What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2023-11-29 compared with 2022-11-23 · 46 added, 32 removed, 129 unchanged (38% of the section changed)

9 unchanged sentences

Changes in interest rates could have an adverse impact on our results of operations and financial condition because the majority of our interest-earning assets are long-term, fixed-rate loans, while the majority of our interest-bearing liabilities are shorter term, and therefore subject to a greater degree of interest rate fluctuations.

This type of risk is known as interest rate risk and is affected by prevailing economic and competitive conditions, including inflationary trends and/or monetary policies of the FRB and fiscal policies of the United States federal government.

This type of risk is known as interest rate risk and is affected by prevailing economic and competitive conditions that are beyond the Company's control, including general economic conditions, inflationary trends and/or monetary policies of the FRB and fiscal policies of the United States federal government.

The impact of changes in interest rates is generally observed on the income statement.

11 unchanged sentences

For additional information, see "Part II, Item 7.

Management's Discussion and Analysis of Financial Condition and Results of Operations - Strategic Securities Transaction," "Part II, Item 7.

Management's Discussion and Analysis of Financial Condition and Results of Operations - Stockholders' Equity" and "Part II, Item 8.

Financial Statements and Supplementary Data – Notes to Consolidated Financial Statements – Note 15.

Financial Statements

and Supplementary Data – Notes to Consolidated Financial Statements – Note 15.

Accumulated Other Comprehensive Income."

1 unchanged sentence

In times of rising interest rates, default risk may increase among borrowers with adjustable-rate loans as the rates on their loans adjust upward and their payments increase.

Fluctuations in interest rates also affect customer demand for deposit products.

Fluctuations in interest rates also affect customer demand for loan and deposit products.

Competition from other financial institutions and/or brokerage firms could affect our ability to attract and retain deposits and could result in us paying more for deposits.

7 unchanged sentences

An economic downturn, especially one affecting our geographic market areas and certain regions of the country where we have correspondent loans secured by one- to four-family properties or commercial real estate participation loans, could have an adverse impact on our business and financial results.

Our primary lending emphasis is the origination and purchase of one- to four-family first mortgage loans secured by residential properties.

Our primary lending emphasis is the origination of one- to four-family first mortgage loans secured by residential properties.

We have also purchased one- to four-family first mortgage loans, secured by properties that are typically outside our local market areas, from correspondent lenders.

As we have grown our commercial real estate lending portfolio, we have continued to maintain relationships not only in our local markets but in geographically diverse markets.

5 unchanged sentences

Any one or a combination of these events may have an adverse impact on borrowers' ability to repay their loans, which could result in increased delinquencies, non-performing assets, loan losses, and future loan loss provisions.

The Company may not be able to attract and retain skilled employees.

The Company's success depends, in large part, on its ability to attract and retain key people.

Competition for the best people can be intense, and the Company spends considerable time and resources attracting and hiring qualified people for its operations.

The unexpected loss of the services of one or more of the Company's key personnel could have an adverse impact on the Company's business because of their skills, knowledge of the Company's market, and years of industry experience, as well as the difficulty of promptly finding qualified replacement personnel.

Risks Related to Lending Activities

16 unchanged sentences

Risks Related to Cybersecurity, Third Parties, and Technology .

The occurrence of any information system failure or interruption, breach of security or cyber-attack, at the Company, at its third-party service providers or counterparties may have an adverse effect on our business, reputation, financial condition and results of operations.

The occurrence of any information system failure or interruption, breach of security or cyberattack, at the Company, at its third-party service providers or counterparties may have an adverse effect on our business, reputation, financial condition and results of operations.

Information systems are essential to the conduct of our business, as we use such systems to manage our customer relationships, our general ledger, our deposits and our loans.

4 unchanged sentences

Cyber criminals use a variety of tactics, such as ransomware, denial of service, and theft of sensitive business and customer information to extort payment or other concessions from victims.

In some cases, these attacks have caused

significant impacts on other businesses' access to data and ability to provide services.

In some cases, these attacks have caused significant impacts on other businesses' access to data and ability to provide services.

We are not able to anticipate or implement effective preventive measures against all incidents of these types, especially because the techniques used change frequently and because attacks can originate from a wide variety of sources, including attacks on third-party vendors and their applications and products used by the Bank.

3 unchanged sentences

Our business and operations depend on the secure processing, storage and transmission of confidential and other information in our information systems and those of our third-party service providers.

Although we devote significant resources and management focus to ensuring the integrity of our information systems through information security measures, risk management practices, relationships with threat intelligence providers and business continuity planning, our facilities, computer systems, software and networks, and those of our third-party service providers, may be vulnerable to external or internal security breaches, acts of vandalism, unauthorized access, misuse, computer viruses or other malicious code and cyber-attacks that could have a security impact.

In addition, breaches of security may occur through intentional or unintentional acts by those having authorized or unauthorized access to our confidential or other information or the confidential or other information of our customers, employees or others.

While we regularly conduct security and risk assessments on our systems and those of our third-party service providers, there can be no assurance that their information security protocols are sufficient to withstand a cyber-attack or other security breach.

While we regularly conduct security and risk

assessments on our systems and those of our third-party service providers, there can be no assurance that their information security protocols are sufficient to withstand a cyberattack or other security breach.

Across our industry, the cost of minimizing these risks and investigating incidents has continued to increase with the frequency and sophistication of these threats.

To date, the Company has no knowledge of a material information security breach affecting its systems.

During June 2023, a third-party service provider (the "Service Provider") to the Bank advised the Bank that files with personally identifiable information related to Bank customers had been compromised during a security incident experienced by the Service Provider (the "Incident").

The Bank used the Service Provider to process transactions.

The Incident resulted from a zero-day vulnerability in a managed file sharing software called MOVEit.

MOVEit is used by thousands of organizations around the world for securely transferring sensitive and confidential information and other data.

The vulnerability was exploited in a large-scale, cyber campaign that impacted government agencies, universities, and corporations around the world.

As a result of the Incident, an unauthorized party was able to obtain access to certain Bank customers' data in the Service Provider's possession that contained social security numbers, account numbers, and other personally identifiable information.

The Bank confirmed the Service Provider has fixed the vulnerability noted above and the Bank has implemented additional security procedures when sharing files with the Service Provider.

When the Bank received notice of the Incident from the Service Provider, the Bank promptly enacted response protocols.

The Service Provider has provided appropriate notifications to potentially affected customers.

The Bank worked with the Service Provider to identify any others potentially impacted by the Incident.

The Bank is not aware of any other third-party incidents related to the MOVEit vulnerability that has affected personally identifiable information associated with Bank customers.

The occurrence of any of the foregoing could subject us to litigation or regulatory scrutiny, cause us significant reputational damage or erode confidence in the security of our information systems, products and services, cause us to lose customers or have greater difficulty in attracting new customers, have an adverse effect on the value of our common stock or subject us to financial losses that may not be covered by insurance, any of which could have an adverse effect on our business, financial condition and results of operations.

3 unchanged sentences

Compliance with current or future privacy, data protection and information security laws could result in higher compliance and technology costs and could restrict our ability to provide certain products and services, which could have an adverse effect on our business, financial condition and results of operations.

Our customers are also targets of cyber-attacks and identity theft.

Our customers are also targets of cyberattacks and identity theft.

There continues to be instances involving financial services and consumer-based companies reporting the unauthorized disclosure of client or customer information or the destruction or theft of corporate data.

Large scale identity theft could result in customers' accounts being compromised and fraudulent activities being performed in their name.

We have implemented certain safeguards against these types of activities but they may not fully protect us from fraudulent financial losses.

The occurrence of a breach of security involving our customers' information, regardless of its origin, could damage our reputation and result in a loss of customers and business and subject us to additional regulatory scrutiny, and could expose us to litigation and possible financial liability.

Any of these events could have an adverse effect on our financial condition and results of operations.

Large scale identity theft could result in customers' accounts being compromised and fraudulent activities being performed in their names.

We have implemented certain safeguards against these types of activities, but they may not fully protect us from financial losses.

The occurrence of a security breach involving our customers' information, regardless of its origin, could damage our reputation and result in a loss of customers and business, subject us to additional regulatory scrutiny, and expose us to litigation and possible financial liability.

Any of these events could have an adverse effect on our business, financial condition and results of operations.

Third-party vendors subject the Company to potential business, reputation and financial risks.

7 unchanged sentences

We are heavily reliant on technology, and a failure to effectively implement technology initiatives or anticipate future technology needs or demands could adversely affect our business or performance.

Like most financial institutions, the Bank significantly depends on technology to deliver its products and other services and to otherwise conduct business.

Like most financial institutions, the Bank significantly depends on technology to deliver its products and services and to otherwise conduct business.

To remain technologically competitive and operationally efficient, the Bank invests in system upgrades, new technological solutions, and other technology initiatives.

3 unchanged sentences

If the Bank were to falter in any of these areas, it could have an adverse effect on our business, financial condition and results of operations.

There are operational and reputation risks associated with the planned digital transformation.

Management is in the process of implementing a new core processing system ("digital transformation") for the Bank, which is expected to be operational by September 2023.

The digital transformation is expected to better position the Bank for the future and allow for the introduction of new products and services to enhance customer experiences.

This project may subject the Company to operational risks, such as disruptions in technology systems impacting customers.

In August 2023, the Company implemented a new core processing system ("digital transformation").

While the digital transformation was completed successfully, the Company may face operational risks, such as disruptions in technology systems, which may impact customers.

The Company will work to remediate any such disruptions, if they occur, but no assurance can be given that a potential adverse development will be quickly or completely remediated.

If an adverse development arising from the digital transformation is not sufficiently remediated or is not remediated in a timely fashion, the Company's reputation could be significantly impacted which could result in loss of customer business, subject the Company to regulatory scrutiny, or expose the Company to possible litigation, any of which could have a material impact on the Company's financial condition and results of operations.

If an adverse development arising from the digital transformation is not sufficiently remediated or is not remediated in a timely fashion, the Company's reputation could be significantly impacted, which could result in loss of customer business, subject the Company to regulatory scrutiny, or expose the Company to litigation, any of which could have a material impact on the Company's financial condition and results of operations.

Risks Related to Competition

Strong competition may limit growth and profitability.

While we are one of the largest mortgage loan originators in the state of Kansas, we compete in the same market areas as local, regional, and national banks, credit unions, mortgage brokerage firms, investment banking firms, investment brokerage firms, and savings institutions.

We also compete with online investment and mortgage brokerages and online banks that are not confined to any specific market area.

10 unchanged sentences

The CFPB also has examination and enforcement authority over all banks with regulatory assets exceeding $10 billion at four consecutive quarter-ends.

The Bank has not exceeded $10 billion in regulatory assets at four consecutive quarter-ends, but it may at some point in the future.

Smaller banks, like the Bank, will continue to be examined for compliance with the consumer laws and regulations of the CFPB by their primary bank regulators (the OCC, in the case of the Bank).

The Bank exceeded $10 billion in

regulatory assets at March 31, 2023, June 30, 2023 and September 30, 2023.

The Bank intends to be below $10 billion in regulatory assets at December 31, 2023 so it will not exceed $10 billion in regulatory assets at four consecutive quarter-ends.

There are increased direct costs, additional regulatory burdens with indirect costs, and lost revenue, mainly related to interchange fees, associated with the Bank being over $10 billion in regulatory assets at certain points in time and for four consecutive quarter-ends.

As long as the Bank does not exceed $10 billion in regulatory assets for four consecutive quarter ends, it will continue to be examined for compliance with consumer protection laws and the regulations of the CFPB by the Bank's primary bank regulator, the OCC.

The Dodd-Frank Act also weakens the federal preemption rules that have been applicable for national banks and federal savings associations and gives state attorneys general the ability to enforce federal consumer protection laws.

1 unchanged sentence

Moreover, bank regulatory agencies have been active in responding to concerns and trends identified in examinations and have issued formal enforcement orders requiring capital ratios in excess of regulatory requirements and/or assessing monetary penalties.

Bank regulatory agencies, such as the OCC, the FRB and the FDIC, govern the activities in which we may engage, primarily for the protection of depositors, and not for the protection or benefit of investors.

Bank regulatory agencies, such as the OCC, the FRB and the FDIC, govern the activities in which we may engage, primarily for the protection of depositors' funds, the DIF and the safety and soundness of the banking system as a whole, and not for the protection or benefit of investors.

The CFPB enforces consumer protection laws and regulations for the benefit of the consumer and not the protection or benefit of investors.

2 unchanged sentences

The Company is also directly subject to the requirements of entities that set and interpret accounting standards such as the Financial Accounting Standards Board, and indirectly subject to the actions and interpretations of the Public Company Accounting Oversight Board, which establishes auditing and related professional practice standards for registered public accounting firms and inspects registered firms to assess their compliance with certain laws, rules, and professional standards in public company audits.

These regulations, along with the currently existing tax, accounting, securities, and monetary laws, regulations, rules, standards, policies and interpretations, control the methods by which financial institutions and their holding companies conduct business, engage in strategic and tax planning, implement strategic initiatives, and govern financial reporting.

The Company's failure to comply with laws, regulations or policies could result in civil or criminal sanctions and money penalties by state and federal agencies, and/or reputation damage, which could have an adverse effect on the Company's business, financial condition and results of operations.

These regulations, along with existing tax, accounting, securities, and monetary laws, regulations, rules, standards, policies and interpretations, control the methods by which financial institutions and their holding companies conduct business, engage in strategic and tax planning, implement strategic initiatives, and govern financial reporting.

The Company's failure to comply with laws, regulations or policies could result in civil or criminal sanctions and money penalties by state and federal agencies, and/or reputational damage, which could have an adverse effect on the Company's business, financial condition and results of operations.

See "Part I, Item 1.

1 unchanged sentence

The Company's ability to pay dividends is subject to the ability of the Bank to make capital distributions to the Company.

The long-term ability of the Company to pay dividends to its stockholders is based primarily upon the ability of the Bank to make capital distributions to the Company, and on the availability of cash at the holding company level in the event earnings are not sufficient to pay dividends.

The long-term ability of the Company to pay dividends to its stockholders is based primarily upon the ability of the Bank to generate earnings and to, therefore, make capital distributions to the Company, and on the availability of cash at the holding company level in the event earnings are not sufficient to pay dividends.

Under certain circumstances, capital distributions from the Bank to the Company may be subject to regulatory approvals.

7 unchanged sentences

If conditions or circumstances arise that expose flaws or gaps in our risk management or compliance programs, or if our controls do not function as designed, the performance and value of our business could be adversely affected.

The Company may not be able to attract and retain skilled employees.

The Company's success depends, in large part, on its ability to attract and retain key people.

Competition for the best people can be intense, and the Company spends considerable time and resources attracting and hiring qualified people for its operations.

Unresolved Staff Comments

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors