What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-02-29 compared with 2023-03-01 · 218 added, 162 removed, 301 unchanged (56% of the section changed)

6 unchanged sentences

Risks Related to the Nature and Geographic Area of Our Business

10 TriCo Bancshares 2023 10-K

The majority of our assets are loans, which are subject to credits risks.

1 unchanged sentence

Our earnings are significantly affected by our ability to properly originate, underwrite and service loans.

Certain of our credit exposures are concentrated in industries that may be more susceptible to the long-term risks of climate change, natural disasters or global pandemics.

To the extent that these risks may have a negative impact on the financial condition of borrowers, it could also have a material adverse effect on our business, financial condition and results of operations.

We have underwriting and credit monitoring procedures and credit policies, including the establishment and review of the allowance for credit losses, that we believe appropriately address this risk by assessing the likelihood of nonperformance, tracking loan performance and diversifying our respective loan portfolios.

6 unchanged sentences

Determining an appropriate level of allowance is an inherently difficult process and is based on numerous assumptions.

The actual amount of future losses is susceptible to changes in economic, operating and other conditions, including changes in interest rates, unemployment and gross domestic product that may be beyond our control and these losses may exceed current estimates.

The actual amount of future losses is susceptible to changes in economic, operating and other conditions, including changes in interest rates, unemployment and economic conditions that may be beyond our control and these losses may exceed current estimates.

Effective January 1, 2020, we implemented a new accounting standard, “Measurement of Credit Losses on Financial Instruments,” commonly referred to as the “Current Expected Credit Losses” standard, or “CECL.” CECL changed the allowance for credit losses methodology from an incurred loss concept to an expected loss concept, which is more dependent on future economic forecasts, assumptions and models than previous methodology, which could result in increases and add volatility to our allowance for credit losses and future provisions for loan losses.

These forecasts, assumptions and models are inherently uncertain and are based upon our management’s reasonable judgment in light of information currently available.

In addition to periodic reviews completed by independent third parties retained by the Bank, Federal and state bank regulatory agencies, as an integral part of their examination process, review our loans and allowance for credit losses.

In addition to periodic reviews completed by management and independent third parties retained by the Bank, Federal and state bank regulatory agencies, as an integral part of their examination process, review our loans and allowance for credit losses.

While we believe that our allowance for credit losses is adequate to cover estimated future losses, we cannot assure you that we will not increase the allowance for credit losses further or that the allowance will be adequate to absorb credit losses we actually incur.

Credit losses in excess of our allowance or addition provisions to our allowance would reduce our net income and capital, potentially materially.

10 TriCo Bancshares 2022 10-K

Our business may be adversely affected by business conditions in California.

4 unchanged sentences

• demand for our products and services may decline,

• low cost or non-interest bearing deposits may decrease, and

• low cost or non-interest bearing deposits may continue to decrease, and

• collateral for loans made by us, especially real estate, may decline in value, in turn reducing customers’ borrowing power, and reducing the value of assets and collateral associated with our existing loans.

9 unchanged sentences

A significant majority of the loans in our portfolio are secured by California real estate and a decline in real estate values could hurt our business.

11 TriCo Bancshares 2023 10-K

A downturn in real estate values in the markets which we conduct our business in California could hurt our business because most of our loans are secured by real estate.

5 unchanged sentences

Substantially all of our real estate collateral is located in California;

So, if there is a significant adverse decline in real estate values in California, the collateral for our loans will provide less security.

therefore, if there is a significant adverse decline in real estate values in California, the collateral for our loans will provide less security.

Any such decline could have a material adverse effect on our business, financial condition and results of operations.

We have significant exposure to risks associated with commercial real estate lending.

A substantial portion of our loan portfolio consists of commercial real estate loans.

As of December 31, 2023, we had approximately $4.4 billion of commercial real estate loans outstanding, which represented approximately 64.7% of our total loan portfolio.

Consequently, commercial real estate-related credit risks are a significant concern for us.

Commercial real estate loans are generally viewed as having more risk of default than some other types of loans because repayment of the loans often depends on the successful operation of the property and the income stream of the borrowers.

In addition, these loans often involve larger loan balances to single borrowers or groups of related borrowers compared with other types of loans.

In recent years, commercial real estate markets have been particularly impacted by the economic disruption resulting from the COVID-19 pandemic, which has been a catalyst for the evolution of various remote work options which could impact the long-term performance of some types of office properties within our commercial real estate portfolio.

Accordingly, the federal banking regulatory agencies have expressed concerns about weaknesses in the current commercial real estate market.

The adverse consequences from real estate-related credit risks tend to be cyclical and are often driven by national economic developments that are not controllable or entirely foreseeable by us or our borrowers.

We are exposed to the risk of environmental liabilities with respect to properties to which we take title.

2 unchanged sentences

The costs associated with investigation or remediation activities could be substantial.

In addition, if we are the owner or former owner of a contaminated site, we may be subject to common law claims by third parties based on damages and costs resulting from environmental contamination emanating from the property.

In addition, if we are the owner or former owner of a contaminated site, we may be subject to common law or contractual claims by third parties based on damages and costs resulting from environmental contamination emanating from the property.

When applicable, we establish contingent liability reserves for this purpose based on future reasonable and estimable costs developed by qualified soil and chemical engineering consultants.

7 unchanged sentences

Areas of competition include interest rates for loans and deposits, efforts to obtain loan and deposit customers and a range in quality of products and services provided, including new technology-driven products and services.

Technological innovation continues to contribute to greater competition in domestic and international financial

11 TriCo Bancshares 2022 10-K

services markets as technological advances enable more companies, such as Internet-based marketplace lenders, financial technology (or “fintech”) companies that rely on technology to provide financial services, often without many of the regulatory and capital restrictions that we face.

Technological innovation continues to contribute to greater competition in domestic and international financial services markets as technological advances enable more companies, such as Internet-based marketplace lenders, financial technology (or “fintech”) companies that rely on technology to provide financial services, often without many of the regulatory and capital restrictions that we face.

We also face competition from out-of-state financial intermediaries that have opened loan production offices or that solicit deposits in our market areas.

If we are unable to attract and retain banking customers, we may be unable to continue our loan growth and level of deposits and our business, financial condition and results of operations be adversely affected.

Additionally, consumers can maintain funds that would have historically been held as bank deposits in brokerage accounts or mutual funds.

Consumers can also complete transactions such as paying bills and/or transferring funds directly without the assistance of banks.

In addition, the emergence, adoption and evolution of new technologies that do not require intermediation, including distributed ledgers such as digital assets and blockchain, as well as advances in robotic process automation, could significantly affect the competition for financial services.

The process of eliminating banks as intermediaries, known as “disintermediation,” could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits.

Our ability to compete successfully depends on a number of factors, including, among other things, (i) the ability to develop, maintain and build long-term customer relationships based on top quality service, high ethical standards and safe, sound assets;

(ii) the ability to expand within our marketplace and with our market position;

(iii) the scope, relevance and pricing of products and services offered to meet customer needs and demands;

(iv) the rate at which we introduce new products and services relative to our competitors;

(v) customer satisfaction with our level of service;

and (vi) industry and general economic trends.

Failure to perform in any of these areas could significantly weaken our

12 TriCo Bancshares 2023 10-K

competitive position, which could adversely affect our growth and profitability, which, in turn, could have a material adverse effect on our business, financial condition and results of operations.

We may be adversely affected by the soundness of other financial institutions.

14 unchanged sentences

Our success depends, to a certain extent, upon local, national and global economic and political conditions, as well as governmental monetary policies.

Conditions such as an economic recession, rising unemployment, inflation, changes in interest rates, declines in asset values and other factors beyond our control may adversely affect our asset quality, deposit levels and our net income.

Conditions such as an economic recession, pandemics, rising unemployment, inflation, changes in interest rates, declines in asset values and other factors beyond our control may adversely affect our asset quality, deposit levels and our net income.

Adverse changes in the economy may also have a negative effect on the demand for new loans and the ability of our existing borrowers to make timely repayments of their loans, which could adversely impact our growth and earnings.

Economic and market conditions may also be affected by political developments in the U.S.

and other countries and global conflicts, such as the conflict in Ukraine.

Uncertainty about the federal fiscal policymaking process, the fiscal outlook of the federal government, and future tax rates is a concern for businesses, consumers and investors in the United States The COVID-19 pandemic has caused and may continue to cause disruptions in the U.S.

economy at large, and for small businesses in particular, and has resulted and may continue to result in disruptions to our customers’ businesses, and a decrease in consumer confidence and business generally.

and other countries and global conflicts, such as the conflicts in Ukraine and the Middle East.

Uncertainty about the federal fiscal policymaking process, the fiscal outlook of the federal government, and future tax rates is a concern for businesses, consumers and investors in the United States The COVID-19 pandemic caused, and its lingering impact may continue to cause, disruptions in the U.S.

economy at large, and for small businesses in particular, and has resulted in and may continue to result in disruptions to our customers’ businesses, and a decrease in consumer confidence and business generally.

If the United States economy weakens or does not improve, our growth and profitability from our lending, deposit and investment operations could be constrained.

Any of these potential outcomes could cause us to suffer losses in our investment securities portfolio, reduce our liquidity and capital levels, hamper our ability to deliver products and services to our clients and customers, and weaken our results of operations and financial condition.

The effects of COVID-19 or a similar health crisis or pandemic, could adversely affect or operations or financial performance.

The lingering effects of COVID-19 or a similar health crisis or pandemic, could adversely affect or operations or financial performance.

and global economies have begun to recover from the COVID-19 pandemic and many health and safety restrictions have been lifted, certain adverse consequences of the pandemic, including labor shortages, disruptions of global supply chains, and inflationary pressures, continue to impact the economy and could adversely affect our business.

The ongoing nature of the pandemic and its effects, such as changes in customer behaviors and preferences, are difficult to predict.

The pandemic or a similar health crisis could cause us to recognize credit losses in our loan portfolios and increases in our allowance for credit losses, particularly if the effects of the pandemic worsen or continue for an extended period of time.

Our business depends on the willingness and ability of our customers and employees to conduct banking and other financial transactions.

Disruptions to our customers caused by the COVID-19 pandemic could result in increased risk of delinquencies, defaults, foreclosures and losses on our loans, as well as reductions in loan demand, the liquidity of loan guarantors, loan collateral values (particularly in real estate), loan originations, interest and noninterest income and deposit availability.

Furthermore, the pandemic could cause us to recognize impairment of our goodwill and our financial assets.

Continued disruptions to our customers caused by the COVID-19 pandemic could result in increased risk of delinquencies, defaults, foreclosures and losses on our loans, as well as reductions in loan demand, the liquidity of loan guarantors, loan collateral values (particularly in real estate), loan originations, interest and noninterest income and deposit availability.

The COVID-19 pandemic has also resulted in heightened operational risks.

1 unchanged sentence

The increase in online and remote banking activities may also increase the risk of fraud in certain instances.

Risks Related to Interest Rates

Adverse developments affecting the financial services industry, such as the failure of three banks in the first half of 2023 or concerns involving liquidity, may have a material effect on the Company’s liquidity, earnings and financial condition.

During the first half of 2023, the financial services industry was negatively affected by three bank failures.

These events caused general uncertainty and concern regarding the adequacy of liquidity within the banking sector as a whole and have decreased investor and customer confidence in banks, notably with regard to mid-sized and larger regional banks.

Although we were not directly affected by these bank failures, the resulting speed and ease in which news or rumors, including social media commentary, led depositors to withdraw or attempt to withdraw their funds from these and other financial institutions caused the stock prices of many financial institutions to become volatile, in particular regional, as well as community banks like us.

Notably, the Company’s share price decreased by 17% during the month of March

13 TriCo Bancshares 2023 10-K

2023, consistent with other community banking organizations.

According to data published by the FRB, deposits at domestic commercial banks decreased by approximately $280 billion between the end of February 2023 and the week ended March 29, 2023.

The Bank’s deposits decreased by $162 million during this period, which was a decrease of 2%.

As a result of these events, customers may choose to maintain deposits with larger financial institutions or in other higher yielding alternatives, which could materially adversely impact the Company’s liquidity, loan funding capacity, net interest margin, capital and results of operations.

The bank failures during 2023 may lead to governmental initiatives intended to prevent future bank failures and stem significant deposit outflows from the banking sector, including (i) legislation aimed at preventing similar future bank runs and failures and stabilizing confidence in the banking sector over the long term, (ii) agency rulemaking to modify and enhance relevant regulatory requirements, specifically with respect to liquidity risk management, deposit concentrations, capital adequacy, stress testing and contingency planning, and safe and sound banking practices, and (iii) enhancement of the agencies’ supervision and examination policies and priorities.

The federal banking agencies may also re-evaluate applicable liquidity risk management standards, such as by reconsidering the mix of assets that are deemed to be "high-quality liquid assets" and/or how HQLA holdings and cash inflows and outflows are tabulated and weighted for liquidity management purposes.

Although we cannot predict the terms and scope of any such initiatives, any of the potential changes referenced above could, among other things, subject us to additional costs, limit the types of financial services and products we may offer, and limit our future growth, any of which could materially and adversely affect our business, results of operations or financial condition.

Risks Related to Interest Rates

Changes in interest rates may make it difficult for us to improve or maintain our current interest income spread and could result in reduced earnings and negatively impact our financial performance.

6 unchanged sentences

Interest rates may be affected by many factors that are beyond the control of our management, including general economic conditions and the policies of various governmental and regulatory authorities.

The actions of the Federal Reserve Board influence the rates of interest that we charge on loans and that we pay on borrowings and interest-bearing deposits.

The actions of the Federal Reserve influence the rates of interest that we charge on loans and that we pay on borrowings and interest-bearing deposits.

Changes in monetary policy, including changes in interest rates, may negatively affect our ability to originate loans and leases, the value of our assets and our ability to realize gains from the sale of our assets, all of which ultimately could affect our earnings.

In addition, the Federal Reserve raised benchmark interest rates throughout 2022 and may continue to raise interest rates in response to economic conditions, particularly inflationary pressures.

The Federal Reserve raised benchmark interest rates in 2022 and 2023 and may continue to raise or keep interest rates high in response to economic conditions, particularly inflationary pressures.

We cannot predict the nature or timing of future changes in monetary, tax and other policies or the effects that they may have on our activities and financial results.

1 unchanged sentence

Although we were successful in generating new loans during 2023, increasing interest rates may adversely affect the demand for new loans and our loan growth.

To supplement our organic loan growth, we from time-to-time will purchase loans from third parties that may have lower yields than those loans that we originate on our own.

To supplement our organic loan growth, we from time-to-time may purchase loans from third parties that may have lower yields than those loans that we originate on our own.

Additionally, interest rate increases often result in larger payment requirements for our borrowers with variable rate loans, which increases the potential for default and could result in a decrease in the demand for loans.

6 unchanged sentences

Accordingly, changes in levels of market interest rates could materially and adversely affect our net interest spread, asset quality, loan origination volume, business, financial condition and results of operations.

Higher inflation could have a negative impact on our financial results and operations.

Higher or prolonged inflation could have a negative impact on our financial results and operations.

14 TriCo Bancshares 2023 10-K

Inflation may negatively affect us by increasing our labor costs, through higher wages and higher interest rates, which may negatively affect the market value of securities on our balance sheet, higher interest expenses on our deposits, especially CDs, and a higher cost of our borrowings.

10 unchanged sentences

In assessing whether the impairment of investment securities is other-than-temporary, we consider the length of time and extent to which the fair value has been less than cost, the financial condition and near-term prospects of the issuer, and the intent and ability to retain our investment in the security for a period of time sufficient to allow for any anticipated recovery in fair value in the near term.

13 TriCo Bancshares 2022 10-K

Changes to LIBOR or SOFR may adversely affect the value of, and the return on, our financial instruments that are indexed to LIBOR or SOFR.

In July 2017, the U.K.

Financial Conduct Authority, which regulates LIBOR, announced that it will no longer persuade or compel banks to submit rates for the calculation of LIBOR to the LIBOR administrator after 2021.

The announcement indicates that the continuation of LIBOR on the current basis cannot and will not be guaranteed after 2021.

In November 2020, the LIBOR administrator published a consultation regarding its intention to delay the date on which it will cease publication of U.S.

dollar LIBOR from December 31, 2021 to June 30, 2023 for the most common tenors of U.S.

dollar LIBOR, including the three-month LIBOR, but indicated no new contracts using U.S.

dollar LIBOR should be entered into after December 31, 2021.

Notwithstanding the publication of this consultation, there is no assurance of how long LIBOR of any currency or tenor will continue to be published.

It is impossible to predict whether and to what extent banks will continue to provide LIBOR submissions to the administrator of LIBOR, whether LIBOR rates will cease to be published before June 30, 2023, or whether any additional reforms to LIBOR may be enacted in the United Kingdom or elsewhere.

Although the Alternative Reference Rates Committee has announced Secured Overnight Financing Rate (“SOFR”) as its recommended alternative to LIBOR, SOFR may not gain market acceptance or be widely used as a benchmark.

Uncertainty as to the nature of such potential changes, alternative reference rates, the elimination or replacement of LIBOR, or other reforms may adversely affect the value of, and the return on our financial instruments.

The market transition away from LIBOR to alternative reference rates is complex and could have a range of adverse effects on the Company’s business, financial condition, and results of operations.

In particular, any such transition could:

• adversely affect the interest rates received or paid on the revenue and expenses associated with or the value of the Company’s LIBOR-based assets and liabilities;

• adversely affect the interest rates received or paid on the revenue and expenses associated with or the value of other securities or financial arrangements, given LIBOR's role in determining market interest rates globally;

• prompt inquiries or other actions from regulators in respect of the Company’s preparation and readiness for the replacement of LIBOR with an alternative reference rate;

• result in disputes, litigation, or other actions with borrowers or counterparties about the interpretation and enforceability of certain fallback language in LIBOR-based contracts and securities.

If we are required to sell securities to meet liquidity needs, we could realize significant losses.

As a result of increases in interest rates over the last year, the market values of previously issued government and other debt securities have declined in value, resulting in unrealized losses in our securities portfolio.

While we anticipate that the scheduled cash flows generated from our investment portfolio will be adequate to support the liquidity needs of the Company, if we were required to sell these securities to expedite the generation of cash flows to meet liquidity needs, we may be required to realize significant losses, which could impair our capital and financial condition and adversely affect our results of operations.

Further, while we have taken actions to maximize our sources of liquidity, there is no guarantee that such sources will be available or sufficient in the event of sudden liquidity needs.

Risks Related to Regulatory and Legal Matters

2 unchanged sentences

Furthermore, regulations may prevent or impair our ability to pay dividends, engage in acquisitions or operate in other ways.

We are subject to extensive regulation, supervision and examination by the DPFI, FDIC, and the FRB.

See Item 1—Regulation and Supervision of this report for information on the regulation and supervision which governs our activities.

We are subject to extensive regulation, supervision and examination by the DFPI, FDIC, and the FRB as well as regulations and policies of the CFPB.

Business - Regulation and Supervision" of this report for information on the regulation and supervision which governs our activities.

Regulatory authorities have extensive discretion in their supervisory and enforcement activities, including the imposition of restrictions on our operations, the classification of our assets and determination of the level of our allowance for credit losses.

Banking regulations, designed primarily for the protection of depositors, may limit our growth and the return to our shareholders by restricting certain of our activities, such as:

Banking regulations or the actions of our banking regulators may limit our growth, earnings and the return to our shareholders by restricting certain of our activities, such as:

• the payment of dividends to our shareholders,

7 unchanged sentences

We also are subject to regulatory capital requirements.

We could be subject to regulatory enforcement actions if any of our regulators determines for example, that we have violated a law of regulation, engaged in unsafe or unsound banking practice or lack adequate capital.

We could be subject to regulatory enforcement actions if any of our regulators determines for example, that we have violated a law or regulation, engaged in unsafe or unsound banking practice or lack adequate capital.

Federal and state governments and regulators could pass legislation and adopt policies responsive to current credit conditions that would have an adverse effect on us and our financial performance.

1 unchanged sentence

Any change in such regulation and oversight, whether in the form of regulatory policy, regulations, legislation or supervisory action, may have a material adverse impact on our operations, including the cost to conduct business.

Risks Related to Our Growth and Expansion

15 TriCo Bancshares 2023 10-K

Furthermore, The evolving landscape of legislative and regulatory actions, influenced by election cycles, introduces an additional layer of uncertainty for our operations.

Elections can precipitate changes in government policies and regulations across various industries, potentially impacting our business.

Uncertainty regarding potential changes in regulations or policies related to our industry may lead to increased costs of doing business and operational challenges.

Economic conditions, including interest rates, inflation, and consumer spending, may be influenced by shifts in government leadership and policies, affecting our ability to maintain historical growth rates.

Furthermore, the election process often introduces market volatility, impacting financial markets, currency exchange rates, and commodity prices.

This volatility may pose risks to our financial performance, cost of capital, and access to funding.

The outcomes of elections may directly affect our industry, influencing regulatory frameworks and industry dynamics.

Shifts in political power may shape the competitive landscape, impacting market share and pricing strategies.

Unfavorable changes in industry-specific regulations could result in increased compliance costs and operational challenges.

Political events, including elections, can influence consumer and investor sentiment, affecting demand for our products and services and impacting investor confidence, which may influence our stock price and access to capital.

Risks Related to Our Growth and Expansion

Goodwill resulting from acquisitions may adversely affect our results of operations.

Our goodwill and other intangible assets have increased substantially as a result of our acquisitions of Valley Republic Bank in 2022, FNB Bancorp in 2018 and North Valley Bancorp in 2014.

Our balance sheet contains a substantial level of goodwill and other intangible assets as a result of our acquisitions, including Valley Republic Bancorp in 2022.

Potential impairment of goodwill and amortization of other intangible assets could adversely affect our financial condition and results of operations.

17 unchanged sentences

• potential changes in banking or tax laws or regulations that may affect the target company,

• potential disruption to our business, and

• potential disruption to our business,

• an acquisition may dilute our earnings per share, in both the short and long term, or it may reduce our tangible capital ratios.

3 unchanged sentences

Furthermore, our ability to engage in certain merger or acquisition transactions depends on the bank regulators' views at the time as to our capital levels, quality of management, and overall condition, in addition to their assessment of a variety of other factors, including our compliance with laws and regulations.

Regulatory approvals could be delayed, impeded, restrictively conditioned or denied due to existing or new regulatory issues we have, or may have, with regulatory agencies, including, without limitation, issues related to BSA compliance, CRA compliance, fair lending laws, fair housing laws, consumer protection laws and other laws and regulations.

We may fail to pursue, evaluate or complete strategic and competitively significant acquisition opportunities as a result of our inability, or perceived or anticipated inability, to obtain regulatory approvals in a timely manner, under reasonable conditions or at all.

Regulatory approvals could be delayed, impeded, restrictively conditioned or denied due to existing or new regulatory issues we have, or may have, with regulatory agencies, including, without limitation, issues related to BSA/AML compliance, CRA performance, fair lending laws, fair housing laws, consumer protection laws and other laws and regulations.

We may fail to pursue, evaluate or complete strategic and competitively significant acquisition opportunities as a result of our inability, or

16 TriCo Bancshares 2023 10-K

perceived or anticipated inability, to obtain regulatory approvals in a timely manner, under reasonable conditions or at all.

Difficulties associated with potential acquisitions that may result from these factors could have a material adverse effect on our business, financial condition and results of operations.

6 unchanged sentences

Our growth and expansion may strain our ability to manage our operations and our financial resources.

15 TriCo Bancshares 2022 10-K

Our financial performance and profitability depend on our ability to execute our corporate growth strategy.

12 unchanged sentences

The Bank had slightly less than $10 billion in total assets at December 31, 2023, so it is possible that with only modest growth, the CFPB, instead of the FDIC, may soon have primary examination and enforcement authority over the Bank.

As an independent bureau within the Federal Reserve Board focused solely on consumer financial protection, the CFPB may interpret or enforce consumer protection laws more strictly or severely than the FDIC.

As an independent bureau focused solely on consumer financial protection, the CFPB may interpret or enforce consumer protection laws more strictly or severely than the FDIC.

Additionally, other regulatory requirements apply to depository institutions and holding companies with $10 billion or more in total consolidated assets, including a cap on interchange transaction fees for debit cards, as required by Federal Reserve Board regulations, which would reduce our interchange revenue, and restrictions on proprietary trading and investment and sponsorship in hedge funds and private equity funds known as the Volcker Rule.

See also Item 1 - Regulation and Supervision - Interchange Fees in this report.

See also "Item 1 - Business - Regulation and Supervision - Interchange Fees" in this report.

Further, deposit insurance assessment rates are calculated differently, and may be higher, for insured depository institutions with $10 billion or more in total consolidated assets.

3 unchanged sentences

The FRB has issued a policy statement on the payment of cash dividends by bank holding companies, which expresses the FRB’s view that a bank holding company should pay cash dividends only to the extent that its net income for the past year is sufficient to cover both the cash dividends and a rate of earnings retention that is consistent with the holding company’s capital needs, asset quality and overall financial condition.

See “Regulation and Supervision – Restrictions on Dividends and Distributions.”

Business - Regulation and Supervision – Restrictions on Dividends and Distributions.”

As a holding company with no significant assets other than the Bank, our ability to continue to pay dividends depends in large part upon the Bank’s ability to pay dividends to us.

The Bank’s ability to pay dividends or make other capital distributions to us is subject to the restrictions in the California Financial Code.

Our ability to pay dividends to our shareholder and the ability of the Bank to pay in dividends to us are by the requirements that the we and the Bank maintain a certain minimum amount of capital to be considered a “well capitalized” institution as well as a separate capital conservation buffer, as further described under “Item 1 – Supervision and Regulation — Regulatory Capital Requirements” in this report.

Our ability to pay dividends to our shareholders and the ability of the Bank to pay in dividends to us are subject to the requirements that we and the Bank maintain a sufficient level of capital to be considered a “well capitalized” institution as well as a separate capital conservation buffer, as further described under “Item 1.

Business - Supervision and Regulation — Regulatory Capital Requirements” in this report.

From time to time, we may become a party to financing agreements or other contractual arrangements that have the effect of limiting or prohibiting us or the Bank from declaring or paying dividends.

Our holding company expenses and obligations with respect to our trust preferred securities and corresponding junior subordinated deferrable interest debentures issued by us may limit or impair our ability to declare or pay dividends.

17 TriCo Bancshares 2023 10-K

Provisions of our governing documents and federal law may limit the ability of another party to acquire us, which could cause our stock price to decline.

Various provisions of our articles of incorporation and bylaws could delay or prevent a third party from acquiring us, even if doing so might be beneficial to our shareholders.

These provisions provide for, among other things, specified actions that the Board of Directors shall or may take when an offer to merge, an offer to acquire all assets or a tender offer is received and the authority to issue preferred stock by action of the board of directors acting alone, without obtaining shareholder approval.

These provisions provide for, among other things, specified factors that the Board of Directors shall or may consider when evaluating an offer to merge, an offer to acquire all assets or a tender offer is received;

advance notice provisions for director nominations and shareholder proposals;

and the authority to issue preferred stock by action of the board of directors acting alone, without obtaining shareholder approval.

The BHC Act and the Change in Bank Control Act of 1978, as amended, together with federal regulations, require that, depending on the particular circumstances, either FRB approval must be obtained or notice must be furnished to the Federal Reserve Board and not disapproved prior to any person or entity acquiring “control” of a bank holding company such as TriCo.

These provisions may prevent a merger or acquisition that would be attractive to shareholders and could limit the price investors would be willing to pay in the future for our common stock

16 TriCo Bancshares 2022 10-K

Holders of our junior subordinated debentures have rights that are senior to those of our shareholders.

We have supported our growth through the prior issuance of trust preferred securities from special purpose trusts and accompanying junior subordinated debentures.

At December 31, 2022, we had outstanding trust preferred securities and accompanying junior subordinated debentures with principal amount of $98,889,000.

At December 31, 2023, we had outstanding trust preferred securities and accompanying junior subordinated debentures with principal amount of $101.1 million.

Payments of the principal and interest on the trust preferred securities are conditionally guaranteed by us.

1 unchanged sentence

As a result, we must make payments on the junior subordinated debentures before we can pay any dividends on our common stock and, in the event of our bankruptcy, dissolution or liquidation, the holders of the junior subordinated debentures must be satisfied before any distributions can be made on our common stock.

We may issue additional common stock or other equity securities in the future which could dilute the ownership interest of existing shareholders.

In order to maintain our capital at desired or regulatory-required levels, or to fund future growth, our board of directors may decide from time to time to issue additional shares of common stock, or securities convertible into, exchangeable for or representing rights to acquire shares of our common stock.

The sale of these shares may significantly dilute your ownership interest as a shareholder.

New investors in the future may also have rights, preferences and privileges senior to our current shareholders which may adversely impact our current shareholders.

The trading price of our common stock price can be volatile.

Stock price volatility may make it more difficult for our shareholders to resell their common stock when they want and at prices they find attractive.

The trading price of our common stock can fluctuate significantly in response to a variety of factors including, among other things:

• actual or anticipated variations in quarterly results of operations;

• recommendations by securities analysts;

• operating and stock price performance of other companies that investors deem comparable to the Company;

• trends, concerns and other issues in the financial services industry or California economy;

• investor sentiments toward depository institutions generally;

• marketplace perceptions in the marketplace regarding the Company and/or its competitors;

• new technology used, or services offered, by competitors;

• significant acquisitions or business combinations involving the Company or its competitors;

• changes in government regulations, including tax laws.

General market fluctuations, industry factors and general economic and political conditions and events, such as economic slowdowns or recessions, interest rate changes or credit loss trends could also cause the Company’s stock price to decrease regardless of operational results.

Risks Relating to Operations, Technology Systems, Accounting and Internal Controls

4 unchanged sentences

We continually review and analyze our internal control over financial reporting for Sarbanes-Oxley Section 404 compliance.

As part of that process we may discover material weaknesses or significant deficiencies in our internal control as defined under standards adopted by the Public Company Accounting Oversight Board that require remediation.

A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented or detected in a timely basis.

A significant deficiency is a deficiency or combination of deficiencies, in internal control over financial reporting that is less severe than material weakness, yet important enough to merit attention by those responsible for the oversight of the Company’s financial reporting.

As a result of weaknesses that may be identified in our internal controls, we may also identify certain deficiencies in some of our disclosure controls and procedures that we believe require remediation.

If we discover weaknesses, we will make efforts to improve our internal and disclosure controls.

However, there is no assurance that we will be successful.

As part of that process we may discover material weaknesses or significant deficiencies in our internal controls.

Any failure to maintain effective controls or timely effect any necessary improvement of our internal and disclosure controls could harm operating results or cause us to fail to meet our reporting obligations, which could affect our ability to remain listed with Nasdaq.

Ineffective internal and disclosure controls could also cause investors to lose confidence in our reported financial information, which would likely have a negative effect on the trading price of our securities.

We experienced a criminal cyberattack in February 2023, which resulted in the temporary interruption of our systems, disclosure of certain confidential information, litigation and governmental inquiries, all of which could damage our reputation or create additional financial and legal exposure.

As previously disclosed in the Current Report on Form 8-K we filed on February 14, 2023, the Bank experienced a cybersecurity incident in February 2023.

After detecting unusual network activity, we shut down networked systems by taking them offline, which prevented access to internal systems, data and telephones for a limited period of time.

We immediately launched an investigation and notified law enforcement and banking regulators.

A digital forensics firm was engaged to help determine the scope of the incident and identify potentially impacted data.

We received a demand for ransom from a party claiming responsibility for the incident.

The Bank’s core banking systems, including those that facilitate loan and deposit related transactions, were not affected and the Bank’s resumed customer facing operations within two days.

However, the Bank’s internal system/server access as well as communication capabilities, including e-mail correspondence and telephones, required approximately one week of time for the restoration process to be completed in a safe and secure environment.

The Company restored its systems without paying ransom.

The Bank worked with third-party forensic investigators to understand the nature and scope of the incident and to determine what and how much information was impacted.

The Bank determined that its internal computer network had been infected with malware which prevented access to certain files on the network.

Through its investigation, the Bank determined that an unauthorized actor illegally accessed and acquired data from certain systems, including the personal information of approximately 86,000 individuals, including certain current and former customers, individuals related to current and former customers, current and former employees and their dependents, and others.

While the information impacted varied by individual, the types of information that were impacted included name, social security number, driver’s license number, state identification number, financial account information, medical information, health insurance information, date of birth, passport number, digital/electronic signature, tax identification number, access credentials, and mother’s maiden name.

The Bank notified and will continue to notify impacted individuals consistent with state and federal requirements and the Bank is offering impacted individuals credit restoration services and 24 months of credit monitoring services at no cost.

The Bank issued a press release regarding this event and posted notice of this event on its website.

18 TriCo Bancshares 2023 10-K

A failure or breach, including cyberattacks, of our operational or security systems or of those of our customers or contracted vendors, could disrupt our business, result in the disclosure of confidential information, damage our reputation, and create significant financial and legal exposure.

We, our customers, our vendors, regulators and other third parties have been subject to, and are likely to continue to be the target of, cyberattacks.

Although we devote significant resources to maintain and regularly upgrade our systems and processes that are designed to protect the security of our computer systems, software, networks, and other technology assets and the confidentiality, integrity, and availability of information belonging to us and our customers, there is no assurance that our security measures will provide absolute security.

Further, to access our products and services our customers may use computers and mobile devices that are beyond our security control systems.

In recent years, many financial institutions, including the Company, have been subjected to sophisticated and targeted attacks intended to obtain unauthorized access to confidential information, destroy data, disrupt or degrade service, sabotage systems or cause other damage, including through the introduction of computer viruses or malware, cyber attacks and other means and expect to be subject to such attacks in the future.

Certain financial institutions and companies involved in data processing in the United States have also experienced attacks from technically sophisticated and well-resourced third parties that were intended to disrupt normal business activities by making internet banking systems inaccessible to customers for extended periods.

These “denial-of-service” attacks have not breached our data security systems, but require substantial resources to defend, and may affect customer satisfaction and behavior.

As a result of the 2023 cyberattack, we have incurred and may continue to incur significant costs or experience other material financial impacts, which may not be covered by, or may exceed the coverage limits of, our cyber liability insurance, and such costs and impacts may have a material adverse effect on our business, reputation, financial condition and operating results.

These risks may stem from litigation or governmental inquiries litigation to which we currently are or may become subject in connection with this incident, and the extent of remediation and other additional costs that may be incurred by us.

We face numerous lawsuits related to the 2023 cyberattack, including three purported class action lawsuits that have been filed in California Superior Court for the Counties of Contra Costa and Butte, seeking unspecified monetary damages, equitable relief, costs and attorneys’ fees.

The lawsuits allege breach of contract, negligence, violations of various privacy laws and a variety of other legal causes of action.

We are currently unable to predict the potential outcome of any of this litigation or whether we may be subject to further private litigation.

In addition, the Company has received inquiries from various government authorities related to the 2023 cyberattack, which could result in sanctions, fines or penalties.

We are responding to these inquiries and cooperating fully.

However, we cannot predict the timing or outcome of any of these inquiries, or whether we may be subject to further governmental inquiries.

Given the uncertainties about any further impacts of the incident, including the inherent uncertainties involved in litigation, contractual obligations, government investigations and regulatory enforcement decisions, we face the risk that outcomes from these risks could have a material adverse effect on our reputation, business and/or financial condition.

In addition, litigation, government interventions, and negative media reports and any resulting damage to our reputation or loss of confidence in the security of our systems could adversely affect our business.

It is possible that we could incur losses associated with these proceedings and inquiries, and the Company will continue to evaluate information as it becomes known and will record an estimate for losses at the time or times when it is both probable that a loss has been incurred and the amount of the loss is reasonably estimable.

Ongoing legal and other costs related to these proceedings and inquiries, as well as any potential future proceedings and inquiries, may be substantial, and losses associated with any adverse judgments, settlements, penalties or other resolutions of such proceedings and inquiries could be material to our business, reputation, financial condition and operating results.

We face the risk that failures or breaches, including cyberattacks, of our operational or security systems or of those of our customers or vendors, could disrupt our business, result in the disclosure of confidential information, damage our reputation, and create significant financial and legal exposure.

We, our customers, our vendors, and other third parties have been subject to, and are likely to continue to be the target of, persistent cyberattacks.

Despite our efforts to ensure the integrity of our systems, we may not be able to anticipate or to implement effective preventive measures against all security breaches.

Attacker's tools and techniques evolve frequently, and because attacks may originate from a wide variety of sources, including, but not limited to, state-sponsored parties, organized crime, terrorist organizations, malicious actors, employees, contractors, or other third parties.

Those parties may attempt, for example, to fraudulently induce employees, customers or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers and others;

may seek to exploit bugs, errors, misconfigurations or other vulnerabilities in our systems to obtain access to our systems;

may seek to obtain unauthorized access to our systems or confidential information by exploiting insider access or utilizing log-in credentials taken from our customers, employees, or third-party providers by various illicit means;

and may seek to disrupt and damage our business operations and systems through ransomware or distributed denial of service attacks.

We have implemented employee and customer awareness training regarding phishing, malware, and other cyber risks, however there can no assurances that this training will be effective or sufficient.

Furthermore, these risks are expected to increase in the future as we continue to increase our electronic payments and other internet-based product offerings and expand our internal usage of web-based products and applications.

Continued geographical turmoil, including the ongoing conflict between Russia and Ukraine, has heightened the risk of cyberattack and has created new risk for cybersecurity, and similar concerns.

For example, the United States government has warned that sanctions imposed against Russia by the United States in response to its conflict with Ukraine could motivate Russia to engage in malicious cyber activities against the United States.

If such cyberattacks occurred, it could result in severe costs and disruptions to governmental entities and companies and their operations.

The impact of the conflict and retaliatory measures is continually evolving and cannot be predicted with certainty.

Despite our efforts to ensure the integrity of our systems, it is possible that we may not be able to anticipate or to implement effective preventive measures against all security breaches of these types, especially because the techniques used change frequently or are not recognized until launched, and because security attacks can originate from a wide variety of sources, including persons who are involved with organized crime or associated with external service providers or who may be linked to terrorist organizations or hostile foreign governments.

Those parties may also attempt to fraudulently induce employees, customers or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or clients.

We have implemented employee and customer awareness training around phishing, malware, and other cyber risks, however there can no assurances that this training will be completely effective.

These risks may increase in the future as we continue to increase our electronic payments and other internet-based product offerings and expand our internal usage of web-based products and applications.

If our security systems or those of our third party vendors, contractors and customers are penetrated or circumvented, it could cause serious negative consequences for us, including significant disruption of our operations, misappropriation or theft of our confidential information or that of our customers, or damage our computers or systems and those of our customers and counterparties, and could result in violations of applicable privacy and other laws, financial loss to us or to our customers, loss of confidence in our security measures, customer dissatisfaction, significant litigation exposure, and harm to our reputation, all of which could have a material adverse effect on us.

If personal, confidential or proprietary information of customers or clients in the Bank’s or such vendors’ or other third-parties’ possession were to be mishandled or misused, we could suffer significant regulatory consequences, reputational damage and financial loss.

We may not be able to anticipate all security breaches, nor may we be able to implement guaranteed preventive measures against such security breaches.

Additionally, a security breach may be difficult to detect, even after it occurs, which may compound the issues related to such breach.

For example, as previously disclosed in the Current Report 8-K filed by us on February 14, 2023, the Bank experienced a network security incident, where unusual network activity was detected, and management shut down all networked systems which prevented employees from accessing internal systems, data and telephones for a limited period of time.

Upon discovering the incident, the Bank immediately launched an investigation and engaged a digital forensics firm to help determine the scope of the incident and identify potentially impacted data.

In addition, the Bank promptly notified law enforcement and banking regulators about the incident.

The Bank believes that its core banking systems, including those that facilitate loan or deposit related transactions, were not affected by this event as evidenced by the Bank’s general ability to resume customer facing operations within two days.

However, the Bank’s internal system access as well as communication capabilities, including e-mail correspondence and telephones, required approximately one week of time for the restoration process to be completed in a safe and secure environment.

The Bank continues to work with third-party forensic investigators to understand the nature and scope of the incident and to determine what information may have been accessed and who may have been impacted.

The investigation is on-going.

While we continue to evaluate the impact of this incident, we remain subject to risks and uncertainties as a result, including legal, reputational, and financial risks, the results of our ongoing investigation of this security incident, any potential regulatory inquiries and/or litigation to which we may become subject in connection with this incident, and the extent of remediation and other additional costs that may be incurred by us.

To date, we do not believe such consequences are material, however the network security incident is still recent and the investigation is ongoing.

Although we maintain insurance coverage, including cybersecurity insurance, the amount of coverage available may not cover all losses.

We anticipate that we will incur additional expenses in future periods.

Network breaches at other financial institutions have, in some instances, resulted in litigation, government investigations and other regulatory enforcement inquiries.

Given the uncertainties about the impact of the incident and the inherent uncertainties involved in litigation, government investigations and regulatory

If personal, confidential or proprietary information of customers or others in the Bank’s or such vendors’ or other third-parties’ possession were to be mishandled or misused, we could suffer significant regulatory consequences, reputational damage and financial loss, as discussed earlier regarding the Bank's 2023 cyberattack.

Our procedures and safeguards to prevent unauthorized access to confidential information and to defend against cyberattacks seeking to disrupt our operations must be continually evaluated and enhanced to address the ever-evolving threat landscape and changing cybersecurity regulations.

These preventative actions require the investment of significant resources and management time and attention.

Nevertheless, we may not be able to anticipate, prevent, timely detect and/or effectively remediate all security breaches.

19 TriCo Bancshares 2023 10-K

enforcement decisions, there is significant uncertainty as to the ultimate liability and expense we may incur from these kinds of matters, if any.

The finding, or even the assertion, of substantial legal liability against us and any regulatory enforcement actions could have a material adverse effect on our business and financial condition and could cause significant reputational harm to us, which could seriously harm our business.

In addition, litigation, regulatory interventions, and media reports of perceived security vulnerabilities and any resulting damage to our reputation or loss of confidence in the security of our systems could adversely affect our business.

As cyber threats continue to evolve, we have been and will likely continue to be required to expend significant resources to continuously enhance our protective measures and may be required to expend significant resources to investigate and remediate any information security vulnerabilities or incidents.

Any inability to prevent or adequately respond to the issues described above could disrupt the Company’s business, inhibit its ability to retain existing customers or attract new customers, otherwise harm its reputation and/or result in financial losses, litigation, increased costs or other adverse consequences that could be material to the Company.

Our reliance on third-party vendors exposes us to risks, including additional cybersecurity risks.

3 unchanged sentences

Although we require third-party providers and these fourth-party vendors to maintain certain levels of information security, such providers may remain vulnerable to breaches, unauthorized access, misuse, computer viruses, or other malicious attacks that could ultimately compromise sensitive information.

Additionally, we do not have control of the cybersecurity systems, breach prevention, and response protocols of our third- or fourth-party vendors, including through our cybersecurity programs or policies.

While the Company may have contractual rights to assess the effectiveness of many of our providers’ systems and protocols, we do not have the means to know or assess the effectiveness of all of our providers’ systems and controls at all times.

We cannot provide any assurances that actions taken by us, or our third- or fourth-party vendors, including through our cybersecurity programs or policies, will adequately prevent or substantially mitigate the impacts of cybersecurity breaches or misuses of confidential information, unauthorized access to our networks or systems or exploits against third-or fourth-party environments, or that we, or our third- or fourth-party vendors, will be able to effectively identify, investigate, and remediate such incidents in a timely manner or at all.

While we may contractually limit our liability in connection with attacks against third-party providers, we remain exposed to the risk of loss associated with such vendors.

2 unchanged sentences

Failures of certain vendors to provide contracted services could adversely affect our ability to deliver products and services to our customers and cause us to incur significant expense.

These types of third-party relationships are subject to evolving and increasingly demanding regulatory requirements and attention by our bank regulators.

Regulatory guidance requires us to enhance our due diligence, ongoing monitoring and control over our third-party vendors and subcontractors and other ongoing third-party business relationships.

In certain cases, we may be required to renegotiate our agreements with these vendors and/or their subcontractors to meet these enhanced requirements, which could increase our costs.

If our regulators conclude that we have not exercised adequate oversight and control over our third-party vendors and subcontractors or other ongoing third-party business relationships, or that such third parties have not performed appropriately, we could be subject to enforcement actions, including the imposition of civil money penalties or other administrative or judicial penalties or fines as well as requirements for customer remediation.

We are subject to certain industry standards regarding our credit/debit card-related services.

Failure to meet those standards may significantly impact our ability to offer these services.

We are subject to the PCI-DSS, issued by the Payment Card Industry Security Standards Council.

PCI-DSS contains compliance guidelines with regard to our security surrounding the physical and electronic storage, processing and transmission of cardholder data.

Compliance with PCI-DSS and implementing related procedures, technology and information security measures requires significant resources and ongoing attention.

Costs and potential problems and interruptions associated with the implementation of new or upgraded systems and technology, such as those necessary to achieve compliance with PCI-DSS or with maintenance or adequate support of existing systems could also disrupt or reduce the efficiency of our operations.

Any material interruptions or failures in our payment-related systems or third parties that we rely upon could have a material adverse effect on our business, results of operations and financial condition.

If there are amendments to PCI-DSS, the cost of compliance could increase, and we may suffer loss of critical data and interruptions or delays in our operations as a result.

If we or our service providers are unable to comply with the standards imposed by PCI-DSS, we may be subject to fines and restrictions on our ability to offer certain services, which could materially and adversely affect our business.

Our business is highly reliant on technology and our ability and our third-party service providers to manage the operational risks associated with technology.

6 unchanged sentences

Our inability to use or access these information systems at critical points in time could unfavorably impact the timeliness and efficiency of our business operations.

A material breach of customer data security [such as a possible breach of customer data in connection with the network security incentive discussed above, may negatively impact our business reputation and cause a loss of customers, result in increased expense to contain the event and/or require that we provide credit monitoring services for affected customers, result in regulatory fines and sanctions and/or result in litigation.

A breach of customer data security such as the breach of customer data in connection with the February 2023

20 TriCo Bancshares 2023 10-K

cyberattack discussed above, may negatively impact our business reputation and cause a loss of customers.

This event has resulted in increased expenses to contain the event, to notify impacted individuals and provide them with credit monitoring services, and to defend / respond to litigation.

Cybersecurity risk management programs are expensive to maintain and will not protect us from all risks associated with maintaining the security of customer data and our proprietary data from external and internal intrusions, disaster recovery and failures in the controls used by our vendors.

1 unchanged sentence

As cybersecurity and data privacy risks for banking organizations and the broader financial system have significantly increased in recent years, cybersecurity and data privacy issues have become the subject of increasing legislative and regulatory focus.

The federal bank regulatory agencies have proposed enhanced cyber risk management standards, which would apply to a wide range of large financial institutions and their third-party service providers, including us, and would focus on cyber risk governance and management, management of internal and external dependencies, and incident response, cyber resilience and situational awareness.

The federal bank regulatory agencies have proposed enhanced cyber risk management standards, which would apply to a wide range of large financial institutions and their third-party service providers, including us, and would focus on cyber risk governance and management, management of internal and external dependencies, incident response, cyber resilience and situational awareness.

Several states have also proposed or adopted cybersecurity legislation and regulations, which require, among other things, notification to affected individuals when there has been a security breach of their personal data.

For more information regarding cybersecurity regulation, refer to the “Supervision and Regulation” section of this report.

For more information regarding cybersecurity regulation, refer to "Item 1.

Business - Supervision and Regulation.”

We receive, maintain and store non-public personal information of our customers and counterparties, including, but not limited to, personally identifiable information and personal financial information.

1 unchanged sentence

Both personally identifiable information and personal financial information is increasingly subject to legislation and regulation, the intent of which is to protect the privacy of personal information that is collected and handled.

For more information regarding data privacy regulation, refer to the “Supervision and Regulation” section of this report.

For more information regarding data privacy regulation, refer to “Item 1.

Business - Supervision and Regulation.”

We may become subject to new legislation or regulation concerning cybersecurity or the privacy of personally identifiable information and personal financial information or of any other information we may store or maintain.

We could be adversely affected if new legislation or regulations are adopted or if existing legislation or regulations are modified such that we are required to alter our systems or require changes to our business practices or privacy policies.

If new or existing cybersecurity, data privacy, data protection, data transfer or data retention laws are implemented, interpreted or applied in a manner inconsistent with our current practices, including as a result of the network security incident discussed above, we may be subject to fines, litigation or regulatory enforcement actions or ordered to change our

19 TriCo Bancshares 2022 10-K

business practices, policies or systems in a manner that adversely impacts our operating results.

In addition, any additional laws and regulatory enforcement measures will result in increased compliance costs.

10 unchanged sentences

As a result, our business, financial condition or results of operations may be adversely affected.

Our business is susceptible to fraud and conduct risk.

The Company’s business exposes it to fraud risk from loan and deposit customers, the parties they do business with, as well as from employees, contractors and vendors.

The Company relies on financial and other data from new and existing customers which could turn out to be fraudulent when accepting such customers, executing their financial transactions and making and purchasing loans and other financial assets.

In times of increased economic stress the Company is at increased risk of fraud losses.

The Company believes it has underwriting and operational controls in place to prevent or detect such fraud, but cannot provide assurance that these controls will be effective in detecting fraud or that the Company will not experience fraud losses or incur costs or other damage related to such fraud, at levels that adversely affect financial results or reputation.

The Company’s lending customers may also experience fraud in their businesses which could adversely affect their ability to repay their loans or make use of services.

The Company’s and its customers’ exposure to fraud may increase the Company’s financial risk and reputation risk as it may result in unexpected loan losses that exceed those that have been provided for in the allowance for credit losses.

In addition, the Company is subject to risk from the conduct of its employees, including the negative impact that can result from employee misconduct or failure by employees to conduct themselves in accordance with the Company’s policies, all of which could damage the Company’s reputation and result in loss of customers or other financial loss or expose the Company to increased regulatory or other risk.

New lines of business, products or services and technological advancements may subject us to additional risks.

From time to time, we implement new lines of business or offer new products and services within existing lines of business.

There are substantial risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed.

In developing and marketing new lines of business and/or new products and services we invest significant time and resources.

21 TriCo Bancshares 2023 10-K

timetables for the introduction and development of new lines of business and/or new products or services may not be achieved, and price and profitability targets may not prove feasible.

External factors, such as compliance with regulations, competitive alternatives, and shifting market preferences, may also impact the successful implementation of a new line of business or a new product or service.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services.

Our future success depends, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations.

Many of our competitors have substantially greater resources to invest in technological improvements.

We may not be able to effectively implement new technology driven products and services or be successful in marketing these products and services to our customers.

In addition, our implementation of certain new technologies, such as those related to artificial intelligence ("AI"), automation and algorithms, in our business processes may have unintended consequences due to their limitations or our failure to use them effectively.

In addition, the growing reliance on AI technologies by vendors, business partners, and technology solutions or applications introduces additional risks, including but not limited to:

Algorithmic Bias that may result in unintended discriminatory outcomes and harm our reputation, loss of proprietary and confidential information through use of AI technologies, unauthorized access or breaches of data could compromise the integrity of our systems with AI dependency, evolving regulations and legal frameworks surrounding AI may pose challenges leading to legal and financial consequences for non-compliance, and protecting the intellectual property associated with AI technologies may be challenging, and unauthorized use or infringement by third parties could bring harm to our competitive position or reputation.

Furthermore, cloud technologies are also critical to the operation of our systems, and our reliance on cloud technologies is growing.

Failure to successfully keep pace with technological change affecting the financial services industry could have a material adverse effect on our business, financial condition and results of operations.

Furthermore, any new line of business, new product or service and/or new technology could have a significant impact on the effectiveness of our system of internal controls.

Failure to successfully manage these risks in the development and implementation of new lines of business, new products or services and/or new technologies could have a material adverse effect on our business, financial condition and results of operations.

Our failure to comply with anti-money laundering and anti-terrorism financing laws could have significant adverse consequences for us.

The Bank Secrecy Act of 1970, the Patriot Act and other laws and regulations require financial institutions to institute and maintain an effective BSA/AML program, file suspicious activity reports and currency transaction reports and comply with other BSA/AML requirements.

Our federal and state banking regulators, regularly review our BSA/AML program FinCEN.

If BSA/AML our program is deemed deficient, we could be subject to liability, including fines, civil money penalties and other regulatory enforcement actions, which may include restrictions on our business operations and our ability to pay dividends, restrictions on mergers and acquisitions activity, restrictions on expansion, and restrictions on entering new business lines.

Our failure to maintain and implement adequate programs to combat money laundering and terrorist financing could also have significant reputational consequences for us and, in turn, could have a material adverse effect on our business, financial condition or results of operations.

We can be negatively affected if we fail to identify and address operational risks associated with the introduction of or changes to products, services and delivery platforms.

9 unchanged sentences

Any of the foregoing consequences could materially and adversely affect our businesses and results of operations.

Our business, financial condition and results of operations are subject to risk from changes in customer behavior.

Individual, economic, political, industry-specific conditions and other factors outside of our control, such as fuel prices, energy costs, real estate values, inflation, taxes or other factors that affect customer income levels, could alter anticipated customer behavior, including borrowing, repayment, investment and deposit practices.

Such a change in these practices could materially adversely affect our ability to anticipate business needs and meet regulatory requirements.

Further, difficult economic conditions may negatively affect consumer

22 TriCo Bancshares 2023 10-K

confidence levels.

A decrease in consumer confidence levels would likely aggravate the adverse effects of these difficult market conditions on us, our customers and others in the financial institutions industry.

Our risk management framework may not be effective in identifying and mitigating every risk to us.

Any inadequacy or lapse in our risk management framework, governance structure, practices, models or reporting systems could expose it to unexpected losses, and our financial condition or results of operations could be materially and adversely affected.

Any inadequacy or lapse in our risk management framework, governance structure, practices, models or reporting systems could expose us to unexpected losses, and our financial condition or results of operations could be materially and adversely affected.

Any such inadequacy or lapse could:

12 unchanged sentences

General Risk Factors

20 TriCo Bancshares 2022 10-K

We depend on key personnel and the loss of one or more of those key personnel may materially and adversely affect our prospects.

Furthermore, our business could suffer if we fail to attract and retain skilled people.

Our future operating results depend substantially upon the continued service of our executive officers and key personnel.

Our future operating results also depend in significant part upon our ability to attract and retain qualified management, financial, technical, marketing, sales and support personnel.

Competition for qualified personnel is intense, and we cannot ensure success in attracting or retaining qualified personnel.

Competition for qualified personnel is intense, including with respect to compensation and emerging workplace practices, accommodations and remote work options, and we cannot ensure success in attracting or retaining qualified personnel.

Our current or future approach to in-office and work-from-home arrangements may not meet the needs or expectations of our current or prospective employees or may not be perceived as favorable as compared to the arrangements offered by competitors, which could adversely affect our ability to attract and retain employees.

There may be only a limited number of persons with the requisite skills to serve in these positions, and it may be increasingly difficult for us to hire personnel over time.

Our business, financial condition or results of operations could be materially adversely affected by the loss of any of our key employees, or our inability to attract and retain skilled employees.

Our business could suffer if we fail to attract and retain skilled people.

Our success depends, in large part, on our ability to attract and retain key people.

Competition for the best people in many activities engaged in by us is intense including with respect to compensation and emerging workplace practices, accommodations and remote work options, and we may not be able to hire people or to retain them.

In addition, the transition to increased work-from-home arrangements, which is likely to survive the COVID-19 pandemic for many companies, may exacerbate the challenges of attracting and retaining talented and diverse employees as job markets may be less constrained by physical geography.

Our previous results may not be indicative of our future results.

We may not be able to sustain our historical rate of growth and level of profitability or may not even be able to grow our business or continue to be profitable at all.

Various factors, such as economic conditions, regulatory and legislative considerations and competition, may also impede or prohibit our ability to expand our market presence and financial performance.

If we experience a significant decrease in our historical rate of growth, our results of operations and financial condition may be adversely affected due to a high percentage of our operating costs being fixed expenses.

Compliance with changing regulation of corporate governance and public disclosure may result in additional risks and expenses.

Changing laws, regulations and standards relating to corporate governance and public disclosure, including the Dodd-Frank Act, the Sarbanes-Oxley Act of 2002 and new SEC regulations, have created additional expense for publicly traded companies such as the Company.

The application of these laws, regulations and standards may evolve over time as new guidance is provided by regulatory and governing bodies, which could result in continuing uncertainty regarding compliance matters and higher costs necessitated by ongoing revisions to disclosure and governance practices.

We are committed to maintaining high standards of corporate governance and public disclosure.

As a result, our efforts to comply with evolving laws, regulations and standards have resulted in, and are likely to continue to result in, increased expenses and a diversion of management time and attention.

In particular, our efforts to comply with Section 404 of the Sarbanes-Oxley Act of 2002 and the related regulations regarding management’s required assessment of its internal control over financial reporting and our external auditors’ audit of our internal control over financial reporting requires, and will continue to require, the commitment of significant financial and managerial resources.

Further, the members of our board of directors, members of our audit or compensation and management succession committees, our chief executive officer, our chief financial officer and certain other executive officers could face an increased risk of personal liability in connection with the performance of their duties.

It may also become more difficult and more expensive to obtain director and officer liability insurance.

As a result, our ability to attract and retain executive officers and qualified board and committee members could be more difficult.

Tax regulations could be subject to potential legislative, administrative or judicial changes or interpretations.

Federal income tax treatment of corporations may be clarified and/or modified by legislative, administrative or judicial changes or interpretations at any time.

Given the current economic and political environment, and ongoing budgetary pressures, the enactment of new federal or state tax legislation or new interpretations of existing tax laws could occur.

The enactment of such legislation, or changes in the interpretation of existing law may have a material adverse effect on our financial condition, results of operations, and liquidity.

In the normal course of business, we are routinely subjected to examinations and audits from federal, state, and local taxing authorities regarding tax positions taken by us and the determination of the amount of tax due.

These examinations may relate to income, franchise, gross receipts, payroll, property, sales and use, or other tax returns.

The challenges made by taxing authorities may result in adjustments to the amount of taxes due, and may result in the imposition of penalties and interest.

If any such challenges are not resolved in our favor, they could have a material adverse effect on our financial condition, results of operations, and liquidity.

Claims, litigation, government investigations, and other proceedings may adversely affect our business and results of operations

As a community financial institution, we are at times subject to actual and threatened claims, litigation, reviews, investigations, and other proceedings, including proceedings by governments and regulatory authorities, involving a wide range of issues, including labor and employment, data protection, data security, network security, consumer protection, commercial disputes, goods and services offered by us and by third parties, and other matters.

Litigation, regulatory actions and compliance issues could subject us to significant fines, penalties, judgments, remediation costs and/or requirements resulting in increased expenses.

As a financial institution, we are at times subject to actual and threatened claims, litigation, arbitration, reviews, investigations, and other proceedings, including proceedings by governments and regulatory authorities, involving a wide range of issues, including labor and employment, data protection, data security, network security, consumer protection, commercial disputes, goods and services offered by us and by third parties, and other matters.

Litigation matters range from individual actions involving a single plaintiff to class action lawsuits and can involve claims for substantial or indeterminate alleged damages or for injunctive or other relief.

Any of these types of proceedings can have an adverse effect on us because of legal costs, disruption of our operations, diversion of management resources, negative publicity, and other factors.

The outcomes of these matters are inherently unpredictable and subject to significant uncertainties.

We establish accruals for those matters when a loss is considered probable and the related amount is reasonably estimable.

Additionally, when it is practicable and reasonably possible that it may experience losses in excess of established accruals, the we estimate possible loss contingencies.

Determining legal reserves for possible losses from such matters involves judgment and may not reflect the full range of uncertainties and unpredictable outcomes.

Until the final resolution of such matters, we may be exposed to losses in excess of the amount recorded, and such amounts could be material.

Should any of our estimates and assumptions

21 TriCo Bancshares 2022 10-K

change or prove to have been incorrect, it could have a material effect on our business, financial condition and results of operations.

Should any of our estimates and assumptions change or prove to have been incorrect, it could have a material effect on our business, financial condition and results of operations.

In addition, it is possible that a resolution of one or more such proceedings, including as a result of a settlement, could involve licenses, sanctions, consent decrees, or orders requiring us to make substantial future payments, preventing us from offering certain products or services, requiring us to change our business practices in a manner materially adverse to our business, requiring development of non-infringing or otherwise altered products or technologies, damaging our reputation, or otherwise having a material effect on our operations.

23 TriCo Bancshares 2023 10-K

We contest liability and/or the amount of damages as appropriate in each pending matter.

The outcome of pending and future matters could be material to our results of operations, financial condition and cash flows depending on, among other factors, the level of our earnings for that period, and could adversely affect our business and reputation.

For a discussion of certain legal proceedings, see the risk factor titled “ We experienced a criminal cyberattack in February 2023, which resulted in the temporary interruption of our systems, disclosure of certain confidential information, litigation and governmental inquiries, all of which could damage our reputation or create additional financial and legal exposure.

In addition to litigation and regulatory matters, from time to time, through our operational and compliance controls, we identify compliance issues that require us to make operational changes and, depending on the nature of the issue, result in financial remediation to impacted customers.

These self-identified issues and voluntary remediation payments could be significant depending on the issue and the number of customers impacted.

They also could generate litigation or regulatory investigations that subject us to additional adverse effects on our business, results of operations and financial condition.

Climate change could have a material negative impact on us and our clients.

6 unchanged sentences

and reputational risk from stakeholder concerns about our practices related to climate change, our carbon footprint, and our business relationships with clients who operate in carbon-intensive industries.

Federal and state banking regulators and supervisory authorities, investors, and other stakeholders have increasingly viewed financial institutions as important in helping to address the risks related to climate change both directly and with respect to their clients, which may result in financial institutions coming under increased pressure regarding the disclosure and management of their climate risks and related lending and investment activities.

Given that climate change could impose systemic risks upon the financial sector, either via disruptions in economic activity resulting from the physical impacts of climate change or changes in policies as the economy transitions to a less carbon-intensive environment, we may face regulatory risk of increasing focus on our resilience to climate-related risks, including in the context of stress testing for various climate stress scenarios.

Ongoing legislative or regulatory uncertainties and changes regarding climate risk management and practices may result in higher regulatory, compliance, credit, and reputational risks and costs.

With the increased importance and focus on climate change, we are making efforts to enhance our governance of climate change-related risks and integrate climate considerations into our risk governance framework.

Nonetheless, the risks associated with climate change are rapidly changing and evolving in an escalating fashion, making them difficult to assess due to limited data and other uncertainties.

The risks associated with climate change are rapidly changing and evolving in an escalating fashion, making them difficult to assess due to limited data and other uncertainties.

We could experience increased expenses resulting from strategic planning, litigation, and technology and market changes, and reputational harm as a result of negative public sentiment, regulatory scrutiny, and reduced investor and stakeholder confidence due to our response to climate change and our climate change strategy, which, in turn, could have a material negative impact on our business, results of operations, and financial condition.

In addition, ongoing legislative or regulatory uncertainties and changes regarding climate risk management and practices may result in higher regulatory, compliance, credit, and reputational risks and costs.

24 TriCo Bancshares 2023 10-K

UNRESOLVED STAFF COMMENTS

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors