What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2026-03-06 compared with 2025-03-05 · 44 added, 80 removed, 229 unchanged (35% of the section changed)

3 unchanged sentences

The Company’s services include freight invoice rating, payment processing, auditing, and the generation of accounting and transportation information.

Cass also processes and pays facility-related invoices, which include electricity and gas as well as waste and telecommunications expenses, and is a provider of telecom expense management solutions.

Cass also processes and pays facility-related invoices, which include electricity and gas as well as waste and telecommunications expenses.

Cass solutions include integrated payments, a B2B payment platform for clients that require an agile fintech partner.

3 unchanged sentences

Louis metropolitan area and restaurant franchises and faith-based ministries within the United States.

On April 7, 2025, the Company signed an Asset Purchase Agreement providing for the sale of its telecom expense management and managed mobility solutions business unit ("TEM Business Unit") to Asignet USA Inc ("Asignet") for a purchase price of $18.0 million.

The sale closed on June 30, 2025.

The Company also signed a Transition Services Agreement with Asignet to provide certain information technology, data ingestion, and payment processing services for a period of time not to exceed 18 months after closing.

Company Strategy and Core Competencies

4 unchanged sentences

Cass gathers vital data from complex and diverse input documents, electronic media, proprietary databases and data feeds, including data acquired from vendor invoices as well as customer procurement and sales systems.

Through its numerous methods of obtaining streams and pieces of raw data, Cass is able to assemble vital data into centralized data management systems and warehouses, thus producing an engine to create the power of information for managing critical corporate functions and processing systems.

Through its numerous methods of obtaining streams and pieces of raw data, including those supported by artificial intelligence ("AI"), Cass is able to assemble vital data into centralized data management systems and warehouses, thus producing an engine to create the power of information for managing critical corporate functions and processing systems.

Data management – Once data is assembled, Cass is able to utilize the power from derived information to produce significant savings and benefits for its clients.

18 unchanged sentences

These competitors compete mainly on price, functionality and service levels.

The Company, through its Utility Expense Management business unit, also competes with other companies located throughout the United States that pay utility bills and provide management reporting.

The Company, through its Facilities Expense Management business unit, also competes with other companies located throughout the United States that pay utility bills and provide management reporting.

Available data indicates that the Company is one of the largest providers of utility information processing and payment services.

2 unchanged sentences

Many of Cass’ services are customized for the ESPs, providing a full-featured solution without any development costs to the ESP.

The Company, through its Telecom Information Services business unit, is a leader in the growing telecom expense management market and competes with other companies located throughout the United States in this market.

The Company, through its Waste Expense Management business, is one of the largest providers of waste invoice management solutions and competes against small expense management companies along with large national account programs of major haulers.

The Company's TouchPoint division offers a church management software solution and an on-line platform to provide generosity services for faith-based and non-profit organizations, which is a complementary service offering to the Bank’s faith-based customers.

22 unchanged sentences

Employees and Human Capital Resources

The Company and its subsidiaries had 1,027 full-time and 221 part-time employees as of February 21, 2025.

The Company and its subsidiaries had 860 full-time and 156 part-time employees as of February 27, 2026, exclusive of discontinued operations.

Of these employees, the Bank had 68 full-time and no part-time employees.

2 unchanged sentences

Furthering the philosophy to attract and retain a pool of talented and motivated employees who will continue to advance the Company’s purpose and contribute to overall success, compensation and benefits programs include:

a noncontributory profit sharing program for exempt employees;

a noncontributory profit sharing

program for exempt employees;

a defined contribution 401(k) plan to provide retirement benefits to eligible employees;

a performance-based equity compensation program for executive officers and key personnel;

and incentive programs for loan

and sales personnel.

and incentive programs for sales personnel.

Cass also provides comprehensive health, dental, and vision plans to most employees, as well as free employee assistance programs to all employees and members of their families.

4 unchanged sentences

Additionally, the Company supports a number of organizations with annual financial contributions.

The Company recognizes the benefits of building a corporate culture that promotes diversity and fosters unique ideas and ways of thinking.

Among other things, Cass focuses on cultivating an environment that encourages collaboration, flexibility and fairness to enable all employees to contribute to their full potential.

As of December 31, 2024, 70% of the Company's U.S.

employees were female, and 22% were ethnically diverse.

Within the management group, 53% were female, and 15% were ethnically diverse.

The Company continues to support and provide diversity training to all employees.

The Company also continues its commitment to providing a workplace that is free of harassment and discrimination by taking proactive measures and providing all employees with non-discrimination and sexual harassment prevention training on an annual basis.

18 unchanged sentences

If the company does not return to compliance within 180 days, the FRB may require divestiture of the holding company’s depository institutions.

In order for a financial holding company to commence any new activity permitted by the BHC Act or to acquire a company engaged in any new activity permitted by the BHC Act, each insured depository institution subsidiary of the financial holding company must have received a rating of at least “satisfactory” in its most recent examination under the Community Reinvestment Act.

holding company must have received a rating of at least “satisfactory” in its most recent examination under the Community Reinvestment Act.

See “Community Reinvestment Act” below.

25 unchanged sentences

With certain exceptions, the value of stock repurchased is determined net of stock issued in the year, including shares issued pursuant to compensatory arrangements.

Capital Requirements – As a bank holding company, the Company and the Bank are subject to capital requirements pursuant to the FRB’s capital guidelines which include (i) risk-based capital guidelines, which are designed to make capital

requirements more sensitive to various risk profiles and account for off-balance sheet exposure;

(ii) guidelines that consider market risk, which is the risk of loss due to change in value of assets and liabilities due to changes in interest rates;

and (iii) guidelines that use a leverage ratio which places a constraint on the maximum degree of risk to which a financial holding company may leverage its equity capital base.

guidelines that use a leverage ratio which places a constraint on the maximum degree of risk to which a financial holding company may leverage its equity capital base.

The Basel III Capital Rules require the Company and the Bank to maintain the following:

10 unchanged sentences

Tier 2 capital is comprised of capital instruments and related surplus meeting specified requirements.

Also included in Tier 2 capital is the allowance for credit losses limited to a maximum of 1.25% of risk-weighted assets and, for non-advanced approaches institutions like Cass that have exercised a one-time opt-out election regarding the treatment of Accumulated Other Comprehensive Income (“AOCI”), up to 45% of net unrealized gains on available-for-sale equity securities with readily determinable fair market values.

Also included in Tier 2 capital is the allowance for credit losses limited to a maximum of 1.25% of risk-weighted assets and, for non-advanced approaches institutions like Cass that have exercised a one-time opt-out election regarding the treatment of Accumulated Other Comprehensive Income (“AOCI”), up to 45% of net unrealized gains on available-for-sale equity investment securities with readily determinable fair market values.

The calculation of all types of regulatory capital is subject to deductions and adjustments specified in the regulations.

7 unchanged sentences

As of December 31, 2025, the Company and the Bank met all capital adequacy requirements under the Basel III Capital Rules.

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms (commonly referred to as “Basel IV”).

Among other things, these standards revise the Basel Committee's standardized approach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain “unconditionally cancellable commitments,” such as unused credit card lines of credit) and provides a new standardized approach for operational risk capital.

Under the Basel framework, these standards went into effect on January 1, 2023, with an aggregate output floor phasing in through January 1, 2027.

Under the current U.S.

capital rules, operational risk capital requirements and a capital floor apply only to advanced approaches institutions, and not to the Company or the Bank.

The impact of Basel IV on the Company will depend on the manner in which it is implemented by the federal bank regulators.

Source of Strength Doctrine – FRB and other regulations require bank holding companies to act as a source of financial and managerial strength to their subsidiary banks.

4 unchanged sentences

Deposit insurance assessments are based on average consolidated total assets minus average tangible equity.

Under the FDIC’s risk-based assessment system, insured institutions with less than $10 billion in assets, such as the Bank, are assigned to one of four risk categories based on supervisory evaluations, regulatory capital level, and certain other factors, with less risky institutions paying lower assessments.

Under the FDIC’s risk-based assessment system, insured institutions with less than $10 billion in assets, such as the Bank, are assigned to one of

four risk categories based on supervisory evaluations, regulatory capital level, and certain other factors, with less risky institutions paying lower assessments.

An institution’s assessment rate depends upon the category to which it is assigned and certain other factors.

In October 2022, the FDIC adopted a final rule to increase the initial base deposit insurance assessment rate schedules uniformly by 2 basis points beginning with the first quarterly assessment period of 2023.

The increased assessment is expected to improve the likelihood that the DIF reserve ratio would reach the statutory minimum of 1.35% by the statutory deadline prescribed under the FDIC's amended restoration plan.

The FDIC established a plan on September 15, 2020 to restore the DIF reserve ratio to meet or exceed the statutory minimum of 1.35% within eight years.

This plan did not include an increase in the deposit insurance assessment rate.

Based on the FDIC’s recent projections, however, the FDIC determined that the DIF reserve ratio is at risk of not reaching the statutory minimum by the statutory deadline of September 30, 2028 without increasing the deposit insurance assessment rates.

In October 2022, the FDIC adopted a final rule to increase initial base deposit insurance assessment rate schedules uniformly by 2 basis points, beginning on January 1, 2023.

In November 2023, the FDIC issued a final rule to implement a special assessment to recover losses to the DIF incurred as a result of bank failures in early 2023 and the FDIC's use of the systemic risk exception to cover certain deposits that were otherwise uninsured.

2 unchanged sentences

Under the final rule, the estimated loss pursuant to the systemic risk determination will be periodically adjusted, and the FDIC has retained the ability to cease collection early, extend the special assessment collection period, and impose a final shortfall special assessment on a one-time basis.

The extent to which any such additional future assessments will impact the Company's future deposit insurance expense is currently uncertain.

In December 2025, based upon the first six quarterly collections of the special assessment and anticipated collections for the seventh quarterly special assessment, the FDIC issued an interim final rule to amend the collection of the special assessment to reduce the eighth quarterly assessment rate from 3.36 basis points to 2.97 basis points.

Because the cumulative amount collected through the initial eight quarter special assessment period is projected to equal the FDIC’s loss estimate, the additional two quarter extension of the assessment period was removed.

The interim final rule also requires the FDIC to provide an offset to regular quarterly deposit insurance assessments for institutions subject to the special assessment if the aggregate amount collected exceeds estimated losses following the resolution of pending litigation, and again following the termination of any receiverships.

As provided in the special assessment rule, if losses at the termination of any receiverships exceed the amount collected, the FDIC will implement a one-time final shortfall special assessment to ensure the full amount of actual losses is recovered as required by law.

The extent to which any such future offsets or a future one-time shortfall special assessment will impact the Company's future deposit insurance expense is currently uncertain.

FDIC insurance expense totaled $628,000, $638,000 and $603,000 for the years ended December 31, 2025, 2024 and 2023, respectively.

7 unchanged sentences

(iv) “significantly undercapitalized” if the institution has a total risk-based capital ratio of less than 6%, a Tier 1 risk-based capital ratio of less than 4%, a leverage ratio of less than 3% or a common equity Tier 1 ratio of less than 3%;

and (v) “critically undercapitalized” if the institution has a ratio of tangible equity (as defined in the regulations) to total assets that is equal to or less than 2%.

and (v) “critically undercapitalized” if the institution has a ratio of tangible

equity (as defined in the regulations) to total assets that is equal to or less than 2%.

An institution may be deemed to be in a capital category that is lower than indicated by its capital ratios if it is determined to be in an unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters.

A bank’s capital category is

determined solely for the purpose of applying prompt corrective action regulations, and the capital category may not constitute an accurate representation of the bank’s overall financial condition or prospects for other purposes.

A bank’s capital category is determined solely for the purpose of applying prompt corrective action regulations, and the capital category may not constitute an accurate representation of the bank’s overall financial condition or prospects for other purposes.

Subject to a narrow exception, a receiver or conservator is required to be appointed for an institution that is “critically undercapitalized” within specified time frames.

19 unchanged sentences

Depository institutions are periodically examined for compliance with the CRA and are assigned ratings that must be publicly disclosed.

In order for a financial holding company to commence any new activity permitted by the BHC Act, or to acquire any company engaged in any new activity permitted by the BHC Act, each insured depository institution subsidiary of the financial holding company must have received a rating of at least “satisfactory” in its most recent examination under the CRA.

have received a rating of at least “satisfactory” in its most recent examination under the CRA.

The Bank received a rating of “satisfactory” in its most recent CRA exam.

In October 2023, the OCC, together with the Federal Reserve and FDIC, issued a joint final rule to modernize the CRA regulatory framework.

In October 2023, the Office of the Comptroller of the Currency ("OCC"), together with the Federal Reserve and FDIC, issued a joint final rule to modernize the CRA regulatory framework.

The final rule is intended, among other things, to adapt to changes in the banking industry, including the expanded role of mobile and online banking, and to tailor performance standards to account for differences in bank size and business models.

1 unchanged sentence

The new rule also includes data collection and reporting requirements, some of which are applicable only to banks larger than the Bank and updates the definitions of community development and process by which banks can seek approval of qualifying projects.

Most provisions of the final rule will become effective on January 1, 2026, and the data reporting requirements will become effective on January 1, 2027.

Most provisions of the final rule became effective on January 1, 2026, and the data reporting requirements will become effective on January 1, 2027.

Financial Privacy – Banks and other financial institutions are subject to regulations that limit their ability to disclose non-public information about consumers to nonaffiliated third parties.

12 unchanged sentences

If the Company fails to observe the regulatory guidance, it could be subject to various regulatory sanctions, including financial penalties.

Recently, the federal banking agencies adopted a final rule requiring banking organizations to notify their primary banking regulator within 36 hours of determining that a “computer-security incident” has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss, or its operations that would impact the stability of the United States.

In November 2021, the federal banking agencies adopted a final rule requiring banking organizations to notify their primary banking regulator within 36 hours of determining that a “computer-security incident” has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss, or its operations that would impact the stability of the United States.

Banking organizations are also required to notify each affected customer as soon as possible in the event of an incident that results in actual or potential harm to the integrity or availability of information and systems or that violates or threatens to violate the organization’s security for four or more hours.

1 unchanged sentence

See Item 1A, “Risk Factors” for a further discussion of risks related to cybersecurity.

Anti-Money Laundering Regulation and the USA PATRIOT Act - A major focus of governmental policy on financial institutions in recent years has been aimed at combating money laundering and terrorist financing.

The Bank Secrecy Act (“BSA”), the USA PATRIOT Act of 2021 (the “USA PATRIOT Act”) and other laws and regulations require financial institutions, among other duties, to institute and maintain an effective Anti-Money Laundering (“AML”) program and to file timely reports such as suspicious activity reports and currency transaction reports that assist government agencies in detecting and preventing money laundering.

The USA PATRIOT Act prohibits financial institutions from entering into specified financial transactions and account relationships and requires that the institutions implement customer identification programs and enhance due diligence procedures for certain high-risk customers.

Regulatory authorities routinely examine financial institutions for compliance with these obligations.

The federal banking agencies and the Financial Crimes Enforcement Network (“FinCEN”) are authorized to impose significant civil money penalties for violations of those requirements and have recently engaged in coordinated enforcement efforts against banks and other financial services providers with the Department of Justice, Drug Enforcement Administration and Internal Revenue Service.

The Company is also subject to increased scrutiny of compliance with the rules enforced by the Office of Foreign Assets Control.

The Anti-Money Laundering Act of 2020 (“AMLA”) amended the BSA and was intended to be a comprehensive reform and modernization to U.S.

bank secrecy and anti-money laundering laws.

Among other things, it codifies a risk-based approach to anti-money laundering compliance for financial institutions;

requires the U.S.

Department of the Treasury to promulgate priorities for anti-money laundering and countering the financing of terrorism policy;

requires the development of standards for testing technology and internal processes for BSA compliance;

expands enforcement- and investigation-related authority, including increasing available sanctions for certain BSA violations;

and expands BSA whistleblower incentives and protections.

Many of the statutory provisions in the AMLA will require additional rulemakings, reports and other measures, and the impact of the AMLA will depend on, among other things, rulemaking and implementation guidance.

In 2021, Congress passed the Corporate Transparency Act as part of the National Defense Authorization Act, which enacted the most significant overhaul of the BSA and related AML laws since the USA PATRIOT Act.

Notable amendments include (i) significant changes to the collection of beneficial ownership information and the establishment of a beneficial ownership registry, which requires corporate entities (generally, any corporation, limited liability company or other similar entity with 20 or fewer employees and/or annual gross income of $5 million or less) to report beneficial ownership information to FinCEN (which information will be maintained by FinCEN and made available upon request to certain government agencies and financial institutions);

(ii) enhanced whistleblower provisions, which provide that one or more whistleblowers who voluntarily provide original information leading to the successful enforcement of violations of the AML laws in any judicial or administrative action brought by the Secretary of the Treasury or the Attorney General resulting in monetary sanctions exceeding $1 million (including disgorgement and interest but excluding forfeiture, restitution, or compensation to victims) will receive not more than 30 percent of the monetary sanctions collected and will receive increased protections;

(iii) increased penalties for violations of the BSA;

(iv) improvements to existing information sharing provisions that permit financial institutions to share information relating to suspicious activity reports with foreign branches, subsidiaries, and affiliates (except those located in China, Russia, or certain other jurisdictions) for the purpose of combating illicit finance risks;

and (v) expanded duties and powers of FinCEN.

Many of the requirements included in the AML amendments will require additional rulemakings, reports and other measures, and the impact of these rules will depend on, among other things, rulemaking and implementation guidance.

FinCEN proposed three rules to implement changes to the beneficial ownership requirements and related amendments set forth in the Corporate Transparency Act.

As of the date of this Form 10-K, two of the three have been finalized.

The Beneficial Ownership Reporting Rule took effect on January 1, 2024 and requires certain domestic and foreign companies created, or registered to conduct business, in the United States to report beneficial ownership information to FinCEN.

The Access Rule, effective as of February 20, 2024, sets forth the circumstances under which FinCEN can disclose beneficial ownership information to authorized recipients and how FinCEN and recipients of the data will protect that information.

It is expected that FinCEN will issue a third rule to revise existing customer due diligence requirements and bring them into conformance with the Corporate Transparency Act and the Access Rule.

Climate-Related Regulation and Guidance - In recent years the federal banking agencies have increased their focus on climate-related risks impacting the operations of banks, the communities they serve and the broader financial system.

Accordingly, the agencies have begun to enhance their supervisory expectations regarding the climate risk management practices of larger banking organizations, including by encouraging such banks to:

ensure that management of climate-related risk exposures has been incorporated into existing governance structures;

evaluate the potential impact of climate-related risks on the bank’s financial condition, operations and business objectives as part of its strategic planning process;

account for the effects of climate change in stress testing scenarios and systemic risk assessments;

revise expectations for

credit portfolio concentrations based on climate-related factors;

consider investments in climate-related initiatives and lending to communities disproportionately impacted by the effects of climate change;

evaluate the impact of climate change on the bank’s borrowers and consider possible changes to underwriting criteria to account for climate-related risks to mortgaged properties;

incorporate climate-related financial risk into the bank’s internal reporting, monitoring and escalation processes;

and prepare for the transition risks to the bank associated with the adjustment to a low-carbon economy and related changes in laws, regulations, governmental policies, technology, and consumer behavior and expectations.

In 2021, the OCC issued proposed principles for climate-related financial risk management for national banks with more than $100 billion in total assets.

In 2022, the FDIC and FRB issued their own proposed principles for climate risk management by larger banking organizations.

Although these risk management principles, if adopted as proposed, would not apply to the Bank directly based upon its current size, the regulators have indicated that all banks, regardless of their size, may have material exposures to climate-related financial and other risks that require prudent management.

The federal banking agencies are expected to adopt a more formal climate risk management framework for larger banking organizations in the coming months.

As climate-related supervisory guidance is considered and formalized for all banks and financial institutions, the Company may be required to expend significant capital and incur compliance, operating, maintenance and remediation costs in order to conform to such requirements.

Anti-Money Laundering - The Bank Secrecy Act, as amended by the Patriot Act and Anti-Money Laundering Act of 2020, contains anti-money laundering and financial transparency provisions intended to detect and prevent the use of the U.S.

financial system for money laundering and terrorist financing activities.

The Bank Secrecy Act requires financial institutions such as depository institutions to undertake activities, including maintaining an AML program, verifying the identity of customers, verifying the identity of certain beneficial owners for legal entity customers, monitoring for and reporting suspicious transactions, reporting on cash transactions exceeding specified thresholds, and responding to requests for information by regulatory authorities and law enforcement agencies.

The Company is subject to the Bank Secrecy Act and, therefore, is required to implement compliance policies, procedures, and internal controls, provide its employees with AML training, designate an AML compliance officer, and undergo periodic independent auditing and testing to assess the effectiveness of its AML program, among other requirements.

The Company has implemented an AML compliance program, including policies, procedures, and internal controls that are designed to comply with these AML requirements.

Bank regulators continue to focus their examinations on AML compliance, and the Company will continue to monitor and augment, where necessary, its AML compliance programs.

The federal banking agencies are required, when reviewing bank and BHC acquisition or merger applications, to take into account the effectiveness of the AML activities of the applicant.

The Anti-Money Laundering Act of 2020, enacted as part of the National Defense Authorization Act, requires the U.S.

Treasury to issue National Anti-Money Laundering and Countering the Financing of Terrorism Priorities, and conduct studies and issue regulations that may, over the next few years, significantly alter some of the due diligence, recordkeeping, and reporting requirements that the Bank Secrecy Act imposes on banks.

The Anti-Money Laundering Act of 2020 also contains provisions that promote increased information-sharing and use of technology and increases penalties for violations of the Bank Secrecy Act and includes whistleblower incentives, both of which could increase the prospect of regulatory enforcement.

Other Regulations – The operations of the Company and the Bank are also subject to:

21 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business