What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-03-02 compared with 2025-03-03 · 113 added, 133 removed, 469 unchanged (34% of the section changed)

6 unchanged sentences

Risks Related to the Nature and Geographic Area of Our Business

The majority of our assets are loans, which are subject to credits risks.

The majority of our assets are loans, which are subject to credit risks.

As a lender, we face a significant risk that we will sustain losses because borrowers, guarantors or related parties may fail to perform in accordance with the terms of the loans we make or acquire.

2 unchanged sentences

To the extent that these risks may have a negative impact on the financial condition of borrowers, it could also have a material adverse effect on our business, financial condition and results of operations.

We have underwriting and credit monitoring procedures and credit policies, including the establishment and review of the allowance for credit losses,

11 TriCo Bancshares 2024 10-K

T a ble of Contents

that we believe appropriately address this risk by assessing the likelihood of nonperformance, tracking loan performance and diversifying our respective loan portfolios.

We have underwriting and credit monitoring procedures and credit policies, including the establishment and review of the allowance for credit losses, that we believe appropriately address this risk by assessing the likelihood of nonperformance, tracking loan performance and diversifying our respective loan portfolios.

Such policies and procedures, however, may not prevent unexpected losses that could adversely affect our results of operations.

4 unchanged sentences

Our allowance for credit losses is based on prior experience, as well as an evaluation of the known risks in the current portfolio, composition and growth of the loan portfolio and actual and forecast economic factors.

Determining an appropriate level of allowance is an inherently difficult process and is based on numerous assumptions.

Determining an appropriate level of allowance is an inherently difficult process and is based on numerous

11 TriCo Bancshares 2025 10-K

The actual amount of future losses is susceptible to changes in economic, operating and other conditions, including changes in interest rates, unemployment and a number of other economic conditions that may be beyond our control and these losses may exceed current estimates.

29 unchanged sentences

Any such decline could have a material adverse effect on our business, financial condition and results of operations.

12 TriCo Bancshares 2024 10-K

T a ble of Contents

We have significant exposure to risks associated with commercial real estate lending.

5 unchanged sentences

In recent years, commercial real estate markets have been particularly impacted by the economic disruption resulting from the COVID-19 pandemic, which has been a catalyst for the evolution of various remote work options which could impact the vacancy rates and the long-term vacancy performance of some types of office properties within our commercial real estate portfolio.

Accordingly, the federal banking regulatory agencies have expressed concerns about weaknesses in the current commercial real estate market.

Accordingly, the federal banking regulatory agencies have expressed concerns about weaknesses in the current commercial

12 TriCo Bancshares 2025 10-K

real estate market.

The adverse consequences from real estate-related credit risks tend to be cyclical and are often driven by national economic developments that are not controllable or entirely foreseeable by us or our borrowers.

We are exposed to the risk of environmental liabilities with respect to properties to which we take title.

In the course of our business, we may foreclose and take title to real estate and could be subject to environmental liabilities with respect to these properties.

In the course of our business, we foreclose and take title to real estate.

As a result, we could be subject to environmental liabilities with respect to these properties.

We may be held liable to a governmental entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination, or may be required to investigate or clean-up hazardous or toxic substances, or chemical releases at a property.

The costs associated with investigation or remediation activities could be substantial.

In addition, if we are the owner or former owner of a contaminated site, we may be subject to common law or contractual claims by third parties based on damages and costs resulting from environmental contamination emanating from the property.

In addition, if we are the owner or former owner of a contaminated site, we may be subject to common law or contractual claims by third parties (including purchasers of a property) based on damages and costs resulting from environmental contamination emanating from the property.

When applicable, we establish contingent liability reserves for this purpose based on future reasonable and estimable costs developed by qualified soil and chemical engineering consultants.

12 unchanged sentences

Consumers can also complete transactions such as paying bills and/or transferring funds directly without the assistance of banks.

In addition, the emergence, adoption and evolution of new technologies that do not require intermediation, including distributed ledgers such as digital assets and blockchain, as well as advances in robotic process automation, could significantly affect the competition for financial services.

The growing experimentation with and adoption of advanced technologies—such as AI, quantum computing, distributed ledgers, tokenized deposits, blockchain, stablecoins, and other digital currencies, including the potential issuance, acceptance, and integration of central bank digital currencies—has the potential to fundamentally reshape the financial services landscape.

Regulatory developments related to these emerging technologies, including the recent enactment of the Guiding and Establishing National Innovation for U.S.

Stablecoins Act of 2025 (“GENIUS Act”) and the potential passage of the Digital Asset Market Clarity Act of 2025 (“CLARITY Act”), further underscore this shift.

This the emergence, adoption and evolution of new technologies that do not require intermediation, as well as advances in robotic process automation, could significantly affect the competition for financial services.

The process of eliminating banks as intermediaries, known as “disintermediation,” could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits.

Failure to keep pace with technological advancements could adversely affect our competitive position, diminish customer satisfaction, and reduce the accessibility and relevance of our products and services.

Our ability to compete successfully depends on a number of factors, including, among other things, (i) the ability to develop, maintain and build long-term customer relationships based on top quality service, high ethical standards and safe, sound assets;

5 unchanged sentences

Failure to perform in any of these areas could significantly weaken our competitive position, which could adversely affect our growth and profitability, which, in turn, could have a material adverse effect on our business, financial condition and results of operations.

We may be adversely affected by the soundness of other financial institutions.

Financial services institutions are interrelated as a result of clearing, counterparty, or other relationships.

We have exposure to many different industries and counterparties, and routinely execute transactions with counterparties in the financial services industry, including commercial banks, brokers and dealers, and other institutional clients.

Many of these transactions expose us to credit risk in the event of a default by a counterparty or client.

In addition, our credit risk may be exacerbated when the collateral that we hold cannot be realized upon or is liquidated at prices not sufficient to recover the full amount of the credit or derivative exposure due to us.

Any such losses could have a material adverse effect on our financial condition and results of operations.

Challenges experienced by other financial institutions could negatively impact the broader financial markets and, in turn, indirectly have an adverse effect on our operations.

The soundness and stability of many financial institutions are often closely interconnected through various credit, trading, clearing, or other operational relationships.

As a result, concerns regarding—or an actual or threatened default by—any single institution could lead to widespread liquidity and credit problems, losses, or defaults across the broader financial system.

This phenomenon, commonly referred to as “systemic risk,” may adversely affect financial intermediaries such as clearing agencies, clearing houses, banks, securities firms, and exchanges with which we regularly engage, and may therefore negatively impact our operations.

Events in the financial services industry during 2023 illustrated this dynamic.

A number of regional and community banks experienced deposit outflows and heightened liquidity pressures, which in turn contributed to broad market concerns about the financial condition and creditworthiness of other institutions.

Although we were not directly affected by these bank failures, the resulting speed and ease in which

13 TriCo Bancshares 2025 10-K

T a ble of Contents

news or rumors, including social media commentary, led depositors to withdraw or attempt to withdraw their funds from these and other financial institutions caused the stock prices of many financial institutions to become volatile, in particular regional, as well as community banks like us.

Notably, the Company’s share price decreased by 17% during the month of March 2023, consistent with other community banking organizations.

These developments resulted in—and similar occurrences may again result in—significant and cascading disruptions across financial markets and the deposit environment, increased operating costs, reduced fee income, and increased volatility and downward pressure on the market value of our common stock.

We may need to raise additional capital, but it may not be available on acceptable terms or at all.

12 unchanged sentences

and other countries and global conflicts, such the conflicts in Ukraine and the Middle East.

Uncertainty about the federal fiscal policymaking process, the fiscal outlook of the federal government, and future tax rates is a concern for businesses, consumers and investors in the United States.

While the effects of COVID have reduced, the pandemic and related efforts to contain it have disrupted global economic activity, adversely affected the functioning of financial markets, impacted interest rates, increased economic and market uncertainty, employment and labor markets and disrupted trade and supply chains.

If these effects continue for a prolonged period or result in sustained economic stress or recession, many of the risk factors identified in our Form 10-K could be exacerbated and such effects could have a material adverse impact on us in a number of ways related to credit, collateral, customer demand, funding, operations, interest rate risk, and human capital, as described in this document.

Uncertainty about the federal fiscal policymaking process, the fiscal outlook of the federal government, prolonged government shutdowns, and future tax rates is a concern for businesses, consumers and investors in the United States.

If these conditions continue for a prolonged period or result in sustained economic stress or recession, many of the risk factors identified in our Form 10-K could be exacerbated and such effects could have a material adverse impact on us in a number of ways related to credit, collateral, customer demand, funding, operations, interest rate risk, and human capital, as described in this document.

If the United States economy weakens or does not improve, our growth and profitability from our lending, deposit and investment operations could be constrained.

Any of these potential outcomes could cause us to suffer losses in our investment securities portfolio, reduce our liquidity and capital levels, hamper our ability to deliver products and services to our clients and customers, and weaken our results of operations and financial condition.

Adverse developments affecting the financial services industry, such as the failure of three banks in the first half of 2023 or concerns involving liquidity, may have a material effect on the Company’s liquidity, earnings and financial condition.

During the first half of 2023, the financial services industry was negatively affected by three bank failures.

These events caused general uncertainty and concern regarding the adequacy of liquidity within the banking sector as a whole and have decreased investor and customer confidence in banks, notably with regard to mid-sized and larger regional banks.

Although we were not directly affected by these bank failures, the resulting speed and ease in which news or rumors, including social media commentary, led depositors to withdraw or attempt to withdraw their funds from these and other financial institutions caused the stock prices of many financial institutions to become volatile, in particular regional, as well as community banks like us.

Notably, the Company’s share price decreased by 17% during the month of March 2023, consistent with other community banking organizations.

According to data published by the FRB, deposits at domestic commercial banks decreased by approximately $280 billion between the end of February 2023 and the week ended March 29, 2023.

The Bank’s deposits decreased by $162 million during this period, which was a decrease of 2%.

Customers may choose to maintain deposits with larger financial institutions or in other higher yielding alternatives, which could materially adversely impact the Company’s liquidity, loan funding capacity, net interest margin, capital and results of operations.

The bank failures during 2023 may lead to governmental initiatives intended to prevent future bank failures and stem significant deposit outflows from the banking sector, including (i) legislation aimed at preventing similar future bank runs and failures and stabilizing confidence in the banking sector over the long term, (ii) agency rulemaking to modify and enhance relevant regulatory requirements, specifically with respect to liquidity risk management, deposit concentrations, capital adequacy, stress testing and contingency planning, and safe and sound banking practices, and (iii) enhancement of the agencies’ supervision and examination policies and priorities.

The federal banking agencies may also re-evaluate applicable liquidity risk management standards, such as by reconsidering the mix of assets that are deemed to be "high-quality liquid assets" and/or how HQLA holdings and cash inflows and outflows are tabulated and weighted for liquidity management purposes.

Although we cannot predict the terms and scope of any such initiatives, any of the potential changes referenced above could, among other things, subject us to additional costs, limit the types of financial services and products we may offer, and limit our future growth, any of which could materially and adversely affect our business, results of operations or financial condition.

Risks Related to Interest Rates

14 TriCo Bancshares 2024 10-K

T a ble of Contents

Our business is subject to interest rate risk and variations in interest rates may negatively affect our financial performance.

4 unchanged sentences

Earnings could also be adversely affected if the interest rates received on loans and investments fall more quickly than the interest rates paid on deposits and other borrowings.

After an extended period at a target rate of 0-0.25%, the Federal Reserve Board began aggressively increasing interest rates in March 2022 and continuing into 2023 with increases of 25 basis points in February, March, May, and July 2023.

Most recently, the Federal Reserve Board decreased interest rates 50 basis points in September and 25 basis points in November and December 2024, respectively, resulting in a target rate range of 4.25% to 4.50% at December 31, 2024.

Today, there continues to be uncertainty regarding future interest rates.

After an extended period at a target rate of 0-0.25%, the FRB began aggressively increasing interest rates in March 2022 and continuing into 2023.

In late 2024, the FRB began lowering rates as inflationary pressure started to ease, and in late 2025, the FRB again lowered rates.

However, the economic and inflationary outlook continues to remain uncertain.

If the FRB were to reverse course and rapidly increase rates, the increase could result in further declines in the fair market values of long duration fixed rate investment securities, constrain our interest rate spread and may adversely affect our business forecasts.

Increases in interest rates can have negative impacts on our business, including reducing our customers’ desire to borrow money from us or adversely affecting their ability to repay their outstanding loans by increasing their debt obligations through the periodic reset of adjustable interest rate loans.

2 unchanged sentences

Conversely, decreases in interest rates can affect the amount of interest we earn on our loans and investment securities, which could have a material adverse effect on our financial condition and results of operations.

14 TriCo Bancshares 2025 10-K

Elevated inflation and expectations for elevated future inflation can adversely impact economic growth, consumer and business confidence, and our financial condition and results.

19 unchanged sentences

Regulatory authorities have extensive discretion in their supervisory and enforcement activities, including the imposition of restrictions on our operations, the classification of our assets and determination of the level of our allowance for credit losses.

Banking regulations or the actions of our banking regulators may limit our growth, earnings and the return to our shareholders by restricting certain of our activities, such as:

• the payment of dividends to our shareholders,

• possible mergers with or acquisitions of or by other institutions,

• desired investments,

15 TriCo Bancshares 2024 10-K

T a ble of Contents

• loans and interest rates on loans,

• interest rates paid on deposits,

• service charges on deposit account transactions,

• the possible expansion or reduction of branch offices, and

• the ability to provide new products or services.

Banking regulations or the actions of our banking regulators may limit our growth, earnings and the return to our shareholders by restricting certain of our activities, such as the payment of dividends to our shareholders, possible mergers with or acquisitions of or by other institutions, desired investments, loans and interest rates on loans, interest rates paid on deposits, service charges on deposit account transactions, the possible expansion or reduction of branch offices, and the ability to provide new products or services.

We also are subject to regulatory capital requirements.

9 unchanged sentences

This volatility may pose risks to our financial performance, cost of capital, and access to funding.

The outcomes of elections may directly affect our industry, influencing regulatory frameworks and industry dynamics.

Shifts in political power may shape the competitive landscape, impacting market share and pricing strategies.

Unfavorable changes in industry-specific regulations could result in increased compliance costs and operational challenges.

Political events, including elections, can influence consumer and investor sentiment, affecting demand for our products and services and impacting investor confidence, which may influence our stock price and access to capital.

While there have been significant revisions to the laws and regulations applicable to us that have been finalized in recent years, there are other rules to implement changes that have yet to be proposed or enacted by our regulators.

3 unchanged sentences

For more information on regulations to which we are subject and recent initiatives to reform financial institution regulation, see the “Regulation and Supervision” section in Item 1.

15 TriCo Bancshares 2025 10-K

Risks Related to Our Growth and Expansion

6 unchanged sentences

Potential acquisitions may disrupt our business and dilute shareholder value, we may not be able to successfully consummate or integrate such acquisitions, and we may not realize the anticipated benefits contemplated when pursuing a potential acquisition.

We may acquire other financial institutions, or branches or assets of other financial institutions, in the future.

We may also open new branches and enter into new lines of business or offer new products or services either through organic expansion, mergers, acquisitions or similar corporate transactions.

Any such expansion of our business will involve a number of expenses and risks, which may include:

• the time and expense associated with identifying and evaluating potential expansions;

• the potential inaccuracy of estimates and judgments used to evaluate credit, operations, management and market risk with respect to the target company;

• potential exposure to unknown or contingent liabilities of the target company;

• exposure to potential asset quality issues of the target company;

• difficulty and expense of integrating the operations and personnel of the target company;

• difficulty or added costs in the wind-down of non-strategic operations;

• potential disruption to our business;

• potential diversion of our management’s time and attention;

• the possible loss of key employees and customers of the target company;

• difficulty in estimating the value (including goodwill) of the target company;

• difficulty in receiving appropriate regulatory approval for any proposed transaction;

16 TriCo Bancshares 2024 10-K

T a ble of Contents

• potential changes in banking, tax or other laws or regulations or accounting rules that may affect the target company or our realization of any anticipated benefits or accretive shareholder value from undertaking such expansion.

We regularly evaluate merger and acquisition opportunities and conduct due diligence activities related to possible transactions with other financial institutions and financial services companies.

Acquisitions could involve the payment of a premium over book and market values, and, therefore, dilution of our tangible book value and net income per common share may occur in connection with any such transaction.

Furthermore, any difficulty integrating businesses acquired as a result of a merger or acquisition and the failure to realize the expected revenue increases, cost savings, increases in geographic or product presence and/or other projected benefits from an acquisition could have an impact on our liquidity, results of operations and financial condition and any such integration could divert management’s time and attention from managing our company in an effective manner.

Any merger or acquisition opportunity that we decide to pursue will ultimately be subject to regulatory approval or other closing conditions.

We may expend substantial time and resources pursuing potential acquisitions which may not be consummated in a timely manner, or at all, because regulatory approval or other closing requirements are not satisfied.

Additionally, the banking regulators and applicable laws and regulations may restrict our ability to engage in acquisitions under certain circumstances.

The Company has in the past and may in the future pursue mergers and acquisition opportunities.

Mergers and acquisitions involve a number of risks and uncertainties to us in addition to those presented by the nature of the business acquired, which may materially and adversely affect our results of operations.

Our ability to analyze the risks presented by prospective acquisitions, as well as our ability to prepare in advance of closing for integration, may be limited to the extent that we cannot gather necessary or desirable information with respect to the business we are acquiring.

We may also make certain assumptions related to an acquisition that may prove to be inaccurate that limit the anticipated benefits (such as cost savings from synergies or strategic gains or be able to offer enhanced product sets) or make the acquisition more expensive or take longer to complete and integrate than anticipated.

Prior to closing an acquisition, prospective acquisition targets are also subject to their own risks that we cannot manage or control.

Any acquisition could be dilutive to our earnings and shareholders' equity per share of our common stock.

Our ability to complete an acquisition may be dependent on regulatory agencies with responsibilities for reviewing or approving the transaction, which could delay, restrictively condition or result in denial of an acquisition, or otherwise limit the benefits of the acquisition.

Changes in regulatory rules or standards or the application of those rules or standards, or future regulatory initiatives designed to mitigate risk or promote competition may also limit our ability to complete an acquisition.

Further, once an acquisition is completed, it may be difficult for us to integrate the acquired business with our operations, and we may not see the anticipated benefits of any such acquisition.

If we cannot attract deposits, our growth may be inhibited.

20 unchanged sentences

As an independent bureau focused solely on consumer financial protection, the CFPB may interpret or enforce consumer protection laws more strictly or severely than the FDIC.

Additionally, other regulatory requirements apply to depository institutions and holding companies with $10 billion or more in total consolidated assets, including a cap on interchange transaction fees for debit cards, as required by Federal Reserve Board regulations, which would reduce our interchange revenue, and restrictions on proprietary trading and investment and sponsorship in hedge funds and private equity funds known as the Volcker Rule.

Additionally, other regulatory requirements apply to depository institutions and holding companies with $10 billion or more in total consolidated assets, including a cap on interchange transaction fees for debit cards, as required by Federal Reserve Board regulations, which would significantly reduce our interchange revenue, and restrictions on proprietary trading and investment and sponsorship in hedge

16 TriCo Bancshares 2025 10-K

funds and private equity funds known as the Volcker Rule.

See also "Item 1 - Business - Regulation and Supervision - Interchange Fees" in this report.

5 unchanged sentences

Business - Regulation and Supervision – Restrictions on Dividends and Distributions.”

17 TriCo Bancshares 2024 10-K

T a ble of Contents

As a holding company with no significant assets other than the Bank, our ability to continue to pay dividends depends in large part upon the Bank’s ability to pay dividends to us.

26 unchanged sentences

Ineffective internal and disclosure controls could also cause investors to lose confidence in our reported financial information, which would likely have a negative effect on the trading price of our securities.

17 TriCo Bancshares 2025 10-K

We experienced a criminal cyberattack in February 2023, which resulted in the temporary interruption of our systems, disclosure of certain confidential information, litigation and governmental inquiries, all of which could damage our reputation or create additional financial and legal exposure.

7 unchanged sentences

The Company restored its systems without paying ransom.

18 TriCo Bancshares 2024 10-K

T a ble of Contents

The Bank worked with third-party forensic investigators to understand the nature and scope of the incident and to determine what and how much information was impacted.

2 unchanged sentences

While the information impacted varied by individual, the types of information that were impacted included name, social security number, driver’s license number, state identification number, financial account information, medical information, health insurance information, date of birth, passport number, digital/electronic signature, tax information, tax identification number, access credentials, and mother’s maiden name.

The Bank notified and will continue to notify impacted individuals consistent with state and federal requirements and the Bank is offering impacted individuals credit restoration services and 24 months of credit monitoring services at no cost.

The Bank notified and will continue to notify impacted individuals consistent with state and federal requirements and the Bank is offered impacted individuals credit restoration services and 24 months of credit monitoring services at no cost.

The Bank issued a press release regarding this event and posted notice of this event on its website.

1 unchanged sentence

These risks may stem from litigation or governmental inquiries litigation to which we currently are or may become subject in connection with this incident, and the extent of remediation and other additional costs that may be incurred by us.

We face numerous lawsuits related to the 2023 cyberattack, including three purported class action lawsuits that have been filed in California Superior Court for the Counties of Contra Costa and Butte, seeking unspecified monetary damages, equitable relief, costs and attorneys’ fees.

The lawsuits allege breach of contract, negligence, violations of various privacy laws and a variety of other legal causes of action.

We are currently unable to predict the potential outcome of any of this litigation or whether we may be subject to further private litigation.

In addition, the Company has received inquiries from various government authorities related to the 2023 cyberattack, which could result in sanctions, fines or penalties.

We are responding to these inquiries and cooperating fully.

We face three purported class action lawsuits numerous lawsuits related to the 2023 cyberattack that have been filed in California Superior Court for the Counties of Contra Costa and Butte, seeking unspecified monetary damages, equitable relief, costs and attorneys’ fees.

The lawsuits were consolidated ( Donna Dryden v.

Tri Counties Bank et.

, Superior Court of State of California - Butte County, 23-CV-03115) and allege breach of contract, negligence, violations of various privacy laws and a variety of other legal causes of action.

Following mediation, the parties entered into a settlement agreement and on January 21, 2026, the court preliminarily approved the agreement.

The Class is being notified by mail and we and hope to resolve this litigation quickly.

The cost of the settlement is expected to be covered by insurance.

However, we are unable to predict whether we may be subject to further private litigation.

In addition, the Company received inquiries from various government authorities related to the 2023 cyberattack, which could result in sanctions, fines or penalties.

We responded to these inquiries and cooperated fully.

However, we cannot predict the timing or outcome of any of these inquiries, or whether we may be subject to further governmental inquiries.

2 unchanged sentences

It is possible that we could incur losses associated with these proceedings and inquiries, and the Company will continue to evaluate information as it becomes known and will record an estimate for losses at the time or times when it is both probable that a loss has been incurred and the amount of the loss is reasonably estimable.

Ongoing legal and other costs related to these proceedings and inquiries, as well as any potential future proceedings and inquiries, may be substantial, and losses associated with any adverse judgments, settlements, penalties or other resolutions of such proceedings and inquiries could be material to our business, reputation, financial condition and operating results.

While we believe we have adequate insurance to cover most of the costs of the cyberattack, ongoing legal and other costs related to these proceedings and inquiries, as well as any potential future proceedings and inquiries, may be substantial, and losses associated with any adverse judgments, settlements, penalties or other resolutions of such proceedings and inquiries could be material to our business, reputation, financial condition and operating results.

We face the risk that failures or breaches, including cyberattacks, of our operational or security systems or of those of our customers or vendors, could disrupt our business, result in the disclosure of confidential information, damage our reputation, and create significant financial and legal exposure.

3 unchanged sentences

the techniques used in cyber attacks evolve frequently and are increasingly sophisticated, and therefore may not be recognized until launched;

cyber attacks can originate from a wide variety of sources, including our own employees, cyber-criminals, hacktivists, groups linked to terrorist organizations or hostile countries, or third parties whose objective is to disrupt the operations of financial institutions more generally;

cyber attacks can originate from a wide variety of sources, including our own employees, cyber-criminals, hacktivists, groups

18 TriCo Bancshares 2025 10-K

linked to terrorist organizations or hostile countries, or third parties whose objective is to disrupt the operations of financial institutions more generally;

we do not have control over the cybersecurity of the systems of the large number of clients, customers, counterparties and third-party service providers with which we do business;

3 unchanged sentences

In addition, a third party could misappropriate confidential information obtained by intercepting signals or communications from mobile devices used by our employees.

The techniques used in cyber attacks and breaches change rapidly and are increasingly sophisticated, including through the use of generative AI and deepfakes, and we expect additional risks in the future through the use of quantum computing, and we may not be able to anticipate cyber attacks or other data security breaches.

Additionally, cyber attacks and breaches in some cases appear to be supported by foreign governments or other well-financed entities and often originate from less regulated and remote areas of the world.

We have seen a higher volume and complexity of attacks during times of increased geopolitical tensions.

A successful penetration or circumvention of the security of our systems or the systems of a vendor, governmental body or another market participant could cause serious negative consequences, including:

10 unchanged sentences

and harm to our reputation, all of which could have a material adverse effect on us.

If personal, confidential or proprietary information of customers or others in the

19 TriCo Bancshares 2024 10-K

T a ble of Contents

Bank’s or such vendors’ or other third-parties’ possession were to be mishandled or misused, we could suffer significant regulatory consequences, reputational damage and financial loss, as discussed earlier regarding the Bank's 2023 cyberattack.

If personal, confidential or proprietary information of customers or others in the Bank’s or such vendors’ or other third-parties’ possession were to be mishandled or misused, we could suffer significant regulatory consequences, reputational damage and financial loss, as discussed earlier regarding the Bank's 2023 cyberattack.

The extent of a particular cyber attack and the steps that we may need to take to investigate the attack may not be immediately clear, and it may take a significant amount of time before such an investigation or determination, judicial or otherwise, can be completed.

3 unchanged sentences

Any or all of these factors could further increase the costs and consequences of a cyber attack.

In addition to threats from external sources, insider threats represent a significant risk to us.

Insiders, including those having legitimate access to our information, communications systems and other technology and the information contained therein, have the easiest opportunity to make inappropriate use of their access.

Addressing that risk requires understanding not only how to protect us from unauthorized use and disclosure of data, but also how to engage behavioral analytics and other tools to identify potential internal threats before any damage is done.

As more work is conducted outside of our facilities, the risk of improper access to our network or confidential information has increased, including for reasons such as a failure by an employee or contractor to secure a device with Company access.

Although we devote significant resources to maintain and regularly upgrade our systems and processes that are designed to protect the security of our computer systems, software, networks, and other technology assets and the confidentiality, integrity, and availability of information belonging to us and our customers, there is no assurance that our security measures will be sufficient.

We have implemented employee and customer awareness training regarding phishing, malware, and other cyber risks, however there can no assurances that this training will be effective or sufficient.

We have implemented employee and customer awareness training regarding phishing, malware, and other cyber risks, however there can be no assurances that this training will be effective or sufficient.

Furthermore, these risks are expected to increase in the future as we continue to increase our electronic payments and other internet-based product offerings and expand our internal usage of web-based products and applications.

Continued geographical turmoil, including the ongoing conflict between Russia and Ukraine, has heightened the risk of cyberattack and has created new risk for cybersecurity, and similar concerns.

For example, the United States government has warned that sanctions imposed against Russia by the United States in response to its conflict with Ukraine could motivate Russia to engage in malicious cyber activities against the United States.

Our procedures and safeguards to prevent unauthorized access to confidential information and to defend against cyberattacks seeking to disrupt our operations must be continually evaluated and enhanced to address the ever-evolving threat landscape and changing cybersecurity regulations.

9 unchanged sentences

While the Company may have contractual rights to assess the effectiveness of many of our providers’ systems and protocols, we do not have the means to know or assess the effectiveness of all of our providers’ systems and controls at all times.

We cannot provide any assurances that actions taken by us, or our third- or fourth-party vendors, including through our cybersecurity programs or policies, will adequately prevent or substantially mitigate the impacts of cybersecurity breaches or misuses of confidential information, unauthorized access to our networks or systems or exploits against third-or fourth-party environments, or that we, or our third- or fourth-party vendors, will be able to effectively identify, investigate, and remediate such incidents in a timely manner or at all.

19 TriCo Bancshares 2025 10-K

fourth-party environments, or that we, or our third- or fourth-party vendors, will be able to effectively identify, investigate, and remediate such incidents in a timely manner or at all.

While we may contractually limit our liability in connection with attacks against third-party providers, we remain exposed to the risk of loss associated with such vendors.

8 unchanged sentences

Failure to meet those standards may significantly impact our ability to offer these services.

20 TriCo Bancshares 2024 10-K

T a ble of Contents

We are subject to the PCI-DSS, issued by the Payment Card Industry Security Standards Council.

11 unchanged sentences

Cyberattack techniques change regularly and can originate from a wide variety of sources, including third parties who are or may be involved in organized crime or linked to terrorist organizations or hostile foreign governments, and such third parties may seek to gain access to systems directly or using equipment or security passwords belonging to employees, customers, third-party service providers or other users of our systems.

These risks may increase in the future as we continue to increase our mobile, digital and other internet-based product offerings and expands our internal usage of web-based products and applications.

These risks may increase in the future as we continue to increase our mobile, digital and other internet-based product offerings and expand our internal usage of web-based products and applications.

A cybersecurity breach or cyberattack could persist for a long time before being detected and could result in theft of sensitive data or disruption of our transaction processing systems.

9 unchanged sentences

Business - Supervision and Regulation.”

20 TriCo Bancshares 2025 10-K

We receive, maintain and store non-public personal information of our customers and counterparties, including, but not limited to, personally identifiable information and personal financial information.

13 unchanged sentences

We may not be able to effectively implement new technology-driven products and services or successfully market such products and services to our customers.

21 TriCo Bancshares 2024 10-K

T a ble of Contents

advances in technology such as digital, mobile, telephone, text, and online banking;

In addition, advances in technology such as digital, mobile, telephone, text, and online banking;

and self-service automatic teller machines and other equipment, as well as changing customer preferences to access our products and services through digital channels, could decrease the value of our branch network and other assets.

24 unchanged sentences

Furthermore, cloud technologies are also critical to the operation of our systems, and our reliance on cloud technologies is growing.

Failure to successfully keep pace with technological change affecting the financial services industry could have a material adverse effect on our business, financial condition and results of operations.

Failure to successfully keep pace with

21 TriCo Bancshares 2025 10-K

technological change affecting the financial services industry could have a material adverse effect on our business, financial condition and results of operations.

Furthermore, any new line of business, new product or service and/or new technology could have a significant impact on the effectiveness of our system of internal controls.

Failure to successfully manage these risks in the development and implementation of new lines of business, new products or services and/or new technologies could have a material adverse effect on our business, financial condition and results of operations.

The increased use and capacity of AI, Generative AI, large language models (LLMs), and AI agents by customers, vendors and competitors increases risks to our business.

The use and capacity of AI, Generative AI, LLMs and AI agents has increased in the past year and is being employed by customers, competitors, and vendors at increased rates.

Many of these tools can increase cybersecurity risks, require specific technical expertise to operate, or expose information through open source code.

These tools are being used by parties in various capacities, and employing these tools without sufficient knowledge or expertise of the power and risks associated with the tools can increase risks for the users.

These tools are relatively new and there is potential of continued and/or increased adoption of legal and regulatory frameworks governing the use of these tools, by law, our primary banking regulators, other federal or state regulatory bodies, or other self-regulatory organizations.

The use of these tools by customers can increase the risk of exposure to their personal information and/or banking credentials which can result in increased opportunities for bad actors to initiate fraudulent activity with respect to a customer’s account(s).

While we have implemented commercially reasonable policies and procedures to protect against fraudulent activity on the accounts of our customers, we cannot assure that such policies and procedures will prevent all fraudulent activity or capture activity that has been inadvertently been authorized by the customer.

Such activity can result in financial liability and litigation risk to us and/or our customers, as well as harm to our reputation and negative impacts on our financial condition, results of our operations, business and prospects.

The use of these tools by vendors engaged by us can increase the risk of unauthorized use or disclosure of sensitive or confidential client or customer information and cyberattacks.

In conducting due diligence of our vendors, we request information regarding how the vendor uses these tools and attempt to mitigate risks related to exposure by agreement with vendors.

While these processes seek to mitigate risks associated with vendor use of these tools, we cannot eliminate this risk.

Vendors may employ tools without realizing the risks associated with the tools, may have employees that use unauthorized technology tools that were not disclosed to us during our diligence process, or the tools that were disclosed may implement new services, features, or technologies that increase the exposure to cybersecurity risks.

If a vendor engaged by us experienced a cyberattack related to use of these tools, or deliberately or inadvertently exposed sensitive or confidential client or customer information, we may experience financial liability and litigation risk to us and/or our customers, as well as harm to our reputation and negative impact on our financial condition, results of operations and business.

Additionally, if any vendors incur additional costs related to any legal or regulatory framework adopted governing the use of such tools, we may face increased costs to engage such vendor, which could impact or financial condition and results of operations if we continue to use such vendor or as a result of costs incurred to find an alternative vendor.

The use of these tools by competitors may impair our ability to attract or retain business if our competitors are successful in their implementation.

Failure to keep pace with these evolving technologies can have a negative impact on our financial condition, results of operations, business and prospects.

In addition, if our competitors suffer any reputational harm as a result of the implementation of these evolving technologies, it could have a negative effect on the financial services industry as a whole and have a negative impact on our financial condition, results of operations, business and prospects.

The increased use of these tools by competitors may also increase pressure to impose legal or regulatory frameworks regarding these tools, which could impact the financial services industry as a whole and cause us to incur increased costs to comply with such legal or regulatory frameworks, which may result in a negative impact on our financial condition, results of operations and business.

We are subject to claims and litigation pertaining to intellectual property.

8 unchanged sentences

In certain cases, we may consider entering into licensing agreements for disputed intellectual property, although no assurance can be given that such licenses can be obtained on acceptable terms or that litigation will not occur.

These licenses

22 TriCo Bancshares 2024 10-K

T a ble of Contents

may also significantly increase our operating expenses.

These licenses may also significantly increase our operating expenses.

If legal matters related to intellectual property claims were resolved against us or settled, we could be required to make payments in amounts that could have a material adverse effect on our business, financial condition and results of operations.

22 TriCo Bancshares 2025 10-K

Our failure to comply with anti-money laundering and anti-terrorism financing laws could have significant adverse consequences for us.

The Bank Secrecy Act of 1970, the Patriot Act and other laws and regulations require financial institutions to institute and maintain an effective BSA/AML program, file suspicious activity reports and currency transaction reports and comply with other BSA/AML requirements.

Our federal and state banking regulators, regularly review our BSA/AML program FinCEN.

If BSA/AML our program is deemed deficient, we could be subject to liability, including fines, civil money penalties and other regulatory enforcement actions, which may include restrictions on our business operations and our ability to pay dividends, restrictions on mergers and acquisitions activity, restrictions on expansion, and restrictions on entering new business lines.

Our federal and state banking regulators regularly review our BSA/AML program.

If FinCEN BSA/AML our program is deemed deficient, we could be subject to liability, including fines, civil money penalties and other regulatory enforcement actions, which may include restrictions on our business operations and our ability to pay dividends, restrictions on mergers and acquisitions activity, restrictions on expansion, and restrictions on entering new business lines.

Our failure to maintain and implement adequate programs to combat money laundering and terrorist financing could also have significant reputational consequences for us and, in turn, could have a material adverse effect on our business, financial condition or results of operations.

16 unchanged sentences

Our risk management framework may not be effective in identifying and mitigating every risk to us.

Any inadequacy or lapse in our risk management framework, governance structure, practices, models or reporting systems could expose us to unexpected losses, and our financial condition or results of operations could be materially and adversely affected.

Any such inadequacy or lapse could:

• hinder the timely escalation of material risk issues to our senior management and the Board of Directors;

• lead to business decisions that have negative outcomes for us;

• require significant resources and time to remediate;

• lead to non-compliance with laws, rules and regulations;

• attract heightened regulatory scrutiny;

• expose us to regulatory investigations or legal proceedings;

• subject us to litigation or regulatory fines, penalties or other sanctions;

• harm our reputation;

• otherwise diminish confidence in TriCo or the Bank.

We rely on data to assess many of our various risk exposures.

Any deficiencies in the quality or effectiveness of our data gathering, analysis and validation processes could result in ineffective risk management practices.

These deficiencies could also result in inaccurate risk reporting.

We have implemented a risk management framework to mitigate our risk and loss exposure.

This framework is comprised of various processes, systems and strategies, and is designed to identify, measure, assess, monitor, report and manage the types of risk to which we are subject, including, among others, credit, capital, interest rate, liquidity, legal and regulatory, cybersecurity, compliance, strategic, reputational and operational risks related to our employees, systems and vendors, among others.

Any system of control and any system to reduce risk exposure, however well designed and operated, is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met and will be effective under all circumstances or that it will adequately identify, manage or mitigate any risk or loss to us.

Additionally, instruments, systems, controls and strategies used to hedge or otherwise understand and manage exposure to the risks we are subject to could be less effective than anticipated.

As a result, we may not be able to effectively mitigate our risk exposures in particular market environments or against particular types of risk.

If our risk management framework is not effective, we could suffer unexpected losses and become subject to litigation, negative regulatory consequences, or reputational damage among other adverse consequences, any of which could result in our business, financial condition, results of operations or prospects being materially adversely affected.

General Risk Factors

23 TriCo Bancshares 2024 10-K

T a ble of Contents

We depend on key personnel and the loss of one or more of those key personnel may materially and adversely affect our prospects.

5 unchanged sentences

There may be only a limited number of persons with the requisite skills to serve in these positions, and it may be increasingly difficult for us to hire personnel over time.

Our business, financial condition or results of operations could be materially adversely affected by the loss of any of our key employees, or our inability to attract and retain skilled employees.

Our business, financial condition or results of

23 TriCo Bancshares 2025 10-K

operations could be materially adversely affected by the loss of any of our key employees, or our inability to attract and retain skilled employees.

Litigation, regulatory actions and compliance issues could subject us to significant fines, penalties, judgments, remediation costs and/or requirements resulting in increased expenses.

36 unchanged sentences

government's debt limit may increase the possibility of a default by the U.S.

government on its debt obligations, related credit-rating

24 TriCo Bancshares 2024 10-K

T a ble of Contents

downgrades, or an economic recession in the United States.

government on its debt obligations, related credit-rating downgrades, or an economic recession in the United States.

Many of our investment securities are issued by the U.S.

7 unchanged sentences

and worldwide.

24 TriCo Bancshares 2025 10-K

Furthermore, evolving responses from federal and state governments and other regulators, and our customers or our third-party partners or vendors, to challenges such as climate change have impacted and could continue to impact the economic and political conditions under which we operate which could have a material adverse effect on our business, financial condition and results of operations.

33 unchanged sentences

Ongoing legislative or regulatory uncertainties and changes regarding climate risk management and practices may result in higher regulatory, compliance, credit and reputational risks and costs, and may subject us to different and potentially conflicting requirements.

25 TriCo Bancshares 2024 10-K

T a ble of Contents

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors