What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2022-03-31 compared with 2021-03-26 · 99 added, 78 removed, 327 unchanged (35% of the section changed)

1 unchanged sentence

The Company is the largest independent financial holding company located on the Eastern Shore of Maryland.

The Company, through its wholly owned banking subsidiary, Shore United Bank (the “Bank”) provides commercial banking products and services, including trust, wealth management and financial planning services.

The Company and the Bank are Affirmative Action/Equal Opportunity Employers.

Pending Transaction

On March 3, 2021, the Company and Severn Bancorp, Inc.

(“Severn”) entered into a definitive agreement for the Company to acquire the Maryland-based Severn.

This transaction will create the third largest community bank headquartered in Maryland.

This transaction will, among others, (i) permit the Company to expand its Maryland market area by entering the greater Annapolis market area, (ii) provide increased opportunities for current Severn products and services and (iii) enhance the Company’s scale to drive efficiency and profitability.

Additionally, this transaction is intended to create a competitive position in the Columbia/Baltimore/Towson MSA, while filling in the Company’s current market footprint.

Under the terms of the agreement, Severn shareholders will have the right to receive 0.6207 shares of Shore common stock and $1.59 in cash for each share of Severn common stock.

Upon closing, Shore shareholders will own approximately 59.6% of the combined Company and Severn will own approximately 40.4% of the combined Company.

The transaction is subject to satisfaction of customary closing conditions, including regulatory approvals and shareholder approval from Shore and Severn shareholders.

The transaction is expected to close in the third quarter of 2021.

As of December 31, 2020, Severn had more than $950 million in assets and operated 7 full-service community banking offices throughout Anne Arundel County, Maryland.

The Company conducts business primarily through two wholly owned subsidiaries, Shore United Bank, N.A.

(the “Bank”) and Mid-Maryland Title Company, Inc.

(“the Title Company”).

The Bank provides consumer and commercial banking products and services, including secondary mortgage lending, trust, wealth management and financial planning services.

The Title Company engages in title work related to real estate transactions.

The Company, Bank and Title Company are Affirmative Action/Equal Opportunity Employers.

HS West, LLC (“HS”) is a subsidiary of the Bank which constructed a building in Annapolis, Maryland that serves as a branch office of the Bank and leases space to five unrelated companies and to a law firm of which the Chairman of the Board of the Company and Bank is a partner.

Recent Acquisition

On October 31, 2021, the Company completed the acquisition of Severn Bancorp, Inc.

(“Severn”), the savings and loan holding company of Severn Savings Bank, FSB, a federally charted savings bank headquartered in Annapolis, Maryland.

In connection with the merger, the Bank consummated its conversion to a national bank on October 29, 2021.

This transaction created the third largest community bank headquartered in Maryland.

This transaction (i) expanded the Company’s Maryland market area with branches in the greater Annapolis market area, (ii) provides increased opportunities for additional products and services and (iii) enhances the Company’s scale to drive efficiency and profitability.

Additionally, this transaction creates a competitive position in the Columbia/Baltimore/Towson MSA, while filling in the Company’s current market footprint.

Under the terms of the merger agreement, each share of Severn common stock was converted into the right to receive 0.6207 shares of Company common stock and $1.59 in cash.

The value of the total deal consideration was approximately $169.8 million, which was based upon the closing price of the Company’s common stock on October 29, 2021, the last trading day prior to the closing, and included aggregate cash consideration of approximately $20.9 million.

Banking Products and Services

The Bank is a Maryland chartered commercial bank with trust powers that can trace its origin to 1876.

The Bank currently operates 22 full service branches, 24 ATMs, 2 loan production offices, and provides a full range of commercial and consumer banking products and services to individuals, businesses, and other organizations in Baltimore City, Baltimore County, Howard County, Kent County, Queen Anne’s County, Caroline County, Talbot County, Dorchester County and Worcester County in Maryland, Kent County, Delaware and in Accomack County, Virginia.

The Bank is a national banking association chartered under the laws of the United States with trust powers that can trace its origin to 1876.

The Bank currently operates 29 full-service branches, 30 ATMs, 5 loan production offices, and provides a full range of commercial and consumer banking products and services to individuals, businesses, and other organizations in Baltimore City, Baltimore County, Howard County, Kent County, Queen Anne’s County, Caroline County, Talbot County, Dorchester County, Anne Arundel County and Worcester County in Maryland, Kent County, Delaware and in Accomack County, Virginia.

The Bank’s deposits are insured up to applicable legal limits by the Federal Deposit Insurance Corporation (the “FDIC”).

4 unchanged sentences

Merchant credit card clearing services are available as well as direct deposit of payroll, internet banking and telephone banking services.

Services to individuals include checking accounts, various savings programs, mortgage loans, home improvement loans, installment and other personal loans, credit cards, personal lines of credit, automobile and other consumer financing, safe deposit boxes, debit cards, 24-hour telephone banking, internet banking, mobile banking, and 24-hour automatic teller

machine services.

The Bank also offers non-deposit products, such as mutual funds and annuities, and discount brokerage services to their customers.

Additionally, the Bank has Saturday hours and extended hours on certain evenings during the week for added customer convenience.

Medical-Use Cannabis Related Business

As of October 31, 2021, in connection with our acquisition of Severn, the Bank began providing banking services to customers that are licensed by the state of Maryland to do business in the medical-use cannabis industry as growers, processors and dispensaries.

The Bank maintains stringent written policies and procedures related to the on-boarding of such businesses and to the monitoring and maintenance of such business accounts.

In accordance with Federal regulatory guidance, and industry best practices, the Bank performs a multilayered due diligence review of a medical-use cannabis business before the business is on-boarded, including site visits and confirmation that the business is properly licensed by the state of Maryland.

Throughout the relationship, the Bank continues to monitor the business, including site visits, to ensure that the medical-use cannabis business continues to meet our stringent requirements, including maintenance of required licenses.

The Bank performs periodic financial reviews of the business and monitor the business in accordance with the Bank Secrecy Act (“BSA”) and Maryland Medical Cannabis Commission requirements.

See Note 23 to the Consolidated Financial Statements for a summary of the level of business activities with the Bank’s medical-use cannabis customers.

Lending Activities

The Bank originates loans of all types, including commercial, commercial mortgage, commercial construction, residential construction, residential mortgage and consumer loans.

The Bank originates secured and unsecured loans for business purposes.

13 unchanged sentences

Permanent financing options for individuals include fixed and variable rate loans with three- and five-year balloon features and one-, three- and five-year adjustable rate mortgage loans.

The risk of loss associated with real estate construction lending is controlled through conservative underwriting procedures such as loan to value ratios of 80% or less at origination, obtaining additional collateral when prudent, and closely monitoring construction projects to control disbursement of funds on loans.

The Bank originates fixed and variable rate residential mortgage loans.

As with any consumer loan, repayment is dependent upon the borrower’s continuing financial stability, which can be adversely impacted by job loss, divorce, illness, or personal bankruptcy, among other factors.

Underwriting standards recommend loan to value ratios not to exceed 80% at origination based on appraisals performed by approved appraisers.

The Bank relies on title insurance to protect their lien priorities and protect the property securing the loans by requiring fire and casualty insurance.

The risk of loss associated with real estate construction lending is controlled through conservative underwriting

procedures such as loan to value ratios of 80% or less at origination, obtaining additional collateral when prudent, and closely monitoring construction projects to control disbursement of funds on loans.

The Bank originates residential mortgage loans that are to be held in our loan portfolio as well as loans that are intended for sale in the secondary market.

Loans sold in the secondary market are primarily sold to investors with which the Bank maintains a correspondent relationship.

These loans are made in conformity with standard government-sponsored enterprise (“GSE”) underwriting criteria required by the investors to assure maximum eligibility for resale in the secondary market and are approved either by the Bank’s underwriter or the correspondent’s underwriter.

Additionally, loans that are sold into the secondary market are typically residential long-term loans (15 or more years), generally with fixed rates of interest.

Loans retained for the Bank’s portfolio typically include construction loans and loans that periodically reprice or mature prior to the end of an amortized term.

Generally, loans are sold with servicing retained which includes loans sold to the Federal National Mortgage Association (“FNMA”) or Federal Home Loan Mortgage Corporation (“FHLMC”).

As of December 31, 2021, the Bank was servicing $301.4 million in loans for FNMA and $69.8 million in loans for FHLMC.

A variety of consumer loans are offered to customers, including home equity loans, credit cards and other secured and unsecured lines of credit and term loans.

18 unchanged sentences

•Practice Balanced Risk Management,

•Leverage the Team

•Leverage the Team, and

• Create a positive impact.

We believe that these values enable our success with our customers and have helped us build an inspiring, vibrant and accountability driven culture.

In addition, we are committed to developing our staff through internal/external training programs, availability of online training resources, and continuing to implement leadership development programs to all levels of leadership within the organization.

levels of leadership within the organization.

This includes identifying future leaders and preparing them for leadership opportunities.

The safety, health and wellness for our employees is a top priority and consists of policies, procedures, guidelines, and mandates all tasks be conducted in a safe and efficient manner complying with all local, state and federal safety and health regulations.

At the onset of the COVID-19 pandemic, we successfully moved to a virtual-workplace and had 85% of our people working remotely.

As of today, most employees have returned to the workplace.

At the onset of the COVID-19 pandemic, we successfully moved to a virtual-workplace and had 85% of our people working remotely, but most employees returned to the workplace in 2021.

Employees are subject to policies and procedures put in place to protect them including a full stock of PPE.

1 unchanged sentence

Shore Bancshares, Inc.

and the Bank operate in a highly competitive environment.

Our competitors include community banks, commercial banks, credit unions, thrifts, mortgage banking companies, credit card issuers, investment advisory firms, brokerage firms, mutual fund companies and e-commerce and other internet-based companies.

and its subsidiaries operate in a highly competitive environment.

Our competitors include community banks, commercial banks, credit unions, thrifts, mortgage banking companies, credit card issuers, investment advisory firms, brokerage firms, mutual fund companies, title companies and e-commerce and other internet-based companies.

We compete on a local and regional basis for banking and investment products and services.

4 unchanged sentences

The Company is a financial holding company registered with the Board of Governors of the Federal Reserve System (the “FRB”) under the BHC Act and, as such, is subject to the supervision, examination and reporting requirements of the BHC Act and the regulations of the FRB.

The Bank is a Maryland chartered commercial bank subject to the banking laws of Maryland and to regulation by the Commissioner of Financial Regulation of Maryland.

The primary federal regulator of the Bank is the FRB.

Following a charter conversion occurring in 2021, the Bank is now a national banking association, chartered by and subject to the supervision of the Office of the Comptroller of the Currency (“OCC”).

The deposits of the Bank are insured by the FDIC, so certain laws and regulations administered by the FDIC also govern its deposit taking operations.

8 unchanged sentences

The Dodd-Frank Act has increased the regulatory burden and compliance costs of the Company.

Moreover, bank regulatory agencies can be more aggressive in responding to concerns and trends identified in examinations, which could result in an increased issuance of enforcement actions to financial institutions requiring action to address credit quality, liquidity and risk management, and capital adequacy, as well as other safety and soundness concerns.

Moreover, bank regulatory agencies can be more aggressive in responding to concerns and trends identified in

examinations, which could result in an increased issuance of enforcement actions to financial institutions requiring action to address credit quality, liquidity and risk management, and capital adequacy, as well as other safety and soundness concerns.

Regulation of Financial Holding Companies

15 unchanged sentences

Federal Regulation of Banks

Federal and state banking regulators may prohibit the institutions over which they have supervisory authority from engaging in activities or investments that the agencies believe are unsafe or unsound banking practices.

These banking regulators have extensive enforcement authority over the institutions they regulate to prohibit or correct activities that violate law, regulation or a regulatory agreement or which are deemed to be unsafe or unsound practices.

The OCC may prohibit national banking associations, such as the Bank, from engaging in activities or investments that the OCC believes is unsafe or unsound banking practices.

The OCC has extensive enforcement authority over national banking associations to prohibit or correct activities that violate law, regulation or a regulatory agreement or which are deemed to be unsafe or unsound practices.

Enforcement actions may include the appointment of a conservator or receiver, the issuance of a cease and desist order, the termination of deposit insurance, the imposition of civil money penalties on the institution, its directors, officers, employees and institution-affiliated parties, the issuance of directives to increase capital, the issuance of formal and informal agreements, the removal of or restrictions on directors, officers, employees and institution-affiliated parties, and the enforcement of any such mechanisms through restraining orders or other court actions.

10 unchanged sentences

FDICIA also imposes capital standards on insured depository institutions.

Increase in Small Bank Holding Company Policy Threshold.

The Regulatory Relief Act directed the FRB to increase the asset threshold for qualifying for the FRB’s “Small Bank Holding Company Policy Statement” (the “Policy”), from $1 billion to $3 billion.

The FRB’s revisions to the Policy took effect on August 30, 2018.

Small BHCs or savings and loan holding companies(“SLHCs”) are excluded from the Policy if they are engaged in significant nonbanking activities, engaged in significant off-balance sheet activities, or have a material amount of debt or equity registered with the SEC.

The FRB also retains the authority to exclude any BHC or SLHC from the Policy if such action is warranted for supervisory purposes.

The Policy allows covered BHCs to operate with higher levels of debt than would normally be permitted, subject to certain restrictions on dividends and the expectation that the BHC will reduce its reliance on debt over time.

Also, BHCs that are subject to the Policy are exempt from the FRB’s consolidated risk-based and leverage capital rules implementing Basel III.

BHCs subject to the Policy also have less extensive regulatory reporting requirements than larger organizations filing reports on a semi-annual rather than quarterly basis.

The Company meets the conditions of the FRB’s Policy and is

therefore currently excluded from consolidated capital requirements.

However, the Bank remains subject to regulatory capital requirements administered by the federal banking agencies.

Deposit Insurance

23 unchanged sentences

Risk-based capital requirements determine the adequacy of capital based on the risk inherent in various classes of assets and off-balance sheet items.

Under the Dodd-Frank Act, the FRB must apply consolidated capital requirements to depository institution holding companies that are no less stringent than those currently applied to depository institutions.

Under the Dodd-

Frank Act, the FRB must apply consolidated capital requirements to depository institution holding companies that are no less stringent than those currently applied to depository institutions.

The Dodd-Frank Act additionally requires capital requirements to be countercyclical so that the required amount of capital increases in times of economic expansion and decreases in times of economic contraction, consistent with safety and soundness.

Under federal regulations, bank holding companies and banks must meet certain risk-based capital requirements.

Effective as of January 1, 2015, the Basel III final capital framework, among other things, (i) introduces as a new capital measure “Common Equity Tier 1” (“CET1”), (ii) specifies that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting specified requirements, (iii) defines CET1 narrowly by requiring that most adjustments to regulatory capital measures be made to CET1 and not to the other components of capital, and (iv) expands the scope of the adjustments as compared to existing regulations.

Beginning January 1, 2016, financial institutions are required to maintain a minimum

“capital conservation buffer” to avoid restrictions on capital distributions such as dividends and equity repurchases and other payments such as discretionary bonuses to executive officers.

The minimum capital conservation buffer has been phased-in over a four year transition period with minimum buffers of 0.625%, 1.25%, 1.875%, and 2.50% during 2016, 2017, 2018, and 2019, respectively.

Effective as of January 1, 2015, the Basel III final capital framework, among other things, (i) introduced as a new capital measure “Common Equity Tier 1” (“CET1”), (ii) specifies that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting specified requirements, (iii) defines CET1 narrowly by requiring that most adjustments to regulatory capital measures be made to CET1 and not to the other components of capital, and (iv) expands the scope of the adjustments as compared to existing regulations.

Beginning January 1, 2016, financial institutions were required to maintain a minimum “capital conservation buffer” to avoid restrictions on capital distributions such as dividends and equity repurchases and other payments such as discretionary bonuses to executive officers.

The minimum capital conservation buffer was phased-in over a four year transition period with minimum buffers of 0.625%, 1.25%, 1.875%, and 2.50% during 2016, 2017, 2018, and 2019, respectively.

As fully phased-in on January 1, 2019, Basel III subjects banks to the following risk-based capital requirements:

16 unchanged sentences

They also include risk weighting of equity exposures and past due loans;

and higher (greater than 100%) risk weighting for certain commercial real estate exposures that have higher credit risk profiles, including higher loan to value and equity components.

and higher (greater than 100%) risk weighting for certain commercial real estate exposures

that have higher credit risk profiles, including higher loan to value and equity components.

In particular, loans categorized as “high-volatility commercial real estate” loans (“HVCRE loans”), as defined pursuant to applicable federal regulations, are required to be assigned a 150% risk weighting, and require additional capital support.

3 unchanged sentences

In addition, the Dodd-Frank Act requires the federal banking agencies to adopt capital requirements that address the risks that the activities of an institution poses to the institution and the public and private stakeholders, including risks arising from certain enumerated activities.

Basel III became applicable to the Bank on January 1, 2015.

The Company meets the conditions of the FRB’s “Small Bank Holding Company Policy Statement” and is therefore currently excluded from consolidated capital requirements.

Overall, the Corporation believes that implementation of the Basel III Rule has not had and will not have a material adverse effect on the Corporation’s or the Bank’s capital ratios, earnings, shareholder’s equity, or its ability to pay dividends, effect stock repurchases or pay discretionary bonuses to executive officers.

Basel III is currently applicable to the Bank and the Company.

Overall, the Comapny believes that implementation of the Basel III Rule has not had and will not have a material adverse effect on the Comapny’s or the Bank’s capital ratios, earnings, shareholder’s equity, or its ability to pay dividends, effect stock repurchases or pay discretionary bonuses to executive officers.

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms (the standards are commonly referred to as “Basel IV”).

26 unchanged sentences

and was not subject to any written agreement, order or directive requiring it to maintain a specific capital level for any capital measure.

As noted above, Basel III integrates the capital requirements into the prompt corrective action category definitions.

The following capital requirements have applied to the Bank since January 1, 2015.

As noted above, Basel III integrates the capital requirements into the prompt corrective action category definitions set forth below.

Capital Category

20 unchanged sentences

Critically Undercapitalized

As of December 31, 2020, the Bank was “well capitalized” according to the guidelines as generally discussed above.

As of December 31, 2021, the Bank and the Company exceeded all regulatory capital requirements and exceeded the minimum CET 1, Tier 1 and total capital ratio inclusive of the fully phased-in capital conservation buffer of 7.0%, 8.5%, and 10.5%, respectively.

An institution may be downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios if it is determined to be in an unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters.

35 unchanged sentences

Department of Treasury issued a memorandum to the federal banking regulators recommending changes to the CRA’s regulations to reduce their complexity and associated burden on banks, and in December 2019, the FDIC and the Office of the Comptroller of the Currency (the “OCC”) proposed for public comment rules to modernize the agencies' regulations under the CRA.

The OCC adopted its final rules in May 2020, and, to date, the FDIC has not adopted revised rules.

In September 2020, the FRB released for public comment its proposed rules to modernize CRA regulations.

The OCC adopted its final rules in May 2020, and then on December 14, 2021, the OCC rescinded the 2020 rules and replaced them with rules based on the rules adopted jointly by the federal bank regulatory agencies in 1995.

We will continue to evaluate the impact of any changes to the CRA regulations.

Anti-Terrorism, Money Laundering Legislation and OFAC

The Bank is subject to the Bank Secrecy Act (“BSA”) and the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (the “USA Patriot Act”).

The Bank is subject to the BSA and the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (the “USA PATRIOT Act”).

These statutes and related rules and regulations impose requirements and limitations on specified financial transactions and accounts and other relationships intended to guard against money laundering and terrorism financing.

The principal requirements for an insured depository institution include (i) establishment of an anti-money laundering program that includes training and audit components, (ii) establishment of a “know your customer” program involving due diligence to confirm the identities of persons seeking to open accounts and to deny accounts to those persons unable to demonstrate their identities, (iii) the filing of currency transaction reports for deposits and withdrawals of large amounts of cash and suspicious activities reports for activity that might signify money laundering, tax evasion, or other criminal activities, (iv) additional precautions for accounts sought and managed for non-U.S.

persons and (v) verification and certification of money laundering risk with respect to private banking and foreign correspondent banking relationships.

persons and (v) verification and certification of money laundering risk with respect to private

banking and foreign correspondent banking relationships.

For many of these tasks a bank must keep records to be made available to its primary federal regulator.

Anti-money laundering rules and policies are developed by a bureau within FinCEN, but compliance by individual institutions is overseen by its primary federal regulator.

Anti-money laundering rules and policies are developed by a bureau within the U.S.

Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”), but compliance by individual institutions is overseen by its primary federal regulator.

The Bank has established appropriate anti-money laundering and customer identification programs.

8 unchanged sentences

Data Privacy and Cybersecurity

The GLB Act and the implementing regulations issued by federal regulatory agencies require financial institutions (including banks, insurance agencies, and broker/dealers) to adopt policies and procedures regarding the disclosure of nonpublic personal information about their customers to non-affiliated third parties.

In general, financial institutions are required to explain to customers their policies and procedures regarding the disclosure of such nonpublic personal information and, unless otherwise required or permitted by law, financial institutions are prohibited from disclosing such information except as provided in their policies and procedures.

Specifically, the GLB Act established certain information security guidelines that require each financial institution, under the supervision and ongoing oversight of its board of directors or an appropriate committee thereof, to develop, implement, and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information, to protect against anticipated threats or hazards to the security or integrity of such information, and to protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer.

Recent cyber-attacks against banks and other financial institutions that resulted in unauthorized access to confidential customer information have prompted the federal banking regulators to issue extensive guidance on cybersecurity.

Among other things, financial institutions are expected to design multiple layers of security controls to establish lines of defense and ensure that their risk management processes address the risks posed by compromised customer credentials, including security measures to authenticate customers accessing internet-based services.

A financial institution also should have a robust business continuity program to recover from a cyberattack and procedures for monitoring the security of third-party service providers that may have access to nonpublic data at the institution.

The federal bank regulatory agencies have adopted guidelines for safeguarding confidential, personal, non-public customer information.

These guidelines require each financial institution, under the supervision and ongoing oversight of its board of directors or an appropriate committee thereof, to create, implement, and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazard to the security or integrity of such information, and protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer.

We have adopted a customer information security program to comply with these requirements.

The GLB Act requires financial institutions to implement policies and procedures regarding the disclosure of non-public personal information about consumers to non-affiliated third parties.

The GLB Act requires disclosures to consumers on policies and procedures regarding the disclosure of such non-public personal information and, except as otherwise required by law, prohibit disclosing such information except as provided in the Bank’s policies and procedures.

We have implemented privacy policies addressing these restrictions that are distributed regularly to all existing and new customers of the Bank.

In March 2015, federal regulators issued two related statements regarding cybersecurity.

One statement indicates that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing Internet-based services of the financial institution.

The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack involving destructive malware.

A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack.

If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.

In November 2021, the federal bank regulatory agencies issued a joint rule establishing computer-security incident notification requirements for banking organizations and their service providers.

This rule requires new notification requirements where a banking organization experiences a computer-security incident.

State regulators have been increasingly active in implementing privacy and cybersecurity standards and regulations.

Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements.

Many states have also recently implemented or modified their data breach notification and data privacy requirements.

In June 2018, the California legislature passed the California Consumer Privacy Act of 2018 (the “California Privacy Act”), which took effect on January 1, 2020.

The California Privacy Act, which covers businesses that obtain or access personal information on California resident consumers, grants consumers enhanced privacy rights and control over their personal information and imposes significant requirements on covered companies with respect to consumer data privacy rights.

We expect this trend of state-level activity to continue, and are continually monitoring developments in the states in which we operate.

The Consumer Financial Protection Bureau

6 unchanged sentences

The Dodd-Frank Act authorizes the CFPB to establish certain minimum standards for the origination of residential mortgages, including a determination of the borrower’s ability to repay.

Under the Dodd-Frank Act and the implementing

final rule adopted by the CFPB, or the ATR/QM Rule, a financial institution may not make a residential mortgage loan to a consumer unless it first makes a “reasonable and good faith determination” that the consumer has a “reasonable ability” to repay the loan.

In addition, the ATR/QM Rule limits prepayment penalties and permits borrowers to raise certain defenses to foreclosure if they receive any loan other than a “qualified mortgage,” as defined by the CFPB.

For this purpose, the ATR/QM Rule defines a “qualified mortgage” to include a loan with a borrower debt-to-income ratio of less than or equal to 43% or, alternatively, a loan eligible for purchase by Fannie Mae or Freddie Mac while they operate under federal conservatorship or receivership, and loans eligible for insurance or guarantee by the Federal Housing Administration, Veterans Administration, or United States Department of Agriculture.

Under the Dodd-Frank Act and the implementing final rule adopted by the CFPB (the ATR/QM Rule), a financial institution may not make a residential mortgage loan to a consumer unless it first makes a “reasonable and good faith determination” that the consumer has a “reasonable ability” to repay the loan.

In addition, the ATR/QM Rule limits prepayment penalties and permits borrowers to raise certain defenses to foreclosure if the financial institution has not complied with these requirements.

The ATR/QM Rule defines a “qualified mortgage” to include a loan with a borrower debt-to-income (DTI) ratio of less than or equal to 43% or, alternatively, a loan eligible for purchase by Fannie Mae or Freddie Mac while they operate under federal conservatorship or receivership (the Fannie/Freddie QM Alternative), and loans that comply with similar ATR/QM rules established by the Federal Housing Administration, Veterans Administration, or United States Department of Agriculture.

Additionally, a qualified mortgage may not:

4 unchanged sentences

The ATR/QM Rule became effective in January 2014.

The Regulatory Relief Act provides that for certain insured depository institutions and insured credit unions with less than $10 billion in total consolidated assets, mortgage loans that are originated and retained in portfolio will automatically be deemed to satisfy the “ability to repay” requirement.

The CFPB amended the ATR/QM rule in December of 2020.

One of the amendments modifies the requirements for a loan to qualify as a QM as well as certain other provisions in the ATR/QM Rule, and eliminates the Fannie/Freddie QM Alternative.

This amendment essentially replaces the 43% DTI limit with an APR-based limitation, which for most loans requires that the loan's annual percentage rate (APR) not exceed the average prime offer rate for a comparable transaction by 2.25 percentage points or more as of the date the interest rate is set.

A second amendment creates a new class of QMs, called Seasoned QMs, which are essentially first-lien loans that could not be classified as QMs when originated for reason only that they had DTI ratios above 43%, but which have been held by the original creditor (or the first purchaser) for at least 36 months, during which time the borrower had no more than two 30-day delinquencies and no delinquencies of 60 days or more.

Both of these amendments were originally slated to become effective on March 1, 2021, but the amendment eliminating the Fannie/Freddie QM Alternative was given a mandatory compliance date of July 1, 2021 (the same date that the Fannie/Freddie QM Alternative was set to expire).

However, the mandatory compliance date for the elimination of the Fannie/Freddie QM Alternative was subsequently extended until October of 2022.

Despite this extension, Fannie and Freddie stopped buying loans, with application dates on or after July 1, 2021, that only qualified as QMs based on the Fannie/Freddie QM alternative.

The risks to lenders resulting from these amendments is as yet uncertain.

The Economic Growth, Regulatory Relief, and Consumer Protection Act enacted in 2018 (the “Regulatory Relief Act”) provides that for certain insured depository institutions and insured credit unions with less than $10 billion in total consolidated assets, mortgage loans that are originated and retained in portfolio will automatically be deemed to satisfy the “ability to repay” requirement.

To qualify for this, the insured depository institutions and credit unions must meet conditions relating to prepayment penalties, points and fees, negative amortization, interest-only features and documentation.

The Regulatory Relief Act directs Federal banking agencies to issue regulations exempting certain insured depository institutions and insured credit unions with assets of $10 billion or less from the requirement to establish escrow accounts for certain residential mortgage loans.

Insured depository institutions and insured credit unions that originated fewer than 500 closed-end mortgage loans or 500 open-end lines of credit in each of the two preceding years are exempt from a subset of disclosure requirements (recently imposed by the CFPB) under the Home Mortgage Disclosure Act (“HMDA”), provided they have received certain minimum CRA ratings in their most recent examinations.

The Regulatory Relief Act also directs Federal banking agencies to issue regulations exempting certain insured depository institutions and insured credit unions with assets of $10 billion or less from the requirement to establish escrow accounts for certain residential mortgage loans.

It also exempts insured depository institutions and insured credit unions that originated fewer than 500 closed-end mortgage loans or 500 open-end lines of credit in each of the two preceding years from a subset of disclosure requirements (recently imposed by the CFPB) under the Home Mortgage Disclosure Act (“HMDA”), provided they have received certain minimum CRA ratings in their most recent examinations.

The Regulatory Relief Act also directs the Comptroller of the Currency to conduct a study assessing the effect of the exemption described above on the amount of HMDA data available at the national and local level.

35 unchanged sentences

In addition, we must comply with privacy and data security laws and regulations at both the federal and state level.

We are heavily regulated by regulatory agencies at the federal and state levels.

The banking industry is heavily regulated by regulatory agencies at the federal and state levels.

Like most of our competitors, we have faced and expect to continue to face increased regulation and regulatory and political scrutiny, which creates significant uncertainty for us, as well as for the financial services industry in general.

2 unchanged sentences

An institution can be subject to an enforcement action due to the failure to timely file required reports, the filing of false or misleading information, or the submission of inaccurate reports, or engaging in other unsafe or unsound banking practices.

Civil penalties may be as high as $1,924,589 per day for violations.

The Financial Institution Reform Recovery and Enforcement Act provided regulators with greater flexibility to commence enforcement actions against institutions and institution-affiliated parties and to terminate an institution’s deposit insurance.

11 unchanged sentences

Among the instruments of monetary policy used by the FRB to implement these objectives are open market operations in U.S.

Government securities, changes in the federal funds rate, changes in the discount rate of member bank borrowings, and changes in reserve requirements

against member bank deposits.

Government securities, changes in the federal funds rate, changes in the discount rate of member bank borrowings, and changes in reserve requirements against member bank deposits.

These means are used in varying combinations to influence overall growth of bank loans, investments and deposits and may also affect interest rates charged on loans or paid for deposits.

6 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business