First Internet Bancorp 10-K

Item 1. Business When we refer to “First Internet Bancorp,” the “Company,” “we,” “us” and “our” in the remainder of this Annual Report on Form 10-K, we mean First Internet Bancorp and its consolidated subsidiaries, unless the context indicates otherwise. References to “First Internet Bank” or the “Bank” refer to First Internet Bank of Indiana, an Indiana chartered bank and wholly-owned subsidiary of the Company. Overview First Internet Bancorp is a financial holding company headquartered in Fishers, Indiana that conducts its primary business activities through its wholly-owned subsidiary, First Internet Bank of Indiana, an Indiana chartered bank. The Bank was the first state-chartered, Federal Deposit Insurance Corporation (“FDIC”) insured Internet bank and commenced banking operations in 1999. First Internet Bancorp was incorporated under the laws of the State of Indiana on September 15, 2005. On March 21, 2006, we consummated a plan of exchange by which we acquired all of the outstanding shares of the Bank. The Bank has three wholly-owned subsidiaries: First Internet Public Finance Corp., an Indiana corporation that provides a range of public and municipal finance lending and leasing products to governmental entities throughout the United States and acquires securities issued by state and local governments and other municipalities; JKH Realty Services, LLC, a Delaware limited liability company that manages other real estate owned properties as needed; and SPF15, Inc., an Indiana corporation that owns real estate used primarily for the Bank’s principal office. We offer a wide range of commercial, small business, consumer and municipal banking products and services. We conduct our consumer and small business deposit operations primarily through digital channels on a nationwide basis and have no traditional branch offices. Our consumer lending products are primarily originated on a nationwide basis through relationships with dealerships and financing partners. Our commercial banking products and services are delivered through a relationship banking model or through strategic partnerships and include commercial and industrial (“C&I”), construction and investor commercial real estate, single tenant lease financing, public finance, healthcare finance, small business lending, franchise finance and commercial deposits and treasury management. Our C&I team provides credit solutions such as lines of credit, term loans, owner-occupied commercial real estate loans and corporate credit cards on a regional basis to commercial borrowers primarily in the Midwest and Southwest regions of the United States. We offer construction, investor commercial real estate loans and single tenant lease financing on a nationwide basis. Our public finance team provides a range of public and municipal lending and leasing products to government entities on a nationwide basis. Our healthcare finance team was established in conjunction with our strategic partnership with Provide, Inc. (formerly known as Lendeavor, Inc.), a San Francisco-based technology-enabled lender to healthcare practices, which provided lending on a nationwide basis for healthcare practice finance or acquisition, acquisition or refinancing of owner-occupied commercial real estate and equipment purchases. In the third quarter 2021, Provide was acquired by a super-regional financial institution. Subsequent to Provide being acquired, the acquiring institution has retained most, if not all, of Provide’s loan origination activity and our healthcare finance loan balances have declined. Our franchise finance business was established in July 2021 in conjunction with our business relationship with ApplePie Capital, a company that specializes in providing financing to franchisees in various industry segments. Our commercial deposits and treasury management team works with the other commercial teams to provide deposit products and treasury management services to our commercial and municipal lending customers as well as pursues commercial deposit opportunities in business segments where we have no credit relationships. We believe that we differentiate ourselves from larger financial institutions by providing a full suite of services to emerging small businesses and entrepreneurs on a nationwide basis. We are one of the fastest-growing lenders in the Small Business Administration (“SBA”) 7(a) program, closing more than $416.1 million in SBA 7(a) loans during the 2023 calendar year, and ranked as the 9 th largest SBA 7(a) lender for the SBA’s 2023 fiscal year. We also offer a top-ranked small business checking account product to our country’s entrepreneurs. We continue to scale up this business with the goal of driving increased earnings and profitability in future periods. We also offer payment, deposit, card and lending products and services through partnerships with financial technology companies and platforms (“fintechs”). With the rapid evolution of technology that enables consumers and small businesses to manage their finances digitally, fintechs are addressing a significantly growing marketplace. Fintechs have created robust digital offerings, unburdened by legacy technology architecture, to address growing customer expectations. Through 1 partnerships with selected fintechs, we believe our ability to win and retain consumer and small business relationships will be significantly enhanced. Furthermore, we believe partnering with select fintechs will allow us to further diversify our revenue sources, acquire lower-cost deposits and pursue additional asset generation capabilities. As of December 31, 2023, the Company had consolidated assets of $5.2 billion, consolidated deposits of $4.1 billion and shareholders’ equity of $362.8 million. Human Capital As of December 31, 2023, we employed 290 people, 287 of which were full-time. Our team members have been, and continue to be, our most valuable assets, helping to create a strong workplace culture that recognizes the unique contributions and perspectives each individual brings to the organization. We encourage our employees to “Imagine More.” We seek the game-changers, innovators and dreamers – those who are driven to find a better way of doing things for customers and each other. We encourage community involvement and opportunities that support team members, both inside and outside the office. We may be a digital bank, but we strongly believe in the power of personal connection and collaboration, resulting in a relationship rich culture that enables us to live to our very best potential. Our focus on employees is evident in the number of “best work place” awards we have been honored with over the years. We strive to maintain an inclusive and diverse work culture in which individual differences and experiences are valued and all employees have the opportunity to contribute and thrive. We believe that leveraging our employees’ diverse perspectives and capabilities will enhance innovation, foster a collaborative work culture and enable us to better serve our customers and communities. With this vision in mind, the Company’s diversity and inclusion strategy focuses on five organizational pillars: People, Partners, Philanthropy, Products and Processes. In 2021, we published our first Environmental, Social and Governance (“ESG”) Report to highlight, among other things, our focus on and efforts to advance Diversity and Inclusion goals. In 2022, we provided a status update to our ESG Report, highlighting key initiatives and efforts. Our initiatives and efforts continued throughout 2023, as we continue to mandate Diversity, Equity & Inclusion (“DEI”) training for executive leadership and all employees. The phased training program — including topics such as unconscious bias, sexual harassment, regulatory issues and the benefits of a more diverse workplace — is delivered both in-person and online. Ongoing quarterly sessions and annual refresher courses help reinforce the program’s methods and maintain active awareness. Meaningful training, an equitable hiring process, expanded hiring pools, and a long-term commitment to fostering a diverse workforce have all resulted in largely exceptional results over the past five years. In particular, when reviewing the Bank’s employee population, representation of diverse individuals by race and ethnicity increased from 9% in 2019 to 17% in 2023. During that same 5 year time period, we increased our percentage of racially and ethnically diverse new hires by more than 22%. Similarly, we have created positive trends in gender diversity, increasing our percentage of women new hires by 6% to 57% of our total new hires and increasing our percentage of women promotions by 20% to 58% of all promotions. To further foster inclusion as a norm, our organization promotes and supports the development of employee-led business resource groups, which currently include First Ladies, LIFT (a professional development group), and BELONG (a group engaged in celebrating and learning about our unique experiences, heritages, etc.). These groups magnify traditionally underrepresented voices. We also offer tuition reimbursement, a robust internal training program, and leadership training and coaching through a third party consultant to help employees advance their careers and perform competently and confidently. The tuition reimbursement program reimburses approved tuition costs, registration fees for classes, and costs of books and computer-based resources as required by class. The internal training program focuses on topics such as privacy, fair banking, skills-training and many industry specific topics and regulations. The leadership training program features curriculum designed to help leaders understand management duties essential to their role. Community service is a foundational tenet. We commit time, talent and financial support to community initiatives that inspire passion among our team members and support the communities within which we live and work. We allow paid volunteer time and sponsor community initiatives such as Junior Achievement Biztown and Habitat for Humanity. Team members serve on non-profit and other Boards/committees, with organizations such as Indianapolis Neighborhood Housing Partnership (INHP), Indy Chamber, and the Indiana Department of Workforce Development, to assist in meeting the community’s most pressing needs. The result is a sense of pride and increased engagement within the Bank that serves as a catalyst for the greater good. 2 Competition The markets in which we compete to make loans, attract deposits and provide fee based financial services are highly competitive. For consumer banking activities, we compete with other digital banks and fintech companies, in addition to traditional banks, savings banks, credit unions, investment banks, insurance companies, securities brokerages and other financial institutions, as nearly all have some form of digital delivery for their consumer banking services. For our construction, investor CRE, and C&I lending activities, we compete with super-regional, regional and community banks operating in the Midwest and Southwest regions of the United States. For our single tenant lease financing activities, we compete nationally with regional banks, community banks and credit unions, as well as life insurance companies and commercial mortgage-backed securities lenders. For our public finance, healthcare finance and franchise finance activities, we compete nationally with superregional and regional banks. These competitors may have significantly greater financial resources and higher lending limits than we do and may also offer specialized products and services that we do not. For our small business lending activities, we compete on a national footprint with other participating SBA-approved lenders, including a large number of regional and community banks. These competitors have resources and/or lending limits that differ greatly from one another. Regulation and Supervision The U.S. banking industry is highly regulated under federal and state law and this regulatory environment has a material effect on the operations and financial condition of the Company and its subsidiaries. As a result, the Company’s growth and earnings performance may be affected not only by management decisions and general economic conditions, but also by the requirements of federal and state statutes and by the regulations and policies of various bank regulatory agencies, including the Indiana Department of Financial Institutions (the “DFI”), the Board of Governors of the Federal Reserve System (the “Federal Reserve”), the FDIC and the Consumer Financial Protection Bureau (“CFPB”). Furthermore, taxation laws administered by the Internal Revenue Service and state taxing authorities, accounting rules developed by the Financial Accounting Standards Board (the “FASB”), securities laws administered by the SEC and state securities authorities, and anti-money laundering laws enforced by the U.S. Department of the Treasury (“U.S. Treasury”) also have an impact on the Company’s business. This regulatory framework is intended for the protection of depositors, borrowers and other customers, as well as the FDIC deposit insurance funds and the U.S. banking system, rather than the Company’s shareholders or creditors. Banking statutes and regulations are subject to ongoing review and revision by federal and state legislatures and regulatory agencies. Notably, the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), enacted in 2010 in response to the global financial crisis, imposed a number of new and expanded regulatory requirements on the banking industry, which in some cases have been subsequently modified. Future changes in laws, regulations or regulatory policies, including changes in the ways laws and regulations are interpreted or enforced, could affect us in significant and unpredictable ways that may have a material impact on our business. Federal and state banking laws and regulations affect, among other things, the scope of the Company’s business; the kinds and amounts of investments the Company and Bank may make; the fees and charges that may be imposed for bank products and services; required capital levels relative to assets; the nature and amount of collateral for loans; the ability to merge, consolidate, and acquire; dealings with the Company’s and Bank’s insiders and affiliates; and the Company’s payment of dividends. The cost of compliance with these legal and regulatory requirements has increased over time and could increase further in the future in response to changing laws and regulations or regulatory expectations, or as the Company grows and passes certain asset size thresholds at which additional requirements begin to apply. The Dodd-Frank Act, for example, gives rise to a number of additional requirements as financial institutions pass $10 billion in assets. The supervisory framework for U.S. banking organizations subjects banks and their holding companies to regular examination by their respective regulatory agencies, which results in examination reports and ratings that are in most cases not publicly available and that can impact the conduct and growth of their business. These examinations consider not only compliance with applicable laws and regulations, but also capital levels, asset quality and risk, management ability and performance, earnings, liquidity, and various other factors. Regulatory agencies may impose restrictions and limitations on the operations of a regulated entity where the agencies determine, among other things, that such operations are unsafe or unsound, fail to comply with applicable law, or are otherwise inconsistent with laws and regulations. These regulatory agencies have broad enforcement power over regulated entities, including the ability to impose substantial fines and other adverse consequences for violations of law and regulations. 3 Following is a summary of the material elements of the supervisory and regulatory framework applicable to the Company and Bank. It does not describe all of the statutes, regulations, and regulatory policies that apply, and the descriptions in this summary are qualified in their entirety by reference to the particular statutory and regulatory provisions involved. Holding Company Regulation General. The Company is registered as a bank holding company under the Bank Holding Company Act of 1956 (the “BHCA”) and has elected to be a financial holding company. It is subject to regulation, supervision, examination and enforcement by the Federal Reserve. Under the BHCA, the Company is required to file with the Federal Reserve periodic reports of its operations and such additional information regarding the Company and Bank as the Federal Reserve may require. In addition, the Federal Reserve has the authority to issue orders to bank holding companies to cease and desist from unsafe or unsound banking practices and from violations of conditions imposed by, or violations of agreements with, the Federal Reserve. The Federal Reserve is also empowered to assess civil money penalties against companies or individuals who violate Federal Reserve orders or regulations, to order termination of nonbanking activities of bank holding companies and to order termination of ownership and control of a nonbanking subsidiary by a bank holding company. Regulatory Capital . Regulatory capital represents the net assets of a banking organization available to absorb losses. Banks and bank holding companies are generally required to hold more capital than other businesses that are not subject to regulation and supervision by the banking agencies, and this directly affects the Company’s earnings capabilities. While capital has historically been one of the key measures of the financial health of both bank holding companies and banks, its role became fundamentally more important in the wake of the global financial crisis, as banking regulators recognized that the amount and quality of capital held by banks prior to the crisis was insufficient to absorb losses during periods of severe stress. Certain provisions of the Dodd-Frank Act and Basel III, discussed below, establish capital standards for banks and bank holding companies that are meaningfully more stringent than those in place previously. Banks have been required to hold minimum levels of capital based on guidelines established by bank regulatory agencies since 1983. The minimums have been expressed in terms of ratios of “capital” divided by “total assets.” The capital guidelines for U.S. banks beginning in 1989 have been based upon international capital accords, known as “Basel” rules, adopted by the Basel Committee on Banking Supervision (the “BCBS”), a committee of central banks and bank supervisors that acts as the primary global standard-setter for prudential regulation, as implemented by the U.S. bank regulatory agencies on an interagency basis. The accords recognized that bank assets for the purpose of the capital ratio calculations needed to be weighted (the theory being that riskier assets should require more capital) and that off-balance-sheet credit exposures needed to be factored in the calculations. Following the global financial crisis, the Group of Governors and Heads of Supervision, the oversight body of the BCBS, announced agreement on a strengthened set of capital requirements for banking organizations around the world, known as Basel III, to address deficiencies recognized in connection with the global financial crisis. The Basel III Rule. In July 2013, the U.S. federal banking agencies approved implementation of the Basel III regulatory capital reforms in pertinent part, and, at the same time, promulgated rules effecting certain changes required by the Dodd-Frank Act (the “Basel III Rule”). In contrast to capital requirements historically, which were in the form of guidelines, Basel III was released in the form of binding regulations by each of the regulatory agencies. The Basel III Rule increased the required quantity and quality of capital and required more detailed categories of risk weighting of riskier, more opaque assets. For nearly every class of assets, the Basel III Rule requires a more complex, detailed, and calibrated assessment of risk in the calculation of risk weightings for all banking organizations that are subject to minimum capital requirements, including federal and state banks and savings and loan associations, as well as to most bank and savings and loan holding companies. The Company and Bank are each subject to the Basel III Rule as described below. Not only did the Basel III Rule increase most of the required minimum capital ratios in effect prior to January 1, 2015, but in requiring that forms of capital be of higher quality to absorb loss, it also introduced the concept of Common Equity Tier 1 Capital, which consists primarily of common stock, related surplus, retained e arnings, and Common Equity Tier 1 minority interests subject to certain regulatory adjustments. The Basel III Rule also changed the definition of capital by establishing more stringent criteria that instruments must meet to be considered Additional Tier 1 Capital (primarily non-cumulative perpetual preferred stock that meets certain requirements) and Tier 2 Capital (primarily other types of preferred stock and subordinated debt, subject to limitations). The Basel III Rule also constrained the inclusion of minority interests, mortgage-servicing assets, and deferred tax assets in capital and required deductions from Common Equity Tier 1 Capital in the event that such assets exceeded a percentage of a banking institution’s Common Equity Tier 1 Capital. The Basel III Rule requires minimum capital ratios for bank holding companies as follows: 4 • A ratio of minimum Common Equity Tier 1 Capital equal to 4.50% of risk-weighted assets; • A ratio of minimum Tier 1 Capital equal to 6.00% of risk-weighted assets; • A continuation of the minimum required amount of Total Capital (Tier 1 plus Tier 2) at 8.00% of risk-weighted assets; and • A minimum leverage ratio of Tier 1 Capital to total quarterly average assets equal to 4.00% in all circumstances. In addition, institutions that seek the freedom to make capital distributions (including for dividends and repurchases of stock) and pay discretionary bonuses to executive officers without restriction must also maintain 2.50% in Common Equity Tier 1 Capital attributable to a capital conservation buffer. The purpose of the conservation buffer is to ensure that banking institutions maintain a buffer of capital that can be used to absorb losses during periods of financial and economic stress. Factoring in the conservation buffer increases the minimum ratios depicted above to 7.00% for Common Equity Tier 1 Capital, 8.50% for Tier 1 Capital and 10.50% for Total Capital. Well-Capitalized Requirements. The ratios described above are minimum standards in order for banking organizations to be considered “adequately capitalized.” Bank regulatory agencies uniformly encourage banks to hold more capital and be “well capitalized” and, to that end, federal law and regulations provide various incentives for banking organizations to maintain regulatory capital at levels in excess of minimum regulatory requirements. For example, a banking organization that is “well capitalized” may: (i) qualify for exemptions from prior notice or application requirements otherwise applicable to certain types of activities; (ii) qualify for expedited processing of other required notices or applications; and (iii) accept, rollover or renew brokered deposits. Higher capital levels could also be required if warranted by the particular circumstances or risk profiles of individual banking organizations. For example, the Federal Reserve’s capital guidelines contemplate that additional capital may be required to take adequate account of, among other things, interest rate risk, or the risks posed by concentrations of credit, nontraditional activities, or securities trading activities. Further, any banking organization experiencing or anticipating significant growth would be expected to maintain capital ratios, including tangible capital positions (i.e., Tier 1 Capital less all intangible assets), well above the minimum levels. Under the capital regulations of the FDIC and Federal Reserve, in order to be well capitalized, a banking organization must maintain: • A Common Equity Tier 1 Capital ratio to risk-weighted assets of 6.50% or more; • A ratio of Tier 1 Capital to total risk-weighted assets of 8.00% or more; • A ratio of Total Capital to total risk-weighted assets of 10.00% or more; and • A leverage ratio of Tier 1 Capital to total adjusted average quarterly assets of 5.00% or greater. It is possible under the Basel III Rule to be well capitalized while remaining out of compliance with the capital conservation buffer discussed above. As of December 31, 2023, the Company had regulatory capital in excess of the Federal Reserve’s requirements and met the requirements to be well capitalized. The Company was also in compliance with the capital conservation buffer. As of December 31, 2023, the Bank was well capitalized, as defined by FDIC regulations. Prompt Corrective Action. The concept of an institution being “well capitalized” is part of a regulatory enforcement regime that provides the federal banking regulators with broad power to take “prompt corrective action” to resolve the problems of depository institutions based on the capital level of each particular institution. The extent of the regulators’ powers depends on whether the institution in question is “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” or “critically undercapitalized,” in each case as defined by regulation. Depending upon the capital category to which an institution is assigned, the regulators’ corrective powers include: (i) requiring the institution to submit a capital restoration plan; (ii) limiting the institution’s asset growth and restricting its activities; (iii) requiring the institution to issue additional capital stock (including additional voting stock) or to sell itself; (iv) restricting transactions between the institution and its affiliates; (v) restricting the interest rate that the institution may pay on deposits; (vi) ordering a new election of directors of the institution; (vii) requiring that senior executive officers or directors be dismissed; (viii) prohibiting the institution from accepting deposits from correspondent banks; (ix) requiring the institution to divest certain subsidiaries; (x) prohibiting the payment of principal or interest on subordinated debt; and (xi) ultimately, appointing a receiver for the institution. Community Bank Leverage Ratio Framework. In response to industry complaints concerning the regulatory burdens imposed on community banks by certain aspects of the Basel III Rule, the U.S. Congress, as part of the 2018 Economic Growth, Regulatory Relief, and Consumer Protection Act, authorized an optional, simplified measure of capital adequacy, the 5 “Community Bank Leverage Ratio” (“CBLR”) framework, for qualifying community banking organizations like the Company with less than $10 billion in total consolidated assets. The federal banking agencies jointly adopted a rulemaking effective January 1, 2020, that implemented this alternative approach to measuring capital. Qualifying institutions must have a leverage ratio greater than 9%, off-balance sheet exposures of 25% or less of total consolidated assets, and trading assets and liabilities of 5% or less of total consolidated assets. Banks that opt in to the rule are not required to calculate or report risk-based capital and are deemed to have met the well-capitalized ratio requirement. In response to the COVID-19 pandemic, the banking agencies temporarily lowered the qualifying leverage ratio to 8.00% in the second quarter of 2020, which then rose to 8.50% for calendar year 2021 and 9.00% thereafter. The Company has not opted in to the CBLR capital framework. Activities, Acquisitions, and Changes in Control. The BHCA requires a bank holding company to obtain approval from the Federal Reserve before (i) acquiring or holding more than a 5% voting interest in any bank or bank holding company, (ii) acquiring all or substantially all of the assets of another bank or bank holding company or (iii) merging or consolidating with another bank holding company. Federal law also prohibits any person or company from acquiring “control” of an FDIC-insured depository institution or its holding company without prior notice to the appropriate federal bank regulator. “Control” is conclusively presumed to exist upon the acquisition of 25% or more of the outstanding voting securities of a bank or bank holding company, but may arise under certain circumstances between 10% and 24.99% ownership. Bank mergers and acquisitions generally will require the approval of the regulatory authorities of each banking organization. In determining whether to approve a proposed bank acquisition, federal bank regulators will consider, among other factors, the effect of the acquisition on competition, public benefits expected to be generated by the acquisition, post-acquisition capital levels, and performance under the Community Reinvestment Act of 1977, as amended (the “CRA”). The federal banking regulators are also required to consider the effectiveness of the Bank Secrecy Act/anti-money laundering activities of the applicant. Federal regulatory policy relating to the approval of proposed mergers and acquisitions is currently under review. In July 2021, President Biden issued an Executive Order on Promoting Competition in the American Economy that, among other initiatives, calls upon the federal banking agencies to review their current merger approval practices under the BHCA and the Bank Merger Act, and adopt a plan for the revitalization of such practices. In February 2022, Acting FDIC Chairman Gruenberg announced that the agency’s priorities include a comprehensive review of the process of considering and evaluating bank mergers, something the FDIC indicated had not been done in 25 years. Holding Company Dividends. The Company’s ability to pay dividends to shareholders will be impacted both by general corporate law considerations and policies of the Federal Reserve applicable to bank holding companies. It may also be impacted by the ability of the Bank to pay dividends to the Company, discussed under “Bank Regulation—Dividends” below. As an Indiana corporation, the Company is subject to the Indiana Business Corporation Law, as amended, which prohibits the Company from paying a dividend if, after giving effect to the dividend, the Company would not be able to pay its debts as they become due in the usual course of business, or if the Company’s total assets would be less than the sum of its total liabilities plus the amount that would be needed, if the corporation were to be dissolved at the time of the distribution, to satisfy the preferential rights upon dissolution of shareholders whose preferential rights are superior to those receiving the distribution. The Federal Reserve has indicated that the board of directors of a bank holding company should eliminate, defer or significantly reduce dividends to shareholders if: (i) the company’s net income available to shareholders for the past four quarters, net of dividends previously paid during that period, is not sufficient to fully fund the dividends; (ii) the prospective rate of earnings retention is inconsistent with the Company’s capital needs and overall current and prospective financial condition; or (iii) the company will not meet, or is in danger of not meeting, its minimum regulatory capital adequacy ratios. The Federal Reserve possesses enforcement powers to prevent or remedy actions that represent unsafe or unsound practices or violations of applicable statutes or regulations. Among those powers is the ability to restrict the payment of dividends. In addition, under the Basel III Rule, institutions that seek the freedom to pay dividends have to maintain 2.50% in Common Equity Tier 1 Capital attributable to the capital conservation buffer. See “Regulatory” section above. Source of Strength . Under the Dodd-Frank Act, we are required to serve as a source of financial and managerial strength for the Bank and to commit resources to support it in circumstances where we might not otherwise do so, in the event of the financial distress of the Bank. This provision codified the longstanding policy of the Federal Reserve. In addition, any capital loans by a bank holding company to any of its depository subsidiaries are subordinate to the payment of deposits and to certain other indebtedness. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a depository subsidiary will be assumed by the bankruptcy trustee and entitled to a priority of payment. Employee Incentive Compensation. Under regulatory guidance applying to all banking organizations, incentive compensation policies must be consistent with safety and soundness principles. Under this guidance, banking organizations must review their compensation programs to ensure that they: (i) provide employees with incentives that appropriately balance 6 risk and reward and that do not encourage imprudent risk, (ii) are compatible with effective controls and risk management, and (iii) are supported by strong corporate governance, including active and effective oversight by the banking organization's board of directors. Monitoring methods and processes used by a banking organization should be commensurate with the size and complexity of the organization and its use of incentive compensation. Bank Regulation General. The Bank is an Indiana-chartered bank formed pursuant to the Indiana Financial Institutions Act (the “IFIA”). As such, the Bank is regularly examined by and subject to regulations promulgated by the DFI and the FDIC as its primary federal bank regulator. The Bank is not a member of the Federal Reserve System. Business Activities . The Bank derives its lending and investment powers from the IFIA, the Federal Deposit Insurance Act (the “FDIA”) and related regulations. Loans-to-One Borrower Limitations . Generally, the Bank’s total loans or extensions of credit to a single borrower, including the borrower’s related entities, outstanding at one time, and not fully secured, cannot exceed 15% of the Bank’s unimpaired capital and surplus. If the loans or extensions of credit are fully secured by readily marketable collateral, the Bank may lend up to an additional 10% of its unimpaired capital and surplus. Community Reinvestment Act . Under the CRA, as implemented by FDIC regulations, the Bank has a continuing and affirmative obligation, consistent with safe and sound banking practices, to help meet the credit needs of its entire community, including low and moderate-income neighborhoods. The CRA does not establish specific lending requirements or programs for financial institutions nor does it limit an institution’s discretion to develop the types of products and services that it believes are best suited to its particular community, consistent with the CRA. The CRA requires the FDIC, in connection with its examinations of the Bank, to assess the Bank’s record of meeting the credit needs of its entire community and to take that record into account in evaluating certain applications for regulatory approvals that we may file with the FDIC. Due to its online-driven model and nationwide banking platform, the Bank has opted to operate under a CRA Strategic Plan, which sets forth certain guidelines the Bank must meet. The Bank is awaiting FDIC approval for its proposed CRA Strategic Plan to cover the time period of January 1, 2024 through December 31, 2027. The Bank’s previous CRA Strategic Plan covered the time period of January 1, 2021 through December 31, 2023. The Bank received a “Satisfactory” CRA rating under that plan in its most recent CRA examination. Failure of an institution to receive at least a “Satisfactory” rating could inhibit such institution or its holding company from engaging in certain activities or pursuing acquisitions of other financial institutions. Transactions with Affiliates . The authority of the Bank, like other FDIC-insured institutions, to engage in transactions with its “affiliates” is limited by Sections 23A and 23B of the Federal Reserve Act and the Federal Reserve’s Regulation W. An “affiliate” for this purpose is defined generally as any company that owns or controls the Bank or is under common ownership or control with the Bank, but excludes a company controlled by a bank. In general, transactions between the Bank and its affiliates must be on terms that are consistent with safe and sound banking practices and at least as favorable to the Bank as comparable transactions between the Bank and non-affiliates. In addition, covered transactions with affiliates are restricted individually to 10% and in the aggregate to 20% of the Bank’s capital. Collateral ranging from 100% to 130% of the loan amount depending on the quality of the collateral must be provided for an affiliate to secure a loan or other extension of credit from the Bank. The Company is an “affiliate” of the Bank for purposes of Regulation W and Sections 23A and 23B of the Federal Reserve Act. We believe the Bank complied with these provisions during 2023. Loans to and Other Transactions with Insiders . The Bank’s authority to extend credit to its directors, executive officers and principal shareholders, as well as to entities controlled by such persons (“Related Interests”), is governed by Sections 22(g) and 22(h) of the Federal Reserve Act and Regulation O of the Federal Reserve. Among other things, these provisions require that extensions of credit to insiders: (1) be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with unaffiliated persons and that do not involve more than the normal risk of repayment or present other unfavorable features; and (2) not exceed certain limitations on the amount of credit extended to such persons, individually and in the aggregate, which limits are based, in part, on the amount of the Bank’s capital. In addition, extensions of credit in excess of certain limits must be approved in advance by the Bank’s Board of Directors. Further, provisions of the Dodd-Frank Act require that any sale or purchase of an asset by the Bank with an insider must be on market terms, and if the transaction represents more than 10% of the Bank’s capital stock and surplus, it must be approved in advance by a majority of the disinterested directors of the Bank. We believe the Bank is in compliance with these provisions. 7 Enforcement . The DFI and the FDIC share primary regulatory enforcement responsibility over the Bank and its institution-affiliated parties, including directors, officers and employees. This enforcement authority includes, among other things, the ability to appoint a conservator or receiver for the Bank, to assess civil money penalties, to issue cease and desist orders, to seek judicial enforcement of administrative orders and to remove directors and officers from office and bar them from further participation in banking. In general, these enforcement actions may be initiated in response to alleged violations of laws, regulations and administrative orders, as well as in response to alleged unsafe or unsound banking practices or conditions. Standards for Safety and Soundness . Pursuant to the FDIA, the federal banking agencies have adopted a set of guidelines prescribing safety and soundness standards. These guidelines establish general standards relating to internal controls and information systems, internal audit systems, loan documentation, credit underwriting, interest rate risk exposure, asset growth, asset quality, earnings standards, compensation, fees and benefits. In general, the guidelines require appropriate systems and practices to identify and manage the risks and exposures specified in the guidelines. We believe we are in compliance with the safety and soundness guidelines. Dividends . The ability of the Bank to pay dividends is limited by state and federal laws and regulations, including the requirement for the Bank to obtain the prior approval of the DFI before paying a dividend that, together with other dividends it has paid during a calendar year, would exceed the sum of its net income for the year to date combined with its retained net income for the previous two years. The ability of the Bank to pay dividends is further affected by the requirement to maintain adequate capital pursuant to applicable capital adequacy guidelines and regulations, and it is generally prohibited from paying any dividends if, following payment thereof, it would be undercapitalized. Notwithstanding the availability of funds for dividends, the FDIC and the DFI may prohibit the payment of dividends by the Bank if either or both determine such payment would constitute an unsafe or unsound practice. In addition, under the Basel III Rule, institutions that seek the freedom to pay dividends have to maintain 2.5% in Common Equity Tier 1 Capital attributable to the capital conservation buffer. Insurance of Deposit Accounts . The Bank is a member of the Deposit Insurance Fund (“DIF”), which is administered by the FDIC. All deposit accounts at the Bank are insured by the FDIC up to a maximum of $250,000 per depositor. Under the FDIA, the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC. Liquidity . The Bank is required to maintain a sufficient amount of liquid assets to ensure its safe and sound operation. To fund its operations, the Bank historically has relied upon deposits, Federal Home Loan Bank of Indianapolis (“FHLB”) borrowings, Fed Funds lines with correspondent banks and brokered deposits. The FDIA and FDIC regulations limit the ability of banks to accept, renew, or roll over brokered deposits unless the institution is well capitalized. The FDIC may grant a waiver to permit a less than well capitalized bank to hold brokered deposits, but limitations on the rates paid on such deposits will apply, and the bank may also be required to pay a higher deposit insurance assessment on such deposits. The Bank believes it has sufficient liquidity to meet its funding obligations for at least the next twelve months. Additionally, as of December 31, 2023, the Bank had access to $1.2 billion in unused borrowing capacity at the Federal Reserve and FHLB. Federal Home Loan Bank System . The Bank is a member of the FHLB, which is one of the regional Federal Home Loan Banks comprising the Federal Home Loan Bank System. Each Federal Home Loan Bank serves as a central credit facility primarily for its member institutions. The Bank, as a member of the FHLB, is required to acquire and hold shares of FHLB capital stock. While the required percentage of stock ownership is subject to change by the FHLB, the Bank is following this requirement with an investment in FHLB stock at December 31, 2023 of $28.4 million. Any advances from the FHLB must be secured by specified types of collateral, and long-term advances may be used for the purpose of providing funds to make residential mortgage or commercial loans and to purchase investments. Long-term advances may also be used to help alleviate interest rate risk for asset and liability management purposes. The Bank receives dividends on its FHLB stock. Federal Reserve System . Although the Bank is not a member of the Federal Reserve System, it is subject to provisions of the Federal Reserve Act and the Federal Reserve’s regulations under which depository institutions may be required to maintain reserves against their deposit accounts and certain other liabilities. In March 2020, the Federal Reserve announced that the banking system had ample reserves and, as reserve requirements no longer played a significant role in this regime, it reduced all reserve tranches to zero percent, thereby freeing banks from the reserve maintenance requirement. This action permits the Bank to loan or invest funds that were previously unavailable. The Federal Reserve has indicated that it currently has no plans to reimpose reserve requirements but that it may impose such a requirement in the future if conditions warrant. Anti-Money Laundering and the Bank Secrecy Act . Under the Bank Secrecy Act (the “BSA”), a financial institution is required to have systems in place to detect and report transactions of a certain size and nature. Financial institutions are generally required to report to the U.S. Treasury any cash transactions involving more than $10,000. In addition, financial 8 institutions are required to file suspicious activity reports for transactions that involve more than $5,000 and which the financial institution knows, suspects or has reason to suspect involves illegal funds, is designed to evade the requirements of the BSA or has no lawful purpose. The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (the “USA PATRIOT Act”), which amended the BSA, is designed to deny terrorists and others the ability to obtain anonymous access to the U.S. financial system. The USA PATRIOT Act has significant implications for financial institutions and businesses of other types involved in the transfer of money. The USA PATRIOT Act, in conjunction with the implementation of various federal regulatory agency regulations, has caused financial institutions, such as the Bank, to adopt and implement additional policies or amend existing policies and procedures with respect to, among other things, anti-money laundering compliance, suspicious activity, currency transaction reporting, customer identity verification and customer risk analysis. Bank regulators regularly examine institutions for compliance with these obligations, and may impose “cease and desist” orders and civil money penalty sanctions on institutions determined to be in violation of these obligations. In January 2021, the Anti-Money Laundering Act of 2020 (the “AMLA”), which amends the BSA, was enacted. The AMLA was intended to comprehensively reform and modernize U.S. anti-money laundering laws. Among other things, the AMLA attempted to codify a risk-based approach to anti-money laundering compliance for financial institutions; required the development of standards by the U.S. Treasury for evaluating technology and internal processes for BSA compliance; and expanded enforcement- and investigation-related authority, including a significant expansion in the available sanctions for certain BSA violations and enhanced whistleblower provisions permitting monetary awards to persons who provide information that leads to successful enforcement of certain violations. Many of the statutory provisions in the AMLA require additional rulemaking, reports and other measures, and the impact of the AMLA will depend on, among other things, rulemaking and implementation guidance. The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others. These sanctions, which are administered by the U.S. Treasury Office of Foreign Assets Control (“OFAC”), take many different forms. Generally, however, they contain one or more of the following elements: (1) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments in, or providing investment-related advice or assistance to, a sanctioned country; and (2) blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (for example, property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions can give rise to serious legal and reputational consequences. Consumer Protection Laws . The Bank is subject to a number of federal and state laws designed to protect consumers and prohibit unfair or deceptive business practices. These laws include the Equal Credit Opportunity Act, Fair Housing Act, Homeowners Protection Act, Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactions Act of 2003 (the “FACT Act”), the Gramm-Leach-Bliley Act (the “GLBA”), the Truth in Lending Act, the CRA, the Home Mortgage Disclosure Act, the Real Estate Settlement Procedures Act, the National Flood Insurance Act, t he Service Members Civil Relief Act, t he Expedited Funds Availability Act, the Electronic Fund Transfer Act, the Truth in Savings Act, the Right to Financial Privacy Act, laws relating to unfair, deceptive and abusive acts and practices, and various state laws such as usury laws, or laws which are counterparts and/or extensions of the foregoing federal laws. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must interact with customers when taking deposits, making loans, collecting loans and providing other services. Further, the Dodd-Frank Act established the CFPB as an independent agency within the Federal Reserve System. The CFPB has the exclusive authority to administer, enforce, and otherwise implement federal consumer financial laws, which includes the power to make rules, issue orders, and issue guidance governing the provision of consumer financial products and services. The CFPB also has a broad mandate to prohibit unfair or deceptive acts and practices and is specifically empowered to require certain disclosures to consumers and draft model disclosure forms. Failure to comply with consumer protection laws and regulations can subject financial institutions to enforcement actions, fines and other penalties. In recent years, state authorities have also increased their attention to the enforcement of consumer protection rules, and in some cases, states are permitted to adopt and enforce consumer protection laws and regulations that are stricter than those issued or enforced by the CFPB. The CFPB has exclusive federal consumer law supervisory authority and primary enforcement authority over insured depository institutions with assets totaling over $10 billion. Authority for institutions with $10 billion or less rests with the prudential regulator, and in the case of the Bank lies with the FDIC. Residential Mortgage Restrictions. The Dodd-Frank Act initiated a number of significant residential mortgage lending reforms. These reforms include standards that mortgage lenders must consider before making a residential mortgage loan, including verifying a borrower’s ability to repay such mortgage loan. Borrowers are also allowed to assert violations of certain provisions of the Truth-in-Lending Act as a defense to foreclosure proceedings. Prepayment penalties are prohibited for certain mortgage transactions and creditors are prohibited from financing insurance policies in connection with a residential mortgage 9 loan or home equity line of credit. Mortgage lenders are required to make additional disclosures prior to the extension of credit, in each billing statement and for negative amortization loans and hybrid adjustable rate mortgages. Additionally, mortgage originators are prohibited from receiving compensation based on the terms of residential mortgage loans and are subject to limitations on their ability to be compensated by others if compensation is received from a consumer. Customer Information Security . The federal banking agencies have adopted final guidelines establishing standards for safeguarding nonpublic personal information about customers. These guidelines implement provisions of the GLBA. Specifically, the Information Security Guidelines established by the GLBA require each financial institution, under the supervision and ongoing oversight of its board of directors or an appropriate committee thereof, to develop, implement and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information (as defined under the GLBA), to protect against anticipated threats or hazards to the security or integrity of such information and to protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. The federal banking regulators have issued guidance for banks on response programs for unauthorized access to customer information. This guidance, among other things, requires notice to be sent to customers whose “sensitive information” has been compromised if misuse of this information is “reasonably possible.” Identity Theft Red Flags . Rules implementing Section 114 of the FACT Act require each financial institution or creditor to develop and implement a written Identity Theft Prevention Program to detect, prevent and mitigate identity theft in connection with the opening of certain accounts or certain existing accounts. In addition, the federal banking agencies issued guidelines to assist financial institutions and creditors in the formulation and maintenance of an Identity Theft Prevention Program that satisfies the requirements of the rules. Rules implementing Section 114 of the FACT Act also require credit and debit card issuers to assess the validity of notifications of changes of address under certain circumstances. Additionally, the federal banking agencies issued joint rules under Section 315 of the FACT Act that provide guidance regarding reasonable policies and procedures that a user of consumer reports must employ when a consumer reporting agency sends the user a notice of address discrepancy. Privacy . The GLBA requires financial institutions to implement policies and procedures regarding the disclosure of nonpublic personal information about consumers to nonaffiliated third parties. In general, the statute requires financial institutions to explain to consumers their policies and procedures regarding the disclosure of such nonpublic personal information and, except as otherwise required or permitted by law, financial institutions are prohibited from disclosing such information except as provided in their policies and procedures. The Bank is required to provide notice to its customers on an annual basis disclosing its policies and procedures on the sharing of nonpublic personal information. From time to time, Congress and state legislatures consider additional legislation relating to privacy and other aspects of consumer information that could have an impact on our business, financial condition or results of operations. A number of U.S. states have also enacted data privacy and security laws and regulations that govern the collection, use, disclosure, transfer, storage, disposal and protection of personal information, such as social security numbers, financial information and other information. These laws and regulations may be more restrictive and not preempted by U.S. federal laws. For example, several U.S. territories and all 50 states now have data breach laws that require timely notification to individuals, and at times regulators, the media or credit reporting agencies, if a company has experienced the unauthorized access or acquisition of personal information. Other state laws include the California Consumer Privacy Act (“CCPA”), which took effect on January 1, 2020. The CCPA, among other things, contains new disclosure obligations for businesses that collect personal information about California residents and affords those individuals numerous rights relating to their personal information that may affect our ability to use personal information or share it with our business partners. A second law called the California Privacy Rights Act (“CPRA”), which went into effect in 2023, expands the scope of the CCPA, imposes new restrictions on behavioral advertising, and establishes a new California Privacy Protection Agency which will enforce the law and issue regulations. Similar laws were enacted in Virginia and Colorado, and other states have considered and are actively considering legislation along the same lines. We will continue to monitor and assess the impact of these state laws, which may impose substantial penalties for violations, impose significant costs for investigation and compliance, allow private class-action litigation and carry significant potential liability for our business. Cybersecurity . In 2015, federal regulators issued two related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish lines of defense and ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing digital-based services of the financial institution. The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption, and maintenance of the institution’s operations after a cyber-attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and 10 address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties. In November 2021, the federal banking agencies published a final rule establishing computer-security incident notification requirements that require a banking organization to notify its primary federal regulator of any “computer security incident” that rises to the level of a “notification incident” as soon as possible and no later than 36 hours after determining that such an incident has occurred. The rule also requires a bank service provider to notify each affected banking organization customer as soon as possible when the service provider determines it has experienced a computer security incident that has caused, or is reasonably likely to cause, a material service disruption or degradation for four or more hours. State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. For example, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. We expect this trend of increased activity and changes at the state level to continue. Recently, the SEC has enacted laws requiring public companies to disclose material cybersecurity risks and incidents along with cybersecurity protections and governance processes. These SEC guidelines, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations. See Part I, Item 1C. Cybersecurity of this Annual Report on Form 10-K for additional information. In support of our digital banking platform, we rely heavily on electronic communications and information systems to conduct our operations and store sensitive data. We employ an in-depth approach that leverages people, processes, and technology to manage and maintain cybersecurity controls. In addition, we employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of our defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. We continually strive to enhance our cyber and information security in order to be resilient against emerging threats and improve our ability to detect and respond to attempts to gain unauthorized access to our data and systems. We regularly conduct cybersecurity risk assessments, regularly engage with the Board or appropriate committees on cybersecurity matters, routinely update our incident response plans based on emerging threats, periodically practice implementation of incident response plans across applicable departments, and train officers and employees to detect and report suspicious activity. Although to date we have not experienced any material losses relating to cyber-attacks or other information security breaches, our systems and those of our customers and third-party service providers are under constant threat, and it is possible that we could experience a significant event in the future due to the rapidly evolving nature and sophistication of these threats. Climate-Related Risk Management and Regulation. In recent years, the federal banking agencies and the SEC have increased their focus on climate-related risks impacting the operation of banks, the communities they serve and the financial system as a whole. Proposals related to climate-related financial and other risks impacting banks are being considered at both the federal and state level. It is too early to predict to what extent legislative and regulatory proposals will impact the Company and the Bank, but we will continue to monitor these developments and the steps that will need to be taken to address any new requirements. Additional Matters . The earnings of financial institutions are also affected by general economic conditions and prevailing interest rates, both domestic and foreign, and by the monetary and fiscal policies of the United States Government and its various agencies, particularly the Federal Reserve. The Federal Reserve regulates the supply of credit in order to influence general economic conditions, primarily through open market operations in United States Government obligations, varying the discount rate on financial institution borrowings, varying reserve requirements against financial institution deposits, and restricting certain borrowings by financial institutions and their subsidiaries. The monetary policies of the Federal Reserve have had a significant effect on the operating results of the Bank in the past and are expected to continue to do so in the future. Additional legislation and administrative actions affecting the banking industry may be considered by the United States Congress, state legislatures and various regulatory agencies, including those referred to above. It cannot be predicted with certainty whether such legislation or administrative action will be enacted or the extent to which the banking industry, the Company or the Bank would be affected. 11 Available Information The Company makes available its Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and all amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), free of charge on its website at www.firstinternetbancorp.com as soon as reasonably practicable after it electronically files such material with, or furnishes it to, the SEC. In addition, the SEC maintains an internet site at www.sec.gov that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC. References to the Company’s website address in this Annual Report on Form 10-K are provided as a convenience only and are not incorporated by reference.