What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2026-02-27 compared with 2025-02-27 · 214 added, 218 removed, 365 unchanged (54% of the section changed)

1 unchanged sentence

We are primarily engaged in the business of planning, directing, and coordinating the business activities of our wholly-owned subsidiary and single reportable segment, Heritage Bank.

Heritage Bank is headquartered in Olympia, Washington and conducts business from its 50 branch offices located throughout Washington State, the greater Portland, Oregon area, Eugene, Oregon and Boise, Idaho as of December 31, 2024.

Heritage Bank also does business under the Whidbey Island Bank name on Whidbey Island, Washington.

On January 31, 2026, Heritage completed its acquisition of Olympic and Olympic’s wholly-owned banking subsidiary, Kitsap Bank.

The acquisition added 16 branch offices to the franchise, doing business under the Kitsap Bank name as a division of Heritage Bank.

The deposits of the Bank are insured by the FDIC.

1 unchanged sentence

We also make real estate construction and land development loans and consumer loans.

Recent Acquisition

On January 31, 2026, the Company completed its acquisition of Olympic Bancorp, Inc., a bank holding company headquartered in Port Orchard, Washington, pursuant to the Agreement and Plan of Bank Merger, dated as of September 25, 2025, by and between the Company and Olympic (the "merger agreement"), whereby Olympic merged with and into the Company, and subsequently Kitsap Bank, Olympic's wholly-owned banking subsidiary, merged with and into the Bank.

Pursuant to the terms of the merger agreement, Olympic shareholders received 45.0 shares of Heritage common stock for each share of Olympic common stock based on a fixed exchange ratio.

Olympic's principal activity was the ownership and operation of Kitsap Bank, a state-chartered banking institution that operated sixteen branches in Washington at the time of closing.

The merger consideration, consisting of 7,167,600 shares of Heritage common stock, totaled approximately $185.0 million, based on the closing price of Heritage common stock on January 30, 2026, as reported on the Nasdaq Global Select Market.

At close, Olympic had total assets of approximately $1.6 billion, loans of approximately $0.9 billion and deposits of approximately $1.4 billion.

The Company accounts for these transactions under the acquisition method of accounting, and thus, the financial position and results of operations of acquired institutions prior to the consummation date are not included in the accompanying consolidated financial statements.

The acquisition method of accounting requires assets purchased and liabilities assumed to be recorded at their respective fair values at the date of acquisition.

The Company determines the fair value of core deposit intangibles, securities, premises and equipment, loans, other assets and liabilities, deposits and borrowings with the assistance of third party valuations, appraisals, and third party advisors.

The estimated fair values are subject to refinement for up to one year after deal consummation as additional information becomes available relative to the closing date fair values.

Business Strategy

5 unchanged sentences

We believe that consolidation across the community bank landscape will continue to take place and further believe that, with our capital and liquidity positions, our approach to credit management, and our extensive acquisition experience, we are well-positioned to take advantage of acquisitions or other business opportunities in our market areas.

In markets where we wish to enter or expand our business, we also periodically consider opening de novo branches, typically in conjunction with hiring commercial lending and

deposit teams.

In markets where we wish to enter or expand our business, we also periodically consider opening de novo branches, typically in conjunction with hiring commercial lending and deposit teams.

In the past, we have successfully integrated acquired institutions and opened de novo branches.

26 unchanged sentences

Our compensation and staff development programs are aligned with our strategies to grow our loans and non-maturity deposits while maintaining our focus on asset quality.

Our incentive systems are designed to achieve balanced, high quality asset growth while maintaining appropriate mechanisms to reduce or eliminate incentive payments when appropriate.

incentive systems are designed to achieve balanced, high quality asset growth while maintaining appropriate mechanisms to reduce or eliminate incentive payments when appropriate.

Our equity compensation programs and retirement benefits are designed to build and encourage employee ownership at all levels of the Company and we align employee performance objectives with corporate growth strategies and shareholder value.

21 unchanged sentences

Acquisition July 2018 Premier Commercial Bancorp Premier Community Bank 387

Acquisition January 2026 Olympic Bancorp, Inc.

Kitsap Bank 1,557

Description of Business

23 unchanged sentences

While our focus is on commercial business lending, we also originate real estate construction and land development loans and consumer loans.

Our loans are originated under policies that are reviewed and approved annually by our Board.

Our loans are originated under policies that are reviewed

and approved annually by our Board.

In addition, we have established internal lending guidelines that are updated as needed.

These policies and guidelines address underwriting standards, structure and rate considerations and compliance with laws, regulations and internal lending limits.

We conduct post-approval reviews on selected loans and routinely perform internal loan reviews of our loan portfolio to confirm credit quality, proper documentation and compliance with laws and regulations.

We conduct post-approval reviews on selected loans and routinely perform independent internal loan reviews of our loan portfolio to confirm credit quality, proper documentation and compliance with laws and regulations.

Loan repayments are considered one of the primary sources of funding for the Company.

43 unchanged sentences

Supervision and Regulation

FDIC-insured institutions, like the Bank, their holding companies and affiliates are extensively regulated under federal and state law.

As a result, our growth and earnings performance may be affected not only by management decisions and general economic conditions, but also by the requirements of federal and state statutes and by the regulations and policies of various banking agencies, including the DFI, the Federal Reserve, the FDIC and the Consumer Financial Protection Bureau (“CFPB”).

Furthermore, taxation laws administered by the Internal Revenue Service and state taxing authorities, accounting rules developed by the FASB and PCAOB, securities laws administered by the SEC and state securities authorities, and anti-money and sanctions laundering laws enforced by the U.S.

FDIC-insured banking institutions, like the Bank, their holding companies and affiliates are extensively regulated under federal and state law.

As a result, our growth and earnings performance may be affected not only by management decisions and general economic conditions, but also by the requirements of federal and state statutes and by the regulations and policies of various banking agencies, including the DFI, the Federal Reserve, the FDIC and federal and state consumer financial protection agencies.

Furthermore, taxation laws administered by the Internal Revenue Service and state taxing authorities, accounting rules developed by the FASB and PCAOB, securities laws administered by the SEC and state securities authorities and anti-money laundering and sanctions laws enforced by the U.S.

Department of the Treasury (“Treasury”) have an impact on our business.

2 unchanged sentences

These laws, and the regulations of the banking agencies issued under them, affect, among other things, the scope of our business, the kinds and amounts of investments that the Company and the Bank may make, required capital levels relative to assets, the nature and amount of collateral for loans, the establishment of branches, the ability of the Company or the Bank to merge, consolidate and acquire, dealings with our insiders and affiliates and the payment of dividends.

In reaction to the global financial crisis and particularly following the passage of the Dodd-Frank Act, we experienced heightened regulatory requirements and scrutiny.

In response to the global financial crisis and particularly following the passage of the Dodd-Frank Act, we experienced heightened regulatory requirements and scrutiny.

Although the reforms primarily targeted large banking organizations and systemically important financial institutions, their influence filtered down in varying degrees to community banks over time and caused our compliance and risk management processes, and the costs thereof, to increase.

The Economic Growth Act eliminated questions about the applicability of certain Dodd-Frank Act reforms to community bank systems, including relieving them of any requirement to engage in mandatory stress tests, maintain a risk committee or comply with the Volcker Rule’s complicated prohibitions on proprietary trading and ownership of private funds.

These reforms have been favorable to our operations.

It is anticipated that the Trump Administration and the current U.S.

Congress likely will not increase the regulatory burden on community banking organizations and may seek to reduce and streamline certain prudential and regulatory requirements

applicable to community banking organizations at a federal level based on statements made by relevant congressional leaders and the acting leaders of certain federal banking agencies.

At this time, however, it is not possible to predict with any certainty the actual impact that the Trump Administration may have on the banking industry or the operations of the Company or the Bank.

The supervisory framework for U.S.

banking organizations subjects banks and bank holding companies to regular examination by their respective banking agencies, which results in examination reports and ratings that are not publicly available and that can impact the conduct and growth of their businesses.

These examinations consider not only compliance with applicable laws and regulations, but also capital levels, asset quality and risk, management ability and performance, earnings, liquidity and various other factors.

The banking agencies generally have broad discretion to impose restrictions and limitations on the operations of a regulated entity where the agencies determine, among other things, that such operations are unsafe or unsound, fail to comply with applicable law or are otherwise inconsistent with laws and regulations.

The approach to supervision adopted by each banking agency may have significant impacts on the operations and results of the Company and the Bank, as well as the banking industry in general.

Based on recent statements made by congressional leaders and the acting leaders of certain federal banking agencies, there may be changes in the supervisory processes and approach made by the Trump Administration banking agencies, but it is not possible at this time to predict the specific changes (or the timing of any such changes) that may be made.

The Economic Growth Act eliminated questions about the applicability of certain Dodd-Frank Act reforms to community banking organizations, including relieving us of any requirement to engage in mandatory stress tests, maintain a risk committee or comply with the Volcker Rule’s complicated prohibitions on proprietary trading and ownership of private funds.

Over the past year, the federal banking agencies have continued efforts to reduce regulatory burden on banking organizations, including community banks, through various supervisory, regulatory and policy initiatives.

These efforts have included the rescission or revision of certain rulemakings and proposals, initiatives to streamline examination and application processes and efforts to increase transparency and consistency in supervisory expectations.

Congress also has considered additional measures aimed at easing specific compliance obligations for community banks, although no reforms comparable in scope to the Economic Growth Act have been enacted to date.

These developments may be favorable to the operations of the Company or the Bank;

however, future changes in laws, regulations, or supervisory priorities and their impacts on the Company’s or the Bank’s business, remain uncertain.

The supervisory framework applicable to U.S.

banking organizations subjects banks and bank holding companies to regular examination by their respective banking agencies.

These examinations result in confidential examination reports and supervisory ratings that may impact an institution’s operations, capital levels, growth and strategic initiatives.

Examinations consider not only compliance with applicable laws and regulations, but also capital levels, asset quality, management ability and performance, earnings, liquidity and overall risk profile, among other things.

The banking agencies generally have broad discretion to impose restrictions and limitations on the operations of a regulated entity where the agencies determine that such operations are unsafe or unsound, violate applicable law or are otherwise inconsistent with laws and regulations.

Changes in supervisory approach or emphasis may materially affect the operations and financial results of the Company and the Bank, as well as the banking industry in general.

In recent supervisory communications, rulemakings and policy statements, federal banking agencies have indicated an increased focus on core, material financial risks (rather than risk management processes), greater transparency in supervisory expectations and efforts to reduce examination burden, particularly for community banks.

For example, the FDIC, the Bank’s primary federal regulator, has proposed or implemented initiatives:

(i) to clarify standards for unsafe or unsound practices;

(ii) to enhance supervisory appeals processes;

(iii) to streamline examination procedures;

and (iv) to revise standards governing the termination of enforcement actions.

These initiatives may enable management to focus more effectively on growth opportunities and the management of material financial risks.

The following is a summary of the material elements of the supervisory and regulatory framework applicable to the Company and the Bank.

7 unchanged sentences

Banking organizations have been required to hold minimum levels of capital based on guidelines established by the banking agencies since 1983.

The minimums have been expressed in terms of ratios of “capital” divided by “total assets.” Beginning in 1989, the capital guidelines for U.S.

banking organizations have been based upon international capital accords (known as “Basel” accords) adopted by the Basel Committee on Banking Supervision, a committee of central banks and bank supervisors that acts as the primary global standard-setter for prudential regulation, as implemented by the U.S.

The minimums have been expressed in terms of ratios of “capital” divided by “total assets.”

Beginning in 1989, the capital guidelines for U.S.

banking organizations have been based upon international capital accords (known as the “Basel” accords) adopted by the Basel Committee on Banking Supervision, a committee of central banks and bank supervisors that acts as the primary global standard-setter for prudential regulation, as interpreted and implemented by the U.S.

federal banking agencies on an interagency basis.

3 unchanged sentences

federal bank regulatory agencies adopted the U.S.

Basel III regulatory capital reforms, and, at the same time, effected changes required by the Dodd-Frank Act, in regulations that were effective (with certain phase-ins) in 2015 (the “Basel III Rule”).

Basel III regulatory capital reforms, and, at the same time, effected changes required by the Dodd-Frank Act, in regulations that were effective in 2015 (with certain phase-ins) (the “Basel III Rule”).

The Basel III Rule established capital standards for banking organizations that are meaningfully more stringent than those established previously and are still in effect today.

8 unchanged sentences

The assignment of risk weights is likely to continue to be under review by the federal banking agencies as they seek to implement certain remaining elements of the Basel III accords.

In July 2023, the Biden Administration banking agencies proposed wide-ranging and significant changes to the Basel III Rules (the “Basel III Endgame Proposal”), which would have, among other requirements, imposed structural changes to the calculation of capital requirements and risk-weighted assets.

The Basel III Endgame Proposal would have primarily impacted the capital requirements applicable to banking organizations with $100 billion or more in total assets, and as a general matter, would not have impacted the Company.

The Basel III Endgame Proposal has not been, and is not expected to be, adopted in its proposed form.

The Trump Administration banking agencies may change or issue their own version of this proposal.

Previously, in 2023, the federal banking agencies proposed a “Basel III Endgame Rule” to complete this implementation process;

however, the proposal was not adopted, in part due to stakeholder concerns regarding potential economic impacts, data transparency and the alignment of certain provisions with statutory tailoring requirements.

Based on public statements from federal agency officials, it is anticipated that a revised proposal may be issued in the future.

Any re-proposal of the Basel III Endgame Rule is expected to primarily affect large, complex banking organizations.

Minimum Capital Ratios.

The Basel III Rule also increased the required quantity and quality of capital.

Not only did it increase most of the required minimum capital ratios in effect prior to January 1, 2015, but, in requiring that forms of capital be of higher quality to absorb loss, it introduced the concept of Common Equity Tier 1 Capital, which consists primarily of common stock, related surplus (net of Treasury stock), retained earnings, and Common Equity Tier 1 minority interests subject to certain

regulatory adjustments.

The Basel III Rule also changed the definition of capital by establishing more stringent criteria that instruments must meet to be considered Additional Tier 1 Capital (primarily non-cumulative perpetual preferred stock that meets certain requirements) and Tier 2 Capital (primarily other types of preferred stock and subordinated debt, subject to limitations).

The Basel III Rule also constrained the inclusion of minority interests, mortgage-servicing assets, and deferred tax assets in capital and required deductions from Common Equity Tier 1 Capital if such assets exceeded a percentage of a banking organization’s Common Equity Tier 1 Capital.

The Basel III Rule requires banking organizations to maintain minimum capital ratios as follows:

• A ratio of Common Equity Tier 1 Capital equal to 4.5% of risk-weighted assets;

Not only did it increase most of the required minimum capital ratios in effect prior to January 1, 2015, but, by requiring that capital instruments be of higher quality to absorb loss, it introduced the concept of Common Equity Tier 1 Capital (“CET1”), which consists primarily of common stock, related surplus (net of Treasury stock), retained earnings and CET1 minority interests, subject to certain regulatory adjustments and deductions.

The Basel III Rule also changed the definition of regulatory capital by establishing more stringent criteria for instruments to qualify as Additional Tier 1 Capital (primarily non-cumulative perpetual preferred stock that meets certain requirements) and Tier 2 Capital (primarily other types of preferred stock and subordinated debt, subject to limitations).

In addition, the Basel III Rule limited the inclusion of minority interests, mortgage-servicing assets and deferred tax assets in regulatory capital and required deductions from CET1 if such assets exceeded prescribed thresholds.

The Basel III Rule requires banking organizations to maintain minimum capital ratios to be deemed “adequately capitalized” as follows:

• A ratio of CET1 equal to 4.5% of risk-weighted assets;

• A ratio of Tier 1 Capital equal to 6% of risk-weighted assets;

• A ratio of Total Capital (Tier 1 plus Tier 2) equal to 8% of risk-weighted assets;

• A leverage ratio of Tier 1 Capital to total quarterly average assets equal to 4% in all circumstances.

In addition, banking organizations that want to make capital distributions (including for dividends and repurchases of stock) and pay discretionary bonuses to executive officers without restriction also must maintain 2.5% in Common Equity Tier 1 Capital attributable to a capital conservation buffer.

The purpose of the conservation buffer is to ensure that banking institutions maintain a buffer of capital that can be used to absorb losses during periods of financial and economic stress.

Factoring in the conservation buffer increases the minimum ratios depicted above to 7% for Common Equity Tier 1 Capital, 8.5% for Tier 1 Capital and 10.5% for Total Capital.

• A ratio of Total Capital (Tier 1 plus Tier 2 Capital) equal to 8% of risk-weighted assets;

• A leverage ratio of Tier 1 Capital to total quarterly average assets equal to 4% of risk-weighted assets in all circumstances.

In addition, banking organizations that want to make capital distributions (including dividends and share repurchases) and pay discretionary bonuses to executive officers without restriction must maintain 2.5% in CET1 in the form of a capital conservation buffer.

The purpose of the conservation buffer is to ensure that banking organizations maintain a cushion of capital that can be used to absorb losses during periods of financial and economic stress.

Factoring in the capital conservation buffer increases the minimum ratios described above to 7% for CET1, 8.5% for Tier 1 Capital and 10.5% for Total Capital.

Well Capitalized Requirements.

The ratios described above are minimum standards in order for banking organizations to be considered “adequately capitalized.” Banking agencies uniformly encourage banking organizations to hold more capital and be “well-capitalized” and, to that end, federal law and regulations provide various incentives for banking organizations to maintain regulatory capital at levels in excess of minimum regulatory requirements.

For example, a banking organization that is well-capitalized may:

(i) qualify for exemptions from prior notice or application requirements otherwise applicable to certain types of activities;

(ii) qualify for expedited processing of other required notices or applications;

The ratios described above represent minimum standards for banking organizations to be considered “adequately capitalized.” Banking agencies uniformly encourage banking organizations to maintain capital levels above these minimums and to be classified as “well capitalized.” To that end, federal law and regulations provide various incentives for banking organizations to maintain regulatory capital in excess of minimum regulatory requirements.

For example, a well capitalized banking organization may:

(i) qualify for exemptions from prior notice or application requirements otherwise applicable to certain activities;

(ii) receive expedited processing of other required notices or applications;

and (iii) accept, roll-over or renew brokered deposits.

Higher capital levels also could be required if warranted by the particular circumstances or risk profiles of individual banking organizations.

In addition, the banking agencies may require higher capital levels where warranted by a banking organization’s particular operating circumstances or risk profiles.

For example, the Federal Reserve’s capital guidelines contemplate that additional capital may be required to take adequate account of, among other things, interest rate risk, or the risks posed by concentrations of credit, nontraditional activities or securities trading activities.

Further, any banking organization experiencing or anticipating significant growth would be expected to maintain capital ratios, including tangible capital positions (i.e., Tier 1 Capital less all intangible assets), well above the minimum levels.

Under the capital regulations of the Federal Reserve for the Company and the FDIC for the Bank, in order to be well capitalized, a banking organization, like the Company and the Bank, must maintain:

• A Common Equity Tier 1 Capital ratio to risk-weighted assets of 6.5% or more;

• A CET1 ratio to risk-weighted assets of 6.5% or more;

• A ratio of Tier 1 Capital to total risk-weighted assets of 8% or more;

1 unchanged sentence

• A leverage ratio of Tier 1 Capital to total adjusted average quarterly assets of 5% or greater.

It is possible under the Basel III Rule to be well-capitalized while remaining out of compliance with the capital conservation buffer discussed above.

Under the Basel III Rule, a banking organization may be considered “well capitalized,” while not complying with the capital conservation buffer described above.

As of December 31, 2025:

(i) the Bank was not subject to a directive from the FDIC or the DFI to increase its capital and (ii) the Bank was well-capitalized, as defined by FDIC regulations.

(i) the Bank was not subject to a directive from the FDIC or the DFI to increase its capital;

and (ii) the Bank was well capitalized, as defined by FDIC regulations.

As of December 31, 2025, the Company had regulatory capital in excess of the Federal Reserve’s requirements and met the Basel III Rule requirements to be well capitalized.

As of December 31, 2024, we were also in compliance with the capital conservation buffer.

As of December 31, 2025, the Company and the Bank also were in compliance with the capital conservation buffer.

Prompt Corrective Action.

The concept of a banking organization being “well-capitalized” is part of a regulatory enforcement regime that provides the federal banking agencies with broad power to take “prompt corrective action” to resolve the problems of depository institutions based on the capital level of each particular institution.

The concept of a banking organization being “adequately capitalized” or “well capitalized” is part of a regulatory enforcement regime that provides the federal banking agencies with broad power to take “prompt corrective action” to resolve the problems of depository institutions based on the capital level of each particular institution.

The extent of the banking agencies’ powers depends on whether the institution in question is “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” or “critically undercapitalized,” in each case as defined by regulation.

13 unchanged sentences

Community banking organizations have long raised concerns with federal banking agencies about the regulatory burden, complexity and costs associated with certain provisions of the Basel III Rule.

In response, the U.S.

Congress provided an “off-ramp” for institutions, like us, with total consolidated assets of less than $10 billion as part of the Economic Growth Act.

In response, the Congress provided an “off-ramp” for institutions, like us, with total consolidated assets of less than $10 billion as part of the Economic Growth Act.

Section 201 of the Economic Growth Act specifically instructed the federal banking regulators to establish a single “Community Bank Leverage Ratio” (“CBLR”) of between 8% and 10%.

Under the final rule, a community banking organization is eligible to elect to comply with its capital requirements under the CBLR framework if it has:

(i) less than

$10 billion in total consolidated assets;

(i) less than $10 billion in total consolidated assets;

(ii) limited amounts of certain assets and off-balance sheet exposures;

and (iii) a CBLR greater than 9%.

In late 2025, the federal banking agencies proposed changes to the CBLR framework intended to encourage broader adoption, including reducing the required leverage ratio from 9.0% to 8.0%;

however, the proposal has not yet been finalized.

We may elect the CBLR framework at any time, but have not elected to use the CBLR framework as of December 31, 2025.

4 unchanged sentences

Under the BHCA, we are subject to periodic examination by the Federal Reserve and are required to file with the Federal Reserve periodic reports of our operations and such additional information regarding us and the Bank as the Federal Reserve may require.

Acquisitions, Activities and Financial Holding Company Election.

Acquisitions and Activities.

The primary purpose of a bank holding company is to control and manage banks.

The BHCA generally requires the prior approval of the Federal Reserve for any merger involving a bank holding company or any acquisition by a bank holding company of another bank or bank holding company.

Subject to certain conditions (including deposit concentration limits established by the BHCA), the Federal Reserve may allow a bank holding company to acquire banks located in any state of the United States.

In approving interstate acquisitions, the Federal Reserve is required to give effect to applicable state law limitations on the aggregate amount of deposits that may be held by the acquiring bank holding company and its FDIC-insured institution affiliates in the state in which the target bank is located (provided that those limits do not discriminate against out-of-state institutions or their holding companies) and state laws that require that the target bank have been in existence for a minimum period of time (not to exceed five years) before being acquired by an out-of-state bank holding company.

Furthermore, in accordance with the Dodd-Frank Act, bank holding companies must be well-capitalized and well-managed in order to effect interstate mergers or acquisitions.

For a discussion of the capital requirements, see “–The Role of Capital” above.

The BHCA generally prohibits us from acquiring direct or indirect ownership or control of more than 5% of the voting shares of any company that is not a bank and from engaging in any business other than that of banking, managing and controlling banks or furnishing services to banks and their subsidiaries.

Pursuant to the BHCA and the Dodd-Frank Act, the Federal Reserve may permit a well capitalized and well managed bank holding company to acquire banks located in any U.S.

state, subject to federal deposit concentration limits, applicable nondiscriminatory state deposit-cap laws and state minimum existence requirements for target banks (not exceeding five years).

The BHCA generally prohibits us from acquiring direct or indirect ownership or control of more than 5% of the outstanding voting shares of any nonbanking entity, and from engaging in any business other than that of banking, managing and controlling banks or furnishing services to banks and their subsidiaries.

This general prohibition is subject to a number of exceptions.

The principal exception allows bank holding companies to engage in, and to own shares of companies engaged in, certain businesses found by the Federal Reserve prior to November 11, 1999 to be “so closely related to banking...

as to be a proper incident thereto.” This authority permits us to engage in a variety of banking-related businesses, including the ownership and operation of a savings association, or any entity engaged in consumer finance, equipment leasing, the operation of a computer service bureau (including software development) and mortgage banking and brokerage services.

The BHCA does not place territorial restrictions on the domestic activities of nonbank subsidiaries of bank holding companies.

In addition to approval from the Federal Reserve, prior approval for acquisitions may be required from other agencies, such as the DFI or other agencies that regulate the target company of an acquisition.

Additionally, bank holding companies that meet certain eligibility requirements prescribed by the BHCA and elect to operate as financial holding companies may engage in, or own shares in companies engaged in, a wider range of nonbanking activities, including securities and insurance underwriting and sales, merchant banking and any other activity that the Federal Reserve, in consultation with the Secretary of the Treasury, determines by regulation or order is financial in nature or incidental to any such financial activity or that the Federal Reserve determines by order to be complementary to any such financial activity, as long as the activity does not pose a substantial risk to the safety or soundness of FDIC-insured institutions or the financial system generally.

as to be a proper incident thereto.” This authority permits the Company to engage in a variety of banking-related businesses, including, among other things, the ownership and operation of a savings association, or any entity engaged in consumer finance, equipment leasing, the operation of a computer service bureau (including software development) and mortgage banking and brokerage services.

The BHCA does not place formal territorial restrictions on the domestic activities of nonbank subsidiaries of bank holding companies.

In addition to approval from the Federal Reserve, prior approval for the establishment or acquisition of nonbank subsidiaries of a bank holding company may be required from other agencies, such as the DFI or other agencies that regulate such nonbank entity.

Financial Holding Company Election.

Bank holding companies that meet certain eligibility requirements and elect to operate as financial holding companies may engage in, or own shares in companies engaged in, a wider range of nonbanking activities, including securities and insurance underwriting and sales, merchant banking and any other activity that:

(i) the Federal Reserve, in consultation with the Secretary of the Treasury, determines by regulation or order is financial in nature or incidental to any such

financial activity;

or (ii) the Federal Reserve determines by order to be complementary to any such financial activity, as long as the activity does not pose a substantial risk to the safety or soundness of FDIC-insured institutions or the financial system generally.

We have not currently elected to operate as a financial holding company.

Change in Control.

Federal law also prohibits any person or company from acquiring “control” of an FDIC-insured depository institution or its holding company without prior notice to the appropriate federal bank regulator.

“Control” is conclusively presumed to exist upon the acquisition of 25% or more of the outstanding voting securities of a bank or bank holding company, but may arise under certain circumstances between 10% and 24.99% ownership.

Federal law prohibits any person or company from acquiring “control” of an FDIC-insured depository institution or its holding company without prior notice to the appropriate federal bank agencies.

“Control” is conclusively determined to exist upon the acquisition of 25% or more of the outstanding voting securities of a bank or bank holding company, but may be presumed to arise under certain circumstances between 10% and 24.99% ownership.

Capital Requirements.

3 unchanged sentences

Our ability to pay dividends to our shareholders may be affected by both general corporate law considerations and policies of the Federal Reserve applicable to bank holding companies.

As a Washington corporation, we are subject to the limitations of Washington corporate law, which does not allow us to pay dividends if, after that payment, the Company would not be able to pay its liabilities as they become due in the usual course of business or its total assets would be less than its total liabilities.

As a Washington corporation, we are subject to the limitations of the Washington Business Corporation Act, which generally prohibits the payment of dividends or other distributions if, after giving effect to the distribution, (i) the Company would not be able to pay its debts as they become due in the usual course of business, or (ii) the Company’s total assets would be less than the sum of its total liabilities plus any amounts needed to satisfy preferential rights upon dissolution.

As a general matter, the Federal Reserve has indicated that the board of directors of a bank holding company should eliminate, defer or significantly reduce dividends to shareholders if:

4 unchanged sentences

Among these powers is the ability to proscribe the payment of dividends by banks and bank holding companies.

In addition, under the Basel III Rule, banking organizations that want to pay unrestricted dividends must maintain 2.5% in Common Equity Tier 1 Capital attributable to the capital conservation buffer.

Finally, the Basel III Rule imposes consolidated capital requirements on banking organizations.

As a result, banking organizations must hold a capital conservation buffer of 2.5% of risk-weighted assets in CET1 above the minimum risk-based capital requirements to avoid regulatory limits on dividends and other capital distributions.

See “–The Role of Capital” above.

Incentive Compensation.

There have been a number of developments in recent years focused on incentive compensation plans sponsored by bank holding companies and their subsidiary banks, reflecting recognition by the federal banking agencies and the U.S.

Congress that flawed incentive compensation practices in the financial industry were one of many factors contributing to the global financial crisis.

The result was interagency guidance on sound incentive compensation practices for banking organizations.

The interagency guidance recognized three core principles.

Effective incentive plans should:

(i) provide employees incentives that appropriately balance risk and reward;

(ii) be compatible with effective controls and risk-management;

and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

Much of the guidance is directed at large banking organizations and, because of the size and complexity of their operations, the regulators expect those organizations to maintain systematic and formalized policies, procedures and systems for ensuring that the incentive compensation arrangements for all executive and non-executive employees covered by this guidance are identified and reviewed, and appropriately balance risks and rewards.

Under the interagency guidance, smaller banking organizations, like us, that use incentive compensation arrangements are expected to implement less extensive, formalized and detailed policies, procedures and systems than those of the larger banks.

In May 2024, certain of the federal banking and other financial services agencies released a proposed rule regarding certain incentive-based compensation arrangements at certain financial institutions with at least $1 billion in assets, as required under Section 956 of the Dodd-Frank Act.

This proposal was largely based on an earlier 2016 proposal.

The Federal Reserve and the SEC, however, did not join this proposal, signaling potential interagency misalignment and raising doubts regarding the likelihood of the proposed rule being finalized in its current form.

The FDIC has indicated that the agencies will continue to coordinate to reach consensus, but it is not yet clear whether this initiative will continue during the Trump Administration.

Monetary Policy.

6 unchanged sentences

Consequently, we are subject to the information, proxy solicitation, insider trading and other restrictions and requirements of the SEC under the Exchange Act.

Corporate Governance.

Corporate Governance/Incentive Compensation.

The Dodd-Frank Act addressed many investor protection, corporate governance and executive compensation matters that affect most U.S.

1 unchanged sentence

It increased shareholder influence over boards of directors by requiring companies to give shareholders a nonbinding vote on executive compensation and so-called “golden parachute” payments, and authorizing the SEC to promulgate rules that would allow shareholders to nominate and solicit voters for their own candidates using a company’s proxy materials.

The Dodd-Frank Act also directed the Federal Reserve, together with the federal banking and financial services agencies, to promulgate rules prohibiting excessive compensation paid to executives of bank holding companies, regardless of whether such companies are publicly traded.

As discussed in the “Incentive Compensation” section above, the federal banking agencies and financial services agencies have proposed rules regarding incentive-based compensation arrangements for certain financial institutions, but no rule has been adopted at this time.

The Dodd-Frank Act also directed the Federal Reserve, in coordination with other federal banking and financial services agencies, to promulgate rules prohibiting excessive incentive-based compensation paid to executives of bank holding companies, regardless of whether such companies are publicly traded.

Although several agencies have made repeated efforts to implement rules under this provision of the Dodd-Frank Act—including a proposal issued most recently in May 2024, which was subsequently withdrawn—no final rule has been adopted at this time.

Nevertheless, the federal banking agencies have issued interagency guidance on sound incentive compensation practices for banking organizations, reflecting the agencies’ recognition that incentive compensation practices in the financial industry were among the factors contributing to the global financial crisis.

The interagency guidance recognizes three core principles for effective incentive compensation plans:

(i) appropriately balancing risk and reward;

(ii) compatibility with effective controls and risk management;

and (iii) support by strong corporate governance, including active and effective oversight by the organization’s board of directors.

Although much of the guidance is directed at large banking organizations that are expected to maintain systematic and formalized policies and procedures, smaller banking organizations like us are expected to implement less extensive and less formalized systems pursuant to the guidance.

Supervision and Regulation of the Bank

The Bank is a Washington state-chartered bank.

The deposit accounts of the Bank are insured by the FDIC’s Deposit Insurance Fund (“DIF”) to the maximum extent provided under federal law and FDIC regulations, currently $250,000 per insured depositor category.

As a Washington state-chartered FDIC-insured bank, the Bank is subject to the examination, supervision, reporting and enforcement requirements of the DFI, the chartering authority for Washington banks, and the FDIC, designated by federal law as the primary federal regulator of insured state banks that, like the Bank, are not members of the Federal Reserve System (nonmember banks).

Deposit Insurance.

The Bank is a Washington state-chartered, nonmember bank.

Ongoing policy discussions at the federal level have focused on potential changes to deposit insurance coverage, including possible adjustments to coverage limits, although no changes have been enacted.

As a Washington state-chartered FDIC-insured bank, the Bank is subject to the examination, supervision, reporting and enforcement requirements of the DFI, its chartering authority, and the FDIC, designated by federal law as the primary federal regulator of insured state banks that, like the Bank, are not members of the Federal Reserve System.

Deposit Insurance Assessments.

As an FDIC-insured institution, the Bank is required to pay deposit insurance premium assessments to the FDIC.

1 unchanged sentence

For institutions like the Bank that are not considered large and highly complex banking organizations, the risk-based assessment is based on examination ratings and financial ratios.

The total base assessment rates, effective as of January 1, 2023, currently range from 2.5 basis points to 32 basis points.

The total base assessment rates, effective as of January 1, 2023, generally range from 2.5 basis points (for the lowest risk institutions) to 32 basis points or beyond (for higher risk institutions).

However, the maximum rate is 18 basis points for FDIC-insured institutions in the top two categories of examination composite ratings.

2 unchanged sentences

In response to the global financial crisis, the Dodd-Frank Act increased the minimum reserve ratio from 1.15% to 1.35% of the estimated amount of total insured deposits.

In its October 2024 semiannual update, the FDIC stated that the reserve ratio likely will reach the statutory minimum by the September 30, 2028 deadline and that no adjustments to the base assessment rates are currently projected.

In addition, because the total cost of the failures of Silicon Valley Bank and Signature Bank to the DIF was approximately $24.1 billion, the FDIC adopted a special assessment for banking organizations having assets of $5 billion or more, at an annual rate of 13.4 basis points beginning with the first quarterly assessment period of 2024, and with an invoice payment date of June 28, 2024.

The FDIC will continue to collect special assessments for an anticipated total of eight quarterly assessment periods.

The special assessment amount for each FDIC-insured institution will be determined at a quarterly rate of 3.36 basis points,

multiplied by an institution’s estimated uninsured deposits, reported for the quarter that ended December 31, 2022, adjusted to exclude the first $5 billion in estimated uninsured deposits of the institution (or of the banking organization as a whole for multi-bank holding companies, such as the Company).

In its May 2025 report, the FDIC stated that the reserve ratio likely will reach the statutory minimum by the September 30, 2028 deadline and that no adjustments to the base assessment rates are currently projected.

In addition, because the cost of the failures of Silicon Valley Bank and Signature Bank to the DIF attributable to the systemic risk exception was approximately $16.7 billion, the FDIC adopted a special assessment for banking organizations with assets of $5 billion or more.

The FDIC has been collecting the special assessment over eight quarters, at a quarterly rate of 3.36 basis points for the initial seven quarters of the collection period (ending on December 30, 2025) and at a quarterly rate of 2.97 basis points for the eighth and final collection period.

The quarterly special assessment rate is applied to the special assessment base equal to an FDIC-insured institution’s estimated uninsured deposits reported for the December 31, 2022 reporting period, adjusted to exclude the first $5 billion in estimated uninsured deposits of the institution.

Although the Company and the Bank are subject to the FDIC’s special assessment as a banking organization with assets of $5 billion or more, the Company does not have to pay the special assessment based on its amount of uninsured deposits.

2 unchanged sentences

The amount of the assessment is calculated on the basis of the Bank’s total assets.

During the year ended December 31, 2024, the Bank paid supervisory assessments to the DFI totaling approximately $0.2 million.

During the year ended December 31, 2025, the Bank paid supervisory assessments to the DFI totaling approximately $235,000.

Capital Requirements.

4 unchanged sentences

Banks are required to implement liquidity risk management frameworks that ensure they maintain sufficient liquidity, including a cushion of unencumbered, high-quality liquid assets, to withstand a range of stress events.

The level and speed of deposit outflows contributing to the failures of Silicon Valley Bank, Signature Bank and First Republic Bank in the first half of 2023 was unprecedented and contributed to acute liquidity and funding strain.

These events have further underscored the importance of liquidity risk management and contingency funding planning by insured depository institutions like the Bank, as highlighted in a 2023 addendum to existing interagency guidance on funding and liquidity risk management.

The level and speed of deposit outflows contributing to the failures of Silicon Valley Bank, Signature Bank and First Republic Bank in 2023 was unprecedented, and contributed to acute liquidity and funding strain, underscoring the importance of liquidity risk management and contingency funding planning by insured depository institutions like the Bank, as highlighted in a 2023 addendum to existing interagency guidance on funding and liquidity risk management.

The primary role of liquidity risk management is to:

6 unchanged sentences

Although these tests do not apply to the Bank, we continue to review our liquidity risk management policies in light of regulatory requirements and industry developments.

For instance, in July 2024, the FDIC released a request for information on deposits, soliciting information on whether and to what extent certain types of deposits may behave differently from each other (particularly during periods of economic or financial stress), the results of which may impact liquidity monitoring and risk management requirements, including for FDIC-insured institutions like the Bank going forward.

Dividend Payments.

3 unchanged sentences

As described above, the Bank exceeded its capital requirements under applicable guidelines as of December 31, 2025.

Notwithstanding the availability of funds for dividends, however, the FDIC and the DFI may prohibit the payment of dividends by the Bank if either or both determine such payment would constitute an unsafe or unsound practice.

Notwithstanding the availability of funds for dividends, however, the FDIC and the DFI may prohibit the payment of dividends by the Bank if either agency determines that such payment would constitute an unsafe or unsound practice.

In addition, under the Basel III Rule, banking organizations that want to pay unrestricted dividends must maintain 2.5% in CET1 attributable to the capital conservation buffer.

See “–The Role of Capital” above.

State Bank Investments, Activities and Acquisitions.

The Bank is permitted to make investments and engage in activities directly or through subsidiaries as authorized by Washington law.

However, under federal law and FDIC regulations, FDIC-insured state banks are prohibited, subject to certain exceptions, from making or retaining equity investments of a type, or in an amount, that are not permissible for a national bank.

Federal law and FDIC regulations also prohibit FDIC-insured state banks and their subsidiaries, subject to certain exceptions, from engaging as principal in any activity that is not permitted for a national bank unless the bank meets, and continues to meet, its minimum regulatory capital requirements and the FDIC determines that the activity would not pose a significant risk to the DIF.

The Bank is permitted to make investments and engage in activities directly or through subsidiaries as authorized under Washington law.

However, under federal law and FDIC regulations, FDIC-insured state banks are prohibited, subject to certain exceptions, from making or retaining equity investments that are not permissible for a national bank.

Federal law and FDIC regulations also prohibit FDIC-insured state banks and their subsidiaries from engaging

as principal in any activity that is not permitted for a national bank unless they meet, and continue to meet, minimum regulatory capital requirements and the FDIC determines that the activity would not pose a significant risk to the DIF.

These restrictions have not had, and are not currently expected to have, a material impact on the operations of the Bank.

The Bank may be required to seek approval from the DFI, the FDIC and other banking or financial services agencies before engaging in certain acquisitions or mergers under applicable state and federal law.

In 2024, each of the OCC and the FDIC separately released updated policy statements—and in the case of the OCC, a final rule—regarding how each banking agency reviews applications submitted pursuant to the Bank Merger Act based on statutory factors.

The acting leader of the Trump Administration’s FDIC has indicated that the FDIC may seek to reverse the FDIC’s 2024 policy statement.

Insider Transactions.

The Bank is subject to certain restrictions imposed by federal law on “covered transactions” between the Bank and its “affiliates.” The Company is an affiliate of the Bank for purposes of these restrictions, and covered transactions subject to the restrictions include extensions of credit to the Company, investments in the stock or other securities of the Company and the acceptance of the stock or other securities of the Company as collateral for loans made by the Bank.

Dodd-Frank Act enhanced the requirements for certain transactions with affiliates, including an expansion of the definition of “covered transactions” and an increase in the amount of time for which collateral requirements regarding covered transactions must be maintained.

Certain limitations and reporting requirements are also placed on extensions of credit by the Bank to its directors and officers, to directors and officers of the Company and its subsidiaries, to principal shareholders of the Company and to “related interests” of such directors, officers and principal shareholders under state and federal law.

In addition, federal law and regulations may affect the terms on which any person who is a director or officer of the Company or the Bank, or a principal shareholder of the Company, may obtain credit from banks with which the Bank maintains a correspondent relationship.

The Bank may be required to obtain approval from the DFI, the FDIC and other applicable banking or financial services agencies before engaging in certain acquisitions or mergers under applicable state and federal law.

With respect to interstate merger and acquisitions, federal law permits state banks to merge with out-of-state banks subject to:

(i) regulatory approval;

(ii) federal and state deposit concentration limits;

and (iii) state law requirements that the merging bank has been in existence for a minimum period of time (not to exceed five years), prior to the merger.

In 2025, the federal banking agencies rescinded certain prior administrative actions regarding the review and approval of mergers and acquisitions, with the intent of streamlining and expediting the regulatory review of certain merger and acquisition applications.

Branching Authority.

Washington state-chartered banks, such as the Bank, have the authority under the Washington Commercial Bank Act to establish branches anywhere in the State of Washington, subject to receipt of approval from the DFI and FDIC, as applicable.

The Dodd-Frank Act further permits well capitalized and well managed banks to establish new interstate branches or to acquire individual branches of a bank in another state (rather than the acquisition of an out-of-state bank in its entirety) without impediments.

Affiliate and Insider Transactions.

Covered transactions subject to these restrictions include extensions of credit to the Company, investments in the stock or other securities of the Company and the acceptance of the stock or other securities of the Company as collateral for loans made by the Bank.

The Dodd-Frank Act enhanced these requirements by expanding the definition of “covered transactions” and extending the period for which collateral requirements for such transactions must be maintained.

Certain limitations and reporting requirements also apply to extensions of credit by the Bank to its directors and officers, to directors and officers of the Company and its subsidiaries, to principal shareholders of the Company and to “related interests” of such directors, officers and principal shareholders under state and federal law.

In addition, federal law and regulations may govern the terms on which any person who is a director or officer of the Company or the Bank, or a principal shareholder of the Company, may obtain credit from banks with which the Bank maintains a correspondent relationship.

Safety and Soundness Standards/Risk Management.

1 unchanged sentence

The standards apply to internal controls, information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, compensation, fees and benefits, asset quality and earnings.

In general, the safety and soundness standards prescribe the goals to be achieved in each area, and each institution is responsible for establishing its own procedures to achieve those goals.

While regulatory standards do not have the force of law, if an institution operates in an unsafe and unsound manner, the FDIC-insured institution’s primary federal banking agency may require the institution to submit a plan for achieving and maintaining compliance.

If an FDIC-insured institution fails to submit an acceptable compliance plan, or fails in any material respect to implement a compliance plan that has been accepted by its primary federal banking agency, the agency is required to issue an order directing the institution to cure the deficiency.

Until the deficiency cited in the regulator’s order is cured, the agency may restrict the FDIC-insured institution’s rate of growth, require the FDIC-insured institution to increase its capital, restrict the rates that the institution pays on deposits or require the institution to take any action that the agency deems appropriate under the circumstances.

Noncompliance with safety and soundness may also constitute grounds for other enforcement action by the federal banking agencies, including cease and desist orders and civil money penalty assessments.

During the past decade, the banking agencies have increasingly emphasized the importance of sound risk management processes and strong internal controls when evaluating the activities of the FDIC-insured institutions they supervise.

Properly managing risk has been identified as critical to the conduct of safe and sound banking activities and has become even more important as new technologies, product innovation, and the size and speed of financial transactions have changed the nature of banking markets.

The agencies have identified a spectrum of risks facing a banking institution including, but not limited to, credit, market, liquidity, operational, legal and reputational risk.

These standards generally prescribe the goals to be achieved in each area, and each institution is responsible for establishing its own procedures to achieve those goals.

Although regulatory standards do not have the force of law, if an institution operates in an unsafe and unsound manner, its primary federal regulator may require the submission of a plan to achieve and maintain compliance.

Failure to submit an acceptable compliance plan, or to implement an approved plan in any material respect may result in formal agency orders directing the institution to cure the deficiencies.

Until such deficiencies are resolved, the agency may restrict the institution’s rate of growth, require additional capital, limit deposit rates, or take other corrective action as deemed appropriate.

Noncompliance with safety and soundness principles may also constitute grounds for other enforcement action by the federal banking agencies, including cease and desist orders and civil money penalty assessments.

The federal banking agencies have emphasized the importance of sound risk management processes and strong internal controls when evaluating the activities of the FDIC-insured institutions.

In 2025, however, the agencies signaled a shift toward focusing on the identification and management of material financial risks, rather than primarily on adherence to prescriptive operational processes.

Although effective risk management, internal controls, and board and management oversight remain important, supervisory attention may increasingly center on whether specific practices pose material harm to the institution’s financial condition or create a risk of loss to the DIF.

Despite this potential shift in focus, the agencies continue to evaluate a broad spectrum of risks—including credit, market, liquidity, operational, and legal risks—emphasizing their potential impact on safety and soundness.

Notably, the federal banking agencies have indicated that they intend to remove reputation risk from consideration, citing concerns about its use in restricting banking services to certain industries or groups.

The Bank is expected to have active board and senior management oversight;

4 unchanged sentences

Privacy and Cybersecurity.

The Bank is subject to many U.S.

federal and state laws and regulations governing requirements for maintaining policies and procedures to protect non-public confidential information of its customers.

These laws require the Bank to periodically disclose its privacy policies and practices relating to sharing such information and permit consumers to opt out of their ability to share information with unaffiliated third parties under certain circumstances.

They also impact the Bank’s ability to share certain information with affiliates and non-affiliates for marketing and/or non-marketing purposes, or to contact customers with marketing offers.

The Bank is subject to numerous U.S.

federal and state laws and regulations aimed at protecting non-public, confidential information of its customers.

These laws require the Bank to periodically disclose its privacy policies and practices regarding the sharing of non-public customer information, and in certain circumstances, permit consumers to opt out of the sharing of information with unaffiliated third parties.

They also limit the Bank’s ability to share certain information with affiliates and non-affiliates for marketing or nonmarketing purposes.

In addition, the Bank is required to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of customer records and information.

These security and privacy policies and procedures are in effect across all businesses and geographic locations.

These security and privacy policies and procedures are applied consistently across all businesses and geographic locations.

The Bank and the Company also are subject to a number of federal and state laws and regulations requiring notifications and disclosures regarding certain cybersecurity incidents.

The Bank must also consider and address cybersecurity considerations as part of its risk management processes.

Branching Authority.

Washington state-chartered banks, such as the Bank, have the authority under Washington Commercial Bank Act to establish branches anywhere in the State of Washington, subject to receipt of approval from the DFI and FDIC, as appropriate.

The establishment of new interstate branches has historically been permitted only in those states the laws of which expressly authorize such expansion.

The Dodd-Frank Act permits well-capitalized and well-managed banks to establish new interstate branches or the acquisition of individual branches of a bank in another state (rather than the acquisition of an out-of-state bank in its entirety) without impediments.

Federal law permits state banks to merge with banks in other states subject to:

(i) regulatory approval;

(ii) federal and state deposit concentration limits;

and (iii) state law limitations requiring the merging bank to have been in existence for a minimum period of time (not to exceed five years) prior to the merger.

In addition, the Bank must consider and address cybersecurity risks as part

of its risk management processes, including implementing and maintaining appropriate safeguards, monitoring and testing systems, and overseeing the cybersecurity practices of its service providers.

Regulatory guidance emphasizes that cybersecurity should be integrated into overall enterprise risk management and business continuity planning.

Federal Home Loan Bank System.

The Bank is a member of a FHLB, which serves as a central credit facility for its members.

The Bank is a member of an FHLB, which serves as a central credit facility for its members.

The FHLB is funded primarily from proceeds from the sale of obligations of the FHLB system.

2 unchanged sentences

Community Reinvestment Act Requirements.

The CRA requires the Bank to have a continuing and affirmative obligation in a safe and sound manner to help meet the credit needs of the entire community, including low- and moderate-income neighborhoods.

The FDIC regularly assesses the Bank’s record of meeting the credit needs of its communities in dedicated examinations.

The CRA imposes on the Bank a continuing and affirmative obligation, consistent with safe and sound operations, to help meet the credit needs of the entire community, including low- and moderate-income neighborhoods.

The FDIC regularly assesses the Bank’s record of meeting these credit needs through periodic CRA examinations.

The Bank’s CRA ratings derived from these examinations can have significant impacts on the activities in which the Bank and the Company may engage.

For example, a low CRA rating may impact the review of applications for acquisitions by the Bank.

On October 24, 2023, the federal banking agencies issued a final rule to strengthen and modernize the CRA regulations (the “CRA Rule”).

Elements of the CRA Rule were originally intended to become effective on April 1, 2024 (while other elements had much later effective dates).

However, the effective date of the CRA Rule was paused because of a preliminary injunction issued in connection with ongoing litigation claiming that the federal banking agencies exceeded their statutory authority in promulgating the CRA Rule.

Despite this lawsuit, management of the Bank are continuing to assess the impact of the CRA Rule on the Bank’s CRA lending and investment activities in their respective markets.

The CRA Rule is designed to update how CRA activities qualify for consideration, where CRA activities are considered, and how CRA activities are evaluated.

More specifically, the federal banking agencies described the goals of the CRA Rule as follows:

(i) to expand access to credit, investment, and basic banking services in low- and moderate-income communities;

(ii) to adapt to changes in the banking industry, including mobile and internet banking, by modernizing assessment areas while maintaining a focus on branch-based areas;

(iii) to provide greater clarity, consistency, and transparency in the application of the regulations through the use of standardized metrics as part of CRA evaluation and clarifying eligible CRA activities focused on low- and moderate-income communities and underserved rural communities;

(iv) to tailor CRA rules and data collection to bank size and business model;

and (v) to maintain a unified approach among the regulators.

In 2023, the federal banking agencies issued a final rule intended to strengthen and modernize the CRA regulations (the “CRA Rule”).

The CRA Rule was subsequently challenged in court, which prevented it from taking effect.

In 2025, the federal banking agencies issued a proposed rule to rescind the CRA Rule and reinstate the prior CRA regulatory framework adopted in 1995.

Additionally, the FDIC is lengthening the period between CRA examinations for certain banks with less than $3 billion in assets;

however, this change is not expected to impact the Bank, which has more than $3 billion in total assets.

Washington has a state law analogous to the federal CRA, which imposes an affirmative obligation on Washington state‑chartered banks, including the Bank, to help meet the credit, lending, and investment needs of their local communities.

The law is enforced by the DFI, which evaluates banks’ performance in meeting community needs, often considering federal data and materials provided in connection with federal CRA examinations, while also applying state‑specific criteria.

Anti-Money Laundering/Countering the Financing of Terrorism/Sanctions.

The Bank Secrecy Act (“BSA”) is the common name for a series of laws and regulations enacted in the United States to combat money laundering and the financing of terrorism.

They are designed to deny terrorists and criminals the ability to obtain access to the U.S.

financial system and have significant implications for FDIC-insured institutions and other businesses involved in the transfer of money.

The so-called Anti-Money Laundering / Countering the Financing of Terrorism (“AML/CFT”) regime under the BSA provides a foundation to promote financial transparency and deter and detect those who seek to misuse the U.S.

financial system to launder criminal proceeds, finance terrorist acts, or move funds for other illicit purposes.

The laws mandate financial services companies to have policies and procedures with respect to measures designed to address:

(i) customer identification programs;

(ii) money laundering;

(iii) terrorist financing;

(iv) identifying and reporting suspicious activities and currency transactions;

(v) currency crimes;

and (vi) cooperation between FDIC-insured institutions and law enforcement authorities.

The Bank must also comply with stringent economic and trade sanctions regimes administered and enforced by the Office of Foreign Assets Control.

The Bank Secrecy Act (“BSA”) is a U.S.

federal statutory framework, as amended and supplemented by subsequent laws and implemented through regulations, which is designed to combat money laundering, the financing of terrorism and other illicit financial activity.

The BSA and related anti-money laundering/countering the financing of terrorism (“AML/CFT”) laws and regulations are intended to prevent terrorists and criminals from accessing the U.S.

financial system and have significant implications for FDIC-insured institutions and other businesses involved in the transmission of funds.

Together, this regulatory framework provides a foundation to promote financial transparency and deter and detect efforts to misuse the U.S.

financial system to launder criminal proceeds, finance terrorist acts, or facilitate other illicit conduct.

The BSA and related regulations require financial institutions to establish and maintain policies and procedures for addressing:

(i) customer identification and due diligence;

(ii) the prevention and detection of money laundering and terrorist financing;

(iii) the identification and reporting of suspicious activities and certain currency transactions;

(iv) compliance with laws relating to currency crimes;

and (v) cooperation with law enforcement authorities.

The Bank also must comply with stringent economic and trade sanctions regimes administered and enforced by the Office of Foreign Assets Control.

Although core AML/CFT statutory requirements and expectations remain unchanged, certain of the federal banking agencies and the Financial Crimes Enforcement Network (FinCEN) have recently pursued or considered efforts to modernize and streamline AML/CFT compliance through a more risk-based approach, including targeted regulatory relief, revised examination expectations and efforts to reduce certain compliance burden, particularly for lower-risk and community banking organizations.

Concentrations in Commercial Real Estate.

Concentration risk exists when FDIC-insured institutions deploy too many assets to any one industry or segment.

A concentration in CRE is one example of regulatory concern.

The interagency Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices guidance (“CRE Guidance”) provides supervisory criteria, including the following numerical indicators, to assist bank examiners in identifying banks with potentially significant commercial real estate loan concentrations that may warrant greater supervisory scrutiny:

(i) CRE loans exceeding 300% of capital and increasing 50% or more in the preceding three years;

Concentration risk exists when FDIC-insured institutions allocate a disproportionate amount of assets to a single industry or economic segment.

Concentration in CRE lending is one area of regulatory focus.

The interagency Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices guidance (“CRE Guidance”) provides supervisory criteria, including the following numerical indicators, to assist bank examiners in identifying banks with potentially significant CRE loan concentrations that may warrant greater supervisory scrutiny.

These indicators include:

(i) total CRE loans exceeding 300% of capital and increasing 50% or more in the preceding three years;

or (ii) construction and land development loans exceeding 100% of capital.

The CRE Guidance does not limit banks’ levels of CRE activities, but rather guides institutions in developing risk management practices and levels of capital that are commensurate with the level and nature of their CRE concentrations.

On December 18, 2015, and again in recent years, the federal banking agencies have issued statements to reinforce prudent risk-management practices related to CRE lending, having observed substantial growth in many CRE asset and lending markets, increased competitive pressures, rising CRE concentrations in banks, and an easing of CRE underwriting standards.

The federal banking agencies reminded FDIC-insured institutions to maintain underwriting discipline and exercise prudent risk-management practices to identify, measure, monitor, and manage the risks arising from CRE lending.

In addition, FDIC-insured institutions must maintain capital commensurate with the level and nature of their CRE concentration risk.

The CRE Guidance does not establish binding limits on CRE lending activities, but rather is intended to inform supervisory assessments of whether an institution’s risk profile, earnings capacity and capital levels are commensurate with its CRE exposure.

In recent years, the federal banking agencies have issued statements to reinforce prudent risk-management practices related to CRE lending, in response to observed growth in many CRE markets, increased competitive pressures, rising CRE concentrations, and an easing of CRE underwriting standards.

In other statements, the agencies reminded FDIC-insured institutions to maintain underwriting discipline and to identify, measure, monitor and manage the risks arising from CRE lending, including by holding capital commensurate with those risks.

As of December 31, 2025, the Bank did not exceed these guidelines.

4 unchanged sentences

FDIC-insured institutions with $10 billion or less in assets, like the Bank, continue to be examined by their applicable bank regulators.

Because abuses in connection with residential mortgages were a significant factor contributing to the global financial crisis, many initial rules issued by the CFPB, as required by the Dodd-Frank Act, addressed mortgage and mortgage-related products, their underwriting, origination, servicing and sales.

The Dodd-Frank Act significantly expanded underwriting requirements applicable to loans secured by 1-4 family residential real property and augmented federal law combating predatory lending practices.

In addition to numerous disclosure requirements, the Dodd Frank Act and the CFPB’s rules imposed new standards for mortgage loan originations on all lenders, including banks and savings associations, in an effort to strongly encourage lenders to verify a borrower’s ability to repay, while also establishing a presumption of compliance for certain “qualified mortgages.”

In response to mortgage-related abuses that contributed to the global financial crisis, the Dodd-Frank Act and CFPB rulemaking significantly expanded underwriting, disclosure and anti-predatory lending requirements for residential mortgage loans, including by imposing ability-to-repay standards and establishing a presumption of compliance for certain “qualified mortgages.” The CFPB

has continued to refine these requirements through additional rulemaking addressing qualified mortgages ability-to-repay standards.

Over the last several years, the CFPB has taken an aggressive approach to the regulation (and supervision, where applicable) of providers of consumer financial products and services.

For example, the CFPB has taken, or attempted to take, a proactive, multi-front approach to protect consumers from excessive overdraft and non-sufficient funds fees, including through proposed or final rules, interpretive opinions and enforcement actions.

Given the increased number and expansive nature of its regulatory initiatives, the CFPB has been subject to lawsuits brought by the banking industry and other providers of consumer financial products and services.

The CFPB’s approach may change under the Trump Administration, but it remains unclear exactly what changes will occur or how quickly.

In addition, certain rules that the Biden Administration CFPB finalized may be subject to reversal by either the U.S.

Congress or the new CFPB administration.

However, more recently, changes in leadership and policy direction have led to:

(i) shifts in regulatory priorities, including the rescission or reconsideration of certain CFPB guidance and rules;

(ii) a reduction in CFPB enforcement activity;

and (iii) constraints on the CFPB’s budget and resources, although the CFPB continues to retain statutory authority to administer, supervise and enforce federal consumer financial protection laws.

In addition, state banking and other financial services regulatory agencies retain authority to administer and enforce state consumer financial protection laws, and could increase supervisory or enforcement activity in response to changes in federal regulatory priorities.

The CFPB’s rules have not had a significant impact on the Bank’s operations, except for higher compliance costs.

The Bank must also comply with certain state consumer protection laws and requirements in the states in which it operates.

The Bank also must comply with certain state consumer protection laws and requirements in the states in which it operates.

Website Access to Company Reports

3 unchanged sentences

We have adopted a Code of Ethics that applies to our directors, officers and employees, as well as those engaged by the Company, but who are not employees, such as contractors and those engaged through external agencies.

We have posted a copy of our Code of Ethics at www.hf-wa.com in the section titled Overview:

We have posted a copy of our Code of Ethics at www.hf-wa.com in the section titled Governance:

Governance Documents.

1 unchanged sentence

Governance Documents.

We compete for loans and deposits with other commercial banks, credit unions and other providers of financial services, including finance companies, online-only banks, mutual funds, insurance companies, and, more recently, with Fintech companies that rely on technology to provide financial services.

We compete for loans and deposits with other commercial banks, credit unions and other providers of financial services, including finance companies, online-only banks, mutual funds, insurance companies, and with Fintech companies that rely on technology to provide financial services.

Many of our competitors have substantially greater resources than we do.

6 unchanged sentences

Our strong culture, built upon a clear mission and values, unites employees at all levels of the Company towards a common goal, enabling them to reach their full potential.

As of December 31, 2025, the Company employed 723 full-time and 32 part-time employees across Washington, Oregon, and Idaho.

The Company also had five employees who were working remotely in other states.

No employees are represented by a collective bargaining agreement.

During 2025, we hired 130 regular full-time and part-time employees.

Voluntary workforce turnover (rolling 12-month attrition) was 14.8% for the period ended December 31, 2025, compared to 14.9% for the period ended December 31, 2024.

At the end of 2025, our average overall tenure was 7.9 years and the average tenure of management was 9.8 years.

Inclusive Workplace

1 unchanged sentence

Recognizing the unique perspectives each employee brings, we value their contributions to making us the leading commercial community bank in the Pacific Northwest.

We focus on inclusion and belonging with a DEI Officer certified by the National Diversity Council (“NDC”) as well as a dedicated Diversity Council comprised of employees and members of management across different functional areas.

We focus on inclusion and belonging with a dedicated Diversity Council comprised of employees and members of management across different functional areas and a DEI officer role.

During November 2025, the Council was temporarily placed on pause due to merger related projects.

Both our Chief Executive Officer and Chief Human Resources Officer serve as executive sponsors to this council.

Our executive management team and Board have undergone instructor-led, customized DEI training.

In 2023, the NDC recognized our community outreach and corporate social responsibility efforts, rating us among the best companies for diversity.

Our executive management team and Board have also undergone instructor-led, customized inclusion and belonging training.

The Company recruits from a broad and diverse labor pool and utilizes structured and consistent hiring practices.

Hiring Managers complete required training on lawful interviewing and selection techniques using objective, job-related criteria and removing unconscious bias from the selection process.

The objectives of the Company's DEI plan include:

3 unchanged sentences

Promote a culture and develop long-term strategies that encourage collaboration, inclusion, flexibility and fairness to enable individuals to contribute to their full potential.

In 2023, our recruiting team achieved certification as “Diversity and Inclusion Recruiters” after completing the Advanced Internet Recruitment Strategies program.

All hiring managers are assigned "Interviewing and Selection" training to address and mitigate unconscious bias in hiring decisions.

This initiative has resulted in an enhanced diversity representation across the organization, with 43% of new hires in 2024 coming from underrepresented minority groups, compared to 37% in 2023.

Additionally, the Company continues to collaborate with an external consultant to provide inclusive leadership training to its managers.

This training, offering insights into diversity, inclusion, and identity, has been incorporated into the mandatory curriculum for new managers.

Additional "Lunch & Learn" sessions are open to all employees and members of management, encouraging ongoing discussions and skills development in these areas.

As of December 31, 2024, the Company employed 733 full-time and 28 part-time employees across Washington, Oregon, and Idaho.

The Company also had six employees who were working remotely in other states.

No employees are represented by a collective bargaining agreement.

During 2024, we hired 130 regular full-time and part-time employees.

Voluntary workforce

turnover (rolling 12-month attrition) was 14.9% for the period ended December 31, 2024, compared to 16.6% for the period ended December 31, 2023.

At the end of 2024, our average overall tenure was 7.5 years and the average tenure of management was 9.7 years.

As of December 31, 2024, the Company’s individual contributors were 70.1% female and 29.9% male;

managers were 72.3% female and 27.7% male;

director-level employees (not members of the Board) were 54.2% female and 45.8% male;

and executives were 22.2% female and 77.8% male, with the Company’s total workforce being 69.5% female and 30.5% male.

As of December 31, 2024, the Company’s individual contributors were 29.4% members of underrepresented minority groups and 70.6% white;

managers were 23.5% members of underrepresented minority groups and 76.5% white;

director-level employees (not members of the Board) were 8.3% members of underrepresented minority groups and 91.7% white;

and executives were 100% white, with the Company’s total workforce being 27.1% members of underrepresented minority groups and 72.9% white.

Our senior recruiting team members have achieved certification as “Diversity and Inclusion Recruiters” after completing the Advanced Internet Recruitment Strategies program.

Communication and Listening

3 unchanged sentences

In recognition of our commitment to employee engagement, the Company earned a spot among the top 100 Best Places to Work in Washington and Oregon by the Puget Sound and Portland Business Journals based on the 2025 employee engagement survey.

The company received similar recognition in 2023.

The company received similar recognitions in both 2023 and 2024.

Our commitment to open communication extends to providing employees with avenues for confidential and anonymous reporting.

We offer a whistleblower hotline/website, enabling employees to report financial and workplace concerns to key leadership, including the Board Chair, Audit Committee Chair, Chief Executive Officer, Chief Operations Officer, Chief Risk Officer and Chief Human Resources Officer.

We offer a whistleblower hotline/website, enabling employees to report financial and workplace concerns to key leadership, including the Board Chair, Audit Committee Chair, Chief Executive Officer, Chief Risk Officer, Chief Human Resources Officer and Director of Internal Audit.

Additionally, our Company intranet hosts an "Idea Bank," allowing employees to submit new ideas or recommendations directly to executive management.

9 unchanged sentences

The Leadership Essentials Certificate is designed for employees interested in developing their leadership skills and preparing for leadership and management in the future, while the Leadership in Action Certificate is for current supervisors and managers interested in deepening their applied leadership skills.

Since the launch of these programs in April 2024, 33 Heritage Bankers have received their Leadership Certification through one of these programs.

During 2025, 37 Heritage Bankers received their Leadership Certification through one of these programs.

The Company leverages an online succession planning tool to further identify next-generation leaders and establish development plans for these individuals.

16 unchanged sentences

Employees also accrue up to 12 days of paid sick time per year for personal use or to care for a family member.

Both full-time and part-time employees accrue vacation time ranging from two and five weeks, dependent on factors such as position and tenure.

Both full-time and part-time employees accrue vacation time ranging from two and five weeks, depending on factors such as position and tenure.

Employee Wellness and Wellbeing

5 unchanged sentences

Moreover, enrolled members can take advantage of mental health apps, weight loss and fitness programs, smoking cessation programs and various online resources, all provided at no extra cost.

To alleviate workplace stress and burnout, the Company hosts a "no meetings week" at the start of each quarter.

This dedicated time allows managers and employees to engage in purposeful planning, catch up on tasks, and reduce stress.

By incorporating these breaks, employees can participate in strategic planning, creative thinking, and collaborative efforts without the constraints of scheduled meetings, ultimately contributing to a more innovative and healthier work environment.

Community Involvement

1 unchanged sentence

In 2022, the Company implemented an annual volunteer event, during which the Bank closes for half a day, providing employees with a paid opportunity to volunteer in teams at various community organizations within our operating footprint.

Our 2024 volunteer day event involved over 550 employees volunteering approximately 1,665 hours to more than 60 organizations in Washington, Oregon and Idaho.

To further facilitate community involvement, employees receive a minimum of eight additional hours of paid time off each year specifically to use for volunteer activities of their choice.

The Bank also participated in a 2024 EcoChallenge, where 41 teams of employees engaged in friendly competition by undertaking environmentally sustainable actions and practices.

Challenges involved activities such as reducing waste, conserving energy and adopting eco-friendly lifestyle habits.

The collective efforts of the EcoChallenge resulted in 21,887 actions, contributing to a heightened awareness of environmental responsibility, fostering a sense of community engagement, and reinforcing a shared commitment to sustainability.

During the 2025 Volunteer Day, Heritage employees volunteered 2,112 hours with 55 organizations.

Additionally in 2025, Heritage employees volunteered 5,106 hours with 177 organizations through the Volunteer Program where employees receive 16 hours paid time annually to use for volunteer activities of their choice.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business