What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-02-27 compared with 2025-03-07 · 52 added, 72 removed, 500 unchanged (20% of the section changed)

11 unchanged sentences

– Geographic concentration in Colorado, Arizona, Wyoming, Montana, and California.

– The soundness of other financial institutions could adversely affect us.

– Negative changes in the economy affecting real estate values and liquidity could impair the value of collateral securing our real estate loans and result in loan and other losses.

2 unchanged sentences

– Our commercial loan portfolio involves risks specific to commercial borrowers.

– Fraud, breaches of our information security, and cybersecurity attacks could adversely affect us.

– We rely on communications, information, operating, and financial control systems technology and related services from third-party service providers, including reliance on cloud-based vendors, and we may suffer an interruption in those systems.

– We may be subject to claims and litigation pertaining to our fiduciary responsibilities.

– Negative developments affecting the banking industry and resulting media coverage have eroded customer confidence in the banking system.

– We may be adversely affected by the soundness of certain securities brokerage firms.

9 unchanged sentences

– We receive substantial deposits and assets under management as a result of referrals by professionals, such as attorneys, accountants, and doctors, and such referrals are dependent upon the continued positive interaction with and financial health of those referral sources.

– Our largest trust client accounts for 37.8% of our total assets under management.

– Our largest trust client accounts for 36.8% of our total assets under management and 4.6% of our total Trust and investment management fees.

– The success of our business depends on achieving our strategic objectives, including through acquisitions which may not increase our profitability and may adversely affect our future operating results.

3 unchanged sentences

– We are required to make significant estimates and assumptions in the preparation of our financial statements and our estimates and assumptions may not be accurate.

– Fraud, breaches of our information security, and cybersecurity attacks could adversely affect us.

– We rely on communications, information, operating and financial control systems technology and related services from third-party service providers and we may suffer an interruption in those systems.

– Our ability to attract and retain clients and key associates could be adversely affected if our reputation is harmed.

2 unchanged sentences

– We rely on customer and counterparty information, which subjects us to risks if that information is not accurate or is incomplete.

– A future pandemic, epidemic, or highly contagious disease could adversely impact our business and financial results.

– Severe weather, natural disasters, acts of war or terrorism, pandemics, and other adverse external events could significantly impact our business and customers.

– Unstable global economic conditions may have serious adverse consequences on our business, financial condition, and operations.

32 unchanged sentences

A prolonged period of low oil prices could have a material adverse effect on our results of operations and financial condition.

The soundness of other financial institutions could adversely affect us.

The lack of soundness of other financial institutions or financial market utilities may adversely affect the Company.

The Company’s ability to engage in routine funding and other transactions could be adversely affected by the actions and commercial soundness of other financial institutions.

Financial institutions are interdependent because of trading, clearing, counterparty or other relationships.

Defaults by, or rumors or questions about, one or more financial institutions or financial market utilities, or the financial services industry generally, may lead to market-wide liquidity problems and losses of client, creditor and counterparty confidence and could lead to losses or defaults by other financial institutions, or the Company.

Bank failures in 2023 caused general uncertainty regarding the adequacy of liquidity of banks, in particular regional banks, which in turn generated significant market volatility among publicly traded bank holding companies.

Although we were not directly impacted by these bank failures, the resulting speed and with which news, including social media outlets, led depositors to withdraw or attempt to withdraw funds from these and other financial institutions, as well as the volatile impact to stock prices, could have a material effect on the Company’s operations.

Because a significant portion of our loan portfolio is comprised of real estate loans, negative changes in the economy affecting real estate values and liquidity could impair the value of collateral securing our real estate loans and result in loan and other losses.

49 unchanged sentences

If our primary market areas experience an economic slowdown, these loans represent higher risk and could result in material increase in our provision for loans charged off and could require us to significantly increase our allowance for credit losses, which could have a material adverse impact on our business, financial condition, results of operations, and cash flows.

The occurrence of fraudulent activity, breaches of our information security, and cybersecurity attacks could adversely affect our ability to conduct our business, manage our exposure to risk or expand our businesses, result in the disclosure or misuse of confidential or proprietary information, increase our costs to maintain and update our operational and security systems and infrastructure, and adversely impact our results of operations, liquidity and financial condition, as well as cause legal or reputational harm.

As a financial institution, we are susceptible to fraudulent activity, information security breaches and cybersecurity-related incidents that may be committed against us, our clients, or third parties with whom we interact and that may result in financial losses or increased costs to us or our clients, disclosure or misuse of confidential information belonging to us or personal or confidential information belonging to our clients, misappropriation of assets, litigation, or damage to our reputation.

Our industry has seen increases in electronic fraudulent activity, hacking, security breaches, sophisticated social engineering and cyber-attacks within the financial services industry, including in the commercial banking sector, as cyber-criminals have been targeting commercial bank and brokerage accounts on an increasing basis.

Our business is highly dependent on the security and efficacy of our infrastructure, computer and data management systems, as well as those of third parties with whom we interact or on whom we rely.

Our business relies on the secure processing, transmission, storage and retrieval of confidential, proprietary and other information in our computer and data management systems and networks, and in the computer and data management systems and networks of third parties.

In addition, to access our network, products and services, our clients and other third parties may use personal mobile devices or computing devices that are outside of our network environment and are subject to their own cybersecurity risks.

All of these factors increase our risks related to cyber-threats and electronic disruptions.

In addition to well-known risks related to fraudulent activity, which take many forms, such as check "kiting" or fraud, wire fraud, and other dishonest acts, cybersecurity and privacy considerations could impact the Company's business .

In the current environment, there are numerous and evolving risks to cybersecurity and privacy, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, employee malfeasance, and human or technological error.

Computer hackers and others routinely attempt to breach the security of technology products, services and systems to fraudulently induce associates, clients, and other third parties to disclose information or unwittingly provide access to systems or data.

The risk of such attacks to the Company includes attempted breaches not only of our own products, services, and systems, but also those of clients, contractors, business partners, vendors, and other third parties.

The Company's products, services, and systems may be used in critical Company, client, or third-party operations, or involve the storage, processing, and transmission of sensitive data, including valuable intellectual property, other proprietary or confidential data, regulated data, and personal information of associates, clients, and others.

Successful breaches, associate malfeasance, or human or technological error could result in, for example, unauthorized access to, disclosure, modification, misuse, loss, or destruction of Company, client, or other third party data or systems;

theft of sensitive, regulated, or confidential data including personal information and intellectual property;

the loss of access to critical data or systems through ransomware, destructive attacks, or other means;

and business delays, service or system disruptions, or denials of service.

In the event of such actions, the Company, its clients, and other third parties could be exposed to potential liability, litigation, and regulatory or other government action, as well as the loss of existing or potential customers, damage to brand and reputation, and other financial loss.

In addition, the cost and operational consequences of responding to breaches and implementing remediation measures could be significant.

The Company also experiences and responds to cybersecurity threats.

Although we have not experienced a material cybersecurity event to date, there is no assurance that there will not be a cybersecurity attack resulting in material adverse effect in the future.

As the Company's business and the cybersecurity landscape evolve, the Company may also find it necessary to make significant further investments to protect data and infrastructure, such as cloud technology, which may have further risks.

In addition, the fast-paced, evolving, pervasive, and sophisticated nature of certain cyber threats and vulnerabilities, as well as the scale and complexity of the business and infrastructure, make it possible that certain threats or vulnerabilities will be undetected or unmitigated in time to prevent an attack on the Company and its clients.

Cybersecurity risk to the Company and its clients will also depend on factors such as actions, practices, and investments of clients, contractors, business partners, vendors, and other third parties.

Cyber-attacks or other catastrophic events resulting in disruptions to or failures in power, information technology, communication systems, or other critical infrastructure could result in interruptions or delays to Company, client, or other third party operations or services, financial loss, injury to persons or property, potential liability, and damage to brand and reputation.

Although the Company takes significant steps to mitigate cybersecurity risk across a range of functions, such measures can never eliminate the risk entirely or provide absolute security.

We rely on communications, information, operating and financial control systems technology and related services from third-party service providers, including reliance on cloud-based vendors, and we may suffer an interruption in those systems.

We also face indirect technology, cybersecurity and operational risks relating to the third parties with whom we do business or upon whom we rely to facilitate or enable our business activities.

In addition to clients, the third parties with whom we interact and upon whom we rely include financial counterparties;

financial intermediaries such as clearing agents, exchanges and clearing houses;

vendors including providers of cloud-based technology solutions and outsourced data hosting or processing services;

providers of critical infrastructure such as internet access and electrical power;

and other parties for whom we process transactions.

Each of these third parties faces the risk of cyber-attack, information breach or loss, or technology failure.

Any such cyber-attack, information breach or loss, or technology failure of a third party could, among other things, adversely affect our ability to effect transactions, service our clients, manage our exposure to risk or expand our businesses.

Additionally, interruptions in service and security breaches could damage our reputation, lead existing clients to terminate their business relationships with us, make it more difficult for us to attract new clients and subject us to additional regulatory scrutiny and possibly financial liability, any of which could have a material adverse effect on our business, financial condition, results of operations and prospects.

We may be subject to claims and litigation pertaining to our fiduciary responsibilities.

3 unchanged sentences

Either of these results may adversely impact demand for our products and services or otherwise have a material adverse effect on our business, financial condition or results of operations.

Negative developments affecting the banking industry and resulting media coverage have eroded customer confidence in the banking system.

Any future bank failures or similar events adversely affecting the banking industry may negatively impact customer confidence in the safety and soundness of regional banks and may generate market volatility among publicly traded bank holding companies and, in particular, regional banks like the Company.

As a result, customers may choose to maintain deposits with larger financial institutions or invest in higher yielding short-term fixed income securities, all of which could materially adversely impact the Company's liquidity, loan funding capacity, net interest margin, capital, and results of operations.

While the Department of the Treasury, the Federal Reserve, and the FDIC historically have taken action to ensure that depositors of failed banks had access to their deposits, including uninsured deposit accounts, there is no guarantee that regional bank failures or bank runs will not occur in the future and, if they were to occur, they may have a material and adverse impact on customer and investor confidence in regional banks negatively impacting the Company's liquidity, capital, results of operations, and stock price.

We may be adversely affected by the soundness of certain securities brokerage firms.

99 unchanged sentences

Further, if the economy in the geographic areas that we serve is negatively impacted, the amount of deposits and services that these professional individuals will utilize and the amount of referrals that they will make may decrease, which may have a material and adverse impact on our business, financial condition or results of operations.

Our largest trust client accounts for 37.8% of our total assets under management.

As of December 31, 2024, our largest trust client accounted for, in the aggregate, 37.8% of our total assets under management and 3.8% of our non-interest income.

Our largest trust client accounts for 36.8% of our total assets under management and 4.6% of our total Trust and investment management fees.

As of December 31, 2025, our largest trust client accounted for, in the aggregate, 36.8% of our total assets under management and 4.6% of our total Trust and investment management fees.

As a result, a material decrease in the volume of those trust assets by that client could materially reduce our assets under management, which would adversely affect our non-interest income and, therefore, our results of operations.

The success of our business depends on achieving our strategic objectives, including through acquisitions which may not increase our profitability and may adversely affect our future operating results.

Since we commence d our banking business in 2004, we have grown our banking franchise and now have twenty locations in Colorado, Arizona, Wyoming, Montana, and California including a centralized operations center in downtown Denver.

Since we commence d our banking business in 2004, we have grown our banking franchise and now have nineteen locations in Colorado, Arizona, Wyoming, Montana, and California including a centralized operations center in downtown Denver.

We plan to continue to grow our banking business both organically and through acquisitions of other banks and financial service providers, which may include entry into new markets.

44 unchanged sentences

If our underlying estimates and assumptions prove to be incorrect, our financial condition and results of operations may be materially adversely affected.

Additionally, the adoption of CECL methodology for determining our allowance for credit losses in 2023 has increased the complexity, and associated risk, of the analysis and processes relying on management judgment.