) loans for the purchase of automobiles, and (iv) other installment loans. The Bank offers deposit banking products, including (i) commercial deposit services, commercial checking, money market, and other deposit accounts, and (ii) retail deposit services such as certificates of deposit, money market accounts, checking accounts, negotiable order of withdrawal accounts, savings accounts, and automated teller machine access. Strategic Focus Our success is driven by: • the development of deep business relationships with our commercial customers and their principals; • disciplined growth without compromising our asset quality or credit culture; • drawing upon years of executive level experience at multi-billion dollar banks; • efficiencies gained by adherence to automated and repeatable processes; and • investing in our people and technology. We focus on our daily execution, making sound credit decisions and maintaining cost discipline, which is the foundation for our success. Our customers are our top priority and we focus on efficiently providing tailored banking products and services to business owners and entrepreneurs, with a goal of generating consistent growth and delivering exceptional returns to our shareholders. Additionally, we continually position ourselves for future growth both organically and through strategic acquisitions. 1 Table of Contents Cost Discipline and Efficiency We constantly monitor expenditures, and, when appropriate, we use automation, technology and repeatable processes to drive profitability. The Bank operates as few branches as practical, and the branches we do operate are smaller and very cost efficient. As we continue to grow, we expect our utilization of automation, technology, and repeatable processes will continue to drive efficiencies throughout the Bank. Combining talented people with process automation will enable us to scale even further, and will also enable us to deliver consistently superior customer service. Organic Growth Much of our historic asset growth has been driven organically and within our current markets. In particular the Dallas/Fort Worth metropolitan area, Oklahoma City, and Tulsa. Although our expansion with brick and mortar branches will be limited, we believe operating strategically placed branches will be important, and therefore we will continue to selectively build our presence in key markets. We currently operate twelve branches. We also intend to continually enhance our internet and mobile banking products to remain competitive in the marketplace. Markets We are headquartered in Oklahoma City, Oklahoma, and we operate seven additional branches in Oklahoma. We also operate two branches in the Dallas/Fort Worth metropolitan area and two branches in Kansas. Competition The banking and financial services industry is highly competitive, and we compete with a wide range of financial institutions within our markets, including local, regional and national commercial banks and credit unions. We also compete with mortgage companies, trust companies, brokerage firms, consumer finance companies, mutual funds, securities firms, insurance companies, third-party payment processors, financial technology, or Fintech, companies and other financial intermediaries for certain of our products and services. Some of our competitors are not subject to the regulatory restrictions and level of regulatory supervision applicable to us. Interest rates on loans and deposits, as well as prices on fee-based services, are typically significant competitive factors within the banking and financial services industry. Many of our competitors are much larger financial institutions that have greater financial resources than we do and compete aggressively for market share. These competitors attempt to gain market share through their financial product mix, pricing strategies and banking center locations. Other important competitive factors in our industry and markets include office locations and hours, quality of customer service, community reputation, continuity of personnel and services, capacity and willingness to extend credit, and ability to offer excellent banking products and services. While we seek to remain competitive with respect to fees charged, interest rates and pricing, we believe that our broad suite of financial solutions, our high-quality customer service culture, our positive reputation and our long-standing community relationships enable us to compete successfully within our markets and enhance our ability to attract and retain customers. Human Capital Our corporate culture is defined by core values which include integrity, accountability, professionalism, community-focus and efficiency. As of December 31, 2022, we had 123 full time employees. We value our employees by investing in competitive compensation and benefit packages and fostering a team environment centered on professional service and open communication. Attracting, retaining and developing qualified, engaged employees who embody these values are crucial our success. We offer all of our employees a comprehensive benefits package that includes medical, dental and vision insurance, a flexible spending plan, group life insurance, short-term and long-term disability insurance, a traditional 401(k) Plan, competitive paid time off/paid holidays, and competitive incentives. 2 Table of Contents We are committed and focused on the health and safety of our employees, customers, and communities and are committed to providing a safe and secure work environment in accordance with applicable labor, safety, health, anti-discrimination and other workplace laws. We strive for all of our employees to feel safe at work. To that end, we maintain a whistleblower hotline that allows associates and others to anonymously voice concerns. We prohibit retaliation against an individual who reported a concern or assisted with an inquiry or investigation. Supervision and Regulation The following is a general summary of the material aspects of certain statutes and regulations that are applicable to us. These summary descriptions are not complete. Please refer to the full text of the statutes, regulations, and corresponding guidance for more information. These statutes and regulations are subject to change, and additional statutes, regulations, and corresponding guidance may be adopted. We are unable to predict future changes or the effects, if any, that these changes could have on our business or our revenues. General We are extensively regulated under U.S. federal and state law. As a result, our growth and earnings performance may be affected not only by management decisions and general economic conditions, but also by federal and state statutes and by the regulations and policies of various bank regulatory agencies, including the Oklahoma Banking Department (“OBD”), the Federal Reserve, the Federal Deposit Insurance Corporation (“FDIC”) and the Consumer Financial Protection Bureau (“CFPB”). Furthermore, tax laws administered by the Internal Revenue Service (“IRS”) and state taxing authorities, accounting rules developed by the Financial Accounting Standards Board (“FASB”), securities laws administered by the Securities and Exchange Commission (“SEC”) and state securities authorities and Anti-Money Laundering (“AML”) laws enforced by the U.S. Department of the Treasury, or Treasury, also impact our business. Federal and state banking laws impose a comprehensive system of supervision, regulation and enforcement on the operations of banks, their holding companies and their affiliates. These laws are intended primarily for the protection of depositors, customers and the Depositor Insurance Fund of the FDIC (“DIF”) rather than for shareholders. Federal and state laws, and the related regulations of the bank regulatory agencies, affect, among other things, the scope of business, the kinds and amounts of investments banks may make, reserve requirements, capital levels relative to operations, the nature and amount of collateral for loans, the establishment of branches, the ability to merge, consolidate and acquire, dealings with insiders and affiliates and the payment of dividends. This supervisory and regulatory framework subjects banks and bank holding companies to regular examination by their respective regulatory agencies, which results in examination reports and ratings that, while not publicly available, can affect the conduct and growth of their businesses. These examinations consider not only compliance with applicable laws and regulations, but also capital levels, asset quality and risk, management’s ability and performance, earnings, liquidity and various other factors. These regulatory agencies have broad discretion to impose restrictions and limitations on the operations of a regulated entity and exercise enforcement powers over a regulated entity (including terminating deposit insurance, imposing orders, fines and other civil and criminal penalties, removing officers and directors and appointing supervisors and conservators) where the agencies determine, among other things, that such operations are unsafe or unsound, fail to comply with applicable law or are otherwise inconsistent with laws and regulations or with the supervisory policies of these agencies. 3 Table of Contents Regulatory Capital Requirements The federal banking agencies require that banking organizations meet several risk-based capital adequacy requirements. The current risk-based capital standards applicable to the Company and the Bank are based on the Basel III Capital Rules established by the Basel Committee on Banking Supervision (the “Basel Committee”). The Basel Committee is a committee of central banks and bank supervisors/regulators from the major industrialized countries that develops broad policy guidelines for use by each country’s supervisors in determining the supervisory policies they apply. The requirements are intended to ensure that banking organizations have adequate capital given the risk levels of assets and off-balance sheet financial instruments. The Basel III Capital Rules require the Bank and the Company to comply with four minimum capital standards: a Tier 1 leverage ratio of at least 4.0%; a CET1 to risk-weighted assets ratio of 4.5%; a Tier 1 capital to risk-weighted assets ratio of at least 6.0%; and a total capital to risk-weighted assets ratio of at least 8.0%. The calculation of all types of regulatory capital is subject to definitions, deductions and adjustments specified in the regulations. The Basel III Capital Rules also require a “capital conservation buffer” of 2.5% above the regulatory minimum risk-based capital requirements. The capital conservation buffer is designed to absorb losses during periods of economic stress and effectively increases the minimum required risk-weighted capital ratios. Banking institutions with a ratio of CET1 to risk-weighted assets below the effective minimum (4.5% plus the capital conservation buffer) is subject to limitations on certain activities, including payment of dividends, share repurchases and discretionary bonuses to executive officers based on the amount of the shortfall. As of December 31, 2022, the Company’s and the Bank’s capital ratios exceeded the minimum capital adequacy guideline percentage requirements under the Basel III Capital Rules on a fully phased-in basis. Prompt Corrective Action The Federal Deposit Insurance Act requires federal banking agencies to take “prompt corrective action” with respect to depository institutions that do not meet minimum capital requirements. For purposes of prompt corrective action, the law establishes five capital tiers: “well-capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” A depository institution’s capital tier depends on its capital levels and certain other factors established by regulation. Under the applicable FDIC regulations, an institution is deemed to be “well-capitalized” if it has a total risk-based capital ratio of 10.0% or greater, a Tier 1 risk-based capital ratio of 8.0% or greater, a CET1 ratio of 6.5% or greater and a leverage ratio of 5.0% or greater. At each lower capital category, a bank is subject to increased restrictions on its operations. For example, a bank is generally prohibited from making capital distributions and paying management fees to its holding company if doing so would make the bank “undercapitalized.” Asset growth and branching restrictions apply to undercapitalized banks, which are required to submit written capital restoration plans meeting specified requirements (including a guarantee by the parent holding company, if any). “Significantly undercapitalized” banks are subject to broad regulatory restrictions, including among other things, capital directives, forced mergers, restrictions on the rates of interest they may pay on deposits, restrictions on asset growth and activities, and prohibitions on paying bonuses or increasing compensation to senior executive officers without FDIC approval. “Critically undercapitalized” are subject to even more severe restrictions, including, subject to a narrow exception, the appointment of a conservator or receiver within 90 days after becoming critically undercapitalized. The appropriate federal banking agency may determine (after notice and opportunity for a hearing) that the institution is in an unsafe or unsound condition or deems the institution to be engaging in an unsafe or unsound practice. The appropriate agency is also permitted to require an adequately capitalized or undercapitalized institution to comply with the supervisory provisions as if the institution were in the next lower category (but not treat a significantly undercapitalized institution as critically undercapitalized) based on supervisory information other than the capital levels of the institution. 4 Table of Contents The capital classification of a bank affects the frequency of regulatory examinations, the bank’s ability to engage in certain activities and the deposit insurance premium paid by the bank. A bank’s capital category is determined solely for the purpose of applying prompt correct action regulations and the capital category may not accurately reflect the bank’s overall financial condition or prospects. As of December 31, 2022, the Bank met the requirements for being deemed “well-capitalized” for purposes of the prompt corrective action regulations. The Company General . As a bank holding company, the Company is subject to regulation and supervision by the Federal Reserve under the Bank Holding Company Act of 1956, as amended, or the BHCA. Under the BHCA, the Company is subject to periodic examination by the Federal Reserve. The Company is required to file with the Federal Reserve periodic reports of its operations and such additional information as the Federal Reserve may require. Acquisitions, Activities and Change in Control . The BHCA generally requires the prior approval by the Federal Reserve for any merger involving a bank holding company or a bank holding company’s acquisition of more than 5% of a class of voting securities of any additional bank or bank holding company or to acquire all or substantially all of the assets of any additional bank or bank holding company. Subject to certain conditions (including deposit concentration limits established by the BHCA and the Dodd-Frank Act), the Federal Reserve may allow a bank holding company to acquire banks located in any state of the United States. Federal law also prohibits any person or company from acquiring “control” of an FDIC-insured depository institution or its holding company without prior notice to the appropriate federal bank regulator. Permitted Activities . The BHCA generally prohibits the Company from controlling or engaging in any business other than that of banking, managing and controlling banks or furnishing services to banks and their subsidiaries. This general prohibition is subject to a number of exceptions. The principal exception allows bank holding companies to engage in, and to own shares of companies engaged in, certain businesses found by the Federal Reserve prior to November 11, 1999 to be “so closely related to banking as to be a proper incident thereto.” This authority would permit the Company to engage in a variety of banking-related businesses, including the ownership and operation of a savings association, or any entity engaged in consumer finance, equipment leasing, the operation of a computer service bureau (including software development) and mortgage banking and brokerage. The BHCA generally does not place territorial restrictions on the domestic activities of nonbank subsidiaries of bank holding companies. The Federal Reserve has the power to order any bank holding company or its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the Federal Reserve has reasonable grounds to believe that continuing such activity, ownership or control constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company. Source of Strength . Federal Reserve policy historically required bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. The Dodd-Frank Act codified this policy as a statutory requirement. Under this requirement the Company is expected to commit resources to support the Bank, including at times when the Company may not be in a financial position to provide it. The Company must stand ready to use its available resources to provide adequate capital to the Bank during periods of financial stress or adversity. The Company must also maintain the financial flexibility and capital raising capacity to obtain additional resources for assisting the Bank. The Company’s failure to meet its source of strength obligations may constitute an unsafe and unsound practice or a violation of the Federal Reserve’s regulations or both. The source of strength obligation most directly affects bank holding companies where a bank holding company’s subsidiary bank fails to maintain adequate capital levels. Any capital loans by a bank holding company to the subsidiary bank are subordinate in right of payment to deposits and to certain other indebtedness of the subsidiary bank. The BHCA provides that in the event of a bank holding company’s bankruptcy any commitment by a bank holding company to a federal bank regulatory agency to maintain the capital of its subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment. 5 Table of Contents Safe and Sound Banking Practices . Bank holding companies and their non-banking subsidiaries are prohibited from engaging in activities that represent unsafe and unsound banking practices or that constitute a violation of law or regulations. Under certain conditions the Federal Reserve may conclude that certain actions of a bank holding company, such as a payment of a cash dividend, would constitute an unsafe and unsound banking practice. The Federal Reserve also has the authority to regulate the debt of bank holding companies, including the authority to impose interest rate ceilings and reserve requirements on such debt. Under certain circumstances the Federal Reserve may require a bank holding company to file written notice and obtain its approval prior to purchasing or redeeming its equity securities, unless certain conditions are met. Dividend Payments, Stock Redemptions and Repurchases . The Company’s ability to pay dividends to its shareholders is affected by both general corporate law considerations and the regulations and policies of the Federal Reserve applicable to bank holding companies, including the Basel III Capital Rules. Generally, an Oklahoma corporation may not make distributions to its shareholders if (i) after giving effect to the dividend, the corporation would be insolvent, or (ii) the amount of the dividend exceeds the surplus of the corporation. Dividends may be declared and paid in a corporation’s own treasury shares that have been reacquired by the corporation out of surplus. Dividends may be declared and paid in a corporation’s own authorized but unissued shares out of the surplus of the corporation upon the satisfaction of certain conditions. It is the Federal Reserve’s policy that bank holding companies should generally pay dividends on common stock only out of income available over the past year, and only if prospective earnings retention is consistent with the organization’s expected future needs and financial condition. It is also the Federal Reserve’s policy that bank holding companies should not maintain dividend levels that undermine their ability to be a source of strength to its banking subsidiaries. Additionally, the Federal Reserve has indicated that bank holding companies should carefully review their dividend policy and has discouraged payment ratios that are at maximum allowable levels unless both asset quality and capital are very strong. Bank holding companies must consult with the Federal Reserve before redeeming any equity or other capital instrument included in Tier 1 or Tier 2 capital (or, for small bank holding companies like the Company, before redeeming any instruments included in equity as defined under GAAP) prior to stated maturity, if such redemption could have a material effect on the level or composition of the organization’s capital base. In addition, bank holding companies are unable to repurchase shares equal to 10% or more of its net worth if it would not be well-capitalized (as defined by the Federal Reserve) after giving effect to such repurchase. Bank holding companies experiencing financial weaknesses, or that are at significant risk of developing financial weaknesses, must consult with the Federal Reserve before redeeming or repurchasing common stock or other regulatory capital instruments. The Bank General . The Bank is an Oklahoma-chartered member bank and is subject to examination, supervision and regulation by the OBD and the Federal Reserve. The Bank is also subject to certain regulations of the FDIC and the CFPB. The OBD supervises and regulates all areas of the Bank’s operations including, without limitation, the making of loans, the issuance of securities, the conduct of the Bank’s corporate affairs, the satisfaction of capital adequacy requirements, the payment of dividends, and the establishment or closing of banking offices. The Federal Reserve is the Bank’s primary federal regulatory agency, and periodically examines the Bank’s operations and financial condition and compliance with federal law. In addition, the Bank’s deposit accounts are insured by the DIF to the maximum extent provided under federal law and FDIC regulations, and the FDIC has certain enforcement powers over the Bank. Depositor Preference . In the event of the “liquidation or other resolution” of an insured depository institution, the claims of depositors of the institution, including the claims of the FDIC as subrogee of insured depositors, and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution. If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors including the parent bank holding company with respect to any extensions of credit they have made to that insured depository institution. 6 Table of Contents Deposit Insurance . As an FDIC-insured institution, the Bank is required to pay deposit insurance premiums to the FDIC. The amount of such premiums is determined by multiplying the institution’s assessment rate by its assessment base. The assessment base is based on the institution’s risk classification which is assigned based on the institution’s capital levels and the level of supervisory concern the institution poses to the regulators. The assessment rate is calculated as the institution’s average consolidated total assets minus average tangible equity. Additionally, the Dodd-Frank Act altered the minimum designated reserve ratio of the DIF, increasing the minimum from 1.15% to 1.35% of the estimated amount of total insured deposits, and eliminating the requirement that the FDIC pay dividends to depository institutions when the reserve ratio exceeds certain thresholds. At least semi-annually, the FDIC updates its loss and income projections for the DIF and, if needed, may increase or decrease the assessment rates, following notice and comment on proposed rulemaking. As a result, the Bank’s FDIC deposit insurance premiums could increase. Examination Assessments . Oklahoma-chartered banks are required to pay an annual fee of $1,000 to the OBD to fund its operations. In addition, Oklahoma-chartered banks are charged an examination assessment calculated based on the amount of the Bank’s assets at rates established by the Oklahoma Banking Board. During the year ended December 31, 2022, the Bank paid examination assessments to the OBD totaling $184,000. Capital Requirements . Banks are generally required to maintain minimum capital ratios. For a discussion of the capital requirements applicable to the Bank, see “—Regulatory Capital Requirements” above. Bank Reserves . The Federal Reserve requires all depository institutions to maintain reserves against some transaction accounts (primarily NOW and Super NOW checking accounts). The balances maintained to meet the reserve requirements imposed by the Federal Reserve may be used to satisfy liquidity requirements. An institution may borrow from the Federal Reserve “discount window” as a secondary source of funds if the institution meets the Federal Reserve’s credit standards. Dividend Payments . The primary source of funds for the Company is dividends from the Bank. Unless the approval of the Federal Reserve is obtained, the Bank may not declare or pay a dividend if the total of all dividends declared during the calendar year, including the proposed dividend, exceeds the sum of the Bank’s net income during the current calendar year and the retained net income of the prior two calendar years. Oklahoma law also places restrictions on the declaration of dividends by Oklahoma state-chartered banks, including the Bank, to their shareholders. Before any dividend may be declared by the Bank, not less than 10% of the net profits of the Bank must be transferred to a surplus fund until the surplus equals 100% of the Bank’s capital stock. This may decrease any amount available for the payment of dividends in a particular period if the surplus funds for the Bank fail to comply with this limitation. Furthermore, the approval of the Commissioner of the OBD is required if the total of all dividends declared by the Bank in any calendar year exceed the total of its net profits of that year combined with its retained net profits of the preceding two years, less any required transfers to surplus or a fund for the retirement of any preferred stock. The Federal Reserve and the OBD also may, under certain circumstances, prohibit the payment of dividends to us from the Bank. Oklahoma corporate law also requires that dividends can only be paid out of funds legally available therefor. The payment of dividends by any financial institution is affected by the requirement to maintain adequate capital pursuant to applicable capital adequacy guidelines and regulations, and a financial institution generally is prohibited from paying any dividends if, following payment thereof, the institution would be undercapitalized. As described above, the Bank exceeded its minimum capital requirements under applicable regulatory guidelines as of December 31, 2022. 7 Table of Contents Transactions with Affiliates . The Bank is subject to sections 23A and 23B of the Federal Reserve Act, or the Affiliates Act, and the Federal Reserve’s implementing Regulation W. An affiliate of a bank is any company or entity that controls, is controlled by or is under common control with the bank. Accordingly, transactions between the Company, the Bank and any non-bank subsidiaries will be subject to a number of restrictions. The Affiliates Act imposes restrictions and limitations on the Bank from making extensions of credit to, or the issuance of a guarantee or letter of credit on behalf of, the Company or other affiliates, the purchase of, or investment in, stock or other securities thereof, the taking of such securities as collateral for loans, and the purchase of assets of the Company or other affiliates. Such restrictions and limitations prevent the Company or other affiliates from borrowing from the Bank unless the loans are secured by marketable obligations of designated amounts. Furthermore, such secured loans and investments by the Bank to or in the Company or to or in any other non-banking affiliate are limited, individually, to 10% of the Bank’s capital and surplus, and such transactions are limited in the aggregate to 20% of the Bank’s capital and surplus. All such transactions, as well as contracts entered into between the Bank and affiliates, must be on terms that are no less favorable to the Bank than those that would be available from non-affiliated third parties. Federal Reserve policies also forbid the payment by bank subsidiaries of management fees which are unreasonable in amount or exceed the fair market value of the services rendered or, if no market exists, actual costs plus a reasonable profit. Loans to Directors, Executive Officers and Principal Shareholders . The authority of the Bank to extend credit to its directors, executive officers and principal shareholders, including their immediate family members and corporations and other entities that they control, is subject to substantial restrictions and requirements under the Federal Reserve’s Regulation O, as well as the Sarbanes-Oxley Act. These statutes and regulations impose limits the amount of loans the Bank may make to directors and other insiders and require that the loans must be made on substantially the same terms, including interest rates and collateral, as prevailing at the time for comparable transactions with persons not affiliated with the Company or the Bank, that the Bank must follow credit underwriting procedures at least as stringent as those applicable to comparable transactions with persons who are not affiliated with the Company or the Bank; and that the loans must not involve a greater than normal risk of non-payment or include other features not favorable to the Bank. Furthermore, the Bank must periodically report all loans made to directors and other insiders to the bank regulators. As of December 31, 2022, the Bank had no lines of credit for loans to insiders and one loan outstanding to insiders of $132,000. Limits on Loans to One Borrower . As an Oklahoma state-chartered bank, the Bank is subject to limits on the amount of loans it can make to one borrower. With certain limited exceptions, loans and extensions of credit from Oklahoma state-chartered banks outstanding to any borrower (including certain related entities of the borrower) at any one time may not exceed 30% of the capital, less intangible assets, of the bank. An Oklahoma state-chartered bank may lend an additional amount if the loan is fully secured by certain types of collateral, like bonds or notes of the United States. Certain types of loans are exempted from the lending limits, including loans secured by segregated deposits held by the bank. The Bank’s legal lending limit to any one borrower was $47.4 million as of December 31, 2022. Safety and Soundness Standards/Risk Management . The federal banking agencies have adopted guidelines establishing operational and managerial standards to promote the safety and soundness of federally insured depository institutions. The guidelines set forth standards for internal controls, information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, compensation, fees and benefits, asset quality and earnings. If an institution fails to comply with any of the standards set forth in the guidelines, the financial institution’s primary federal regulator may require the institution to submit a plan for achieving and maintaining compliance. If a financial institution fails to submit an acceptable compliance plan, or fails in any material respect to implement a compliance plan that has been accepted by its primary federal regulator, the regulator is required to issue an order directing the institution to cure the deficiency. Until the deficiency cited in the regulator’s order is cured, the regulator may restrict the financial institution’s rate of growth, require the financial institution to increase its capital, restrict the rates the institution pays on deposits or require the institution to take any action the regulator deems appropriate under the circumstances. Noncompliance with the standards established by the safety and soundness guidelines may also constitute grounds for other enforcement action by the federal bank regulatory agencies, including cease and desist orders and civil money penalty assessments. 8 Table of Contents Branching Authority . New branches must be approved by the Federal Reserve and the OBD, which consider a number of factors, including financial history, capital adequacy, earnings prospects, character of management, needs of the community and consistency with corporate power. The Dodd-Frank Act permits insured state banks to engage in interstate branching if the laws of the state where the new banking office is to be established would permit the establishment of the banking office if it were chartered by a bank in such state. Finally, we may also establish banking offices in other states by merging with banks or by purchasing banking offices of other banks in other states, subject to certain restrictions. Interstate Deposit Restrictions . The Interstate Act, together with the Dodd-Frank Act, relaxed prior branching restrictions under federal law by permitting, subject to regulatory approval, banks to establish branches in states where the laws permit banks chartered in such states to establish branches. Section 109 of the Interstate Act prohibits a bank from establishing or acquiring a branch or branches outside of its home state primarily for the purpose of deposit production. Community Reinvestment Act . The CRA directs the federal bank regulatory agencies, in examining insured depository institutions, to assess their record of helping to meet the credit needs of their entire community, including low- and moderate- income neighborhoods, consistent with safe and sound banking practices. The CRA further requires the agencies to take a financial institution’s record of meeting its community credit needs into account when evaluating applications for, among other things, domestic branches, consummating mergers or acquisitions or holding company formations. The federal banking agencies have adopted regulations which measure a bank’s compliance with its CRA obligations on a performance-based evaluation system. This system bases CRA ratings on an institution’s actual lending service and investment performance rather than the extent to which the institution conducts needs assessments, documents community outreach or complies with other procedural requirements. The ratings range from a high of “outstanding” to a low of “substantial noncompliance.” The Bank had a CRA rating of “satisfactory” as of its most recent CRA assessment. Anti-Money Laundering and the Office of Foreign Assets Control Regulation . The USA PATRIOT Act is designed to deny terrorists and criminals the ability to obtain access to the U.S. financial system and has significant implications for depository institutions, brokers, dealers and other businesses involved in the transfer of money. The USA PATRIOT Act substantially broadened the scope of United States AML laws and regulations by imposing significant compliance and due diligence obligations, created new crimes and penalties and expanded the extra territorial jurisdiction of the United States. Financial institutions are also prohibited from entering into specified financial transactions and account relationships, must use enhanced due diligence procedures in their dealings with certain types of high-risk customers and must implement a written customer identification program. Financial institutions must take certain steps to assist government agencies in detecting and preventing money laundering and report certain types of suspicious transactions. Regulatory authorities routinely examine financial institutions for compliance with these obligations and have imposed cease and desist orders and civil money penalties against institutions found to be in violation of these obligations. Likewise, OFAC administers and enforces economic and trade sanctions against targeted foreign countries and regimes under authority of various laws, including designated foreign countries, nationals and others. OFAC publishes lists of specially designated targets and countries. Financial institutions are responsible for, among other things, blocking accounts of and transactions with such targets and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence. Failure of a financial institution to maintain and implement adequate AML and OFAC programs, or to comply with all of the relevant laws or regulations, could have serious legal and reputational consequences for the institution, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required. 9 Table of Contents Consumer Financial Services We are subject to a number of federal and state consumer protection laws that extensively govern our relationship with our customers. These laws include the ECOA, the Fair Credit Reporting Act, the Truth in Lending Act, the Truth in Savings Act, the Electronic Fund Transfer Act, the Expedited Funds Availability Act, the Home Mortgage Disclosure Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Fair Debt Collection Practices Act, the Service Members Civil Relief Act, the Military Lending Act, and these laws’ respective state law counterparts, as well as state usury laws and laws regarding unfair and deceptive acts and practices. These and other federal laws, among other things, require disclosures of the cost of credit and terms of deposit accounts, provide substantive consumer rights, prohibit discrimination in credit transactions, regulate the use of credit report information, provide financial privacy protections, prohibit unfair, deceptive and abusive practices and subject us to substantial regulatory oversight. Violations of applicable consumer protection laws can result in significant potential liability from litigation brought by customers, including actual damages, restitution and attorneys’ fees. Federal bank regulators, state attorneys general and state and local consumer protection agencies may also seek to enforce consumer protection requirements and obtain these and other remedies, including regulatory sanctions, customer rescission rights, action by the state and local attorneys general in each jurisdiction in which we operate and civil money penalties. Failure to comply with consumer protection requirements may also result in failure to obtain any required bank regulatory approval for mergers or acquisitions or prohibition from engaging in such transactions even if approval is not required. Rulemaking authority for most federal consumer protection laws was transferred from the prudential regulators to the CFPB on July 21, 2011. In some cases, regulators such as the Federal Trade Commission and the DOJ also retain certain rulemaking or enforcement authority. The CFPB also has broad authority to prohibit unfair, deceptive and abusive acts and practices, or UDAAP, and to investigate and penalize financial institutions that violate this prohibition. While the statutory language of the Dodd-Frank Act sets forth the standards for acts and practices that violate the prohibition on UDAAP, certain aspects of these standards are untested, and thus it is currently not possible to predict how the CFPB will exercise this authority. The consumer protection provisions of the Dodd-Frank Act and the examination, supervision and enforcement of those laws and implementing regulations by the CFPB have created a more intense and complex environment for consumer finance regulation. The CFPB has significant authority to implement and enforce federal consumer protection laws and new requirements for financial services products provided for in the Dodd-Frank Act, as well as the authority to identify and prohibit UDAAP. The review of products and practices to prevent such acts and practices is a continuing focus of the CFPB, and of banking regulators more broadly. The ultimate impact of this heightened scrutiny is uncertain but could result in changes to pricing, practices, products and procedures. It could also result in increased costs related to regulatory oversight, supervision and examination, additional remediation efforts and possible penalties. In addition, the Dodd-Frank Act provides the CFPB with broad supervisory, examination and enforcement authority over various consumer financial products and services, including the ability to require reimbursements and other payments to customers for alleged legal violations and to impose significant penalties, as well as injunctive relief that prohibits lenders from engaging in allegedly unlawful practices. The CFPB also has the authority to obtain cease and desist orders providing for affirmative relief or monetary penalties. The Dodd-Frank Act does not prevent states from adopting stricter consumer protection standards. State regulation of financial products and potential enforcement actions could also adversely affect our business, financial condition or results of operations. The CFPB has examination and enforcement authority over providers with more than $10 billion in assets. Banks and savings institutions with $10 billion or less in assets, like the Bank, will continue to be examined by their applicable bank regulators. 10 Table of Contents Federal Banking Agency Incentive Compensation Guidance The federal bank regulatory agencies have issued comprehensive guidance intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of those organizations by encouraging excessive risk-taking. The incentive compensation guidance sets expectations for banking organizations concerning their incentive compensation arrangements and related risk-management, control and governance processes. The incentive compensation guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon three primary principles: (1) balanced risk-taking incentives; (2) compatibility with effective controls and risk management; and (3) strong corporate governance. Any deficiencies in compensation practices that are identified may be incorporated into the organization’s supervisory ratings, which can affect its ability to make acquisitions or take other actions. In addition, under the incentive compensation guidance, a banking organization’s federal supervisor may initiate enforcement action if the organization’s incentive compensation arrangements pose a risk to the safety and soundness of the organization. Further, the Basel III capital rules limit discretionary bonus payments to bank executives if the institution’s regulatory capital ratios fail to exceed certain thresholds. Although the federal bank regulatory agencies proposed additional rules in 2016 related to incentive compensation for all banks with more than $1.0 billion in assets, which would include the Company and the Bank, those rules have not been finalized and the scope and content of the U.S. banking regulators’ policies on executive compensation are continuing to develop and are likely to continue evolving in the near future. Financial Privacy The federal bank regulatory agencies have adopted rules that limit the ability of banks and other financial institutions to disclose non-public information about consumers to non-affiliated third parties. These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a non-affiliated third party. These regulations affect how consumer information is transmitted through financial services companies and conveyed to outside vendors. In addition, consumers may also prevent disclosure of certain information among affiliated companies that is assembled or used to determine eligibility for a product or service, such as that shown on consumer credit reports and asset and income information from applications. Consumers also have the option to direct banks and other financial institutions not to share information about transactions and experiences with affiliated companies for the purpose of marketing products or services. Cybersecurity Banking institutions are required to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures for the protection of confidential and personal information are in effect across our lines of business. Furthermore, the federal banking regulators regularly issue guidance regarding cybersecurity intended to enhance cyber risk management. A financial institution is expected to implement multiple lines of defense against cyber-attacks and ensure that their risk management procedures address the risk posed by potential cyber threats. A financial institution is further expected to maintain procedures to effectively respond to a cyber-attack and resume operations following any such attack. The Bank has adopted and implemented policies and procedures to comply with privacy, information security, and cybersecurity requirements. On November 18, 2021, the federal banking agencies issued a new rule effective in 2022 that requires banks to notify their regulators within 36 hours of a “computer-security incident” that rises to the level of a “notification incident.” Impact of Monetary Policy The monetary policy of the Federal Reserve has a significant effect on the operating results of financial or bank holding companies and their subsidiaries. Among the tools available to the Federal Reserve to affect the money supply are open market transactions in U.S. government securities, changes in the discount rate on member bank borrowings and changes in reserve requirements against member bank deposits. These tools are used in varying combinations to influence overall growth and distribution of bank loans, investments and deposits, and their use may affect interest rates charged on loans or paid on deposits. 11 Table of Contents Changes in Laws, Regulations or Policies Other legislative and regulatory initiatives which could affect the Company, the Bank and the banking industry in general may be pending, proposed or introduced before the U.S. Congress, the Oklahoma Legislature and other governmental bodies from time to time. Such proposals, if enacted, may further alter the structure, regulation and competitive relationship among financial institutions, and may subject the Company or the Bank to increased regulation, disclosure and reporting requirements. In addition, the various banking regulatory agencies often adopt new rules and regulations to implement and enforce existing legislation. It cannot be predicted whether, or in what form, any such legislation or regulations may be enacted or the extent to which the business of the Company or the Bank would be affected thereby.