FARMERS & MERCHANTS BANCORP 10-K

Item 1. Business Organizational Structure Farmers & Merchants Bancorp is a Delaware registered bank holding company organized in 1999. As a registered bank holding company, FMCB is subject to regulation, supervision, and examination by the Board of Governors of the Federal Reserve System (“Federal Reserve”) and by the California Department of Financial Protection and Innovation (“DFPI”). The Company’s principal business is to serve as a holding company for the Bank and for other banking or banking related subsidiaries, which the Company may establish or acquire. As a legal entity separate and distinct from its subsidiary, the Company’s principal source of funds is, and will continue to be, dividends paid by and other funds received from the Bank. Legal limitations are imposed on the amount of dividends that may be paid and loans that may be made by the Bank to the Company. See “Supervision and Regulation - Dividends and Other Transfer of Funds.” The Company’s outstanding common stock as of December 31, 2023, consisted of 747,971 shares of common stock, $0.01 par value. No shares of preferred stock were issued or outstanding as of December 31, 2023. The Company operates all financial service activities through its wholly-owned banking subsidiary, Farmers & Merchants Bank of Central California, which was organized in 1916. The Bank was incorporated under the laws of the State of California as a non-Federal Reserve member, California state-chartered bank subject to primary regulation, supervision and examination by the Federal Deposit Insurance Corporation (“FDIC”) and by the DFPI. The Bank’s two wholly-owned subsidiaries are Farmers & Merchants Investment Corporation and Farmers/Merchants Corporation. Farmers & Merchants Investment Corporation is currently dormant, and Farmers/Merchants Corporation acts as trustee on deeds of trust originated by the Bank. The Bank’s deposit accounts are insured under the Federal Deposit Insurance Act, as amended (“FDIA”), up to applicable limits. See “Supervision and Regulation – Deposit Insurance.” In March 2002, F & M Bancorp, Inc. was created to protect the name “F & M Bank.” During 2002, the Company completed a fictitious name filing in California to begin using the streamlined name, “F & M Bank,” as part of a larger effort to enhance the Company’s image and build brand name recognition. Since 2002, the Company has converted all of its daily operating and image advertising to the “F & M Bank” name and the Company’s logo, slogan and signage were redesigned to incorporate the trade name, “F & M Bank.” In 2003, the Company formed a wholly-owned Connecticut statutory business trust, FMCB Statutory Trust I, for the sole purpose of issuing trust-preferred securities. See Note 9 “Long-Term Subordinated Debentures” located in Item 8. “Financial Statements and Supplementary Data” in this Form 10-K. Market Area The Company’s primary service area is the mid Central Valley of California, including Sacramento, San Joaquin, Solano, Stanislaus and Merced counties, and the east region of the San Francisco Bay Area, including Napa, Alameda, and Contra Costa counties. The Company operates 29 full-service branches and 3 stand-alone ATMs. The following statistical data, for the counties in our market area, are set forth below: • Sacramento County, with branches in Sacramento, Elk Grove, Galt and Walnut Grove. This county had a Population of 1.6 million and a Median Household Income of approximately $83,985. Significant employment sectors include the following: government, education & health trade, and transportation & utilities. Unemployment was at 4.7%. 4 Table of Contents • San Joaquin County, with branches in Lodi, Linden, Stockton, Lockeford and Manteca. This county had a Population of 0.79 million and a Median Household Income of approximately $82,837. Significant employment sectors include the following: trade, transportation & utilities, government, and education & health services. Unemployment was at 6.8%. • Solano County, with a branch in Rio Vista. This county had a Population of 0.45 million and a Median Household Income of approximately $97,037. Significant employment in the following industries: education and health services, trade, transportation and utilities, and government. Unemployment was at 5.1%. • Stanislaus County, with branches in Modesto, Riverbank and Turlock. This county had a Population of 0.55 million and a Median Household Income of approximately $74,872. Significant employment in the following sectors: trade, transportation & utilities, educational & health services, and government. Unemployment was at 6.9%. • Merced County, with branches in Hilmar and Merced. This county had a Population of 0.29 million and a Median Household Income of approximately $64,772. Significant employment in the following sectors: government, trade, transportation & utilities, and farming. Unemployment was at 10.2%. • Alameda County, with a branch in Oakland. This county had a Population of 2.8 million and a Median Household Income of approximately $122,488. Significant employment in the following sectors: professional & business services, educational & health services, trade, and transportation & utilities. Unemployment was at 4.5%. • Contra Costa County, with branches in Concord and Walnut Creek. This county had a Population of 2.8 million and a Median Household Income of approximately $110,455. The Significant employment in the following sectors: professional & business services, educational & health services, trade, and transportation & utilities. Unemployment was at 4.5%. • Napa County, with a branch in Napa. This county had a Population of 0.13 million and a Median Household Income of approximately $105,809. Significant employment in the following sectors: manufacturing, leisure & hospitality, trade, and educational & health services. Unemployment was at 4.1%. Through its network of banking offices, the Company emphasizes personalized service along with a broad range of banking services to businesses and individuals located in the service areas of its offices. Although the Company focuses on marketing its services to small and medium-sized businesses, a broad range of retail banking services are also made available to the local consumer market. The Company offers a wide range of deposit products. These include checking, savings, money market, time certificates of deposit, individual retirement accounts and online banking services for both business and personal accounts. The Company provides a broad complement of lending products, including commercial, commercial real estate, real estate construction, agribusiness, consumer, credit card, residential real estate loans, and equipment leases. Commercial products include term loans, leases, lines of credit and other working capital financing and letters of credit. Financing products for individuals include automobile financing, lines of credit, residential real estate, home improvement and home equity lines of credit. The Company also offers a wide range of specialized services designed for the needs of its commercial accounts. These services include a credit card program for merchants, lockbox and other collection services, account reconciliation, investment sweep, on-line account access, and electronic funds transfers by way of domestic and international wire and automated clearinghouse. 5 Table of Contents The Company makes investment products available to customers, including mutual funds and annuities. These investment products are offered through a third party, which employs investment advisors to meet with and provide investment advice to the Company’s customers. Competition The banking and financial services industry in California generally, and in the Company’s market areas specifically, is highly competitive. The increasingly competitive environment is a result primarily of changes in regulation, changes in technology and product delivery systems, and the accelerating pace of consolidation among financial service providers. The Company competes with other major commercial banks, diversified financial institutions, credit unions, savings institutions, money market and other mutual funds, mortgage companies, and a variety of other non-banking financial services and advisory companies. Federal legislation encourages competition between different types of financial service providers and has fostered new entrants into the financial services market. It is anticipated that this trend will continue. Using the financial holding company structure, insurance companies and securities firms may compete more directly with banks and bank holding companies. Many of our competitors are much larger in total assets and capitalization, have greater access to capital markets and offer a broader range of financial services than the Company. In order to compete with other financial service providers, the Company relies upon personal contact by its officers, directors, employees, and stockholders, along with various promotional activities and specialized services. In those instances where the Company is unable to accommodate a customer’s needs, the Company may arrange for those services to be provided through its correspondents. The market shares of the Bank and all other banks within the eight counties in California in which we operate, at June 30, 2023 (the most recent data available), as reported by FDIC, are as follows: County F&M Bank Deposits All Banks Deposits F&M Bank Deposit Share (Dollars in thousands) San Joaquin $ 1,946,599 $ 15,208,059 12.80 % Stanislaus 1,011,213 11,496,841 8.80 % Merced 278,564 3,402,530 8.19 % Solano 194,503 6,843,282 2.84 % Sacramento 706,016 71,900,266 0.98 % Contra Costa 456,919 53,024,409 0.86 % Napa 19,833 5,117,439 0.39 % Alameda 27,412 66,995,394 0.04 % Total $ 4,641,059 $ 233,988,220 1.98 % Human Capital Resources As of December 31, 2023, we employed 378 full-time-equivalent employees. The Company believes that its employee relations are satisfactory. For the year ended December 31, 2023, salaries and employee benefits expense totaled $71 million, representing 68% of our total non-interest expense. Expenses, excluding salaries, related to education, training, recruiting and placement was approximately $500,000 for the period ended December 31, 2023. We are led by an experienced management team with substantial experience in the markets we serve and the financial products we offer. Our business strategy focuses on providing products and services through long-term relationship managers. As a result, our success depends heavily on the performance of our employees, as well as on our ability to attract, motivate and retain highly qualified employees at all levels of the Company. We believe that our work environment contributes to employee satisfaction and retention. 6 Table of Contents We are committed to maintaining a work environment where every employee is treated with dignity and respect, free from the threat of discrimination and harassment. As stated in our Board approved (i) Code of Conduct and (ii) Prohibited Harassment Policy, we expect these same standards to apply to all stakeholders, and to our interactions with customers, vendors and independent contractors. We are firmly committed to providing equal employment and advancement opportunities to all qualified individuals and will not tolerate any discrimination or harassment of any kind. Team members are encouraged to immediately report any discrimination or harassment to their supervisor and human resources. Policies and Planning We are proud to be an Equal Opportunity Employer and enforce those values throughout all of our operations. We prohibit discrimination in hiring or advancement against any individual on the basis of race, color, religion, gender, sex, national origin, age, marital status, pregnancy, physical or mental disability, genetics, veteran status, sexual orientation, or any other characteristic protected by applicable law. We strive to ensure our team members have access to working conditions that provide a safe and healthy environment, free from work-related injuries and illnesses. Many of our locations employ badges and keypads to enter or to enter restricted areas of locations that have a public presence. Each year our annual planning and budgeting process involves an assessment of staffing levels and skills and results in the development of targets for recruitment and training. In addition, our Board of Directors reviews all succession plans in place for key personnel. Recruitment We strive to recruit talent from both local educational institutions and the banking industry. The Company has full-time staff dedicated to our recruitment efforts and we utilize many of the major recruitment firms and websites. Annually we visit local colleges and universities for job fairs and other recruitment events, which we believe allows us to identify those students who have the skills and aptitudes we need in the Company. The results of these efforts has been a consistent flow of candidates to fill our staffing needs as we grow. Compensation Salary and Bonuses We have job descriptions and salary grade ranges for all of our positions. Annually, we use outside survey firms to provide information on market pay. We also pay performance-based bonuses to our employees. We use different performance based bonus programs for those in business generating roles and those in administrative support roles to ensure incentives align with job responsibilities and proper segregation of duties. During 2023, total bonus compensation amounted to over 30% of base salaries. We believe that this “pay-for-performance” approach allows us to effectively recruit and retain key employees. Retirement Plans All employees are eligible to participate in our Profit Sharing Plan after one year of service and having worked at least 1,000 hours. The Company makes contributions equal to 5% of the employee’s eligible compensation and discretionary contributions determined annually by the Board of Directors. This is not a matching based program; employees receive these contributions regardless of whether they make individual contributions to our 401(K) program. During 2023 total contributions for the Profit Sharing Plan amounted to over 10% of base salaries, a level that we believe helps us in recruitment and retention. 7 Table of Contents Medical and Other Benefits In addition to competitive salaries, incentives and retirement benefits, we provide comprehensive medical, dental, and vision plans, health savings accounts, paid sick time, long-term disability, basic life and AD&D insurance, flexible spending accounts, and employee assistance and wellness programs. Training Job Related We support team members, should they wish to continue their education in subjects and fields that are directly related to our operations, activities, and objectives. We encourage our team members to pursue educational opportunities that will help improve job performance and professional development. To further this goal, we reimburse tuition and certain fees for satisfactory completion of approved educational courses and certain certifications. Included are college credit courses at accredited colleges and universities, continuing education courses and certification exams. Diversity, Equity, and Inclusion (“DE&I”) To foster a deeper understanding regarding diversity and inclusion, the Company assigns all employees diversity and inclusion training - Diversity Made Simple. The diversity course is mandatory for all staff. As of December 31, 2023, all employees had met their diversity and inclusion training obligations. Our DE&I efforts focus on shared commitment and action across business lines to foster a culture of belonging and inclusion among our colleagues. Our efforts extend to our markets by strengthening our DE&I efforts in our relationships with customers and the communities that we live in and serve . In 2023, we used our expertise to provide loans and investments as well as financial support to promote affordable housing, provide small business lending, and advance neighborhood development through philanthropic support. These initiatives and investments create opportunities for individuals, families, and businesses to fully participate in and share the rewards of building economic stability in our communities. Harassment Prevention The Company assigns all employees preventative harassment training. Every two years non-supervisory employees receive one hour of harassment prevention training while supervisors receive two hours of harassment prevention training. Newly hired employees are assigned harassment prevention and must complete the training within six months of hire or promotion. Following the initial training, all employees must complete training every two years, at minimum. As of December 31, 2023, all employees had met their harassment prevention training requirements for 2023. Performance Evaluation The Company has implemented a Performance Planning, Coaching and Evaluation (“PPC&E”) system that requires each year that employees and their managers establish detailed goals and objectives. Annually, employees are reviewed relative to their progress in achieving those goals, with the objective of reducing performance surprises and encouraging behavior that is consistent with Company objectives. We believe that this PPC&E discipline is important in retaining and growing our employees. Succession Planning The Company has a succession planning process led by the Board of Directors and executive management. The Board engages in strategic planning sessions, which includes board succession plans and succession plans for executive management and other key positions. Succession plans are designed to ensure a smooth and orderly transition. These succession plans are discussed with our regulators during the examination process. Government Policies The Company’s profitability, like that of most financial institutions, is significantly dependent on interest rate differentials. The difference between the interest rates paid by the Company on interest-bearing liabilities, such as deposits and other borrowings, and the interest rates received by the Company on its interest-earning assets, such as loans and leases extended to its customers and securities held in its investment portfolio, comprise the major portion of the Company’s earnings. These rates are highly sensitive to many factors that are beyond the control of the Company and the Bank, such as inflation, recession, unemployment, and the monetary policy of the Federal Reserve. The impact that changes in economic conditions might have on the Company and the Bank cannot be predicted. 8 Table of Contents The business of the Company is also influenced by the monetary and fiscal policies of the federal government and the policies of regulatory agencies, particularly the Federal Reserve. The Federal Reserve implements national monetary policies (with objectives such as curbing inflation and maximum employment, stable prices, and moderate long-term interest rates) through its open-market operations in U.S. Government securities by adjusting the required level of reserves for depository institutions subject to its reserve requirements, and by varying the target federal funds and discount rates applicable to borrowings by depository institutions. The actions of the Federal Reserve in these areas influence the growth of bank loans and leases, investments, and deposits and affect interest rates earned on interest-earning assets and paid on interest-bearing liabilities. The nature and impact on the Company of any future changes in monetary and fiscal policies cannot be predicted. From time to time, legislative acts, as well as regulations, are enacted which have the effect of increasing the cost of doing business, limiting or expanding permissible activities, or affecting the competitive balance between banks and other financial services providers. Proposals to change the laws and regulations governing the operations and taxation of banks, bank holding companies, and other financial institutions and financial services providers are frequently made in the U.S. Congress, in the state legislatures, and before various regulatory agencies. This legislation may change banking statutes and the operating environment of the Company and the Bank in substantial and unpredictable ways. If enacted, such legislation or regulations could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance among banks, savings institutions, credit unions, and other financial institutions. The Company cannot predict whether any of this potential legislation will be enacted, and if enacted, the effect that it, or any implemented regulations, would have on the financial condition or results of operations of the Company or any of its subsidiaries. Supervision and Regulation General Bank holding companies and banks are extensively regulated under both federal and state law. The regulation is intended primarily for the protection of the banking system and the Deposit Insurance Fund (“DIF”) and clients of insured depository institutions and not for the benefit of stockholders of the Company. This supervisory and regulatory framework subjects banks and bank holding companies to regular examination by their respective regulatory agencies, which results in examination reports and ratings that, while not publicly available, can affect the conduct and growth of their businesses. These examinations consider not only compliance with applicable laws and regulations, but also capital levels, asset quality and risk, management ability and performance, earnings, liquidity, and various other factors. The regulatory agencies generally have broad discretion to impose restrictions and limitations on the operations of a regulated entity where the agencies determine, among other things, that such operations are unsafe or unsound, fail to comply with applicable law or are otherwise inconsistent with laws and regulations or with the supervisory policies of these agencies. Set forth below is a summary description of the material laws and regulations, which relate to the operations of the Company and the Bank. This description does not purport to be complete and is qualified in its entirety by reference to the applicable laws and regulations. The Company The Company is a registered bank holding company and is subject to regulation under the Bank Holding Company Act of 1956, as amended (“BHCA”). Accordingly, the Company’s operations are subject to extensive regulation and examination by the Federal Reserve. The Company is required to file with the Federal Reserve quarterly and annual reports and such additional information as the Federal Reserve may require pursuant to the BHCA. The Federal Reserve conducts periodic examinations of the Company. 9 Table of Contents The Federal Reserve may require that the Company terminate an activity, terminate control of, liquidate, or divest certain subsidiaries or affiliates when the Federal Reserve believes the activity or the control of the subsidiary or affiliate constitutes a significant risk to the financial safety, soundness or stability of any of its banking subsidiaries. The Federal Reserve also has the authority to regulate provisions of certain bank holding company debt. Under certain circumstances, the Company must file written notice with, and obtain approval from, the Federal Reserve prior to purchasing or redeeming its equity securities. Under the BHCA and regulations adopted by the Federal Reserve, a bank holding company and its non-banking subsidiaries are prohibited from requiring certain tie-in arrangements in connection with an extension of credit, lease or sale of property, or furnishing of services. For example, with certain exceptions, a bank may not condition an extension of credit on a promise by its customer to obtain other services provided by it, its holding company or other subsidiaries, or on a promise by its customer not to obtain other services from a competitor. In addition, federal law imposes certain restrictions on transactions between Farmers & Merchants Bancorp and its subsidiaries. Further, the Company is required by the Federal Reserve to maintain certain levels of capital. See “Capital Standards.” The Company is prohibited by the BHCA, except in certain statutorily prescribed instances, from acquiring direct or indirect ownership or control of more than 5% of the outstanding voting shares of any company that is not a bank or bank holding company and from engaging directly or indirectly in activities other than those of banking, managing or controlling banks, or furnishing services to its subsidiaries. However, the Company, subject to the prior notice to, and/or approval of, the Federal Reserve, may engage in any, or acquire shares of companies engaged in any, activities that are deemed by the Federal Reserve to be so closely related to banking or managing or controlling banks as to be a proper incident thereto. A bank holding company is required to serve as a source of financial and managerial strength to its subsidiary banks and may not conduct its operations in an unsafe or unsound manner. In addition, it is the Federal Reserve’s policy, that in serving as a source of strength to its subsidiary banks, a bank holding company should stand ready to use available resources to provide adequate capital funds to its subsidiary banks during periods of financial stress or adversity and should maintain the financial flexibility and capital-raising capacity to obtain additional resources for assisting its subsidiary banks. This support may be required at times when a bank holding company may not be able to provide such support. A bank holding company’s failure to meet its obligations to serve as a source of strength to its subsidiary banks will generally be considered by the Federal Reserve to be an unsafe and unsound banking practice or a violation of the Federal Reserve’s regulations or both. The Company is not a financial holding company for purposes of the BHCA. The Company is also a bank holding company within the meaning of the California Financial Code. As such, the Company and its subsidiaries are subject to examination by, and may be required to file reports with, the DFPI. The Company’s common stock is registered with the Securities and Exchange Commission (“SEC”) under the Securities Exchange Act of 1934, as amended (the “Exchange Act”). As such, the Company is subject to the reporting, proxy solicitation and other requirements and restrictions of the Exchange Act. The Bank The Bank, as a California-chartered non-Federal Reserve member bank, is subject to primary supervision, periodic examination and regulation by the DFPI and the FDIC. If, as a result of an examination of the Bank, the FDIC should determine that the financial condition, capital resources, asset quality, earnings prospects, management, liquidity, or other aspects of the Bank’s operations are unsatisfactory, or that the Bank or its management is violating or has violated any law or regulation, various remedies are available to the FDIC. Such remedies include the power to enjoin “unsafe or unsound” practices, to require affirmative action to correct any conditions resulting from any violation or practice, to issue an administrative order that can be judicially enforced, to direct an increase in capital, to restrict the growth of the Bank, to assess civil monetary penalties, to remove officers and directors, and ultimately to terminate the Bank’s deposit insurance, which for a California-chartered bank would result in a revocation of the Bank’s charter. The DFPI has many of the same remedial powers. 10 Table of Contents Various requirements and restrictions under the laws of the State of California and the United States affect the operations of the Bank. State and federal statutes and regulations relate to many aspects of the Bank’s operations, including reserves against deposits, ownership of deposit accounts, interest rates payable on deposits, loans and leases, investments, mergers and acquisitions, borrowings, dividends, locations of branch offices, and capital requirements. Further, the Bank is required to maintain certain levels of capital. See “Capital Standards.” The Dodd Frank Wall Street Reform and Consumer Protection Act (the “Dodd Frank Act”) - The Dodd-Frank Act implemented sweeping reform across the U.S. financial regulatory framework, including, among other changes: • creating a Financial Stability Oversight Council tasked with identifying and monitoring systemic risks in the financial system; • creating the Consumer Financial Protection Bureau (“CFPB”), which is responsible for implementing, examining and enforcing compliance with federal consumer financial protection laws; • requiring the FDIC to make its capital requirements for insured depository institutions countercyclical, so that capital requirements increase in times of economic expansion and decrease in times of economic contraction; • imposing more stringent capital requirements on bank holding companies and subjecting certain activities, including interstate mergers and acquisitions, to heightened capital conditions; • changing the assessment base for federal deposit insurance from the amount of the insured deposits held by the depository institution to the depository institution’s average total consolidated assets less tangible equity, eliminating the ceiling on the size of the FDIC’s DIF and increasing the floor on the size of the FDIC’s DIF; • eliminating all remaining restrictions on interstate banking by authorizing state banks to establish de novo banking offices in any state that would permit a bank chartered in that state to open a banking office at that location; • repealing the federal prohibitions on the payment of interest on demand deposits, thereby permitting depository institutions to pay interest on business transaction and other accounts; and • in the so-called “Volcker Rule,” subject to numerous exceptions, prohibiting depository institutions and affiliates from certain investments in, and sponsorship of, hedge funds and private equity funds and from engaging in proprietary trading. Many of the law’s provisions have been implemented by rules and regulations of the federal banking agencies. The law contains many provisions which have particular relevance to our business, including provisions that have resulted in adjustments to our FDIC deposit insurance premiums and that resulted in increased capital and liquidity requirements, increased supervision, increased regulatory and compliance risks and costs and other operational costs and expenses, reduced fee-based revenues and restrictions on some aspects of our operations, and increased interest expense on our demand deposits. On May 24, 2018, President Trump signed the Economic Growth, Regulatory Relief and Consumer Protection Act (“Economic Growth Act”), which repealed or modified certain provisions of the Dodd-Frank Act and eased regulations on all but the largest banks. 11 Table of Contents The Economic Growth Act’s highlights include improving consumer access to mortgage credit that, among other things: (i) exempt banks with less than $10 billion in assets from the ability-to-repay requirements for certain qualified residential mortgage loans; (ii) do not require appraisals for certain transactions valued at less than $400,000 in rural areas; (iii) exempt banks and credit unions that originate fewer than 500 open-end and 500 closed-end mortgages from the Home Mortgage Disclosure Act’s (“HMDA”) expanded data disclosures (the provision would not apply to nonbanks and would not exempt institutions from HMDA reporting altogether); (iv) amend the SAFE Mortgage Licensing Act by providing registered mortgage loan originators in good standing with 120 days of transitional authority to originate loans when moving from a federal depository institution to a non-depository institution or across state lines; (v) require the CFPB to clarify how Truth in Lending Disclosure (“TRID”) rules apply to mortgage assumption transactions and construction-to-permanent home loans as well as outline certain liabilities related to model disclosure use; and (vi) provide that federal banking regulators may not impose higher capital standards on High Volatility Commercial Real Estate exposures unless they are for acquisition, development or construction (“ADC”), and clarifies ADC status. In addition, the Economic Growth Act’s highlights also include regulatory relief for certain institutions, including among other things, simplifying capital calculations by requiring regulators to adopt a threshold for a community bank leverage ratio of between 8% to 10%. Institutions under $10 billion in assets that meet such community bank leverage ratio will automatically be deemed to be “well-capitalized”, although regulators retain the flexibility to determine that a depository institution may not qualify for the community bank leverage ratio test based on the institution’s risk profile. The Economic Growth Act also exempts community banks from Section 13 of the BHCA if they have less than $10 billion in total consolidated assets; and exempts banks with less than $10 billion in assets, and total trading assets and liabilities not exceeding more than five percent of their total assets, from the Volcker Rule restrictions on trading with their own capital. The Economic Growth Act also added certain protections for consumers, including veterans and active duty military personnel, expanded credit freezes and created an identity theft protection database. The Economic Growth Act also made changes applicable to bank holding companies, as it raises the threshold for automatic designation as a systemically important financial institution from $50 billion to $250 billion in assets, subjects banks with $100 billion to $250 billion in total assets to periodic stress tests, exempts from stress test requirements entirely banks with under $100 billion in assets, and required the federal banking regulators , within 180 days of passage, to raise the asset threshold under the Small Bank Holding Company Policy Statement from $1 billion to $3 billion. The Economic Growth Act also added certain protections for student borrowers. Whether and the extent to which the Economic Growth Act, or any other new legislation, will result in additional regulatory initiatives and policies, or modifications of existing regulations and policies, which may impact our business, cannot be predicted at this time. No current assurance may be given that any other such legislative changes will not have a negative impact on the results of operations and financial condition of the Company and the Bank. Capital Standards The federal banking agencies have risk-based capital adequacy guidelines intended to provide a measure of capital adequacy that reflects the degree of risk associated with a banking organization’s operations, both for transactions reported on the balance sheet as assets and for transactions, such as letters of credit and recourse arrangements, that are recorded as off-balance sheet items. In 2013, the Federal Reserve, FDIC, and Office of the Comptroller of the Currency issued final rules (the “Basel III Capital Rules”) establishing a new comprehensive capital framework for U.S. banking organizations. The rules implement the Basel Committee’s December 2010 framework, commonly referred to as Basel III, for strengthening international capital standards, as well as implementing certain provisions of the Dodd-Frank Act. 12 Table of Contents The Basel III Capital Rules became effective for the Company and the Bank on January 1, 2015 (subject to phase-in periods for some of their components). The Basel III Capital Rules: (i) introduce a new capital measure called Common Equity Tier 1 (“CET1”), and a related regulatory capital ratio of CET1 to risk-weighted assets; (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments, which are instruments treated as Tier 1 instruments under the prior capital rules that meet certain revised requirements; (iii) mandate that most deductions or adjustments to regulatory capital measures be made to CET1 and not to the other components of capital; and (iv) expand the scope of the deductions from and adjustments to capital, as compared to existing regulations. Under the Basel III Capital Rules, for most banking organizations, the most common form of additional Tier 1 capital is non-cumulative perpetual preferred stock and the most common form of Tier 2 capital is subordinated notes and a portion of the allowance for credit losses, in each case, subject to the Basel III Capital Rules’ specific requirements. Under the Basel III Capital Rules, the following are the minimum capital ratios applicable to the Company and the Bank: • 4.0% Tier 1 leverage ratio; • 4.5% CET1 to risk-weighted assets, plus the capital conservation buffer, effectively resulting in a minimum ratio of CET1 to risk-weighted assets of at least 7%; • 6.0% Tier 1 capital to risk-weighted assets, plus the capital conservation buffer, effectively resulting in a minimum Tier 1 capital ratio of at least 8.5%; and • 8.0% total capital to risk-weighted assets, plus the capital conservation buffer, effectively resulting in a minimum total capital ratio of at least 10.5%. The Basel III Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that: (i) mortgage servicing rights, (ii) deferred tax assets arising from temporary differences that could not be realized through net operating loss carrybacks, and (iii) significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such items, in the aggregate, exceed 15% of CET1. Under the Basel III Capital Rules, the effects of certain accumulated other comprehensive income or loss items are not excluded for the purposes of determining regulatory capital ratios; however, non-advanced approaches banking organizations (i.e., banking organizations with less than $250 billion in total consolidated assets or with less than $10 billion of on-balance sheet foreign exposures), including the Company and the Bank, may make a one-time permanent election to exclude these items. The Company and the Bank made this election in 2015 in order to avoid significant variations in the level of capital depending upon the impact of interest rate fluctuations on the fair value of its available-for-sale investment securities portfolio, changes of which are included in accumulated other comprehensive income or loss. The Basel III Capital Rules prescribe a standardized approach for risk weightings that expands the risk weighting categories from the previous four Basel I-derived categories (0%, 20%, 50% and 100%) to a larger and more risk-sensitive number of categories, generally ranging from 0% for U.S. Government and agency securities, to 600% for certain equity exposures, depending on the nature of the assets. The Basel III capital rules generally result in higher risk weights for a variety of asset classes. Additional aspects of the Basel III Capital Rules that are relevant to the Company and the Bank include: • consistent with the Basel I risk-based capital rules, assigning exposures secured by single-family residential properties to either a 50% risk weight for first-lien mortgages that meet prudent underwriting standards or a 100% risk weight category for all other mortgages; • providing for a 20% credit conversion factor for the unused portion of a commitment with an original maturity of one year or less that is not unconditionally cancellable (set at 0% under the Basel I risk-based capital rules); • assigning a 150% risk weight to all exposures that are nonaccrual or 90 days or more past due (set at 100% under the Basel I risk-based capital rules), except for those secured by single-family residential properties, which will be assigned a 100% risk weight, consistent with the Basel I risk-based capital rules; 13 Table of Contents • applying a 150% risk weight instead of a 100% risk weight for certain high volatility commercial real estate acquisition, development and construction loans; and • applying a 250% risk weight to the portion of mortgage servicing rights and deferred tax assets arising from temporary differences that could not be realized through net operating loss carrybacks that are not deducted from CET1 capital (set at 100% under the Basel I risk-based capital rules). With respect to the Bank, the Basel III capital rules also revise the prompt corrective action regulations pursuant to Section 38 of the FDIA. As of December 31, 2023, the Company’s and the Bank’s capital ratios exceeded the minimum capital adequacy guideline percentage requirements of the federal banking agencies for a “well capitalized” institution under the Basel III capital rules on a fully phased-in basis. In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms, which standards are commonly referred to as Basel IV. Among other things, these standards revise the Basel Committee’s standardized approach for credit risk (including the recalibration of the risk weights and the introduction of new capital requirements for certain “unconditionally cancellable commitments,” such as unused credit card lines of credit) and provides a new standardized approach for operational risk capital. Under the Basel framework, these standards were generally effective on January 1, 2022, with an aggregate output floor phasing in through January 1, 2027. On July 27, 2023, the federal banking agencies issued a proposed rule to implement the final components of the Basel III standards set by the Basel Committee on Banking Supervision in 2017. The proposed rule, which would not apply to the Company and the Bank as proposed, would substantially revise the existing regulatory capital framework for institutions with $100 billion or more of assets. Under the current U.S. capital rules, operational risk capital requirements and a capital floor apply only to advanced approaches institutions, and not to the Bank. The impact of Basel IV on us will depend on how it is implemented by the federal bank regulators. Prompt Corrective Action (“PCA”) The FDIA requires federal banking agencies to take PCA in respect of depository institutions that do not meet minimum capital requirements. The FDIA includes the following five capital tiers: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” A depository institution’s capital tier will depend upon how its capital levels compare with various relevant capital measures and certain other factors, as established by regulation. The Basel III Capital Rules revised the PCA requirements effective January 1, 2015. Under the revised PCA provisions of the FDIA, an insured depository institution generally will be classified in the following categories based on the capital measures indicated: Minimum to be Categorized as "Well Capitalized" Minimum to be Categorized as "Adequately Capitalized" Under-capitalized Significantly Under- capitalized Critically Under- capitalized Risk-based capital to risk-weighted assets 10.00 %+ 8.00 %+ < 8.00% < 6.00% N/A Tier 1 capital to risk-weighted assets 8.00 %+ 6.00 %+ < 6.00% < 4.00% N/A CET1 capital to risk-weighted assets 6.50 %+ 4.50 %+ < 4.50% < 3.00% N/A Tier 1 leverage capital ratio 5.00 %+ 4.00 %+ < 4.00% < 3.00% N/A Tangible equity to assets N/A N/A N/A N/A < 2.00% Supplemental leverage ratio N/A 3.00 %+ < 3.00% N/A N/A 14 Table of Contents An institution may be downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios, if it is determined to be operating in an unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters. A bank’s capital category is determined solely for the purpose of applying PCA regulations and the capital category may not constitute an accurate representation of the bank’s overall financial condition or prospects for other purposes. The FDIA generally prohibits a depository institution from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company, if the depository institution would thereafter be “undercapitalized.” “Undercapitalized” institutions are subject to growth limitations and are required to submit capital restoration plans. If a depository institution fails to submit an acceptable plan, it is treated as if it is “significantly undercapitalized.” “Significantly undercapitalized” depository institutions may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become “adequately capitalized,” requirements to reduce total assets, and cessation of receipt of deposits from correspondent banks. “Critically undercapitalized” institutions are subject to the appointment of a receiver or conservator by the bank regulators. The capital classification of a bank holding company and a bank affects the frequency of regulatory examinations, the bank holding company’s and the bank’s ability to engage in certain activities and the deposit insurance premium paid by the bank to the FDIC. As of December 31, 2023, we met the requirements to be classified as “well capitalized” based upon the aforementioned ratios for purposes of the PCA regulations. The Community Bank Leverage Ratio On November 4, 2019, the federal banking agencies jointly issued a final rule that provides for an optional, simplified measure of capital adequacy, known as the community bank leverage ratio (“CBLR”) framework, for qualifying community banking organizations consistent with Section 201 of the Economic Growth Act. The CBLR framework is designed to reduce the capital burden by removing the requirements for calculating and reporting risk-based capital ratios for qualifying community banking organizations that opt into the framework. The final rule was effective on January 1, 2020. In order to qualify for the CBLR framework, a community banking organization must have a tier 1 leverage ratio of greater than 9%, less than $10 billion in total consolidated assets, off-balance-sheet exposures of 25% or less of total consolidated assets, and trading assets and liabilities of 5% or less of total consolidated assets. A qualifying community banking organization that opts into the CBLR framework and meets all requirements under the framework will be considered to have met the “well capitalized” ratio requirements under the PCA regulations. Such a community banking organization would not be subject to other risk-based and leverage capital requirements (including the Basel III and Basel IV requirements). The CBLR is determined by dividing a financial institution’s tangible equity capital by its average total consolidated assets. The rule describes what is included in tangible equity capital and average total consolidated assets. The CBLR framework was available for banks to use in their March 31, 2020, call report. A CBLR bank that ceases to meet any of the qualifying criteria in a future period but maintains a leverage ratio greater than 8% will be allowed a grace period of two reporting periods to satisfy the CBLR qualifying criteria or to otherwise comply with the generally applicable capital requirements. Further, a CBLR bank may opt out of the framework at any time, without restriction, by reverting to the generally applicable capital requirements. The Company and Bank did not opt into the CBLR framework. Anti-Money Laundering and Office of Foreign Assets Control Regulation Title III of the United and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (the “Patriot Act”), is designed to deny terrorists and criminals the ability to obtain access to the U.S. financial system and has significant implications for depository institutions, brokers, dealers and other businesses involved in the transfer of money. 15 Table of Contents The Patriot Act mandates financial services companies to have policies and procedures with respect to measures designed to address any or all of the following matters: (i) customer identification programs; (ii) money laundering; (iii) terrorist financing; (iv) identifying and reporting suspicious activities and currency transactions; (v) currency crimes; and (vi) cooperation between financial institutions and law enforcement authorities. Regulatory authorities routinely examine financial institutions for compliance with these obligations, and failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal and reputational consequences for the institution, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required. Regulatory authorities have imposed cease and desist orders and civil money penalties against institutions found to be violating these obligations. The U.S. Treasury’s Office of Foreign Assets Control (“OFAC”) administers and enforces economic and trade sanctions against targeted foreign countries and regimes under authority of various laws, including designated foreign countries, nationals and others. OFAC publishes lists of specially designated targets and countries. Financial institutions are responsible for, among other things, blocking accounts of and transactions with such targets and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence. Banking regulators examine banks for compliance with the economic sanctions regulations administered by OFAC, and failure of a financial institution to maintain and implement adequate OFAC programs, or to comply with all of the relevant laws or regulations, could have serious legal and reputational consequences for the institution. Privacy Restrictions The Gramm-Leach-Bliley Act (“GLBA”) requires financial institutions in the U.S. to provide certain privacy disclosures to customers and consumers, to comply with certain restrictions on the sharing and usage of personally identifiable information, and to implement and maintain commercially reasonable customer information safeguarding standards. The Company believes that it complies with all provisions of the GLBA and all implementing regulations and that the Bank has developed appropriate policies and procedures to meet its responsibilities in connection with the privacy provisions of the GLBA. Certain state laws and regulations designed to protect the privacy and security of customer information also apply to us and our subsidiaries, including laws requiring notification to affected individuals and regulators of data security breaches and laws prohibiting sharing of customer information without the customer’s prior permission. In June 2018, the State of California enacted The California Consumer Privacy Act of 2018 (“CCPA”). This law became effective on January 1, 2020, and provides consumers with expansive rights and controls over their personal information which is obtained by or shared with “covered businesses”, which includes the Bank and most other banking institutions subject to California law. The CCPA gives consumers the right to request disclosure of information collected about them and whether that information has been sold or shared with others, the right to request deletion of personal information subject to certain exceptions, the right to opt out of the sale of the consumer’s personal information and the right not to be discriminated against because of choices regarding the consumer’s personal information. The CCPA provides for certain monetary penalties and for its enforcement by the California Attorney General or consumers whose rights under the law are not observed. It also provides for damages as well as injunctive or declaratory relief if there has been unauthorized access, theft or disclosure of personal information due to failure to implement reasonable security procedures. The CCPA contains several exemptions, including a provision to the effect that the CCPA does not apply where the information is collected, processed, sold or disclosed pursuant to the GLBA if the GLBA is in conflict with the CCPA. In November 2020, California voters approved state-wide Proposition 24, also known as the California Privacy Rights and Enforcement Act of 2020 (the “CPREA”) which expanded and amended certain provisions of the CCPA and created the California Privacy Protection Agency to enforce privacy rights for Californians and impose fines for violations of such rights. The CPREA requires businesses to not share a consumer’s personal information upon the consumer’s request, provides consumers with an opt-out option for having their sensitive personal information used or disclosed for advertising or marketing, to obtain permission for collecting data on certain minors, and to correct a consumer’s inaccurate information upon the consumer’s request. It also removed the ability of businesses to remedy violations before being penalized for violations and increased the penalties for such violations. Most of the provisions of the CPREA took effect in 2023 but some portions, such as the creation of the new state agency, went into effect immediately. While GLBA-regulated nonpublic, personal information generally is exempt under the CCPA, the CCPA and certain other state laws apply to the personal information of representatives of any business contacts that the Bank engages with who are California residents, employees who are California residents, and any other personal information that the Bank collects outside of the scope of GLBA, such as with respect to certain data collected from visitors to our website. The impact of these laws on the business of the Bank could result in increased operating expenses as well as additional exposure to the risk of litigation by or on behalf of consumers. 16 Table of Contents Dividends and Other Transfer of Funds Dividends from the Bank constitute the principal source of cash to the Company. The Company is a legal entity separate and distinct from the Bank. The Bank is subject to various statutory and regulatory restrictions on its ability to pay dividends to the Company. Under such restrictions, the amount available for payment of dividends to the Company by the Bank totaled $157.7 million at December 31, 2023. During 2023, the Bank paid $33.3 million in dividends to the Company of which $12.9 million was used for cash dividends to shareholders, $16.3 million was allocated for share repurchases and $4.1 million to cover expenses and maintain a cash reserve. The FDIC and the DFPI also have authority to prohibit the Bank from engaging in activities that, in their opinion, constitute unsafe or unsound practices in conducting its business. It is possible, depending upon the financial condition of the bank in question and other factors, that the FDIC or the DFPI could assert that the payment of dividends or other payments might, under some circumstances, be an unsafe or unsound practice. Further, the Federal Reserve and the FDIC have established guidelines with respect to the maintenance of appropriate levels of capital by banks and bank holding companies under their jurisdiction. Compliance with the standards set forth in such guidelines and the restrictions that are or may be imposed under the PCA provisions of federal law could limit the amount of dividends that the Bank or the Company may pay. An insured depository institution is prohibited from paying management fees to any controlling persons or, with certain limited exceptions, making capital distributions if after such transaction the institution would be undercapitalized. The DFPI may impose similar limitations on the Bank. See “Prompt Corrective Action” and “Capital Standards”, above, for a discussion of these additional restrictions on capital distributions. Transactions with Affiliates The Bank is subject to certain restrictions imposed by federal law on any extensions of credit to, or the issuance of a guarantee or letter of credit on behalf of the Company or other affiliates, the purchase of, or investments in, stock or other securities of the Company or other affiliates, the taking of such securities as collateral for loans and leases, and the purchase of assets of the Company or other affiliates. Such restrictions prevent the Company and other affiliates from borrowing from the Bank unless the loans are secured by marketable obligations of designated amounts. Further, such secured loans and investments by the Bank to or in the Company or to or in any other affiliates are limited, individually, to 10% of the Bank’s capital and surplus (as defined by federal regulations), and such secured loans and investments are limited, in the aggregate as to all affiliates, to 20% of the Bank’s capital and surplus (as defined by federal regulations). In addition, the Company and its operating subsidiaries generally may not purchase a low-quality asset from an affiliate, and other specified transactions between the Company or its operating subsidiaries and an affiliate must be on terms and conditions that are consistent with safe and sound banking practices. Also, the Bank and its operating subsidiaries may engage in transactions with affiliates only on terms and under conditions that are substantially the same, or at least as favorable to the Bank or its subsidiaries, as those prevailing at the time for comparable transactions with (or that in good faith would be offered to) non-affiliated companies. California law also imposes certain restrictions with respect to transactions with affiliates. Additionally, limitations involving the transactions with affiliates may be imposed on the Bank under the PCA provisions of federal law. See “Prompt Corrective Action.” 17 Table of Contents Safety and Soundness Standards The federal banking agencies have adopted guidelines that establish operational and managerial standards to promote the safety and soundness of federally insured depository institutions. The guidelines set forth standards for internal controls, information systems, internal audit systems, loan documentation; credit underwriting, interest rate exposure, asset growth, compensation, fees and benefits, asset quality and earnings. In general, the safety and soundness guidelines prescribe the goals to be achieved in each area, and each institution is responsible for establishing its own procedures to achieve those goals. If an institution fails to comply with any of the standards set forth in the guidelines, the financial institution’s primary federal regulator may require the institution to submit a plan for achieving and maintaining compliance. If a financial institution fails to submit an acceptable compliance plan, or fails in any material respect to implement a compliance plan that has been accepted by its primary federal regulator, the regulator is required to issue an order directing the institution to cure the deficiency. Until the deficiency cited in the regulator’s order is cured, the regulator may restrict the financial institution’s rate of growth, require the financial institution to increase its capital, restrict the rates the institution pays on deposits or require the institution to take any action the regulator deems appropriate under the circumstances. Noncompliance with the standards established by the safety and soundness guidelines may also constitute grounds for other enforcement action by the federal bank regulatory agencies, including cease and desist orders and civil money penalty assessments. Since the financial crisis of 2008-2009, the bank regulatory agencies have increasingly emphasized the importance of sound risk management processes and strong internal controls when evaluating the activities of the financial institutions they supervise. Properly managing risks has been identified as critical to the conduct of safe and sound banking activities and has become even more important as new technologies, product innovation, and the size and speed of financial transactions have changed the nature of banking markets. The agencies have identified a spectrum of risks facing a banking institution including, but not limited to, credit, market, liquidity, operational, legal, and reputational risk. In particular, regulatory pronouncements in the past few years have focused on operational risk, which arises from the potential that inadequate information systems, operational problems, breaches in internal controls, fraud, or unforeseen catastrophes will result in unexpected losses. New products and services, third-party risk management and cyber-security are critical sources of operational risk that financial institutions are expected to address in the current environment. The Bank is expected to have active board and senior management oversight; adequate policies, procedures, and limits; adequate risk measurement, monitoring, and management information systems; and comprehensive internal controls. Deposit Insurance As an FDIC-insured institution, the Bank is required to pay deposit insurance premium assessments to the FDIC. The premiums fund the Deposit Insurance Fund (“DIF”). The FDIC assesses a quarterly deposit insurance premium on each insured institution based on risk characteristics of the institution and may also impose special assessments in emergency situations. Effective July 1, 2016, the FDIC changed the deposit insurance assessment system for banks, such as the Bank, with less than $10 billion in assets that have been federally insured for at least five years. Among other changes, the FDIC eliminated risk categories for such banks and now uses the “financial ratios method” to determine assessment rates for all such banks. Under the financial ratios method, the FDIC determines assessment rates based on a combination of financial data and supervisory ratings that estimate a bank’s probability of failure within three years. The assessment rate determined by considering such information is then applied to the amount of the institution’s average assets minus average tangible equity to determine the institution’s insurance premium. On October 18, 2022, the FDIC adopted a final rule, applicable to all insured depository institutions to increase the initial base deposit insurance assessment rate schedules uniformly by two basis points consistent with the Amended Restoration Plan approved by the FDIC on June 21, 2022. The FDIC indicated that it was taking this action in order to restore the DIF reserve ratio to the required statutory minimum of 1.35% by the statutory deadline of September 30, 2028. The FDIC said that the reserve ratio had declined below this level because of the increase in insured deposits since the start of the COVID-19 pandemic and other factors that affect the level of the DIF. Under the final rule, the increase in rates began with the first quarterly assessment period of 2023 and will remain in effect unless and until the reserve ratio meets or exceeds 2% in order to support growth in the DIF in progressing toward the FDIC’s long-term goal of a 2% reserve ratio. 18 Table of Contents On November 16, 2023, the FDIC issued a final rule to implement a special assessment to recover the loss to the DIF associated with protecting uninsured depositors following the closures in early 2023 of Silicon Valley Bank and Signature Bank. Under the final rule, the assessment base for an insured depository institution will be equal to the institution’s estimated uninsured deposits as of December 31, 2022, adjusted to exclude the first $5 billion in estimated uninsured deposits. Under the final rule, the FDIC will collect the special assessment at an annual rate of 13.4 basis points beginning with the first quarterly assessment period of 2024 and will continue to collect special assessments for an anticipated total of eight quarterly assessment periods. This special assessment does not apply to the Bank. The Bank’s FDIC premiums were $2.4 million, $1.4 million, and $1.2 million for the three years ended December 31, 2023, 2022, and 2021, respectively. Future increases in insurance premiums could have adverse effects on the operating expenses and results of operations of the Company. Management cannot predict what the FDIC insurance assessment rates will be in the future. Insurance of a bank’s deposits may be terminated by the FDIC upon a finding that the institution has engaged in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order, or condition imposed by the FDIC or the Bank’s primary regulator. Management of the Company is not aware of any practice, condition or violation that might lead to termination of the Company’s deposit insurance. Community Reinvestment Act (“CRA”) and Fair Lending The Bank is subject to certain fair lending requirements involving lending, investing, and other CRA activities. CRA requires each insured depository institution to identify the communities served by the institution’s offices and to identify the types of credit and investments the institution is prepared to extend within such communities including low and moderate-income neighborhoods. It also requires the institution’s regulators to assess the institution’s performance in meeting the credit needs of its community and to consider such assessment in reviewing applications for mergers, acquisitions, relocation of existing branches, opening of new branches, and other transactions. A bank may be subject to substantial penalties and corrective measures for a violation of certain fair lending laws. A bank’s compliance with the CRA is assessed using an evaluation system, which bases CRA ratings on an institution’s lending, service and investment performance. An unsatisfactory rating may be the basis for denying a merger application. The Bank’s latest CRA examination was completed by the FDIC in August 2022 and the Bank received an overall Outstanding rating in complying with its CRA obligations. On October 24, 2023, the federal banking agencies jointly issued a final rule to strengthen and modernize the existing CRA regulations. Under the final rule, the agencies will evaluate a bank’s CRA performance based upon the varied activities that it conducts and the communities in which it operates. CRA evaluations and data collection requirements will be tailored based on bank size and type. The Bank would be considered a large bank under the final rule (with assets greater than $2 billion) and therefore will be evaluated under new lending, retail services and products, community development financing, and community development services tests. The final rule includes CRA assessment areas associated with mobile and online banking, and new metrics and benchmarks to assess retail lending performance. In addition, the final rule emphasizes smaller loans and investments that can have a high impact and be more responsive to the needs of low- and moderate-income communities. The rule imposes new data collection requirements on large banks, although certain data collection and reporting requirements will be limited to larger banks with assets greater than $10 billion. The final rule will take effect on April 1, 2024; however, compliance with the majority of the final rule's provisions will not be required until January 1, 2026, and the data reporting requirements of the final rule will not take effect until January 1, 2027. 19 Table of Contents Consumer Protection Regulations Banks and other financial institutions are subject to numerous laws and regulations intended to protect consumers in their transactions with banks. These laws include, among others, laws regarding unfair and deceptive acts and practices and usury laws, as well as the following consumer protection statutes: Truth in Lending Act, Truth in Savings Act, Electronic Fund Transfer Act, Expedited Funds Availability Act, Equal Credit Opportunity Act, Fair and Accurate Credit Transactions Act, Fair Housing Act, Fair Credit Reporting Act, Fair Debt Collection Practices Act, GLBA, Home Mortgage Disclosure Act, Right to Financial Privacy Act, Servicemembers Civil Relief Act, Military Lending Act and Real Estate Settlement Procedures Act. Many states and local jurisdictions have consumer protection laws analogous, and in addition, to those listed above. These federal, state and local laws regulate the manner in which financial institutions deal with customers when taking deposits, making loans or conducting other types of transactions. Failure to comply with these laws and regulations could give rise to regulatory sanctions, customer rescission rights, action by state and local attorneys general and civil or criminal liability. Failure to comply with consumer protection requirements may also result in our failure to obtain any required bank regulatory approval for merger or acquisition transactions we may wish to pursue or our prohibition from engaging in such transactions even if approval is not required. The structure of federal consumer protection regulation applicable to all providers of consumer financial products and services changed significantly on July 21, 2011, when the CFPB commenced operations to supervise and enforce federal consumer protection laws. The consumer protection provisions of the Dodd-Frank Act and the examination, supervision and enforcement of those laws and implementing regulations by the CFPB have created a more intense and complex environment for consumer finance regulation. The CFPB has significant authority to implement and enforce federal consumer protection laws and new requirements for financial services products provided for in the Dodd-Frank Act, as well as the authority to identify and prohibit unfair, deceptive or abusive acts and practices. The review of products and practices to prevent such acts and practices is a continuing focus of the CFPB, and of banking regulators more broadly. The ultimate impact of this heightened scrutiny is uncertain but could result in changes to pricing, practices, products and procedures. It could also result in increased costs related to regulatory oversight, supervision and examination, additional remediation efforts and possible penalties. In addition, the Dodd-Frank Act provides the CFPB with broad supervisory, examination and enforcement authority over various consumer financial products and services, including the ability to require reimbursements and other payments to customers for alleged legal violations and to impose significant penalties, as well as injunctive relief that prohibits lenders from engaging in allegedly unlawful practices. The CFPB also has the authority to obtain cease and desist orders providing for affirmative relief or monetary penalties. The Dodd-Frank Act does not prevent states from adopting stricter consumer protection standards. State regulation of financial products and potential enforcement actions could also adversely affect our business, financial condition or results of operations. The CFPB is authorized to issue rules for both bank and non-bank companies that offer consumer financial products and services, subject to consultation with the prudential banking regulators. In general, however, banks with assets of $10 billion or less, such as the Bank, will continue to be examined for consumer compliance by their primary bank regulator. Notice and Approval Requirements Related to Control Banking laws impose notice, approval and ongoing regulatory requirements on any stockholder or other party that seeks to acquire direct or indirect "control" of an FDIC-insured depository institution. These laws include the BHCA and the Change in Bank Control Act. Among other things, these laws require regulatory filings by a stockholder or other party that seeks to acquire direct or indirect "control" of an FDIC-insured depository institution or bank holding company. The determination whether an investor "controls" a depository institution is based on all of the facts and circumstances surrounding the investment. As a general matter, a party is deemed to control a depository institution or other company if the party owns or controls 25% or more of any class of voting stock. Subject to rebuttal, a party may be presumed to control a depository institution or other company if the investor owns or controls 10% or more of any class of voting stock. Ownership by family members, affiliated parties, or parties acting in concert, is typically aggregated for these purposes. If a party's ownership of the Company were to exceed certain thresholds, the investor could be deemed to "control" the Company for regulatory purposes. This could subject the investor to regulatory filings or other regulatory consequences. 20 Table of Contents In addition, except under limited circumstances, bank holding companies are prohibited from acquiring, without prior approval: • control of any other bank or bank holding company or all or substantially all the assets thereof; or • more than 5% of the voting shares of a bank or bank holding company which is not already a subsidiary. Incentive Compensation In 2010, the federal bank regulatory agencies issued comprehensive guidance intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of those organizations by encouraging excessive risk-taking. The incentive compensation guidance sets expectations for banking organizations concerning their incentive compensation arrangements and related risk management, control and governance processes. The incentive compensation guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon three primary principles: (1) balanced risk-taking incentives; (2) compatibility with effective controls and risk management; and (3) strong corporate governance. Any deficiencies in compensation practices that are identified may be incorporated into the organization’s supervisory ratings, which can affect its ability to make acquisitions or take other actions. In addition, under the incentive compensation guidance, a banking organization’s federal supervisor may initiate enforcement action if the organization’s incentive compensation arrangements pose a risk to the safety and soundness of the organization. In 2016, several federal financial agencies (including the Federal Reserve and FDIC) re-proposed restrictions on incentive-based compensation pursuant to Section 956 of the Dodd-Frank Act for financial institutions with $1 billion or more in total consolidated assets. For institutions with at least $1 billion but less than $50 billion in total consolidated assets, the proposal would impose principles-based restrictions that are broadly consistent with existing interagency guidance on incentive-based compensation. Such institutions would be prohibited from entering into incentive compensation arrangements that encourage inappropriate risks by the institution: (i) by providing an executive officer, employee, director, or principal shareholder with excessive compensation, fees, or benefits; or (ii) that could lead to material financial loss to the institution. The comment period for these proposed regulations has closed, but a final rule has not been published. Depending upon the outcome of the rule making process, the application of this rule to us could require us to revise our compensation strategy, increase our administrative costs and adversely affect our ability to recruit and retain qualified employees. Further, as discussed above, the Basel III Capital Rules limit discretionary bonus payments to bank executives if the institution’s regulatory capital ratios fail to exceed certain thresholds that started being phased in on January 1, 2016. It is currently anticipated that a third rulemaking document on incentive-based compensation arrangements for financial institutions could be proposed by these federal banking agencies in 2024. Available Information Company reports filed with the SEC, including the Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, proxy statements and ownership reports filed by directors, executive officers and principal stockholders, can be accessed free of charge through the Company’s website at http://www.fmbonline.com , as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC. The link to the SEC is on the About Us page. The Company’s reports may also be accessed at the SEC’s Internet website (http://www.sec.gov). 21 Table of Contents