Heritage Commerce Corp

ITEM 1ARISK FACTORS

Our business, financial condition and results of operations are subject to various risks, including those discussed below. The risks discussed below are those that we believe are the most significant risks, although additional risks not presently known to us or that we currently deem less significant may also materially and adversely affect our business, financial condition and results of operations.

Summary of Risk Factors

Risks Related to Our Reputation and Operations

Risks Related to Our Business

Risks Related to Our Loans

Risks Related to Our SB 

A Loan Program

Risks Related to Our Credit Quality

Riskis Related to our Growth Strategy

Risks Related to Our Financial Strength and Liquidity

Riusks Related to Our Capital

Risks Related tsio Our Legal and Regulatory Environment

Risks n ofrom Competition

Risks Related to Ou r Common Stock

Risks Relating to Our Reputation and Operations

Interruptions, cyberattacks, fraudulent activity or other security breaches may have a material adverse e factors affect on our business.

In the normal course of business, we (directly or through third parties) collect, store, share, process and retain sensitive and confidential information regarding our clients. We also rely heavily upon electronic infrastructure that we own or that we obtain via license or other contractual arrangements with third parties. This infrastructure is essential in the conduct of our business, including for allowing our clients to access and transfer funds, initiate and pay loans and leases, communicating with our client service teams, and a variety of other activities that form the foundation of modern financial services businesses. There have been a number of recent and well-publicized incidents involving various types of cybersecurity lapses, and many of these have had substantial impacts upon targeted businesses and on clients of even some of the worlds most prominent cybersecurity firms. One of the most recent events resulted in a widespread failure of a large cybersecurity platform, some of the consequences of which are ongoing and may not be fully known or estimable. Similarly, extremely sophisticated criminal and nation-state organizations routinely target and exploit information technology networks, data systems, and other critical infrastructure.

We devote significant financial and management resources to ensure the integrity of our systems against cybercriminals and similar actors, as well as against threats from fires and other natural disasters; power or telecommunications failures; acts of terrorism or wars or other catastrophic events; breaches, physical break-ins or errors

resulting in interruptions and unauthorized disclosure of confidential information, through information security and business continuity programs.

Notwithstanding these efforts, cybersecurity measures are, by their nature, largely reactive, and threats are constantly evolving. We expect that the development of AI-based technology will cause a rapid expansion in both the number and the sophistication of these threats. While we believe we maintain state-of-the-art defensive measures, we routinely experience attempts to exploit our networks and systems, and we must continue investing in increasingly sophisticated (and concomitantly expensive) technology to counteract these threats. Further, if our systems cannot timely detect and mitigate vulnerabilities, or cannot promptly respond to threats, we may experience damage to or interruptions in the availability of our computer networks, or we may experience a loss of data, unauthorized use or disclosure of client information, or a loss of client funds as a result of unauthorized access to client accounts.

Additionally, as financial institutions and technology systems become more interconnected and more complex, any operational incident at a third party, such as a vendor or client, may increase our operational risks, including from information breaches or loss, breakdowns, disruptions or failures of their own systems or infrastructure, or any deficiencies in the performance of their responsibilities. These risks are increased to the extent we rely on a single-source vendor or provider.

The access by unauthorized persons to, or the improper disclosure by us or our third-party vendors of, confidential information regarding our clients or our own proprietary information, software, methodologies and business secrets, failures or disruptions in our communications, information and technology systems, or our failure to adequately address them, could negatively affect our client relationship management, online banking, accounting or other systems. We cannot assure readers that such breaches, failures or interruptions will not occur or, if they do occur, that they will be adequately addressed by us or the third parties on which we rely. Our insurance may not fully cover all types of losses.

Accordingly, any failures or interruptions of our communications, information and technology systems could damage our reputation, result in a loss of client business, subject us to additional regulatory scrutiny or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on our business, financial condition or results of operations.

Our operations could be disrupted by our third-party service providers experiencing difficulty in providing their services, terminating their services or failing to comply with banking regulations.

We depend to a significant extent on relationships with third-party service providers. Specifically, we utilize third-party core banking services and receive credit card and debit card services, branch capture services, Internet banking services and services complementary to our banking products from various third-party service providers. These types of third-party relationships are subject to increasingly demanding regulatory requirements that require us to maintain and continue to enhance our due diligence and ongoing monitoring and control over our third-party vendors. We may be required to renegotiate our agreements to meet these enhanced requirements, which could increase our costs or which may be impracticable. If our service providers experience difficulties or terminate their services and we are unable to replace them, our operations could be interrupted. It may be difficult for us to timely replace some of our service providers, which may be at a higher cost due to the unique services they provide. A third-party provider may fail to provide the services we require, or meet contractual requirements, comply with applicable laws and regulations, or suffer a cyberattack or other security breach. We expect that our regulators would hold us responsible for deficiencies of our third-party relationships which could result in enforcement actions, including civil money penalties or other administrative or judicial penalties or fines, or client remediation, any of which could have a material adverse effect on our business, financial condition and results of operations.

Commercial banking requires substantial board and management expertise, knowledge, and community and industry relationships. If we cannot retain our existing Board or leadership team or recruit experienced, well-qualified successors, our business may suffer.

Our success depends, in large degree, on the skills of our Board and management team and our ability to retain, recruit and motivate key directors, officers and team members. Our Board and senior management team have significant industry experience, as well as significant experience in our local markets, and their knowledge and relationships would be difficult to replace. We recently We recently hired a new Chief Operating Officer and we have previously announced a recruitment process for a successor to our longtime Chief Financial Officer. We have announced the retirements of two

directors, and we are conducting a search for qualified successors to these positions. These succession plans, and the performance of the executives hired as a result thereof, may also result in a distraction from other critical management functions in one or both of those leadership positions. Additional Board and/or leadership changes will occur from time to time, and we cannot always anticipate or control the timing of these changes, Similarly, we cannot offer assurance that we would be able to recruit additional qualified personnel on a timely basis, either to fill vacancies created by departures or to grow our executive team to respond to and prepare for the expansion of our business. Competition for directors, senior executives and skilled personnel in the financial services and banking industry is intense, which means the cost of hiring, paying incentives and retaining skilled personnel may continue to increase. Our ability to compete effectively for senior executives and other qualified leadership personnel may increase our compensation and administrative expenses and may be restricted by applicable banking laws and regulations. The loss of the services of any director, senior executive or other key personnel, or the inability to recruit and retain qualified personnel in the future, could have a material adverse effect on our business, financial condition and results of operations.

Our ability to access markets for funding and acquire and retain clients could be adversely affected by the deterioration of other financial institutions or the financial service industrys reputation.

Our ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services companies are interrelated as a result of trading, clearing, counterparty and other relationships. We have exposure to different industries and counterparties, and through transactions with counterparties in the financial services industry, including brokers and dealers, commercial banks, investment banks and other institutional clients. As a result, defaults by, or even rumors or questions about, one or more financial services companies, or the financial services industry generally, have led to market-wide liquidity problems and could lead to losses or defaults by us or by other institutions, as well as impact the trading prices of our common stock. These losses or defaults could have a material adverse effect on our business, financial condition and results of operations.

 Several high-profile bank failures within recent years, including two of our regional competitors, have generated significant market volatility among publicly traded bank holding companies. These market developments have negatively impacted client confidence in the safety and soundness in the financial services industry. We cannot offer assurances that the risks underlying negative publicity and public opinion have ameliorated or that adverse media stories, other bank failures, or geopolitical and market conditions will not exacerbate or continue these conditions. ing us as is set forth in Partly as a result of these conditions, some community and regional bank depositors have chosen to place their deposits with larger financial institutions or to invest in higher yielding short-term fixed income securities, all of which have unfavorably affected, and may continue to materially adversely impact our liquidity, cost of funding, loan funding capacity, net interest margin, capital, and results of operations. In connection with high-profile bank failures, uncertainty and concern has been, and may be in the future, compounded by advances in technology that increase the speed at which deposits can be moved, as well as the speed and reach of media attention, including social media, and its ability to disseminate concerns or rumors, in each case potentially exacerbating liquidity concerns. Further, any current or future measures announced by the Department of the Treasury, the Federal Reserve, and the Federal Deposit Insurance Corporation (FDIC) intended to reassure depositors of the availability of their deposits may not be successful in restoring client confidence in the banking system.

Events such as these may also result in potentially adverse changes to laws or regulations governing banks and bank holding companies or result in the imposition of restrictions through supervisory or enforcement activities, including higher capital requirements, which could have a material impact on our business.

Our risk management framework may not be effective in mitigating risks and/or losses to us.

Our risk management framework is comprised of various processes, systems and strategies, and is designed to manage the types of risk to which we are subject, including, among others, credit, market, liquidity, interest rate and compliance. Our risk management framework may not be effective under all circumstances and may not adequately mitigate any risk or loss. If our risk management framework is not effective, we could suffer unexpected losses and our business, financial condition and results of operations could be materially and adversely affected. We may also be subject to potentially adverse regulatory consequences.

Team member misconduct could expose us to significant legal liability and reputational harm.

We are vulnerable to reputational harm because we operate in an industry in which II, Item integrity and the confidence of our clients are of critical importance. Conduct by our team members that reflects fraudulent, illegal, wrongful or suspicious activities, or they act in a manner that results in consumer harm, may adversely affect our clients and/or our business. The precautions we take to detect and prevent such misconduct may not always be effective and could result in regulatory sanctions and/or penalties, criminal or civil penalties and, serious harm to our reputation, financial condition, client relationships, team member relationships and ability to attract new clients. In addition, improper use or disclosure of confidential information by our team members, even if inadvertent, could result in serious harm to our reputation, financial condition and current and future business relationships. If our internal controls against operational risks fail to prevent or detect an occurrence of such team member error or misconduct, or if any resulting loss is not insured or exceeds applicable insurance limits, it could have a material adverse effect on our business, financial condition and results of operations.

We depend on the accuracy and completeness of information provided by clients and counterparties and any misrepresented information could adversely affect our business, financial condition and results of operations.

In deciding whether to extend credit or to enter into other transactions with clients and counterparties, we may rely on information furnished to us by or on behalf of clients and counterparties, including financial statements and other financial information. Some of the information regarding clients provided to us is also used in our proprietary credit decision making and scoring models, which we use to determine whether to do business with clients. Further, the risk profiles of such clients may subsequently be utilized by counterparties who may lend us capital to fund our operations. We may also rely on representations of clients and counterparties as to the accuracy and completeness of that information. In deciding whether to extend credit, we may rely upon our clients representations that their financial statements conform to stated accounting principles and present fairly, in all material respects, the financial condition, results of operations and cash flows of the client. We also may rely on client representations and certifications, or other audit or accountants reports, with respect to the business and financial condition of our clients. Whether a misrepresentation is made by the applicant, another third party or one of our team members, we generally bear the risk of loss associated with the misrepresentation. We may not detect all misrepresented information in our originations or from service providers we engage to assist in the approval process. Any such misrepresented information could have a material adverse effect on our business, financial condition and results of operations.

Evolving expectations from clients, regulators, investors, and other stakeholders about our environmental, social and governance practices may impose additional costs on us or expose us to new or additional risks.

In recent years, clients, regulators, investors, and other stakeholders have more heavily scrutinized public companies environmental, social and governance (ESG) practices and the related disclosures. Changes in the incoming Presidential administration have added to uncertainties about the level and extent of these disclosure obligations, and uncertainties remain regarding whether and to what extent companies should focus on these disclosures, as well as on the underlying conduct and strategies. These stakeholders often consider, and place varying degrees of emphasis upon, these practices, especially as they relate to the environment, health and safety, diversity, labor conditions and human rights. Increased ESG-related compliance costs for us as well as among our suppliers, vendors and various other parties within our supply chain could result in increases to our overall operational costs. Moreover, the last few years have witnessed an increase in anti-ESG measures and proposals by investor advocacy groups, shareholders and policymakers. The potential impact of administrative policies and stakeholder emphasis, and the related policies and priorities as they may affect the financial services industry, cannot be predicted at this time. Failure to adapt to or comply with evolving regulatory requirements or investor or stakeholder expectations and standards could negatively impact our reputation, ability to do business with certain partners, access to capital, and our stock price.

Severe weather, natural disasters, pandemics, acts of war or terrorism, social unrest and other external events could significantly impact our operations.

Severe weather, natural disasters (including fires, earthquakes, and floods), wide spread disease or pandemics, such as the COVID-19 pandemic, acts of war or terrorism, social unrest and other adverse external events have had in the past and could have in the future a significant impact on our ability to conduct business and create significant volatility and disruption in global and U.S. economies. Such events could affect the financial markets, reduce access to liquidity, impair our clients financial condition, affect the stability of our deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue and/or cause us to incur additional expenses. The majority of our branches are located in the San Jose, San

Francisco, Oakland areas, which in the past have experienced both severe earthquakes and wildfires. Further, other areas of California, particularly including the Los 1Angeles Basin, have recently experienced extensive losses and business interruptions as a result of a well-publicized series of wildfires, and these and other areas that affect our markets, our customers, and the collateral securing our loans present significant risk to our operations and our assets. We do not carry earthquake insurance on our properties, and we do not require customers to carry such insurance on the real property that secures our mortgage and commercial real estate loans. Fire insurance, which we do carry on our properties and which we require our customers to carry, may prove inadequate to insure fully against potential losses. Accordingly, earthquakes, wildfires or other natural disasters could severely disrupt our operations. Operations in our market could be disrupted by both the evacuation of large portions of the population as well as damage to and/or lack of access to our banking and operation facilities. Although management has established disaster recovery policies and procedures, the occurrence of any such events could have a material adverse effect on our business, financial condition and results of operations.

. Risks Relating to Our Business

Our profitability is dependent upon the geographic concentration of the markets in which we operate.

We operate primarily in the general San Francisco Bay Area of California in the counties of Alameda, Contra Costa, Marin, San Benito, San Francisco, San Mateo, and Santa Clara and, as a result, our business, financial condition and results of operations are subject to the demand for our products in those areas and is also subject to chan Factors, on pages in the economic conditions in those areas. Our success depends upon the business activity, population, income levels, deposits and real estate activity in these markets. Although Bay View Funding, the Banks factoring subsidiary, and our clients business and financial interests may extend well beyond these market areas, adverse economic conditions that affect these market areas could reduce our growth rate, affect the ability of our clients to repay their loans to us, could impair the value of the collateral securing our loans, or otherwise generally could affect our business, financial condition and results of operations. Because of our geographic concentration, we are less able than regional or national financial institutions to diversify demand for our products or our credit risks across multiple markets.

Similarly, geologic, weather-related, and other hazards such as wildfires, earthquakes, droughts, floods and storms, frequently threaten our markets, and in certain circumstances could be expected to have a disproportionate effect on our business as compared to financial institutions whose client and asset bases are more diversified. Such events may harm our business directly or may harm our clients and prospective clients in a way that increases the risks of defaults on our loans, reduces the value of our collateral, and increases clients need for liquidity, thus reducing our deposit base and potentially increasing our costs of funds.

Our ability to maintain our reputation is critical to the success of our business, and the failure to do so may materially adversely affect our business, financial condition and results of operations.

We are a community bank, and our reputation is one of the most valuable components of our business. Threats to our reputation can come from many sources, including adverse sentiment about financial institutions generally, unethical practices, team member misconduct, cybersecurity failures or disruptions, failure to deliver minimum standards of service or quality, compliance deficiencies, and questionable or fraudulent activities of our clients or third parties. Negative publicity regarding our business, team members, or clients, with or without merit, may result in the loss of clients, investors and team members, costly litigation, a decline in revenues and increased governmental regulation and have a material adverse effect on business, financial condition and results of operations.

Risks Related to Our Loans

Because a significant portion of our loan portfolio is comprised of real estate loans, negative changes affecting real estate values and liquidity could impair the value of collateral securing our loans and result in loan and other losses.

Real estate lending (including commercial, land development and construction, home equity, multifamily, and residential mortgage loans) is a large portion of our loan portfolio. At March 31, 2025, approximately $3.0 billion, or 85% of our loan portfolio, was comprised of loans with real estate as a primary or secondary component of collateral. Included in CRE loans were owner occupied loans of $616.8 million, or 18% of total loans. The real estate securing our loan portfolio is concentrated in California. The market value of real estate can fluctuate significantly in a short period of time as a result of market conditions in the geographic area in which the real estate is located. Real estate values and real estate markets are generally affected by changes in national, regional or local economic conditions, the rate of unemployment,

fluctuations in interest rates and the availability of loans to potential purchasers, fluctuations in vacancy rates, changes in tax laws and other governmental statutes, regulations and policies, access to insurance coverage, and acts of nature, such as wildfires, earthquakes and other natural disasters or adverse events. Adverse changes affecting real estate values and the liquidity of real estate in one or more of our markets could increase the credit risk associated with our loan portfolio, significantly impair the value of property pledged as collateral on loans and affect our ability to sell the collateral upon foreclosure without a loss or additional losses, which would adversely affect profitability. Such declines and losses would have a material adverse effect on our business, financial condition, and results of operations.

Our land and construction development loans are based upon estimates of costs and value associated with the completed project. These estimates may be inaccurate and we may be exposed to more losses on these projects than on other loans.

At March 31, 2025, land and construction loans, (including land acquisition and development loans) totaled $136.1 million or 4% of our portfolio. Of these loans, 1 7% were comprised of owner occupied and 83% non-owner occupied land and construction loans. These loans involve additional risks because funds are advanced upon the security of the project, which is of uncertain value prior to its completion, and costs may exceed realizable values in declining real estate markets. Because of the uncertainties inherent in estimating construction costs and the realizable market value of the completed project and the effects of governmental regulation of real property, it is relatively difficult to evaluate accurately the total funds required to complete a project and the related loan-to-value ratio. As a result, construction loans often involve the disbursement of substantial funds with repayment dependent, in part, on the success of the ultimate project and the ability of the borrower to sell or lease the property, rather than the ability of the borrower or guarantor to repay principal and interest. If our appraisal of the value of the completed project proves to be overstated or market values or rental rates decline, we may have inadequate security for the repayment of the loan upon completion of project construction. If we are forced to foreclose on a project prior to or at completion due to a default, we may not be able to recover all of the unpaid balance of, and accrued interest on, the loan as well as related foreclosure and holding costs. In addition, we may be required to fund additional amounts to complete the project and may have to hold the property for an unspecified period of time while we attempt to dispose of it.

Increased scrutiny by regulators of commercial real estate concentrations could restrict our activities and impose financial requirements or limits on the conduct of our business.

Banking regulators are giving commercial real estate lending greater scrutiny, and may require banks with higher levels of commercial real estate loans to implement improved underwriting, internal controls, risk management policies and portfolio stress testing, as well as possibly higher levels of allowances for credit losses on loans and capital levels as a result of commercial real estate lending growth and exposures. Therefore, we could be required to raise additional capital or restrict our future growth as a result of our higher level of commercial real estate loans.

Our use of appraisals in deciding whether to make a loan on or secured by real property does not ensure the value of the real property collateral.

In considering whether to make a loan secured by real property we generally require an appraisal of the property. However, an appraisal is only an estimate of the value of the property at the time the appraisal is conducted, and an error in fact or judgment could adversely affect the reliability of an appraisal. In addition, events occurring after the initial appraisal may cause the value of the real estate to decrease. As a result of any of these factors the value of collateral securing a loan may be less than estimated, and if a default occurs, we may not recover the outstanding balance of the loan.

Many of our loans are to commercial borrowers, which may have a higher degree of risk than other types of borrowers.

At March 31, 2025, commercial loans totaled $489.2 million or 14% of our loan portfolio (including SBA loans, asset-based lending, and factored receivables). Commercial loans are often larger and involve greater risks than other types of lending. Because payments on such loans are often dependent on the successful operation or development of the property or business involved, repayment of such loans is often more sensitive than other types of loans to adverse conditions in the real estate market or the general business climate and economy. Accordingly, a downturn in the real estate market and a challenging business and economic environment may increase our risk related to commercial loans, particularly commercial real estate loans. Unlike home mortgage loans, which generally are made on the basis of the

borrowers ability to make repayment from their employment and other income and which are secured by real property whose value tends to be more easily ascertainable, commercial loans typically are made on the basis of the borrowers ability to make repayment from the cash flow of the commercial venture. Our commercial and industrial loans are primarily made based on the identified cash flow of the borrower and secondarily on the collateral underlying the loans. Most often, collateral consists of accounts receivable, inventory and equipment and may incorporate a personal guarantee. Inventory and equipment may depreciate over time, may be difficult to appraise and may fluctuate in value based on the success of the business. Accounts receivable may be uncollectable. If the cash flow from business operations is reduced, the borrowers ability to repay the loan may be impaired. Vacancy rates can also negatively impact cash flows from business operations. Thus, HBCs borrowers and their guarantors could be adversely impacted by a downturn in these sectors of the economy which could further impact the borrowers ability to repay their loans. Due to the larger average size of each commercial loan as compared with other loans such as residential loans, as well as collateral that is generally less readily-marketable, losses incurred on a small number of commercial loans could have a material adverse effect on our business, financial condition and results of operations.

The small and medium-sized businesses that we lend to may have fewer resources to weather adverse business developments, which may impair a borrowers ability to repay a loan, and such impairment could adversely affect our business, financial condition and results of operation.

We target our business development and marketing strategy primarily to serve the banking and financial services needs of small to medium-sized businesses. These businesses generally have fewer financial resources in terms of capital or borrowing capacity than larger entities, frequently have smaller market shares than their competition, may be more vulnerable to economic downturns, often need substantial additional capital to expand or compete and may experience substantial volatility in operating results, any of which may impair a borrowers ability to repay a loan. In addition, the success of a small and medium-sized business often depends on the management talents and efforts of one or two people or a small group of people, and the death, disability or resignation of one or more of these people could have a material adverse impact on the business and its ability to repay its loan. Negative general economic conditions in our markets where we operate that adversely affect our medium-sized business borrowers may impair the borrowers ability to repay a loan and such impairment could have a material adverse effect on our business, financial condition and results of operation.

Risks Related to our SBA Loan Program

Small Business Administration lending is an important part of our business. Our SBA lending program is dependent upon the U.S. federal government, and we face specific risks associated with originating SBA loans.

At March 31, 2023 95, SBA loans totaled $29.6 million, which are included in the commercial loan portfolio. SBA loans held-for-sale totaled $1.9 million at March 31, 2025. Our SBA lending program is dependent upon the U.S. federal government. As an approved participant in the SBA Preferred Lenders Program (an SBA Preferred Lender), we enable our clients to obtain SBA loans without being subject to of the potentially lengthy SBA approval process necessary for lenders that are not SBA Preferred Lenders. The SBA periodically reviews the lending operations of participating lenders to assess, among other things, whether the lender exhibits prudent risk management. When weaknesses are identified, the SBA may request corrective actions or impose enforcement actions, including revocation of the lenders SBA Preferred Lender status. If we lose our status as an SBA Preferred Lender, we may lose some or all of our clients to lenders who are SBA Preferred Lenders, and as a result we could experience a material adverse effect to our financial results. Any changes to the SBA program, including but not limited to changes to the level of guarantee provided by the federal government on SBA loans, changes to program specific rules impacting volume eligibility under the guaranty program, as well as changes to the program amounts authorized by Congress may also have a material adverse effect on our business. In addition, any default by the U.S. government on its obligations or any prolonged government shutdown could, among other things, impede our ability to originate SBA loans or sell such loans in the secondary market, which could have a material adverse effect on our business, financial condition and results of operations.

The SBAs 7(a) Loan Program is the SBAs primary program for helping start-up and existing small businesses, with financing guaranteed for a variety of general business purposes. Generally, we sell the guaranteed portion of our SBA 7(a) loans in the secondary market. These sales result in premium income for us at the time of sale and create a stream of future servicing income, as we retain the servicing rights to these loans. For the reasons described above, we may not be able to continue originating these loans or sell them in the secondary market. Furthermore, even if we are able to continue to originate and sell SBA 7(a) loans in the secondary market, we might not continue to realize premiums upon

the sale of the guaranteed portion of these loans or the premiums may decline due to economic and competitive factors. When we originate SBA loans, we incur credit risk on the non-guaranteed portion of the loans, and if a client defaults on a loan, we share any loss and recovery related to the loan pro-rata with the SBA. If the SBA establishes that a loss on an SBA guaranteed loan is attributable to significant technical deficiencies in the manner in which the loan was originated, funded or serviced by us, the SBA may seek recovery of the principal loss related to the deficiency from us. Generally, we do not maintain reserves or loss allowances for such potential claims and any such claims could materially adversely affect our business, financial condition and results of operations.

In addition, the Companys SBA loans include loans under the U.S. Department of Agriculture guaranteed lending programs.

The laws, regulations and standard operating procedures that are applicable to SBA loan products may change in the future. We cannot predict the effects of these changes on our business and profitability. Because government regulation greatly affects the business and financial results of all commercial banks and bank holding companies and especially our organization, changes in the laws, regulations and procedures applicable to SBA loans could adversely affect our ability to operate profitably.

The recognition of gains on the sale of loans and servicing asset valuations reflect certain assumptions.

We expect that gains on the sale of U.S. government guaranteed loans will contribute to noninterest income. The gains on such sales recognized for the Companyear ended March 31, 2025 was $98,000. The determination of these gains is based on assumptions regarding the value of unguaranteed loans retained, servicing rights retained and deferred fees and costs, and net premiums paid by purchasers of the guaranteed portions of U.S. government guaranteed loans. The value of retained unguaranteed loans and servicing rights are determined based on market derived factors such as prepayment rates, current market conditions and recent loan sales. Deferred fees and costs are determined using internal analysis of the cost to originate loans. Significant errors in assumptions used to compute gains on sale of loans or servicing asset valuations could result in material revenue misstatements, which may have a material adverse effect on our business, financial condition and results of operations.

We originated $11.2 million of SBA loans for the year ended March 31, 2025. We sold $1.0 million of the guaranteed portion of our SBA loans for the quarter ended March 31, 2025. We generally retain the non-guaranteed portions of the SBA loans that we originate. Consequently, as of March 31, 2025, we held $31.5 million of SBA loans (including loans held-for-sale) on our balance sheet, $17.2 million of which consisted of the non-guaranteed portion of SBA loans, and $14.3 million of which consisted of the guaranteed portion of SBA loans. At March 31, 2025, $1.9 million, or 5.99%, consisted of the guaranteed portion of SBA loans which we intend to sell in 2025. The non-guaranteed portion of SBA loans have a higher degree of credit risk and risk of loss as compared to the guaranteed portion of such loans and make up a substantial majority of our remaining SBA loans.

When we sell the guaranteed portion of SBA loans in the ordinary course of business, we are required to make certain representations and warranties to the purchaser about the SBA loans and the manner in which they were originated. Under these agreements, we may be required to repurchase the guaranteed portion of the SBA loan if we have breached any of these representations or warranties, in which case we may record a loss. In addition, if repurchase and indemnity demands increase on loans that we sell from our portfolios, our liquidity, results of operations and financial condition could be adversely affected. Further, we generally retain the non-guaranteed portions of the SBA loans that we originate and sell, and to the extent the borrowers of such loans experience financial difficulties, our financial condition and results of operations could be adversely impacted.

Risks Related to our Credit 's Quality

Our business depends on our ability to successfully manage credit risk.

The operation of our business requires us to manage credit risk. As a lender, we are exposed to the risk that our borrowers will be unable to repay their loans according to their terms, and that the collateral securing repayment of their loans, if any, may not be sufficient to ensure repayment. In addition, there are risks inherent in making any loan, including risks with respect to the period of time over which the loan may be repaid, risks relating to proper loan underwriting, risks resulting from changes in economic and industry conditions and risks inherent in dealing with individual borrowers. In order to successfully manage credit risk, we must, among other things, maintain disciplined and prudent underwriting standards and ensure that our bankers follow those standards. The weakening of these standards for any reason, a lack of discipline or diligence by our team members in underwriting and monitoring loans, the inability of our team members to adequately adapt policies and procedures to changes in economic or any other conditions affecting borrowers and the quality of our loan portfolio, may result in loan defaults, foreclosures and additional charge-offs and may necessitate that we significantly increase our allowance for credit losses on loans, each of which could adversely affect our net income. As a result, our inability to successfully manage credit risk could have a material adverse effect on our business, financial condition and results of operations.

Our allowance for credit losses on loans may prove to be insufficient to absorb potential losses in our loan portfolio.

We maintain an allowance for credit losses on loans to provide for loan defaults and non-performance, which reflects our estimate of the current expected credit losses in our loan portfolio at the relevant balance sheet date. Our allowance for credit losses was $48.3 million, or 1.38% expressed as a percentage of loans, at March 31, 2025. Allowance for credit losses on loans is funded from a provision for credit losses on loans, which is a charge to our income statement. The Company had a provision for credit losses on loans of $274,000 for the quarter ended March 31, 2025. The processes we use to estimate the allowance for credit losses on loans and to measure the fair value of financial instruments, as well as the processes used to estimate the effects of changing interest rates and other market measures on our financial condition and results of operations, depends upon the use of analytical models which takes into account known risks, composition and growth of the loan portfolio and economic forecasts. These models may not be accurate, particularly in times of market stress, unforeseen circumstances or due to flaws in the models design or implementation. If the models we use for interest rate risk and asset-liability management are inadequate, we may incur increased or unexpected losses upon changes in market interest rates or other market measures. If the models we use for determining the allowance for credit losses on loans are inadequate, the allowance for credit losses on loans may not be sufficient to support future charge-offs. If the models we use to measure the fair value of financial instruments are inadequate, the fair value of such financial instruments may fluctuate unexpectedly or may not accurately reflect what we could realize upon sale or settlement of such financial instruments. Any such failure in our analytical models could result in losses that could have a material adverse effect on our business, financial condition and results of operations.

In addition, we evaluate all loans identified as individually evaluated loans and allocate an allowance based upon our estimation of the potential loss associated with those problem loans. While we strive to carefully manage and monitor credit quality and to identify loans that may be deteriorating, at any time there are loans included in the portfolio that may result in losses, but that have not yet been identified as nonperforming or potential problem loans. Through established credit practices, we attempt to identify deteriorating loans and adjust the allowance for credit losses on loans accordingly. However, because future events are uncertain and because we may not successfully identify all deteriorating loans in a timely manner, there may be loans that deteriorate in an accelerated time frame. We cannot be sure that we will be able to identify deteriorating loans before they become nonperforming assets, or that we will be able to limit losses on those loans that have been so identified.

Although management believes that the allowance for credit losses on loans is adequate to absorb losses on any existing loans that may become uncollectible, we may be required to take additional provisions for credit losses on loans in the future to further supplement the allowance for credit losses on loans, either due to managements decision to do so or because our banking regulators require us to do so. Our bank regulatory agencies will periodically review our allowance for credit losses on loans and the value attributed to nonaccrual loans or to real estate acquired through foreclosure and may require us to adjust our determination of the value for these items. If our allowance for credit losses on loans is inaccurate, for any of the reasons discussed above (or other reasons), and is inadequate to cover the loan losses that we actually experience, the resulting losses could have a material adverse effect on our business, financial condition and results of operations.

Nonperforming assets adversely affect our results of operations and financial condition, and take significant time to resolve.

As of March 31, 2025, our nonperforming loans (which consist of nonaccrual loans, loans past due 90 days or more and still accruing interest) totaled $6.3 million, or 0.18% of our loan portfolio, and our nonperforming assets (which include nonperforming loans plus other real estate owned) also totaled $6.3 million, or 0.11% of total assets.

Our nonperforming assets adversely affect our net income in various ways. We do not record interest income on nonaccrual loans or other real estate owned, thereby adversely affecting our net interest income, net income and returns on assets and equity, and our loan administration costs increase, which together with reduced interest income adversely affects our efficiency ratio. Further, when we place a loan on nonaccrual status, we reverse any accrued but unpaid interest receivable, which decreases interest income. Subsequently, we continue to have a cost to fund the loan, which is reflected as interest expense, without any interest income to offset the associated funding expense. When we take collateral in foreclosure and similar proceedings, we are required to mark the collateral to its then-fair market value, which may result in a loss. These nonperforming loans and other real estate owned also increase our risk profile and the level of capital our regulators believe is appropriate for us to maintain in light of such risks. The resolution of nonperforming assets requires significant time commitments from management and can be detrimental to the performance of their other responsibilities. If we experience increases in nonperforming loans and nonperforming assets, our net interest income may be negatively impacted and our loan administration costs could increase, each of which could have a material adverse effect on our business, financial condition and results of operations.

We could be exposed to risk of environmental liabilities with respect to properties to which we take title.

In the course of our business, we may foreclose and take title to real estate, and could be subject to environmental liabilities with respect to these properties. We may be held liable to a governmental entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination, or may be required to investigate or clean up hazardous or toxic substances, or chemical releases at a property. The costs associated with investigation or remediation activities could be substantial. In addition, if we are the owner or former owner of a contaminated site, we may be subject to common law claims by third parties based on damages and costs resulting from environmental contamination emanating from the property. Significant environmental liabilities could have a material adverse effect on our business, financial condition, and results of operations.

rterly Risks Related to Our Growth Strategy

We face risks related to any future acquisitions we make.

We plan to continue to grow our business organically. However, from time to time, we may consider opportunistic strategic acquisitions that we believe support our long-term business strategy. We face significant competition from numerous other financial services institutions, many of which will have greater financial resources than we do, when considering acquisition opportunities. Additionally, the process for obtaining any required regulatory approvals has become substantially more difficult, which could affect our evaluation or completion of strategic and competitively significant business opportunities. Accordingly, attractive acquisition opportunities may not be available to us. We may not be successful in identifying or completing any future acquisitions, and we may incur expenses as a result of seeking these opportunities regardless of whether they are consummated. Acquisitions of financial institutions involve operational risks and uncertainties and acquired companies may have unforeseen liabilities, exposure to asset quality problems, key employee and client retention problems and other problems that could negatively affect our organization.

If we complete any future acquisitions, we may not be able to successfully integrate the operations, management, products and services of the entities that we acquire and eliminate redundancies. The integration process could result in the loss of key employees or disruption of the combined entitys ongoing business that adversely affect our ability to maintain relationships with clients and employees or achieve the anticipated benefits of the transaction. The integration process may also require significant time and attention from our management that they would otherwise direct at servicing existing business and developing new business. We may not be able to realize any projected cost savings, synergies or other benefits associated with any such acquisition we complete. We cannot determine all potential events, facts and circumstances that could result in loss and our investigation or mitigation efforts may be insufficient to protect against any such loss.

If the goodwill that we recorded in connection with a business acquisition becomes impaired, it could require charges to earnings, which would have a negative impact on our financial condition and results of operations.

Goodwill represents the amount by which the cost of an acquisition exceeded the fair value of net assets we acquired in connection with the purchase. At March 31, 2025, our acquisition-related goodwill as reflected on our balance sheet was $167.6 million. Management assesses whether it is necessary to perform a quantitative impairment test of goodwill on a quarterly basis. In addition, the Company hires a third-party vendor to test goodwill for impairment annually as of November 30, or on an interim basis if an event triggering impairment assessment may have occurred. We determine impairment by comparing the implied fair value of the reporting unit goodwill with the carrying amount of that goodwill. Estimates of fair value are determined based on a complex model using cash flows, the fair value of our Company as determined by our stock price, and company comparisons. If managements estimates of future cash flows are inaccurate, fair value determined could be inaccurate and impairment may not be recognized in a timely manner. If the carrying amount (book value) of the reporting unit exceeds the fair value of the reporting unit, an impairment loss is recognized in an amount equal to that excess. Any such adjustments are reflected in our results of operations in the periods in which they become known. There can be no assurance that our future evaluations of goodwill will not result in findings of impairment and related write-downs, which may have a material adverse effect on our financial condition and results of operations.

We must effectively manage our branch growth strategy.

We seek to expand our franchise safely and consistently. A successful growth strategy requires us to manage multiple aspects of our business simultaneously, such as following adequate loan underwriting standards, balancing loan and deposit growth without increasing interest rate risk or compressing our net interest margin, maintaining sufficient capital, maintaining proper system and controls, and recruiting, training and retaining qualified professionals. We also may experience a lag in profitability associated with new branch openings. As part of our general growth strategy we may expand into additional communities or attempt to strengthen our position in our current markets by opening new offices, subject to any regulatory constraints on our ability to open new offices. To the extent that we are able to open additional offices, we are likely to experience the effects of higher operating expenses relative to operating income from the new operations for a period of time which could have a material adverse effect on our business, financial condition and results of operations.

New lines of business or new products and services may subject us to additional risks.

eport on From time to time, we may implement or may acquire new lines of business or offer new products and services within existing lines of business. There are substantial risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and new products and services we may invest significant time and resources. We may not achieve target timetables for the introduction and development of new lines of business and new products or services and price and profitability targets may not prove feasible. External factors, such as regulatory compliance obligations, competitive alternatives, and shifting market preferences, may also impact the successful implementation of a new line of business or a new product or service. Furthermore, any new line of business and/or new product or service could have a significant impact on the effectiveness of our system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business or new products or services could have a material adverse effect on our business, financial condition and results of operations.

Risks Related to Our Financial Strength and Liquidity

An actual or perceived reduction in our financial strength may cause others to reduce or cease doing business with us, which could result in a decrease in our net interest income and fee revenues.

Our clients rely upon our financial strength and stability and evaluate the risks of doing business with us. If we experience diminished financial strength or stability, actual or perceived, including due to market or regulatory developments, announced or rumored business developments or results of operations, or a decline in stock price, clients may withdraw their deposits or otherwise seek services from other banking institutions and prospective clients may select other service providers. The risk that we may be perceived as less creditworthy relative to other market participants is increased in the current market environment, where the consolidation of financial institutions, including major global financial institutions, is resulting in a smaller number of much larger counterparties and competitors. If clients reduce their deposits with us or select other service providers for all or a portion of the services that we provide them, net interest income and fee revenues will decrease accordingly, and could have a material adverse effect on our results of operations.

Changing interest rates, economic conditions and tariff policies, and the effects on our current and future borrowers have adversely affected, and in the future may adversely affect, our loan portfolio and may result in losses or increasing provision expense.

With the succession of a new Presidential administration in January 2025, the United States has experienced a substantial shift in executive branch policies that may have an adverse impact on our borrowers and, accordingly, on the performance of our loan portfolio. These shifts, many of which are ongoing and are subject to extensive litigation and uncertainties as to timing and effect, pose risks to a wide variety of business and individual customers. The application of tariffs announced by the federal government have a pronounced effects on business customers, particularly those dependent on exports and imports, and also have implications for economic conditions that are affected by employment and interest rates.

These events also appear to have created caution in both the equity capital markets and in the interest rate environment. Although the Federal Reserve System (commonly referred to as the Fed) has recently made modest incremental reductions in benchmark interest rates, the current interest rate environment remains significantly elevated from those of the recent past, and recent indications as of the date of this Report are that further reductions are unlikely in the near future. Interest rates affect both our ability to reprice variable-rate loans and to originate new fixed-rate loans, and in times of significant uncertainty about interest rates, such as the present, clients and prospective investors often reduce their borrowing levels, which tends to have a deflating effect on our outstanding loan balances and thus on our interest income.

During the third and fourth quarters of 2024, the Federal Reserve Open Markets Committee cut benchmark interest rates three times and for the first time since 2020. Although the Fed has indicated after its meetings in January and March, 2025, that economic conditions appeared to have stabilized, the committee held benchmark rates stead, and, as a result, we are unable to predict changes in future interest rates. Further, even if adjustments are made, the effect on overall markets remains uncertain, and reflect in part a perceived increase in risks of political instability associated with the new presidential administration and subsequent governmental and economic reactions. If rates resume increasing, or if they continue to remain at relatively elevated levels for prolonged periods, our borrowers may experience increasing difficulty in repaying their loans. Further, borrowers may defer additional borrowing decisions pending the resolution of both the political uncertainties and the potential for further market adjustments in response to those matters and to general economic conditions.

To the extent interest rates remain relatively elevated, or if economic conditions affecting our borrowers worsen, our allowance for credit losses and related provision could be negatively impacted, which would result in a reduction in net income for the corresponding period, or in some cases we may experience losses in excess of established reserves, which would have a similar effect. At the same time, even if interest rates stabilize or if reductions are less significant than clients expect, we may confront a loss of demand that adversely affects our interest earning assets. Either of these outcomes, alone or in combination with other factors, may have a material adverse effect on our results of operations.

Fluctuations in interest rates may reduce net interest income and otherwise negatively affect our business, financial condition and results of operations.

Shifts in short-term interest rates may reduce net interest income, which is the principal component of our earnings. Net interest income is the difference between the amounts received by us on our interest-earning assets and the interest paid by us on our interest-bearing liabilities. When interest rates rise, the rate of interest we receive on our assets, such as floating interest rate loans, rises more quickly than the rate of interest that we pay on our interest-bearing liabilities, such as deposits, which may cause our profits to increase. When interest rates decrease, the rate of interest we receive on our assets, such as floating interest rate loans, declines more quickly than the rate of interest that we pay on our interest-bearing liabilities, such as deposits, which may cause our profits to decrease.

Changes in interest rates could influence our ability to originate loans and deposits. Historically, there has been an inverse correlation between the demand for loans and interest rates. Loan origination volume usually declines during periods of rising or high interest rates and increases during periods of declining or low interest rates.

Changes in interest rates can also affect the level of loan refinancing activity, which impacts the amount of prepayment penalty income we receive on loans we hold. Because prepayment penalties are recorded as interest income when received, the extent to which they increase or decrease during any given period could have a significant impact on the level of net interest income and net income we generate during that time. A decrease in our prepayment penalty income resulting from any change in interest rates or as a result of regulatory limitations on our ability to charge prepayment penalties could therefore adversely affect our net interest income, net income or results of operations.

An increase in interest rates that adversely affects the ability of borrowers to pay the principal or interest on loans may lead to an increase in nonperforming assets and a reduction of income recognized, which could have a material adverse effect on our results of operations and cash flows. Tariffs and other economic conditions may also increase the risk of our borrowers ability to perform according to the terms of their loans. Further, when we place a loan on nonaccrual status, we reverse any accrued but unpaid interest receivable, which decreases interest income. Subsequently, we continue to have a cost to fund the loan, which is reflected as interest expense, without any interest income to offset the associated funding expense. Thus, an increase in the amount of nonperforming assets would have an adverse impact on net interest income.

Changes in interest rates also can affect the value of loans, securities and other assets. Rising interest rates will result in a decline in value of the fixed-rate debt securities we hold in our investment securities portfolio. The unrealized losses resulting from holding these securities would be recognized in accumulated other comprehensive income and reduce total shareholders equity. Unrealized losses do not negatively impact our regulatory capital ratios. However, tangible common equity and the associated ratios would be reduced. If debt securities in an unrealized loss position are sold, such losses become realized and will reduce our regulatory capital ratios.

Failure to maintain effective internal controls over financial reporting could have a material adverse effect on our business and stock price.

We are required to comply with the Securities and Exchange Commissions (SEC) rules implementing Section 3orm 102, Section 404, and Section 906 of the Sarbanes-Oxley Act, which will require management to certify financial and other information in our quarterly and annual reports and provide an annual management report as to the effectiveness of controls over financial reporting. If we identify any material weaknesses in our internal control over financial reporting or are unable to comply with the requirements of Section 404 in a timely manner or assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an opinion as to the effectiveness of our internal control over financial reporting, investors, counterparties and clients may lose confidence in the accuracy and completeness of our financial statements and reports; our liquidity, access to capital markets and perceptions of our creditworthiness could be adversely affected; and the market price of our common stock could decline. In addition, we could become subject to investigations by the stock exchange on which our securities are listed, the SEC, the Federal Reserve, the FDIC, the California Department of Financial Protection and Innovation (DFPI) or other regulatory authorities, which could require additional financial and management resources. These events could have a material adverse effect on our business and stock price.

We have significant deferred tax assets and cannot assure that they will be fully realized.

Deferred tax assets and liabilities are the expected future tax amounts for the temporary differences between the carrying amounts and tax basis of assets and liabilities computed using enacted tax rates. We regularly assess available positive and negative evidence to determine whether it is more likely than not that our net deferred tax assets will be realized. Realization of a deferred tax asset requires us to apply significant judgment and is inherently speculative because it requires estimates that cannot be made with certainty. At March 31, 2025, we had a net deferred tax asset of $25.3 million. If we were to determine at some point in the future that we will not-Q achieve sufficient future taxable income to realize our net deferred tax asset, we would be required, under generally accepted accounting principles, to establish a full or partial valuation allowance which would require us to incur a charge to income for the period in which the determination was made.

Fluctuations in market interest rates may have a material effect on the value of the Companys securities portfolio.

As of for the quarter ended March 31, 2025, the fair value of our securities portfolio was approximately $867.2 million, of which approximately $371.0 million were categorized as available-for-sale. Fixed-rate investment securities, such as bonds, treasuries and mortgage-backed securities, generally decline in value when interest rates rise above the rates applicable to such securities. Correspondingly, declining interest rates tend to increase the value of fixed-rate securities issued in times of relatively higher rates, but those declines also affect our net interest income because they force us to pay above-market rates on certificates of deposit and other longer-term obligations, and clients tend to exit those investments less frequently under those conditions because their earning capacity in other investments is relatively less attractive.

In response to inflationary pressures and other general economic conditions, the Federal Open Market Committee of the Board of Governors of the Fed rapidly and significantly increased interest rates between early 2022 and mid-2024, which resulted in declines in the carrying value of both our held-to-maturity and, particularly, our available-for-sale securities portfolios. Market interest rates have declined modestly in response to the Feds recent interest rate reductions. However, reductions in benchmark rates that were widely expected in early 2025 have not yet materialized, and the economy remains highly uncertain with respect to various factors, including inflation and employment statistics. It is thus extremely difficult for management to predict when, to what degree, or in which direction the Fed may attempt to adjust rates further. Such fluctuations have in the past resulted in declines, and in the future may cause further declines, in the carrying value of our available-for-sale securities portfolio and our portfolio of fixed rate loans, as well as the value of securities pledged as collateral for certain borrowing lines. . These trends can be exacerbated if the Company were required to sell such securities to meet liquidity needs, including in the event of deposit outflows or slower deposit growth. Correspondingly, additional rate reductions may affect our net interest income as we seek to price our deposit products in a way that remains competitive and attractive to clients, while also mitigating the risk that future declines may leave us with elevated borrowing costs.

Additional facto discussion of risk factors beyond our control can further significantly influence the fair value of securities in our portfolio and can cause potential adverse changes to the fair value of these securities. Additional factors include, but are not limited to, rating agency downgrades of the securities or our own analysis of the value of the security, defaults by the issuer or individual mortgagors with respect to the underlying securities, and continued instability in the credit markets. Any of the foregoing factors could cause credit-related impairment in future periods and result in realized losses. The process for determining whether impairment is credit related usually requires difficult, subjective judgments about the future financial performancprovides a description of some of the issuer and any collateral underlying the security in order to assess the probability of receiving all contractual principal and interest payments on the security. Because of changing economic and market conditions affecting interest rates, we may recognize realized and/or unrealized losses in future periods, or we may face periods of compressed net interest margins, either of which could have a material adverse effect on our business, financial condition and results of operations.

Adverse changes to our credit ratings could limit our access to funding and increase our borrowing costs.

Credit ratings are subject to ongoing review by rating agencies, which consider a number of factors, including our financial strength, performance, prospects and operations as well as factors not under our control. Other factors that influence our credit ratings include changes to the rating agencies methodologies for our industry or certain security types; the rating agencies assessment of the general operating environment for financial services companies; our relative positions in the markets in which we compete; our various risk exposures and risk management policies and activities; pending litigation and other contingencies; our reputation; our liquidity position, diversity of funding sources and funding

mportant risk facosts; the current and expected level and volatility of our earnings; our capital position and capital management practices; our corporate governance; current or future regulatory and legislative initiatives; and the agencies views on whether the U.S. government would provide meaningful support to us or our subsidiaries in a crisis. Rating agencies ctors that could make adjustments to our credit ratings at any time, and there can be no assurance that they will maintain our ratings at current levels or that downgrades will not occur.

Any downgrade in our credit ratings could potentially adversely aaffect the cost and other terms upon which we are able to borrow or obtain funding, increase our cost of capital and/or limit our access to capital markets. Credit rating downgrades or negative watch warnings could negatively impact our reputation with lenders, investors our actual results and other third parties, which ccould also impair our ability to compete in certain markets or engage in certain transactions. In particular, holders of deposits may perceive such a downgrade or warning negatively and withdraw all or a portion of such deposits. While certain aspects of a credit rating downgrade are quantifiable, the impact that such a downgrade would have on our liquidity, business and results of operations in future periods is inherently uncertain and would depend on a number of interrelated factors, including, among other things, the magnitude of the downgrade, the rating relative to peers, the rating assigned by the relevant agency pre-downgrade, individual client behavior and future mitigating actions we might take.

Liquidity risks could affect operations and jeopardize our business, financial condition, and results of operations.

Liquidity is essential to our business. An inability to raise funds through deposits, borrowings, the sale of loans and/or investment securities, and from other sources could have a substantial negative effect on our liquidity. Our most important source of funds consists of our client deposits. The composition of our deposit base, and particularly the extent to which our deposits are not federally insured, may present a heightened risk of withdrawal. Such deposit balances can decrease during periods of economic uncertainty or when clients perceive alternative investments are providing a better risk/return tradeoff. Our measures to mitigate these risks, including correspondent deposit relationships, may not be completely effective in retaining and reassuring clients about theicause our results to vary materially from those expressed in public statements or deposits and may increase the costs of maintaining those deposits. Further, significant economic fluctuations, or cliocuments expectations about such events (whether or not those expectations materialize) may exacerbate depositors sensitivity to the availability of cash to fund immediate withdrawals. If clients move money out of bank deposits and into other investments, we could face a material decrease in the volume of our deposits and lose a relatively low cost source of funds, thereby increasing our funding costs and reducing net interest income and net income. We could have to raise interest rates to retain deposits, thereby increasing our funding costs and reducing net interest income and net income.

Additional liquidity is provided by our ability to borrow from the Federal Reserve Bank of San Francisco and the Federal Home Loan Bank of San Francisco. We also may borrow from third-party lenders from time to time. Our access to funding sources in amounts adequate to finance or capitalize our activities on terms that are acceptable to us could be impaired by factors that affect us directly or the financial services industry or economy in general, such as disruptions in s. However, othe financial markets or negative views and expectations about the prospects for the financial services industry.

Any decline in available funding could adversely impact our ability to continue to implement our strategic plan, including our ability to originate loans, invest in securities, meet our expenses, or to fulfill obligations such as repaying our borrowings or meeting deposit withdrawal demands, any of which could have a material adverse effect on our liquidity, business, financial condition and results of operations.

Risks Related to Our Capital

We may be subject to more stringent capital requirements in the future.

We are subject to current and changing regulatory requirements specifying minimum amounts and types of capital that we must maintain. The failure to meet applicable regulatory capital requirements could result in one or more of our regulators placing limitations or conditions on our activities, including our growth initiatives, or restricting the commencement of new activities, and could affect client and investor confidence, our costs of funds and FDIC insurance costs, our ability to pay dividends on our common stock, our ability to fund share repurchases, our ability to make acquisitions, and could materially adversely affect our business, financial condition and results of operations.

We may need to raise additional capital in the future, and if we fail to maintain sufficient capital, whether due to losses, an inability to raise additional capital or otherwise, our financial condition, liquidity and results of operations, as well as our ability to maintain regulatory compliance, would be adversely affected.

We face significant capital and otr factors besides those included in the discussion of risk factors, or discussed elsewher regulatory requirements as a financial institution. We may need to raise additional capital in the future to provide us with sufficient capital resources and liquidity to meet our commitments and business needs, which could include the possibility of financing acquisitions. Our ability to raise additional capital depends on conditions in the capital markets, economic conditions and a number of other factors, including investor perceptions regarding the banking industry, market conditions and governmental activities, and on our financial condition and performance. Any occurrence that may limit our access to the capital markets may adversely affect our capital costs and our ability to raise capital. Moreover, if we need to raise capital in the future, we may have to do so when many othere in any of our reports filed with or financial institutions are also seeking to raise capital and would have to compete with those institutions for investors. We, therefore, may not be able to raise additional capital if needed or on terms acceptable to us.

Risks Related to Our Legal and Regulatory Environment

We are subject to extensive and complex regulations which are costly to comply with and may subject us to significant penalties for noncompliance.

Our operations are subject to extensive regulation by federal, state and local governmental authorities, including the FDIC, the Federal Reserve and the California Department of Financial Protection and Innovation, and to various laws and judicial and administrative decisions imposing requirements and restrictions on part or all of our operations. Further, California law permits certain categories of plaintiffs, particularly current and former employees or customers, to assert private rights of action under Californias Private Attorney General Act, or PAGA, even if government authorities do not make such claims. Many of the applicable laws are complex, especially those governing fair lending, predatory or unfair or deceptive practices, and other consumer-focused practices, as well as labor and employment matters. Similarly, these laws and regulations have expanded substantially in terms of scope and complexity in recent years, and this expansion can be expected to continue. The complexity of those rules creates additional potential liability for us because noncompliance could result in significant regulatory action, including restrictions on operations and fines, and could lead to class action lawsuits from shareholders, consumers and employees. In addition, various states, particularly California, where substantially all our operations and banking activities take place, have their own laws and regulations governing a wide area of our business that may differ significantly from federal laws and regulations or from the laws or regulations of other states. These state-specific regulations include heightened data privacy, labor and employment law and consumer protection regulations, and the cost of complying with state rules that differ from federal rules can significantly increase compliance costs. Further, in certain instances, such as lending and deposit activities that involve customers or assets located in other states, we may be subject to the laws of those jurisdictions, which may vary from, or in limited circumstances may be in conflict with, California law.

Our consumer business, including our mortgage and other consumer lending and non-lending businesses, is also governed by policies enacted or regulations adopted by the Consumer Financial Protection Bureay, or CFPB, which under the Dodd-Frank Act has broad rulemaking authority over consumer financial products and services. Our regulators, including the FDIC, use interpretations from the CFPB and relevant statutory citations in certain parts of their assessments of our regulatory compliance, including the Real Estate Settlement Procedures Act, the Final Integrated Disclosure Rule, known as TRID, and the Home Mortgage Disclosure Act, adding to the complexity of our regulatory requirements, increasing our data collection requirements and increasing our costs of compliance. The laws, rules and regulations to which we are subject evolve and change frequently, including changes that come from judicial or administrative agency interpretations of laws and regulations outside of the legislative process that may be more difficult to anticipate, and changes to our regulatory environment are often driven by shifts of political power in the federal government. In addition, we are subject to various examinations by our regulators during the course of the year. Regulatory authorities who conduct these examinations have extensive discretion in their interpretation of various laws and regulations and in their supervisory and enforcement activities, including the authority to restrict our operations and certain corporate actions. Administrative and judicial interpretations of the rules that apply to our business may change the way such rules are applied, which also increases our compliance risk if the interpretation differs from our understanding or prior practice. Moreover, an increasing amount of the regulatory authority that pertains to financial institutions is in the form of informal guidance such as handbooks, guidelines, examination manuals, field interpretations by regulators or similar provisions that could affect our business or require changes in our practices in the future even if they are not formally adopted as laws or regulations. Any such changes could adversely affect our cost of doing business and our profitability and may create operational and legal risks that are difficult to anticipate or to mitigate.

In addition, changes in regulation of our industry have the potential to create higher costs of compliance, including short-term costs to meet new compliance standards, limit our ability to pursue business opportunities and increase our exposure to potential fines, penalties and litigation.

urnished to the SEChanges in accounting standards cou could materially impact our financial statements.

From time to time, the Financial Accounting Standards Board or the SEC, may change the financial accounting and reporting standards that govern the preparation of our financial statements. Such changes may result in us being subject to new or changing accounting and reporting standards. In addition, the bodies that interpret the accounting standards (such as banking regulators or outside auditors) may change their interpretations or positions on how these standards should be applied. These changes may be beyond our control, can be hard to predict and can materially impact how we record and report our financial condition and results of operations. In some cases, we could be required to apply a new or revised standard retrospectively, or apply an existing standard differently, also retrospectively, in each case resulting in our needing to revise or restate prior period financial statements. Restating or revising our financial statements may result in reputational harm or may have other adverse effects on us.

Significant legal claims or regulatory actions could subject us to substantial uninsured liabilities and reputational harm and have a material adverse effect on our business and results of operations.

We are from time to time subject to legal claims or regulatory actions related to our operations. affect our business or results. These matters may include supervisory or enforcement actions by our regulators, criminal proceedings by prosecutorial authorities, claims by customers or by current or former employees. Civil claims may be asserted as class, collective and representative actions, as well as certain claims that may be asserted under PAGA. We also may be subject to environmental lawsuits or enforcement actions arising in connection with property that we may acquire and hold following a foreclosure action in the course of our business. Such actions can pose substantial management distraction and could involve large monetary claims, including civil money penalties or fines imposed by government authorities and significant defense costs.

To mitigate the cost of some of these claims, we maintain insurance coverage in amounts and with deductibles that we believe are appropriate for our operat readers should not consider any descriptions. However, our insurance coverage does not cover any civil monetary penalties or fines imposed by government authorities and may not cover all other claims that might be brought against us, including certain wage and hour class, collective and representative actions brought by customers, employees or former employees, whether under state or federal labor and employment laws or regulations. In addition, such insurance coverage may not continue to be available to us at a reasonable cost or at all. Further, in some cases carriers may deny or contest coverage for claims that we expect to  of such factors to be fully or partially insured. As a result of any or a a combination of these factors, we may be exposed to substantial uninsured liabilities, which could adversely affecplete set our business, prospects, financial condition, results of operations and capital position. Substantial legal liability or significant regulatory action against us could cause significant reputational harm to us and/or could have a material adverse impact on our business, prospects, financial condition, results of operations and capital position.

We make estimates from time to time regarding expected losses from litigation, and those estimates may prove inaccurate or inadequate.

Our financial statements may, from time to time, reflect managements estimates of costs that may be incurred in various litigation matters. Generally speaking, f all potential risks that we expense our litigation costs, such as attorney fees, as they are incurred. We also record an expense to establish and maintain a reserve for contingent losses based upon a determination that a liability is probable that a loss will be incurred and when the amount of the loss is reasonably estimable. As with all accounting estimates, loss contingencies estimates reflect judgments as to the potential value of currently known exposures, and they are subject to change based upon developing facts and circumstances. Accordingly, we may adjust estimates to reflect our current expectations based on information that is subject to change, and these estimates may prove inadequate. If we incur a loss that exceeds the amount of an established reserve, or if our estimates are insufficient to reflect the actual amount of a loss, we will record an expense to reflect the incurrence of that loss to the extent it exceeds then-existing reserves, if any. Losses that are larger than estimated, or that were not predicted or anticipated by management, may therefore have a material adverse impact on our business, financial condition or results of operations.

The costs and effects of litigation, investigations or similar matters, or adverse facts and developments related thereto, could materially affect our business, financial condition and results of operations.

We are and will continue to be involved from time to time in a variety of litigation, investigations or similar matters arising out of our business. It is inherently difficult to assess the outcome of these matters, and we may not prevail in any proceedings or litigation. Any claims and lawsuits, and the disposition of such claims and lawsuits, whether through settlement, or litigation, could be time-consuming and expensive to resolve, divert management attention from executing our business plan, and lead to attempts on the part of other parties to pursue similar claims. Any claims asserted against us, regardless of merit or eventual outcome may harm our reputation. To mitigate the cost of some of these claims, we maintain insurance coverage in amounts and with deductibles that we believe are appropriate for our operations. However, our insurance coverage does not cover any civil monetary penalties, punitive damages or fines imposed by government authorities and may not cover all other claims that might be brought against us, including certain wage and hour class, collective and representative actions brought by clients, team members or former team members, and ponzi schemes. In addition, such insurance coverage may not continue to be available to us at a reasonable cost or at all. As a result, we may be exposed to substantial uninsured liabilities. Substantial legal liability or significant regulatory action against us could cause significant reputational harm to us and could have a material adverse impact on our business, financial condition, and results of operations.

The failure to protect our clients' confidential information, data and privacy could adversely affect our business.

We are subject to federal and state privacy regulations and confidentiality obligations, including the California Consumer Privacy Act of 2018 and the California Privacy Rights Act of 2020, that, among other things restrict the use and dissemination of, and access to, certain information that we produce, store or maintain in the course of our business and establishes a new state agency to enforce these rules. We also have contractual obligations to protect certain confidential information we obtain from our existing vendors and clients. These obligations generally include protecting such confidential information in the same manner and to the same extent as we protect our own confidential information, and in some instances may impose indemnity obligations on us relating to unlawful or unauthorized disclosure of any such information.

The continued development and enhancement of our information security controls, processes and practices designed to protect client information, our systems, computers, software, data and networks from attack, damage or unauthorized access remain a priority for our management as we increase our online and mobile banking offerings. As cyber threats continue to evolve, including supply chain risks, our costs to combat the cybersecurity threat can be expected to increase. Nonetheless, our measures may be insufficient to prevent all physical and electronic break-ins, denial of service and other cyber-attacks or security breaches.

If we do not properly comply with privacy regulations and contractual obligations that require us to protect confidential information, or if we experience a security breach or network compromise, we could face regulatory sanctions, penalties or fines, increased compliance costs, remedial costs such as providing credit monitoring or other services to affected clients, litigation and damage to our reputation, which in turn could result in decreased revenues and loss of clients, any or all of which would have a material adverse effect on our business, financial condition, results of operations and capital position.

Risks from Competition

We face strong competition from financial services companies and other companies that offer commercial banking services, which could harm our business.

We face substantial competition in all phases of our operations from a variety of different competitors. Our competitors, including larger commercial banks, community banks, savings and loan associations, mutual savings banks, credit unions, consumer finance companies, insurance companies, securities dealers, brokers, mortgage bankers, investment advisors, money market mutual funds and other financial institutions, compete with lending and deposit gathering services offered by us. Many of these competing institutions have much greater financial and marketing resources than we have. Due to their size, many competitors can achieve larger economies of scale and may offer a broader range of products and services than we can. If we are unable to offer competitive products and services, our business may be negatively affected. Some of the financial services organizations with which we compete are not subject

to the same degree of regulation as is imposed on bank holding companies and federally insured financial institutions or are not subject to increased supervisory oversight arising from regulatory examinations. As a result, these non-bank competitors have certain advantages over us in accessing funding and in providing various services.

We anticipate intense competition will continue for the coming year due to the recent consolidation of many financial institutions and more changes in legislation, regulation and technology. Further, we expect loan demand to continue to be challenging due to the uncertain economic climate and the intensifying competition for creditworthy borrowers, both of which could lead to loan rate concession pressure and could impact our ability to generate profitable loans. We expect we may see tighter competition in the industry as banks seek to take market share in the most profitable client segments, particularly the small business segment and the mass affluent segment, which offers a rich source of deposits as well as more profitable and less risky client relationships. Further, if there is a rebound of higher interest rates our deposit clients may perceive alternative investment opportunities as providing superior expected returns. Efforts and initiatives we undertake to retain and increase deposits, including deposit pricing, can increase our costs. When our clients move money into higher yielding deposits or in favor of alternative investments, we can lose a relatively inexpensive source of funds, thus increasing our funding costs.

New technology and other changes are allowing parties to effectuate financial transactions that previously required the involvement of banks. For example, consumers can maintain funds in brokerage accounts or mutual funds that would have historically been held as bank deposits. Consumers can also complete transactions such as paying bills and transferring funds directly without the assistance of banks. The process of eliminating banks as intermediaries, known as disintermediation, could result in the loss of fee income, as well as the loss of client deposits and the related income generated from those deposits.

Increased competition in our markets may result in reduced loans, deposits, and fee income, as well as reduced net interest margin and profitability. If we are unable to attract and retain banking clients and expand our loan and deposit growth, then we may be unable to continue to grow our business which could have a material adverse effect on our financial condition and results of operations.

We have a continuing competitive need for technological change, and we may not have the resources to effectively implement new technology or we may experience operational challenges when implementing new technology.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new, technology-driven products and services. The effective use of technology increases efficiency and enables financial institutions to better serve clients and to reduce costs. Our future success depends, in part, upon our ability to address the needs of our clients by using technology to provide products and services that will satisfy client demands, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements than we do. As a result, they may be able to offer additional or superior products to those that we will be able to offer, which would put us at a competitive disadvantage. We may not be able to effectively implement new, technology-driven products and services or be successful in marketing these products and services to our clients. In addition, the implementation of technological changes and upgrades to maintain current systems and integrate new ones may also cause service interruptions, transaction processing errors and system conversion delays and may cause us to fail to comply with applicable laws. Failure to successfully keep pace with technological change affecting the financial services industry and avoid interruptions, errors and delays could have a material adverse effect on our business, financial condition and results of operations.

Risks Related to Our Common Stock

An investment in our common stock is not an insured deposit.

An investment in our common stock is not a bank deposit and, therefore, is not insured against loss by the FDIC, any other deposit insurance fund or by any other public or private entity. Investment in our common stock is inherently risky for the reasons described herein, and is subject to the same market forces that affect the price of common stock in any company. As a result, if you acquire our common stock, you could lose some or all of your investment.

Issuing additional shares of our common stock to acquire other banks and bank holding companies may result in dilution for existing shareholders and may adversely affect the market price of our stock.

In connection with our growth strategy, we have issued, and may issue in the future, shares of our common stock to acquire additional banks or bank holding companies that may complement our organizational structure. Resales of substantial amounts of common stock in the public market and the potential of such sales could adversely affect the prevailing market price of our common stock and impair our ability to raise additional capital through the sale of equity securities. We sometimes must pay an acquisition premium above the fair market value of acquired assets for the acquisition of banks or bank holding companies. Paying this acquisition premium, in addition to the dilutive effect of issuing additional shares, may also adversely affect the prevailing market price of our common stock.

The trading volume in our common stock is less than that of other larger financial services companies.

Although our common stock is listed for trading on The Nasdaq Stock Market LLC (Nasdaq), its trading volume is less than that of other, larger financial services companies, and investors are not assured that a liquid market will exist at any given time for our common stock. A public trading market having the desired characteristics of depth, liquidity and orderliness depends on the presence in the marketplace at any given time of willing buyers and sellers of our common stock. This presence depends on the individual decisions of investors and general economic and market conditions over which we have no control. Given the lower trading volume of our common stock, significant sales of our common stock, or the expectation of these sales, could cause our stock price to fall.

The price of our common stock may fluctuate significantly, and this may make it difficult for you to resell shares of common stock owned by you at times or at prices you find attractive.

The stock market and, in particular, the market for financial institution stocks, has experienced significant volatility. In some cases, the markets have produced downward pressure on stock prices for certain issuers without regard to those issuers underlying financial strength. As a result, the trading volume in our common stock may fluctuate more than usual and cause significant price variations to occur.

The trading price of the shares of our common stock will depend on many factors, which may change from time to time and which may be beyond our control, including, without limitation, our financial condition, performance, creditworthiness and prospects, future sales or offerings of our equity or equity related securities, and other factors identified above under Cautionary Note Regarding Forward-Looking Statements and Risk Factors contained in this Report. These broad market fluctuations have adversely affected and may continue to adversely affect the market price of our common stock, some of which are out of our control. Among the factors that could affect our stock price are:

Our dividend policy may change without notice, and our future ability to pay dividends is subject to restrictions.

Historically, our Board has declared quarterly dividends on our common stock. However, we have no obligation to continue doing so and may change our dividend policy at any time without notice to holders of our common stock. Holders of our common stock are only entitled to receive such cash dividends as our Board, in its discretion, may declare out of funds legally available for such payments. Furthermore, consistent with our strategic plans, growth initiatives, capital availability, projected liquidity needs, and other factors, we have made, and will continue to make, capital management decisions and policies that could adversely impact the amount of dividends paid to holders of our common stock.

HCC is a separate and distinct legal entity from HBC. We receive substantially all of our revenue from dividends paid to us by HBC, which we use as the principal source of funds to pay our expenses and to pay dividends to our shareholders, if any. Various federal and/or state laws and regulations limit the amount of dividends that HBC may pay us. The Basel III capital rules also provide for risk-based capital, leverage and liquidity standards, including capital conservation buffers, that result in restrictions on HBC and the Company's ability to make dividend payments, redemptions or other capital distributions. If HBC does not receive regulatory approval or does not maintain a level of capital sufficient to permit it to make dividend payments to us while maintaining adequate capital levels, our ability to pay our expenses and our business, financial condition and results of operations could be materially adversely impacted.

As a bank holding company, we are subject to regulation by the Fed. The Fed has indicated that bank holding companies should carefully review their dividend policy in relation to the organizations overall asset quality, current and prospective earnings and level, composition and quality of capital. The guidance provides that we inform and consult with the Fed prior to declaring and paying a dividend that exceeds earnings for the period for which the dividend is being paid or that could result in an adverse change to our capital structure, including interest on our debt obligations. If required payments on our debt obligations are not made or are deferred, or dividends on any preferred stock we may issue are not paid, we will be prohibited from paying dividends on our common stock.

We have limited the circumstances in which our directors will be liable for monetary damages.

We have included in our articles of incorporation a provision to eliminate the liability of directors for monetary damages to the maximum extent permitted by California law. The effect of this provision will be to reduce the situations in which we or our shareholders will be able to seek monetary damages from our directors.

Our bylaws also have a provision providing for indemnification of our directors and executive officers and advancement of litigation expenses to the fullest extent permitted or required by California law, including circumstances in which indemnification is otherwise discretionary. Also, we have entered into agreements with our officers and directors in which we similarly agreed to provide indemnification that is otherwise discretionary. Such indemnification may be available for liabilities arising in connection with future offerings.

We may issue shares of preferred stock in the future, which could make it difficult for another company to acquire us or could otherwise adversely affect holders of our common stock, which could depress the price of our common stock.

Although there are currently no shares of our preferred stock issued and outstanding, our articles of incorporation authorize us to issue up to 10 million shares of one or more series of preferred stock. The board also has the power, without shareholder approval (subject to Nasdaq shareholder approval rules), to set the terms of any series of preferred stock that may be issued, including voting rights, dividend rights, preferences over our common stock with respect to dividends or in the event of a dissolution, liquidation or winding up and other terms. In the event that we issue preferred stock in the future that has preference over our common stock with respect to payment of dividends or upon our liquidation, dissolution or winding up, or if we issue preferred stock with voting rights that dilute the voting power of our common stock, the rights of the holders of our common stock or the market price of our common stock could be adversely affected. In addition, the ability of our Board to issue shares of preferred stock without any action on the part of our shareholders may impede a takeover of us and prevent a transaction perceived to be favorable to our shareholders.

The holders of our debt obligations will have priority over our common stock with respect to payment in the event of liquidation, dissolution or winding up and with respect to the payment of interest and dividends.

The holders of our debt obligations will have priority over our common stock with respect to payment in the event of liquidation, dissolution or winding up and with respect to the payment of interest and dividends.

In any liquidation, dissolution or winding up of the Company, our common stock would rank below all claims of the holders of outstanding debt issued by the Company. As of March 31, 2025, we had $40.0 million principal amount of subordinated notes outstanding due May 15, 2032. In such event, holders of our common stock would not be entitled to receive any payment or other distribution of assets upon the liquidation, dissolution or winding up of the Company until after all of the Companys obligations to the debt holders were satisfied and holders of the subordinated debt had received any payment or distribution due to them. In addition, we are required to pay interest on the subordinated notes and if we are in default in the payment of interest we would not be able to pay any dividends on our common stock.

Provisions in our charter documents and California law may have an anti-takeover effect, and there are substantial regulatory limitations on changes of control of bank holding companies.

Our articles of incorporation and bylaws contain a number of provisions relating to corporate governance and rights of shareholders that might discourage future takeover attempts. As a result, shareholders who might desire to participate in such transactions may not have an opportunity to do so. In addition, these provisions will also render the removal of our Board or management more difficult. Such provisions include a requirement that shareholder approval for any action proposed by the Company must be obtained at a shareholders meeting and may not be obtained by written consent. Our bylaws provide that shareholders seeking to make nominations of candidates for election as directors, or to bring other business before an annual meeting of the shareholders, must provide timely notice of their intent in writing and follow specific procedural steps in order for nominees or shareholder proposals to be brought before an annual meeting.

Provisions of our charter documents and the California General Corporation Law could make it more difficult for a third party to acquire us, even if doing so would be perceived to be beneficial by our shareholders. Furthermore, with certain limited exceptions, federal regulations prohibit a person or company or a group of persons deemed to be acting in concert from, directly or indirectly, acquiring more than 10% (5% if the acquirer is a bank holding company) of any class of our voting stock or obtaining the ability to control in any manner the election of a majority of our directors or otherwise direct the management or policies of our company without prior notice or application to and the approval of the Fed. Under the California Financial Code, no person may, directly or indirectly, acquire control of a California state bank or its holding company unless the DFPI has approved such acquisition of control. Moreover, the combination of these provisions effectively inhibits certain mergers or other business combinations, which, in turn, could adversely affect the market price of our common stock.

ITEM 1B. UNRESOLVED STAFF COMMENTS

None.

ITEM 1C. CYBERSECURITY

Risk Management and Strategy

Our cybersecurity program provides what we believe is an effective level of protection of client information and of our operating systems while also promoting the timely detection of, and defense against, cyberattacks and other unauthorized access to our information technology (IT) systems. In order to accomplish these goals, we invest heavily in up-to-date information security and monitoring controls, which we believe provide the best mechanism to mitigate cybersecurity risks and threats. At the same time, cyberattacks are becoming increasingly common, sophisticated and destructive, and several highly sophisticated financial institutions have been successfully targeted in recent years, leading to significant losses of client data, denials and loss of online banking and other data services, and other critical functions that have become essential to modern banking. In order to mitigate these risks and the potential harm that may result, our Chief Information Security Officer, who reports directly to the Chief Operating Officer and who reports regularly to our Boards Audit Committee, oversees certain policies and procedures that are intended to guard against, detect, and respond to potential breaches of our IT systems. We also maintain and periodically review our cybersecurity disclosure procedures to assure the timely compliance with the Companys obligations under Item 1.05 of Form 8-K.

Managing Material Risks Integrated Overall Risk Management

We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our Companys Information Security Program encompasses the guiding policies over our cybersecurity risk management. Additionally, our IT team uses industry-leading tools to help protect stakeholders against cybercriminals. We leverage the latest encryption practices and cyber technologies on our systems, devices, and third-party connections and further review vendor encryption to ensure proper information security safeguards are mainined. Our Company team members are responsible for complying with our cybersecurity standards and complete training to understand the behaviors and technical requirements necessary to keep information secure.

Engaging Third Parties for Risk Management

We recognize the complexity and evolving nature of cybersecurity threats, which is why we engage a range of external experts, including cybersecurity consultants, in evaluating and testing our risk management systems. Our IT security team partners with third-parties to perform annual penetration testing, vulnerability scanning, and monitoring of any potentially suspicious activity across the Company.

Oversight of Third-party Risk

The Companys Third-Party Relationship Risk Management (TPRM) Policy governs of all aspects of third-party risk management. The Board has ultimate responsibility for providing oversight for third-party risk management and holding management accountable. The Board provides clear guidance to the Audit Committee and management regarding the Companys strategic goals and acceptable risk appetite with respect to third-party relationships. The Board reviews the TPRM Policy on at least an annual basis and ensures that appropriate implementation procedures and practices have been established by management. The Chief Risk Officer is responsible for development and implementation of third-party risk management policies, procedures, and practices, commensurate with the Companys strategic goals, risk appetite and the level of risk and complexity of its third-party relationships. The Chief Risk Officer periodically provides reports to the Audit Committee on third-party risk management activities. The Companys Internal Audit department determines the frequency and scope of independent third-party audits of the TPRM program and its effectiveness.

The Company recognizes that not all third-party relationships present the same level of risk, and therefore not all third-party relationships require the same level, degree or type of oversight or risk management. As part of its risk management program, management analyzes the specific risks associated with each third-party relationship, including but not limited to, cybersecurity and information security related risks.

Risks from Cybersecurity Threats

We have not encountered cybersecurity risks or threats that have materially impaired our business strategy, results of operations, or financial condition.

Governance

The Board recognizes the importance of managing risks associated with cybersecurity threats. The Board has established robust oversight procedures to promote effective governance in managing cybersecurity risks because of the significance of these threats to our operational integrity and shareholder confidence.

Board of Directors Oversight

The Audit Committee is central to the Boards oversight of cybersecurity risks. The Audit Committee currently oversees risks relating to cybersecurity, technology, and finance, and in support of this objective, receives regular reports from the Chief Information Security Officer and other third-party advisors, to assure the Board maintains appropriate expertise to assure the appropriate management of cybersecurity risk. The Audit Committee reports periodically to the Board on the effectiveness of cybersecurity risk management processes and cybersecurity risk trends. The Board also receives specific reports from senior management with oversight responsibility for cybersecurity risks within the Company. These reports include cybersecurity and related risks and our exposure to those risks. The Audit Committee conducts an annual review of the companys cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with its overall risk management framework.

Managements Role in Managing Risk

The Chief Information Security Officer plays a pivotal role in informing the Audit Committee on cybersecurity risks. He reports quarterly to the Audit Committee on a range of topics, including:

  Current cybersecurity landscape and risks;

  Status of ongoing cybersecurity incidents, threats and strategies;

  Cybersecurity incident reporting and post-incident reviews; and

  Compliance with regulatory requirements and evolving industry trends.

The Chief Information Security Officer reports to the Chief Operating Officer, has a dotted line to the Audit Committee and the Chief Information Officer, and maintains independence in reporting on the status and impact of any information security related developments and strategic initiatives to the Audit Committee, and depending on the severity of the situation, directly to the Board of Directors. In addition to regular meetings, the Audit Committee, Chief Information Security Officer, Chief Information Officer, Chief Risk Officer and Chief Executive Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks that we face, particularly as a financial institution. The Companys internal Risk Management Steering Committee also reports directly to the Audit Committee regarding our risk management initiatives. The Audit Committee also receives quarterly reports from the Risk Management Steering Committee, the Companys Internal Audit department, and IT department in order to stay informed on all aspects of cybersecurity risk affecting the Company.

Risk Management Personnel

Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Information Security Officer, who has more than 20 years of cybersecurity experience working with large financial institutions and actively maintains multiple information security certifications. Additionally, our Chief Information Security Officer oversees our cybersecurity incident disclosure and communications. Our Chief Risk Officer separately chairs our Risk Management Steering Committee. Our Chief Risk Officer has served in her position since 2014 and is an accomplished banking professional with more than 40 years of experience in compliance and risk management.

Monitoring Cybersecurity Incidents

The Company monitors cybersecurity events using multiple methods. The Companys 24/7 Security Operations Center (SOC) has the ability to detect and respond to threats in real time and is authorized to shut threats down before they can harm the organization. Additionally, the SOC periodically performs pro-active threat hunts, searching for

potential indicators of compromise and bad actors on our network. Endpoint and network detection tools alert IT staff of security events that warrant further analysis. The Chief Information Security Officer is kept abreast of all active investigations. If an incident is identified, we attempt to contain the threat immediately, such as if systems could be taken offline to stop the spread of an attack. Eradication of an attackers artifacts, such as user accounts and malicious code, would then be performed. The Company maintains Business Continuity and Disaster Recovery plans, processes, and technology to restore systems affected by a cybersecurity incident. The Chief Information Security Officer may determine that an incident has the potential to be materially relevant and would escalate that determination to the Cybersecurity Incident Disclosure Team comprised of the senior leaders, including the Chief Executive Officer, Chief Risk Officer, Chief Information Officer, Chief Financial Officer, outside counsel and other leaders and advisors to the Company. In addition, we maintain insurance that we believe is customary against certain insurable cybersecurity risks. However, certain aspects of cybersecurity risks are not insurable, and the availability, extent, and cost of coverage may limit our recourse to these sources of risk mitigation.

Reporting to Board of Directors

The Chief Information Security Officer, in his capacity as such, regularly reports to management and the Audit Committee on all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept informed of our cybersecurity and the potential risks we face. In the event of certain cybersecurity matters which present increasing concern, our policies require escalating these cybersecurity and risk management decisions to the full Board.may face.