Risk Factors Dashboard

Once a year, publicly traded companies issue a comprehensive report of their business, called a 10-K. A component mandated in the 10-K is the ‘Risk Factors’ section, where companies disclose any major potential risks that they may face. This dashboard highlights all major changes and additions in new 10K reports, allowing investors to quickly identify new potential risks and opportunities.

Risk Factors - NBBK

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

ITEM 1A. Risk Factors

In addition to factors discussed in the description of our business and elsewhere in this Annual Report on form 10-K, the following are factors that could adversely affect our future results of operations and financial condition.

42

We are subject to a number of risks potentially affecting our business, financial condition, results of operations and cash flows. As a company offering banking and other financial services, certain elements of risk are inherent in our transactions and operations and are present in the business decisions we make. We, therefore, encounter risk as part of the normal course of our business, and we design risk management processes to help manage these risks. Our success is dependent on our ability to identify, understand and manage the risks presented by our business activities so that we can appropriately balance revenue generation and profitability. These risks include, but are not limited to, credit risk, capital risk, market risks, liquidity risks, cyber risk, interest rate risks, operational risks, model risks, technology, compliance, regulatory and legal risks, and strategic and reputational risks. We discuss our principal risk management processes and, in appropriate places, related historical performance in the “Management’s Discussion and Analysis of Financial Condition and Results of Operations” section included in Part II, Item 7 in this Annual Report on Form 10-K.

You should carefully consider the following risk factors, as well as the other information set forth in this Annual Report on Form 10-K, in evaluating whether to make or retain an investment in our common stock. If any of the following risks actually occur, our business, financial condition or results of operations would likely be materially adversely affected. In such case, the trading price of our common stock would likely decline due to any of these risks, and you may lose all or part of your investment. The following risks are not the only risks we face. Additional risks that are not presently known or that we presently deem to be immaterial also could have a material adverse effect on our future business, financial condition, results of operations and cash flows.

Summary of Material Risk Factors

This section summarizes some of the material risks potentially affecting our business, financial condition, results of operations and cash flows. These material risks and others risks are discussed in more detail further below in this section. You should consider this summary together with the more detailed information provided below.

There are various risks associated with our acquisition growth strategy, any of which could have a material adverse effect on our business.

We may be unsuccessful in realizing the expected benefits of the Provident Acquisition or other acquired businesses, including failure to retain key employees or customers, incurrence of unexpected difficulty or expense in integrating operations, technologies or customers, assumption of significant (and potentially unknown) liabilities, and inexperience with the products and/or geographies offered by the acquired business, all of which could divert our management’s attention and/or negatively impact our financial results.

When we acquire a business, a portion of the purchase price of the acquisition may be allocated to goodwill and other identifiable intangible assets. The excess of the purchase price over the fair value of the net identifiable tangible and intangible assets acquired determines the amount of the purchase price that is allocated to goodwill. Under current accounting guidance, if we determine that goodwill or intangible assets are impaired, we would be required to write down the value of these assets.

We operate in a competitive market and may be unable to successfully identify additional acquisition opportunities or compete for attractive acquisition targets.

Risks associated with changes in interest rates, loan losses, cybersecurity and regulatory compliance, are inherent in our business and our industry generally.

Changes in interest rates have had and, in the future, may have a material effect on many areas of our business, including net interest income, the earnings and volume of interest-earning assets and interest-bearing liabilities, and loan delinquency.

If our ACL on loans is insufficient to cover actual loan losses, our earnings and capital could decrease.

43

The geographic concentration of our loan portfolio and lending activities in eastern Massachusetts and southern New Hampshire makes us vulnerable to a downturn in our local economy.

We face security risks related to our information databases, including information we maintain relating to our customers, as precautions taken by us and our vendors may not be completely effective to prevent unauthorized access, human error, phishing attacks or other events that could impact the security, reliability, confidentiality, integrity and availability of our systems or those of our vendors.

We operate in a highly competitive industry, and technological advances have lowered barriers to entry and made it possible for non-banks to offer products and services, such as loans and payment services, that traditionally were banking products.

We may be unable to successfully execute on our strategic plan or performance targets, including through a failure to attract or retain the necessary highly skilled and qualified personnel.

Commercial loans, including those secured by commercial real estate, are generally considered riskier than other types of loans and constitute a significant portion of our loan portfolio.

Operational risk and losses can result from factors such as internal and external fraud; errors by employees or third parties; failure to document transactions properly or to obtain proper authorization; failure to comply with applicable regulatory requirements and conduct of business rules; business continuity and data security system failures, including those encountered while implementing major new computer systems or upgrades to existing systems; or the inadequacy or failure of systems and controls, including those of our suppliers or counterparties.

We may be adversely affected by weaknesses in financial institutions, the financial markets and economic conditions in the United States, market changes, or changes in equity markets.

We are subject to capital and liquidity standards that may change from time to time, and we may be unable to raise additional capital if needed on terms that are acceptable to us, or at all.

Our business is subject to extensive state and federal regulations, which often limit or restrict our activities and may impose material financial requirements or limitations on the conduct of our business.

We are subject to numerous laws designed to protect consumers, including the CRA and fair lending laws, and failure to comply with these laws could lead to a wide variety of sanctions, or could impede or materially delay our receipt of regulatory approval to acquire other companies.

We may incur fines, penalties and other negative consequences from regulatory violations, which could include inadvertent or unintentional violations.

We may be unable to disclose some restrictions or limitations on our operations imposed by our regulators.

Our Employee Stock Ownership Plan and 2025 Equity Plan, which we adopted in 2023 and 2025, respectively, have increased and are expected to continue to increase our annual compensation expenses.

Risks Related to our Acquisition Strategy

We may fail to realize all of the anticipated benefits of the Provident Acquisition, or those benefits may take longer to realize than expected. We may also encounter significant difficulties in integrating with Provident.

The success of the Provident Acquisition, including anticipated benefits and cost savings, will depend, in part, on the our ability to successfully integrate the operations of Provident in a manner that results in various benefits and that does not materially disrupt existing customer relationships or result in decreased revenues due to loss of customers.

44

The process of integrating operations could result in a loss of key personnel or cause an interruption of, or loss of momentum in, the activities of one or more of the combined company’s businesses. Inconsistencies in standards, controls, procedures and policies could adversely affect the combined company. The diversion of management’s attention and any delays or difficulties encountered in connection with the Provident Acquisition and the integration of Provident’s operations could have an adverse effect on the business, financial condition, operating results and future prospects of the combined company. If the bank experiences difficulties in the integration process, including those listed above, we may fail to realize the anticipated benefits and synergies of the Provident Acquisition in a timely manner or at all.

Our future results will suffer if we do not effectively manage expanded operations following the Provident Acquisition.

Following the Provident Acquisition, the size and operation scope of the combined Company’s business has increased beyond its current size and scope. The Provident Acquisition has increased the combined Company’s asset size and will further increase the breadth and complexity of the combined Company’s business with the addition of new business lines in which we have not previously engaged, and exposure to industry sectors which the Company has not historically served. The size and scope of the combined Company’s commercial loan portfolio has also increased in size as a result of the Provident Acquisition. The commercial loan portfolio acquired from Provident includes loans that are concentrated in industry sectors that are relatively new to the Company. The Company’s future success depends, in part, on the Company’s ability to manage this expanded business, which poses challenges for management, including challenges related to the management and monitoring of new operations and associated increased costs and complexity. There can be no assurances that the Company will be successful in this regard or that the expected operating efficiencies, cost savings and other benefits currently anticipated from the Provident Acquisition will be realized.

The Company may be unsuccessful identifying and competing for acquisitions.

The Company will continue to look for acquisition opportunities of banks and financial institutions that meet our criteria, some of which may be material to the Company’s business and financial performance and could involve significant cash expenditures or result in a material increase in the number of shares of the Company’s common stock that are outstanding. The Company may face competition from other financial services institutions, some of which may have greater financial resources, when considering acquisition opportunities. Accordingly, attractive opportunities may not be available, and there can be no assurance that the Company will be successful in identifying, completing or integrating future acquisitions. The Company may not be able to acquire other institutions on acceptable terms. The ability to grow may be limited if the Company is unable to successfully make acquisitions in the future.

The Company may be unsuccessful in retaining our personnel or the personnel of any company we acquire.

The success of any merger or acquisition that we pursue will depend in part on the Company’s ability to retain the key employees currently employed by the Company and employees who join the Company from the acquired company. If the Company is unable to retain key employees, including management, who are critical to the successful integration and future operations of the combined company, the Company could face disruptions in its operations, loss of existing customers, loss of key information, expertise or know-how and unanticipated additional recruitment costs.

In addition, if key employees terminate their employment, the Company’s business activities may be adversely affected, and management’s attention may be diverted from successfully integrating the Company and the acquired company to hiring suitable replacements, all of which may cause the Company’s business to suffer. In addition, the Company may not be able to locate or retain suitable replacements for any key employees who leave the combined company.

45

The Company has incurred and expects to continue to incur costs related to the acquisition and integration of Provident.

The Company incurs significant, non-recurring costs when it agrees to acquire other businesses. In addition, the Company incurs integration costs following the completion of acquisitions as it integrates the acquired business, including facilities and systems consolidation costs and employment-related costs. The Company may also incur additional costs to retain key employees of the Company and the acquired business. There can be no assurances that the expected benefits and efficiencies related to the integration of the acquired businesses will be realized to offset these transaction and integration costs over time.

Regulatory approvals related to proposed business acquisitions may not be received, may take longer to receive than expected, or may impose burdensome conditions, which could impose additional costs and could delay or prevent completion of the acquisition.

Before a merger or acquisition may be completed, certain approvals or consents must be obtained from various bank regulatory and other authorities of the United States and the Commonwealth of Massachusetts. These governmental entities, including the Federal Reserve Board, the FDIC and the Massachusetts Division of Banks, may impose conditions on the completion of the transaction, require changes to the terms of the transaction or require divestitures or place restrictions on our conduct after the completion of the transaction. Any such conditions or changes could have the effect of delaying completion of the transaction or imposing additional costs on or limiting the financial performance of the Company following the completion of the transaction, any of which might have a material adverse effect on the Company.

The degree of scrutiny that our regulators give to mergers and acquisitions can change from time to time. In general, we anticipate that as the Company increases in size and complexity, our proposed mergers and acquisitions will receive greater regulatory scrutiny and the time that regulators will take to process the applications will increase.

In September 2024, the Department of Justice’s Antitrust Division and the FDIC announced that each respective agency has withdrawn the 1995 Bank Merger Competitive Review Guidelines (the “1995 Guidelines”). The Department of Justice’s Antitrust Division announced that it will instead evaluate the bank mergers using its 2023 Merger Guidelines that apply across all industries. As of the date of this Annual Report on Form 10-K, the Federal Reserve Board has not released any new guidance on its approach to bank merger reviews, nor has it withdrawn from the 1995 Guidelines. Past statements from the Federal Reserve Board staff indicate that the Federal Reserve Board is not actively planning to alter its approach to bank merger reviews. The 2023 Merger Guidelines set forth more stringent concentration limits than the 1995 Bank Merger Guidelines. The 2023 Merger Guidelines provide additional, largely qualitative grounds on which the Department of Justice could object to a transaction beyond traditional local market concentration.

At this time, we are unable to predict whether the actions taken by the FDIC and the Department of Justice will have a material adverse effect on our ability to acquire or merge with banking companies in our market area.

To the extent that we acquire other companies, our business may be negatively impacted by certain risks inherent with such acquisitions.

A significant component of our business strategy is to grow through acquisitions of other financial institutions or business lines as opportunities arise. Although we have been successful with this strategy in the past, we may not be able to grow our business in the future through acquisitions for a number of reasons, including:

Competition with other prospective buyers resulting in our inability to complete an acquisition or in our paying a substantial premium over the fair value of the net assets of the acquired business;

Inability to obtain regulatory or shareholder approvals, delays in obtaining regulatory approvals or the imposition of costly or burdensome conditions to regulatory approvals;

46

Potential difficulties and/or unexpected expenses relating to the integration of the operations, technologies, products and the key employees of the acquired business, resulting in the diversion of resources from the operation of our existing business;

Acquisitions of new lines of business may present risks that are different in kind or degree compared to those that we are accustomed to managing, requiring us to implement new or enhance existing procedures and controls and diverting resources from the operation of our existing business;

Inability to maintain existing customers of the acquired business or to sell the products and services of the acquired business to our existing customers;

Inability to retain key management of the acquired business;

Assumption of or potential exposure to significant liabilities of the acquired business, some of which may be unknown or contingent at the time of acquisition, including, without limitation, liabilities for regulatory and compliance issues;

Exposure to potential asset quality issues of the acquired business;

Failure to mitigate deposit erosion or loan quality deterioration at the acquired business;

Potential changes in banking or tax laws or regulations that may affect the acquired business;

Inability to improve the revenues and profitability or realize the cost savings and synergies expected of the acquired business;

Potential future impairment of the fair value of goodwill and intangible assets acquired, as discussed below and elsewhere in this Annual Report on Form 10-K; and

Identification of internal control deficiencies of the acquired business.

We anticipate that whenever we acquire a business, a portion of the purchase price of the acquisition will be allocated to goodwill and other identifiable intangible assets, and our subsequent evaluation of that goodwill, at least annually, will be a critical accounting estimate. Under current accounting rules, at the time we complete an acquisition, the excess of the purchase price over the fair value of the net identifiable tangible and intangible assets acquired will determine the amount of the purchase price that is allocated to goodwill acquired, and subsequently, if we determine that goodwill or intangible assets are impaired, we would be required to write down the value of these intangible assets. If such a write-down occurs, it may have a material adverse effect on our financial condition and operating results.

All of these and other potential risks may serve as a diversion of our management’s attention from other business concerns, and any of these factors could have a material adverse effect on our business. Moreover, acquisitions typically involve the payment of a premium over book and market values, and therefore, some dilution of our tangible book value and net income per share may occur in connection with any future transaction.

47

Risks Related to our Lending Activities

Our portfolios of commercial real estate loans, multifamily loans, construction and land development loans and commercial and industrial loans have increased in recent periods, and we intend to continue originating these types of loans. These loans involve credit risks that could adversely affect our financial condition and results of operations.

At December 31, 2025, total commercial loans including commercial real estate loans, multifamily loans, construction and land development loans and commercial and industrial loans, totaled $4.18 billion, or 69.7%, of our loan portfolio (reflective of the impact of the $930.6 million in commercial loans from the Provident Acquisition) compared to $2.84 billion, or 65.5%, of our loan portfolio, at December 31, 2024. These loans generally have more risk than the one-to-four-family residential real estate loans we originate. Such loans typically involve larger loan balances to single borrowers or groups of related borrowers compared to one-to-four-family residential mortgage loans. In addition, the repayment of these types of loans depends on the successful management and operation of the borrower’s businesses or properties. The repayment of such loans can be affected by adverse conditions in the local real estate market or economy. Also, many of our commercial borrowers have more than one loan outstanding with us. At December 31, 2025, our loans-to-one borrower limit was $158.3 million and our four largest borrower relationships, including available lines of credit, were $122.5 million, $107.0 million, $98.9 million and $93.9 million, respectively. Consequently, an adverse development with respect to one loan or one credit relationship can expose us to a significantly greater risk of loss compared to an adverse development with respect to a one-to-four-family residential real estate loan. Commercial and industrial loans expose us to additional risk since they typically are dependent on the borrower’s ability to make repayments from the cash flows of the business and are sometimes secured by non-real estate collateral that may depreciate over time, such as inventory and accounts receivable, the value of which may be more difficult to appraise, control or collect and may be more susceptible to fluctuation in value at the time of default. In addition, if we foreclose on commercial real estate loans, our holding period for the collateral may be longer than for a single-family residential property if there are fewer potential purchasers of the collateral. Furthermore, if loans that are collateralized by commercial real estate become troubled and the value of the real estate has been significantly impaired, then we may not be able to recover the full contractual amount of principal and interest that we anticipated at the time we originated the loan. Any of these risks could cause us to increase our provision for credit losses and adversely affect our operating results and financial condition.

The level of our commercial real estate loan portfolio subjects us to additional regulatory scrutiny.

The Federal Reserve Board and the other federal bank regulatory agencies have promulgated joint guidance on sound risk management practices for financial institutions with concentrations in commercial real estate lending. Under the guidance, a financial institution that is actively involved in commercial real estate lending should perform a risk assessment to identify concentrations. A financial institution may have a concentration in commercial real estate lending if, among other factors, (i) total reported loans for construction, land acquisition and development, and other land represent 100% or more of total capital, or (ii) total reported loans secured by multifamily and non-farm residential properties, loans for construction, land acquisition and development and other land, and loans otherwise sensitive to the general commercial real estate market, including loans to non-owner occupied commercial real estate related entities, represent 300% or more of total capital.

Based on these factors we could be deemed to have a concentration in commercial real estate lending, as such loans represent approximately 294.2% and 249.9% of the Bank’s total capital as of December 31, 2025 and 2024, respectively. The guidance focuses on exposure to commercial real estate loans that is dependent on the cash flow from the real estate held as collateral and that is likely to be at greater risk to conditions in the commercial real estate market (as opposed to real estate collateral held as a secondary source of repayment or as an abundance of caution).

The guidance assists banks in developing risk management practices and capital levels commensurate with the level and nature of real estate concentrations. The guidance states that management should employ heightened risk management practices including board and management oversight and strategic planning, development of underwriting standards, risk assessment and monitoring through market analysis and stress testing.

48

While we believe we have implemented policies and procedures with respect to our commercial real estate loan portfolio consistent with this guidance, bank regulators could require us to implement additional policies and procedures consistent with their interpretation of the guidance that may result in additional costs to us or that may result in a curtailment of our commercial real estate lending, including multifamily and construction and land development lending, and/or the requirement that we maintain higher levels of regulatory capital, either of which would adversely affect our loan originations and profitability.

Our construction and land development loans involve credit risks that could adversely affect our financial condition and results of operations.

At December 31, 2025, construction loans and loans to finance the acquisition of developable land which we refer to as “land development loans” totaled $730.6 million, or 12.2%, of our loan portfolio and 91.6% of the Bank’s total capital (reflective of the impact of the Provident Acquisition) compared to $583.8 million, or 13.5%, of our loan portfolio and 85.8% of the Bank’s total capital at December 31, 2024. Construction lending involves additional risks when compared with permanent finance lending because funds are advanced upon the security of the project, which is of uncertain value before its completion.At December 31, 2024, construction loans and loans to finance the acquisition of developable land which we refer to as “land development loans” totaled $583.8 million, or 13.5%, of our loan portfolio and 88.8% of the Bank’s total capital compared to $622.8 million, or 16.0%, of our loan portfolio and 100.4% of the Bank’s total capital at December 31, 2023. Construction lending involves additional risks when compared with permanent finance lending because funds are advanced upon the security of the project, which is of uncertain value before its completion. Because of the uncertainties inherent in estimating construction costs, as well as the market value of the completed project and the effects of governmental regulation of real property, it is relatively difficult to accurately evaluate the total funds required to complete a project and the related loan-to-value ratio. In addition, generally during the term of a construction loan, interest may be funded by the borrower or disbursed from an interest reserve set aside from the construction loan budget. These loans often involve the disbursement of substantial funds with repayment substantially dependent on the success of the ultimate project and the ability of the borrower to sell or lease the property or obtain permanent take-out financing, rather than the ability of the borrower or guarantor to repay principal and interest. If the appraised value of a completed project proves to be overstated, we may have inadequate security for the repayment of the loan upon completion of construction of the project and may incur a loss. In addition, speculative construction loans, which are loans made to home builders who, at the time of loan origination, have not yet secured an end buyer for the home under construction, typically carry higher risks than those associated with traditional construction loans. These increased risks arise because of the risk that there will be inadequate demand to ensure the sale of the property within an acceptable time. As a result, in addition to the risks associated with traditional construction loans, speculative construction loans carry the added risk that the builder will have to pay the property taxes and other carrying costs of the property until an end buyer is found. Land loans have substantially similar risks to speculative construction loans. As our construction and land loan portfolio increases, the corresponding risks and potential for losses from these loans may also increase.

Lack of seasoning of certain portions of our commercial and industrial loan portfolio, especially with respect to cannabis, solar and bridge financing customers, may increase the risk of credit defaults in the future.

We have experienced significant loan growth in recent years in our larger commercial and industrial loans, which we refer to as Structured Finance loans. Most of these loans are to new customers in the cannabis and solar industries and bridge financing. We believe we have grown these loan portfolios consistent with prudent underwriting standards but in general, loans do not begin to show signs of credit deterioration or default until they have been outstanding for some period of time, a process referred to as “seasoning.” As a result, a portfolio of older loans will usually behave more predictably than a newer portfolio. It will take several years to determine our borrowers’ payment histories, with respect to many of these new lending relationships and, as a result, we may not be able to reliably evaluate the quality of the loan portfolio until that time.

Our historical emphasis on residential mortgage loans exposes us to lending risks.

At December 31, 2025, $1.18 billion, or 19.6% of our loan portfolio, was secured by one-to-four-family residential real estate compared to $1.13 billion or 26.1%, of our loan portfolio, as of December 31, 2024, and we intend to continue to provide this type of lending for the foreseeable future. One-to-four-family residential mortgage lending is generally sensitive to regional and local economic conditions that significantly impact the ability of borrowers to meet their loan payment obligations, making loss levels difficult to predict. Declines in real estate values could cause some of our residential mortgages to be inadequately collateralized, which would expose us to a greater risk of loss if we seek to recover on defaulted loans by selling the real estate collateral.

49

Changes in the secondary mortgage market may impede our ability to collect repayment on the mortgage warehouse facility lines.

Mortgage warehouse loans are facility lines to non-bank mortgage origination companies. The underlying collateral of these facility lines are residential real estate loans. Loans are originated by the mortgage companies for sale into secondary markets. The primary source of repayment of the facility lines is the cash flow upon sale of the loans. Changes in the secondary mortgage market may impede the mortgage companies’ ability to sell the loans and repay their facility lines. Such events could result in an increase to our provision for credit losses, which could decrease our net income.

The geographic concentration of our loan portfolio and lending activities makes us vulnerable to a downturn in the local economy.

We primarily serve individuals and businesses located in the Greater Boston metropolitan area and surrounding communities, including eastern Connecticut, southern New Hampshire and Rhode Island. At December 31, 2025, the vast majority of our total loans were primarily secured by real estate in this market area, defined as within a 100-mile radius of the company headquarters in Needham, Massachusetts. At December 31, 2025, $434.1 million in loans were reported as out of territory, excluding Structured Finance loans, which have a broader geographical targeted footprint. Therefore, our success is largely dependent on the economic conditions, including employment levels, population growth, income levels, savings trends and government policies, in this market area. Although our loan portfolio has very limited exposure to commercial office space in downtown Boston, increased vacancies in this market resulting in depressed prices could have a ripple effect on the Greater Boston Metropolitan area. Moreover, the continued trend of hybrid and remote work would likely result in increased vacancy rates in commercial office space throughout the Greater Boston metropolitan area which could also negatively affect the demand for retail occupancy and sales in surrounding areas, any of which could adversely affect the value of the properties used as collateral for such loans. Similarly, weaker economic conditions caused by recessions, unemployment, inflation, a decline in real estate values or other factors beyond our control may adversely affect the ability of our borrowers to service their debt obligations and could result in higher loan losses and lower net income for us.

Although there is not a single employer or industry in our market area on which a significant number of our customers are dependent, a substantial portion of our loan portfolio is composed of loans secured by property located in the Greater Boston metropolitan area. This makes us vulnerable to a downturn in the local economy and real estate markets. Decreases in local real estate values caused by economic conditions or other events could adversely affect the value of the property used as collateral for our loans, which could cause us to realize a loss in the event of foreclosure.

A worsening of business and economic conditions generally or specifically in the principal markets in which we conduct business could have adverse effects on our business, including the following:

a decrease in the demand for, or the availability of, loans and other products and services offered by us;
a decrease in the value of our loans or other assets secured by residential or commercial real estate;
a decrease in interest income from variable rate loans due to declines in interest rates; and
an increase in the number of customers and counterparties who become delinquent, file for protection under bankruptcy laws or default on their loans or other obligations to us, which could result in a higher level of nonperforming assets, net charge-offs, provisions for credit losses, and valuation adjustments on loans held for sale.

Moreover, a significant decline in general economic conditions, caused by inflation, recession, acts of terrorism, an outbreak of hostilities or other international or domestic calamities, unemployment, public health crises or other factors beyond our control could further impact these local economic conditions and could further negatively affect the financial results of our banking operations.

50

In addition, deflationary pressures, while possibly lowering our operating costs, could have a significant negative effect on our borrowers, especially our business borrowers, and the values of underlying collateral securing loans, which could negatively affect our financial performance. In the event of severely adverse business and economic conditions generally or specifically in the principal markets in which we conduct business, there can be no assurance that the federal government and the Federal Reserve Board would intervene. If economic conditions worsen or volatility increases, our business, financial condition and results of operations could be materially adversely affected. For more information about our market area, please see the section titled “Business of Needham Bank – Market Area.”

If our ACL on loans is not sufficient to cover actual credit losses, our earnings could decrease.

We maintain an allowance for credit losses on loans, which is established through a provision for credit losses that represents management’s best estimate of the current expected losses within the loan portfolio. We make various assumptions and judgments about the collectability of our loan portfolio, including the creditworthiness of our borrowers and the value of the real estate and other assets serving as collateral for the repayment of many of our loans. In determining the amount of the allowance for credit losses on loans, we review our loans and our loss and delinquency experience, and we evaluate economic conditions. If our assumptions or the results of our analyses are incorrect, our allowance for credit losses on loans may not be sufficient to cover losses inherent in our loan portfolio, resulting in additions to our allowance for credit losses on loans. In addition, our emphasis on loan growth and on increasing our portfolios of commercial real estate loans, as well as any future credit deterioration or changes in economic conditions could require us to increase our allowance for credit losses on loans in the future. At December 31, 2025, our allowance for credit losses on loans was 1.46% of total loans and 201% of non-performing loans (reflective of the impact of the Provident Acquisition) compared to 0.89% and 280% at December 31, 2024. Material additions to our allowance for credit losses on loans would materially decrease our net income. At December 31, 2024, our allowance for credit losses on loans was 0.89% of total loans and 280% of non-performing loans compared to 0.83% and 298% at December 31, 2023. Material additions to our allowance for credit losses on loans would materially decrease our net income.

In addition, bank regulators periodically review our allowance for credit losses on loans and, as a result of such reviews, we may be required to increase our provision for credit losses on loans or recognize further loan charge-offs. However, regulatory agencies are not directly involved in the process of establishing the allowance for credit losses on loans, as the process is our responsibility and any adjustment of the allowance for credit losses on loans is the responsibility of the Company’s management. Any increase in our allowance for credit losses on loans or loan charge-offs as a result of such review or otherwise may have a material adverse effect on our financial condition and results of operations.

We provide banking services to customers who do business in the cannabis industry and the strict enforcement of federal laws regarding cannabis would likely result in our inability to continue to provide banking services to these customers and we could have legal action taken against us by the federal government.

We have deposit and loan customers that are licensed in various states to do business in the cannabis industry as growers, processors, and dispensaries. While cannabis is legal in each of these states, it remains classified as a Schedule I controlled substance under the Federal Controlled Substances Act, or CSA. As such, the cultivation, use, distribution, and possession of cannabis is a violation of federal law that is punishable by imprisonment and fines. Moreover, the U.S. Supreme Court ruled in USA v. Oakland Cannabis Buyers’ Coop. that the federal government has the authority to regulate and criminalize cannabis, including medical marijuana.

In January 2018, the U.S. Department of Justice (“DOJ”) rescinded the “Cole Memo” and related memoranda which characterized the enforcement of the CSA against persons and entities complying with state regulatory systems permitting the use, manufacture and sale of medical marijuana as an inefficient use of their prosecutorial resources and discretion. The impact of the DOJ’s rescission of the Cole Memo and related memoranda is unclear, but may result in the DOJ increasing its enforcement actions against the regulated cannabis industry generally.

As in past years, the U.S. Congress has enacted an omnibus spending bill that includes a provision prohibiting the DOJ and the U.S. Drug Enforcement Administration from using funds appropriated by that bill to prevent states from implementing their medical-use cannabis laws. This provision was recently renewed as part of the Consolidated Appropriations Act of 2022.

51

While this provision has been re-enacted every year since 2014, and is expected to continue to be re-enacted in future federal spending bills, if Congress and the President of the United States fail to further renew the provision, then the ability of medical cannabis businesses to act in this area, and our ability to provide banking products and services to such businesses, may be impeded. Further, the U.S. Court of Appeals for the Ninth Circuit held in USA v. McIntosh that this provision prohibits the DOJ from spending funds from relevant appropriations acts to prosecute individuals who engage in conduct permitted by state medical-use cannabis laws and who strictly comply with such laws. There is no guarantee that the U.S. Congress will extend this provision or that U.S. Federal courts located outside the Ninth Circuit will follow the ruling in USA v. McIntosh. As of the date of filing this Annual Report on Form 10-K, we are aware of no federal or state court in or for Massachusetts that has addressed the merits of the McIntosh ruling.

Federal prosecutors have significant discretion and there can be no assurance that a federal prosecutor in any of the federal districts in which we operate will not choose to strictly enforce the federal laws governing cannabis, including medical-use cannabis, or that any of these federal courts will follow the Ninth Circuit’s ruling in USA v. McIntosh. Any change in the federal government’s enforcement position, could cause us to immediately cease providing banking services to the medical-use cannabis industry in the states where we operate.

Additionally, as the possession and use of cannabis remains illegal under the CSA, we may be deemed to be aiding and abetting illegal activities through the services that we provide to these customers and could have legal action taken against us by the Federal government, including imprisonment and fines. Any change in position or potential action taken against us could result in significant financial damage to us and our stockholders.

The Financial Crimes Enforcement Network (“FinCEN”) published guidelines in 2014 for financial institutions servicing state legal cannabis business. These guidelines were issued for the explicit purpose so “that financial institutions can provide services to marijuana-related businesses in a manner consistent with their obligations to know their customers and to report possible criminal activity.” The Bank has and will continue to follow this and other FinCEN guidance in the areas of cannabis banking. Any adverse change in this FinCEN guidance, any new regulations or legislation, any change in existing regulations or oversight, whether a change in regulatory policy or a change in a regulator’s interpretation of a law or regulation, could have a negative impact on our interest income and noninterest income, as well as the cost of our operations, increasing our cost of regulatory compliance and of doing business, and/or otherwise affect us, which may materially affect our profitability.

On December 18, 2025, President Trump signed an executive order directing the Department of Justice to move cannabis from a Schedule I to a Schedule III substance, a category for substances with accepted medical use and lower abuse potential. While not full legalization, the change is designed to ease financial and tax burdens on the cannabis industry, including, to some extent, banking access. Schedule III classification allows state-legal cannabis businesses to deduct ordinary business expenses under IRS Code Section 280E, which is expected to boost cash flow and profitability and it aims to encourage banks and financial institutions to work with the cannabis industry, as the risk of violating federal Anti-Money Laundering laws is reduced.

Environmental liability associated with our lending activities could result in losses.

In the course of business, we may acquire, through foreclosure, properties securing loans originated or purchased that are in default. Particularly in commercial real estate lending, there is a risk that material environmental violations could be discovered on these properties. In this event, we might be required to remedy these violations at the affected properties at our sole cost and expense. The cost of remedial action could substantially exceed the value of affected properties. We may not have adequate remedies against the prior owner or other responsible parties and could find it difficult or impossible to sell the affected properties. These events could have an adverse effect on our financial condition and results of operations.

The foreclosure process may adversely impact our recoveries on non-performing loans.

The judicial foreclosure process is protracted, which delays our ability to resolve non-performing loans through the sale of the underlying collateral.

52

The longer timelines have been the result of additional consumer protection initiatives related to the foreclosure process, increased documentary requirements and judicial scrutiny, and, both voluntary and mandatory programs under which lenders may consider loan modifications or other alternatives to foreclosure. These reasons and the legal and regulatory responses have impacted the foreclosure process and completion time of foreclosures for residential mortgage lenders. This may result in a material adverse effect on collateral values and our ability to minimize its losses.

Risks Related to Market Interest Rates

The reversal of the high-interest rate environment may adversely affect our net interest income and profitability.

Net interest income historically has been, and we anticipate that it will remain, a significant component of our total revenue. A high percentage of our assets and liabilities involve interest-bearing or interest-related instruments. Thus, changes in interest rates have impacted and may continue to impact many areas of our business, including net interest income, both the earnings and volume of interest-earning assets and interest-bearing liabilities, as well as loan delinquency. Interest rates are highly sensitive to many factors that are beyond our control, including global, national, regional and local economic conditions, the effects of disease pandemics such as COVID-19, competitive pressures, and policies of various governmental and regulatory agencies and, in particular, the Federal Open Market Committee (“FOMC”). Changes in interest rates have influenced and will continue to influence the interest we receive on loans and securities and the amount of interest we pay on deposits and borrowings, our ability to originate loans and obtain deposits, and the fair value of our financial assets and liabilities. If the interest rates on our interest-earning assets decrease at a faster pace than the interest rates on our interest-bearing liabilities, our net interest income may decline and, with it, a decline in our earnings may occur. Our net interest income and our earnings would be similarly affected if the interest rates on our interest-bearing liabilities increased at a faster pace than the interest rates on our interest-earning assets.

The FOMC cut the target range for the federal funds during 2025 by 75 basis points. Additional rate cuts may occur if inflationary pressures continue towards the FOMC’s 2% target and employment continues to weaken. Additional rate cuts may occur if inflationary pressures continue towards the FOMC’s 2% target and employment weakens. Decreases to the target range for the federal funds rate, combined with ongoing geopolitical instability, could signal the risk of an economic recession. Any such downturn may adversely affect our asset quality, deposit levels, loan demand and results of operations.

Lower interest rates generally are associated with a higher volume of loan originations and refinancing transactions, while higher interest rates are usually associated with lower loan originations and refinancing transactions. Our ability to generate gains on sales of mortgage loans is significantly dependent on the level of originations. Cash flows are affected by changes in market interest rates. Generally, in falling interest rate environments, loan prepayment rates are likely to increase, and in rising interest rate environments, loan prepayment rates are likely to decline.

A significant amount of our commercial and industrial and commercial real estate, including multi-family residential real estate loans, are adjustable-rate loans and a decrease in the general level of interest rates may adversely affect our interest income levels. Changes in interest rates, prepayment speeds and other factors may also cause the value of our loans held for sale to change.

Although we have implemented risk management strategies, as well as policies and procedures designed to manage the risks associated with changes in market interest rates, changes in interest rates have had and may continue to have an adverse effect on our operating results and financial condition.

If our ongoing assumptions regarding borrower or depositor behavior or overall economic conditions are significantly different than we anticipate, then our risk mitigation may be insufficient to protect against interest rate risk and our operating results and financial condition would be adversely affected.

53

Changes in interest rates could reduce our profits and asset values.

We derive our income mainly from the difference or “spread” between the interest earned on loans, securities and other interest-earning assets and interest paid on deposits, borrowings and other interest-bearing liabilities. In general, the larger the spread, the more we earn.

When market rates of interest change, the interest we receive on our assets and the interest we pay on our liabilities will fluctuate. This can cause decreases in our spread and can adversely affect our income. For the past several years, we have been asset sensitive, which indicates that assets generally reprice faster than liabilities. In a falling rate environment, asset sensitivity is not preferable as it results in deterioration to our net interest margin.

Interest rates also affect how much money we lend. For example, when interest rates fall, the cost of borrowing decreases for customers and the Bank’s loan originations tend to increase.

A falling rate environment can also negatively impact the Bank if the lower rates earned on adjustable-rate loans lead to lower levels of interest income. In addition, changes in interest rates can affect the average life of loans and securities. For example, a reduction in interest rates generally results in increased prepayments of loans and mortgage-backed securities, as borrowers refinance their debt to reduce their borrowing cost. This causes reinvestment risk, because we generally are not able to reinvest prepayments at rates that are comparable to the rates we earned on the prepaid loans or securities in a declining rate environment.

Any substantial, unexpected, prolonged change in market interest rates could have a material adverse effect on our financial condition, liquidity and results of operations. Changes in the level of interest rates also may negatively affect the value of our assets, including the value of our AFS securities, which generally decrease when market interest rates rise, and ultimately affect our earnings. During the year ended December 31, 2025, we earned other comprehensive income of $5.0 million, primarily related to net changes in unrealized holding gains in the AFS securities portfolio and an increase in the value of our hedges. During the year ended December 31, 2024, we incurred other comprehensive income of $3.7 million, primarily related to net changes in unrealized holding gains in the AFS securities portfolio.

Changes in the level of interest rates also may negatively affect our ability to originate real estate loans, the value of our assets, and our ability to realize gains from the sale of our assets, all of which ultimately affect our earnings. Also, our interest rate risk modeling techniques and assumptions likely may not fully predict or capture the impact of actual interest rate changes on our balance sheet or projected operating results. See “Management’s Discussion and Analysis of Financial Condition and Results of Operations – Management of Market Risk.”

Hedging against interest rate exposure may adversely affect our earnings.

On occasion we have employed various financial risk methodologies that limit, or “hedge,” the adverse effects of rising or decreasing interest rates on our loan portfolios and short-term liabilities. We also engage in hedging strategies with respect to arrangements where our customers swap floating interest rate obligations for fixed interest rate obligations, or vice versa. Our hedging activity varies based on the level and volatility of interest rates and other changing market conditions.

There are no perfect hedging strategies, and interest rate hedging may fail to protect us from loss. Moreover, hedging activities could result in losses if the event against which we hedge does not occur. Additionally, interest rate hedging could fail to protect us or adversely affect us because, among other things:

available interest rate hedging may not correspond directly with the interest rate risk for which protection is sought;
the duration of the hedge may not match the duration of the related liability;
the party owing money in the hedging transaction may default on its obligation to pay;

54

the credit quality of the party owing money on the hedge may be downgraded to such an extent that it impairs our ability to sell or assign our side of the hedging transaction;
the value of derivatives used for hedging may be adjusted from time to time in accordance with U.S. GAAP to reflect changes in fair value; and/or
downward adjustments, or “mark-to-market” losses, would reduce our stockholders’ equity.

Risks Related to Economic Conditions

A worsening of economic conditions in our market area could reduce demand for our products and services and/or result in increases in our level of non-performing loans, which could adversely affect our operations, financial condition and earnings.

Local and regional economic conditions have a significant impact on the ability of our borrowers to repay loans and the value of the collateral securing loans.

A deterioration in economic conditions, especially local conditions, could have the following consequences, any of which could have a material adverse effect on our business, financial condition, liquidity and results of operations, and could more negatively affect us compared to a financial institution that operates with more geographic diversity:

demand for our products and services may decline;
loan delinquencies, problem assets and foreclosures may increase;
collateral for loans, especially real estate, may decline in value, thereby reducing customers’ future borrowing power, and reducing the value of assets and collateral associated with existing loans, causing an increase in our allowance for credit losses; and
the net worth and liquidity of loan guarantors may decline, impairing their ability to honor commitments to us.

Moreover, a significant decline in general economic conditions caused by inflation, recession, acts of terrorism, civil unrest, an outbreak of hostilities or other international or domestic calamities, an epidemic or pandemic, unemployment or other factors beyond our control could further impact these local economic conditions and could further negatively affect the financial results of our banking operations. In addition, deflationary pressures, while possibly lowering our operating costs, could have a significant negative effect on our borrowers, especially our business borrowers, and the values of underlying collateral securing loans, which could negatively affect our financial performance.

Further, a U.S. government debt default would have a material adverse impact on our business and financial performance, including a decrease in the value of U.S. Treasury securities and other government securities held by us, which could negatively impact our capital position and our ability to meet regulatory requirements. Other negative impacts could be volatile capital markets, an adverse impact on the U.S. economy and the U.S. dollar, as well as increased default rates among borrowers in light of increased economic uncertainty. Some of these impacts might occur even in the absence of an actual default but as a consequence of extended political negotiations around the threat of such a default and a government shutdown.

55

We have a high concentration of loans secured by real estate in our market area. Adverse economic conditions, both generally and in our market area, could adversely affect our financial condition and results of operations.

The majority of our loans are inside of our primary market area and, as a result, we have a greater risk of loan defaults and losses in the event of a further economic downturn in our market area, as adverse economic conditions may have a negative effect on the ability of our borrowers to make timely payments of their loans.

A return of recessionary conditions and/or negative developments in the domestic and international credit markets may significantly affect the markets in which we do business, the value of our loans, investments, and collateral securing our loans, and our ongoing operations, costs and profitability. Any of these negative events may result in higher-than-expected loan delinquencies, increase our levels of nonperforming and classified assets, and reduce demand for our products and services, which may cause us to incur losses and may adversely affect our capital, liquidity and financial condition.

Adverse developments affecting the financial services industry, such as actual events or concerns involving liquidity, defaults, or non-performance by financial institutions or transactional counterparties, could adversely affect our financial condition and results of operations.

Actual events involving limited liquidity, defaults, non-performance or other adverse developments that affect financial institutions, transactional counterparties or other companies in the financial services industry or the financial services industry generally, or concerns or rumors about any events of these kinds or other similar risks, have in the past and may in the future lead to market-wide liquidity problems.

Inflation and rapid increases in interest rates have led to a decline in the trading value of previously issued government securities with interest rates below current market interest rates. Although the Treasury, FDIC and Federal Reserve Board have announced a program to provide up to $25 billion of loans to financial institutions secured by certain of such government securities held by financial institutions to mitigate the risk of potential losses on the sale of such instruments, widespread demands for customer withdrawals or other liquidity needs of financial institutions for immediately liquidity may exceed the capacity of such program. Additionally, there is no guarantee that the Treasury, FDIC and Federal Reserve Board will provide access to uninsured funds in the future in the event of the closure of other banks or financial institutions, or that they would do so in a timely fashion.

Our AFS securities portfolio performance in difficult market conditions could have adverse effects on our results of operations.

Unrealized losses on AFS securities result from changes in credit spreads and liquidity issues in the marketplace, along with changes in the credit profile of individual securities issuers. Under U.S. GAAP, we are required to review our AFS securities portfolio periodically for the presence of credit losses of our AFS securities, taking into consideration current and future market conditions, the extent and nature of changes in fair value, issuer rating changes and trends, volatility of earnings, current analysts’ evaluations, our ability and intent to hold investments until a recovery of fair value, as well as other factors. Adverse developments with respect to one or more of the foregoing factors may require us to deem particular AFS securities to be impaired, with the credit-related portion of the reduction in the value recognized as a charge to our earnings through an allowance. Subsequent valuations, in light of factors prevailing at that time, may result in significant changes in the values of these AFS securities in future periods.

Any of these factors could require us to recognize further impairments in the value of our AFS securities portfolio, which may have an adverse effect on our results of operations in future periods.

The fair value of our AFS securities can fluctuate due to factors outside of our control.

Factors beyond our control can significantly influence the fair value of AFS securities in our portfolio and can cause potential adverse changes to the fair value of these AFS securities. These factors include, but are not limited to, rating agency actions with respect to individual AFS securities, defaults by the issuer or with respect to the underlying AFS securities, and changes in market interest rates and continued instability in the capital markets.

56

Any of these factors, among others, could cause credit losses and realized and/or unrealized losses in future periods and declines in other comprehensive income, which could materially and adversely affect our business, results of operations, financial condition and prospects. The process for determining whether impairment of an AFS security is related to credit usually requires complex, subjective judgments about the future financial performance and liquidity of the issuer and any collateral underlying the AFS security in order to assess the probability of receiving all contractual principal and interest payments on the AFS security. Significant negative changes to valuations could result in credit losses on our AFS securities portfolio, which could have an adverse effect on our financial condition or results of operations. As of December 31, 2025, we had approximately $3.1 million of accumulated other comprehensive losses. During the year ended December 31, 2025, we had $5.0 million of after-tax other comprehensive income, which resulted primarily from $6.4 million in pre-tax unrealized valuation gains on AFS securities. During the year ended December 31, 2024, we had $3.7 million of after-tax other comprehensive income, which resulted primarily from $4.9 million in unrealized valuation gains on AFS securities.

Potential downgrades of U.S. government securities by one or more of the credit ratings agencies could have a material adverse effect on our operations, earnings and financial condition.

A possible future downgrade of the sovereign credit ratings of the U.S. government and a decline in the perceived creditworthiness of U.S. government-related obligations could impact our ability to obtain funding that is collateralized by affected instruments, as well as affect the pricing of that funding when it is available. A downgrade may also adversely affect the market value of such instruments. We cannot predict if, when or how any changes to the credit ratings or perceived creditworthiness of these organizations will affect economic conditions. Such ratings actions could result in a significant adverse impact on us.

Among other things, a downgrade in the U.S. government’s credit rating could adversely impact the value of our AFS securities portfolio and may trigger requirements that we post additional collateral for trades relative to these AFS securities. A downgrade of the sovereign credit ratings of the U.S. government or the credit ratings of related institutions, agencies or instruments would significantly exacerbate the other risks to which we are subject and any related adverse effects on the business, financial condition and results of operations.

The soundness of other financial institutions could adversely affect us.

Our ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services institutions are interrelated as a result of trading, clearing, counterparty and other relationships. We have exposure to many different counterparties, and we routinely execute transactions with counterparties in the financial industry, including brokers and dealers, other commercial banks, investment banks, mutual and hedge funds, and other financial institutions. As a result, defaults by, or even rumors or questions about, one or more financial services institutions, or the financial services industry generally, could lead to market-wide liquidity problems and losses or defaults by us or by other institutions and organizations. Many of these transactions expose us to credit risk in the event of default of our counterparty or client. In addition, our credit risk may be exacerbated when the collateral held by us cannot be liquidated or is liquidated at prices not sufficient to recover the full amount of the financial instrument exposure due to us. There is no assurance that any such losses would not materially and adversely affect our results of operations.

Risks Related to Our Funding

Our inability to generate core deposits may cause us to rely more heavily on wholesale funding strategies for funding and liquidity needs, which could have an adverse effect on our net interest margin and profitability.

We must maintain sufficient funds to respond to the needs of depositors and borrowers. Deposits have traditionally been our primary source of funds for use in lending and investment activities. We also receive funds from loan repayments, investment payments and maturities and income on other interest-earning assets. While we emphasize generating transaction accounts, we cannot guarantee if and when this will occur. Further, the considerable competition for deposits in our market area also has made, and may continue to make, it difficult for us to obtain reasonably priced deposits. Moreover, deposit balances can decrease if customers perceive alternative investments as providing a better risk/return tradeoff.

57

If we are not able to increase our lower-cost transactional deposits at a level necessary to fund our asset growth or deposit outflows, we may be forced to seek other sources of funds, including other certificates of deposit, FHLB advances, FRB borrowings, brokered deposits and lines of credit to meet the borrowing and deposit withdrawal requirements of our customers, which may be more expensive and have an adverse effect on our net interest margin and profitability. In addition, if our capital levels fell such that we were no longer considered “well capitalized,” under federal law we would be subject to restrictions on accepting brokered deposits and on paying above-market rates for deposits. Additionally, if, based on a decrease in our tangible equity, the FHLB were to determine that we have inadequate capital levels, in its discretion, it may limit our ability to utilize FHLB advances.

Additionally, our cannabis-related business includes approximately $367.9 million of direct cannabis deposits, directly involved in growing, transporting, packaging, distributing, or selling cannabis (that “touch” cannabis along the distribution chain), as of December 31, 2025. Due to the unique industry-specific risks of this business, if we were forced to terminate this business line, we could lose many or most of these deposits, all of which are core deposits.

Our funding sources may prove insufficient to replace deposits at maturity and support our future growth.

We must maintain sufficient funds to respond to the needs of depositors and borrowers. As a part of our liquidity management, we use a number of funding sources in addition to core deposit growth and repayments and maturities of loans and investments. As we continue to grow, we are likely to become more dependent on these sources, which may include FHLB advances, proceeds from the sale of loans, federal funds purchased and brokered certificates of deposit. Adverse operating results or changes in industry conditions could lead to difficulty or an inability to access these additional funding sources. Our financial flexibility will be severely constrained if we are unable to maintain our access to funding or if adequate financing is not available to accommodate future growth at acceptable interest rates.

If we are required to rely more heavily on more expensive funding sources to support future growth, our revenues may not increase proportionately to cover our costs. In this case, our operating margins and profitability would be adversely affected.

Regulatory scrutiny of BaaS solutions and related technology considerations has recently increased.

As a result of the Provident Acquisition, we provide banking products and services to our financial technology company (“fintech”) partners, which includes payments infrastructure and deposit services. Federal bank regulators have increasingly focused on the risks related to bank and fintech partnerships, raising concerns regarding risk management, oversight, internal controls, information security, change management, and information technology. This focus is demonstrated by regulatory enforcement actions against other banks that have allegedly not adequately addressed these concerns while growing their Banking as a Service (“BaaS”) offerings. We could be subject to additional regulatory scrutiny with respect to that portion of our business that could have a material adverse effect on the business, financial condition, results of operations and growth prospects of the Company. Furthermore, while a financial institution can benefit from a fintech’s products and technology to reach new customers and previously underserved communities, the financial institution bears ultimate accountability for its partners’ compliance and risk management, including with respect to penalties, fines, and other measures that bank regulatory agencies take in the event of non-compliant activity or risks that are not well controlled.Actual events involving limited liquidity, defaults, non-performance or other adverse developments that affect financial institutions, transactional counterparties or other companies in the financial services industry or the financial services industry generally, or concerns or rumors about any events of these kinds or other similar risks, have in the past and may in the future lead to market-wide liquidity problems. In addition, end customers of fintech may not conduct deposit activity in the same manner as other customers or the fintech itself. In recognition of this risk, in July 2024 federal banking agencies issued a joint statement and request for information on banks' arrangements with third parties to deliver bank deposit products and services to end users. Our failure to properly monitor such liquidity risks and/or manage such risk could subject us to regulatory fines or other penalties, or business or reputational harm, and could adversely affect our financial condition and results of operations including if we were forced to terminate this business line, we could lose many or most of these deposits, all of which are core deposits.

58

Risks Related to Laws and Regulations

Changes in laws and regulations and the cost of regulatory compliance with new laws and regulations may adversely affect our operations and/or increase our costs of operations.

The Bank is subject to extensive regulation, supervision and examination by the Commissioner and the Federal Reserve Board, and, also by the FDIC as insurer of the Bank’s deposit accounts and the Company is subject to extensive regulation, supervision and examination by the Federal Reserve Board. Such regulation and supervision govern the activities in which an institution and its holding company may engage and are intended primarily for the protection of the federal deposit insurance fund and the depositors of the Bank, rather than for our stockholders. Regulatory authorities have extensive discretion in their supervisory and enforcement activities, including the imposition of restrictions on our operations, the classification of our assets and determination of the adequacy of the level of our allowance for credit losses. These regulations, along with existing tax, accounting, securities, insurance and monetary laws, rules, standards, policies, and interpretations, control the methods by which financial institutions conduct business, implement strategic initiatives and tax compliance, and govern financial reporting and disclosures. Any change in such regulation and oversight, whether in the form of regulatory policy, regulations, legislation or supervisory action, may have a material impact on our operations.

Our cannabis-related, money service and ATM business present compliance risks that are different in kind or degree compared to those that we are accustomed to managing and have required us to implement new or enhance existing procedures, systems and controls.

We provide depository services to cannabis businesses, including cannabis retailers and cannabis cultivators. We provide depository services to cannabis businesses, including cannabis retailers and cannabis cultivators. We also provide loans to various cannabis-related businesses. We also provide depository services to money service businesses and ATM businesses.

These acquired portfolios are mature portfolios which have been previously reviewed and managed by the management team and employees now employed by the Bank who were previously employed by the selling institution. However, these business lines are relatively new to the Bank and have required and we expect will continue to require, proportionately greater compliance and risk management resources than our other business lines in order for us to comply with laws and regulations related to the prevention of financial crimes and combating terrorism, including the U.S. Patriot Act of 2001. These laws and regulations require us to, among other things, implement specific policies and procedures related to those business lines, including enhanced licensing procedures and policies, and anti-money laundering, anti-bribery and corruption, fraud, compliance, suspicious activities, currency transaction reporting, and due diligence on new and existing customers.

With respect to cannabis-related businesses, the Controlled Substances Act makes it illegal under federal law to manufacture, distribute, or dispense cannabis, and therefore federal law, including the money laundering statutes and the BSA, apply to cannabis-related conduct. Financial transactions involving proceeds generated by cannabis-related conduct can form the basis for prosecution under the money laundering statutes. Financial institutions must report currency transactions and conduct suspicious activity monitoring and reporting in connection with cannabis-related businesses to FinCEN.

Our ability to comply with anti-money laundering laws and state regulations and our reporting obligations to FinCEN depend on our ability to maintain robust customer due diligence, surveillance, detection, reporting and analytic capabilities.

Although we believe that we have policies, systems and procedures designed to comply with these laws and regulations, to the extent our policies or procedures are not fully effective or do not meet heightened regulatory standards or expectations, we may be subject to fines, penalties, restrictions on certain activities including future acquisitions, reputational harm, or other adverse consequences from our federal bank regulators, the DOJ or FinCEN.

59

Non-compliance with the USA PATRIOT Act, BSA, or other laws and regulations could result in fines or sanctions.

The USA PATRIOT and BSA require financial institutions to develop programs to prevent financial institutions from being used for money laundering and terrorist activities. If such activities are suspected, financial institutions are obligated to file suspicious activity reports with FinCEN. These rules require financial institutions to establish procedures for identifying and verifying the identity of customers seeking to open new financial accounts. Failure to comply with these regulations could result in fines or sanctions, including restrictions on pursuing acquisitions or establishing new branches. The policies and procedures we have adopted that are designed to assist in compliance with these laws and regulations may not be effective in preventing violations of these laws and regulations. Furthermore, these rules and regulations continue to evolve and expand.

Monetary policies and regulations of the Federal Reserve Board could adversely affect our business, financial condition and results of operations.

In addition to being affected by general economic conditions, our earnings and growth are affected by the policies of the Federal Reserve Board. An important function of the Federal Reserve Board is to regulate the money supply and credit conditions. Among the instruments used by the Federal Reserve Board to implement these objectives are open market purchases and sales of U.S. government securities, adjustments of the discount rate and changes in banks’ reserve requirements against bank deposits.

These instruments are used in varying combinations to influence overall economic growth and the distribution of credit, bank loans, investments and deposits. Their use also affects interest rates charged on loans or paid on deposits.

The monetary policies and regulations of the Federal Reserve Board have had a significant effect on the operating results of financial institutions in the past and are expected to continue to do so in the future. The effects of such policies upon our business, financial condition and results of operations cannot be predicted.

We are subject to stringent capital requirements, which may adversely impact our return on stockholders’ equity, require us to raise additional capital, or limit our ability to pay dividends or repurchase shares.

Federal regulations establish minimum capital requirements for insured depository institutions, including minimum risk-based capital and leverage ratios, and define “capital” for calculating these ratios. The minimum capital requirements are: (1) a common equity Tier 1 capital ratio of 4.5%; (2) a Tier 1 to risk-based assets capital ratio of 6.0%; (3) a total capital ratio of 8.0%; and (4) a Tier 1 leverage ratio of 4.0%. The regulations also establish a “capital conservation buffer” of 2.5%, which results in the following minimum ratios: (1) a common equity Tier 1 capital ratio of 7.0%; (2) a Tier 1 to risk-based assets capital ratio of 8.5%; and (3) a total capital ratio of 10.5%. An institution will be subject to limitations on paying dividends, engaging in share repurchases and paying discretionary bonuses if its capital level falls below the capital conservation buffer amount.

The application of these capital requirements could, among other things, result in lower returns on equity, and result in regulatory actions if we are unable to comply with such requirements. The Bank’s ability to pay dividends to the Company would be limited if it does not maintain the capital conservation buffer required by the capital rules, which may limit the Company’s ability to pay dividends to its stockholders. Needham Bank’s ability to pay dividends to NB Bancorp would be limited if it does not maintain the capital conservation buffer required by the capital rules, which may limit NB Bancorp’s ability to pay dividends to its stockholders. See “Item 1. Business – Supervision and Regulation – Federal Regulations Applicable to the Bank – Capital Requirements.

We are an emerging growth company, and any decision on our part to comply only with certain reduced reporting and disclosure requirements applicable to emerging growth companies could make our common stock less attractive to investors.

The Company is an emerging growth company. For as long as we continue to be an emerging growth company, we may choose to take advantage of exemptions from various reporting requirements applicable to other public companies, including, but not limited to, reduced disclosure obligations regarding executive compensation in our periodic reports and proxy statements,

60

and exemptions from the requirements of holding a non-binding advisory vote on executive compensation and shareholder approval of any golden parachute payments not previously approved. We have also elected to use the extended transition period to delay adoption of new or revised accounting pronouncements applicable to public companies until such pronouncements are made applicable to private companies. Accordingly, our consolidated financial statements may not be comparable to the financial statements of public companies that comply with such new or revised accounting standards. Investors may find our common stock less attractive since we have chosen to rely on these exemptions.

If some investors find our common stock less attractive as a result of any choices to reduce future disclosure, there may be a less active trading market for our common stock and the price of our common stock may be more volatile.

Potential impact of losing the benefits of excess deposit insurance provided by the DIF.

Effective April 25, 2025, the Bank exited the DIF, which results in excess deposits no longer being insured above FDIC-limits, beginning one year after such exit or upon the next maturity date. Losing excess deposit insurance could result in deposit run off, reduce our overall level of deposits and increase the extent to which we may need to rely in the future on other, more expensive or less stable sources for funding, including FHLB advances or brokered deposits, which would reduce net income. Reducing excess deposits by taking any of the above risk-mitigating measures, which allows deposits to run off, reduces our overall level of deposits and increases the extent to which we may need to rely in the future on other, more expensive or less stable sources for funding, including FHLB advances, which would reduce net income. Shifting excess deposits into reciprocal deposit programs may result in higher funding costs, which also would reduce net income.

The Federal Reserve Board may require us to commit capital resources to support our bank subsidiary.

Federal law requires that a holding company act as a source of financial and managerial strength to its subsidiary bank and to commit resources to support such subsidiary bank. Under the “source of strength” doctrine, the Federal Reserve Board may require a holding company to make capital injections into a troubled subsidiary bank and may charge the holding company with engaging in unsafe and unsound practices for failure to commit resources to a subsidiary bank. A capital injection may be required at times when the holding company may not have the resources to provide it and therefore may be required to borrow the funds or raise capital. Thus, any borrowing or funds needed to raise capital required to make a capital injection becomes more difficult and expensive and could have an adverse effect on our business, financial condition and results of operations.

We may become subject to enforcement actions even though noncompliance was inadvertent or unintentional.

The financial services industry is subject to intense scrutiny from bank supervisors in the examination process and aggressive enforcement of federal and state regulations, particularly with respect to mortgage-related practices and other consumer compliance matters, and compliance with anti-money laundering, BSA and OFAC regulations, and economic sanctions against certain foreign countries and nationals. Enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices.

We maintain systems and procedures designed to ensure that we comply with applicable laws and regulations; however, some legal/regulatory frameworks provide for the imposition of fines or penalties for noncompliance even though the noncompliance was inadvertent or unintentional and even though there was in place at the time systems and procedures designed to ensure compliance. Failure to comply with these and other regulations, and supervisory expectations related thereto, may result in fines, penalties, lawsuits, regulatory sanctions, reputation damage, or restrictions on our business.

We face significant legal risks, both from regulatory investigations and proceedings and from private actions brought against us.

As a participant in the financial services industry, many aspects of our business involve substantial risk of legal liability. From time to time, customers and others make claims and take legal action pertaining to the performance of our responsibilities.

61

Whether customer claims and legal action related to the performance of our responsibilities are founded or unfounded, if such claims and legal actions are not resolved in a manner favorable to us, they may result in significant expenses, and attention from management and financial liability. Any financial liability or reputational damage could have a material adverse effect on our business, which, in turn, could have a material adverse effect on our financial condition and results of operations. There is no assurance that litigation with private parties will not increase in the future. Actions currently pending against us may result in judgments, settlements, fines, penalties or other results adverse to us, which could materially adversely affect our business, financial condition or results of operations, or cause serious reputational harm to us.

Risks Related to our Business Strategy

Our business strategy includes growth, and our financial condition and results of operations could be negatively affected if we fail to grow or fail to manage our growth prudently and effectively. Growing our operations could also cause our expenses to increase faster than our revenues.

Our business strategy includes growth in assets, deposits and the scale of our operations. Achieving such growth will require us to attract customers that currently bank at other financial institutions in our market area. Our ability to successfully grow will depend on a variety of factors, including our ability to attract and retain experienced bankers, the continued availability of desirable business opportunities and the level of competition from other financial institutions. Growth opportunities may not be available or we may not be able to manage our growth successfully. If we do not manage our growth prudently and effectively, our financial condition and operating results could be negatively affected. If we do not manage our growth effectively, our financial condition and operating results could be negatively affected.

Furthermore, there can be considerable costs involved in expanding lending capacity, and generally a period of time is required to generate the necessary revenues to offset these costs, especially in areas in which we do not have an established presence. Accordingly, any such business expansion can be expected to negatively impact our earnings until certain economies of scale are reached.

Our continued pace of growth may require us to raise additional capital in the future, but that capital may not be available when it is needed.

We are required by banking regulatory authorities to maintain adequate levels of capital to support our operations. We may at some point need to raise additional capital to support our continued growth. If we raise capital through the issuance of additional shares of our common stock or other securities, it would dilute the ownership interests of stockholders and may dilute the per share book value of our common stock. New investors may also have rights, preferences and privileges senior to our current stockholders, which may adversely impact our current stockholders. Also, the need to raise additional capital may force our management to spend more time in managerial and financing-related activities than in operational activities.52 Table of ContentsAlso, the need to raise additional capital may force our management to spend more time in managerial and financing-related activities than in operational activities.

Our ability to raise additional capital, if needed, will depend on conditions in the capital markets at that time, which are outside of our control, and our financial performance. Accordingly, we may not be able to raise additional capital, if needed, with favorable terms. If we cannot raise additional capital when needed, our ability to further expand our operations through internal growth and acquisitions could be materially impaired.

We depend on our management team to implement our business strategy and execute successful operations and we could be harmed by the loss of their services.

We depend on the services of the members of our senior management team who direct our strategy and operations. Our executive officers and lending personnel possess substantial expertise, extensive knowledge of our markets and key business relationships. Any one of them could be difficult to replace.

Additionally, in recent years, we have grown our Structured Finance loan portfolio significantly, including through lending relationships to cannabis and solar companies and bridge financing.

62

These industries can entail unique regulatory and operational risks and we believe we have experienced team members who are able to understand and assess these risks when originating and managing these relationships. Our loss of these persons, or our inability to hire additional qualified personnel, could impact our ability to implement our business strategy and could have a material adverse effect on our results of operations and our ability to compete in our markets.

Development of new products and services may impose additional costs on us and may expose us to increased operational risk.

The introduction of new products and services can entail significant time and resources, including regulatory approvals. Substantial risks and uncertainties are associated with the introduction of new products and services, including technical and control requirements that may need to be developed and implemented, rapid technological change in the industry, our ability to access technical and other information from its clients, the significant and ongoing investments required to bring new products and services to market in a timely manner at competitive prices and the preparation of marketing, sales and other materials that fully and accurately describe the product or service and its underlying risks. Our failure to manage these risks and uncertainties also exposes it to enhanced risk of operational lapses which may result in the recognition of financial statement liabilities. Regulatory and internal control requirements, capital requirements, competitive alternatives, vendor relationships and shifting market preferences may also determine if such initiatives can be brought to market in a manner that is timely and attractive to our clients. Products and services relying on internet and mobile technologies may expose us to fraud and cybersecurity risks. Failure to successfully manage these risks in the development and implementation of new products or services could have a material adverse effect on our business and reputation, as well as on its consolidated results of operations and financial condition.

Risks Related to Competitive Matters

Strong competition within our market area may limit our growth and profitability.

Competition in the banking and financial services industry is intense. We compete with commercial banks, savings institutions, mortgage brokerage firms, credit unions, finance companies, mutual funds, insurance companies, brokerage and investment banking firms, financial technology or “fintech companies,” and unregulated or less regulated non-banking entities. Many of these competitors are substantially larger than we are and have substantially greater resources and higher lending limits than we have and offer certain services that we do not or cannot provide. In addition, some of our competitors offer loans with lower interest rates and/or more attractive terms than loans we offer. Competition also makes it increasingly difficult and costly to attract and retain qualified employees. We expect competition to increase in the future as a result of legislative, regulatory and technological changes and the continuing trend of consolidation in the financial services industry. Our profitability depends upon our continued ability to successfully compete for business and qualified employees in our market areas. The greater resources and deposit and loan products offered by some of our competitors may limit our ability to increase our interest-earning assets.

Risks Related to Operational Matters

We face significant operational risks because of our reliance on technology. Our information technology systems may be subject to failure, interruption or security breaches.

Information technology systems are critical to our business. Our business requires us to collect, process, transmit and store significant amounts of confidential information regarding our customers, employees and our own business, operations, plans and business strategies.

We use various technology systems to manage our customer relationships, general ledger, investments, deposits, and loans. Our computer systems, data management and internal processes, as well as those of third parties, are integral to our performance. Our operational risks include the risk of malfeasance by employees or persons outside our company, errors relating to transaction processing and technology, systems failures or interruptions, breaches of our internal control systems and compliance requirements, and business continuation and disaster recovery.

63

There have been increasing efforts by third parties to breach data security at financial institutions. Such attacks include computer viruses, malicious or destructive code, phishing attacks, denial of service or information or other security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary and other information, damages to systems, or other material disruptions to network access or business operations. We have established policies and procedures to prevent or limit the impact of system failures, interruptions and security breaches, including privacy breaches and cyber-attacks. Although we take protective measures and believe that we have not experienced any of the data breaches described above, the security of our computer systems, software, and networks may be vulnerable to breaches, unauthorized access, misuse, computer viruses, or other malicious code and cyber-attacks that could have an impact on information security.

Because the techniques used to cause security breaches change frequently, we may be unable to proactively address these techniques or to implement adequate preventative measures.

In the event of a breakdown in our internal control systems, improper operation of systems or improper employee actions, or a breach of our security systems, including if confidential or proprietary information were to be mishandled, misused or lost, we could suffer financial loss, loss of customers and damage to our reputation, and face regulatory action or civil litigation. Any of these events could have a material adverse effect on our financial condition and results of operations. Insurance coverage may not be available for such losses, or where available, such losses may exceed insurance limits.

We outsource critical operations to third-party service providers. Systems failures, interruptions and cybersecurity breaches could have a material adverse effect on us.

We outsource a majority of our data processing requirements to third-party providers.

Accordingly, our operations are exposed to the risk that these vendors will not perform in accordance with our contractual agreements with them, or we also could be adversely affected if such an agreement is not renewed by the third-party vendor or is renewed on terms less favorable to us. If our third-party providers encounter difficulties, or if we have difficulty communicating with those service providers, our ability to adequately process and account for transactions could be affected, and our business operations could be adversely affected, which could have a material adverse effect on our financial condition and results of operations. Threats to information security also exist in the processing of customer information through various other vendors and their personnel, and our third-party service providers may be vulnerable to unauthorized access, computer viruses, phishing schemes and other security breaches. We may have to expend additional resources to protect against the threat of such security breaches and computer viruses, or to alleviate problems caused by such security breaches or viruses. To the extent that the activities of our third-party service providers or the activities of our customers involve the storage and transmission of confidential information, security breaches and viruses could expose us to claims, regulatory scrutiny, litigation costs and other possible liabilities. To our knowledge, the services and programs provided to us by third parties have not experienced any material security breaches. However, the existence of cyber-attacks or security breaches at third parties with access to our data, such as vendors, may not be disclosed to us in a timely manner.

Our business may be adversely affected by an increasing prevalence of fraud and other financial crimes.

Our loans to businesses and individuals and our deposit relationships and related transactions are subject to exposure to the risk of loss due to fraud and other financial crimes. Nationally, reported incidents of fraud and other financial crimes have increased. To our knowledge, we have not experienced material losses due to apparent fraud or other financial crimes. While we have policies and procedures designed to prevent such losses, losses may still occur.

64

Risks Related to Accounting Matters

Changes in management’s estimates and assumptions may have a material impact on our consolidated financial statements and our financial condition or operating results.

In preparing this Annual Report on Form 10-K, as well as other periodic reports we are required to file under the Exchange Act, including our consolidated financial statements, our management is required under applicable rules and regulations to make estimates and assumptions as of a specified date. These estimates and assumptions are based on management’s best estimates and experience as of that date and are subject to substantial risk and uncertainty. Materially different results may occur as circumstances change and additional information becomes known. The area requiring significant estimates and assumptions by management include our evaluation of the adequacy of our allowance for credit losses.

Changes in accounting standards could affect reported earnings.

The regulatory bodies responsible for establishing accounting standards, including the FASB, the SEC and other regulatory bodies, periodically change the financial accounting and reporting guidance that governs the preparation of our consolidated financial statements. These changes can be hard to predict and can materially impact how we record and report our financial condition and results of operations. In some cases, we could be required to apply new or revised guidance retroactively.

Other Risks Related to Our Business

We operate as a community bank and our ability to maintain our reputation, which is critical to the success of our business, may materially adversely affect our performance.

We are a community bank, and our reputation is one of the most valuable components of our business. A key component of our business strategy is to rely on our reputation for customer service and knowledge of local markets to expand our presence by capturing new business opportunities from existing and prospective customers in our market area and contiguous areas.

Threats to our reputation can come from many sources, including adverse sentiment about financial institutions generally, unethical practices, employee misconduct, failure to deliver minimum standards of service or quality, compliance deficiencies, cybersecurity incidents and questionable or fraudulent activities of our customers. Negative publicity regarding our business, employees, or customers, with or without merit, may result in the loss of customers and employees, costly litigation and increased governmental regulation, any or all of which could adversely affect our business and operating results.

Societal responses to climate change could adversely affect our business and performance, including indirectly through impacts on our customers.

Concerns over the long-term impacts of climate change have led and will continue to lead to governmental efforts around the world to mitigate those impacts. Consumers and businesses also may change their behavior as a result of these concerns. We and our customers will need to respond to new laws and regulations as well as consumer and business preferences resulting from climate change concerns.

The impact on our customers will likely vary depending on their specific attributes, including reliance on or role in carbon intensive activities. Among the impacts to us could be a decrease in demand for our products and services, particularly in certain sectors. In addition, we could face reductions in creditworthiness on the part of some customers or in the value of assets securing loans. Our efforts to take these risks into account in making lending and other decisions, including by increasing our business with climate-friendly companies, may not be effective in protecting us from the negative impact of new laws and regulations or changes in consumer or business behavior.

65

Various factors may make takeover attempts more difficult to achieve.

Certain provisions of our articles of incorporation and bylaws and federal and state banking laws, including regulatory approval requirements, could make it more difficult for a third party to acquire control of the Company without our Board of Directors’ approval. Massachusetts and federal regulations applicable to the conversion state that for a period of three years following completion of our conversion, no person may offer to acquire or acquire beneficial ownership of more than 10% of our common stock without prior approval of the Federal Reserve Board. Under federal law, subject to certain exemptions, a person, entity or group must notify the Federal Reserve Board and receive the Federal Reserve Board’s non-objection before acquiring control of a bank holding company. There also are provisions in our articles of incorporation and bylaws that we may use to delay or block a takeover attempt, including a provision that prohibits any person from voting more than 10% of our outstanding shares of common stock. Furthermore, shares of restricted stock and stock options that we may grant to employees and directors, stock ownership by our management and directors and other factors may make it more difficult for companies or persons to acquire control of the Company, Inc. without the consent of our Board of Directors, and may increase the cost of an acquisition. Taken as a whole, these statutory or regulatory provisions and provisions in our articles of incorporation and bylaws could result in the Company, Inc. being less attractive to a potential acquirer and therefore could adversely affect the market price of our common stock.

Our articles of incorporation provide that, subject to limited exception, state and federal courts in the State of Maryland are the sole and exclusive forum for certain stockholder litigation matters, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers, and other employees.

The articles of incorporation of the Company provide that, unless the Company consents in writing to the selection of an alternative forum, the sole and exclusive forum for (i) any derivative action or proceeding brought on behalf of the Company, (ii) any action asserting a claim of breach of a fiduciary duty owed by any director, officer or other employee of the Company to the Company or its stockholders, (iii) any action asserting a claim arising pursuant to any provision of the Maryland General Corporation Law, or (iv) any action asserting a claim governed by the internal affairs doctrine will be conducted in a state or federal court located within the State of Maryland, in all cases subject to the court having personal jurisdiction over the indispensable parties named as defendants. This exclusive forum provision does not apply to claims arising under the federal securities laws. This exclusive forum provision may limit a stockholder’s ability to bring a claim in a judicial forum it finds favorable for disputes with the Company and its directors, officers, and other employees or may cause a stockholder to incur additional expense by having to bring a claim in a judicial forum that is distant from where the stockholder resides, or both. In addition, if a court were to find this exclusive forum provision to be inapplicable or unenforceable in a particular action, we may incur additional costs associated with resolving the action in another jurisdiction, which could have a material adverse effect on our financial condition and results of operations.

ITEM 1B. Unresolved Staff Comments

None.

ITEM 1C. Cybersecurity

The Company recognizes the importance of cybersecurity and the potential risks posed to our business operations, financial performance, and reputation. Cybersecurity is a significant and integrated component of the Company’s risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company. Cybersecurity risks and threats include, but are not limited to, unauthorized access, use, disclosure, modification, or destruction of our information systems, data, or network; denial of service attacks; malware; ransomware; phishing; social engineering; and cyberattacks by hackers, state-sponsored actors, or other malicious third parties and is compounded by the advent and availability of artificial intelligence tools.

66

To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes establishing a cybersecurity risk management framework that aligns with industry standards and best practices provided by the National Institute of Standards and Technology, employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response that ensure compliance with applicable laws, regulations and obligations, such as the Gramm-Leach-Bliley Act, the Federal Financial Institutions Examination Council (“FFIEC”) Cybersecurity Assessment Tool, and the Ransomware Self-Assessment Tool. Additionally, we have implemented various technical measures to prevent, detect, and respond to cybersecurity incidents, such as firewalls, third-party managed detection & response services, encryption, authentication, backup and recovery solutions. The Company engages third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits to regularly evaluate our cybersecurity posture in conjunction with obtaining cybersecurity insurance coverage to mitigate the potential financial impact of cybersecurity incidents.

The Board Enterprise Risk Management (“ERM”) Committee provides governance oversight of all risks faced by the Company, including cybersecurity and information technology general controls.

The Chief Information Officer (“CIO”) manages the IT Department and reports to the ERM and Chief Risk Officer (“CRO”) on these matters. The CIO also supervises the Information Security Officer (“ISO”) who is responsible for implementing and maintaining the Company’s Information Security Program. The Information Security Program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. Additional cybersecurity training to the ERM Committee is provided and overseen by the CRO and CIO. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Information Security Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to external and internal penetration testing, business continuity/ disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Company’s management-level Information Technology Steering Committee, and presents information security and cybersecurity updates on a regular basis to the Company’s Risk Committee, which consists of members of management, including the Chairman, President and Chief Executive Officer, Chief Operating Officer, and other senior leaders in the Company. The Risk Committee is responsible for identifying and assessing cybersecurity risks, developing and implementing risk mitigation strategies that align with the Bank’s corporate strategies, and ensuring compliance with applicable laws and regulations. The Bank’s Information Technology (“IT”) Steering Committee in conjunction with the Bank’s Project Management Office oversees the development and implementation of our cybersecurity strategy, financial planning, and capital allocation.

The Risk Committee provides executive management oversight, from a risk perspective, of information systems security. As referenced above, the CIO provides information security updates to the Risk Committee periodically. In addition, as discussed below, the Company has implemented an Incident Response Plan to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Company. The Incident Response Plan is implemented and maintained by members of senior management and is subject to annual review and periodic updates. The Incident Response Plan is implemented and maintained by the CIO and ISO and is subject to annual review and approval by the Risk Committee. Information security metrics are reported to both management level committees and the ERM Committee and Risk Committee on a quarterly basis.

The Board of Directors recognizes the importance of the FFIEC for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program.

We continually monitor and evaluate the evolving cybersecurity landscape and the potential impact of cybersecurity incidents on our business.

We may incur additional costs to enhance our cybersecurity processes and controls, to comply with new or changing laws, regulations, or contractual obligations, or to respond to or recover from cybersecurity incidents. We may also experience reputational harm or loss of customer confidence or trust as a result of cybersecurity incidents.

67

Any of these factors could have a material adverse effect on our business, financial condition, results of operations, and reputation.

Despite our efforts to enhance our cybersecurity posture, we cannot guarantee that our processes and controls will be sufficient to prevent or mitigate all cybersecurity risks and threats that we face. We may experience cybersecurity incidents that result in unauthorized access, use, disclosure, modification, or destruction of our information systems, data, or network; disruption or degradation of our operations; loss of customers or business opportunities; regulatory investigations or enforcement actions; litigation or liability; reputational damage; or increased costs.

Risk Assessment. On a periodic basis, but not less than annually, the CIO and ISO, in conjunction with Enterprise Risk Management, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Company’s Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The IT Steering Committee reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.

Response to Security Vulnerabilities. In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include:

Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches;
Ensuring that changes to security configurations are documented, approved, and tested;
Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs;
Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities;
Investing in additional technologies or resources to aid in the evaluation, identification and mitigation of risks;
Conducting subsequent penetration testing and vulnerability assessments, as warranted; and
Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.

Internal Controls, Audit, and Testing. Regular internal monitoring is integral to the Company’s risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis, which may identify additional risks or require additional costs to remediate.

Service Providers. The Company relies, in part, on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information.

In order to mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Vendor Risk Management Program, which is implemented through a Vendor Risk Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data.

68

The Vendor Risk Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Third Party Relationships: Risk Management. The Vendor Risk Management Program is subject to periodic audit based on the Company’s annual Internal Audit Risk Assessment. The Vendor Risk Management Program is audited as part of the Company’s annual Internal Audit Risk Assessment.

Employees and Training. Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting Company and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.

Board Reporting. At least annually, the CIO reports to the Board of Directors, directly or through the ERM Committee, the overall status of the Information Security Program and the Company’s compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management’s responses and any recommendations for program changes.

Program Adjustments. The CIO monitors, evaluates, and adjusts the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.

Incident Response Plan. To ensure that information security incidents can be recovered from quickly and with the least impact to the Company and its customers, the Company maintains a structured and systematic incident response plan (the “IRP”) for all information security incidents that affect any of the IT systems, network, or data of the Company, including the Company’s data held, or IT services provided by third-party vendors or other service providers. The CIO is responsible for implementing and maintaining the IRP, which includes:

Identifying the incident response team (“IRT”) and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents;
Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents;
Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures;
Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP;
Reviewing the IRP at least annually, or whenever there is a material change in the Company’s business practices that may reasonably affect its cyber incident response procedures and
Report up to the Executive Incident Response Committee, as needed.

69

Recently Filed
Click on a ticker to see risk factors
Ticker * File Date
SRRK 20 minutes ago
PASG 21 minutes ago
AMLX 26 minutes ago
HYMC 11 hours ago
ANIK 12 hours ago
DAAQ 12 hours ago
RAAQ 13 hours ago
HTLD 13 hours ago
NBBK 14 hours ago
AMRN 14 hours ago
CECO 14 hours ago
SIVR 14 hours ago
GLTR 14 hours ago
PALL 14 hours ago
PPLT 14 hours ago
SGOL 14 hours ago
LINC 14 hours ago
HSTA 14 hours ago
TPB 14 hours ago
BPOP 14 hours ago
RDNT 14 hours ago
SKWD 14 hours ago
AIV 14 hours ago
NVTS 3 days, 16 hours ago
DAN 3 days, 16 hours ago
FSBC 3 days, 16 hours ago
CLMB 3 days, 16 hours ago
NPKI 3 days, 17 hours ago
SBGI 3 days, 17 hours ago
BXP 3 days, 17 hours ago
SHO 3 days, 17 hours ago
HFWA 3 days, 17 hours ago
SSP 3 days, 17 hours ago
FBP 3 days, 17 hours ago
WULF 3 days, 17 hours ago
GSG 3 days, 17 hours ago
SLV 3 days, 17 hours ago
IBIT 3 days, 17 hours ago
IAUM 3 days, 17 hours ago
IAU 3 days, 17 hours ago
ETHA 3 days, 17 hours ago
SOLV 3 days, 17 hours ago
NWN 3 days, 18 hours ago
TDC 3 days, 18 hours ago
SAFT 3 days, 18 hours ago
RPC 3 days, 18 hours ago
FMAO 3 days, 18 hours ago
HMN 3 days, 18 hours ago
STLD 3 days, 18 hours ago
UBSI 3 days, 18 hours ago

OTHER DATASETS

House Trading

Dashboard

Corporate Flights

Dashboard

App Ratings

Dashboard