What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2023-02-28 compared with 2022-02-28 · 57 added, 51 removed, 212 unchanged (34% of the section changed)

5 unchanged sentences

Cass solutions include integrated payments, a B2B payment platform for clients that require an agile fintech partner.

Additionally, the Company offers an on-line platform to provide generosity services for faith-based and non-profit organizations.

Additionally, the Company offers a church management software solution and an on-line platform to provide generosity services for faith-based and non-profit organizations.

The Company’s bank subsidiary, Cass Commercial Bank (the “Bank”), supports the Company’s payment operations.

The Bank also provides banking services to its target markets, which include privately-owned businesses and faith-based ministries in the St.

Louis metropolitan area as well as other selected cities in the United States.

The Bank also provides banking services to its target markets, which include privately held businesses in the St.

Louis metropolitan area and restaurant franchises and faith-based ministries within the United States.

Company Strategy and Core Competencies

32 unchanged sentences

The Company, through its Waste Expense Management business competes against small expense management companies along with large national account programs of major haulers.

The Company division known as Gyve Generosity Services uses an on-line platform to provide generosity services for faith-based and non-profit organizations, which is a complementary service offering to the Bank’s faith-based customers.

Also, the Company through its Integrated Payments business competes with providers of corporate payment solutions.

The Company division known as TouchPoint offers a church management software solution and an on-line platform to provide generosity services for faith-based and non-profit organizations, which is a complementary service offering to the Bank’s faith-based customers.

Also, the Company, through its CassPay operation, competes with providers of corporate payment solutions.

The Bank is organized as a Missouri trust company with banking powers and was founded in 1906.

10 unchanged sentences

The Bank’s principal competitors, however, are large bank holding companies that are able to offer a wide range of banking and related services through extensive branch networks.

The Bank targets its services to privately held businesses located in the St.

Louis, Missouri area and faith-based ministries located in St.

The Bank targets its services to privately held businesses, restaurant franchises, and faith-based ministries located in St.

Louis, Missouri and other selected cities located throughout the United States.

1 unchanged sentence

These include:

FreightPay®, Transdata®, Ratemaker®, Best Rate®, Rate Exchange®, CassPort®, Cass Freight Index®, Cass Truckload Linehaul Index®, Cass Intermodal Price Index® Expense$mart®, ExpenseSmart®, WasteVision™ and Direct2Carrier Payments™.

The Company holds patents for methods and systems for managing employee-liable expenses and methods and systems for communicating expense management information.

15 unchanged sentences

Additionally, the Company supports a number of organizations with annual financial contributions.

Cass strives to place the health and well-being of employees above all else.

Never has this been more necessary than during the novel coronavirus (“COVID-19”) pandemic.

In response to the COVID-19 pandemic, the Company has taken significant steps to protect the health and well-being of employees and clients.

These steps include implementing a work-from-home policy for the majority of employees and establishing safety guidelines in facilities based on guidance from the U.S.

Centers for Disease Control and Prevention ("CDC").

The Company recognizes the benefits of building a corporate culture that promotes diversity, equity and inclusion ("DEI") to foster unique ideas and ways of thinking.

3 unchanged sentences

and c) ensuring leadership commitment in facilitating the Company's DEI efforts.

In January 2022, the Company created a DEI Committee.

The DEI Committee was formed after a thorough process of determining a charter and is actively in the process of expanding the Company's DEI vision.

The committee members are passionate about DEI efforts and represent the Company's various business divisions and corporate departments.

The Company continues to promote DEI within its culture and make improvements to human resources programs to support related initiatives.

As of December 31, 2022, 70% of the Company's U.S.

employees were female, and 23% were ethnically diverse.

Within the management group, 47% were female, and 16% were ethnically diverse.

Over the past year, the Company has continued to support and provide diversity training to all employees.

The Company continues its commitment to providing a workplace that is free of harassment and discrimination by taking proactive measures and providing all employees with non-discrimination and sexual harassment prevention training on an annual basis.

The DEI initiatives will continue to be supported and promoted to provide all employees a place where they feel welcomed, appreciated and valued.

Equal opportunities, anti-harassment, non-discrimination, the health and safety of employees and work-life balance are actively promoted as more fully described in the Company's Environmental, Social, and Governance report.

Supervision and Regulation

13 unchanged sentences

A financial holding company’s status will also depend upon it maintaining its status as “well capitalized” and “well managed’ under applicable FRB regulations.

If a financial holding company ceases to meet these capital and management requirements, the FRB may impose limitations or conditions on the conduct of its activities during the non-compliance period, and the company may not commence any of the broader financial activities permissible for financial holding companies or acquire a company engaged in such financial activities without prior approval of the FRB.

If a financial holding company ceases to meet these capital and management requirements, the FRB may impose limitations or conditions on the conduct of its

activities during the non-compliance period, and the company may not commence any of the broader financial activities permissible for financial holding companies or acquire a company engaged in such financial activities without prior approval of the FRB.

If the company does not return to compliance within 180 days, the FRB may require divestiture of the holding company’s depository institutions.

12 unchanged sentences

The payment of dividends by the Company and the Bank may also be affected or limited by other factors, such as the requirement to maintain adequate capital and, under certain circumstances, the ability of federal regulators to prohibit dividend payments as an unsound or unsafe practice.

In July 2019, the federal bank regulators adopted final rules (the “Capital Simplifications Rules”) applicable to banks, like Cass, that are not subject to the advanced approaches capital framework that applies to large, internationally active banking organizations with at least $250 billion in total consolidated assets or at least $10 billion in total on-balance sheet foreign exposure.

Among other things, the Capital Simplifications Rules eliminated the standalone Federal Reserve prior approval requirement in the Basel III Capital Rules for any repurchase of common stock.

In certain circumstances, the Company’s repurchases of its common stock may be subject to a prior approval or notice requirement under other regulations, policies or supervisory expectations of the Federal Reserve Board.

From time to time, the Company's Board of Directors has authorized stock repurchase plans.

Bank holding companies must consult with the Federal Reserve before redeeming any equity or other capital instrument included in tier 1 or tier 2 capital prior to stated maturity, if such redemption could have a material effect on the level or composition of the organization’s capital base.

In addition, a bank holding company is unable to repurchase shares equal to 10% or more of its net worth if it would not be well-capitalized (as defined by the Federal Reserve) after giving effect to such repurchase.

Bank holding companies experiencing financial weaknesses, or that are at significant risk of developing financial weaknesses, must consult with the Federal Reserve before redeeming or repurchasing common stock or other regulatory capital instruments.

In August 2022, the Inflation Reduction Act of 2022 (the “Inflation Reduction Act") was enacted.

Among other things, the Inflation Reduction Act imposes a new 1% excise tax on the fair market value of stock repurchased after December 31, 2022 by publicly traded U.S.

corporations.

With certain exceptions, the value of stock repurchased is determined net of stock issued in the year, including shares issued pursuant to compensatory arrangements.

Capital Requirements – As a bank holding company, the Company and the Bank are subject to capital requirements pursuant to the FRB’s capital guidelines which include (i) risk-based capital guidelines, which are designed to make capital requirements more sensitive to various risk profiles and account for off-balance sheet exposure;

2 unchanged sentences

The Basel III Capital Rules require the Company and the Bank to maintain the following:

• a minimum ratio of common equity Tier 1 capital to risk-weighted assets of at least 4.5%, plus a 2.5% capital conservation buffer (resulting in a minimum common equity Tier 1 capital ration of 7.0%);

• a minimum ratio of Tier 1 capital to risk-weighted assets of at least 6.0%, plus a 2.5% capital conservation buffer (resulting in a minimum Tier 1 capital ratio of 8.5%);

9 unchanged sentences

Also included in Tier 2 capital is the allowance for credit losses limited to a maximum of 1.25% of risk-weighted assets and, for non-advanced approaches institutions like Cass that have exercised a one-time opt-out election regarding the treatment of Accumulated Other Comprehensive Income (“AOCI”), up to 45% of net unrealized gains on available-for-sale equity securities with readily determinable fair market values.

The calculation of all types of regulatory capital is subject to deductions and adjustments specified in applicable regulations.

The calculation of all types of regulatory capital is subject to deductions and adjustments specified in the regulations.

5 unchanged sentences

government securities, a risk weight of 50% is generally assigned to prudently underwritten first lien one to four-family residential mortgages, a risk weight of 100% is assigned to commercial and consumer loans, a risk weight of 150% is assigned to certain past due loans, and a risk weight of between 0% to 600% is assigned to permissible equity interests, depending on certain specified factors.

In February 2019, the federal bank regulatory agencies issued a final rule (the “2019 CECL Rule”) that revised certain capital regulations to account for changes to credit loss accounting under U.S.

The 2019 CECL Rule included a transition option that allows banking organizations to phase in, over a three-year period, the day-one adverse effects of adopting a new accounting standard related to the measurement of current expected credit losses (“CECL”) on their regulatory capital ratios (three-year transition option).

In March 2020, the federal bank regulatory agencies issued an interim final rule that maintains the three-year transition option of the 2019 CECL Rule and also provides banking organizations that were required under U.S.

GAAP (as of January 2020) to implement CECL before the end of 2020 the option to delay for two years an estimate of the effect of CECL on regulatory capital, relative to the incurred loss methodology’s effect on regulatory capital, followed by a three-year transition period (five-year transition option).

The Company elected to not use either the three-year or five-year transition period.

The FRB has authority to establish individual minimum capital requirements in appropriate cases upon a determination that an institution’s capital level is or may become inadequate in light of the particular risks or circumstances.

2 unchanged sentences

Among other things, these standards revise the Basel Committee's standardized approach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain “unconditionally cancellable commitments,” such as unused credit card lines of credit) and provides a new standardized approach for operational risk capital.

Under the Basel framework, these standards are currently set to go into effect on January 1, 2023, pushed back 12 months from the original implementation date of January 1, 2022 as a result of the Covid-19 pandemic, with an aggregate output floor phasing in through January 1, 2027.

Under the Basel framework, these standards went into effect on January 1, 2023, with an aggregate output floor phasing in through January 1, 2027.

Under the current U.S.

10 unchanged sentences

FDIC insurance expense totaled $415,700, $300,200 and $152,500 for the years ended December 31, 2022, 2021 and 2020, respectively.

In October 2022, the FDIC adopted a final rule to increase the initial base deposit insurance assessment rate schedules uniformly by 2 basis points beginning with the first quarterly assessment period of 2023.

The increased assessment is expected to improve the likelihood that the DIF reserve ratio would reach the statutory minimum of 1.35% by the statutory deadline prescribed under the FDIC's amended restoration plan.

The FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC.

32 unchanged sentences

The Bank received a rating of “satisfactory” in its most recent CRA exam.

In December 2019, the FDIC joined the Office of the Comptroller of the Currency in proposing rules that would significantly change existing CRA regulations.

The proposed rules are intended to increase bank activity in low and moderate income communities where there is significant need for credit, more responsible lending, greater access to banking services, and improvements to critical infrastructure.

The proposals focus on four improvement areas:

(i) clarifying what activities qualify for CRA credit;

(ii) updating assessment areas where activities count for CRA credit;

(iii) providing a more objective method for measuring CRA performance;

and (iv) improving the timeliness and transparency of record keeping and reporting.

The Federal Reserve did not join in the proposed rulemaking but is seeking public comment on an approach to modernize the CRA and evaluate how banks address inequities in credit access.

The agencies are working together to put forward a joint rule.

The Company will continue to monitor CRA regulatory changes and evaluate any resulting impact on the Company’s financial condition and results of operations.

On May 5, 2022, federal banking regulators requested comment on a joint notice of proposed rulemaking intended to strengthen and modernize the CRA regulations and framework.

Until the proposed rulemaking is final and effective, the Company and the Bank will continue to operate under the CRA regulations currently in effect.

At this time, it is uncertain what effect the impending CRA regulations will have on the Company and the Bank with respect to their CRA activities.

Financial Privacy – Banks and other financial institutions are subject to regulations that limit their ability to disclose non-public information about consumers to nonaffiliated third parties.

4 unchanged sentences

The term “affiliate” is defined to mean any company that controls or is under common control with the Bank and includes the Company and its non-bank subsidiaries.

“Covered transactions” include a loan or extension of credit, as well as a purchase of securities issued by an affiliate, certain purchases of assets from the affiliate, certain derivative transactions that create a credit exposure to an affiliate, the acceptance of securities issued by the affiliate as collateral for a loan, and the issuance of a guarantee, acceptance or letter of credit on behalf of an affiliate.

“Covered transactions” include a loan or extension of credit, as

well as a purchase of securities issued by an affiliate, certain purchases of assets from the affiliate, certain derivative transactions that create a credit exposure to an affiliate, the acceptance of securities issued by the affiliate as collateral for a loan, and the issuance of a guarantee, acceptance or letter of credit on behalf of an affiliate.

In general, these regulations require that any such transaction by the Bank (or its subsidiaries) with an affiliate must be secured by designated amounts of specified collateral and must be limited to certain thresholds on an individual and aggregate basis.

2 unchanged sentences

Also, the terms of such extensions of credit may not involve more than the normal risk of repayment or present other unfavorable features and may not exceed certain limitations on the amount of credit extended to such persons, individually and in the aggregate, which limits are based, in part, on the amount of the Bank’s capital.

Cybersecurity – In March 2015, federal regulators issued two related statements regarding cybersecurity.

One statement indicates that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution.

The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack involving destructive malware.

A financial institution is expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack.

Cybersecurity – Federal regulators regularly issue new and updated guidance and standards regarding cybersecurity intended to enhance cyber risk management among financial institutions and public companies generally.

Financial institutions are expected to comply with such guidance and standards and develop appropriate risk management processes and security controls.

If the Company fails to observe the regulatory guidance, it could be subject to various regulatory sanctions, including financial penalties.

In November 2021, the federal banking agencies adopted a final rule requiring banking organizations to notify their primary banking regulator within 36 hours of determining that a “computer-security incident” has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss, or its operations that would impact the stability of the United States.

Recently, the federal banking agencies adopted a final rule requiring banking organizations to notify their primary banking regulator within 36 hours of determining that a “computer-security incident” has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss, or its operations that would impact the stability of the United States.

Banking organizations are also required to notify each affected customer as soon as possible in the event of an incident that results in actual or potential harm to the integrity or availability of information and systems or that violates or threatens to violate the organization’s security for four or more hours.

In the ordinary course of business, the Company relies on electronic communications and information systems to conduct operations and store sensitive data.

The Company employs an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls.

The Company also employs a variety of preventative and detective tools to identify, protect, detect, respond, and recover against suspicious activity, as well as to report on any suspected advanced persistent threats.

Notwithstanding the strength of the Company’s defensive measures, the threat from cyber attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures.

While the Company has not experienced a significant compromise to date, significant data loss or any material financial losses related to cybersecurity attacks, the Company’s systems and those of its customers and third-party service providers are under constant threat and it is possible that the Company could experience a significant event in the future.

Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of internet banking, mobile banking and other technology-based products and services by the Company and its customers.

Risks and exposures related to cybersecurity attacks, including litigation and enforcement risks, are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of internet banking, mobile banking and other technology-based products and services by the Company and its customers.

See Item 1A, “Risk Factors” for a further discussion of risks related to cybersecurity.

Bank Secrecy Act/Anti Money Laundering Regulation, USA PATRIOT Act and National Defense Authorization Act - The Bank Secrecy Act ("BSA"), the USA PATRIOT Act and other laws and regulations require financial institutions, among other duties, to institute and maintain an effective Anti Money Laundering ("AML") program and to file timely reports such as suspicious activity reports and currency transaction reports.

The Company is required to comply with these and other AML requirements.

The federal banking agencies and the Financial Crimes Enforcement Network (“FinCEN”) are authorized to impose significant civil money penalties for violations of those requirements and have recently engaged in coordinated enforcement efforts against banks and other financial services providers with the Department of Justice, Drug Enforcement Administration and Internal Revenue Service.

The Company is also subject to increased scrutiny of compliance with the rules enforced by the Office of Foreign Assets Control.

The USA PATRIOT Act gives federal agencies additional powers to address terrorist threats through enhanced domestic security measures, expanded surveillance powers, increased information sharing, and broadened AML requirements.

The USA PATRIOT Act mandates that financial service companies implement additional policies and procedures and take heightened measures designed to address any or all of the following matters:

customer identification programs, money laundering, terrorist financing, identifying and reporting suspicious activities and currency transactions, currency crimes, and cooperation between financial institutions and law enforcement authorities.

On January 1, 2021, Congress enacted the National Defense Authorization Act, which enacted the most significant overhaul of the BSA and related AML laws since the USA PATRIOT Act.

Notable amendments include (i) significant changes to the collection of beneficial ownership information and the establishment of a beneficial ownership registry, which requires corporate entities (generally, any corporation, limited liability company or other similar entity with 20 or fewer employees and annual gross income of $5 million or less) to report beneficial ownership information to FinCEN (which information will be maintained by FinCEN and made available upon request to financial institutions);

(ii) enhanced whistleblower provisions, which provide that one or more whistleblowers who voluntarily provide original information

leading to the successful enforcement of violations of the AML laws in any judicial or administrative action brought by the Secretary of the Treasury or the Attorney General resulting in monetary sanctions exceeding $1 million (including disgorgement and interest but excluding forfeiture, restitution, or compensation to victims) will receive not more than 30 percent of the monetary sanctions collected and will receive increased protections;

(iii) increased penalties for violations of the BSA;

(iv) improvements to existing information sharing provisions that permit financial institutions to share information relating to suspicious activity reports with foreign branches, subsidiaries, and affiliates (except those located in China, Russia, or certain other jurisdictions) for the purpose of combating illicit finance risks;

and (v) expanded duties and powers of FinCEN.

Many of the requirements included in the AML amendments will require additional rulemakings, reports and other measures, and the impact of these rules will depend on, among other things, rulemaking and implementation guidance.

On December 8, 2021, FinCEN issued proposed regulations that would implement the amendments regarding beneficial ownership if adopted as proposed.

Other Regulations – The operations of the Company and the Bank are also subject to:

6 unchanged sentences

• Check Clearing for the 21st Century Act (also known as “Check 21”), which gives “substitute checks,” such as digital check images and copies made from that image, the same legal standing as the original paper check.

• The USA PATRIOT Act, which requires banks and savings institutions to establish broadened anti-money laundering compliance programs and due diligence policies and controls to ensure the detection and reporting of money laundering;

• The Bank Secrecy Act, which requires U.S.

financial institutions to collaborate with the U.S.

government in cases of suspected money laundering and fraud.

Certain of these laws are consumer protection laws that extensively govern the Company’s relationship with its customers.

11 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business