What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2024-02-29 compared with 2023-03-01 · 151 added, 136 removed, 193 unchanged (60% of the section changed)

8 unchanged sentences

In addition, TriCo has five capital trusts, which are all wholly-owned trust subsidiaries formed for the purpose of issuing trust preferred securities (“Trust Preferred Securities”) and lending the proceeds to TriCo.

For more information regarding the trust preferred securities please refer to “Note 14 – Junior Subordinated Debt” to the financial statements at Item 8 of this report.

For more information regarding the trust preferred securities please refer to “Note 14 – Junior Subordinated Debt” to the consolidated financial statements at Part II, Item 8 of this report.

Additional Information

Our executive offices are located at 63 Constitution Drive, Chico, California 95973, and our telephone number is (530) 898-0300.

Additional information concerning the Company can be found on our website at www.tcbk.com.

6 unchanged sentences

The Bank focuses on relationships and personal contact, emphasizing its Service with Solutions ®.

In addition to its California community bank network, the Bank provides advanced online and mobile banking, a shared nationwide network of over 37,000 ATMs, and bankers available by phone 7 days per week.

In addition to its California community bank network, the Bank provides advanced online and mobile banking, a shared nationwide network of over 40,000 surcharge-free ATMs, and bankers available by phone 7 days per week.

The Bank provides a breadth of personal, small business and commercial financial services including accepting demand, savings and time deposits and making small business, commercial, real estate, and consumer loans, as well as a range of treasury management services and other customary banking services including safe deposit boxes at some branches.

2 unchanged sentences

In many instances the owners or stakeholders of the business and commercial customers are also personal customers.

The industries that we serve are diverse in both number and type and include, but are not limited to, manufacturing, real estate development, retail, wholesale, transportation, agriculture, commerce, and professional services.

The majority of the Bank’s loans are direct loans made to individuals and businesses in California where its branches or business lending centers are located.

At December 31, 2022, the Bank’s consumer loans net of deferred fees outstanding were $1,240,743,000 (19.2%), commercial and industrial loans outstanding were $569,921,000 (8.8%), real estate construction loans of $211,560,000 (3.3%), and commercial real estate loans were $4,359,083,000 (67.6%) of total loans.

At December 31, 2023, the Bank’s consumer loans net of deferred fees outstanding were $1.3 billion (19.3%), commercial and industrial loans outstanding were $586.5 million (8.6%), real estate construction loans of $347.2 million (5.1%), and commercial real estate loans were $4.4 billion (64.7%) of total loans.

The Bank takes real estate, listed and unlisted securities, savings and time deposits, automobiles, machinery, equipment, inventory, accounts receivable and notes receivable secured by property as collateral for loans.

Most of the Bank’s deposits are attracted from individuals and business-related sources.

Most of the Bank’s deposits are from individuals and business-related sources.

No single person or group of persons provides a material portion of the Bank’s deposits, the loss of any one or more of which would have a materially adverse effect on the business of the Bank, nor is a material portion of the Bank’s loans concentrated within a single industry or group of related industries.

Merger with Valley Republic Bancorp

On March 25, 2022, the Company completed its acquisition of Valley Republic Bancorp, including the merger of Valley Republic Bank into Tri Counties Bank, with Tri Counties Bank as the surviving entity, in accordance with the terms of the merger agreement dated as of July 27, 2021.

The cash and stock transaction was valued at approximately $174.0 million in aggregate, based on TriCo's closing stock price of $42.48 on March 25, 2022.

Under the terms of the merger agreement, the Company issued approximately 4.1 million shares, in addition to approximately $431,000 in cash paid out for settlement of stock option awards at VRB.

VRB was headquartered in Bakersfield, California, and had four branch locations in and around Bakersfield, and a loan production office in Fresno, California.

The Bank's overlapping Bakersfield branch was consolidated into the acquired VRB branch during the quarter ended June 30, 2022, and the VRB loan production office in Fresno was consolidated with the nearby legacy TCBK loan production office during the fourth quarter of 2022.

All remaining branches now operate as Tri Counties Bank.

2 TriCo Bancshares 2022 10-K

Acquisition of Valley Republic Bancorp

On March 25, 2022, the Company acquired Valley Republic Bancorp and its subsidiary Valley Republic Bank ("VRB") in a merger transaction in which the Company issued approximately 4.1 million shares of common stock valued at approximately $174.4 million based on the closing stock price of TriCo common stock of $42.48 on March 25, 2022 in addition to approximately $431,000 in cash paid out for settlement of stock option awards.

At the time of the acquisition, VRB merged with and into the Bank.

VRB was headquartered in Bakersfield, California, and operated four branch locations in and around Bakersfield, and a loan production office in Fresno, California.

Human Capital Resources

At December 31, 2022, we employed 1,231 persons, including five executive officers.

2 TriCo Bancshares 2023 10-K

At December 31, 2023, we employed 1,231 persons.

Full time equivalent employees numbered 1,207.

Additionally, we at times will utilize independent contractors and temporary personnel to supplement our workforce.

Additionally, we at times will utilize temporary personnel to supplement our workforce.

None of our employees are presently represented by a union or covered under a collective bargaining agreement.

1 unchanged sentence

Our employees are critical to our success and competition for qualified banking personnel has historically been intense;

We provide a wide variety of opportunities for professional growth for all employees with a focus on in-classroom and on-line trainings, on-the-job experience, including active mentoring and education tuition assistance.

We seek to create an engaged workforce through proactive listening, forward looking career conversation and constructive dialogue through periodic performance discussions as well as employee engagement and exit surveys.

therefore our corporate culture is an important element of our board of director's oversight of risk.

Senior management is responsible for embodying, maintaining, and communicating our culture to employees.

In that regard, our culture is designed to promote our commitment to improving the livelihood of our employees and guides us in making decisions throughout the Company.

Our culture is designed to adhere to TriCo’s values of trust, respect, integrity, communication and opportunity.

In keeping with that culture, we expect our people to treat each other and our customers with the highest level of honesty and respect and to do the right thing.

We strive to be a force for good in everyday life.

We dedicate resources to promote a safe and inclusive workplace;

attract, develop and retain talented, diverse employees;

promote our values;

and reward and recognize employees for both the results they deliver and, importantly, how they deliver them.

We provide a wide variety of opportunities for professional growth for all employees with a focus on in-classroom and on-line trainings, on-the-job experience, internal and external development opportunities and education tuition assistance.

We seek to create an engaged workforce through proactive listening, forward-looking career conversation and constructive dialogue through frequent and ongoing performance discussions as well as employee engagement and exit surveys.

We focus on attracting and retaining employees by providing compensation and benefits packages that we believe are competitive within the applicable market, taking into account the position’s location and responsibilities.

We provide competitive health and financial focused benefits such as but not limited to employer subsidized health insurance, a 401(k) retirement plan and an employee stock ownership plan.

We provide competitive health and other benefits focused on physical and financial health, including employer subsidized health insurance, robust wellness initiatives, employee assistance programs, a 401(k) retirement plan and an employee stock ownership plan.

In addition, we offer a portfolio of additional services and tools to support our employees’ health and well-being.

TriCo team members actively share their talents in their communities through volunteer activities in education, economic development, human and health services, and community reinvestment.

During 2022, team members logged more than 10,000 hours, supporting nearly 360 organizations, and more than 3,200 of those hours were for the benefit of community development efforts to support programs and services to low- or moderate-income communities.

While we believe that the diversity of our employees generally represents and reflects the diversity of the communities which we serve, we recognize and continue to promote the need for diversity enhancement in leadership roles throughout the Company.

We have assembled a team to assist us in progressing the Bank's diversity, inclusion, and equity efforts.

Our efforts to foster an environment that embraces employee perspectives through understanding one another's opinions, beliefs, experiences, innate differences and the promotion of dialogue and actions will make us a stronger company.

We also believe that a diverse workforce that is representative of our customers in the community will enable us to better serve our customers, enhancing our success as an organization.

We know the process is a journey and expect our efforts to develop and progress over time.

Refer to Item 7:

Management’s Discussion and Analysis of Financial Condition and Results of Operations for additional information.

We encourage our team members to share their talents in their communities through volunteer activities in education, economic development, human and health services, and community reinvestment.

During 2023, our team members logged more than 11,000 volunteer hours, supporting nearly 400 organizations, and more than 3,700 of those hours were for the benefit of community development efforts to support programs and services to low- or moderate-income communities.

While we believe that the diversity of our employees generally represents and reflects the communities which we serve, we recognize and continue to promote the need for diversity enhancements in leadership roles throughout the Company.

We are dedicated to providing a workplace for our employees that is inclusive, supportive, and free of any form of discrimination or harassment;

rewarding and recognizing our employees based on their individual results and performance as well as that of their department and the Company overall;

and recognizing and respecting all of the characteristics and differences that make each of our employees unique.

The banking business in California generally is highly competitive with respect to both loans and deposits.

It is dominated by a relatively small number of national and regional banks with many offices operating over a wide geographic area;

with the more metropolitan areas that we serve having a larger number of national and regional banks than the rest of our footprint.

It is dominated by a relatively small number of national and regional banks with many offices operating over a wide geographic area, with the more metropolitan areas that we serve having a larger number of national and regional banks than the rest of our footprint.

Among the advantages such major banks have over the Bank are their greater ability to finance investments in technology and marketing campaigns and to allocate their investment assets to regions of high yield and demand.

By virtue of their greater total capitalization, such institutions also have substantially higher lending limits than the Bank.

In addition to competing with other banks, the Bank competes with savings institutions, credit unions and the financial markets for funds.

In addition to competing with other banks, the Bank competes with savings institutions, credit unions, brokerage firms and the financial markets for funds.

Yields on corporate and government debt securities and other commercial paper may be higher than on deposits, and therefore affect the ability of commercial banks to attract and hold deposits.

Commercial banks also compete for available funds with money market instruments and mutual funds.

We also compete for available funds with money market instruments and mutual funds.

During periods of high or rising interest rates, money market funds have provided substantial competition to banks for deposits and they may continue to do so in the future.

4 unchanged sentences

Regulation and Supervision

The Company and the Bank are subject to extensive regulation under both federal and state law governing most aspects of our operations.

This regulation is intended primarily for the protection of customers, depositors, the FDIC deposit insurance fund and the banking system as a whole, and not for the protection of shareholders of the Company.

The Company and the Bank are subject to extensive regulation under both federal and state law affecting most aspects of our operations.

This regulation is intended primarily for the protection of customers, depositors, the FDIC deposit insurance fund and the banking system as a whole, and not for the protection of our shareholders.

Set forth below is a summary description of the significant laws and regulations applicable to the Company and the Bank.

8 unchanged sentences

The Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”) created the Consumer Financial Protection Bureau (the “CFPB”) as an independent entity with broad rulemaking, supervisory and enforcement authority over consumer financial products and services.

The CFPB’s functions include investigating consumer complaints, rulemaking, supervising and examining bank consumer transactions, and enforcing rules related to consumer financial products and services.

In addition, the CFPB is authorized to investigate consumer complaints and enforce rules related to consumer financial products and services.

CFPB regulations and guidance apply to all financial institutions, including the Bank.

Banks with $10 billion or more in assets are subject to examination by the CFPB.

Banks with less than $10 billion in assets, including the Bank, continue to be examined for compliance with federal consumer laws by their primary federal banking agency.

Banks with $10 billion or more in assets are subject to examination by the CFPB, while banks with less than $10 billion in assets, including the Bank, continue to be examined for compliance with federal consumer laws by their primary federal banking agency.

At December 31, 2023, the Company had $9.9 billion in total assets.

See the Risk Factors section for a discussion of some of the risks the Bank will encounter when it exceeds $10 billion in assets as of a December 31 measurement date.

See the Risk Factors section for a discussion of some of the risks the Bank will encounter when it exceeds $10 billion in assets as of a December 31 annual measurement date.

The Bank Holding Company Act

9 unchanged sentences

In addition, the prior approval of the FDIC and DFPI is required for a California chartered bank to merge with another bank or purchase the assets or assume the deposits of another bank.

In determining whether to approve a proposed bank acquisition, bank regulators will consider, among other factors, the effect of the acquisition on competition, the public benefits expected to be received from the acquisition, the projected capital ratios and levels on a post-acquisition basis, and the acquiring institution’s record of addressing the credit needs of the communities it serves, including the needs of low- and moderate-income neighborhoods under the Community Reinvestment Act of 1997, as amended ("CRA").

In determining whether to approve a proposed bank acquisition, bank regulators will consider, among other factors, the effect of the acquisition on competition, the public benefits expected to be received from the acquisition, capital adequacy and the acquiring institution’s effectiveness in combating money laundering and its record of addressing the credit needs of the communities it serves, including the needs of low- and moderate-income neighborhoods under the Community Reinvestment Act of 1997, as amended ("CRA").

On July 9, 2021, President Biden issued an Executive Order on Promoting Competition in the American Economy.

1 unchanged sentence

There are many steps that must be taken by the agencies before any formal changes to the framework for evaluating bank mergers can be finalized and the prospects for such action are uncertain at this time;

however, the adoption of more expansive or prescriptive standards may have an impact on our acquisition activities.

See the Risk Factors section for a more extensive discussion of this topic.

however, the adoption of more expansive or prescriptive standards may have a negative impact on any future acquisition activities.

Safety and Soundness Standards

Under the Federal Deposit Insurance Corporation Improvement Act of 1991 (“FDICIA”), the federal bank regulatory agencies have established safety and soundness standards for insured depository institutions covering:

• Internal controls, information systems and internal audit systems;

loan documentation;

2 unchanged sentences

asset growth;

• Compensation, fees and benefits;

• Asset quality, earnings and stock valuation;

• Excessive compensation for executive officers, directors or principal shareholders which could lead to material financial loss.

4 TriCo Bancshares 2022 10-K

compensation (including executive compensation) fees and benefits;

and asset quality, earnings and stock valuation.

If a federal bank regulatory agency determines that a depository institution fails to meet any standard established by the guidelines, the agency may require the institution to submit to the agency an acceptable plan to achieve compliance with the standard.

If the agency requires submission of a compliance plan and the institution fails to timely submit an acceptable plan or to implement an accepted plan, the agency must require the institution to correct the deficiency.

An institution must file a compliance plan within 30 days of a request to do so from the institution’s primary federal regulatory agency.

The agencies may elect to initiate enforcement actions in certain cases rather than relying on a plan, particularly where failure to meet one or more of the standards could threaten the safe and sound operation of the institution.

Restrictions on Dividends and Distributions

The agencies may elect to initiate enforcement actions in certain cases rather than relying on a plan, particularly where and institution has failed to comply with an acceptable plan or where a failure to meet one or more of the standards could threaten the safe and sound operation of the institution.

Dividends, Distributions and Stock Repurchases

A California corporation such as TriCo may make a distribution to its shareholders to the extent that either the corporation’s retained earnings meet or exceed the amount of the proposed distribution or the value of the corporation’s assets exceed the amount of its liabilities plus the amount of shareholders preferences, if any, and certain other conditions are met.

It is the FRB’s policy that bank holding companies should generally pay dividends on common stock only out of income available over the past year, and only if prospective earnings retention is consistent with the organization’s expected future needs and financial condition.

It is the FRB’s policy that bank holding companies should generally pay dividends on common stock only out of income available over the past year, and only if prospective earnings retention

4 TriCo Bancshares 2023 10-K

is consistent with the organization’s expected future needs and financial condition.

In addition, a bank holding company’s ability to pay dividends on its common stock may be limited if it fails to maintain an adequate capital conservation buffer under these capital rules.

See “Regulatory Capital Requirements.”

In certain circumstances, the Company's repurchases of its common stock may be subject to a prior approval or notice requirement under other regulations, policies or supervisory expectations of the FRB.

In August 2022, the Inflation Reduction Act of 2022 (the “IRA”) was enacted.

Among other things, the IRA imposes a new 1% excise tax on the fair market value of stock repurchased after December 31, 2022 by publicly traded U.S.

corporations.

With certain exceptions, the value of stock repurchased is determined net of stock issued in the year, including shares issued pursuant to compensatory arrangements.

The primary source of funds for payment of dividends by TriCo to its shareholders has been and will be the receipt of dividends and management fees from the Bank.

7 unchanged sentences

However, if the DPFI finds that the shareholders’ equity of the bank is not adequate or that the payment of a dividend would be unsafe or unsound, the Commissioner may order the bank not to pay a dividend to shareholders.

The Bank’s ability to pay dividends may be limited if the Bank fails to maintain an adequate capital conservation buffer.

In addition, the Bank’s ability to pay dividends may be limited if the Bank fails to maintain an adequate capital conservation buffer.

See “Regulatory Capital Requirements.”

The FRB, FDIC and the DPFI have authority to prohibit a bank holding company or a bank from engaging in practices which are considered to be unsafe and unsound.

Depending on the financial condition of TriCo and the Bank and other factors, our regulators could determine that payment of dividends or other payments by TriCo or the Bank might constitute an unsafe or unsound practice.

Depending on the financial condition of TriCo and the Bank and other factors, our regulators could determine that payment of dividends or other payments or stock repurchases by TriCo or the Bank might constitute an unsafe or unsound practice.

The Community Reinvestment Act

4 unchanged sentences

As of its most recent CRA examination, the Bank’s CRA rating was “Satisfactory."

On May 5, 2022, the FRB, OCC and FDIC jointly issued a notice of proposed rulemaking proposing revisions to the agencies’ CRA regulations, including with respect to the delineation of assessment areas, the overall evaluation framework and performance standards and metrics, the definition of community development activities, and data collection and reporting.

The proposed rule would adjust CRA evaluations based on bank size and type, with many of the proposed changes applying only to banks with over $2 billion in assets and several applying only to banks with over $10 billion in assets.

We will continue to evaluate the impact of any changes to the regulations implementing the CRA.

On October 24, 2023, the FRB, OCC and FDIC issued a joint final rule to modernize the CRA regulatory framework.

The final rule is intended, among other things, to adapt to changes in the banking industry, including the expanded role of mobile and online banking, and to tailor performance standards to account for differences in bank size and business models.

The final rule introduces new tests under which the performance of banks with over $2 billion in assets will be assessed.

The new rule also includes data collection and reporting requirements, some of which are applicable only to banks with over $10 billion in assets.

Most provisions of the final rule will become effective on January 1, 2026, and the data reporting requirements will become effective on January 1, 2027.

We continue to evaluate and adapt as necessary for the impact of the changes.

Consumer Protection Laws and Supervision

The Bank is subject to many federal consumer protection statues and regulations, some of which are discussed below.

The Bank is subject to many federal consumer protection statutes and regulations, some of which are discussed below.

• The Equal Credit Opportunity Act generally prohibits discrimination in any credit transaction, whether for consumer or business purposes, on the basis of race, color, religion, national origin, sex, marital status, age (except in limited circumstances), receipt of income from public assistance programs, or good faith exercise of any rights under the Consumer Credit Protection Act.

2 unchanged sentences

• The Home Mortgage Disclosure Act, which includes a “fair lending” aspect, requires the collection and disclosure of data about applicant and borrower characteristics as a way of identifying possible discriminatory lending patterns and enforcing anti-discrimination statutes.

5 TriCo Bancshares 2022 10-K

• The Real Estate Settlement Procedures Act requires lenders to provide borrowers with disclosures regarding the nature and cost of real estate settlements and prohibits certain abusive practices, such as kickbacks, and places limitations on the amount of escrow accounts.

In addition, the CFPB has taken a number of actions that may affect the Bank’s operations and compliance costs, including the following:

• The issuance of final rules for residential mortgage lending, which became effective January 10, 2013, including definitions for “qualified mortgages” and detailed standards by which lenders must satisfy themselves of the borrower’s ability to repay the loan and revised forms of disclosure under the Truth in Lending Act and the Real Estate Settlement Procedures Act.

• Actions taken to regulate and supervise credit bureaus and debt collections.

• Positions taken by the CFPB on fair lending, including applying the disparate impact theory in auto financing, which could make it harder for lenders, such as the Bank, to charge different rates or apply different terms to loans to different customers.

The CFPB has broad rulemaking authority for a wide range of consumer financial laws that apply to all banks, including, among other things, laws relating to fair lending and the authority to prohibit “unfair, deceptive or abusive” acts and practices.

The CFPB has promulgated many mortgage-related final rules since it was established under the Dodd-Frank Act, including rules related to the ability to repay and qualified mortgage standards, mortgage servicing standards, loan originator compensation standards, high-cost mortgage requirements, HMDA requirements, and appraisal and escrow standards for higher priced mortgages.

The mortgage-related final rules issued by the CFPB have materially restructured the origination, servicing, and securitization of residential mortgages in the United States.

These rules have impacted, and will continue to impact, the business practices of mortgage lenders, including the Company.

The CFPB has broad rule making authority for a wide range of consumer financial laws that apply to all banks, including, among other things, laws relating to fair lending and the authority to prohibit “unfair, deceptive or abusive” acts and practices.

The CFPB has promulgated

5 TriCo Bancshares 2023 10-K

many mortgage-related rules, including rules related to requirements for "qualified mortgages," standards by which lenders must satisfy themselves of a borrower's ability to repay a mortgage loan, mortgage servicing standards, disclosure requirements, loan originator compensation standards, high-cost mortgage requirements, HMDA requirements, and appraisal and escrow standards for higher priced mortgages.

The mortgage-related rules issued by the CFPB have materially restructured the origination, servicing, and securitization of residential mortgages in the United States.

The CFPB has also taken positions on fair lending, including applying the disparate impact theory in auto financing, which could make it harder for lenders, such as the Bank, to charge different rates or apply different terms to loans to different customers.

The CFPB’ rules and policies have impacted, and will continue to impact, the business practices of mortgage lenders, including the Bank.

We are also subject to certain state consumer protection laws and state attorneys general and other state officials are empowered to enforce certain federal consumer protection laws and regulations.

2 unchanged sentences

Penalties for violations of the above laws may include fines, reimbursements, injunctive relief and other penalties.

Privacy, Data Protection and Cybersecurity

Privacy and Data Protection

We are subject to a number of U.S.

3 unchanged sentences

In addition, such financial institutions must appropriately safeguard their customers’ nonpublic, personal information.

Like other lenders, the Bank uses credit bureau data in their underwriting activities.

Use of such data is regulated under the Fair Credit Reporting Act (“FCRA”), and the FCRA also regulates reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information between affiliates, and using affiliate data for marketing purposes.

Similar state laws may impose additional requirements on the Company and the Bank.

Data privacy and data protection are areas of increasing state legislative focus.

For example, in June 2018, the Governor of California signed into law the California Consumer Privacy Act ("CCPA").

The CCPA, which became effective on January 1, 2020, applies to for-profit businesses that conduct business in California and meet certain revenue or data collection thresholds.

For example, the California Consumer Privacy Act ("CCPA"), which became effective on January 1, 2020, applies to for-profit businesses that conduct business in California and meet certain revenue or data collection thresholds.

The CCPA gives consumers the right to request disclosure of information collected about them, and whether that information has been sold or shared with others, the right to request deletion of personal information (subject to certain exceptions), the right to opt out of the sale of the consumer’s personal information, and the right not to be discriminated against for exercising these rights.

The CCPA contains several exemptions, including that many, but not all, requirements of the CCPA are inapplicable to information that is collected, processed, sold, or disclosed pursuant to the GLBA.

California voters also recently passed the CPRA, which took effect on January 1, 2023, and significantly modifies the CCPA, including imposing additional obligations on covered companies and expanding California consumers’ rights with respect to certain sensitive personal information.

On July 8, 2022, the CPPA commenced formal rulemaking to adopt regulations to implement the CPRA.

However, regulations did not come into effect prior to the CPRA’s effective date.

The CPPA has stated that the earliest proposed regulations could be in effect is April 2023, potentially resulting in further uncertainty and requiring us to incur additional costs and expenses in an effort to comply with the regulations.

In California, the CCPA, the CPRA, and upcoming regulations may be interpreted or applied in a manner inconsistent with our understanding.

In addition, numerous other states have also enacted or are in the process of enacting state-level privacy, data protection and/or data security laws and regulations.

The federal government and regulators outside of the United States may also pass additional data privacy or data protection legislation, including possible amendment of the GLBA.

For example, on November 23, 2021, the federal financial regulatory agencies published a final rule that will impose upon banking organizations and their service providers new notification requirements for significant cybersecurity incidents.

Specifically, the final rule requires banking organizations to notify their primary federal regulator as soon as possible and no later than 36 hours after the discovery of a "computer-security incident" that rises to the level of a "notification incident" within the meaning attributed to those terms by the final rule.

Banks' service providers are required under the final rule to notify any affected bank to or on behalf of which the service provider provides services "as soon as possible" after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank

In addition, the California Privacy Rights Act (“CPRA”), which took effect on January 1, 2023, significantly modified the CCPA, including imposing additional obligations on covered companies and expanding California consumers’ rights with respect to certain sensitive personal information.

The CCPA and CPRA do not provide a blanket exemption for financial institutions, but instead contain a partial exemption for information collected by financial institutions where the information is itself subject to the GLBA (e.g., information about individuals who have obtained personal financial products from the institution).

Such information is exempt from the privacy requirements of the CCPA, but, is not exempt from the private right of action conferred if a business fails to implement and maintain reasonable security to protect certain categories of information.

In California, the CCPA, the CPRA, and their implementing regulations may be interpreted or applied in a manner inconsistent with our understanding.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations.

Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and many states, including California, have also recently implemented or modified their data breach notification, information security and data privacy requirements.

We expect this trend of state-level activity in those areas to continue and are continually monitoring developments in the states in which our customers are located.

Cybersecurity

Under a rule adopted by federal banking agencies in 2021, banking organizations are required to notify their primary banking regulator within 36 hours of determining that a “computer-security incident” has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss, or its operations that would impact the stability of the United States.

Banks' service providers are required to notify any affected bank to or on behalf of which the service provider provides services "as soon as possible" after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank for as much as four hours.

Recent cyberattacks against banks and other financial institutions that resulted in unauthorized access to confidential customer information have prompted the federal banking regulators to issue guidance on cybersecurity.

Among other things, financial institutions are expected to design multiple layers of security controls to establish lines of defense and ensure that their risk management processes address the risks

6 TriCo Bancshares 2023 10-K

for as much as four hours.

The final rule took effect on April 1, 2022 and banks and their service providers were required to be in compliance with the requirements of the rule by May 1, 2022.

Federal banking agencies, including the FDIC and FRB, have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of the board of directors.

These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services.

Among other things, financial institutions are expected to design multiple layers of security controls to establish lines of defense and ensure that their risk management processes address the risks posed by compromised customer credentials, including security measures to authenticate customers accessing internet-based services.

posed by compromised customer credentials, including security measures to authenticate customers accessing internet-based services.

A financial institution also should have a robust business continuity program to recover from a cyberattack and procedures for monitoring the security of third-party service providers that may have access to nonpublic data at the institution.

Further, the Company’s financial institution customers have obligations to safeguard their systems and sensitive information and the Company may be bound contractually and/or by regulation to comply with the same requirements.

Further, our service providers have obligations to safeguard their systems and sensitive information and the Company may be bound contractually and/or by regulation to comply with the same requirements.

If the Company or its service providers fail to comply with applicable regulations and contractual requirements, the Company could be exposed to lawsuits, governmental proceedings or the imposition of fines, among other consequences.

In February 2018, the SEC published interpretive guidance to assist public companies in preparing disclosures about cybersecurity risks and incidents.

These SEC guidelines, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations.

We and other U.S.

financial services providers continue to be targeted with evolving and adaptive cybersecurity threats from sophisticated third parties.

Unauthorized access or cybersecurity incidents could occur more frequently and on a more significant scale.

If future attacks are successful or if customers are unable to access their accounts online for other reasons, it could adversely impact our ability to service customer accounts or loans, complete financial transactions for our customers or otherwise operate any of our businesses or services.

In addition, a breach or attack affecting one of our third-party service providers or partners could harm our business even if we do not control the service that is attacked.

Any inability to prevent or adequately respond to the issues described above could disrupt the Company’s business, inhibit its ability to retain existing customers or attract new customers, otherwise harm its reputation and/or result in financial losses, litigation, increased costs or other adverse consequences that could be material to the Company.

See Risk Factors below for additional information and discussion related to cybersecurity.

Like other lenders, the Bank uses credit bureau data in their underwriting activities.

Similar state laws may impose additional requirements on the Company and the Bank.

Risks and exposures related to cybersecurity attacks, including litigation and enforcement risks, are expected to be elevated for the foreseeable future due to the rapidly evolving nature and sophistication of these threats.

as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our customers.

See "Item 1A.

Risk Factors" for a further discussion of risks related to cybersecurity, including the Bank's cybersecurity incident in 2023, and "Item 1C.

Cybersecurity" for a further discussion of risk management strategies and governance processes related to cybersecurity.

Regulatory Capital Requirements

7 unchanged sentences

government and agency securities, to 1,250% for certain trading securitization exposures, resulting in higher risk weights for a variety of asset classes than previous regulations.

Under Basel III, we are subject to the following minimum capital ratios:

Under Basel III, the Company (on a consolidated basis) and the Bank are each subject to the following minimum capital ratios:

(1) common equity Tier 1 capital or “CET1” to risk‑weighted assets of 4.5%;

3 unchanged sentences

The Basel III capital framework includes a “capital conservation buffer” of 2.5%, composed entirely of CET1, on top of the minimum risk‑weighted asset ratios.

Banking institutions that fail to maintain a full capital conservation buffer face constraints on dividends, equity repurchases and discretionary executive compensation based on the amount of the shortfall and the institution’s “eligible retained income” (that is, four quarter trailing net income, net of distributions and tax effects not reflected in net income).

Banking institutions that fail to maintain a full capital conservation buffer face constraints on dividends, equity repurchases and discretionary executive compensation based on the amount of the shortfall and the institution’s “eligible retained income” (that is, trailing net income for four quarters, net of distributions and tax effects not reflected in net income).

The 2.5% capital conservation buffer effectively results in minimum ratios of (i) CET1 to risk‑weighted assets of at least 7%, (ii) Tier 1 capital to risk‑weighted assets of at least 8.5%, and (iii) total capital to risk‑weighted assets of at least 10.5%.

3 unchanged sentences

Prompt Corrective Action regulations of the federal bank regulatory agencies establish five capital categories in descending order based on an institution’s regulatory capital ratios:

well capitalized, adequately capitalized, undercapitalized, significantly undercapitalized and critically

7 TriCo Bancshares 2022 10-K

undercapitalized.

well capitalized, adequately capitalized, undercapitalized, significantly undercapitalized and critically undercapitalized.

Under the Prompt Corrective Action framework, insured depository institutions are required to meet the following minimum capital level requirements in order to qualify as “well capitalized:” (i) a common equity Tier 1 capital ratio of 6.5%;

13 unchanged sentences

In addition, the FDIC can impose special assessments in certain instances.

7 TriCo Bancshares 2023 10-K

The FDIC, as required under the FDIA, established a plan on September 15, 2020, to restore the DIF reserve ratio to meet or exceed the statutory minimum of 1.35% within eight years.

3 unchanged sentences

The FDIC also concurrently maintained the Designated Reserve Ratio for the DIF at 2%.

In addition, on November 16, 2023, the FDIC issued a final rule to implement a special assessment to recover losses to the DIF incurred as a result of recent bank failures and the FDIC's use of the systemic risk exception to cover certain deposits that were otherwise uninsured.

The special assessment was based on estimated uninsured deposits as of December 31, 2022 (excluding the first $5.0 billion) and will be assessed at a quarterly rate of 3.36 basis points over eight quarterly assessment periods, beginning in the first quarter of 2024.

The Bank’s uninsured deposits were below the threshold and therefore is not required to pay the special assessment.

Under the final rule, the estimated loss pursuant to the systemic risk determination will be periodically adjusted, and the FDIC has retained the ability to cease collection early, extend the special assessment collection period and impose a final shortfall special assessment on a one-time basis.

The extent to which any such additional future assessments will impact our future deposit insurance expense is currently uncertain.

The Bank is generally unable to control the amount of premiums that it is required to pay for FDIC insurance or the amount of credit, if any, that it may be allowed to offset such assessments.

3 unchanged sentences

The termination of deposit insurance for the Bank would also result in the revocation of the Bank’s charter by the DPFI.

Depositor Preference

The FDIA provides that, in the event of the "liquidation or other resolution" of an insured depository institution, the claims of depositors of the institution, including the claims of the FDIC as subrogee of insured depositors.

and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution.

If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors, including depositors whose deposits are payable only outside of the United States and the parent bank holding company, with respect to any extensions of credit they have made to such insured depository institution.

Commercial Real Estate Concentrations

Under guidance issued by the federal banking regulators, a financial institution is considered to have a significant commercial real estate (“CRE”) concentration risk, and will be subject to enhanced supervisory expectations to manage that risk, if (i) total reported loans for construction, land development and other land (“C&D”) represent 100% or more of the institution’s total capital or (ii) total CRE loans represent 300% or more of the institution’s total capital and the outstanding balance of the institution’s CRE loan portfolio has increased by 50% or more during the prior 36 months.

As of December 31, 2023, our C&D concentration as a percentage of capital totaled 29.9% and our CRE concentration, net of owner-occupied loans, as a percentage of capital totaled 328.6%.

Bank Secrecy Act / Anti-Money Laundering

The Bank Secrecy Act of 1970 (“BSA”) requires financial institutions to develop policies, procedures, and practices to prevent and deter money laundering, mandates that every bank have a written, board-approved program that is reasonably designed to assure and monitor compliance with the BSA.

The Bank Secrecy Act of 1970 and the USA Patriot Act of 2001 require financial institutions to develop policies, procedures, and practices to prevent and deter money laundering ("BSA/AML"), and mandate that every bank have a written, board-approved program that is reasonably designed to assure and monitor compliance with the BSA/AML laws.

The program must, at a minimum:

3 unchanged sentences

and (4) provide training for appropriate personnel.

In addition, banks are required to adopt a customer identification program as part of their BSA compliance program.

Banks are also required to file reports when they detect certain known or suspected violations of federal law or suspicious transactions related to a money laundering activity or a violation of the BSA.

BSA regulations require that we that we verify customer information when opening a new account, which includes identifying and verifying the beneficial owners of all customer that are legal entity customers, and performing ongoing customer due diligence to understand the nature and purpose of customer relationships for the purpose of developing customer risk profiles.

In addition to complying with the BSA, the Bank is subject to the USA Patriot Act of 2001 (“Patriot Act”).

The Patriot Act is designed to deny terrorists and criminals the ability to obtain access to the United States’ financial system and has significant implications for depository institutions, brokers, dealers, and other businesses involved in the transfer of money.

The Patriot Act mandates that financial service companies implement additional policies and procedures and take heightened measures designed to address any or all of the following matters:

customer identification programs, money laundering, terrorist financing, identifying and reporting suspicious activities and currency transactions, currency crimes, and cooperation between financial institutions and law enforcement authorities.

In addition, banks are required to adopt a customer identification program, performing ongoing customer due diligence to understand the nature and purpose of customer relationships for the purpose of developing customer risk profiles and file reports regarding known or suspected violations of federal law or suspicious transactions.

On December 3, 2019, three federal banking agencies and the Financial Crimes Enforcement Network (“FinCEN”) issued a joint statement clarifying the compliance procedures and reporting requirements that banks must file for customers engaged in the growth or cultivation of hemp, including a clear statement that banks need not file a SAR on customers engaged in the growth or cultivation of hemp in accordance with applicable laws and regulations.

2 unchanged sentences

8 TriCo Bancshares 2023 10-K

Further, on January 1, 2021, Congress passed the National Defense Authorization Act, which enacted the most significant overhaul of the BSA and related AML laws since the Patriot Act.

Notable amendments include (1) significant changes to the collection of beneficial ownership information and the establishment of a beneficial ownership registry, which requires corporate entities (generally, any corporation, LLC, or other similar entity with 20 or fewer employees and annual gross income of $5 million or less) to report beneficial ownership information to FinCEN (which will be maintained by FinCEN and made available upon request to financial institutions);

(2) enhanced whistleblower provisions, which provide that one or more whistleblowers who voluntarily provide original information leading to the successful enforcement of violations of the AML laws in any judicial or administrative action brought by the Secretary of the Treasury or the Attorney General resulting in monetary sanctions exceeding $1 million (including disgorgement and interest but excluding forfeiture, restitution, or compensation to victims) will receive not more than 30 percent of the monetary sanctions collected and will receive increased protections;

(3) increased penalties for violations of the BSA;

(4) improvements to existing information sharing provisions that permit financial institutions to share information relating to SARs with foreign branches, subsidiaries, and affiliates (except those located in China, Russia, or certain other jurisdictions) for the purpose of combating illicit finance risks;

and (5) expanded duties and powers of FinCEN.

Many of the amendments require the Department of Treasury and FinCEN to promulgate rules.

On September 29, 2022, FinCEN issued final regulations implementing the amendments with respect to beneficial ownership.

Failure to comply with these requirements could have serious financial, legal and reputational consequences, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required.

Office of Foreign Assets Control Regulation

2 unchanged sentences

We are responsible for, among other things, blocking accounts of, and transactions with, such targets and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence.

Failure to comply with these sanctions could have serious financial, legal and reputational consequences, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required.

Transactions with Affiliates

Banks are also subject to certain restrictions imposed by the Federal Reserve Act on extensions of credit to executive officers, directors, principal shareholders (including the Company) or any related interest of such persons.

Extensions of credit must be made on substantially the same terms, including interest rates and collateral as, and follow credit underwriting procedures that are not less stringent than, those prevailing at the time for comparable transactions with persons not affiliated with the bank, and must not involve more than the normal risk of repayment or present other unfavorable features.

Regulation O requires that such extensions of credit must be made on substantially the same terms, including interest rates and collateral as, and follow credit underwriting procedures that are not less stringent than, those prevailing at the time for comparable transactions with persons not affiliated with the bank, and must not involve more than the normal risk of repayment or present other unfavorable features.

Banks are also subject to certain lending limits and restrictions on overdrafts to such persons.

Regulation W requires that certain transactions between the Bank and its affiliates, including its holding company, be on terms substantially the same, or at least as favorable to the Bank, as those prevailing at the time for comparable transactions with or involving non-affiliated companies or, in the absence of comparable transactions, on terms and under circumstances, including credit standards, that in good faith would be offered to or would apply to non-affiliated companies.

Source of Strength Doctrine

Federal Reserve Board policy and federal law require bank holding companies to act as a source of financial and managerial strength to their subsidiary banks.

Under this requirement, the Company is expected to commit resources to support the Bank, including at times when the Company may not be in a financial position to provide such resources.

Any capital loans by a bank holding company to any of its subsidiary banks are subordinate in right of payment to depositors and to certain other indebtedness of such subsidiary banks.

In the event of a bank holding company's bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Interchange Fees

3 unchanged sentences

An upward adjustment of no more than 1 cent to an issuer's debit card interchange fee is allowed if the card issuer develops and implements policies and procedures reasonably designed to achieve certain fraud-prevention standards.

The FRB also has rules governing routing and exclusivity that require issuers to offer two unaffiliated networks for routing transactions on each debit or prepaid product.

Effective July 1, 2023, a new FRB Federal Reserve rule will require that debit card issuers enable all debit card transactions, including card-not-present transactions such as online payments, to be processed on at least two unaffiliated payment card networks.

The Bank is currently not subject to these restrictions, however if our assets exceed $10 billion or more at December 31, 2023, these rules would be applicable to the Bank in July 2024.

Impact of Monetary Policies

Banking is a business that depends on interest rate differentials.

In general, the difference between the interest paid by a bank on its deposits and other borrowings, and the interest rate earned by banks on loans, securities and other interest-earning assets, comprises the major source of banks’ earnings.

Thus, the earnings and growth of banks are subject to the influence of economic conditions generally, both domestic and foreign, and also to the monetary and fiscal policies of the United States and its agencies, particularly the FRB.

The FRB implements national monetary policy, such as seeking to curb inflation and combat recession, by its open-market dealings in United States government securities, by adjusting the required level of reserves for financial institutions subject to reserve requirements and through adjustments to the discount rate applicable to borrowings by banks which are members of the FRB.

The actions of the FRB in these areas influence the growth of bank loans, investments and deposits, and also affect interest rates.

The nature and timing of any future changes in such policies and their impact on the Company cannot be predicted.

In addition, adverse economic conditions could make a higher provision for loan losses a prudent course and could cause higher loan loss charge-offs, thus adversely affecting the Company’s net earnings.

In October 2023, the Federal Reserve issued a proposed rule under which the maximum permissible interchange fee for an electronic debit transaction would be the sum of 14.4 cents per transaction and 4 basis points multiplied by the value of the transaction.

Furthermore, the fraud-prevention adjustment would increase from a maximum of 1 cent to 1.3 cents.

The proposal would adopt an approach for future adjustments to the interchange fee cap, which would occur every other year based on issuer cost data gathered by the FRB from large debit card issuers.

The Bank is currently not subject to these restrictions or those proposed, however if our assets exceed $10 billion or more at December 31, 2024, these rules would be applicable to the Bank in July 2025.

Effective July 1, 2023, debit card issuers are required to enable all debit card transactions, including card-not-present transactions such as online payments, to be processed on at least two unaffiliated payment card networks.

Incentive Compensation Policies and Restrictions

9 TriCo Bancshares 2022 10-K

In July 2010, the federal banking agencies issued guidance on sound incentive compensation policies that applies to all banking organizations supervised by the agencies (thereby including both the Company and the Bank).

4 unchanged sentences

Monitoring methods and processes used by a banking organization should be commensurate with the size and complexity of the organization and its use of incentive compensation.

The Dodd-Frank Act requires the federal banking agencies and the SEC to establish joint regulations or guidelines for specified regulated entities, such as us, having at least $1 billion in total assets, to prohibit incentive-based payment arrangements that encourage inappropriate risk taking by providing an executive officer, employee, director or principal shareholder with excessive compensation, fees, or benefits or that could lead to material financial loss to the entity.

The Dodd-Frank Act requires the federal banking agencies and the SEC to establish joint regulations or guidelines for specified regulated entities having at least $1 billion in total assets, such as us, to prohibit incentive-based payment arrangements that encourage inappropriate risk taking by providing an executive officer, employee, director or principal shareholder with excessive compensation, fees, or benefits or

9 TriCo Bancshares 2023 10-K

that could lead to material financial loss to the entity.

In addition, these regulators must establish regulations or guidelines requiring enhanced disclosure to regulators of incentive-based compensation arrangements.

The agencies have not yet finalized these rules.

however, on October 26, 2022, the SEC adopted a final rule regarding "clawbacks" of incentive-based executive compensation.

Pursuant to the Dodd-Frank Act, in 2023, effective October 2, 2023, the Nasdaq Stock Market adopted a rule requiring listed companies to adopt policies to recover or "clawback" of excess incentive-based compensation earned by a current or former executive officer during the three fiscal years preceding the date the listed company is required to prepare an accounting restatement, including to correct an error that would result in a material misstatement if the error were corrected in the current period or left uncorrected in the current period.

We adopted a compensation clawback policy pursuant to the listing standards that is included as Exhibit 97.1 to this report.

The scope and content of the U.S.

1 unchanged sentence

It cannot be determined at this time whether compliance with such policies will adversely affect the Company’s ability to hire, retain and motivate its key employees.

Climate-Related and Other ESG Developments

In recent years, federal, state and international lawmakers and regulators have increased their focus on financial institutions' and other companies' risk oversight, disclosures and practices in connection with climate change and other environmental, social and governance ("ESG") matters.

For example, in March 2022, the SEC issued a proposed rule on the enhancement and standardization of climate-related disclosures for investors.

The proposed rule would require public issuers, including us, to significantly expand the scope of climate-related disclosures in their SEC filings.

The SEC has also announced plans to propose rules to require enhanced disclosure regarding human capital management and board diversity for public issuers.

In California, the Climate Corporate Data and Accountability Act (“CCDAA”) requires both public and private U.S.

businesses with revenues greater than $1 billion doing business in California to report their greenhouse gas emissions including scopes 1, 2, and 3, beginning in 2026 (for 2025 data) and also requires reporting companies to get third-party assurance of their reports.

The Climate-Related Financial Risk Act mandates U.S.

businesses with annual revenues over $500 million doing business in California to bi-annually disclose climate-related financial risks and their mitigation strategies beginning January 1, 2026.

Disclosure requirements imposed by different regulators may not always be uniform, which may result in increased complexity, and cost, for compliance.

Additionally, many of our suppliers and business partners may be subject to similar requirements, which may augment or create additional risks, including risks that may not be known to us.

Although these new disclosure rules do not apply to a banking organization of our size, as the Company continues to grow and expand the scope of our operations, our regulators generally will expect us to enhance our internal control programs and processes, including with respect to risk management and stress testing under a variety of adverse scenarios and related capital planning.

In the event the federal banking agencies were to expand the scope of coverage of the new climate risk guidelines to institutions of our size or promulgate new regulations or supervisory guidance applicable to the Company, we would expect to experience increased compliance costs and other compliance-related risks.

Impact of Monetary Policies

Banking is a business that depends on interest rate differentials.

The actions of the FRB in these areas influence the growth of bank loans, investments and deposits, and also affect interest rates.

The nature and timing of any future changes in such policies and their impact on the Company cannot be predicted.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business