What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-03-28 compared with 2024-03-29 · 109 added, 87 removed, 675 unchanged (23% of the section changed)

9 unchanged sentences

Risks Related to Our Business

• Decline in general business and economic conditions

• Interruptions, cyber-attacks, fraudulent activity

• Rapid technological developments

• Adverse economic conditions in Asia, particularly South Korea

• Fluctuations in interest rates

• Monetary Policy and the Federal Reserve

• Fluctuations in interest rates

• Losses on our securities portfolio, particularly from increases in interest rates

• Liquidity risks

• Decline in general business and economic conditions

Risks Related to Our Loans

68 unchanged sentences

acts of terrorism or wars or other catastrophic events;

breaches, physical break-ins or errors resulting in interruptions and unauthorized disclosure of

confidential information, through information security and business continuity programs.

breaches, physical break-ins or errors resulting in interruptions and unauthorized disclosure of confidential information, through information security and business continuity programs.

Notwithstanding, our facilities and systems are vulnerable to interruptions, external or internal security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming or human errors, force majeure events, or other similar events.

6 unchanged sentences

While we have policies and procedures designed to prevent such losses, there can be no assurance that such losses will not occur.

We are not able to anticipate or implement effective preventive measures against all security breaches of these types, especially because the techniques used change frequently and because attacks can originate from a wide variety of sources.

We are not able to anticipate or implement effective preventive measures against all security breaches of these types, especially because the techniques used change frequently and because attacks can

originate from a wide variety of sources.

We employ detection and response mechanisms designed to contain and mitigate security incidents, but early detection may be thwarted by sophisticated attacks and malware designed to avoid detection.

17 unchanged sentences

To address the challenges that we face with respect to fraudulent activity, we maintain certain risk control policies and procedures, both internally and with respect to our third-party vendors and service providers, that make it more difficult for to fraudulently obtain and use our products and services.

However, our inability to keep pace with

technological changes, including our ability to identify and address cybersecurity risks, may significantly affect our financial position and results of operation.

However, our inability to keep pace with technological changes, including our ability to identify and address cybersecurity risks, may significantly affect our financial position and results of operation.

Adverse conditions in Asia and elsewhere could adversely affect our business.

2 unchanged sentences

In addition, pandemics and other public health crises or concerns over the possibility of such crises could create economic and financial disruptions in the region.

The coronavirus pandemic has had a material adverse effect on the Asian economies.

A significant deterioration of economic conditions in Asia, and in South Korea in particular, could expose us to, among other things, economic and transfer risk, and we could experience an outflow of deposits by those of our customers with connections to Asia.

23 unchanged sentences

A decrease in our prepayment penalty income resulting from any change in interest rates or as a result of regulatory limitations on our ability to charge prepayment penalties could therefore adversely affect our net interest income, net income or results of operations.

An increase in interest rates that adversely affects the ability of borrowers to pay the principal or interest on loans may lead to an increase in nonperforming assets and a reduction of income recognized, which could have a material

adverse effect on our results of operations and cash flows.

Further, when we place a loan on nonaccrual status, we reverse any accrued but unpaid interest receivable, which decreases interest income.

10 unchanged sentences

For example, fixed-rate securities acquired by us are generally subject to decreases in market value when interest rates rise.

Additional factors include, but are not limited to, rating agency downgrades of the securities or our own analysis of the value of the security, defaults by the issuer or individual mortgagors with respect to the underlying securities, or instability in the credit markets.

Additional factors include, but are not limited to, rating agency downgrades of the securities or our own analysis of the value of the security, defaults by the issuer or

individual mortgagors with respect to the underlying securities, or instability in the credit markets.

Any of the foregoing factors could cause other-than-temporary impairment in future periods and result in realized losses.

14 unchanged sentences

Our business and operations are sensitive to general business and economic conditions in the United States, generally, and particularly the state of California and the Los Angeles-Long Beach-Anaheim, California Metropolitan Statistical Areas.

Unfavorable or uncertain economic and market conditions could lead to credit quality concerns related to borrower repayment ability and collateral protection as well as reduced demand for the products and services we offer.

These areas are significantly exposed to natural disasters, particularly earthquakes, flooding, storms and wildfires.

In particular, certain localized areas of Los Angeles were heavily damaged in a series of wildfires that occurred in January 2025, causing hundreds of billions of dollars in damage and disrupting businesses and residents throughout the area.

Although we are not aware of direct effects upon a substantial portion of our customer base, the effects of these events are still being discovered, and it is possible that the fires, or the effects of those fires, may ultimately reduce the ability of our customers to repay loans to the Bank or may impair collateral values securing our loans.

Further, these and other unfavorable or uncertain economic and market conditions could lead to credit quality concerns related to borrower repayment ability and collateral protection as well as reduced demand for the products and services we offer.

Geopolitical developments, such as existing and potential trade wars and other events beyond our control, can increase levels of political and economic unpredictability globally and increase the volatility of global financial markets.

26 unchanged sentences

We target our business development and marketing strategy primarily to serve the banking and financial services needs of small- to medium-sized businesses.

These businesses generally have fewer financial resources in terms of capital

or borrowing capacity than larger entities, frequently have smaller market shares than their competition, may be more vulnerable to economic downturns, often need significant additional capital to expand or compete and may experience substantial volatility in operating results, any of which may impair a borrower’s ability to repay a loan.

These businesses generally have fewer financial resources in terms of capital or borrowing capacity than larger entities, frequently have smaller market shares than their competition, may be more vulnerable to economic downturns, often need significant additional capital to expand or compete and may experience substantial volatility in operating results, any of which may impair a borrower’s ability to repay a loan.

In addition, the success of a small- and medium-sized business often depends on the management talents and efforts of one or two people or a small group of people, and the death, disability or resignation of one or more of these people could have a material adverse impact on the business and its ability to repay its loan.

4 unchanged sentences

We originated $44.2 million and $65.0 million of single family home mortgage loans for the years ended December 31, 2024 and 2023, respectively.

We also purchased $11.2 million $185.8 million of single family home mortgage loans from TPO for the years ended December 31, 2023 and 2022, respectively.

We did not purchase single family home mortgage loans for the year ended December 31, 2024, compared to a $11.2 million purchase of single family home mortgage loans from TPO for the year ended December 31, 2023.

The non-qualified single-family home mortgage loans that we originate are designed to assist mainly Korean-Americans who have recently immigrated to the United States and those Korean-Americans without sufficient documentation to qualify for a traditional home mortgage loan and as such are willing to provide higher down payment amounts and pay higher interest rates and fees in return for reduced documentation requirements.

20 unchanged sentences

Because a large portion of our portfolio is relatively new, the current level of delinquencies and defaults may not represent the level that may prevail as the portfolio becomes more seasoned.

If delinquencies and defaults increase, we may be required to increase our provision for credit losses, which could materially and adversely affect our business, financial condition and results of operations.

If delinquencies and defaults increase, we may be required to increase our provision for credit losses, which could materially and adversely affect our business, financial

condition and results of operations.

For information about the average age of our loans, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations-Financial Condition-Nonperforming Loans.”

27 unchanged sentences

The gain on such sales recognized for the years ended December 31, 2024 and 2023 was $8.3 million and $7.8 million , respectively.

The determination of these gains is based on assumptions regarding the value of unguaranteed

loans retained, servicing rights retained and deferred fees and costs, and net premiums paid by purchasers of the guaranteed portions of U.S.

The determination of these gains is based on assumptions regarding the value of unguaranteed loans retained, servicing rights retained and deferred fees and costs, and net premiums paid by purchasers of the guaranteed portions of U.S.

government guaranteed loans.

29 unchanged sentences

Interest-bearing accounts earn interest at rates established by management based on competitive market factors.

The demand for the deposit products we offer may also be reduced due to a variety of factors, such as demographic patterns, changes in customer preferences, reductions in consumers’

disposable income, regulatory actions that decrease customer access to particular products, or the availability of competing products.

The demand for the deposit products we offer may also be reduced due to a variety of factors, such as demographic patterns, changes in customer preferences, reductions in consumers’ disposable income, regulatory actions that decrease customer access to particular products, or the availability of competing products.

Risks Related to our Management

11 unchanged sentences

Min Kim, our President and Chief Executive Officer, or other key personnel, or the inability to recruit and retain qualified personnel in the future, could have a material adverse effect on our business, financial condition and results of operations.

Similarly, we recently announced and have begun to implement a leadership succession plan pursuant to which, among other things, Ms.

Kim will retire as our Chief Executive Officer and will assume the role of Chair of our Board of Directors, and will be succeeded in the CEO role by Mr.

Sang Oh effective July 1, 2025.

We announced in February 2025 that Ms.

Christine Oh, our longtime Chief Financial Officer, will accept the role of Chief Operating Officer and will be succeeded in her CFO role by Jaehyun Park.

While our Board of Directors has carefully considered and begun to implement these plans, there can be no assurance that these changes will not prove disruptive, or that they ultimately will be successful in promoting our strategic goals and assuring a smooth leadership transition.

Unexpected failures or shortcomings as these changes occur may have a material adverse effect upon our business, financial condition and results of operations.

Risks Related to our Credit Quality

8 unchanged sentences

As of December 31, 2024, our nonperforming loans (which consist of nonaccrual loans, loans past due 90 days or more and still accruing interest and loans modified under troubled debt restructurings) totaled $7.8 million , or 0.40% of our gross loans, and 0.33% of total assets.

We did not have other real estate owned (“OREO”) as of December 31, 2023.

Our nonperforming assets adversely affect our net income in various ways.

We do not record interest income on nonaccrual loans or other real estate owned, thereby adversely affecting our net interest income, net income and returns on assets and equity, and our loan administration costs increase, which together with reduced interest income adversely affects our efficiency ratio.

When we take collateral in foreclosure and similar proceedings, we are required to mark the collateral to its then-fair market value, which may result in a loss.

These nonperforming loans and other real estate owned also

increase our risk profile and the level of capital our regulators believe is appropriate for us to maintain in light of such risks.

When we take collateral in foreclosure and similar proceedings, we are required to mark the collateral

to its then-fair market value, which may result in a loss.

These nonperforming loans and other real estate owned also increase our risk profile and the level of capital our regulators believe is appropriate for us to maintain in light of such risks.

The resolution of nonperforming assets requires significant time commitments from management and can be detrimental to the performance of their other responsibilities.

1 unchanged sentence

Our allowance for credit losses may prove to be insufficient to absorb potential losses in our loan portfolio.

We maintain an allowance for credit losses for probable incurred losses in our loan portfolio.

The allowance is established through a provision for credit losses based on management’s evaluation of the risks inherent in the loan portfolio and the general economy.

The allowance is also appropriately increased for new loan growth.

The allowance is based upon a number of factors, including the size of the loan portfolio, asset classifications, economic trends, industry experience and trends, industry and geographic concentrations, estimated collateral values, management’s assessment of the credit risk inherent in the portfolio, historical loan loss experience and loan underwriting policies.

The allowance is only an estimate of the probable incurred losses in the loan portfolio and may not represent actual losses realized over time, either of losses in excess of the allowance or of losses less than the allowance.

In addition, we evaluate all loans identified as impaired loans and allocate an allowance based upon our estimation of the potential loss associated with those problem loans.

While we strive to carefully manage and monitor credit quality and to identify loans that may be deteriorating, at any time there are loans included in the portfolio that may result in losses, but that have not yet been identified as nonperforming or potential problem loans.

Through established credit practices, we attempt to identify deteriorating loans and adjust the allowance for credit losses accordingly.

However, because future events are uncertain and because we may not successfully identify all deteriorating loans in a timely manner, there may be loans that deteriorate in an accelerated time frame.

We cannot be sure that we will be able to identify deteriorating loans before they become nonperforming assets, or that we will be able to limit losses on those loans that have been so identified.

Although management believes that the allowance for credit losses is adequate to absorb probable incurred losses on any existing loans that may become uncollectible, we may be required to take additional provisions for credit losses in the future to further supplement the allowance for credit losses, either due to management’s decision to do so or because our banking regulators require us to do so.

Our bank regulatory agencies will periodically review our allowance for credit losses and the value attributed to nonaccrual loans or to real estate acquired through foreclosure and may require us to adjust our determination of the value for these items.

These adjustments could have a material adverse effect on our business, financial condition and results of operations.

generally accepted accounting principles (“GAAP”) requires credit loss recognition using a methodology that estimates current expected credit losses for the life of the loan and requires consideration of a broader range of reasonable and supportable information to inform credit loss estimates.

A significant source of risk arises from the possibility that we could sustain losses because borrowers, guarantors and related parties may fail to perform in accordance with the terms of their loans.

The underwriting and credit monitoring policies and procedures that we have adopted to address these risks may not prevent losses that could have a material adverse effect on our business, financial condition, results of operations and cash flows.

We maintain an allowance for credit losses to provide for losses resulting from loan defaults and non-performance.

The allowance is increased for loan growth.

We also make various assumptions and judgments about the collectability of loans in our portfolio, including the creditworthiness of borrowers, the strength of the economy and the value of the real estate and other assets serving as collateral for the repayment of loans.

In determining the adequacy of the allowance for credit losses, we rely on our historic loss experience and our evaluation of economic conditions.

If our assumptions prove to be incorrect, our allowance for credit losses may not be sufficient to cover losses in our loan portfolio, and adjustments may be necessary to address different economic conditions or adverse developments in the loan portfolio.

Consequently, a problem with one or more loans could require us to significantly increase our provision for credit losses.

Environmental liabilities could materially and adversely affect our business and financial condition.

10 unchanged sentences

It also will depend, in part, upon our ability to attract deposits and grow our loan portfolio and investment opportunities and on whether we can continue to fund growth while maintaining cost controls and asset quality, as well on other factors beyond our control, such as national, regional and local economic conditions and interest rate trends.

Further, we have expanded by establishing de novo branches in the Bay Area of California and in the Atlanta, Georgia, Las Vegas, Nevada, and Washington, DC, metropolitan area, and loan production offices in some of these locations as well as in the Dallas, Texas area.

These efforts may prove less successful or more expensive than we have estimated, and in certain cases could materially and adversely affect our results of operation or our financial condition.

There is risk related to acquisitions.

1 unchanged sentence

However, from time to time, we may consider opportunistic strategic acquisitions that we believe support our long-term business strategy.

When considering acquisition opportunities we face significant competition from numerous other financial services institutions, many of which will have greater financial resources than we do.

When considering acquisition opportunities we face significant competition from numerous other financial services institutions, many of which will have greater

financial resources than we do.

Accordingly, attractive acquisition opportunities may not be available to us.

31 unchanged sentences

There are no approval rights of either party for any of the actions or omissions that either party may take under the Coexistence Agreement.

The Coexistence Agreement will limit our potential geographic expansion to the Permitted Markets.

Those limitations could affect our overall growth over the long term.

To our knowledge, Open Bank S.A.

To date we have not received notice that we are in breach of the Coexistence Agreement or that our business cannot be operated as currently conducted and as proposed to be conducted.

Additionally, to our knowledge, Open Bank S.A.

had not undertaken any actions to engage in any business or marketing activities in the United States other than have a presence on the internet through their website.

However, the Coexistence Agreement restricts our potential geographic expansion beyond the Permitted Markets, which could affect our overall growth over the long term.

As we expand our business outside of California markets, we will encounter risks that could adversely affect us.

2 unchanged sentences

For example, we have loan production operations in Atlanta, Georgia, Aurora, Colorado, and Lynnwood and Seattle, Washington, and a full service branch with a commercial lending center in Carrollton, Texas, all of which have relatively high concentrations of Korean-American individuals and businesses.

In the course of this expansion, we will encounter significant risks and uncertainties that could have a material adverse effect on our operations.

course of this expansion, we will encounter significant risks and uncertainties that could have a material adverse effect on our operations.

These risks and uncertainties include increased expenses and operational difficulties arising from, among other things, our ability to attract sufficient business in new markets, to manage operations in noncontiguous market areas, to comply with all of the various local laws and regulations, and to anticipate events or differences in markets in which we have no current experience.

19 unchanged sentences

Although management believes that the Company has sufficient capital to fund operations and growth initiatives for at least the next twenty-four months based on our estimated future operations, we may need to raise additional capital in the future to provide us with sufficient capital resources and liquidity to meet our commitments and business needs.

Our ability to raise additional capital depends on conditions in the capital markets, economic conditions and a number of other factors, including investor perceptions regarding the banking industry, market conditions and governmental activities, and on our financial condition

and performance.

Any occurrence that may limit our access to the capital markets may adversely affect our capital costs and our ability to raise capital.

33 unchanged sentences

Our marketing focuses primarily on the banking needs of small- and medium-sized businesses, professionals and residents in the Korean-American communities that we serve.

This demographic concentration makes us more prone to circumstances that particularly affect this segment of the population.

This demographic concentration makes us more prone to

circumstances that particularly affect this segment of the population.

As a result, our financial condition and results of operations are subject to changes in the economic conditions affecting these communities.

23 unchanged sentences

Financial services companies are interrelated as a result of trading, clearing, counterparty, and other relationships.

We have exposure to different industries and counterparties, and through transactions with counterparties in the financial services industry, including brokers and dealers, commercial banks, investment banks,

and other institutional clients.

As a result, defaults by, or even rumors or questions about, one or more financial services companies, or the financial services industry generally, have led to market-wide liquidity problems and could lead to losses or defaults by us or by other institutions.

25 unchanged sentences

Our risk management framework is comprised of various processes, systems and strategies, and is designed to manage the types of risk to which we are subject, including, among others, credit, market, liquidity, interest rate and compliance.

Our framework also includes financial or other modeling methodologies that involve management

assumptions and judgment.

Our framework also includes financial or other modeling methodologies that involve management assumptions and judgment.

Our risk management framework may not be effective under all circumstances and may not adequately mitigate any risk or loss to us.

1 unchanged sentence

We may also be subject to potentially adverse regulatory consequences.

Interruptions, cyberattacks, fraudulent activity or other security breaches may have a material adverse effect on our business.

Our business is highly dependent on the collection, storage, transmittal, sharing, processing and retention of information about our customers and employees.

To accomplish these activities, we rely heavily upon electronic infrastructure that we own or that we obtain via license or other contractual arrangements with third parties.

These technologies affect, among other things, our customers’ ability to access and transfer funds, initiate and pay loans and leases, communicate with our customer service teams, and engage in a variety of other activities that form the foundation of modern financial services businesses.

Likewise, our employee data and related technologies allow us to communicate with our employees about routine and extraordinary matters, compensate our staff, maintain timekeeping, payroll and benefits records, and comply with an increasingly complex web of labor and employment laws and regulations.

The loss, interruption or disruption of these systems may damage our relationships with customers and correspondingly may harm our reputation.

Compromises or interruptions in our employment-related systems may cause challenges in our relationships with our employees, upon whom we are heavily dependent in the conduct of our business and the development and maintenance of our relationships with customers and prospective customers.

There have been a number of recent and well-publicized incidents involving various types of cybersecurity lapses, some of which have had substantial adverse impacts upon targeted businesses and on customers of even some of the world’s most prominent cybersecurity and financial services firms.

Similarly, extremely sophisticated criminal and nation-state organizations routinely target and exploit information technology networks, data systems, and other critical infrastructure.

One of the most prominent recent events resulted in a widespread failure of a large cybersecurity platform, some of the consequences of which are not yet, and may not soon be, fully known or estimable.

We devote significant resources and management focus to ensuring the integrity of our systems against cybercriminals and similar actors, as well as against threats from fires and other natural disasters;

power or telecommunications failures;

acts of terrorism or wars or other catastrophic events;

breaches, physical break-ins or errors resulting in interruptions and unauthorized disclosure of confidential information, through information security and business continuity programs.

Likewise, we have made, and we continue to make, substantial investments in systems that are intended to protect against these vulnerabilities, including real-time threat detection and warning, security programs and protocols, backup and alternative-access systems, virus and malware protection programs, and a wide variety of other protective measures.

Notwithstanding these investments, cybersecurity measures are, by their nature, largely reactive, and threats are constantly evolving.

We expect that the development of AI-based technologies will accelerate both the number and the sophistication of these threats.

We routinely experience attempts to exploit our networks and systems, and we must continue investing in increasingly advanced (and concomitantly expensive) technology to counteract these threats.

Further, if our systems cannot timely detect and mitigate vulnerabilities, or cannot promptly respond to threats, we may experience damage to or interruptions in the availability of our computer networks, or we may experience a loss of data, unauthorized use or disclosure of customer information, or a loss of customer funds as a result of unauthorized access to customer accounts.

Likewise, breaches of our payroll, benefits, and other employee-related systems may give rise to liability under employment laws and may damage our relationships with our employees.

Disruptions or failures in the physical infrastructure, controls or operating systems that support our businesses and customers, failures of the third parties on which we rely to adequately or appropriately provide their services or perform their responsibilities, or our failure to effectively manage or oversee our third-party relationships, could result in business disruptions, loss of revenue or customers, legal or regulatory proceedings, remediation and other costs, violations of applicable privacy and other laws, reputational damage, customer harm, or other adverse consequences, any of which could materially adversely affect our results of operations or financial condition.

Further, new and evolving SEC regulations, as well as federal and state banking and consumer privacy laws and regulations, could require us to provide notices of security breaches.

Such disclosures could result in increased regulatory scrutiny, exacerbate our potential legal liability, and result in a loss of confidence in the security of our systems or an adverse perception of our products and services.

The access by unauthorized persons to, or the improper disclosure by us or our third-party vendors of, confidential information regarding our customers or our own proprietary information, software, methodologies and business secrets, failures or disruptions in our communications, information and technology systems, or our failure to adequately address them, could negatively affect our customer relationship management, online banking, accounting or other systems.

We cannot assure readers that such breaches, failures or interruptions will not occur or, if they do occur, that they will be adequately addressed by us or the third parties on which we rely.

Accordingly, any failures or interruptions of our communications, information and technology systems could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on our business, financial condition or results of operations.

Our cybersecurity investments may create unforeseen implementation challenges that confer unexpected disruptions, unbudgeted costs, or delays in adaptation to crucial threats.

Enhancements and upgrades to our infrastructure or computer systems may be time-consuming, may entail significant costs, and may themselves create risks associated with implementing new systems and integrating them with existing ones.

Due to the complexity and interconnectedness of our systems, the process of enhancing our infrastructure and operating systems, including their security measures and controls, also can create an inherent risk of system disruptions and security issues.

Similarly, we may not be able to timely recover critical business processes or operations that have been disrupted, which may further increase any associated costs and consequences of such disruptions.

Although we have enterprise incident response processes, business continuity plans and other safeguards in place to help provide operational resiliency, our business operations may be adversely affected by significant and widespread disruption to our physical infrastructure or computer systems that support our businesses and customers.

Our relatively small size requires us to be heavily reliant upon third-party vendors for cybersecurity expertise.

Those vendors may themselves be subject to vulnerabilities, and their failures may be harmful to our business.

As a smaller bank holding company and a small community bank, we lack the resources available to larger institutions to recruit, train and retain a large staff focused on data security.

Instead, like most community banks, we rely heavily on third-party vendors and other service providers for these functions.

As financial institutions and technology systems become more interconnected and more complex, any operational incident at a third party, such as a vendor or customer, may increase our operational risks, including from information breaches or loss, breakdowns, disruptions or failures of their own systems or infrastructure, or any deficiencies in the performance of their responsibilities.

These risks are increased to the extent we rely on a single-source vendor or provider.

If a third-party vendor or service provider is not fully effective in assisting us in protecting our data and systems, we may be held responsible for any resulting failures, and even a failure by a third party could damage or jeopardize our relationships with our customers.

Further, a recent and well-publicized cybersecurity incident involving the failure of one of the world’s most sophisticated security platforms resulted in extensive outages of that provider’s customer systems, the effect of which was a cascading failure of several of that firm’s clients’ networks.

Such interruptions, occurring as a result of the acts or omissions of one or more of our vendors, could result in liability to our customers, as well as reputational harm and a potential interruption of our business.

Cybersecurity incidents, failures or lapses could give rise to regulatory harms to the Company or the Bank.

As cybersecurity threats become increasingly widespread and sophisticated, federal and state banking and privacy regulations are becoming correspondingly complex and prevalent, and the penalties for the actual or suspected violations of such rules are becoming increasingly substantial.

Accordingly, we must meet stringent and increasingly costly regulatory requirements regarding our own obligations, as well as our reliance on third-party service providers, and any failure by us or our third-party service providers to comply with applicable laws, rules, regulations, or internal policies could result in the Company or the Bank becoming subject to fines, penalties, or business restrictions, as well as to increased costs to remediate any actual or perceived deficiencies and potentially to legal and other costs associated with defending against such regulatory sanctions.

System failure or breaches of our network security could subject us to increased operating costs as well as litigation and other liabilities.

5 unchanged sentences

Notwithstanding, our facilities and systems, and those of third party service providers, are vulnerable to interruptions, external or internal security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming or human errors, force majeure events, or other similar events.

We outsource certain aspects of our data processing and other operational functions to certain third-party providers.

We outsource certain aspects of our data

processing and other operational functions to certain third-party providers.

If our third-party providers encounter difficulties including those resulting from breach, breakdowns or other disruptions in communication services, cyber-attacks and security breaches or if we otherwise have difficulty in our ability to deliver products and services to our customers and otherwise conduct business operations and could have a material adverse effect on our business, financial condition and results of operations.

27 unchanged sentences

A third party provider may fail to provide the services we require, or meet contractual requirements, comply with applicable laws and regulations, or suffer a cyber-attack or other security breach.

We expect that our regulators will hold us responsible for deficiencies of our third party relationships which could result in enforcement actions, including civil money penalties or other administrative or judicial penalties or fines, or customer remediation, any of which could have a material adverse effect on our business, financial condition or results of operations.

We expect that our regulators will hold us responsible for deficiencies of our third party relationships which could result in

enforcement actions, including civil money penalties or other administrative or judicial penalties or fines, or customer remediation, any of which could have a material adverse effect on our business, financial condition or results of operations.

We depend on the accuracy and completeness of information provided by customers and counterparties and any misrepresented information could adversely affect our business, financial condition and results of operations.

14 unchanged sentences

Our accounting estimates and risk management processes rely on analytical and forecasting models.

Processes that management uses to estimate our probable credit losses and to measure the fair value of financial instruments, as well as the processes used to estimate the effects of changing interest rates and other market measures on our financial condition and results of operations, depend upon the use of analytical and forecasting models.

reflect assumptions that may not be accurate, particularly in times of market stress or other unforeseen circumstances.

Processes that management uses to estimate our expected credit losses and to measure the fair value of financial instruments, as well as the processes used to estimate the effects of changing interest rates and other market measures on our financial condition and results of operations, depend upon the use of analytical and forecasting models.

These models reflect assumptions that may not be accurate, particularly in times of market stress or other unforeseen circumstances.

Even if these assumptions are accurate, the models may prove to be inadequate or inaccurate because of other flaws in their design or their implementation.

27 unchanged sentences

Any of the above could cause investors to lose confidence in our reported financial information or our common stock listing on The Nasdaq Global Market to be suspended or terminated, which could have a negative effect on the trading price of our common stock.

In addition, we could become subject to investigations by the

SEC, the Board of Governors of the Federal Reserve System, the FDIC, the DFPI or other regulatory authorities, which could require additional financial and management resources.

In addition, we could become subject to investigations by the SEC, the Board of Governors of the Federal Reserve System, the FDIC, the DFPI or other regulatory authorities, which could require additional financial and management resources.

These events could have a material adverse effect on our business, financial condition and results of operations.

3 unchanged sentences

Regulations adopted by these agencies, which are generally intended to provide protection for depositors and customers rather than for the benefit of shareholders, govern a comprehensive range of matters relating to ownership and control of our shares, our acquisition of other companies and businesses, permissible activities, maintenance of adequate capital levels, and other aspects of our operations.

These bank regulators possess broad authority to prevent or remedy unsafe or unsound practices or violations of law.

These bank regulators possess broad authority to prevent or remedy unsafe or unsound practices or violations of

The laws and regulations applicable to the banking industry could change at any time, and we cannot predict the effects of these changes on our business, profitability or growth strategy.

5 unchanged sentences

In addition, adverse publicity and damage to our reputation arising from the failure or perceived failure to comply with legal, regulatory or contractual requirements could affect our ability to attract and retain customers.

Legislative and regulatory actions taken now or in the future may increase our costs and impact our business, governance structure, financial condition or results of operations.

Proposed legislative and regulatory actions, including changes to financial regulation, may not occur on the timeframe that is expected, or at all, which could result in additional uncertainty for our business.

New proposals for legislation continue to be introduced in the U.S.

Congress that could further substantially increase regulation of the financial services industry, impose restrictions on the operations and general ability of firms within the industry to conduct business consistent with historical practices, including in the areas of compensation, interest rates, financial product offerings and disclosures, and have an effect on bankruptcy proceedings with respect to consumer residential real estate mortgages, among other things.

Federal and state regulatory agencies also frequently adopt changes to their regulations or change the manner in which existing regulations are applied.

Presently, in addition to refining existing regulations implemented after the 2007-2008 financial crisis, the banking regulators are also focusing their attention on certain policy areas, such as climate risk, digital currencies, and technological innovation.

This new focus may require us to invest significant management attention and resources to evaluate and make any changes required by the legislation and accompanying rules.

Future regulatory or legislative changes, including to laws applicable to the financial industry and the U.S.

corporate tax code, may impact the profitability of our business activities, require more oversight or change certain of our business practices, including the ability to offer new products, obtain financing, attract deposits, make loans and achieve satisfactory interest spreads, and could expose us to additional costs, including increased compliance costs.

These changes also may require us to invest significant management attention and resources to make any necessary changes to operations to comply, and could have a material adverse effect on our business, financial condition and results of operations.

In addition, any proposed legislative or regulatory changes, including those that could benefit our business, financial condition and results of operations, may not occur on the timeframe that is proposed, or at all, which could result in additional uncertainty for our business.

Federal and state regulators periodically examine our business, and we may be required to remediate adverse examination findings.

The Federal Reserve, the FDIC, and the DFPI periodically examine our business, including our compliance with laws and regulations.

If, as a result of an examination, a banking agency were to determine that our financial condition,

capital resources, asset quality, earnings prospects, management, liquidity or other aspects of any of our operations had become unsatisfactory, or that we were in violation of any law or regulation, they may take a number of different remedial actions as they deem appropriate.

If, as a result of an examination, a banking agency were to determine that our financial condition, capital resources, asset quality, earnings prospects, management, liquidity or other aspects of any of our operations had become unsatisfactory, or that we were in violation of any law or regulation, they may take a number of different remedial actions as they deem appropriate.

These actions include the power to (i) enjoin “unsafe or unsound” practices, (ii) require correction of any conditions resulting from any violation or practice, (iii) issue an administrative order that can be judicially enforced, (iv) direct an increase in our capital, (v) restrict our growth, (vi) assess civil money penalties, and (vii) fine or remove officers and directors.

1 unchanged sentence

Any regulatory action against us could have an adverse effect on our business, financial condition and results of operations.

We are subject to numerous laws designed to protect consumers, including the Community Reinvestment Act and fair lending laws, and failure to comply with these laws could lead to a wide variety of sanctions.

The Community Reinvestment Act, the Equal Credit Opportunity Act, the Fair Housing Act and other fair lending laws and regulations prohibit discrimination and impose other requirements on financial institutions.

Department of Justice and other federal agencies, including the FDIC and the CFPB, are responsible for enforcing these laws and regulations.

A successful challenge to an institution’s performance under the Community Reinvestment Act, fair lending and other compliance laws and regulations could result in a wide variety of sanctions, including the required payment of damages and civil money penalties, injunctive relief, imposition of restrictions on mergers and acquisitions activity and restrictions on expansion.

Private parties may also have the ability to challenge an institution’s performance under fair lending laws in private class action litigation.

The costs of defending, and any adverse outcome from, any such challenge could damage our reputation or could have a material adverse effect on our business, financial condition and results of operations.

Regulatory agencies and consumer advocacy groups are becoming more aggressive in asserting claims that the practices of lenders and loan servicers result in a disparate impact on protected classes.

Antidiscrimination statutes, such as the Fair Housing Act and the Equal Credit Opportunity Act (“ECOA”), prohibit creditors from discriminating against loan applicants and borrowers based on certain characteristics, such as race, religion and national origin, among others.

Various federal regulatory agencies and departments, including the U.S.

Department of Justice and the CFPB, take the position that these laws apply not only to intentional discrimination, but also to neutral practices that have a disparate impact on a group that shares a characteristic that a creditor may not consider in making credit decisions (i.e., creditor or servicing practices that have a disproportionate negative effect on a protected class of individuals).

These regulatory agencies, as well as consumer advocacy groups and plaintiffs’ attorneys, are focusing greater attention on “disparate impact” claims.

Regulatory agencies and private plaintiffs are expected to apply the “disparate impact” theory to both the Fair Housing Act and ECOA in the context of mortgage lending and servicing, among others.

To the extent that the “disparate impact” theory continues to apply, it may significantly increase our administrative burdens, compliance requirements and potential liability for failures to comply.

In addition to reputational harm, violations of ECOA and the Fair Housing Act can result in actual damages, punitive damages, injunctive or equitable relief, attorneys’ fees and civil money penalties.

We face a risk of noncompliance and enforcement action with the BSA and other anti-money laundering statutes and regulations.

65 unchanged sentences

Failure to maintain a capital conservation buffer above certain levels will result in restrictions on the Bank’s ability to make dividend payments, repurchases, redemptions or other capital distributions.

These requirements, and any other new

regulations or capital distribution constraints, could adversely affect the ability of the Bank to pay dividends to the Company and, in turn, affect our ability to pay dividends on our common stock.

These requirements, and any other new regulations or capital distribution constraints, could adversely affect the ability of the Bank to pay dividends to the Company and, in turn, affect our ability to pay dividends on our common stock.

We have limited the circumstances in which our directors will be liable for monetary damages.

4 unchanged sentences

Future equity issuances could result in dilution, which could cause our common stock price to decline.

We are generally not restricted from issuing additional shares of our common stock, up to the 50 million shares of voting common stock and 10 million shares of preferred stock authorized in our articles of incorporation (subject to Nasdaq shareholder approval rules), which in each case could be increased by a vote of a majority of our shares.

shareholder approval rules), which in each case could be increased by a vote of a majority of our shares.

We may issue additional shares of our common stock in the future pursuant to current or future equity compensation plans, upon conversions of preferred stock or debt, upon exercise of warrants or in connection with future acquisitions or financings.

13 unchanged sentences

A person would be deemed to have acquired control of the Company if such person, directly or indirectly, has the power (i) to vote 25% or more of the voting power of the Company or (ii) to direct or cause the direction of the management and policies of the Company.

of this law, a person who directly or indirectly owns or controls 10% or more of our outstanding common stock would be presumed to control the Company.

For purposes of this law, a person who directly or indirectly owns or controls 10% or more of our outstanding common stock would be presumed to control the Company.

Federal regulators generally would prohibit any company that is not engaged in financial activities and activities that are permissible for a bank holding company or a financial holding company from acquiring control of the Company.

12 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors