What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2023-03-15 compared with 2022-03-15 · 149 added, 157 removed, 571 unchanged (35% of the section changed)

3 unchanged sentences

We believe our integrated business model distinguishes us from other banks and non-bank financial services companies in the markets in which we operate.

As of December 31, 2021, we provided fiduciary and advisory services on $7.35 billion of trust and investment management assets (referred to as "AUM"), and we had total assets of $2.53 billion, total loans of $1.95 billion, total deposits of $2.21 billion and total shareholders’ equity of $219.0 million.

As of December 31, 2022, we provided fiduciary and advisory services on $6.11 billion of trust and investment management assets (referred to as "AUM"), and we had total assets of $2.87 billion, total loans of $2.48 billion, total deposits of $2.41 billion and total shareholders’ equity of $240.9 million.

Our mission is to be the best private bank for the Western wealth management client.

We believe that the "Western wealth management client"

shares our entrepreneurial spirit and values our sophisticated, high-touch integrated financial services that are tailored to meet their specific needs.

We believe that the "Western wealth management client" shares our entrepreneurial spirit and values our sophisticated, high-touch integrated financial services that are tailored to meet their specific needs.

Our target clients include successful entrepreneurs, professionals and other high net worth individuals or families, along with their businesses and philanthropic organizations.

We offer our services through a branded network of boutique private trust bank offices, loan production offices, and trust offices, which we believe are strategically located in affluent and high-growth markets in eighteen locations across Colorado, Arizona, Wyoming and California.

We offer our services through a branded network of boutique private trust bank offices, loan production offices, and trust offices, which we believe are strategically located in affluent and high-growth markets in nineteen locations across Colorado, Arizona, Wyoming, California, and Montana.

We generate a significant portion of our revenues from non-interest income, which we produce from our trust, investment management and other advisory services as well as through the origination and sale of mortgage loans.

3 unchanged sentences

• Offering sophisticated wealth management products and services, including traditional banking as well as trust, wealth planning, investment management and other related services often provided by larger financial institutions with the high-touch and personalized experience that is typically associated with community and trust banks;

● Delivering services through our strategically located private trust bank offices, which we refer to internally as "profit centers";

● Using our relationship-based team approach to become a "trusted advisor"

to our clients by understanding their investment management, ultimate goals and banking needs and tailoring our products and services to meet those needs.

Our History and Growth

• Delivering services through our strategically located private trust bank offices, which we refer to internally as "profit centers";

• Using our relationship-based team approach to become a "trusted advisor" to our clients by understanding their investment management, ultimate goals and banking needs and tailoring our products and services to meet those needs.

We were founded in 2002 by our Chairman, Chief Executive Officer and President, Scott C.

1 unchanged sentence

Since opening our first office in Denver, Colorado in 2004, we have grown organically primarily by establishing boutique private trust bank offices, attracting new clients and expanding our relationships with existing clients, as well as through a series of strategic acquisitions of various trust, registered investment advisory, bank branch and full bank institutions, and other financial services firms.

Since we completed an initial public offering of our common stock on July 23, 2018, our common stock has been listed on the NASDAQ Global Select Market under the symbol "MYFW."

Balance Sheet Growth

Since December 31, 2017, we have increased total loans from $813.7 million to $1.95 billion as of December 31, 2021, representing a compound annual growth rate ("CAGR") of 24.4% and we have increased total deposits from $816.1 million as of December 31, 2017 to $2.21 billion as of December 31, 2021, representing a CAGR of 28.2%.

Revenue, Expense, and Income Growth

Since the year ended December 31, 2017, we have increased total income before non-interest expense from $54.5 million to $95.4 million for the year ended December 31, 2021, representing a CAGR of 15.0%, while total non-interest expense increased from $49.5 million for the year ended December 31, 2017 to $68.1 million for the year ended December 31, 2021, representing a CAGR of 8.3%.

We calculate operating leverage as the ratio of total income before non-interest expense CAGR to the total non-interest expense CAGR.

For the year ended December 31, 2021, this 180.6% operating leverage has resulted in improved income before income tax, which increased 4.4 times over the same time period.

We have demonstrated significant operating leverage by growing income before income tax at a faster rate than expenses.

Since we completed an initial public offering of our common stock on July 23, 2018, our common stock has been listed on the NASDAQ Global Select Market under the symbol "MYFW."

Our Business Strategy

We believe we have built a premier private trust bank in the Western United States that is focused on providing the best financial solutions to our clients.

We believe we have built a premier private trust bank in the Western United States that focuses on providing the best financial solutions to our clients.

We are service-driven, solution-oriented and relationship-based.

1 unchanged sentence

• Building Out Existing Markets.

Once we have established a presence in a particular geographic market that contains attractive high net worth household demographics, we then look to establish additional locations that are closely situated to sub-concentrations of affluent households and/or commercial activity (a "hub and spoke"

market build-out, as we have commenced in Denver and Phoenix).

We continue to seek out talent to hire as part of our strategy of building out existing markets and continue to be successful in hiring teams that help us accomplish this goal.

1 unchanged sentence

• Deepening Existing Client Relationships.

We deliver our services though our eighteen local boutique private trust bank offices, loan production offices, and trust offices.

We deliver our services though our nineteen local boutique private trust bank offices, loan production offices, and trust offices.

This allows us to use multi-discipline sales and client service teams, in-market, to ensure we are meeting each client’s comprehensive set of needs.

31 unchanged sentences

By continuing to expand our product offerings—either by internal product development or establishing third-party relationships—we work to meet expanding client needs while further diversifying our revenue streams.

This includes our recent efforts to upgrade our commercial banking capabilities, adding market expertise in certain business verticals.

This includes our recent efforts to focus on our product management disciplines as well as upgrading our commercial banking capabilities, adding market expertise in certain business verticals.

Our Service Model and Products

9 unchanged sentences

Our commercial lending products include commercial loans, business term loans and lines of credit to a diversified mix of small and midsized businesses.

We offer both owner occupied and non-owner occupied commercial real estate ("CRE") loans, as well as construction loans.

Our consumer lending products include residential first mortgage loans, originated loans for our own portfolio, as well as those for which we conduct mortgage banking activities whereby we originate and sell, servicing-released, whole loans in the secondary market.

28 unchanged sentences

Cash, Securities and Other .

Our cash, securities and other loan portfolio consists of consumer and commercial purpose loans that are primarily secured by securities managed and under custody with us, cash on deposit with us or life insurance policies.

In addition, loans in this portfolio are collateralized with other sources of consumer collateral, which typically leaves an immaterial amount of the loan balance unsecured.

Our cash, securities and other loan portfolio consists of consumer and commercial purpose loans, which are primarily secured by securities managed and under custody with us, cash on deposit with us or life insurance policies.

As of December 31, 2022, loans secured with cash, marketable securities and other were $165.7 million, or 6.6% of our total loan portfolio.

1 unchanged sentence

PPP loans that are fully guaranteed by the SBA are classified within this line item.

Consumer and Other.

Our consumer and other loan portfolio consists of unsecured consumer loans.

Loans held for investment accounted for under the fair value option are also classified within this line item and had an unpaid principal balance of $23.4 million as of December 31, 2022.

Consumer and other loans were $50.0 million, or 2.0% of our total loan portfolio.

Commercial and Industrial .

20 unchanged sentences

We originate loans to finance the construction of residential and non-residential properties.

Construction and development loans are generally collateralized by first liens on real estate and usually have floating interest rates.

Construction and development loans are generally collateralized by first liens on real estate as well as financial guarantees from the borrower and usually have floating interest rates.

Our construction and development loans typically have maturities of up to two years depending on factors such as the type and size of the development and the financial strength of the borrower/guarantor, and are typically structured with an interest only construction period.

2 unchanged sentences

Concentrations .

Most of our lending activity and credit exposure, including real estate collateral for many of our loans, are concentrated in Colorado, Arizona, Wyoming and California, as approximately 87.3% of the loans in our loan portfolio as of December 31, 2021 were made to borrowers who live in or conduct business in those states.

Most of our lending activity and credit exposure, including real estate collateral for many of our loans, are concentrated in Colorado, Arizona, Wyoming, California, and Montana, as approximately 83.6% of the loans in our loan portfolio as of December 31, 2022 were made to borrowers who live in or conduct business in those states.

Our commercial real estate loans are generally secured by first liens on real property.

The remaining commercial and industrial loans are typically secured by general business assets, accounts receivable, inventory and/or the corporate guaranty of the borrower and personal guaranty of its principals.

The geographic concentration subjects the loan portfolio to the general economic conditions within Colorado, Arizona, Wyoming and California.

The geographic concentration subjects the loan portfolio to the general economic conditions within Colorado, Arizona, Wyoming, California, and Montana.

The risks created by such concentrations have been considered by management in the determination of the adequacy of the allowance for loan losses.

48 unchanged sentences

A key part of our strategy is to continue to enhance our funding sources by continuing to build our private and commercial banking capabilities to keep building our base of attractively priced core deposits.

We provide a broad range of deposit products and services, including demand deposits, interest-bearing transaction accounts, money market accounts, time and savings deposits, certificates of deposit and CDARS ® reciprocal products.

We provide a broad range of deposit products and services, including demand deposits, interest-bearing transaction accounts, money market accounts, time and savings deposits, ICS ® , certificates of deposit and CDARS ® reciprocal products.

We also offer a range of treasury management products including cash manager and commercial analysis accounts, electronic receivables management, remote deposit capture, cash vault services, merchant services and other cash management services.

3 unchanged sentences

For liquidity purposes, the Bank occasionally uses brokered deposits.

As of December 31, 2021 and 2020, we had brokered deposits of $22.3 million and $20.7 million, respectively.

As of December 31, 2022 and 2021, we had brokered deposits of $115.3 mill ion a nd $22.3 mill ion, respectively.

We have experienced banking and business development teams who we believe provide superior client service, creative cash management solutions and competitive pricing to market our depository products and services.

As of December 31, 2021, total deposits were $2.21 billion, an increase of $585.8 million, or 36.2%, compared to $1.62 billion as of December 31, 2020.

As of December 31, 2022 , total deposits we re $2.41 billion, a n increase of $199.5 million, or 9.0%, compared to $2.21 billion as of December 31, 2021.

As of December 31, 2022 , our deposit portfolio contained a balanced and diverse mix of deposits, as shown below:

8 unchanged sentences

These local teams have personal and professional networks and relationships with centers of influence to market our wealth advisory products and services.

As of December 31, 2021, total AUM was $7.35 billion, an increase of $1.10 billion, or 17.5%, compared to $6.26 billion as of December 31, 2020.

As of December 31, 2022 , total AUM was $6.11 billion , a decrea se of $1.24 billion, or 16.9%, compared to $7.35 billion as of December 31, 2021.

As of December 31, 2022 , we provided fiduciary and advisory services on $6.11 billion of trust and investment management assets, as shown below:

Trust and Investment Management Assets

Our investment management platform combines a broad range of asset and sub asset classes meeting the needs of both taxable and tax-free private client accounts as well as trust investment services.

5 unchanged sentences

Other Products

which include experienced professionals in commercial banking, investment management, wealth planning, risk management/insurance, personal trust, retirement planning and tax-advantaged products, and mortgage lending.

In addition to the traditional loan, deposit and trust and investment management products and services, our profit centers are supported by a central team of specialized product experts in our "product groups," which include experienced professionals in commercial banking, investment management, wealth planning, risk management/insurance, personal trust, retirement planning and tax-advantaged products, and mortgage lending.

We believe that the sophistication of our product groups rivals the offerings and expertise typically provided by larger financial institutions.

5 unchanged sentences

Our mortgage banking loan sales activities are primarily directed at originating single family mortgages that are priced and underwritten to conform to previously agreed criteria before loan funding and are delivered to the investor shortly after funding.

The level of future loan originations, loan sales and loan repayments depends on overall credit availability, the interest rate environment, the strength of the general economy, local real estate markets and the housing industry, and conditions in the secondary loan sale market.

The amount of gain or loss on the sale of loans is primarily driven by market conditions and changes in interest rates, as well as our pricing and asset liability management strategies.

As of December 31, 2021, we had mortgage loans held for sale of $30.6 million in residential mortgage loans we originated.

For the year ended December 31, 2021, we had net proceeds of $1.42 billion on mortgage loans that we originated and sold into the secondary market.

• Treasury Management.

7 unchanged sentences

We offer creative corporate retirement plan design and analysis solutions and fiduciary liability management, providing tools such as corporate retirement plans, and ERISA regulation compliance, education and expertise.

Our associates in our support centers have significant experience in wealth management, investment advisory, and commercial banking, including areas such as lending, underwriting, credit administration, risk management, accounting/finance, operations and information technology.

Our profit centers and product groups are also supported centrally by teams providing management services such as operations, risk management, credit administration, technology support, marketing, human capital and accounting/finance services, which we refer to as "support centers." Our associates in our support centers have significant experience in wealth management, investment advisory, and commercial banking, including areas such as lending, underwriting, credit administration, risk management, accounting/finance, operations and information technology.

We have structured our teams, services and product offerings to use technology to efficiently provide our clients with a high-touch, solution-oriented experience, that we believe is scalable and provides operating leverage for future growth.

9 unchanged sentences

The primary objectives of our Bank portfolio investment policy are to provide a source of liquidity, to provide an appropriate return on funds invested, to manage interest rate risk, to meet pledging requirements and to meet regulatory capital requirements.

As of December 31, 2021, the carrying value of our investment portfolio totaled $56.2 million, with an average yield of 2.5%.

As of December 31, 2022 , the carrying value of our investment portfolio totaled $81.1 million, with an average y ield of 2.8%.

Our investment policy outlines investment type limitations, security mix parameters, authorization guidelines and risk management guidelines.

2 unchanged sentences

Treasury and other U.S.

government agencies, corporate or sponsored entities, including mortgage-backed securities, collateralized mortgage obligations, sub-debt bonds, and mutual funds.

We participate in the Mortgage Partnership Finance Program ("MPF") and are required to maintain an investment in Federal Home Loan Bank of Topeka ("FHLB") stock, which investment is based on the level of our FHLB borrowings.

government agencies, corporate or sponsored entities, including mortgage-backed securities, collateralized mortgage obligations,

subordinated debt bonds, and mutual funds.

Our board of directors has the overall responsibility for the investment portfolio, including approval of our investment policy.

Our Asset and Liability Committee ("ALCO") and management are responsible for implementation of the investment policy and monitoring of our investment performance.

Our ALCO and management review the status of our investment portfolio at least ten times per year.

17 unchanged sentences

We utilize the COSO 2017 ERM Framework to govern the process of anticipating, identifying, assessing, managing, optimizing, and monitoring risks within the organization.

Our Enterprise Risk Management ("ERM") Committee oversees our ERM program.

This group contains key members of management including the Chief Executive Officer and the Chief Financial Officer.

Our Enterprise Risk Management ("ERM") Committee oversees our ERM program.

This group contains key members of management including the Chief Executive Officer and the Chief Operating Officer/Chief Financial Officer.

In order to carry out the ERM program, we have developed the following objectives to:

13 unchanged sentences

Human Capital Overview

As of December 31, 2021, we had 313 associates.

As of December 31, 2022 , we had 365 assoc iates.

We strive to recruit and retain team-oriented, respectful, problem solvers.

1 unchanged sentence

We take advantage of new opportunities, and encourage our team to explore new processes, products, and services to improve First Western.

Associates are our trusted partner both within their teams and with our clients as we build a partnership for generations to come.

Associates are our trusted partners both within their teams and with our clients as we build a partnership for generations to come.

We strive to be a high performing financial institution producing consistent, strong financial results, coming from a well-executed strategy.

It is our belief that this can only be accomplished by a well-run organization of outstanding, motivated, engaged and supported associates.

Internally, we call this a “People First” mind-set and over the last several years have focused on building upon the foundational elements of this strategy.

Those elements include an internally developed manager training program designed to train our managers to be great bosses in support of a culture of learning, collaboration, growth and development.

Providing meaningful work for our associates by connecting their role to the Company’s mission and vision as well as simplifying and streamlining repetitive tasks to make work more interesting and value added.

We are building career paths, development opportunities and accountabilities into each role so that throughout the associates lifecycle there is opportunity to master skills and pursue professional and personal growth.

People First is also about building connection and community with the Company.

We believe the benefits of being part of our Company means you are appreciated and valued, you can build meaningful relationships, and have a sense of mutual accountability.

None of our associates are represented by any collective bargaining unit or are parties to a collective bargaining agreement.

We believe that our strong relationships with our associates are central to establishing the corporate culture we need to serve our clients and our communities well.

We believe that our strong relationships with our associates are central to establishing the corporate culture we need to serve our clients, shareholders, and our communities well.

We are committed to implementing diverse, equitable and, inclusive (DEI) policies and practices across the Company.

5 unchanged sentences

We established six subcommittees devoted to carrying out our goal of fostering a diverse, equitable, and inclusive Company and workforce.

In late 2022 we began the process of redefining our DEI program to

include four action-oriented groups.

Once implemented, the members of each ARG (Associate Resource Group) will work towards moving initiatives forward to meet goals established by leadership.

In addition, we are members of Colorado Inclusive Economy, a business-led non-profit focused on promoting effective DEI initiatives.

3 unchanged sentences

We provide extensive training to our associates in an effort to ensure that our clients receive superior service and that our risks are well managed.

Learning and development opportunities consist of leadership development programs, communication courses, and technical development training (to name a few) as part of our goal to provide associates meaningful work with a sense of mastery, autonomy, and purpose.

Our strategic commitment to learning and development ensures the Company’s leadership and management teams continue to grow at a pace consistent with our financial growth goals.

19 unchanged sentences

Available Information

The Company files reports, proxy statements and other information with the Securities and Exchange Commission ("SEC") under the Securities Exchange Act of 1934, as amended (the "Exchange Act").

Electronic copies of our SEC filings are available to the public at the SEC’s website at https://www.sec.gov.

8 unchanged sentences

Investors should understand that the primary objective of the U.S.

bank regulatory regime is the protection of depositors, the Deposit Insurance Fund ("DIF"), and the banking system as a whole, not the protection of the Company’s shareholders.

As a bank holding company, we are subject to inspection, examination, supervision, and regulation by the Board of Governors of the Federal Reserve System (the "Federal Reserve").

The Bank, which is our subsidiary, is a Colorado-chartered commercial bank and is not a member of the Federal Reserve System (a "state nonmember bank").

As such, the Bank is subject to regulation, supervision, and examination by both the Colorado Division of Banking (the "CDB") and the Federal Deposit Insurance Corporation ("FDIC").

bank regulatory regime is the protection of depositors, the Deposit Insurance Fund ("DIF"), and the banking system as a whole, not the protection of the Company’s shareholders.

As a bank holding company, we are subject to inspection, examination, supervision, and regulation by the Board of Governors of the Federal Reserve System (the "Federal Reserve").

The Bank, which is our subsidiary, is a Colorado-chartered commercial bank and is not a member of the Federal Reserve System (a "state nonmember bank").

As such, the Bank is subject to regulation, supervision, and examination by both the Colorado Division of Banking (the "CDB") and the Federal Deposit Insurance Corporation ("FDIC").

In addition, we expect that any additional businesses that we may invest in or acquire will be regulated by various state and/or federal banking regulators.

11 unchanged sentences

The final rules implementing the Basel Committee on Banking Supervision’s capital guidelines for U.S.

banks ("Basel III Rules") have been fully phased in.

The Basel III Rules require banks and bank holding companies, including the Company and the Bank, to maintain minimum capital amounts and ratios.

These ratios are common equity Tier 1 capital ("CET1"), Tier 1 capital and total capital (as defined in the regulations) to risk-weighted assets (as defined in the regulations), and Tier 1 capital (as defined in the regulations) to average assets (as defined in the regulations).

The final rules of Basel III also established a "capital conservation buffer"

of 2.5% above new regulatory minimum capital ratios, which are fully effective following minimum ratios:

The final rules of Basel III also established a "capital conservation buffer" of 2.5% above new regulatory minimum capital ratios.

The minimum capital ratios inclusive of the capital conservation buffer are as follows:

(i) a CET1 ratio of 7.0%;

9 unchanged sentences

At this time, the bank regulatory agencies are more inclined to impose higher capital requirements to meet well capitalized standards and future regulatory change could impose higher capital standards as a routine matter.

The Company’s regulatory capital ratios and those of the Bank are in excess of the levels established for "well capitalized"

institutions under the rules.

The Company’s regulatory capital ratios and those of the Bank are in excess of the levels established for "well capitalized" institutions under the rules.

The Basel III Capital Rules also set forth certain changes in the methods of calculating certain risk-weighted assets, which in turn affects the calculation of risk-based capital ratios.

3 unchanged sentences

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms (commonly referred to as Basel IV).

such as unused credit card lines of credit) and provides a new standardized approach for operational risk capital.

Among other things, these standards revise the Basel Committee’s standardized approach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain "unconditionally cancellable commitments," such as unused credit card lines of credit) and provides a new standardized approach for operational risk capital.

Under the Basel framework, these standards will generally be effective on January 1, 2023, with an aggregate output floor phasing in through January 1, 2028.

On September 9, 2022, the U.S.

federal banking regulators announced their intent to revise regulatory capital requirements to align them with the regulatory capital standards that were finalized by the Basel Committee in December 2017, however a proposed rule has not yet been issued.

In addition, the U.S.

federal banking regulators stated that Community banking organizations would not be impacted by the proposal.

Under the current U.S.

1 unchanged sentence

The impact of Basel IV on us will depend on the manner in which it is implemented by the federal bank regulators.

In accordance with the Economic Growth, Regulatory Relief, and Consumer Protection Act (the "Regulatory Relief Act"), discussed below, the federal banking agencies published final rules implementing the community bank leverage ratio in November 2019.

Under the final rules, which went into effect on January 1, 2020, depository institutions and depository institution holding companies that have less than $10 billion in total consolidated assets and meet other qualifying criteria, including a leverage capital ratio of greater than 9%, off-balance-sheet exposures of 25% or less of total consolidated assets and trading assets plus trading liabilities of 5% or less of total consolidated assets, are deemed "qualifying community banking organizations"

and are eligible to opt into the community bank leverage ratio framework.

A qualifying community banking organization that elects to use the community bank leverage ratio framework and that maintains a leverage capital ratio of greater than 9% is considered to have satisfied the generally applicable risk-based and leverage capital requirements under the Basel III Capital Rules and, if applicable, is considered to have met the “well capitalized” ratio requirements for purposes of its primary federal regulators prompt corrective action rules, discussed below.

Pursuant to the CARES Act, the federal banking agencies authorities adopted an interim rule, which temporarily reduced the Community Bank Leverage Ratio to 8%.

This provision terminated on December 31, 2020.

The Company and the Bank have not made an election to use the community bank leverage ratio framework but may make such an election in the future if determined to be possible and advantageous.

Regulation of the Company

The Bank Holding Company Act of 1956, as amended ("BHC Act"), and other federal laws subject bank holding companies to particular restrictions on the types of activities in which they may engage, and to a range of supervisory requirements and activities, including regulatory enforcement actions for violations of laws and regulations.

Permitted Activities.

3 unchanged sentences

Under the BHC Act, a bank holding company may file an election with the Federal Reserve to be treated as a financial holding company and engage in an expanded list of financial activities.

The election must be accompanied by a certification that all of the company’s insured depository institution subsidiaries are "well capitalized"

and "well managed."

Additionally, the Community Reinvestment Act of 1977 ("CRA") rating of each subsidiary bank must be satisfactory or better.

The election must be accompanied by a certification that all of the company’s insured depository institution subsidiaries are "well capitalized" and "well managed." Additionally, the Community Reinvestment Act of 1977 ("CRA") rating of each subsidiary bank must be satisfactory or better.

If, after becoming a financial holding company and undertaking activities not permissible for a bank holding company, the company fails to continue to meet any of the prerequisites for financial holding company status, the company must enter into an agreement with the Federal Reserve to comply with all applicable capital and management requirements.

18 unchanged sentences

Acquisitions.

The BHC Act, Section 18(c) of the Federal Deposit Insurance Act, as amended ("FDIA"), the Colorado Banking Code and other federal and state statutes regulate acquisitions of commercial banks and their holding companies.

The BHC Act generally limits acquisitions by bank holding companies to commercial banks and companies engaged in activities that the Federal Reserve has determined to be so closely related to banking as to be a proper incident thereto.

3 unchanged sentences

or (iii) merging or consolidating with any other bank holding company.

In reviewing applications seeking approval of merger and acquisition transactions, the bank regulatory authorities generally consider, among other things, the competitive effect and public benefits of the transactions, the financial and managerial resources and future prospects of the combined organization (including the capital position of the combined organization), the applicant’s performance record under the Community Reinvestment Act, (see the section captioned "Community Reinvestment Act"

included below in this item), fair housing laws and the effectiveness of the subject organizations in combating money laundering activities.

The Company is also subject to the Change in Bank Control Act of 1978 ("Control Act") and related Federal Reserve regulations, which provide that any person who proposes to acquire at least 10% (but less than 25%) of any class of a bank holding company’s voting securities is presumed to control the company (unless the company is not publicly held or some other shareholder owns a greater percentage of voting stock).

Any person who would be presumed to acquire control or who proposes to acquire control of 25% or more of any class of a bank holding company’s voting securities, or who proposes to acquire actual control, must provide the Federal Reserve with at least 60 days’ prior written notice of the acquisition.

5 unchanged sentences

Any proposed acquisition of the voting securities of a bank holding company that is subject to approval under the BHC Act is not subject to the Control Act notice requirements.

Any company that proposes to acquire "control,"

as those terms are defined in the BHC Act and Federal Reserve regulations, of a bank holding company or to acquire 25% or more of any class of voting securities of a bank holding company would be required to seek the Federal Reserve’s prior approval under the BHC Act to become a bank holding company.

Any company that proposes to acquire "control," as those terms are defined in the BHC Act and Federal Reserve regulations, of a bank holding company or to acquire 25% or more of any class of voting securities of a bank holding company would be required to seek the Federal Reserve’s prior approval under the BHC Act to become a bank holding company.

The Company’s earnings and activities are affected by legislation, by regulations and by local legislative and administrative bodies and decisions of courts in the jurisdictions in which we conduct business.

9 unchanged sentences

In 2009, the Federal Reserve issued a supervisory letter providing greater clarity to its policy statement on the payment of dividends by bank holding companies.

In this letter, the Federal Reserve stated that when a holding company’s board of directors is deciding on the level of dividends to declare, it should consider, among other factors:

In this letter, the Federal Reserve stated that when a holding company’s

board of directors is deciding on the level of dividends to declare, it should consider, among other factors:

(i) overall asset quality, potential need to increase reserves and write down assets, and concentrations of credit;

6 unchanged sentences

(viii) level, composition, and quality of capital;

and (ix) ability to raise additional equity capital in prevailing market and economic conditions (the "Dividend Factors").

It is particularly important for a bank holding company’s board of directors to ensure that the dividend level is prudent relative to the organization’s financial position and is not based on overly optimistic earnings scenarios.

9 unchanged sentences

It is an essential principle of safety and soundness that a banking organization’s redemption and repurchases of regulatory capital instruments, including common stock, from investors be consistent with the organization’s current and prospective capital needs.

In assessing such needs, the board of directors and management of a bank holding company should consider the Dividend Factors discussed above under "Dividends."

The risk-based capital rule directs bank holding companies to consult with the Federal Reserve before redeeming any equity or other capital instrument included in Tier 1 or Tier 2 capital prior to stated maturity, if such redemption could have a material effect on the level or composition of the organization’s capital base.

In assessing such needs, the board of directors and management of a bank holding company should consider the Dividend Factors discussed above under "Dividends." The risk-based capital rule directs bank holding companies to consult with the Federal Reserve before redeeming any equity or other capital instrument included in Tier 1 or Tier 2 capital prior to stated maturity, if such redemption could have a material effect on the level or composition of the organization’s capital base.

Bank holding companies that are experiencing financial weaknesses, or that are at significant risk of developing financial weaknesses, must consult with the appropriate Federal Reserve supervisory staff before redeeming or repurchasing common stock or other regulatory capital instruments for cash or other valuable consideration.

12 unchanged sentences

Imposition of Liability for Undercapitalized Subsidiaries.

FDIA requires bank regulators to take "prompt corrective action"

to resolve problems associated with insured depository institutions.

In the event an institution becomes "undercapitalized,"

it must submit a capital restoration plan.

The capital restoration plan will not be accepted by the regulators unless each company "having control of"

the undercapitalized institution "guarantees"

the subsidiary’s compliance with the capital restoration plan until it becomes "adequately capitalized."

For purposes of this statute, the Company has control of the Bank.

FDIA requires bank regulators to take "prompt corrective action" to resolve problems associated with insured depository institutions.

In the event an institution becomes "undercapitalized," it must submit a capital restoration plan.

The capital restoration plan will not be accepted by the regulators unless each company "having control of" the undercapitalized institution "guarantees" the subsidiary’s compliance with the capital restoration plan until it becomes "adequately capitalized." For purposes of this statute, the Company has control of the Bank.

Under FDIA, the aggregate liability of all companies controlling a particular institution is limited to the lesser of five percent of the depository institution’s total assets at the time it became undercapitalized or the amount necessary to bring the institution into compliance with applicable capital standards.

FDIA grants greater powers to bank regulators in situations where an institution becomes "significantly"

or "critically"

undercapitalized or fails to submit a capital restoration plan.

FDIA grants greater powers to bank regulators in situations where an institution becomes "significantly" or "critically" undercapitalized or fails to submit a capital restoration plan.

For example, a bank holding company controlling such an institution can be required to obtain prior Federal Reserve approval of proposed distributions, or might be required to consent to a merger or to divest the troubled institution or other affiliates.

9 unchanged sentences

Under the Basel III Capital Rules, discussed above, the FDIC monitors the capital adequacy of the Bank by using a combination of risk-based guidelines and leverage ratios.

The FDIC considers the Bank’s capital levels when taking action on various types of applications and when conducting supervisory activities related to the safety and soundness of the Bank and the banking system.

The FDIC considers the Bank’s capital levels when acting on various types of applications and when conducting supervisory activities related to the safety and soundness of the Bank and the banking system.

Higher capital levels may be required if warranted by the circumstances or risk profiles of individual institutions, or if required by the banking regulators due to the economic conditions impacting our markets.

2 unchanged sentences

Prompt Corrective Regulatory Action.

Under applicable federal statutes, the federal bank regulatory agencies are required to take "prompt corrective action"

with respect to institutions that do not meet specified minimum capital requirements.

Under applicable federal statutes, the federal bank regulatory agencies are required to take "prompt corrective action" with respect to institutions that do not meet specified minimum capital requirements.

For these purposes, the law establishes five capital categories:

well capitalized, adequately capitalized, undercapitalized, significantly undercapitalized, and critically undercapitalized.

Under the FDIC’s prompt corrective action regulations, an institution is deemed to be "well capitalized"

if it has a total risk-based capital ratio of 10.0% or greater, a Tier 1 risk-based capital ratio of 8.0% or greater, a CET1 risk-based capital ratio of 6.5% or greater and a leverage capital ratio of 5.0% or greater.

An institution is "adequately capitalized"

if it has a total risk-based capital ratio of 8.0% or greater, a Tier 1 risk-based capital ratio of 6.0% or greater, a CET1 risk-based capital ratio of 4.5% or greater and a leverage capital ratio of 4.0% or greater.

An institution is "undercapitalized"

if it has a total risk-based capital ratio of less than 8.0%, a Tier 1 risk-based capital ratio of less than 6.0%, a CET1 risk-based capital ratio of less than 4.5% or a leverage capital ratio of less than 4.0%.

An institution is deemed to be "significantly undercapitalized"

if it has a total risk-based capital ratio of less than 6.0%, a Tier 1 risk-based capital ratio of less than 4.0%, a CET1 capital ratio of less than 3.0% or a leverage capital ratio of less than 3.0%.

An institution is considered to be "critically undercapitalized"

if it has a ratio of tangible equity to total assets that is equal to or less than 2.0%.

Under the FDIC’s prompt corrective action regulations, an institution is deemed to be "well capitalized" if it has a total risk-based capital ratio of 10.0% or greater, a Tier 1 risk-based capital ratio of 8.0% or greater, a CET1 risk-based capital ratio of 6.5% or greater and a leverage capital ratio of 5.0% or greater.

An institution is "adequately capitalized" if it has a total risk-based capital ratio of 8.0% or greater, a Tier 1 risk-based capital ratio of 6.0% or greater, a CET1 risk-based capital ratio of 4.5% or greater and a leverage capital ratio of 4.0% or greater.

An institution is "undercapitalized" if it has a total risk-based capital ratio of less than 8.0%, a Tier 1 risk-based capital ratio of less than 6.0%, a CET1 risk-based capital ratio of less than 4.5% or a leverage capital ratio of less than 4.0%.

An institution is deemed to be "significantly undercapitalized" if it has a total risk-based capital ratio of less than 6.0%, a Tier 1 risk-based capital ratio of less than 4.0%, a CET1 capital ratio of less than 3.0% or a leverage capital ratio of less than 3.0%.

An institution is considered to be "critically undercapitalized" if it has a ratio of tangible equity to total assets that is equal to or less than 2.0%.

Undercapitalized institutions are subject to growth limitations and are required to submit a capital restoration plan to the FDIC.

1 unchanged sentence

In addition, for a capital restoration plan to be acceptable, the depository institution’s parent holding company must guarantee that the institution will comply with such capital restoration plan.

If a depository institution fails to submit an acceptable plan, it is treated as if it is "significantly undercapitalized."

"Significantly undercapitalized"

depository institutions may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become "adequately capitalized,"

requirements to reduce total assets, and cessation of receipt of deposits from correspondent banks.

"Critically undercapitalized"

institutions are subject to the appointment of a receiver or conservator.

As of December 31, 2021, the Bank qualified as "well capitalized"

under the prompt corrective action rules.

If a depository institution fails to submit an acceptable

plan, it is treated as if it is "significantly undercapitalized." "Significantly undercapitalized" depository institutions may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become "adequately capitalized," requirements to reduce total assets, and cessation of receipt of deposits from correspondent banks.

"Critically undercapitalized" institutions are subject to the appointment of a receiver or conservator.

As of December 31, 2022 , the Bank qualified as "well capitalized" under the prompt corrective action rules.

Deposit Insurance Assessments.

7 unchanged sentences

Depositor Preference.

FDIA provides that, in the event of the "liquidation or other resolution"

of an insured depository institution, the claims of depositors of the institution, including the claims of the FDIC as subrogee of insured depositors, and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution.

FDIA provides that, in the event of the "liquidation or other resolution" of an insured depository institution, the claims of depositors of the institution, including the claims of the FDIC as subrogee of insured depositors, and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution.

If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors, including the parent bank holding company, with respect to any extensions of credit they have made to such insured depository institution.

6 unchanged sentences

Failure to comply with consumer protection requirements may also result in our failure to obtain any required bank regulatory approval for merger or acquisition transactions the Company may want to pursue or our prohibition from engaging in such transactions even if approval is not required.

The Consumer Financial Protection Bureau ("CFPB") has broad rulemaking authority for a wide range of consumer financial laws that apply to all banks.

The CFPB is authorized to issue rules for both bank and non-bank companies that offer consumer financial products and services, subject to consultation with the prudential banking regulators.

3 unchanged sentences

The CFPB has been particularly active in issuing rules and guidelines concerning residential mortgage lending and servicing, issuing numerous rules and guidance related to residential mortgages.

Perhaps the most significant of these guidelines is the "Ability-to-Repay and Qualified Mortgage Standards under the Truth in Lending Act"

portions of Regulation Z.

Under the Dodd-Frank Act, creditors must make a reasonable and good faith determination, based on verified and documented information, that the consumer has a reasonable "ability to repay"

a residential mortgage according to its terms.

There is a statutory presumption of compliance with this requirement for mortgages that meet the requirements to be deemed "qualified mortgages."

The CFPB rule defines the key threshold terms "ability to repay"

and "qualified mortgage."

Perhaps the most significant of these guidelines is the "Ability-to-Repay and Qualified Mortgage Standards under the Truth in Lending Act" portions of

Regulation Z.

Under the Dodd-Frank Act, creditors must make a reasonable and good faith determination, based on verified and documented information, that the consumer has a reasonable "ability to repay" a residential mortgage according to its terms.

There is a statutory presumption of compliance with this requirement for mortgages that meet the requirements to be deemed "qualified mortgages." The CFPB rule defines the key threshold terms "ability to repay" and "qualified mortgage."

The CFPB has actively issued enforcement actions against both large and small entities and to entities across the entire financial service industry.

The CFPB has relied upon "unfair, deceptive, or abusive acts"

prohibitions as its primary enforcement tool.

However, the CFPB and Department of Justice ("DOJ") continue to be focused on fair lending in taking enforcement actions against banks with renewed emphasis on alleged "redlining"

The CFPB has relied upon "unfair, deceptive, or abusive acts" prohibitions as its primary enforcement tool.

However, the CFPB and Department of Justice ("DOJ") continue to be focused on fair lending in taking enforcement actions against banks with renewed emphasis on alleged "redlining" practices.

Failure to comply with these laws and regulations could give rise to regulatory sanctions, client rescission rights, actions by state and local attorneys general and civil or criminal liability.

5 unchanged sentences

The regulators examine banks and assign each bank a public CRA rating.

The CRA then requires bank regulators to take into account the bank’s record in meeting the needs of its community when considering certain applications by a bank, including applications to establish a banking center or to conduct certain mergers or acquisitions.

The CRA then requires bank regulators to consider the bank's record in meeting the needs of its community when considering certain applications by a bank, including applications to establish a banking center or to conduct certain mergers or acquisitions.

The Federal Reserve is required to consider the CRA records of a bank holding company’s controlled banks when considering an application by the bank holding company to acquire a bank or to merge with another bank holding company.

7 unchanged sentences

Safety and Soundness Standards.

Under the FDIC Improvement Act ("FDICIA"), each federal banking agency has prescribed, by regulation, non-capital safety and soundness standards for institutions under its authority.

These standards cover internal controls, information and internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, compensation, fees and benefits, such other operational and managerial standards as the agency determines to be appropriate, and standards for asset quality, earnings, and stock valuation.

2 unchanged sentences

Financial Privacy.

In accordance with the Gramm-Leach-Bliley Act of 1999 (the "GLB Act"), federal banking regulators adopted rules that limit the ability of banks and other financial institutions to disclose nonpublic information about consumers to nonaffiliated third parties.

These rules require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a nonaffiliated third party.

1 unchanged sentence

Anti-Money Laundering.

Under federal law, including the Bank Secrecy Act and Title III of the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (the "USA PATRIOT Act"), certain types of financial institutions, including insured depository institutions, must maintain anti-money laundering programs that include established internal policies, procedures and controls;

a designated compliance officer;

5 unchanged sentences

Bank regulators routinely examine institutions for compliance with these obligations and they must consider an institution’s anti-money laundering compliance when considering regulatory applications filed by the institution, including applications for banking mergers and acquisitions.

The regulatory authorities have imposed "cease and desist"

orders and civil money penalty sanctions against institutions found to be violating these obligations.

The regulatory authorities have imposed "cease and desist" orders and civil money penalty sanctions against institutions found to be violating these obligations.

Office of Foreign Assets Control Regulation.

The United States has imposed economic sanctions that affect transactions with designated foreign countries, foreign nationals, and others.

These are typically known as the "OFAC"

rules based on their administration by the U.S.

Department of the Treasury Office of Foreign Assets Control ("OFAC").

These are typically known as the "OFAC" rules based on their administration by the U.S.

Department of the Treasury Office of Foreign Assets Control ("OFAC").

The OFAC-administered sanctions targeting countries take many different forms.

Generally, however, they contain one or more of the following elements:

(i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on "U.S.

persons"

engaging in financial transactions relating to making investments in, or providing investment-related advice or assistance to, a sanctioned country;

(i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on "U.S.

persons" engaging in financial transactions relating to making investments in, or providing investment-related advice or assistance to, a sanctioned country;

and (ii) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S.

5 unchanged sentences

Transactions between depository institutions and their affiliates, including transactions between the Bank and the Company, are governed by Sections 23A and 23B of the Federal Reserve Act and the Federal Reserve’s Regulation W promulgated thereunder.

Generally, Section 23A limits the extent to which a depository institution and its subsidiaries may engage in "covered transactions"

with any one affiliate to an amount equal to 10% of the depository institution’s capital stock and surplus, and contains an aggregate limit on all such transactions with all affiliates of an amount equal to 20% of the depository institution’s capital stock and surplus.

Generally, Section 23A limits the extent to which a depository institution and its subsidiaries may engage in "covered transactions" with any one affiliate to an amount equal to 10% of the depository institution’s capital stock and surplus and contains an aggregate limit on all such transactions with all affiliates of an amount equal to 20% of the depository institution’s capital stock and surplus.

Section 23A also establishes specific collateral requirements for loans or extensions of credit to, or guarantees, acceptances or letters of credit issued on behalf of, an affiliate.

1 unchanged sentence

The Volcker Rule

Section 619 of the Dodd-Frank Act, commonly known as the "Volcker Rule,"

generally prohibits certain banking entities from engaging in short-term proprietary trading of financial instruments and from owning, sponsoring or having certain relationships with hedge funds or private equity funds (collectively, "covered funds").

Section 619 of the Dodd-Frank Act, commonly known as the "Volcker Rule," generally prohibits certain banking entities from engaging in short-term proprietary trading of financial instruments and from owning, sponsoring or having certain relationships with hedge funds or private equity funds (collectively, "covered funds").

The Regulatory Relief Act, discussed below, includes a provision exempting banking organizations with $10 billion or less in total consolidation assets, and total trading assets and trading liabilities that are 5% or less of total consolidated assets, from the Volcker Rule.

4 unchanged sentences

The guidelines are designed to promote appropriate levels of capital and sound loan and risk management practices for institutions with a concentration of CRE loans.

The Company’s CRE concentrations are discussed in the "Risk Factors"

section below.

The Company’s CRE concentrations are discussed in the "Risk Factors" section below.

Interstate Banking and Branching

Under the Riegle-Neal Interstate Banking and Branching Efficiency Act of 1999 (the "Riegle-Neal Act"), a bank holding company may acquire banks in states other than its home state, subject to any state requirement that the bank has been organized and operating for a minimum period of time, not to exceed five years, and to certain deposit market-share limitations.

Bank holding companies must be well capitalized and well managed, not merely adequately capitalized and adequately managed, in order to acquire a bank located outside of the bank holding company’s home state.

2 unchanged sentences

The branch must also be approved by the FDIC.

The approval process takes into account a number of factors, including financial history, capital adequacy, earnings prospects, character of management, needs of the community and consistency with corporate powers.

The approval process considers a number of factors, including financial history, capital adequacy, earnings prospects, character of management, needs of the community and consistency with corporate powers.

The Dodd-Frank Act permits a national or state bank, with the approval of its regulator, to open a de novo branch in any state if the law of the state in which the branch is proposed would permit the establishment of the branch if the bank was charted in such state.

5 unchanged sentences

For institutions with at least $1 billion but less than $50 billion in total consolidated assets, the proposal would impose principles-based restrictions that are broadly consistent with existing interagency guidance on incentive-based compensation.

with excessive compensation, fees or benefits, or (ii) that could lead to material financial loss to the institution.

Such institutions would be prohibited from entering into incentive compensation arrangements that encourage inappropriate risks by the institution (i) by providing an executive officer, employee, director, principal shareholder, or individuals who are "significant risk takers" with excessive compensation, fees, or benefits, or (ii) that could lead to material financial loss to the institution.

The comment period for these proposed regulations has closed, but a final rule has not been published.

1 unchanged sentence

Cybersecurity

In March 2015, the Federal Financial Institutions Examination Council ("FFIEC") issued two related statements regarding cybersecurity.

One statement indicates that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution.

The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity management planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack involving destructive malware.

The Federal Financial Institutions Examination Council ("FFIEC") requires financial institutions to design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution.

Further, a financial institution’s management is expected to maintain sufficient business continuity management planning processes to ensure the rapid recovery, resumption, and maintenance of the institution’s operations after a cyber-attack involving destructive malware.

A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack.

If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.

In June 2016, the FDIC introduced its Information Technology Risk Examination (InTREx) Program based on the Uniform Rating System for Information Technology (URSIT) and includes core modules for Audit, Management, Development and Acquisition, and Support and Delivery component ratings.

In November 2019, the FFIEC also released updated examination procedures regarding overall business continuity management ("BCM").

The new BCM release focuses on enterprise-wide approaches that address technology, business operations, testing, and communication strategies critical to the continuity of the business.

The BCM procedures describe principles and practices for information technology ("IT") and operations designed to achieve safety and soundness, consumer financial protection, and compliance with applicable laws, regulations, and rules.

Additionally, the FDIC's Information Technology Risk Examination (InTREx) Program, based on the Uniform Rating System for Information Technology (URSIT), includes core modules for Audit, Management, Development and Acquisition, and Support and Delivery component ratings.

If we fail to remain compliant with changing components of this regulation, we could be subject to various regulatory sanctions, including financial penalties.

The FFIEC's examination procedures regarding overall business continuity management ("BCM") focus on enterprise-wide approaches that address technology, business operations, testing, and communication strategies critical to the continuity of the business.

laws, regulations, and rules.

Continued testing, training, and program updates ensure appropriate response to cyber and non-cyber, human and non-human disaster events.

The Company had a robust pandemic plan at the time of COVID-19, which covered similar disaster events and included detailed preparation, training and testing that had been conducted over multiple years prior to COVID-19.

While we are compliant with BCM measures, the scope and severity of cyber and non-cyber, human, and non-human disaster events is unpredictable.

The Company has a robust pandemic plan, which covers disaster events similar to COVID-19 and includes detailed preparation, training, and testing that have been conducted over multiple years prior to COVID-19.

This preparation includes a comprehensive, annual Business Impact Analysis.

As such, the Company was poised to react successfully to the pandemic event.

As such, the Company remains poised to react to a pandemic event;

however, future pandemic strains may be unpredictable in scope and severity of impact.

The Federal Trade Commission's (FTC) Safeguard's Rule was updated effective January 2022.

The safeguard provision of the FTC's Gramm-Leach Bliley Act (GLBA) requires the Bank to take steps to protect their clients' information.

The law requires the Bank to create a written information security plan that outlines its strategy for protecting customer/client information.

The Bank must have reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of client information.

The security measures must be commensurate with its size, scope of activities, sensitivity of the information in question, and the risk of data loss.

While we are compliant with the FTC Safeguard's Rule, unforeseen risks and threats could challenge the strategy for protecting such information and the controls in place.

Cloud Adoption

Treasury Department Office of Cybersecurity and Critical Infrastructure Protection (OCCIP) released a report on the current landscape of cloud adoption in December 2022.

The report noted that financial institutions of all sizes are increasingly viewing cloud services as an important component of their technology program.

The COVID-19 pandemic accelerated consumer demand for innovative offerings via digital channels, financial institution demand to accommodate remote work, and vendors favoring cloud-based offerings are all driving the trend in cloud adoption.

Many larger financial institutions plan to adopt a hybrid model which includes both public and private cloud services and to have their own data centers.

Significant benefits such as redundancy, scalability, and security are supporting cloud adoption.

Six main challenges were noted by the OCCIP, for greater adoption of cloud by financial institutions:

transparency in conducting due diligence on Cloud Service Providers (CSPs);

gaps in expertise and tools as the growth of cloud service utilization outpaces the talent pool of technologists as well as the capability of financial institutions to validate rapid technological updates;

Exposure to potential operational incidents originating from CSPs;

Potential impact of market concentration in cloud service offerings on the financial services sector’s ability to be resilient against a large system failure or data breach which could impact multiple financial institutions and their customers;

the dynamics of smaller institutions being at a disadvantage in securing preferred contract terms given the current market concentration;

The increasingly complex and diverse global landscape for cloud services providers and users to be compliant and to also be able to weather operational challenges with inconsistent regulatory frameworks.

Despite the challenges noted by the OCCIP, the Treasury Department intends to be guided by its Strategic Vision for Supporting the Resilience of the Financial Sector’s Use of Cloud Services and will address issues that could impact operational resilience of the financial institution sector.

The Company is currently exploring adoption of a Zero Trust Network Architecture and related cloud security infrastructure to support its migration to the cloud.

Despite extensive due diligence with our technology and security advisors and the known benefits of cloud adoption, unforeseen risks and threats in cyberspace continue to evolve to challenge our cybersecurity controls.

Anti-Money Laundering Act of 2020

7 unchanged sentences

Some of the key requirements of the AML Act requires FinCEN to:

(1) establish standards for the reporting of information on beneficial ownership, build an IT system to collect and secure the data, and create access protocols;

(1) establish standards for the reporting of information on beneficial ownership, build an IT system to collect

and secure the data, and create access protocols;

(2) establish national anti-money laundering and countering the financing of terrorism priorities;

16 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business