$FSBC Risk Factor changes from 00/02/25/22/2022 to 00/02/23/24/2024

Item 1A.

You should carefully consider the following risks, together with all of the other information contained in this Annual Report on Form 10-K, including the sections entitled “Cautionary Note Regarding Forward-Looking Statements” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our financial statements and the related notes thereto. Any of the following risks could have an adverse effect on our business, financial condition, and results of operations and could cause the trading price of our common stock to decline, which would cause you to lose all or part of your investment. Our business, financial condition, and results of operations could also be harmed by risks and uncertainties not currently known to us or that we currently do not believe are material.•We operate in a highly regulated industry, and current regulatory requirements, including stringent capital requirements, consumer protection laws, and anti-money laundering laws, and failure to comply with these requirements and any future legislative and regulatory changes may have an adverse effect on our business, financial condition, and results of operations. As of December 31, 2023, approximately more than half of our real estate loans measured by dollar amount were secured by collateral located in California, substantially all of which is in Northern California. Therefore, our success will depend upon the general economic conditions and real estate activity in these areas, which we cannot predict with certainty. As a result, our operations and profitability may be more adversely affected by a local economic downturn than those of larger, more geographically diverse competitors. In addition, businesses operating in Northern California, and Sacramento in particular, depend on California state government employees for business, and reduced spending activity by such employees in the event of furloughing or termination of such employees could have an adverse impact on the success or failure of these businesses, some of which are current or could become future customers of the Bank. For these reasons, any regional or local economic downturn could have an adverse effect on our business, financial condition, and results of operations. These businesses generally have fewer financial resources in terms of capital or borrowing capacity than larger entities, frequently have smaller market shares than their competition, may be more vulnerable to economic downturns, often need substantial additional capital to expand or compete, and may experience substantial volatility in operating results, any of which may impair their ability as a borrower to repay a loan. In addition, the success of small and medium-sized businesses often depends on the management skills, talents, and efforts of one or two people or a small group of people, and the death, disability, or resignation of one or more of these people could have an adverse impact on the business and its ability to repay its loan. If general economic conditions negatively impact the markets in which we operate or any of our borrowers are otherwise affected by adverse business developments, our small to medium-sized borrowers may be disproportionately affected and their ability to repay outstanding loans may be negatively affected, resulting in an adverse effect on our business, financial condition, and results of operations.As of December 31, 2023, a significant majority of our loan portfolio was comprised of loans with real estate as a primary or secondary component of collateral, with a majority of these real estate loans concentrated in Northern California. Real property values in our market may be different from, and in some instances worse than, real property values in other markets or in the United States as a whole and may be affected by a variety of factors outside of our control and the control of our borrowers, including national and local economic conditions, generally. Declines in real estate values, including prices for homes and commercial properties, could result in a deterioration of the credit quality of our borrowers, an increase in the number of loan delinquencies, defaults, and charge-offs, and reduced demand for our products and services, generally. Our commercial real estate loans may have a greater risk of loss than residential mortgage loans, in part because these loans are generally larger or more complex to underwrite. In addition, declines in real property values in California could reduce the value of any collateral we realize following a default on these loans and could adversely affect our ability to continue to grow our loan portfolio consistent with our underwriting standards. We may have to foreclose on real estate assets if borrowers default on their loans, in which case we are required to record the related asset to the then-fair market value of the collateral, which may ultimately result in a loss. An increase in the level of nonperforming assets increases our risk profile and may affect the capital levels regulators believe are appropriate in light of the ensuing risk profile. Our failure to effectively mitigate these risks could have an adverse effect on our business, financial condition, and results of operations. Changes in interest rates can increase or decrease our net interest income because different types of assets and liabilities may react differently, and at different times, to market interest rate changes. As interest rates have increased, so have competitive pressures on the deposit cost of funds. This has been exacerbated by the bank failures in the first half of 2023 and the resulting heightened competition for deposits, which has also affected the interest we pay on deposits. It is not possible to predict the pace and magnitude of changes in interest rates, or the impact rate changes will have on our results of operations. Changes in monetary policy, including changes in interest rates, could influence not only the interest we receive on loans and securities and the interest we pay on deposits and borrowings, but such changes could also affect our ability to originate loans and obtain deposits, the fair value of our financial assets and liabilities, and the average duration of our assets and liabilities. If the interest rates paid on deposits and other borrowings increase at a faster rate than the interest rates received on loans and other investments, our net interest income, and therefore earnings, could be adversely affected. Earnings could also be adversely affected if the interest rates received on loans and other investments fall more quickly than the interest rates paid on deposits and other borrowings. Any substantial, unexpected, or prolonged change in market interest rates could have an adverse effect on our business, financial condition, and results of operations. As of December 31, 2023, significant portions of our interest-bearing liabilities were variable rate, where our variable rate liabilities reprice at a faster rate than our variable rate assets. A decrease in the general level of interest rates may affect us through, among other things, increased prepayments on our loan portfolio, and our cost of funds may not fall as quickly as yields on interest-earning assets. Our asset-liability management strategy may not be effective in mitigating exposure to the risks related to changes in market interest rates. Our principal competitors are commercial and community banks, credit unions, savings and loan associations, mortgage banking firms and online mortgage lenders, and commercial and consumer finance companies, including large national financial institutions that operate in our market. Many of these competitors are larger than we are, have significantly more resources, greater brand recognition, and more extensive and established branch networks or geographic footprints than we do, and may be able to attract customers more effectively than we can. Because of their scale, many of these competitors can be more aggressive on loan and deposit pricing than we can and may better afford and make broader use of media advertising, support services, and electronic technology than we do. Also, many of our non-bank competitors have fewer regulatory constraints and may have lower cost structures. We compete with these other financial institutions both in attracting deposits and making loans. We expect competition to continue to increase as a result of legislative, regulatory, and technological changes, the continuing trend of consolidation in the financial services industry, and the emergence of alternative banking sources. Our profitability in large part depends upon our continued ability to compete successfully with traditional and new financial services providers, some of which maintain a physical presence in our market and others of which maintain only a virtual presence. Increased competition could require us to increase the rates we pay on deposits or lower the rates that we offer on loans, which could reduce our profitability. Our future growth will largely depend on our ability to retain and grow our deposit base. Although we have historically maintained a high deposit customer retention rate, these deposits are subject to potentially dramatic fluctuations in availability or price due to certain factors outside of our control, such as increasing competitive pressures for deposits, changes in interest rates and returns on other investment classes, customer perceptions of our financial health and general reputation, and a loss of confidence by 20customers in us or the banking sector generally, which could result in significant outflows of deposits within short periods of time or significant changes in pricing necessary to maintain current customer deposits or attract additional deposits. Additionally, any such loss of funds could result in lower loan originations, which could have an adverse effect on our business, financial condition, and results of operations. Our failure to compete effectively in our market could restrain our growth or cause us to lose market share, which could have an adverse effect on our business, financial condition, and results of operations. The effective use of technology increases efficiency and enables financial institutions to better serve customers and reduce costs. Our future success will depend, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands for convenience, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements than we do. We may not be able to implement new technology-driven products and services effectively or be successful in marketing these products and services to our customers. Failure to keep pace successfully with technological change affecting the financial services industry could harm our ability to compete effectively and could have an adverse effect on our business, financial condition, and results of operations. As these technologies improve in the future, we may be required to make significant capital expenditures in order to remain competitive, which may increase our overall expenses and have an adverse effect on our business, financial condition, and results of operations. We anticipate that model-derived insights will be used more widely in our decision making in the future. While these quantitative techniques and approaches improve our decision making, they also create the possibility that faulty data or flawed quantitative approaches could yield adverse outcomes or regulatory scrutiny. Secondarily, because of the complexity inherent in these approaches, misunderstanding or misuse of their outputs could similarly result in suboptimal decision making, which could have an adverse effect on our business, financial condition, and results of operations. As a lender, we are exposed to the risk that the principal of, or interest on, a loan will not be paid timely or at all or that the value of any collateral supporting a loan will be insufficient to cover our outstanding exposure. In addition, we are exposed to risks with respect to the period of time over which the loan may be repaid, risks relating to proper loan underwriting, risks resulting from changes in economic and industry conditions, and risks inherent in dealing with individual loans and borrowers. The creditworthiness of a borrower is affected by many factors, including local market conditions and general economic conditions. Many of our loans are made to small to medium-sized businesses that are less able to withstand competitive, economic, and financial pressures than larger borrowers. Additional factors related to the credit quality of multifamily residential, real estate construction, and other commercial real estate loans include the quality of management of the business and tenant vacancy rates. A failure to effectively measure and limit the credit risk associated with our loan portfolio may result in loan defaults, foreclosures, and additional charge-offs, and may necessitate that we significantly increase our allowance for credit losses, each of which could adversely affect our net income. As a result, our 21inability to successfully manage credit risk could have an adverse effect on our business, financial condition, and results of operations.We are exposed to higher credit risk and other risks and costs by our commercial real estate, commercial land and construction, commercial construction, farmland loans and other real estate assets.Commercial real estate, commercial land and construction, commercial construction, and farmland-based lending, which form significant portions of our loan portfolio, usually involve higher credit risks than other types of mortgage loans. These types of loans also involve larger loan balances to a single borrower or groups of related borrowers. These higher credit risks are further heightened when the loans are concentrated in a small number of larger borrowers, leading to relationship exposure. These loans also involve greater risk because they generally are not fully amortizing over the loan period but have a balloon payment due at maturity. A borrower’s ability to make a balloon payment typically will depend on being able to either refinance the loan or sell the underlying property in a timely manner. These loans may involve greater risk because the availability of funds to repay each loan depends substantially on the success of the business itself. In addition, the assets securing the loans have the following characteristics: (i) they depreciate over time; (ii) they are difficult to appraise and liquidate; and (iii) they fluctuate in value based on the success of the business. Our underwriting, review, and monitoring cannot eliminate all the risks related to these loans. Secured commercial loans are generally collateralized by real estate, accounts receivable, inventory, equipment, or other assets owned by the borrower, or may include a personal guaranty of the business owner. Unsecured loans generally involve a higher degree of risk of loss than do secure loans because, without collateral, repayment is wholly dependent upon the success of the borrowers’ businesses. Because of this lack of collateral, we are limited in our ability to collect on defaulted unsecured loans. Furthermore, the collateral that secures our secured commercial and industrial loans typically includes inventory, accounts receivable, and equipment, which, if the business is unsuccessful, usually has a value that is insufficient to satisfy the loan without a loss. The amount that we, as a mortgagee, may realize after a foreclosure depends on factors outside of our control, including, but not limited to, general or local economic conditions, environmental cleanup liabilities, assessments, interest rates, real estate tax rates, operating expenses of the mortgaged properties, our ability to obtain and maintain adequate occupancy of the properties, zoning laws, governmental and regulatory rules, and natural disasters. A number of states in recent years have either considered or adopted foreclosure reform laws that make it substantially more difficult and expensive for lenders to foreclose on properties in default. Additionally, federal and state regulators and state attorneys general have prosecuted or pursued enforcement action against a number of mortgage servicing companies for alleged consumer protection law violations. If new federal or state laws or regulations are ultimately enacted that significantly raise the cost 22of foreclosure or raise outright barriers to foreclosure, they could have an adverse effect on our business, financial condition, and results of operations. Environmental laws may require us to incur substantial expenses and may materially reduce the affected property’s value or limit our ability to sell the affected property. The remediation costs and any other financial liabilities associated with an environmental hazard could have an adverse effect on our business, financial condition, and results of operations.S. government-guaranteed loans, in particular those guaranteed by the SBA. Pursuant to the Consolidated Appropriations Act, the SBA guaranteed 90% of the principal amount of each qualifying SBA loan originated under the SBA’s 7(a) loan program through October 1, 2021. The U.S. government may not maintain the SBA 7(a) loan program, and even if it does, the guaranteed portion may not remain at its current or anticipated level. In addition, from time to time, the government agencies that guarantee these loans reach their internal limits and cease to guarantee future loans. In addition, these agencies may change their rules for qualifying loans or Congress may adopt legislation that would have the effect of discontinuing or changing the loan guarantee programs. Non-governmental programs could replace government programs for some borrowers, but the terms might not be equally acceptable. Therefore, if these changes occur, the volume of loans to small business and industrial borrowers of the types that now qualify for government-guaranteed loans could decline. Also, the profitability of the sale of the guaranteed portion of these loans could decline as a result of market displacements due to increases in interest rates, and premiums realized on the sale of the guaranteed portions could decline from current levels. As the funding and sale of the guaranteed portion of SBA 7(a) loans is a major portion of our business and a significant portion of our non-interest income, any significant changes to the SBA 7(a) loan program, such as its funding or eligibility requirements, may have an unfavorable impact on our prospects, future performance, and results of operations. The aggregate principal balance of SBA 7(a) guaranteed portions sold during the year ended December 31, 2023 was $36.8 million for the year ended December 31, 2022. We require sufficient liquidity to fund asset growth, meet customer loan requests, facilitate customer deposit maturities and withdrawals, make payments on our debt obligations as they come due, and fulfill other cash commitments under both normal operating conditions and other unpredictable circumstances, including events causing industry or general financial market stress. Liquidity risk can increase due to a number of factors, which include, but are not limited to, an over-reliance on a particular source of funding, changes in the liquidity needs of our depositors, adverse regulatory actions against us, or a downturn in the markets in which our loans are concentrated. Our inability to raise funds through deposits, borrowings, the sale of loans, and other sources could have an adverse effect on our business, financial condition, and results of operations, and could result in the closure of the Bank. Additional liquidity is provided by the ability to borrow from the FHLB and the Federal Reserve Bank of San Francisco to fund our operations. We may also borrow funds from third-party lenders, such as other financial institutions. Our access to funding sources in amounts adequate to finance our activities or on acceptable terms could be impaired by factors that affect our organization specifically or the financial services industry or economy in general. Our access to funding sources could also be affected by a decrease in the level of our business activity as a result of a downturn in our primary market or by one or more adverse regulatory actions against us. Although we have historically been able to replace maturing deposits and advances if 23desired, we may not be able to replace such funds in the future if our financial condition, the financial condition of the FHLB, or market conditions change. FHLB borrowings and other current sources of liquidity may not be available or, if available, may not be sufficient to provide adequate funding for operations and to support our continued growth. The unavailability of sufficient funding could have an adverse effect on our business, financial condition, and results of operations. Financial services companies may be interrelated as a result of trading, clearing, counterparty, and other relationships. The failures of Silicon Valley Bank, Signature Bank, and First Republic Bank in 2023 resulted in significant disruption in the financial services industry and negative media attention, which has also adversely impacted the volatility and market prices of the securities of financial institutions and resulted in outflows of deposits for us and many other financial institutions. These events have adversely impacted and could continue to adversely affect our business, results of operations, and financial condition, as well as the market price and volatility of our common stock.The rapid rise in interest rates during 2022 and 2023 and the resulting industry-wide reduction in the fair value of securities portfolios, among other events, have resulted in a current state of volatility and uncertainty with respect to the health of the United States banking system. There is heightened awareness around liquidity, uninsured deposits, deposit composition, unrecognized investment losses, and capital. As a result, defaults by, declines in the financial condition of, or even rumors or questions about one or more financial services companies, or the financial services industry generally, could lead to market-wide liquidity problems and losses or defaults by us or other institutions. Under this guidance, an institution that has: (i) total reported loans for construction, land development, and other land which represent 100% or more of the institution’s total risk-based capital or (ii) total commercial real estate loans representing 300% or more of the institution’s total risk-based capital, where the outstanding balance of the institution’s commercial real estate loan portfolio has increased 50% or more during the prior 36 months, is identified as having potential commercial real estate concentration risk. An institution that is deemed to have concentrations in commercial real estate lending is expected to employ heightened levels of risk management with respect to its commercial real estate portfolios and may be required to maintain higher levels of capital. We have a concentration in commercial real estate loans, and we have experienced significant growth in our commercial real estate portfolio in recent years. We cannot guarantee that any risk management practices we implement will be effective to prevent losses relating to our commercial real estate portfolio. Management has extensive experience in commercial real estate lending and has implemented and continues to maintain heightened portfolio monitoring and reporting, and strong underwriting criteria with respect to our commercial real estate portfolio. Nevertheless, we could be required to maintain higher levels of capital as a result of our commercial real estate concentration, which could limit our growth, require us to obtain additional capital, and have an adverse effect on our business, financial condition, and results of operations. A secondary market for most types of commercial real estate loans is not readily liquid, so we have less opportunity to mitigate credit risk by selling part or all of our interest in these loans. As a result of these characteristics, if we foreclose on a commercial real estate loan, our holding period for the collateral typically is longer than for residential mortgage loans because there are fewer potential purchasers of the collateral. Accordingly, charge-offs on commercial real estate loans may be larger as a percentage of the total principal outstanding than those incurred with our residential or consumer loan portfolios. However, an appraisal is only an estimate of the value of the property at the time the appraisal is made, and as real estate values may change significantly in value in relatively short periods of time (especially in periods of heightened economic uncertainty), this estimate may not accurately reflect the net value of the collateral after the loan is made. As a result, we may not be able to realize the full amount of any remaining indebtedness when we foreclose on and sell the relevant property. In addition, we rely on appraisals and other valuation techniques to establish the value of OREO that we acquire through foreclosure proceedings and to determine loan impairments. If any of these valuations are inaccurate, our consolidated financial statements may not reflect the correct value of our OREO, if any, and our allowance for credit losses may not reflect accurate loan impairments.” These laws prohibit practices such as steering borrowers away from more affordable products, selling unnecessary insurance to borrowers, repeatedly refinancing loans, and making loans without a reasonable expectation that the borrowers will be able to repay the loans irrespective of the value of the underlying property. It is our policy to determine borrowers’ ability to repay and not to make predatory loans. Nonetheless, the law and related rules create the potential for increased liability with respect to our lending and loan investment activities. Compliance with these laws increases our cost of doing business. A number of states in recent years have either considered or adopted foreclosure reform laws that make it substantially more difficult and expensive for lenders to foreclose on properties in default, and we cannot be certain that the state in which we operate will not adopt similar legislation in the future. Additionally, federal regulators have prosecuted or pursued enforcement actions against a number of mortgage servicing companies for alleged consumer protection law violations. If new state or federal laws or regulations are ultimately enacted that significantly raise the cost of foreclosure or raise outright barriers to foreclosure, such laws or regulations could have an adverse effect on our business, financial condition, and results of operations.5 million (including unfunded commitments) and totaled approximately $1. Each of the loans associated with these relationships has been underwritten in accordance with our underwriting policies and limits. Along with other risks inherent in these loans, such as the deterioration of the underlying businesses or property securing these loans, this concentration of borrowers presents a risk that, if one or more of these relationships were to become delinquent or suffer default, we could be exposed to material losses. Even if these loans are adequately collateralized, an increase in classified assets could harm our reputation with our regulators and inhibit our ability to execute our business plan.0 million, amounted to $1.7 million in deposits from municipalities, of which we conduct a monthly review. Withdrawals of deposits by any one of our largest depositors or by one of our related customer groups could force us to rely more heavily on borrowings and other sources of funding for our business and withdrawal demands, adversely affecting our net interest margin and results of operations. If a significant amount of these deposits were withdrawn within a short period of time, it could have a negative impact on our short-term liquidity and have an adverse impact on our earnings. We may also be forced, as a result of withdrawals of deposits, to rely more heavily on other, 25potentially more expensive and less stable, funding sources. Additionally, such circumstances could require us to raise deposit rates in an attempt to attract new deposits, which would adversely affect our results of operations, and/or to raise funding through brokered deposits. Under applicable regulations, if the Bank were no longer “well-capitalized,” the Bank would not be able to accept brokered deposits without the approval of the FDIC.Our allowance for credit losses may be inadequate to absorb losses inherent in the loan portfolio. We may experience losses for reasons beyond our control, such as the impact of general economic conditions on customers and their businesses.4 million. If we need to make significant and unanticipated increases in the loss allowance in the future, or to take additional charge-offs for which we have not established adequate reserves, our business, financial condition, and results of operations could be adversely affected at that time.On January 1, 2023, the Company adopted ASU No. 2016-13, Financial Instruments – Credit Losses (Topic 326): Measurement of Credit Losses on Financial Instruments and all subsequent amendments that modified ASU 2016-13 (collectively, “ASC 326,”), which replaces the current “incurred loss” model for recognizing credit losses with an “expected loss” model referred to as the CECL model. The CECL model applies to estimated credit losses on loans receivable, held-to-maturity debt securities, unfunded loan commitments, and certain other financial assets measured at amortized cost. Under ASC 326, available-for-sale debt securities are evaluated for impairment if fair value is less than amortized cost, with any estimated credit losses recorded through a credit loss expense and an allowance, rather than a write-down of the investment. Changes in fair value that are not credit-related will continue to be recorded in other comprehensive income. Under the CECL model, the calculated allowance for credit losses was $5.3 million higher on January 1, 2023 than the allowance under the incurred loss model.

For further information, please see Note 2, Recently Issued Accounting Standards, in the notes to our audited consolidated financial statements included in this Annual Report on Form 10-K.2 million. As of the same date, 9.48% of our investments were U.S. government agency securities. Factors beyond our control can significantly influence the fair value of securities in our portfolio and can cause potential adverse changes to the fair value of these securities. Our failure to correctly and timely assess any impairments or losses with respect to our securities could have an adverse effect on our business, financial condition, and results of operations. We may also rely on representations of customers and counterparties as to the accuracy and completeness of that information. In deciding whether to extend credit, we may rely upon customers’ representations that their financial statements conform to GAAP and present fairly the financial condition, results of operations, and cash flows of the customer. We also may rely on customer representations and certifications, or other audit or accountants’ reports, with respect to the business and financial condition of our customers. Our business, financial condition, and results of operations could be adversely affected if we rely on misleading, false, inaccurate, or fraudulent information. We are subject to regulation and supervision by the Federal Reserve, and our Bank is subject to regulation and supervision by the FDIC and the DFPI. Compliance with these laws and regulations can be difficult and costly, and changes to laws and regulations can impose additional compliance costs. The Dodd-Frank Act, which imposed significant regulatory and compliance changes on financial institutions, is an example of this type of federal law. The laws and regulations applicable to us govern a variety of matters, including permissible types, amounts, and terms of loans and investments we may make, the maximum interest rate that may be charged, the amount of reserves we must hold against deposits we take, the types of deposits we may accept and the rates we may pay on such deposits, maintenance of adequate capital and liquidity, changes in control of us and our Bank, transactions between us and our Bank, handling of nonpublic information, restrictions on dividends, and establishment of new offices. We must obtain approval from our regulators before engaging in certain activities, and there is risk that such approvals may not be granted, either in a timely manner or at all. These requirements may constrain our operations, and the adoption of new laws and changes to or repeal of existing laws may have an adverse effect on our business, financial condition, and results of operations. Also, the burden imposed by those federal and state regulations may place banks in general, including our Bank in particular, at a competitive disadvantage compared to their non-bank competitors. Compliance with current and potential regulation, as well as supervisory scrutiny by our regulators, may significantly increase our costs, impede the efficiency of our internal business processes, require us to increase our regulatory capital, and limit our ability to pursue business opportunities in an efficient manner by requiring us to expend significant time, effort, and resources to ensure compliance and respond to any regulatory inquiries or investigations. Our failure to comply with any applicable laws or regulations, interpretations of such laws and regulations, or regulatory policies could result in sanctions by regulatory agencies, civil money penalties, and/or damage to our reputation, all of which could have an adverse effect on our business, financial condition, and results of operations. Additionally, federal and state regulatory agencies may change the manner in which existing regulations are applied. We cannot predict the substance or effect of pending or future legislation or regulation or changes to the application of laws and regulations to us. Future changes may have an adverse effect on our business, financial condition, and results of operations. This could impact our ability to implement our strategy, could affect us in substantial and unpredictable ways, and could have an adverse effect on our business, financial condition, and results of operations. Furthermore, the regulatory agencies have broad discretion in their interpretation of laws and regulations and their assessment of the quality of our loan portfolio, securities portfolio, and other assets. Based on our regulators’ assessment of the quality of our assets, operations, lending practices, investment practices, capital 27structure, or other aspects of our business, we may be required to take additional charges or undertake, or refrain from taking, actions that could have an adverse effect on our business, financial condition, and results of operations. An important function of the Federal Reserve is to regulate the money supply and credit conditions. Among the instruments used by the Federal Reserve to implement these objectives are open market purchases and sales of U.S. government securities, adjustments of the discount rate, and changes in banks’ reserve requirements against bank deposits. These instruments are used in varying combinations to influence overall economic growth and the distribution of credit, bank loans, investments, and deposits. Their use also affects interest rates charged on loans or paid on deposits. The effects of such policies upon our business, financial condition, and results of operations cannot be predicted with certainty. If, as a result of an examination, the Federal Reserve, the FDIC, or the DFPI were to determine that our financial condition, capital resources, asset quality, earnings prospects, management, liquidity, or other aspects of any of our operations had become unsatisfactory, or that we were in violation of any law or regulation, they may take a number of different remedial actions as they deem appropriate. These actions may include requiring us to remediate any such adverse examination findings. Any regulatory enforcement action against us could have an adverse effect on our business, financial condition, and results of operations. The capital rules generally require bank holding companies and banks to maintain a common equity Tier 1 capital to risk-weighted assets ratio of at least 7.00% (a minimum of 4.50% plus a capital conservation buffer of 2.50%), a Tier 1 capital to risk-weighted assets ratio of at least 8.50% (a minimum of 6.00% plus a capital conservation buffer of 2.50%), a total capital to risk-weighted assets ratio of at least 10.50% (a minimum of 8.00% plus a capital conservation buffer of 2.50%), and a Tier 1 leverage ratio of at least 4.00%. An institution’s failure to exceed the capital conservation buffer with common equity Tier 1 capital would result in limitations on an institution’s ability to make capital distributions and discretionary bonus payments. In addition, for an insured depository institution to be “well-capitalized” under the banking agencies’ prompt corrective action framework, it must have a common equity Tier 1 capital ratio of at least 6.50%, a Tier 1 capital ratio of at least 8.00%, a total capital ratio of at least 10.00%, and a Tier 1 leverage ratio of at least 5.00%, and must not be subject to any written agreement, order or capital directive, or prompt corrective action directive issued by its primary federal or state banking regulator to meet and maintain a specific capital level for any capital measure.Historically, as a bank holding company with less than $3.0 billion in total consolidated assets and that met certain other criteria, the Company had been operating under the Federal Reserve’s Small Bank Holding Company Policy Statement, which exempts from the Federal Reserve’s risk-based capital and leverage rules bank holding companies with total consolidated assets of less than $3.0 billion that are not engaged in significant nonbanking activities, do not conduct significant off-balance sheet activities, and do not have a material amount of debt or equity securities registered with the SEC. Because the Company’s total consolidated assets exceeded the $3.0 billion threshold as of September 30, 2022, the 28Company is no longer subject to this policy statement and its capital adequacy is evaluated relative to the Federal Reserve’s generally applicable capital requirements. We may not be able to raise additional capital at all, or on terms acceptable to us. Failure to maintain capital to meet current or future regulatory requirements could have an adverse effect on our business, financial condition, and results of operations. The Federal Trade Commission Act prohibits unfair or deceptive acts or practices, and the Dodd-Frank Act prohibits unfair, deceptive, or abusive acts or practices by financial institutions. The U.S. Department of Justice, federal and state banking agencies, and other federal and state agencies, including the CFPB, are responsible for enforcing these fair and responsible banking laws and regulations. Banks with no more than $10.0 billion in total consolidated assets, including the Bank, are subject to rules promulgated by the CFPB but are examined and supervised by federal banking agencies for compliance with federal consumer protection laws and regulations. The CFPB has proposed rules that would restrict various fees that financial institutions can charge consumers, including credit card late fees and certain insufficient funds (“NSF”) fees. Accordingly, CFPB rulemaking has the potential to have a significant impact on the operations of the Bank. Private parties may also have the ability to challenge an institution’s performance under fair lending laws in private litigation, including through class action litigation. Such actions could have an adverse effect on our business, financial condition, and results of operations. Our principal source of funds to pay distributions on our common stock and service any of our obligations, other than further issuances of securities, is dividends received from the Bank. The holding company, Five Star Bancorp, is a legal entity separate and distinct from the Bank. Furthermore, the Bank is not obligated to pay dividends to us, and any dividends paid to us would depend on the earnings or financial condition of the Bank, various business considerations, and applicable law and regulation. As is generally the case for banking institutions, the profitability of the Bank is subject to the fluctuating cost and availability of money, changes in interest rates, and economic conditions in general. In addition, various federal and state statutes and regulations limit the amount of dividends that the Bank may pay to the Company without regulatory approval. Under the “source of strength” doctrine that was codified by the Dodd-Frank Act, the Federal Reserve may require a bank holding company to make capital injections into a subsidiary bank, including at times when the bank holding company may not be inclined to do so, and may charge the bank holding company with engaging in unsafe and unsound practices for failure to commit resources to such a subsidiary bank. Accordingly, we could be required to provide financial assistance to the Bank if it experiences financial distress. Any loan by a bank holding company to its subsidiary bank is subordinate in right of payment to deposits and certain other indebtedness of such subsidiary bank. In the event of a bank holding company’s bankruptcy, the bankruptcy trustee will assume any commitment by the holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank. Moreover, bankruptcy law provides that claims based on any such commitment will be entitled to a priority of payment over the claims of the holding company’s general unsecured creditors, including the holders of any note obligations. Thus, any borrowing by a bank holding company for the 29purpose of making a capital injection to a subsidiary bank may become more difficult and expensive relative to other corporate borrowings. We are required to comply with these and other anti-money laundering requirements. Our federal and state banking regulators, the Treasury Department’s Financial Crimes Enforcement Network, and other government agencies are authorized to impose significant civil money penalties for violations of anti-money laundering requirements. We are also subject to increased scrutiny of compliance with the regulations issued and enforced by the Treasury Department’s OFAC, which is responsible for helping to ensure that U.S. entities do not engage in transactions with certain prohibited parties, as defined by various Executive Orders and Acts of Congress. If our program is deemed deficient, we could be subject to liability, including fines, civil money penalties, and other regulatory actions, which may include restrictions on our business operations and our ability to pay dividends, restrictions on mergers and acquisitions activity, restrictions on expansion, and restrictions on entering new business lines. Failure to maintain and implement adequate programs to combat money laundering and terrorist financing could also have significant reputational consequences for us. Any of these circumstances could have an adverse effect on our business, financial condition, and results of operations. You may not be able to resell your shares at or above the price you paid and may lose part or all of your investment as a result.Our stock price has fluctuated from a low of $18.21 to a high of $31.92 between our initial public offering and December 31, 2023. In addition, the stock market in general has experienced extreme volatility that has often been unrelated to the operating performance of particular companies. In the past, following periods of volatility in the market price of a company's securities, shareholders have often instituted securities class action litigation. For as long as we continue to be an emerging growth company, we may take advantage of certain exemptions from various requirements generally applicable to public companies. These exemptions allow us, among other things, to present only two years of audited financial statements and discuss our results of operations for only two years in related Management’s Discussions and Analyses; not to provide an auditor attestation of our internal control over financial reporting; to take advantage of an extended transition period to comply with the new or revised accounting standards applicable to public companies; to provide reduced disclosure regarding our executive compensation arrangements pursuant to the rules applicable to smaller reporting companies, which means we do not have to include a compensation discussion and analysis and certain other disclosure regarding our executive compensation; and not to seek a non-binding advisory vote on executive compensation or golden parachute arrangements. We would cease to be an emerging growth company upon the earliest of: (i) the first fiscal year following the fifth anniversary of our IPO; (ii) the first fiscal year after our annual gross revenues are $1.235 billion or more; (iii) the date on which we have, during the previous three-year period, issued more than $1.0 billion in non-convertible debt securities; or (iv) the date on which we are deemed to be a large accelerated filer under the rules of the SEC. If some investors find our common stock less attractive as a result, there may be a less active trading market for our common stock, and our stock price may be more volatile or decline.47% of our issued and outstanding shares of common stock. Consequently, our directors, executive officers, and principal shareholders are able to significantly affect our affairs and policies, including the outcome of the election of directors and the potential outcome of other matters submitted to a vote of our shareholders, such as mergers, the sale of substantially all of our assets, and other extraordinary corporate matters. This influence may also have the effect of delaying or preventing changes of control or changes in management or limiting the ability of our 31other shareholders to approve transactions that they may deem to be in the best interests of our Company. The interests of these insiders could conflict with the interests of our other shareholders, including you.If securities or industry analysts do not publish research or publish inaccurate or unfavorable research about our business, or change their recommendations regarding our common stock, or if our operating results do not meet their expectations, the market price of our common stock and trading volume could decline. If one or more of the analysts who covers us downgrades our stock or publishes inaccurate or unfavorable research about our business, or our operating results do not meet their expectations, either absolutely or relative to our competitors, the market price of our common stock would likely decline. Our board of directors may, in its sole discretion, change the amount or frequency of dividends or discontinue the payment of dividends entirely. In addition, we are a bank holding company, and our ability to declare and pay dividends is dependent on federal regulatory considerations, including the guidelines of the Federal Reserve regarding capital adequacy and dividends. It is the policy of the Federal Reserve that bank holding companies should generally pay dividends on common stock only out of earnings, and only if prospective earnings retention is consistent with the organization’s expected future needs, asset quality, and financial condition, and that bank holding companies should inform and consult with the Federal Reserve in advance of declaring and paying a dividend that exceeds earnings for the period for which the dividend is being paid.7 million of subordinated notes, net of debt issuance costs, outstanding, and we did not have any outstanding preferred stock or trust preferred securities. Since any decision to issue debt securities or incur other borrowings in the future will depend on market conditions and other factors beyond our control, the amount, timing, nature, or success of our future capital raising efforts is uncertain. Thus, holders of our common stock bear the risk that our future issuances of debt securities or our incurrence of other borrowings will negatively affect the market price of our common stock. Accordingly, 32prospective investors must comply with these requirements, if applicable, in connection with any purchase of shares of our common stock. Collectively, provisions of our articles of incorporation and bylaws and other statutory and regulatory provisions may delay, prevent, or deter a merger, acquisition, tender offer, proxy contest, or other transaction that might otherwise result in our shareholders receiving a premium over the market price for their common stock. Moreover, the combination of these provisions effectively inhibits certain business combinations, which, in turn, could adversely affect the market price of our common stock. Our bylaws will further provide that, unless we consent in writing to the selection of an alternative forum, the federal district courts of the United States of America will, to the fullest extent permitted by applicable law, be the exclusive forum for the resolution of any complaint asserting a cause of action arising under the federal securities laws, including the applicable rules and regulations promulgated thereunder. Any person purchasing or otherwise acquiring any interest in any shares of our capital stock will be deemed to have notice of and to have consented to this provision of our bylaws. The exclusive forum provision may limit a shareholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or our directors, officers, or other employees, which may discourage such lawsuits. Alternatively, if a court were to find the exclusive forum provision to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving such action in other jurisdictions, which could have an adverse effect on our business, financial condition, results of operations, and growth prospects. We are subject to the reporting requirements of the Exchange Act, the Sarbanes-Oxley Act, and applicable securities rules and regulations. These laws and regulations increase the scope, complexity, and cost of corporate governance, reporting, and disclosure practices over those of non-public or non-reporting companies. Despite our conducting business in a highly regulated environment, these laws and regulations have different requirements for compliance than we experienced prior to becoming a public company. Among other things, the Exchange Act requires that we file annual, quarterly, and current reports with respect to our business and operating results and maintain effective disclosure controls and procedures and internal control over financial reporting. As a Nasdaq-listed company, we are required to prepare and file proxy materials which meet the requirements of the Exchange Act and the SEC’s proxy rules. Compliance with these rules and regulations has increased, and will continue to increase, our legal and financial compliance costs, will make some activities more difficult, time-consuming, or costly, and will increase demand on our systems and resources, particularly after we are no longer an “emerging growth company” as defined in the JOBS Act. In order to maintain, appropriately document and, if required, improve our disclosure controls and procedures and internal control over financial reporting to meet the standards required by the Sarbanes-Oxley Act, significant resources and management oversight may be required. As a result, management’s attention may be diverted from other business concerns, which could harm our business and operating results. Additionally, any failure by us to file our periodic reports with the SEC in a timely manner could harm our reputation and cause our investors and potential investors to lose confidence in us, and restrict trading in, and reduce the market price of, our common stock, and potentially impact our ability to access the capital markets. Effective internal control over financial reporting is necessary for us to provide reliable reports and prevent fraud. We may not be able to identify all significant deficiencies and/or material weaknesses in our internal control over financial reporting in the 33future, and our failure to maintain effective internal control over financial reporting in accordance with Section 404 of the Sarbanes-Oxley Act could have an adverse effect on our business, financial condition, and results of operations. A material weakness is defined by the standards issued by the PCAOB as a deficiency, or combination of deficiencies, in internal control over financial reporting that results in a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. As a consequence, we would have to disclose in periodic reports we file with the SEC any material weakness in our internal control over financial reporting. The existence of a material weakness would preclude management from concluding that our internal control over financial reporting is effective and, when we cease to be an emerging growth company under the JOBS Act, preclude our independent registered public accounting firm from rendering their report addressing an assessment of the effectiveness of our internal control over financial reporting. In addition, disclosures of deficiencies of this type in our SEC reports could cause investors to lose confidence in our financial reporting, may negatively affect the market price of our common stock, and could result in the delisting of our securities from the securities exchanges on which they trade. Moreover, effective internal controls are necessary to produce reliable financial reports and to prevent fraud. If we have deficiencies in our disclosure controls and procedures or internal control over financial reporting, such deficiencies may adversely affect us.General Risk FactorsOur success is largely dependent upon our management team and key employees and ability to successfully execute our business strategy. Our management team and other key employees, including those who conduct our loan origination and other business development activities, have significant industry experience. We cannot ensure that we will be able to retain the services of any members of our management team or other key employees. Though we have employment agreements in place with certain members of our management team, they may still elect to leave at any time. The loss of any of our management team or our key employees could adversely affect our ability to execute our business strategy, and we may not be able to find adequate replacements on a timely basis, or at all. Qualified individuals are in high demand, and we may incur significant costs to attract and retain them. Because the market for qualified individuals is highly competitive, we may not be able to attract and retain qualified officers or candidates. Failure to attract and retain a qualified management team and qualified key employees could have an adverse effect on our business, financial condition, and results of operations. A downturn in economic conditions in our market, particularly in the real estate market, heightened competition from other financial services providers, an inability to retain or grow our core deposit base, regulatory and legislative considerations, and failure to attract and retain high-performing talent, among other factors, could limit our ability to grow assets or increase profitability as rapidly as we have in the past. Sustainable growth requires that we manage our risks by following prudent loan underwriting standards, balancing loan and deposit growth without materially increasing interest rate risk or compressing our net interest margin, maintaining more than adequate capital at all times, managing a growing number of customer relationships, scaling technology platforms, hiring and retaining qualified employees, and successfully implementing our strategic initiatives. We must also successfully implement improvements to, or integrate, our management information and control systems, procedures, and processes in an efficient and timely manner and identify deficiencies in existing systems and controls. In particular, our controls and procedures must be able to accommodate an increase in loan volume in various markets and the infrastructure that comes with expanding operations, including new branches. Our growth strategy may require us to incur additional expenditures to expand our administrative and operational infrastructure. If we are unable to effectively manage and grow our banking franchise, we may experience compliance and operational problems, have to slow the pace of growth, or have to incur additional expenditures beyond current projections to support such growth. We may not have, or may not be able to develop, the knowledge or relationships necessary to be successful in new markets. Our failure to sustain our historical rate of growth, adequately manage the factors that have 34contributed to our growth, or successfully enter new markets could have an adverse effect on our earnings and profitability and, therefore, on our business, financial condition, and results of operations.If we implement new lines of business, products, or services, we may invest significant time and resources in doing so, and such new lines of business, products, or services may not be successful. There are substantial risks and uncertainties associated with these efforts. In developing, implementing, or marketing new lines of business, products, product enhancements, or services, we may invest significant time and resources. We may underestimate the appropriate level of resources or expertise necessary to make new lines of business or products successful or to realize their expected benefits. We may not achieve the milestones set in initial timetables for the development and introduction of new lines of business, products, product enhancements, or services, and price and profitability targets may not prove feasible. External factors, such as new or changing regulations, competitive alternatives, and shifting market preferences, may also impact the ultimate implementation of a new line of business or offerings of new products, product enhancements, or services. Any new line of business, product, product enhancement, or service could have a significant impact on the effectiveness of our system of internal controls. We may also decide to discontinue businesses or products due to lack of customer acceptance or unprofitability. Failure to successfully manage these risks in the development and implementation of new lines of business or offerings of new products, product enhancements, or services could have an adverse effect on our business, financial condition, and results of operations. Our inability to overcome these risks could have an adverse effect on our ability to implement our business strategy and enhance shareholder value, which, in turn, could have an adverse effect on our business, financial condition, and results of operations. Additionally, if we record goodwill in connection with any acquisition, our business, financial condition, and results of operations may be adversely affected if that goodwill is determined to be impaired, which would require us to take an impairment charge. Maintaining a positive reputation is critical to attracting and retaining customers and employees. Adverse perceptions of us could make it more difficult for us to execute on our strategy. Harm to our reputation can arise from many sources, including actual or perceived employee misconduct, errors or misconduct by our third-party vendors or other counterparties, litigation or regulatory actions, our failure to meet our high customer service and quality standards, and compliance failures. Because the nature of the financial services business involves a high volume of transactions, certain errors may be repeated or compounded before they are discovered and successfully rectified. Our necessary dependence upon processing systems to record and process transactions and our large transaction volume may further increase the risk that employee errors, tampering, or manipulation of those systems will result in losses that are difficult to detect. Employee error or misconduct could also subject us to financial claims. If our internal control systems fail to prevent or detect an occurrence, or if any resulting loss is not insured, exceeds applicable insurance limits, or if insurance coverage is denied or not available, it could have an adverse effect on our business, financial condition, and results of operations. Such activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering, and other dishonest acts. Although we devote substantial resources to maintaining effective policies and internal controls to identify and prevent such incidents, given the increasing sophistication of possible perpetrators, we may experience financial losses or reputational harm as a result of fraud. Our business depends on the successful and uninterrupted functioning of our information technology and telecommunications systems, many of which also depend on third-party providers. The failure of these systems, a cybersecurity breach involving any of our third-party service providers, or the termination or change in terms of a third-party software license or service agreement on which any of these systems is based could interrupt our operations. Because our information technology and telecommunications systems interface with and depend on third-party systems, we could experience service denials if demand for such services exceeds capacity, or such third-party systems fail or experience interruptions. Replacing vendors or addressing other issues with our third-party service providers could entail significant delay, expense, and disruption of service. If an interruption were to continue for a significant period of time, our business, financial condition, and results of operations could be adversely affected. Even if we are able to replace third-party service providers, it may be at a higher cost to us, which could adversely affect our business, financial condition, and results of operations. These regulatory expectations may change, and potentially become more rigorous in certain ways, due to an interagency effort to replace existing guidance on the risk management of third-party relationships with new guidance. Our regulators may hold us responsible for any deficiencies in our oversight or control of our third-party service providers and in the performance of the parties with which we have these relationships. As a result, if our regulators assess that we have not exercised adequate oversight and control over our third-party service providers or that such providers have not performed adequately, we could be subject to administrative penalties, fines, or other forms of regulatory enforcement action as well as requirements for consumer remediation, any of which could have an adverse effect on our business, financial condition, and results of operations. We also maintain important internal company data such as PII about our employees and information relating to our operations. We are subject to complex and evolving laws and regulations governing the privacy and protection of PII of individuals (including customers, employees, and other third parties). For example, our business is subject to the GLB Act, which, among other things: (i) imposes certain limitations on our ability to share nonpublic PII about our customers with nonaffiliated third parties; (ii) requires that we provide certain disclosures to customers about our information collection, sharing, and security practices and afford customers the right to “opt out” of any information sharing by us with nonaffiliated third parties (with certain exceptions); and (iii) requires that we develop, implement, and maintain a written comprehensive information security program containing appropriate safeguards based on our size and complexity, the nature and scope of our activities, and the sensitivity of customer information we process, as well as plans for responding to data security breaches. Various federal and state banking regulators and states have also enacted data breach notification requirements with varying levels of individual, consumer, regulatory, or law enforcement notification in the event of a security breach. The California Consumer Privacy Act grants California residents the rights to know about personal information collected about them, to delete certain of this personal information, to opt out of the sale of personal information, and to non-discrimination for exercising these rights. Furthermore, we may not be able to ensure that customers and other third parties have appropriate controls in place to protect the confidentiality of the information that they exchange with us, particularly where such information is transmitted by electronic means. If personal, confidential, or proprietary information of customers or others were to be mishandled or misused (in situations where, for example, such information was erroneously provided to parties who are not permitted to have the information, or where such information was intercepted or otherwise compromised by third parties), we could be exposed to litigation or regulatory sanctions under privacy and data protection laws and regulations. Concerns regarding the effectiveness of our measures to safeguard PII, or even the perception that such measures are inadequate, could cause us to lose customers or potential customers and thereby reduce our revenues. Accordingly, any failure or perceived failure to comply with applicable privacy or data protection laws and regulations may subject us to inquiries, examinations, and investigations that could result in requirements to modify or cease certain operations or practices or in significant liabilities, fines, or penalties, and could damage our reputation and otherwise adversely affect our business, financial condition, and results of operations.Failures in, or breaches of, our computer systems and network infrastructure, or those of our third-party vendors or other service providers, including as a result of cyber-attacks, cybersecurity breaches, and other disruptions, could disrupt our business, result in the disclosure or misuse of confidential or proprietary information, result in supervisory liability or regulatory enforcement action, damage our reputation, result in a loss of customers and business, result in a loss of confidence in the security of our systems, products, and services, increase our costs, and cause losses. Our operations are dependent upon our ability to protect our computer equipment against damage from fire, power loss, telecommunications failure, or a similar catastrophic event. Any damage or failure that causes an interruption in our operations could have an adverse effect on our business, financial condition, and results of operations. In addition, our operations are dependent upon our ability to protect our computer systems and network infrastructure, including our internet banking activities, against damage from physical break-ins, cybersecurity breaches, and other disruptive problems caused by the internet or other users. Our security measures, including firewalls and penetration testing, as well as oversight by our board of directors and Audit Committee as well as management's assessment, identification, and management of cybersecurity risks, may not prevent or detect future potential losses from system failures or cybersecurity breaches, attacks, or other disruptions. While we seek to continuously monitor for and react to any and all such malicious cyber activity and develop our systems to protect our technology infrastructure and data, such monitoring and systems development may not be effective in preventing misuse, misappropriation, or corruption. In the ordinary course of business, our board of directors receives quarterly cybersecurity risk management updates and members of the Audit Committee of our board of directors also attend the meetings of our information technology steering committee on a quarterly basis. Cybersecurity risk 37management is incorporated into our overall enterprise risk management model, which is updated on a quarterly basis and subject to oversight by our board of directors. We and our third-party service providers have experienced these types of events in the past and expect to continue to experience them in the future. Although the impact to date from these events has not had an adverse effect on us, we cannot be sure this will be the case in the future. Any of these occurrences could have an adverse effect on our business, financial condition, and results of operations. Despite our implementation of protective measures and endeavoring to modify them as circumstances warrant, our computer systems, software, and networks may be vulnerable to human error, equipment failure, natural disasters, power loss, unauthorized access, supply chain attacks, distributed denial of service attacks, computer viruses and other malicious code, and other events that could result in significant liability and damage to our reputation, and have an ongoing impact on the security and stability of our operations. In addition, although we maintain insurance coverage that may, subject to terms and conditions, cover certain aspects of cyber and information security risks, such insurance coverage may be insufficient to cover all losses, such as litigation costs or financial losses that exceed our policy limits or are not covered under any of our current insurance policies. Additionally, like many large enterprises, we have introduced more remote work arrangements for our employees. The increase in remote work arrangements over the past few years has introduced potential new vulnerabilities to cyber threats. We also face increased cybersecurity risk as we deploy additional technologies and digital solutions, including our website and digital banking platform with complementary treasury management solutions. Moreover, any cyber-attack or other security breach may persist for an extended period of time without detection. We endeavor to design and implement policies and procedures to identify such cyber-attacks or breaches as quickly as possible; however, we expect that any investigation of a cyber-attack or breach would take substantial amounts of time, and that there may be extensive delays before we obtain full and reliable information. During such time we would not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, all of which would further increase the costs and consequences of such an attack or breach. We are not able to anticipate or implement effective preventive measures against all security breaches of these types, especially because the techniques used change frequently and because attacks can originate from a wide variety of sources. Our early detection and response mechanisms may be thwarted by sophisticated attacks and malware designed to avoid detection.Banking organizations are required to notify their primary federal regulator of significant computer security incidents within 36 hours of determining that such an incident has occurred.The SEC recently enacted rules, effective as of December 18, 2023, requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. If we fail to comply with these new requirements we could incur regulatory fines in addition to other adverse consequences to our reputation, business, financial condition, and results of operations.38We may also be subject to liability under various data protection laws. In the normal course of business, we collect, process, and retain sensitive and confidential information regarding our customers and employees, including personal data. As a result, we are subject to numerous laws and regulations designed to protect this information, such as U.S. federal, state, and international laws governing the protection of personally identifiable information. These laws and regulations are increasing in complexity and number. If any person, including any of our employees, negligently disregards or intentionally breaches our established controls with respect to client or employee data, or otherwise mismanages or misappropriates such data, we could be subject to significant monetary damages, regulatory enforcement actions, fines and/or criminal prosecution. In addition, unauthorized disclosure of sensitive or confidential client or employee data, whether through system failure, employee negligence, fraud, or misappropriation, could damage our reputation and cause us to lose clients and related revenue. Potential liability in the event of a security breach of client data could be significant. Depending on the circumstances giving rise to the breach, this liability may not be subject to a contractual limit or an exclusion of consequential or indirect damages. California has had and will continue to have major earthquakes in areas where a significant portion of the collateral and assets of our borrowers are concentrated. California is also prone to wildfires, droughts, mudslides, floods, and other natural disasters. Additionally, acts of terrorism, war, civil unrest, violence, other man-made disasters, or the effects of climate change could also cause disruptions to our business or to the economy as a whole. Natural or man-made disasters or the effects of climate change could also disrupt our business operations more generally. We have implemented a business continuity program that allows us to move critical functions to a backup data center in the event of a catastrophe. Although this program has been tested, we cannot guarantee its effectiveness in any disaster scenarios. Regardless of the effectiveness of our disaster recovery and business continuity plan, the occurrence of any natural or man-made disaster or the effects of climate change could have an adverse effect on our business, financial condition, and results of operations. Climate change also could present financial risks to us as a result of transition risks, such as societal and/or technological responses to climate change, which could include changes in climate policy or in the regulation of financial institutions with respect to risks posed by climate change. Legal actions could include claims for substantial compensatory or punitive damages or claims for indeterminate amounts of damages. Further, in the future our regulators may impose consent orders, civil money penalties, matters requiring attention, or similar types of supervisory criticism. We may also, from time to time, be the subject of subpoenas, requests for information, reviews, investigations, and proceedings (both formal and informal) by governmental agencies regarding our current and/or prior business activities. Any such legal or regulatory actions may subject us to substantial compensatory or punitive damages, significant fines, penalties, obligations to change our business practices, or other requirements resulting in increased expenses, diminished income, and damage to our reputation. Our involvement in any such matters, whether tangential or otherwise and even if the matters are ultimately determined in our favor, could also cause significant harm to our reputation and divert management attention from the operation of our business. Further, any settlement, consent order, or adverse judgment in connection with any formal or informal proceeding or investigation by government agencies may result in litigation, investigations, or proceedings as other litigants and government agencies begin independent reviews of the same activities. As a result, the outcome of legal and regulatory actions could have an adverse effect on our business, financial condition, and results of operations. Periodic changes to such rules may change the treatment and recognition of critical financial line items. From time to time, the governing bodies that oversee changes to accounting rules and reporting requirements may release new guidance for the preparation of our consolidated financial statements. These changes can materially impact how we record and report our financial condition and results of operations. In some instances, we could be required to apply a new or revised standard retroactively, resulting in the restatement of prior period financial statements. These changes could adversely affect our capital, regulatory capital ratios, ability to make larger loans, earnings, and performance metrics. Any such changes could have an adverse effect on our business, financial condition, and results of operations.

Our critical accounting policies, which are included in the section entitled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in this Annual Report on Form 10-K, describe those significant accounting policies and methods used in the preparation of our consolidated financial statements that we consider “critical” because they require judgments, assumptions, and estimates that materially affect our consolidated financial statements and related disclosures. As a result, if future events or regulatory views concerning such analysis differ significantly from the judgments, assumptions, and estimates in our critical accounting policies, those events or assumptions could have a material impact on our consolidated financial statements and related disclosures, in each case resulting in our possible need to revise or, if in error, restate prior period financial statements, cause damage to our reputation and the price of our common stock, and adversely affect our business, financial condition, and results of operations. CybersecurityWe recognize the crucial importance of identifying, assessing, and managing material risks from cybersecurity threats. We are committed to implementing and maintaining a comprehensive information security program to manage such risks and safeguard our systems and data, including the data of our customers.Information Security Policies and ProceduresWe manage our cybersecurity risk in accordance with our Information Security Program (the “Information Security Program”), which is applicable to all users of our information technology assets, information assets, and facilities, including our employees, contractors, vendors, volunteers, and agents. The Information Security Program includes an Information Security Incident Response Policy (the “Incident Response Policy”), which sets forth the rules and requirements for identifying, investigating, validating, prioritizing, and responding to information security incidents, and addresses the response portion of security monitoring. The Information Security Program also includes: (i) an Information Security Incident Response Procedure (the “Incident Response Procedure”), which delineates the processes for reporting, classifying, investigating, planning, containing, eradicating, recovering, documenting, and communicating information security incidents, as well as post-incident activities, and (ii) a Security Monitoring Policy, which establishes the rules and requirements for enabling, logging, alerting, and monitoring real time security alerts and security logs (automated or manual), as well as various condition monitoring tests and reviews, and documentation requirements in connection with security incident identification.Potential information security incidents are identified in a number of ways, including, but not limited to: users reporting security violations, system weaknesses, violations of our Information Security Acceptable Use Policy, which addresses the boundaries of acceptable use of our information technology assets, automated system alerts, and monitoring of both system generated and manually generated logs. Our Information Security Program mandates that any potential information security incident response begin at the initial internal communication and investigation stage, during which such events undergo initial investigation for validation, including related to the scope and depth of such incident and to ensure that it 40has not resulted from a false positive. Internal communications regarding the potential incident occur with the relevant security coordinator according to our Incident Response Procedures.Following this initial stage, we gather and update impact information and related documentation for such incident. We use an incident classification matrix to determine the initial classification of a potential information security incident, which considers users, customers, and systems affected, the sensitivity of data at risk, and the potential business impacts to the Company including financial, legal, regulatory, operational, and reputation. The resulting classification of “Red,” “Yellow,” or “Green” identifies next steps for escalation and communication following initial investigation of the potential incident. Upon escalation of an incident, a member of management who is identified as an Incident Response Contact per our Information Security Program reviews and validates the initial determination of the priority of the incident prior to entering into the subsequent stage, during which a response to the incident is determined and notifications or communications are made to either additional personnel or any external entities. Depending on the specific details of any such incident, we may notify additional members of our management team, our board of directors, the Audit Committee, state and federal regulators, technology service providers, and/or the SEC. The timing of such communications varies based on the details of a particular incident and applicable regulations governing such disclosure. Following this classification and communication stage, we enter the recovery stage to determine containment and a response to the incident, assign technical staff to address such incident, implement containment, eradicate the incident source, and recover from such incident. Following any such incident, we engage in follow-up to communicate with law enforcement and notify impacted third parties and customers, as appropriate, in addition to further investigating the cause of the incident, documenting takeaways, and engaging in remediation.Our Chief Information Security Officer (“CISO”) coordinates with other members of our executive management team identified in our Information Security Program to document, validate, respond, and manage actual or potential security incidents according to their threat classifications as described above, and report to our board of directors and/or the Audit Committee on an ad hoc basis. The CISO also provides quarterly reports on the status of our Information Security Program and its compliance with regulatory requirements to our board of directors in connection with our board's general risk management oversight role, as described in further detail below. The CISO and the Chief Information Officer (“CIO”) have shared responsibility for overseeing day-to-day operations of the Information Security Program, coordinating or contributing to reviews, audits, risk assessments, and other risk management material, development of departmental policies and procedures for board approval, and periodic updates to our information technology steering committee and/or the full board of directors. The CIO reports to President and Chief Executive Officer, while the CISO reports to the Chief Regulatory Officer and reports regularly to the Audit Committee.The CIO has 20 years of industry experience including management of technology, security, data analytics, and vendor relationships. The CISO has over 10 years of industry experience including management of security and vendor relationships as well as possesses several industry certifications, including certification as a Certified Information Systems Security Professional from the International Information System Security Certification Consortium and as a Certified Information Security Manager from the Information Systems Audit and Control Association.With the approval of Audit Committee, we also engage third party assessors, consultants, and auditors in connection with the Company’s Information Security Program and in accordance with our Audit Program, including to conduct external and internal penetration testing, independent audits, and risk assessments. We may also utilize third party service providers in the ordinary course of business, including to assist us in performing information security assessments for third party service providers that store or process our confidential data. These information security assessments, whether performed by a third party or internally, include a review of any systems and organization control reports, and proof of the vendor’s independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes, and third party data protection controls (which can include, but are not limited to: access reviews and controls, backups, monitoring, encryption standards, and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor.In addition, we use a combination of technology, policies, procedures, training, and monitoring to promote security awareness and prevent security incidents.Cybersecurity Risk OversightOur executive management team is responsible for the development of our policies and procedures and for managing any exception to the same. In particular, our CISO oversees information security compliance, as described above. The board of directors of the Company has ultimate oversight of cybersecurity-related risk and activities, including the review and 41approval of our policies and procedures related to cybersecurity. The Information Security Program is approved on an annual basis. Cybersecurity risk management is also incorporated into our overall enterprise risk management model, which is updated on a quarterly basis and subject to oversight by our board of directors.In the ordinary course of business, our board of directors receives quarterly updates from the CISO regarding the Information Security Program and compliance with relevant regulations, as described above. Members of the Audit Committee of our board of directors also attend the meetings of our information technology steering committee on a quarterly basis. Our information technology steering committee consists of members of our board of directors who have relevant experience from their audit and management experience as well as training provided by our management. If an incident occurs, depending on its priority as identified through the procedures described above, management may inform our board of directors and/or Audit Committee sooner than its next quarterly update. See the section entitled “Part I, Item 1. Business—Risk Management” for additional information on the role of our board of directors and its committees in overseeing risk management.Relevant RegulationsAs a regulated financial institution, the Bank is also subject to financial privacy laws, and our cybersecurity practices are subject to oversight by the federal banking agencies. In addition, the SEC recently enacted rules, effective as of December 18, 2023, requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. For additional information, see the section entitled “Part I, Item 1. Business—Supervision and Regulation—Supervision and Regulation of the Bank—Cybersecurity.

”Prior IncidentsAlthough we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected our business strategy, results of operations, or financial condition, there can be no guarantee that we will not experience such an incident in the future. For additional information regarding the risk we face from cybersecurity threats, see the risk factor entitled “System failure or cybersecurity breaches of our network security could subject us to increased operating costs as well as litigation, damage to our reputation, and other potential losses.” included in Part I, Item 1A.

Risk Factors in this Annual Report on Form 10-K..

Recently Filed

Click on a ticker to see risk factors

Ticker *	File Date
NKE	1 day, 5 hours ago
OPTT	1 day, 5 hours ago
ANGO	1 day, 5 hours ago
CTAS	1 day, 7 hours ago
RPM	1 day, 7 hours ago
CNXA	2 days, 2 hours ago
LW	2 days, 8 hours ago
HUDA	3 days, 4 hours ago
AXR	3 days, 5 hours ago
CALM	3 days, 5 hours ago
BUKS	3 days, 5 hours ago
NRAC	4 days, 1 hour ago
RGP	4 days, 5 hours ago
SING	1 week ago
CSBR	1 week ago
DRI	1 week ago
SCHL	1 week ago
GNLN	1 week, 1 day ago
AIR	1 week, 1 day ago
ABTI	1 week, 2 days ago
SHMP	1 week, 2 days ago
BXXY	1 week, 2 days ago
ACRG	1 week, 3 days ago
CARV	1 week, 3 days ago
FOMC	1 week, 3 days ago
KRFG	1 week, 3 days ago
GHMP	1 week, 3 days ago
GWTI	1 week, 3 days ago
VEII	1 week, 3 days ago
ZEST	1 week, 4 days ago
KITL	1 week, 4 days ago
ADMT	1 week, 4 days ago
ATAK	1 week, 4 days ago
BOTY	1 week, 4 days ago
DPLS	1 week, 4 days ago
FDX	1 week, 4 days ago
ECIA	1 week, 4 days ago
ATXG	1 week, 4 days ago
CRMT	1 week, 4 days ago
ELRE	1 week, 4 days ago
CAG	2 weeks, 1 day ago
KALV	2 weeks, 1 day ago
PAYX	2 weeks, 1 day ago
MEI	2 weeks, 1 day ago
BCRD	2 weeks, 1 day ago
FMHS	2 weeks, 2 days ago
ASPA	2 weeks, 2 days ago
STEK	2 weeks, 2 days ago
LEAI	2 weeks, 4 days ago
AIDG	3 weeks ago

OTHER DATASETS

House Trading

Dashboard

Corporate Flights

Dashboard

App Ratings

Dashboard

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - FSBC

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

$FSBC Risk Factor changes from 00/02/25/22/2022 to 00/02/23/24/2024

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - FSBC

-New additions in green-Changes in blue-Hover to see similar sentence in last filing

$FSBC Risk Factor changes from 00/02/25/22/2022 to 00/02/23/24/2024

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing