S&T BANCORP INC 10-K

Item 1. BUSINESS General S&T Bancorp, Inc. was incorporated on March 17, 1983 under the laws of the Commonwealth of Pennsylvania as a bank holding company and is registered with the Board of Governors of the Federal Reserve System, or the Federal Reserve Board, under the Bank Holding Company Act of 1956, as amended, or the BHCA, as a bank holding company and a financial holding company. S&T Bancorp, Inc. has four active direct wholly-owned subsidiaries including S&T Bank, 9th Street Holdings, Inc., STBA Capital Trust I and DNB Capital Trust II, and owns a 50 percent interest in Commonwealth Trust Credit Life Insurance Company, or CTCLIC. When used in this Report, “S&T,” “we,” “us” or “our” may refer to S&T Bancorp, Inc. individually, S&T Bancorp, Inc. and its consolidated subsidiaries or certain of S&T Bancorp, Inc.’s subsidiaries or affiliates, depending on the context. As of December 31, 2024, we had approximately $9.7 billion in assets, $7.7 billion in total loans, $7.8 billion in deposits and $1.4 billion in shareholders’ equity. S&T Bank is a full-service bank that operates in Pennsylvania and Ohio. S&T Bank deposits are insured by the Federal Deposit Insurance Corporation, or FDIC, to the maximum extent provided by law. S&T Bank has four active wholly-owned operating subsidiaries including S&T Insurance Group, LLC, S&T Bancholdings, Inc., Stewart Capital Advisors, LLC and DN Acquisition Company, Inc. Through S&T Bank and our non-bank subsidiaries, we offer consumer, commercial and small business banking services, which include accepting time and demand deposits and originating commercial and consumer loans, brokerage services and trust services including serving as executor and trustee under wills and deeds and as guardian and custodian of employee benefits. We also manage private investment accounts for individuals and institutions through our registered investment advisor. Total Wealth Management assets under administration, which are not accounted for as part of our assets, were $2.0 billion at December 31, 2024. The main office of both S&T Bancorp, Inc. and S&T Bank is located at 800 Philadelphia Street, Indiana, Pennsylvania, and our phone number is (800) 325-2265. Human Capital Management Our commitment to our customers starts with a talented team. To attract and retain our talented team, we strive to make S&T an inclusive workplace that provides our employees with opportunities to develop and grow. The S&T mindset is to encourage, develop and inspire all employees to achieve their best, motivated by their own personal progress and development. Our commitment is to foster an inclusive workplace where everyone utilizes their knowledge, skills, abilities and unique interests to help each other find success and drive positive results. S&T fosters an inclusive work culture where employees work together to better our company, products and services and community. We are committed to promoting a workplace that develops all people through ensuring fairness in all aspects of employment, educating our employees and fostering a culture to address employees’ and customers’ needs. As of December 31, 2024, we had approximately 1,206 full time equivalent employees. Our Team and Culture Our purpose is building a better future together through people-forward banking. We believe that all banking should be personal. We cultivate relationships rooted in trust, strengthened by going above and beyond and renewed with every interaction. We move banking forward, building better lives together by always putting people first. Our team strives to embody values to encourage a culture that has enabled us to be named a top workplace. The following five core values support our purpose: Make People our Purpose Humility, empathy and a sincere desire to uplift each other and our community guide our actions every day. We are people in service of people, committed to constantly improving our communication and connection and delivering the right solutions. Do the Right Thing We are built on trust and following through on our promises. We hold ourselves accountable by delivering results, continuously learning and striving for better every day. Go Above and Beyond We go as far as we possibly can to help advance the cause of our colleagues, customers and communities. In every case, we seek the right solutions based on a holistic understanding of the opportunities ahead of us. 2 Table of Contents S&T BANCORP, INC. AND SUBSIDIARIES Value Every Voice We stand for inclusivity, accessibility and opportunity. We listen for forward-looking ideas to better ourselves and improve our experience. And we always welcome an honest and open dialogue with our colleagues, customers and the community at large. Win as One Team We function as one connected team working together to deliver a seamless experience. We communicate, collaborate and care enough to go the extra mile for the colleagues we work alongside, the customers we serve and the communities where we live. Talent Development and Training S&T strives to provide our employees access to comprehensive training to enhance all job positions. Our corporate training department maintains oversight of trainings to ensure it is implemented and monitored properly and encourages career development for our employees. Our training programs offer a blended learning approach comprised of classroom, asynchronous online learning and synchronous online sessions. Our learning management systems and vendor relationships provide employees regulatory, compliance, skill-based, technology, leadership and career development trainings. We encourage all employees to develop their skill sets and careers through a variety of internal and external training opportunities to align our organization for long-term success. We are dedicated to investing in and developing our managers, supervisors and future leaders of S&T. Our multi-tier succession plan includes replacement planning of vacancies, ongoing talent development and career path design of current employees. Additional resources that support these initiatives include S&T's annual training and recruitment plans that identify specific actionable programs and efforts. In 2024, our employees logged approximately 77,290 training hours, on average 64 hours per employee. Safety, Health and Wellness The safety, health and well-being of our employees is a top priority. We offer our employees and their families access to a variety of flexible and convenient health and welfare programs that provide resources to help them maintain and/or improve their physical and mental health. We also have a financial wellness program that assists our employees and their families with budgeting and various personal financial content consisting of an online personal financial program and internally produced webinars. We believe in the education and offering of programs and initiatives that make lasting positive impacts in the lives of our employees. Access to United States Securities and Exchange Commission Filings All of our reports filed electronically with the United States Securities and Exchange Commission, or the SEC, including this Annual Report on Form 10-K for the fiscal year ended December 31, 2024, our prior annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and our annual proxy statements, as well as any amendments to those reports, are accessible at no cost on our website at www.stbancorp.com under Financials, SEC Filings. These filings are also accessible on the SEC’s website at www.sec.gov. The charters of the Audit Committee, the Compensation and Benefits Committee, the Credit Risk Committee, the Executive Committee, the Nominating and Corporate Governance Committee and the Risk Committee as well as the Complaints Regarding Accounting, Internal Accounting Controls or Auditing Matters ("Whistleblower Policy"), the Code of Conduct for the CEO and CFO, the General Code of Conduct, the Shareholder Communications Policy and the Corporate Governance Guidelines are also available at www.stbancorp.com under Governance. Supervision and Regulation General S&T is extensively regulated under federal and state law. Regulation of bank holding companies and banks is intended primarily for the protection of consumers, depositors, borrowers, the Federal Deposit Insurance Fund, or DIF, and the banking system as a whole, and not for the protection of shareholders or creditors. The following describes certain aspects of that regulation and does not purport to be a complete description of all regulations that affect S&T, or all aspects of any regulation discussed here. To the extent statutory or regulatory provisions are described, the description is qualified in its entirety by reference to the particular statutory or regulatory provisions. The discussion of the regulations applicable to S&T provided below is based on our status as an institution with less than $10 billion in assets. If S&T’s assets cross the $10 billion threshold, we will be subject to different and additional regulations than those described below. 3 Table of Contents S&T BANCORP, INC. AND SUBSIDIARIES The Dodd-Frank Wall Street Reform and Consumer Protection Act, or Dodd-Frank Act, enacted in July 2010, has had and will continue to have a broad impact on the financial services industry, including significant regulatory and compliance changes addressing, among other things: (i) enhanced resolution authority of troubled and failing banks and their holding companies; (ii) increased capital and liquidity requirements; (iii) increased regulatory examination fees; (iv) changes to assessments to be paid to the FDIC for federal deposit insurance; (v) enhanced corporate governance and executive compensation requirements and disclosures; and (vi) numerous other provisions designed to improve supervision and oversight of, and strengthen safety and soundness for, the financial services sector. Additionally, the Dodd-Frank Act established a new framework for systemic risk oversight within the financial system to be distributed among new and existing federal regulatory agencies, including the Financial Stability Oversight Council, the Federal Reserve Board, or FRB, the Office of the Comptroller of the Currency, or OCC, and the FDIC. While many requirements called for in the Dodd-Frank Act have been implemented, these regulations are subject to continuing interpretation and potential amendment. Given the continued uncertainty associated with the ongoing implementation of the requirements of the Dodd-Frank Act by the various regulatory agencies, including the manner in which the remaining provisions will be implemented and the interpretation of and potential amendments to existing regulations, the full extent of the impact of such requirements on financial institutions’ operations remains unclear, but management expects will continue to affect us in some way. The continuing changes resulting from the Dodd-Frank Act may impact the profitability of our business activities, require changes to business practices, increase our operating and compliance costs, or otherwise adversely affect our business. These changes may also require us to invest significant management attention and resources to evaluate and make necessary changes in order to comply with new statutory and regulatory requirements. In addition, proposals to change the laws and regulations governing the banking industry are frequently raised in Congress, in state legislatures and before the various bank regulatory agencies that may impact S&T. Such initiatives to change the laws and regulations may include proposals to expand or contract the powers of bank holding companies and depository institutions or proposals to substantially change the financial institution regulatory system. Any such legislation could change bank statutes and our operating environment in substantial and unpredictable ways. If enacted, such legislation could affect how S&T and S&T Bank operate and could significantly increase costs, impede the efficiency of internal business processes, limit our ability to pursue business opportunities in an efficient manner, or affect the competitive balance among banks, credit unions and other financial institutions, any of which could materially and adversely affect our business, financial condition and results of operations. The likelihood and timing of any changes and the impact such changes might have on S&T is impossible to determine with any certainty. S&T We are a bank holding company subject to regulation under the BHCA and the examination and reporting requirements of the FRB. Under the BHCA, a bank holding company may not directly or indirectly acquire ownership or control of more than five percent of the voting shares or substantially all of the assets of any additional bank, or merge or consolidate with another bank holding company, without the prior approval of the FRB. As a bank holding company, we are expected under statutory and regulatory provisions to serve as a source of financial and managerial strength to our subsidiary bank. A bank holding company is also expected to commit resources, including capital and other funds, to support its subsidiary bank. We elected to become a financial holding company under the BHCA in 2001 and thereby may engage in a broader range of financial activities than are permissible for traditional bank holding companies. In order to maintain our status as a financial holding company, we must remain “well-capitalized” and “well-managed” and the depository institutions controlled by us must remain “well-capitalized,” “well-managed” (as defined in federal law) and have at least a “satisfactory” Community Reinvestment Act, or CRA, rating. Refer to Note 23. Regulatory Matters to the consolidated financial statements contained in Part II, Item 8 of this Report for information concerning the current capital ratios of S&T and S&T Bank. No prior regulatory approval is required for a financial holding company with total consolidated assets less than $50 billion to acquire a company, other than a bank or savings association, engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the FRB, unless the total consolidated assets to be acquired exceed $10 billion. The BHCA identifies several activities as “financial in nature” including, among others, securities underwriting; dealing and market making; sponsoring mutual funds and investment companies; insurance underwriting and sales agency; investment advisory activities; merchant banking activities and activities that the FRB has determined to be closely related to banking. Banks may also engage in, subject to limitations on investment, activities that are financial in nature, other than insurance underwriting, insurance company portfolio investment, real estate development and real estate investment, through a financial subsidiary of the bank, if the bank is “well-capitalized,” “well-managed” and has at least a “satisfactory” CRA rating. If S&T or S&T Bank ceases to be “well-capitalized” or “well-managed,” we will not be in compliance with the requirements of the BHCA regarding financial holding companies or requirements regarding the operation of financial subsidiaries by insured banks. 4 Table of Contents S&T BANCORP, INC. AND SUBSIDIARIES If a financial holding company is notified by the FRB of such a change in the ratings of any of its subsidiary banks, it must take certain corrective actions within specified time frames. Furthermore, if S&T Bank was to receive a CRA rating of less than “satisfactory,” then we would be prohibited from engaging in certain new activities or acquiring companies engaged in certain financial activities until the rating is raised to “satisfactory” or better. We are presently engaged in non-banking activities through the following six entities: • 9 th Street Holdings, Inc. was formed in June 1988 to hold and manage a group of investments previously owned by S&T Bank and to give us additional latitude to purchase other investments. • S&T Bancholdings, Inc. was formed in August 2002 to hold and manage a group of investments previously owned by S&T Bank and to give us additional latitude to purchase other investments. • CTCLIC is a joint venture with another financial institution, and acts as a reinsurer of credit life, accident and health insurance policies that were sold by S&T Bank and the other institution. S&T Bank and the other institution each have ownership interests of 50 percent in CTCLIC. • S&T Insurance Group, LLC distributes life insurance and long-term disability income insurance products. During 2001, S&T Insurance Group, LLC and Attorneys Abstract Company, Inc. entered into an agreement to form S&T Settlement Services, LLC, or STSS, with respective ownership interests of 55 percent and 45 percent. STSS is a title insurance agency servicing commercial customers. We also have a 30 percent partnership interest in Evergreen Insurance, LLC. • Stewart Capital Advisors, LLC was formed in August 2005 and is a registered investment advisor that manages private investment accounts for individuals and institutions. • DN Acquisition Company, Inc. was acquired with the DNB First merger on November 30, 2019. DN Acquisition Company, Inc. was formed to acquire and hold Other Real Estate Owned acquired through foreclosure or deed in-lieu-of foreclosure, as well as Bank-occupied real estate. S&T Bank As a Pennsylvania-chartered, FDIC-insured non-member commercial bank, S&T Bank is subject to the supervision and regulation of the Pennsylvania Department of Banking and Securities, or PADBS, and the FDIC. We are also subject to various requirements and restrictions under federal and state law, including requirements to maintain reserves against deposits, restrictions on the types, amount and terms and conditions of loans that may be granted and limits on the types of other activities in which S&T Bank may engage and the investments it may make. In addition, pursuant to the Federal Bank Merger Act, S&T Bank must obtain the prior approval of the FDIC before it can merge or consolidate with or acquire the assets or assume the deposit liabilities of another bank. S&T Bank is subject to affiliate transaction rules in Sections 23A and 23B of the Federal Reserve Act as implemented by the FRB's Regulation W, that limit the amount of transactions between itself and S&T or any other company or entity that controls or is under common control with any company or entity that controls S&T Bank, including for most purposes any financial or depository institution subsidiary of S&T Bank. Under these provisions, “covered” transactions, including making loans, purchasing assets, issuing guarantees and other similar transactions, between a bank and its parent company or any other affiliate, generally are limited to 10 percent of the bank subsidiary’s capital and surplus, and with respect to all transactions with affiliates, are limited to 20 percent of the bank subsidiary’s capital and surplus. Loans and extensions of credit from a bank to an affiliate generally are required to be secured by eligible collateral in specified amounts, and in general all affiliated transactions must be on terms consistent with safe and sound banking practices. Furthermore, in general, transactions between a bank and its affiliates must be on terms and conditions that are at least as favorable to the bank as the terms that would apply in comparable transactions between the bank and a third party. The Dodd-Frank Act expanded the affiliate transaction rules to broaden the definition of affiliate to include as covered transactions securities borrowing or lending, repurchase or reverse repurchase agreements and derivative activities, and to strengthen collateral requirements and limit Federal Reserve exemptive authority. Federal law also constrains the types and amounts of loans that S&T Bank may make to its executive officers, directors and principal shareholders. Among other things, these loans are limited in amount, must be approved by the bank’s board of directors in advance, and must be on terms and conditions as favorable to the bank as those available to an unrelated person. The Dodd-Frank Act strengthened restrictions on loans to insiders and expanded the types of transactions subject to the various limits to include credit exposure arising from a derivative transaction, a repurchase or reverse repurchase agreement and a securities lending or borrowing transaction. The Dodd-Frank Act also placed restrictions on certain asset sales to and from an insider to an institution, including requirements that such sales be on market terms and, in certain circumstances, approved by the institution’s board of directors. 5 Table of Contents S&T BANCORP, INC. AND SUBSIDIARIES Insurance of Accounts; Depositor Preference The deposits of S&T Bank are insured up to applicable limits per insured depositor by the Deposit Insurance Fund, or DIF, as administered by the FDIC. The Dodd-Frank Act codified FDIC deposit insurance coverage per separately insured depositor for all account types at $250,000. As an FDIC-insured bank, S&T Bank is subject to FDIC insurance assessments, which are imposed based upon the calculated risk the institution poses to the DIF. Under the current assessment system, for an institution with less than $10 billion in assets, assessment rates are determined based on a combination of financial ratios and CAMELS (capital adequacy, asset quality, management, earnings, liquidity and sensitivity) composite ratings. The assessment rate schedule can change from time to time, at the discretion of the FDIC, subject to certain limits. Under the current system, premiums are assessed quarterly. Assessments are calculated as a percentage of average consolidated total assets less average tangible equity during the assessment period. As part of its semiannual update of the restoration plan established by the FDIC to facilitate restoration of the reserve ratio of the DIF to the statutory minimum in the mandated time frame, the FDIC adopted a final rule in October 2022. The new rule, applicable to all insured depository institutions, increased the initial base deposit insurance assessment rate schedules uniformly by 2 basis points, beginning in the first quarterly assessment period of 2023 (January 1 through March 31, 2023). The increase in assessment rate schedules is intended to increase the likelihood that the reserve ratio of the DIF reaches the statutory minimum of 1.35 percent by the statutory deadline of September 30, 2028. Second, the proposed change in assessment rates is further intended to support growth in the DIF in progressing toward the 2 percent Designated Reserve Ratio, or DRR, established by the FDIC. The FDIC has indicated that the new assessment rate schedules will remain in effect unless and until the DRR meets or exceeds 2 percent, absent further FDIC action. Under the new rule, the total base assessment rates on an annualized basis range from 2.5 basis points for certain “well-capitalized,” “well-managed” banks, with the highest ratings, to 42 basis points for complex institutions posing the most risk to the DIF compared to the 2022 rates that ranged from 1.5 to 40. S&T’s total assets were below $10 billion at December 31, 2024. In November 2023, the FDIC approved a final rule to implement special assessments to recover the loss to the DIF associated with protecting uninsured depositors following the closures of Silicon Valley Bank and Signature Bank. The assessment base for the special assessment is equal to estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion. The special assessment will be collected at an annual rate of approximately 13.4 basis points for an anticipated total of eight quarterly assessment periods, beginning in the first quarterly assessment period of 2024 (January 1 through March 31, 2024). Because the Bank's uninsured deposits were below $5 billion at December 31, 2022, this special assessment is not applicable to S&T. The FDIC may terminate the deposit insurance of any insured depository institution if it determines, after hearing that the institution has engaged in unsafe or unsound practices, that the institution is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC or the FRB. It also may suspend deposit insurance temporarily during the hearing process if the institution has no tangible capital. If insurance of accounts is terminated, the accounts at the institution at the time of termination, less subsequent withdrawals, will continue to be insured for a period of six months to two years, as determined by the FDIC. Under federal law, deposits and certain claims for administrative expenses and employee compensation against insured depository institutions are afforded a priority over other general unsecured claims against such an institution, including federal funds and letters of credit, in the liquidation or other resolution of such an institution by a receiver. Such priority creditors would include the FDIC. 6 Table of Contents S&T BANCORP, INC. AND SUBSIDIARIES Capital The FRB and the FDIC have issued substantially similar minimum risk-based and leverage capital rules applicable to the banking organizations they supervise. On December 31, 2024, both S&T and S&T Bank met the applicable minimum regulatory capital requirements. The following table summarizes the leverage and risk-based capital ratios for S&T and S&T Bank: Actual Minimum Regulatory Capital Requirements To be Well Capitalized Under Prompt Corrective Action Provisions (dollars in thousands) Amount Ratio Amount Ratio Amount Ratio As of December 31, 2024 Leverage Ratio S&T $ 1,112,126 11.98 % $ 371,211 4.00 % $ 464,014 5.00 % S&T Bank 1,060,010 11.43 % 371,002 4.00 % 463,752 5.00 % Common Equity Tier 1 (to Risk-Weighted Assets) S&T 1,088,126 14.58 % 335,888 4.50 % 485,172 6.50 % S&T Bank 1,060,010 14.21 % 335,722 4.50 % 484,932 6.50 % Tier 1 Capital (to Risk-Weighted Assets) S&T 1,112,126 14.90 % 447,851 6.00 % 597,134 8.00 % S&T Bank 1,060,010 14.21 % 447,629 6.00 % 596,839 8.00 % Total Capital (to Risk-Weighted Assets) S&T 1,230,497 16.49 % 597,134 8.00 % 746,418 10.00 % S&T Bank 1,178,335 15.79 % 596,839 8.00 % 746,049 10.00 % The banking regulatory agencies may from time to time require that a banking organization maintain capital above the minimum prescribed levels, whether because of its financial condition or actual or anticipated growth. The risk-based capital standards establish a systematic, analytical framework that makes regulatory capital requirements more sensitive to differences in risk profiles among banking organizations, takes off-balance sheet exposures explicitly into account in assessing capital adequacy and minimizes disincentives to holding liquid, low-risk assets. For purposes of the risk-based ratios, assets and specified off-balance sheet instruments are assigned to broad risk categories, each with appropriate weights. The resulting capital ratios represent capital as a percentage of total risk-weighted assets and off-balance sheet items. The leverage ratio represents capital as a percentage of total average assets adjusted as specified in the guidelines. Generally, under the guidelines, common equity Tier 1 capital consists of common stock instruments that meet the eligibility criteria in the rule, retained earnings, accumulated other comprehensive income and common equity Tier 1 minority interest, less applicable regulatory adjustments and deductions including goodwill, intangible assets subject to limitation and certain deferred tax assets subject to limitation. Tier 1 capital is comprised of common equity Tier 1 capital plus generally non-cumulative perpetual preferred stock, Tier 1 minority interests and, for bank holding companies with less than $15 billion in consolidated assets at December 31, 2009, certain restricted capital instruments including qualifying cumulative perpetual preferred stock and grandfathered trust preferred securities, up to a limit of 25 percent of Tier 1 capital, less applicable regulatory adjustments and deductions. Tier 2, or supplementary, capital generally includes portions of trust preferred securities and cumulative perpetual preferred stock not otherwise counted in Tier 1 capital, as well as preferred stock, subordinated debt, total capital minority interests not included in Tier 1, and the allowance for credit losses, or ACL, in an amount not exceeding 1.25 percent of standardized risk-weighted assets, less applicable regulatory adjustments and deductions. Total capital is the sum of Tier 1 and Tier 2 capital. The regulatory capital rules also require a banking organization to maintain a capital conservation buffer composed of common equity Tier 1 capital in an amount greater than 2.50 percent of total risk-weighted assets beginning in 2019. As a result, since 2019, a banking organization has been required to maintain a common equity Tier 1 risk-based capital ratio greater than 7.00 percent, a Tier 1 risk-based capital ratio greater than 8.50 percent and a Total risk-based capital ratio greater than 10.50 percent; otherwise, it will be subject to restrictions on capital distributions and discretionary bonus payments. Since 2019, the minimum capital requirements plus the capital conservation buffer exceed the regulatory capital ratios required for an insured depository institution to be well-capitalized under prompt corrective action law, described in "Other Safety and Soundness Regulations." Federal regulators periodically propose amendments to the regulatory capital rules and the related regulatory framework and consider changes to the capital standards that could significantly increase the amount of capital needed to meet applicable standards. The timing of adoption, ultimate form and effect of any such proposed amendments cannot be predicted. 7 Table of Contents S&T BANCORP, INC. AND SUBSIDIARIES Payment of Dividends S&T is a legal entity separate and distinct from its banking and other subsidiaries. A substantial portion of our revenues consist of dividend payments we receive from S&T Bank. The payment of common dividends by S&T is subject to certain requirements and limitations of Pennsylvania law. S&T Bank, in turn, is subject to federal and state laws and regulations that limit the amount of dividends it can pay to S&T. In addition, both S&T and S&T Bank are subject to various general regulatory policies relating to the payment of dividends, including requirements to maintain adequate capital above regulatory minimums. The FRB has indicated that banking organizations should generally pay dividends only if (i) the organization’s net income available to common shareholders over the past year has been sufficient to fully fund the dividends and (ii) the prospective rate of earnings retention appears consistent with the organization’s capital needs, asset quality and overall financial condition. Thus, under certain circumstances based upon our financial condition, our ability to declare and pay quarterly dividends may require consultation with the FRB and may be prohibited by applicable FRB guidance. Other Safety and Soundness Regulations There are a number of obligations and restrictions imposed on bank holding companies such as us and our depository institution subsidiary by federal law and regulatory policy. These obligations and restrictions are designed to reduce potential loss exposure to the FDIC’s DIF in the event an insured depository institution becomes in danger of default or is in default. Under current federal law, for example, the federal banking agencies possess broad powers to take prompt corrective action to resolve problems of insured depository institutions. The extent of these powers depends upon whether the institution in question is “well-capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” or “critically undercapitalized,” as defined by the law. As of December 31, 2024, S&T Bank was classified as “well-capitalized.” Refer to the above section titled Capital within this Item 1. Business section for capital requirements. The classification of depository institutions is primarily for the purpose of applying the federal banking agencies’ prompt corrective action provisions and is not intended to be and should not be interpreted as a representation of overall financial condition or prospects of any financial institution. The federal banking agencies’ prompt corrective action powers, which increase depending upon the degree to which an institution is undercapitalized, can include, among other things, requiring an insured depository institution to adopt a capital restoration plan, which cannot be approved unless guaranteed by the institution’s parent company; placing limits on asset growth and restrictions on activities, including restrictions on transactions with affiliates; restricting the interest rates the institution may pay on deposits; restricting the institution from accepting brokered deposits; prohibiting the payment of principal or interest on subordinated debt; prohibiting the holding company from making capital distributions, including payment of dividends, without prior regulatory approval; and, ultimately, appointing a receiver for the institution. The federal banking agencies have also adopted guidelines prescribing safety and soundness standards relating to internal controls and information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, fees and compensation and benefits. In general, the guidelines require appropriate systems and practices to identify and manage specified risks and exposures. The guidelines prohibit excessive compensation as an unsafe and unsound practice and characterize compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal shareholder. In addition, the agencies have adopted regulations that authorize, but do not require, an agency to order an institution that has been given notice by an agency that it is not in compliance with any of such safety and soundness standards to submit a compliance plan. If, after being so notified, an institution fails to submit an acceptable compliance plan, the agency must issue an order directing action to correct the deficiency and may issue an order directing other actions of the types to which an “undercapitalized” institution is subject under the prompt corrective action provisions described above. Regulatory Enforcement Authority The enforcement powers available to federal banking agencies are substantial and include, among other things and in addition to other powers described herein, the ability to assess civil money penalties and impose other civil and criminal penalties, to issue cease-and-desist or removal orders, to appoint a conservator to conserve the assets of an institution for the benefit of its depositors and creditors and to initiate injunctive actions against banks and bank holding companies and “institution affiliated parties,” as defined in the Federal Deposit Insurance Act. In general, these enforcement actions may be initiated for violations of laws and regulations, and engagement in unsafe or unsound practices. Other actions or inactions may provide the basis for enforcement action, including misleading or untimely reports filed with regulatory authorities. At the state level, the PADBS also has broad enforcement powers over S&T Bank, including the power to impose fines and other penalties and to appoint a conservator or receiver. 8 Table of Contents S&T BANCORP, INC. AND SUBSIDIARIES Interstate Banking and Branching The BHCA currently permits bank holding companies from any state to acquire banks and bank holding companies located in any other state, subject to certain conditions, including certain nationwide and state-imposed deposit concentration limits. In addition, because of changes to law made by the Dodd-Frank Act, S&T Bank may now establish de novo branches in any state to the same extent that a bank chartered in that state could establish a branch. Community Reinvestment, Fair Lending and Consumer Protection Laws In connection with its lending activities, S&T Bank is subject to a number of state and federal laws and regulations designed to protect consumers and promote lending to various sectors of the economy and population. The federal laws include, among others, the Equal Credit Opportunity Act, the Truth-in-Lending Act, the Truth-in-Savings Act, the Home Mortgage Disclosure Act, the Real Estate Settlement Procedures Act, the Fair Credit Reporting Act and the CRA. In addition, federal rules require disclosure of privacy policies to consumers. The purpose of the CRA is to help address inequities in credit access for low and moderate-income (LMI) individuals and communities. It is designed to encourage regulated banks to help meet the credit needs of the local communities in which they are chartered. The FRB, the FDIC and the OCC implement the CRA through their CRA regulations, which establish the framework for how the agencies assess a bank’s record of helping to meet the credit needs of the communities that they serve, including LMI neighborhoods, consistent with safe and sound operations. The CRA requires the appropriate federal banking agency, in connection with its examination of a bank, to assess the bank’s record in meeting the credit needs of the communities served by the bank, including LMI neighborhoods. Furthermore, such assessment is required of any bank that has applied, among other things, to merge or consolidate with or acquire the assets or assume the liabilities of an insured depository institution, or to open or relocate a branch office. In the case of a bank holding company, including a financial holding company, applying for approval to acquire a bank or bank holding company, the FRB will assess the record of each subsidiary bank of the applicant bank holding company in considering the application. Under the CRA, institutions are assigned a rating of “outstanding,” “satisfactory,” “needs to improve” or “unsatisfactory.” S&T Bank was rated “satisfactory” in its most recent CRA performance evaluation. More recently, on October 24, 2023, the FDIC, OCC and FRB jointly issued a final rule to the CRA designed to strengthen and modernize the regulations implementing the CRA. The changes are designed to encourage banks to expand access to credit, investment and banking services in LMI communities, adapt to changes in the banking industry, including mobile and internet banking, provide greater clarity and consistency in the application of the CRA regulations and tailor CRA evaluations and data collection to bank size and type. Most of the final rule’s requirements will be applicable beginning in January 2026, while the remaining requirements, including data reporting requirements, will be applicable in January 2027. With respect to consumer protection, the Dodd-Frank Act created the Consumer Financial Protection Bureau, or the CFPB, which took over rulemaking responsibility on July 21, 2011 for the principal federal consumer financial protection laws, such as those identified above. Institutions that have assets of $10 billion or less, such as S&T Bank, are subject to the rules established by the CFPB, but will continue to be supervised in this area by their state and primary federal regulators, which in the case of S&T Bank is the FDIC. Fair lending laws prohibit discrimination in the provision of bank's lending practices, and the enforcement of these laws has been a focus for bank regulators. Fair lending laws include the Equal Credit Opportunity Act and the Fair Housing Act, which outlaw discrimination in credit transactions and residential real estate on the basis of prohibited factors including, among others, race, color, national origin, sex and religion. A lender may be liable for policies that result in a disparate treatment of or have a disparate impact on a protected class of applicants or borrowers. If a pattern or practice of lending discrimination is alleged by a regulator, then that agency is required to refer the matter to the U.S. Department of Justice, or DOJ, for investigation. S&T Bank is required to have a fair lending program that is of sufficient scope to monitor the inherent fair lending risk of the institution and that appropriately remediates issues which are identified. 9 Table of Contents S&T BANCORP, INC. AND SUBSIDIARIES During 2013, the CFPB issued a series of final rules related to mortgage loan origination and mortgage loan servicing, which became effective in 2014. In particular, on January 10, 2013, the CFPB issued a final rule implementing the ability-to-repay and qualified mortgage (QM) provisions of the Truth-in-Lending Act, as amended by the Dodd-Frank Act (“QM Rule.”) The ability-to-repay provision requires creditors to make reasonable, good-faith determinations that borrowers are able to repay their mortgage loans before extending the credit, based on a number of factors and consideration of financial information about the borrower from reasonably reliable third party documents. Under the Dodd-Frank Act and the QM Rule, loans meeting the definition of “qualified mortgage” are entitled to a presumption that the lender satisfied the ability-to-repay requirements. The presumption is a conclusive presumption/safe harbor for prime loans meeting the QM requirements, and a rebuttable presumption for higher-priced/subprime loans meeting the QM requirements. The QM Rule also adds an explicit maximum 43 percent debt-to-income ratio (DTI) for borrowers if the loan is to meet the QM definition, though some mortgages that meet government-sponsored enterprise, or GSE, Federal Housing Administration, or FHA, and Veterans Affairs, or VA, underwriting guidelines may, for a period not to exceed seven years, meet the QM definition without being subject to the 43 percent DTI limits (GSE Patch). In December 2020, the CFPB published a final rule that replaced the 43 percent DTI ratio limit in the general QM definition (the “General QM Rule”) with a limit based on the loan’s pricing. The final rule also created a new category of qualified mortgage, called a seasoned qualified mortgage, for first lien, fixed rate covered loans that meet certain performance requirements, are held in the portfolio of the originating creditor or first purchaser for a 36-month period, comply with general restrictions on product features and points and fees, and meet certain underwriting requirements. The compliance date of the final rules was October 1, 2022. These rules did not have a material impact on our mortgage business. Anti-Money Laundering Rules S&T Bank is subject to the Bank Secrecy Act, its implementing regulations and other anti-money laundering laws and regulations, including the USA Patriot Act of 2001. Among other things, these laws and regulations require S&T Bank to take steps to prevent the bank from being used to facilitate the flow of illegal or illicit money, to report large currency transactions and to file suspicious activity reports. S&T Bank is also required to develop and implement a comprehensive anti-money laundering compliance program. Banks must also have in place appropriate “know your customer” policies and procedures which includes requirements to (1) identify and verify, subject to certain exceptions, the identity of the beneficial owners of all legal entity customers at the time a new account is opened, and (2) include in its anti-money laundering program, risk-based procedures for conducting ongoing customer due diligence, which are to include procedures that (a) assist in understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile, and (b) require ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information. Violations of these requirements can result in substantial civil and criminal sanctions. In addition, provisions of the USA Patriot Act of 2001 require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s anti-money laundering activities when considering applications for bank mergers and bank holding company acquisitions. Other Dodd-Frank Provisions In December 2013, federal regulators adopted final regulations regarding the Volcker Rule established in the Dodd-Frank Act. The Volcker Rule generally prohibits banks and their affiliates from engaging in proprietary trading and investing in and sponsoring certain unregistered investment companies generally covering hedge funds and private equity funds, subject to certain exemptions. Banking entities had until July 21, 2017 to conform their activities to the requirements of the rule. Since S&T generally does not engage in the activities prohibited by the Volcker Rule, the effectiveness of the rule has not had a material effect on S&T Bank or its affiliates. In addition, the Dodd-Frank Act provides that the amount of any interchange fee charged for electronic debit transactions by debit card issuers having assets over $10 billion must be reasonable and proportional to the actual cost of a transaction to the issuer. The FRB has adopted a rule which limits the maximum permissible interchange fees that such issuers can receive for an electronic debit transaction. This rule, Regulation II, was effective October 1, 2011, and then amended on October 3, 2022 to require debit card issuers to provide at least two unaffiliated payment card networks to process card-not-present debit card transactions. Regulation II does not apply to a bank that, together with its affiliates, has less than $10 billion in assets, which includes S&T. Cybersecurity We are subject to a variety of regulatory expectations and requirements regarding cybersecurity and data privacy. Federal regulators have issued statements regarding cybersecurity addressing the controls that financial institutions should design and business continuity planning and recovery processes that should be in place. Additionally, the FDIC, OCC and FRB issued a final rule that became effective in May 2022, requiring banking organizations that experience a computer-security incident to notify certain entities and its federal regulator of the computer-security incident as soon as possible and no later than 36 hours after the bank determines a computer-security incident has occurred. This rule also requires banking organizations to notify 10 Table of Contents S&T BANCORP, INC. AND SUBSIDIARIES their customers of a computer-security incident that has caused, or is reasonably likely to cause, a material service disruption or degradation for four or more hours. Moreover, in March 2022, the Cyber Incident Reporting for Critical Infrastructure Act, or CIRCIA, was enacted and once final rules are adopted, will require certain covered entities to report a covered cyber incident to the U.S. Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency, or CISA, within 72 hours after a covered entity reasonably believes an incident has occurred. Separate reporting to CISA will also be required within 24 hours if a ransom payment is made as a result of a ransomware attack. In April 2024, the CISA issued proposed rules under the CIRCIA that would clarify the scope of cyber incidents to be reported and would further define covered entities subject to the CIRCIA. Public comments were due in July 2024 and the final rules are expected to be adopted later in 2025. Furthermore, in September 2023, the SEC’s Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure rules went into effect requiring, among other disclosure obligations, companies to publicly disclose the occurrence of a material cybersecurity incident, including the material aspects of the nature, scope and timing of the incident and the material impact on the company including financial condition and results of operation beginning with any material cybersecurity incidents occurring on or after December 18, 2023. State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations, including data breach notification requirements. We actively monitor developments regarding regulatory expectations and federal and state requirements with respect to cybersecurity and data breach notifications. Competition S&T Bank competes with other local, regional and national financial services providers, such as other financial holding companies, commercial banks, credit unions, finance companies, brokerage and insurance firms and financial technology companies, including competitors that provide their products and services online and through mobile devices. Some of our competitors are not subject to the same level of regulation and oversight that is required of banks and bank holding companies and are thus able to operate under lower cost structures. Our wealth management business competes with trust companies, mutual fund companies, investment advisory firms, law firms, brokerage firms and other financial services companies. Changes in bank regulation, such as changes in the products and services banks can offer and permitted involvement in non-banking activities by bank holding companies, as well as bank mergers and acquisitions, can affect our ability to compete with other financial services providers. Our ability to do so will depend upon how successfully we can respond to the evolving competitive, regulatory, technological and demographic developments affecting our operations. Our customers are primarily in Pennsylvania and the contiguous states of Ohio, New York, West Virginia, New Jersey, Delaware and Maryland. The majority of our commercial and consumer loans are made to businesses and individuals in these states resulting in a geographic concentration. Our market area has a high density of financial institutions, some of which are significantly larger institutions with greater financial resources than us, and many of which are our competitors to varying degrees. Our competition for loans comes principally from commercial banks, mortgage banking companies, credit unions, online lenders and other financial service companies. Our most direct competition for deposits has historically come from commercial banks and credit unions. We face additional competition for deposits from non-depository competitors such as the mutual fund industry, securities and brokerage firms, insurance companies and financial technology companies. Since larger competitors have advantages in attracting business from larger corporations, we do not generally attempt to compete for that business. Instead, we concentrate our efforts on attracting the business of individuals, and small and medium-size businesses. We consider our competitive advantages to be customer service and responsiveness to customer needs, the convenience of banking offices and hours, access to electronic banking services and the availability and pricing of our customized banking solutions. We emphasize personalized banking and the advantage of local decision-making in our banking business. The financial services industry is likely to become more competitive as further technological advances enable more companies to provide financial services on a more efficient and convenient basis. Technological innovations have lowered traditional barriers to entry and enabled many companies to compete in financial services markets. Many customers now expect a choice of banking options for the delivery of services, including traditional banking offices, telephone, internet, mobile, ATMs, self-service branches, in-store branches and/or digital and technology based solutions. These delivery channels are offered by traditional banks and savings associations, credit unions, brokerage firms, asset management groups, financial technology companies, finance and insurance companies, internet-based companies and mortgage banking firms.