Risk Factors Dashboard

Once a year, publicly traded companies issue a comprehensive report of their business, called a 10-K. A component mandated in the 10-K is the ‘Risk Factors’ section, where companies disclose any major potential risks that they may face. This dashboard highlights all major changes and additions in new 10K reports, allowing investors to quickly identify new potential risks and opportunities.

Risk Factors - RBB

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

Item 1A. Risk Factors in particular) should not be construed as exhaustive and should be read together with the other cautionary statements included in this Annual Report. If one or more events related to these or other risks or uncertainties materialize, or if our underlying assumptions prove to be incorrect, actual results may differ materially from what we anticipate. Accordingly, you should not place undue reliance on any such forward-looking statements. Any forward-looking statement speaks only as of the date on which it is made, and we do not undertake any obligation to publicly update or review any forward-looking statement, whether as a result of new information, future developments or otherwise. New factors emerge from time to time, and it is not possible for us to predict which will arise. In addition, we cannot assess the impact of each factor on our business or the extent to which any factor, or combination of factors, may cause actual results to differ materially from those contained in any forward-looking statements.

PART I

Item 1. Business.

Company Overview

RBB Bancorp is a bank holding company registered under the Bank Holding Company Act of 1956, as amended. RBB Bancorp’s principal business is to serve as the holding company for its wholly-owned banking subsidiaries, Royal Business Bank (“Bank”) and RBB Asset Management Company (“RAM”), collectively referred to herein as "the Company." RBB Bancorp was formed in January 2011 as a bank holding company and RAM was formed in 2012 to hold and manage problem assets acquired in business combinations. There are no problem assets at RAM or activity in this subsidiary for the fiscal years ended 2025 or 2024. When we refer to “we”, “us”, “our”, or the “Company”, we are referring to RBB Bancorp and its consolidated subsidiaries including the Bank, collectively. When we refer to the “parent company”, “Bancorp”, or the “holding company”, we are referring to RBB Bancorp, the parent company, on a stand-alone basis.

The Bank provides business-banking and consumer products and services predominantly to the Asian-centric communities through full service branches located in Los Angeles County, Orange County and Ventura County in California, Las Vegas (Nevada), the New York City metropolitan areas, Chicago (Illinois), Edison (New Jersey) and Honolulu (Hawaii). The products and services include commercial and investor real estate loans, business loans and lines of credit, Small Business Administration (“SBA”) 7A and 504 loans, mortgage loans, trade finance and a full range of depository accounts, including specialized services such as remote deposit, E-banking, mobile banking and treasury management services.

We have supported our organic growth with disciplined strategic growth. Between 2011 and 2018 we successfully completed six whole-bank acquisitions and, in 2022, a bank branch acquisition in Hawaii. All of our acquisitions have been accounted for using the acquisition method of accounting and, accordingly, the operating results of the acquired entities have been included in the consolidated financial statements from their respective acquisition dates.

We will continue to consider opportunistic acquisitions that we believe will be beneficial to our long-term growth strategy and will be accretive to our shareholders.

We operate as a minority depository institution (“MDI”), which is defined by the Federal Deposit Insurance Corporation (“FDIC”) as a federally insured depository institution ("IDI") where 51% or more of the voting stock is owned by minority individuals or a majority of the board of directors is minority and the community that the institution serves is predominantly minority. A MDI is eligible to receive support from the FDIC and other federal regulatory agencies such as training, technical assistance and review of proposed new deposit taking and lending programs, and the adoption of applicable policies and procedures governing such programs. We intend to maintain our MDI designation, as it is expected that at least 51% of our issued and outstanding shares of capital shall remain owned by minority individuals. The MDI designation has been historically beneficial to us, and we continue to use the program for technical assistance.

We operate 24 banking offices in Arcadia, Cerritos, Diamond Bar, Irvine, Los Angeles, Monterey Park, Oxnard, Rowland Heights, San Gabriel, Silver Lake, Torrance, and Westlake Village, California; Las Vegas, Nevada; Manhattan, Brooklyn, Flushing, and Elmhurst, New York; the Chinatown and Bridgeport neighborhoods of Chicago, Illinois; Edison, New Jersey; and Honolulu, Hawaii. Our primary source of revenue is providing loans to customers, who are predominantly small and middle-market businesses and individuals.

We generate our revenue primarily from interest received on loans and, to a lesser extent, from interest received on investment securities. We also derive income from noninterest sources, such as fees received in connection with various lending and deposit services, loan servicing, gain on sales of loans and wealth management services. Our principal expenses include interest expense on deposits and borrowings, and operating expenses, such as salaries and employee benefits, occupancy and equipment, data processing, and income tax expense.

We completed six whole bank acquisitions and one branch acquisition from July 2011 through January 2022. All of our acquisitions have been accounted for using the acquisition method of accounting and, accordingly, the operating results of the acquired entities have been included in the consolidated financial statements from their respective acquisition dates.

As of December 31, 2025, we had total consolidated assets of $4.2 billion, gross consolidated loans of $3.3 billion, deposits of $3.4 billion and shareholders’ equity of $523.4 million. Our common stock is traded on the NASDAQ Global Select Market under the symbol “RBB.

Our Strategic Plan

We update our strategic plan annually to reflect our growth, recent developments and describe our business objectives over a reasonable planning horizon. Our current strategic plan contains the following key elements:

Maintain regulatory capital levels in excess of Basel III requirements;

Provide commercial banking services and products primarily to small to midsized commercial enterprises operating within Asian-centric communities or that can benefit from our areas of core lending expertise;

Maintain a board of directors comprised of business leaders who work closely with community leaders;

Attract and retain an experienced management team with demonstrated industry knowledge and lending expertise;

Focus on a target market consisting of businesses that:

o

are located in southern California, the San Francisco Bay area, the Chicago metropolitan area, the New York metropolitan area (including northern New Jersey), Nevada and Hawaii;

o

provide or receive goods or services to or from Asian countries, primarily Chinese-speaking regions, such as China, Hong Kong, Macau, Taiwan;

o have loan needs of $1 million to $20 million (average loan size of $3 million to $7 million); and

o

prioritize using bankers with strong market knowledge who are dedicated to serving the local markets in which we operate.

Provide five main lending products:

1)

Commercial real estate (“CRE”) lending consisting of owner occupied and non-owner occupied commercial property, including loans secured by single-family residences for a business purposes and multi-family residential property;

2) Construction and land development (“C&D”) loans comprised of residential construction, commercial construction and land acquisition and development construction;

3)

Commercial and Industrial (“C&I”) lending that emphasizes asset-based lending, trade finance, working capital lines of credit, and term loans secured by inventory, accounts receivables, fixed assets and real estate;

4)

Single-family residential (“SFR”) mortgage lending primarily to Asian-Americans willing to provide higher down payment amounts and pay higher fees and interest rates in return for reduced documentation requirements. The Company originates these loans through its correspondent banking relationships, and through its branch network. In addition, we offer 15-year and 30-year qualified mortgage loans that are sold directly to the Federal National Mortgage Association (“FNMA”) and Federal Home Loan Mortgage Corporation (“FHLMC”), and in most cases, the Company retains the loan servicing rights and obligations; and

5)

Small Business Administration (“SBA”) loans consisting primarily of 7(a) loans through our SBA Preferred Lender status with the ability to sell the SBA guarantee portion of the loan in the secondary market subject to market conditions.

Our Competition

We view the Asian-centric banking market, including the Company, as comprised of banks divided into three overlapping segments: publicly-traded banks, locally-based banks, and banks that are subsidiaries of Taiwanese or Chinese banks. These banks promote competition for attracting deposits and making loans in the markets we target.

In addition to Chinese-American banks, we also compete with other banks in the region for deposits, loans, and other banking products. Although we were founded by and market primarily to Chinese-Americans, we have broadened our marketing efforts to include all Asian-American communities. In certain geographic markets where we currently operate, there is an overlap between Chinese-American, Korean-American, and other Asian-American banks for loan and deposit business. We aim to grow both organically and potentially through opportunistic acquisitions in these markets.

Lending Activities

We seek to be the premier provider of lending products and services in our market areas and serve the credit needs of high quality business and individual borrowers in the communities we serve. Our lending strategy is to maintain a broadly diversified loan portfolio based on the type of customer (e.g., businesses versus individuals), type of loan product (e.g., owner occupied commercial real estate, commercial loans, etc.), geographic location and industries in which our business customers are engaged. We principally focus our lending activities on loans that we originate from borrowers located in our market areas.

We strive to expedite all requests from potential borrowers by promptly responding after we receive the required financials and certain preliminary information. Our ability to provide quick responses to borrowers with financial solutions, while performing appropriate underwriting if a borrower decides to move forward, is primarily due to our experienced banking professionals who understand the needs of borrowers in our target markets and their expertise in the Company’s commercial lending practices. In addition, our credit approval process is streamlined since decision-making often only requires a couple of key executive management members while any loans that exceed executive management's delegated authority is elevated to a board loan committee which meets at regularly scheduled meetings and whenever needed.

We have five principal lending areas:

SFR Loans. We originate qualified SFR mortgage loans and non-qualified, alternative documentation SFR mortgage loans through wholesale and retail channels, including our branch network, to accommodate the needs of the Asian-centric and selected niche markets. The qualified SFR mortgage loans are 15-year and 30-year conforming mortgages and may be sold directly to FNMA and FHLMC. As of December 31, 2025, we had $1.66 billion of SFR mortgage loans, representing 50.0% of our total loan portfolio compared to $1.49 billion, or 48.9% at December 31, 2024. We had $2.1 million in non-accrual SFR real estate loans as of December 31, 2025, compared to $11.5 million in non-accrual loans at December 31, 2024.

We originate non-qualified SFR mortgage loans generally to hold for investment. The loans generated through our retail branch network are to our customers and referrals, many of whom establish a deposit relationship with us. During 2025, we originated $202.8 million of SFR mortgage loans through our retail channel and $210.9 million of such loans through our wholesale channels. During 2024, we originated $102.8 million of SFR mortgage loans through our retail channel and $80.4 million of such loans through our wholesale channels.

We have sold non-qualified SFR mortgage loans to other banks and investors. SFR mortgage loans held for sale ("HFS") consist primarily of first trust deed mortgages on SFR properties located in California, New York, Illinois, and New Jersey. SFR mortgage loans HFS are generally sold with the servicing rights retained, however most recent loan sales have been servicing released.

In 2025, we identified new channels for secondary market sales for SFR loans that the Bank originated. We completed two sales transactions with two other counterparties, both insured US banks, in addition to other bidders for our mortgage products, which creates a lever for liquidity and additional fee income. As we identify additional counterparties who are able and willing to purchase our SFR mortgage loans, we expect to use this channel to grow additional fee income while increasing origination volume.

Commercial Real Estate Loans. We offer real estate loans for owner occupied and non-owner occupied commercial property, including loans secured by single-family residences for business purposes, multi-family residential property and construction and land development loans. Our management team has an extensive knowledge of the markets where we operate and our borrowers; we take a conservative approach to CRE lending, focus on high quality credits with low loan-to-value ratios, income-producing properties with stable cash flow, and strong collateral profiles. The real estate securing our existing CRE loans includes a wide variety of property types, such as multi-family properties, mixed-use residential and commercial, mobile home parks, hotels, offices, apartments, warehouses and retail centers.
The total CRE portfolio was $1.3 billion, or 39.3% of our total loan portfolio, at December 31, 2025, of which $154.7 million was secured by owner occupied properties, compared to $1.2 billion, or 39.3% of our total loan portfolio, at December 31, 2024, of which $160.2 million was secured by owner occupied properties. The multi-family residential loan portfolio totaled $745.3 million as of December 31, 2025, compared to $605.5 million as of December 31, 2024. Nonaccrual CRE loans totaled $8.2 million at December 31, 2025, and $17.1 million at December 31, 2024, of which $9.7 million were held for sale.
Construction and Land Development Loans. Our C&D loans are comprised of residential construction, commercial construction and land acquisition and development construction. Interest reserves are generally established on real estate construction loans. As of December 31, 2025, our real estate construction loan portfolio totaled $155.5 million, or 4.7% of our total loan portfolio, and was divided among the following categories: $100.0 million of commercial construction; $ 51.8 million of residential construction; and $ 3.6 million of land acquisition and development. As of December 31, 2024, the C&D loans totaled $173.3 million and were comprised of $98.0 million of commercial construction; $58.4 million of residential construction; and $17.0 million of land acquisition and development. There were $ 28.0 million non-accrual C&D loans as of December 31, 2025, compared to $44.6 million as of December 31, 2024.

Commercial and Industrial Loans. We have significant expertise in small to middle market C&I lending. Our success is the result of our products and market expertise. We focus on delivering high-quality, customized and quick turnaround service for our clients while maintaining an appropriate balance between disciplined underwriting and flexibility and responsiveness to our clients. Our trade financing unit provides international letters of credit, SWIFT, export advice, trade finance discounts and foreign exchange to many of our C&I loan customers. As of December 31, 2025, we had outstanding C&I loans of $140.1 million, or 4.2% of our total loan portfolio, compared to $129.6 million, or 4.2% of our total loan portfolio as of December 31, 2024. C&I loans on nonaccrual totaled $5.1 million at December 31, 2025, and $6.3 million at December 31, 2024, of which $1.5 million were held for sale.

SBA Loans. We are designated as a Preferred Lender under the SBA Preferred Lender Program. We offer SBA 7(a) variable-rate loans. We originate all loans to hold for investment and move loans to available for sale as management decides which loans to sell. We generally sell the guaranteed portion of the SBA loans that we originate. Our SBA loans are typically made to small-sized manufacturing, wholesale, retail, hotel/motel and service businesses for working capital needs or business expansions. SBA loans can have any maturity up to 25 years. Typically, non-real estate secured loans mature in less than 10 years. Collateral may include inventory, accounts receivable and equipment, and personal guarantees. From time to time, we also originate SBA 504 loans. As of December 31, 2025, our SBA loan portfolio totaled $56.0 million, or 1.7% of our total loan portfolio compared to $47.3 million, or 1.5% at December 31, 2024. Our non-accrual SBA loans as of December 31, 2025, were $1.2 million, compared to $1.5 million as of December 31, 2024.

Deposits

The quality of our deposit franchise and access to stable funding are key components to our success. We offer traditional depository products, including checking, savings, money market and time deposits, to individuals, businesses, municipalities and other entities through our branch network. In addition, we offer retail deposit products where customers are able to achieve FDIC insurance for balances on deposit in excess of the $250,000 FDIC limit through the Certificate of Deposit Account Registry Service (“CDARS”) and Insured Cash Sweep (“ICS”) programs. Deposits are insured by the FDIC up to statutory limits. Time deposits include deposits acquired through both retail and wholesale channels. Wholesale channels include brokered deposits, collateralized deposits from the State of California, and deposits acquired through internet listing services.

As an Asian-centric business bank that focuses on successful businesses and their owners, many of our depositors choose to leave large deposits with us. We monitor all deposit relationships over $250,000 on a quarterly basis and consider a relationship to be stable if there are any three or more of the following characteristics: (i) relationships with us (as a director or shareholder); (ii) deposits within our market area; (iii) additional non-deposit services with us; (iv) electronic banking services with us; (v) active demand deposit account with us; (vi) deposits at market interest rates; and (vii) longevity of the relationship with us. As many of our customers have more than $250,000 on deposit with us, we believe that using this method reflects a more accurate assessment of the stability of our deposit base. At December 31, 2025, $2.7 billion, or 80.6%, of our relationships are less than or equal to $250,000 or are over $250,000 and meet our defined criteria to be considered a stable deposit.

Many of our management team members, including our branch managers, have worked together for up to 30 years, and our deposits relationships have been cultivated over that time period. Our ability to gather deposits, particularly stable deposits, is an important aspect of our business franchise and we believe these deposits are a significant driver of franchise value as a cost efficient and stable source of funding to support our growth. As of December 31, 2025, we had $3.4 billion of total deposits, with a weighted average spot rate of 2.90%.

Other Subsidiaries

In addition to the Bank and RAM, the Bancorp has three statutory business trusts acquired through our business acquisitions as follows:

TFC Statutory Trust. In connection with our 2016 acquisition of TomatoBank and its holding company, TFC, we acquired the TFC Statutory Trust (the “TFC Trust”), a statutory business trust that was established by TFC in 2006 under the laws of Connecticut as a wholly-owned subsidiary.

FAIC Statutory Trust I. In connection with our 2018 acquisition of First American International Bank ("FAIB") and its holding company, First American International Corp. ("FAIC"), we acquired the FAIC Statutory Trust I (“FAIC Trust I”), a statutory business trust that was established by FAIC in 2004 under the laws of Delaware as a wholly-owned subsidiary.

PGBH Trust I. In connection with our 2020 acquisition of PGB and its holding company, PGBH, we acquired Pacific Global Bank Trust I (“PGB Capital Trust I”), a statutory business trust that was established by PGB in 2004 under the laws of Delaware as a wholly-owned subsidiary.

Each of the foregoing trusts issued trust preferred securities representing undivided preferred beneficial interests in the assets of the trusts. The proceeds of these trusts preferred securities were invested in certain securities issued by us, with similar terms to the relevant series of securities issued by the trusts, which we refer to as subordinated debentures. We guarantee on a limited basis the payments of distributions on the capital securities of the trusts and payments on redemption of the capital securities of the trusts. We are the owner of all the beneficial interests represented by the common securities of the trusts.

In addition, the Bank has a wholly-owned subsidiary, FAIB Capital Corp. ("FAIBCC"), a real estate investment trust, which was acquired through the acquisition of FAIC in 2018. FAIBCC is a New York State corporation formed on August 28, 2013. The purpose of this real estate investment trust is to minimize New York State and local taxes. As of December 31, 2025, FAIBCC had $533.7 million in assets.

Human Capital Resources

We believe in the value of teamwork and the power of participation and collaboration. We cultivate an environment where it is understood that we need each other to be successful. We value accountability because it is essential to our success, and we accept our responsibility to hold ourselves and others accountable for meeting shareholder commitments and achieving exceptional standards of performance. We are committed to fostering an inclusive environment that empowers our employees to make more meaningful contributions within our Company and the communities we serve.

Staffing Model. The majority of our staff are regular full-time employees, however we also employ regular part-time associates. We do not outsource job functions or use subcontractors to fill open positions, and rarely use seasonal or temporary employees. None of our employees are represented by any collective bargaining unit or are parties to a collective bargaining agreement. As of December 31, 2025, we had 369 full-time equivalent employees.

Health & Safety. We are focused on conducting our business in a safe manner and in compliance with all local, state and federal safety and health regulations, and special safety concerns.

Benefits. We are committed to offering a competitive total compensation package. We regularly compare compensation and benefits with peer companies and market data, making adjustments as needed to ensure compensation stays competitive. We also offer a wide array of benefits for our associates and their families, including:

Competitive bonus programs;

Comprehensive medical, dental and vision benefits;

401(k) plan including a competitive company match;

Flexible work schedules;

Paid time off, holidays and bank holidays;

Internal training and development; and

Employee Assistance Plans.

Corporate Information

Our principal executive offices are located at 1055 Wilshire Blvd. Suite 1200, Los Angeles, California 90017, and our telephone number at that address is (213) 627-9888.

Available Information

We invite you to visit our website at www.royalbusinessbankusa.com, to access free of charge our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and amendments to those reports, all of which are made available as soon as reasonably practicable after we electronically file such material with or furnish it to the SEC. The content of our website is not incorporated into and is not part of this Annual Report. In addition, you can write to us to obtain a free copy of any of those reports at RBB Bancorp, 1055 Wilshire Blvd. Suite 1200, Los Angeles, California 90017, Attn: Investor Relations. These reports are also available through the SEC’s Public Reference Room, located at 100 F Street NE, Washington, DC 20549 and online at the SEC’s website, available at http://www.sec.gov. Investors can obtain information about the operation of the SEC’s Public Reference Room by calling 800-SEC-0330. Our Code of Ethics and other corporate governance documents are located on our website at www.royalbusinessbankusa.com.

Supervision and Regulation

General

Financial institutions, their holding companies and their affiliates are extensively regulated under U.S. federal and state laws. As a result, our growth and earnings performance may be affected not only by management decisions and general economic conditions, but also by the requirements of federal and state statutes and by the regulations and policies of various bank regulatory agencies, including the DFPI, the Board of Governors of the Federal Reserve System (“Federal Reserve”), the FDIC, and the CFPB. Furthermore, tax laws administered by the Internal Revenue Service and state taxing authorities, accounting rules developed by the FASB, securities laws administered by the SEC and state securities authorities, anti-money laundering laws enforced by the Treasury, and mortgage related rules, including with respect to loan securitization and servicing by the U.S. Department of Housing and Urban Development, and agencies such as FNMA and FHLMC, have an impact on our business. The effect of these statutes, regulations, regulatory policies and rules are significant to the financial condition and results of operations of the Company and its subsidiaries, including the Bank, and the nature and extent of future legislative, regulatory or other changes affecting financial institutions are impossible to predict with any certainty. This summary is qualified in its entirety by reference to the particular statute and regulatory provision referred to below and is not intended to be an exhaustive description of all applicable statutes and regulations.

Bancorp, as the sole shareholder of the Bank, is a bank holding company under federal law and regulation. As a bank holding company, Bancorp is registered with, and is subject to regulation by, the Federal Reserve under the Bank Holding Company Act of 1956, as amended (“BHCA”). Under the BHCA, Bancorp is subject to periodic examination by the Federal Reserve. Bancorp is required to file with the Federal Reserve periodic reports of Bancorp’s operations and such additional information regarding Bancorp and its subsidiaries as the Federal Reserve may require. Bancorp is also a bank holding company within the meaning of Section 1280 of the California Financial Code. Therefore, Bancorp and its subsidiaries are subject to examination by, and may be required to file reports with the DFPI.

Under changes made by the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”), a bank holding company must act as a source of financial and managerial strength to each of its subsidiary banks and commit resources to support each such subsidiary bank. In order to fulfill its obligations as a source of strength, the Federal Reserve may require a bank holding company to make capital injections into a troubled subsidiary bank. In addition, the Federal Reserve may charge the bank holding company with engaging in unsafe and unsound practices if the bank holding company fails to commit resources to a subsidiary bank or if it undertakes actions that the Federal Reserve believes might jeopardize the bank holding company’s ability to commit resources to such subsidiary bank. The Federal Reserve also has the authority to require a bank holding company to terminate any activity or to relinquish control of a nonbank subsidiary (other than a nonbank subsidiary of a bank) upon the Federal Reserve’s determination that such activity or control constitutes a serious risk to the financial soundness and stability of any bank subsidiary of the bank holding company.

The Bank is a California-chartered bank, but is not a member of the Federal Reserve System (a “non-member bank”). The deposit accounts of the Bank are insured by the FDIC’s Deposit Insurance Fund (“DIF”) to the maximum extent provided under federal law and FDIC regulations. As a California-chartered FDIC-insured non-member bank, the Bank is subject to the examination, supervision, reporting and enforcement requirements of the DFPI, the chartering authority for California banks, and as a non-member bank, the FDIC.

California-chartered banks are required to pay supervisory assessments to the DFPI to fund its operations. The amount of the assessment paid by a California bank to the DFPI is calculated on the basis of the institution’s total assets, including consolidated subsidiaries, as reported to the DFPI. During the years ended December 31, 2025 and 2024, the Bank paid supervisory assessments to the DFPI totaling $310,000 and $303,000.

The Bank operates branches in California, Illinois, Nevada, New York, New Jersey and Hawaii. While the DFPI remains the Bank’s primary state regulator, the Bank’s operations in these jurisdictions are subject to examination and supervision by local bank regulators, and transactions with customers in those jurisdictions are subject to local laws, including consumer protection laws.

Legislative and regulatory initiatives, which necessarily impact the regulation of the financial services industry, are introduced from time-to-time. We cannot predict whether or when potential legislation or new regulations will be enacted, and if enacted, the effect that new legislation or any implemented regulations and supervisory policies would have on our financial condition and results of operations. Further, we generally retain the non-guaranteed portions of the SBA loans that we originate and sell, and to the extent the borrowers of such loans experience financial difficulties, our financial condition and results of operations could be adversely impacted. The Dodd-Frank Act, by way of example, contains a comprehensive set of provisions designed to govern the practices and oversight of financial institutions and other participants in the financial markets. The Dodd-Frank Act made extensive changes in the regulation of financial institutions and their holding companies. Some of the changes brought about by the Dodd-Frank Act have been modified by the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 (the “Regulatory Relief Act”), signed into law on May 24, 2018. The Dodd-Frank Act has increased the regulatory burden and compliance costs of the Company. Moreover, bank regulatory agencies can be more aggressive in responding to concerns and trends identified in examinations, which could result in an increased issuance of enforcement actions to financial institutions requiring action to address credit quality, liquidity, risk management, and capital adequacy, as well as other safety and soundness concerns.

Acquisitions, Activities and Change in Control

The primary purpose of a bank holding company is to control and manage banks. The BHCA generally requires the prior approval by the Federal Reserve for any merger involving a bank holding company or any acquisition of control by a bank holding company of another bank or bank holding company. Subject to certain conditions (including deposit concentration limits established by the BHCA and the Dodd-Frank Act), the Federal Reserve may allow a bank holding company to acquire banks located in any state of the United States. In approving interstate acquisitions, the Federal Reserve is required to give effect to applicable state law limitations on the aggregate amount of deposits that may be held by the acquiring bank holding company and its IDI affiliates in the state in which the target bank is located (provided that those limits do not discriminate against out-of-state depository institutions or their holding companies) and state laws that require that the target bank have been in existence for a minimum period of time (not to exceed five years) before being acquired by an out-of-state bank holding company. Furthermore, in accordance with the Dodd-Frank Act, bank holding companies must be well-capitalized and well-managed in order to effect interstate mergers or acquisitions.

The BHCA generally prohibits Bancorp from acquiring direct or indirect ownership or control of more than 5% of the voting shares of any company that is not a bank and from engaging in any business other than that of banking, managing and controlling banks or furnishing services to banks and their subsidiaries. This general prohibition is subject to a number of exceptions. The principal exception allows bank holding companies to engage in, and to own shares of companies engaged in, certain businesses found by the Federal Reserve prior to November 11, 1999 to be “so closely related to banking as to be a proper incident thereto.” This authority would permit Bancorp to engage in a variety of banking-related businesses, including the ownership and operation of a savings association, or any entity engaged in consumer finance, equipment leasing, the operation of a computer service bureau (including software development) and mortgage banking and brokerage. The BHCA generally does not place territorial restrictions on the domestic activities of nonbank subsidiaries of bank holding companies.

Additionally, bank holding companies that meet certain eligibility requirements prescribed by the BHCA and elect to operate as financial holding companies may engage in, or own shares in companies engaged in, a wider range of nonbanking activities, including securities and insurance underwriting and sales, merchant banking and any other activity that the Federal Reserve, in consultation with the Secretary of the Treasury, determines by regulation or order is financial in nature or incidental to any such financial activity or that the Federal Reserve determines by order to be complementary to any such financial activity and does not pose a substantial risk to the safety or soundness of depository institutions or the financial system generally. Bancorp has elected to be a bank holding company.

In order to maintain Bancorp’s status as a bank holding company, Bancorp and the Bank must be well-capitalized, well-managed, and have at least a satisfactory CRA rating. If the Federal Reserve subsequently determines that Bancorp, as a bank holding company, is not well-capitalized or well-managed, Bancorp would have a period of time during which to achieve compliance, but during the period of noncompliance, the Federal Reserve may place any limitations on Bancorp it believes to be appropriate. Furthermore, if the Federal Reserve subsequently determines that the Bank, as a bank holding company subsidiary, has not received a satisfactory CRA rating, Bancorp would not be able to commence any new financial activities or acquire a company that engages in such activities.

Federal law also prohibits any person or company from acquiring “control” of an FDIC-insured depository institution or its holding company without prior notice to the appropriate federal bank regulator. “Control” is conclusively presumed to exist upon the acquisition of 25% or more of the outstanding voting securities of a bank or bank holding company, but may arise under certain circumstances between 5% and 24.99% ownership.

Under the California Financial Code, any proposed acquisition of “control” of the Bank by any person (including a company) must be approved by the Commissioner of the DFPI. The California Financial Code defines “control” as the power, directly or indirectly, to direct the Bank’s management or policies or to vote 25% or more of any class of the Bank’s outstanding voting securities. Additionally, a rebuttable presumption of control arises when any person (including a company) seeks to acquire, directly or indirectly, 10% or more of any class of the Bank’s outstanding voting securities.

The Consumer Financial Protection Bureau

The Dodd-Frank Act provided for the creation of the CFPB as an independent entity within the Federal Reserve with broad rulemaking, supervisory, and enforcement authority over consumer financial products and services, including deposit products, residential mortgages, home-equity loans and credit cards. The CFPB’s functions include investigating consumer complaints, conducting market research, rulemaking, supervising and examining bank consumer transactions, and enforcing rules related to consumer financial products and services. CFPB regulations and guidance apply to all financial institutions and banks with $10 billion or more in assets, which are also subject to examination by the CFPB. As the Bank has less than $10 billion in assets, it is not examined by the CFPB for compliance with CFPB regulations, although it is examined by the FDIC and the DFPI.

The CFPB has enforcement authority over unfair, deceptive or abusive acts and practices (“UDAAP”). UDAAP is considered one of the most far reaching enforcement tools at the disposal of the CFPB and covers all consumer and small business financial products or services such as deposit and lending products or services such as overdraft programs and third-party payroll card vendors. It is a wide-ranging regulatory net that potentially picks up the gaps not included in other consumer laws, rules and regulations. Violations of UDAAP can be found in many areas and can include advertising and marketing materials, the order of processing and paying items in a checking account or the design of client overdraft programs. The scope of coverage includes not only direct interactions with clients and prospects but also actions by third-party service providers. The Dodd-Frank Act does not prevent states from adopting stricter consumer protection standards. State regulation of financial products and potential enforcement actions could also adversely affect our business, financial condition or results of operations.

Regulatory Capital Requirements

Bank holding companies and banks are subject to various regulatory capital requirements administered by state and federal agencies. These agencies may establish higher minimum requirements if, for example, a banking organization previously has received special attention or has a high susceptibility to interest rate risk. Risk-based capital requirements determine the adequacy of capital based on the risk inherent in various classes of assets and off-balance sheet items. Under the Dodd-Frank Act, the Federal Reserve must apply consolidated capital requirements to depository institution holding companies that are no less stringent than those currently applied to depository institutions. The Dodd-Frank Act additionally requires capital requirements to be countercyclical so that the required amount of capital increases in times of economic expansion and decreases in times of economic contraction, consistent with safety and soundness.

Under federal regulations, bank holding companies and banks must meet certain risk-based capital requirements. Basel III is currently applicable to Bancorp and the Bank. Basel III requires financial institutions to maintain a minimum “capital conservation buffer” on top of each of the minimum-risk based capital ratios to avoid restrictions on capital distributions such as dividends and equity repurchases and other payments such as discretionary bonuses to executive officers.

Basel III subjects bank holding companies and banks to the following risk-based capital requirements:

a minimum ratio of CET1 to risk-weighted assets of at least 4.5%, plus a 2.5% “capital conservation buffer,” or 7.0%;

a minimum ratio of Tier 1 capital to risk-weighted assets of at least 6.0%, plus the capital conservation buffer, or 8.5%;

a minimum ratio of Total (Tier 1 plus Tier 2) capital to risk-weighted assets of at least 8.0%, plus the capital conservation buffer, or 10.5%; and

a minimum leverage ratio of 4%, calculated as the ratio of Tier 1 capital to balance sheet exposures plus certain off-balance sheet exposures.

To be considered “well capitalized,” a bank holding company or bank must have the following minimum ratios: (i) a CET1 capital ratio of 6.5%, (ii) a Tier 1 risk-based capital ratio of 8.0%, (iii) a Total risk-based capital ratio of 10.0%, and (iv) a Tier 1 leverage ratio of 5.0%. As of December 31, 2025, the Company's capital ratios exceeded the minimum capital adequacy guideline percentage requirements to be considered "well capitalized" under the Basel III capital rules.

The Basel III final framework provides for a number of deductions from and adjustments to CET1. These include, for example, a limitation on the amount of mortgage servicing rights, deferred tax assets dependent upon future taxable income and significant investments in non-consolidated financial entities that may be held on a Bank's balance sheet, with any excess to be deducted from CET1. Basel III also includes, as part of the definition of CET1 capital, a requirement that banking institutions include the amount of Additional Other Comprehensive Income (“AOCI”), which primarily consists of unrealized gains and losses on available for sale securities, which are not required to be treated as other-than-temporary impairment, net of tax, in calculating regulatory capital. Banking institutions had the option to opt out of including AOCI in CET1 capital if they elected to do so in their first regulatory report following January 1, 2015. As permitted by Basel III, we elected to exclude AOCI from CET1.

The Dodd-Frank Act excludes trust preferred securities issued after May 19, 2010 from being included in Tier 1 capital, unless the issuing company is a bank holding company with less than $500 million in total assets. Trust preferred securities issued prior to that date will continue to count as Tier 1 capital for bank holding companies with less than $15 billion in total assets. The trust preferred securities issued by our unconsolidated subsidiary capital trusts qualify as Tier 1 capital up to a maximum limit of 25% of total Tier 1 capital. Any additional portion of our trust preferred securities would qualify as “Tier 2 capital.

In addition, goodwill and most intangible assets are deducted from Tier 1 capital. For purposes of applicable total risk-based capital regulatory guidelines, Tier 2 capital (sometimes referred to as “supplementary capital”) is defined to include, subject to limitations: perpetual preferred stock not included in Tier 1 capital, intermediate-term preferred stock and any related surplus, certain hybrid capital instruments, perpetual debt and mandatory convertible debt securities, allowances for credit losses, and intermediate-term subordinated debt instruments. The maximum amount of qualifying Tier 2 capital is 100% of qualifying Tier 1 capital. For purposes of determining total capital under federal guidelines, total capital equals Tier 1 capital, plus qualifying Tier 2 capital, minus investments in unconsolidated subsidiaries, reciprocal holdings of bank holding company capital securities, and deferred tax assets and other deductions.

We had outstanding subordinated debentures and subordinated notes in the aggregate principal amount of $135.3 million as of December 31, 2025. Of this amount, $15.4 million is attributable to subordinated debentures issued to statutory trusts in connection with prior issuances of trust preferred securities, which qualifies as Tier 1 capital, and $119.9 million is attributable to outstanding subordinated notes, which qualifies as Tier 2 capital.

In addition to the uniform risk-based capital guidelines and regulatory capital ratios that apply across the industry, the regulators have the discretion to set individual minimum capital requirements for specific institutions at rates significantly above the minimum guidelines and ratios. Future changes in regulations or practices could further reduce the amount of capital recognized for purposes of capital adequacy. Such a change could affect our ability to grow and could restrict the amount of profits, if any, available for the payment of dividends.

In addition, the Dodd-Frank Act requires the federal banking agencies to adopt capital requirements that address the risks that the activities of an institution poses to the institution and the public and private stakeholders, including risks arising from certain enumerated activities.

In February 2019, the U.S. federal bank regulatory agencies approved a final rule modifying their regulatory capital rules and providing an option to phase-in over a three-year period the Day 1 adverse regulatory capital effects of CECL accounting standard. Additionally, in March 2020, the U.S. federal bank regulatory agencies issued an interim final rule that provided banking organizations an option to delay the estimated CECL impact on regulatory capital for an additional two years for a total transition period of up to five years to provide regulatory relief to banking organizations to better focus on supporting lending to creditworthy households and businesses in light of strains on the U.S. economy as a result of the COVID-19 pandemic. Effective January 1, 2022, we adopted ASU 2016-13, reflected the full effect of CECL at December 31, 2022, and did not elect the three-year or five-year CECL phase-in options on regulatory capital.

Prompt Corrective Action

The Federal Deposit Insurance Act ("FDIA") requires federal banking agencies to take “prompt corrective action” (“PCA”) in respect to depository institutions that do not meet minimum capital requirements. The FDIA includes the following five capital tiers: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” A depository institution’s capital tier will depend upon how its capital levels compare with various relevant capital measures and certain other factors, as established by regulation. Effective January 1, 2015, the Basel III Capital Rules revised the PCA requirements. Under the revised PCA provisions of the FDIA, an IDI generally will be classified in the following categories based on the capital measures indicated:

As of December 31, 2025, the Bank’s capital ratios exceeded the minimum capital adequacy guideline percentage requirements of the federal banking agencies for “well capitalized” institutions under the Basel III capital rules on a fully phased-in basis.

An institution may be downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios if it is determined to be in an unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters. A bank’s capital category is determined solely for the purpose of applying PCA regulations and the capital category may not constitute an accurate representation of such bank’s overall financial condition or prospects for other purposes.

The FDIA generally prohibits a depository institution from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company, if the depository institution would thereafter be “undercapitalized.” “Undercapitalized” institutions are subject to growth limitations and are required to submit capital restoration plans. If a depository institution fails to submit an acceptable plan, it is treated as if it is “significantly undercapitalized.” “Significantly undercapitalized” depository institutions may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become “adequately capitalized,” requirements to reduce total assets, and cessation of receipt of deposits from correspondent banks. “Critically undercapitalized” institutions are subject to the appointment of a receiver or conservator.

The capital classification of a bank holding company and a bank affects the frequency of regulatory examinations, the bank holding company’s and the bank’s ability to engage in certain activities and the deposit insurance premium paid by a bank.

Dividend Payments

Bancorp’s ability to pay dividends to its shareholders may be affected by both general corporate law considerations and the policies of the Federal Reserve applicable to bank holding companies. As a California corporation, Bancorp is subject to the limitations of California law, which allows a corporation to distribute cash or property to shareholders, including a dividend or repurchase or redemption of shares, if the corporation meets either a retained earnings test or a “balance sheet” test. Under the retained earnings test, Bancorp may make a distribution from retained earnings to the extent that its retained earnings exceed the sum of (a) the amount of the distribution plus (b) the amount, if any, of dividends in arrears on shares with preferential dividend rights. Bancorp may also make a distribution if, immediately after the distribution, the value of its assets equals or exceeds the sum of (a) its total liabilities plus (b) the liquidation preference of any shares which have a preference upon dissolution over the rights of shareholders receiving the distribution. Indebtedness is not considered a liability if the terms of such indebtedness provide that payment of principal and interest thereon are to be made only if, and to the extent that, a distribution to shareholders could be made under the balance sheet test. A California corporation may specify in its articles of incorporation that distributions under the retained earnings test or balance sheet test can be made without regard to the preferential rights amount. Bancorp’s articles of incorporation do not address distributions under either the retained earnings test or the balance sheet test.

As a general matter, the Federal Reserve has indicated that the board of directors of a bank holding company should eliminate, defer or significantly reduce dividends to shareholders if: (i) Bancorp’s net income available to shareholders for the past four quarters, net of dividends previously paid during that period, is not sufficient to fully fund the dividends; (ii) the prospective rate of earnings retention is inconsistent with Bancorp’s capital needs and overall current and prospective financial condition; or (iii) Bancorp will not meet, or is in danger of not meeting, its minimum regulatory capital adequacy ratios. The Federal Reserve also possesses enforcement powers over bank holding companies and their nonbank subsidiaries to prevent or remedy actions that represent unsafe or unsound practices or violations of applicable statutes and regulations. Among these powers is the ability to proscribe the payment of dividends by banks and bank holding companies.

The terms of our subordinated notes also limit our ability to pay dividends on our common stock. If we are not current on our payment of interest on our subordinated notes, we may not pay dividends on our common stock. The amount of future dividends by Bancorp will depend on our earnings, financial condition, capital requirements and other factors, and will be determined by our board of directors in accordance with the capital management and dividend policy.

The Bank is a legal entity that is separate and distinct from its holding company. Bancorp is dependent on the performance of the Bank for funds, which may be received as dividends from the Bank, for use in the operation of Bancorp and the ability of Bancorp to pay dividends to its stockholders. Future cash dividends by the Bank will also depend upon management’s assessment of future capital requirements, contractual restrictions, and other factors. During the years ended December 31, 2025 and 2024, the Bank paid $45.0 million and $20.0 million, respectively, of dividends to Bancorp. Dividends on common stock during the years ended December 31, 2025 and 2024, totaled $11.3 million and $11.7 million.

Transactions with Affiliates and Insiders Depository institutions are subject to the restrictions contained in the Federal Reserve Act (the “FRA”) with respect to loans to directors, executive officers and principal stockholders. Under the FRA, loans to directors, executive officers and stockholders who own more than 10% of a depository institution and certain affiliated entities of any of the foregoing, may not exceed, together with all other outstanding loans to such person and affiliated entities, the institution’s loans-to-one-borrower limit. Federal regulations also prohibit loans above amounts prescribed by the appropriate federal banking agency to directors, executive officers, and stockholders who own more than 10% of an institution, and their respective affiliates, unless such loans are approved in advance by a majority of the board of directors of the institution. Additions to the ACL, which are charged to earnings through the provision for credit losses, are determined based on a variety of factors, including an analysis of the loan portfolio, historical loss experience, reasonable and supportable forecasts and an evaluation of current economic conditions in our market areas. Any “interested” director may not participate in the voting. The proscribed loan amount, which includes all other outstanding loans to such person, as to which such prior board of director approval is required, is the greater of $25,000 or 5% of capital and surplus up to $500,000. The Federal Reserve also requires that loans to directors, executive officers and principal stockholders be made on terms substantially the same as offered in comparable transactions to non-executive employees of the bank and must not involve more than the normal risk of repayment. There are additional limits on the amount a bank can loan to an executive officer.

Transactions between a bank and its “affiliates” are quantitatively and qualitatively restricted under Sections 23A and 23B of the FRA. Section 23A restricts the aggregate amount of covered transactions with any individual affiliate to 10% of the capital and surplus of the financial institution. The aggregate amount of covered transactions with all affiliates is limited to 20% of the institution’s capital and surplus. Certain transactions with affiliates are required to be secured by collateral in an amount and of a type described in Section 23A and the purchase of low quality assets from affiliates are generally prohibited.

Section 23B generally provides that certain transactions with affiliates, including loans and asset purchases, must be on terms and under circumstances, including credit standards, that are substantially the same or at least as favorable to the institution as those prevailing at the time for comparable transactions with non-affiliated companies. The Federal Reserve has promulgated Regulation W, which codifies prior interpretations under Sections 23A and 23B of the FRA and provides interpretive guidance with respect to affiliate transactions. Affiliates of a bank include, among other entities, a bank’s holding company and companies that are under common control with the bank. Bancorp is considered to be an affiliate of the Bank.

The Dodd-Frank Act generally enhanced the restrictions on transactions with affiliates under Section 23A and 23B of the FRA, including an expansion of the definition of “covered transactions” and an increase in the amount of time for which collateral requirements regarding covered credit transactions must be satisfied. Insider transaction limitations are expanded through the strengthening of loan restrictions to insiders and the expansion of the types of transactions subject to the various limits, including derivatives transactions, repurchase agreements, reverse repurchase agreements and securities lending or borrowing transactions. Restrictions are also placed on certain asset sales to and from an insider to an institution, including requirements that such sales be on market terms and, in certain circumstances, approved by the institution’s board of directors.

Loans to One Borrower

Under California law, our ability to make aggregate secured and unsecured loans-to-one-borrower is limited to 25% and 15%, respectively, of unimpaired capital and surplus. At December 31, 2025, the Bank’s regulatory limit on aggregate secured loans-to-one-borrower was $144.4 million and unsecured loans-to-one borrower was $86.6 million. The Bank did not have any loans to one borrower that exceeded either of these limits at December 31, 2025.

Safety and Soundness Standards/Risk Management

The federal banking agencies have adopted guidelines that establish operational and managerial standards to promote the safety and soundness of federally insured depository institutions. The guidelines set forth standards for internal controls, information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, compensation, fees and benefits, asset quality and earnings.

In general, the safety and soundness guidelines prescribe the goals to be achieved in each area, and each institution is responsible for establishing its own procedures to achieve those goals. If an institution fails to comply with any of the standards set forth in the guidelines, the financial institution’s primary federal regulator may require the institution to submit a plan for achieving and maintaining compliance. If a financial institution fails to submit an acceptable compliance plan, or fails in any material respect to implement a compliance plan that has been accepted by its primary federal regulator, the regulator is required to issue an order directing the institution to cure the deficiency. Until the deficiency cited in the regulator’s order is cured, the regulator may restrict the financial institution’s rate of growth, require the financial institution to increase its capital, restrict the rates the institution pays on deposits or require the institution to take any action the regulator deems appropriate under the circumstances. Noncompliance with the standards established by the safety and soundness guidelines may also constitute grounds for other enforcement action by the federal bank regulatory agencies, including cease and desist orders and civil money penalty assessments.

During the past decade, the bank regulatory agencies have increasingly emphasized the importance of sound risk management processes and strong internal controls when evaluating the activities of the financial institutions they supervise. Properly managing risks has been identified as critical to the conduct of safe and sound banking activities and has become even more important as new technologies, product innovation, and the size and speed of financial transactions have changed the nature of banking markets. The agencies have identified a spectrum of risks facing a banking institution including, but not limited to, credit, market, liquidity, operational, legal, and reputational risk. In particular, recent regulatory pronouncements have focused on operational risk, which arises from the potential that inadequate information systems, operational problems, breaches in internal controls, fraud, or unforeseen catastrophes will result in unexpected losses. New products and services, third-party risk management and cybersecurity are critical sources of operational risk that financial institutions are expected to address in the current environment. The Bank is expected to have active board and senior management oversight; adequate policies, procedures, and limits; adequate risk measurement, monitoring, and management information systems; and comprehensive internal controls.

Branching Authority

California banks, such as the Bank, may, under California law, establish a banking office so long as the bank’s board of directors approves the banking office and the DFPI is notified of the establishment of the banking office. Deposit-taking banking offices must be approved by the FDIC, which considers a number of factors, including financial history, capital adequacy, earnings prospects, character of management, needs of the community and consistency with corporate power. The Dodd-Frank Act permits insured state banks to engage in de novo interstate branching if the laws of the state where the new banking office is to be established would permit the establishment of the banking office if it were chartered by such state. Finally, we may also establish banking offices in other states by merging with banks or by purchasing banking offices of other banks in other states, subject to certain restrictions.

Community Reinvestment Act Requirements

The CRA requires the Bank to have a continuing and affirmative obligation in a safe and sound manner to help meet the credit needs of its entire community, including low- and moderate-income neighborhoods. Federal regulators regularly assess the Bank’s record of meeting the credit needs of its communities. A bank’s compliance with its CRA obligations is based on a performance-based evaluation system, which bases CRA ratings on an institution’s lending, service, and investment performance, resulting in a rating by the appropriate bank regulator of “outstanding,” “satisfactory,” “needs to improve,” or “substantial noncompliance.” The Bank received a “satisfactory” rating on its most recent CRA examination, which was conducted in May 2023. The federal banking agencies may take compliance with fair lending laws and practices, including CRA into account when regulating and supervising other activities.

On October 24, 2023, the federal regulatory agencies jointly issued a final rule to strengthen and modernize regulations implementing the CRA, but in light of litigation, the agencies issued a joint proposal in July 2025 to rescind this rule and reinstate the CRA framework that existed prior to the 2023 final rule.

Anti-Money Laundering and OFAC Regulation

The USA Patriot Act is designed to deny terrorists and criminals the ability to obtain access to the U.S. financial system and has significant implications for depository institutions, brokers, dealers and other businesses involved in the transfer of money. The USA Patriot Act mandates financial services companies to have policies and procedures with respect to measures designed to address any or all of the following matters: (i) customer identification programs; (ii) money laundering; (iii) terrorist financing; (iv) identifying and reporting suspicious activities and currency transactions; (v) currency crimes; and (vi) cooperation between financial institutions and law enforcement authorities. Banking regulators also examine banks for compliance with the economic sanctions regulations administered by OFAC. Failure of a financial institution to maintain and implement adequate anti-money laundering and OFAC programs, or to comply with all of the relevant laws or regulations, could have serious legal and reputational consequences for the institution.

Concentrations in Commercial Real Estate

Concentration risk exists when financial institutions deploy too many assets to any one industry or segment. Concentration stemming from commercial real estate is one area of regulatory concern. The CRE Concentration Guidance, provides supervisory criteria, including the following numerical indicators, to assist bank examiners in identifying banks with potentially significant commercial real estate loan concentrations that may warrant greater supervisory scrutiny: (i) commercial real estate loans exceeding 300% of capital and increasing 50% or more in the preceding three years; or (ii) construction and land development loans exceeding 100% of capital. The CRE Concentration Guidance does not limit banks’ levels of commercial real estate lending activities, but rather guides institutions in developing risk management practices and levels of capital that are commensurate with the level and nature of their commercial real estate concentrations. Based on the Bank’s loan portfolio, the Bank does not exceed these guidelines.

Mortgage and Mortgage-Related Products

The Dodd-Frank Act significantly expanded underwriting requirements applicable to loans secured by 1-4 family residential real property and augmented federal law combating predatory lending practices. In addition to numerous disclosure requirements, the Dodd-Frank Act imposed new standards for mortgage loan originations on all lenders, including banks and savings associations, in an effort to strongly encourage lenders to verify a borrower’s ability to repay, while also establishing a presumption of compliance for certain “qualified mortgages.” The Dodd-Frank Act generally requires lenders or securitizers to retain an economic interest in the credit risk relating to loans that the lender sells, and other asset-backed securities that the securitizer issues, if the loans do not comply with the ability-to-repay standards described below. The risk retention requirement generally is 5%, but could be increased or decreased by regulation.

The Volcker Rule

On December 10, 2013, the federal regulatory agencies issued final rules to implement the prohibitions required by the Volcker Rule under the Dodd-Frank Act. Under the final regulations, banking entities are generally prohibited, subject to significant exceptions from: (i) short-term proprietary trading as principal in securities and other financial instruments, and (ii) sponsoring or acquiring or retaining an ownership interest in private equity and hedge funds. Revisions to the Volcker Rule in 2019, that became effective in 2020, simplify and streamline the compliance requirements for banks that do not have significant trading activities. In 2020, the OCC, Federal Reserve, FDIC, SEC and Commodity Futures Trading Commission finalized further amendments to the Volcker Rule. The amendments include new exclusions from the Volcker Rule’s general prohibitions on banking entities investing in and sponsoring private equity funds, hedge funds, and certain other investment vehicles (collectively “covered funds”). The amendments in the final rule, which became effective on October 1, 2020, clarify and expand permissible banking activities and relationships under the Volcker Rule.

Additional Restrictions on Bancorp and Bank Activities

The activities of bank holding companies are generally limited to the business of banking, managing, or controlling banks, and other activities that the Federal Reserve has determined to be so closely related to banking or managing or controlling banks as to be a proper incident thereto. Bank holding companies that qualify and register as “financial holding companies” are also able to engage in certain additional financial activities, such as merchant banking, and securities and insurance underwriting, subject to limitations set forth in federal law. We are not at this date a “financial holding company.

The BHCA requires a bank holding company to obtain prior approval of the Federal Reserve before: (i) taking any action that causes a bank to become a controlled subsidiary of the bank holding company; (ii) acquiring direct or indirect ownership or control of voting shares of any bank or bank holding company, if the acquisition results in the acquiring bank holding company having control of more than 5% of the outstanding shares of any class of voting securities of such bank or bank holding company, unless such bank or bank holding company is majority-owned by the acquiring bank holding company before the acquisition; (iii) acquiring all or substantially all of the assets of a bank; or (iv) merging or consolidating with another bank holding company.

Because California permits commercial banks chartered by the state to engage in any activity permissible for national banks, the Bank can form subsidiaries to engage in activates “closely related to banking” or “nonbanking” activities and expanded financial activities. However, to form a financial subsidiary, the Bank must be well capitalized and would be subject to the same capital deduction, risk management and affiliate transaction rules as applicable to national banks. Generally, a financial subsidiary is permitted to engage in activities that are “financial in nature” or incidental thereto, even though they are not permissible for a national bank to conduct directly within the bank. The definition of “financial in nature” includes, among other items, underwriting, dealing in, or making a market in securities, including, for example, distributing shares of mutual funds. The subsidiary may not, however, engage as principal in underwriting insurance (other than credit life insurance), issue annuities, or engage in real estate development, investment, or merchant banking.

Enforcement Powers of Federal and State Banking Agencies

The federal bank regulatory agencies have broad enforcement powers, including the power to terminate deposit insurance, impose substantial fines and other civil and criminal penalties, and appoint a conservator or receiver for financial institutions. Failure to comply with applicable laws and regulations could subject us and our officers and directors to administrative sanctions and potentially substantial civil money penalties. In addition to the grounds discussed above under “Prompt Corrective Actions,” the appropriate federal bank regulatory agency may appoint the FDIC as conservator or receiver for a banking institution (or the FDIC may appoint itself, under certain circumstances) if any one or more of a number of circumstances exist, including, without limitation, the fact that the banking institution is undercapitalized and has no reasonable prospect of becoming adequately capitalized, fails to become adequately capitalized when required to do so, fails to submit a timely and acceptable capital restoration plan or materially fails to implement an accepted capital restoration plan. The DFPI also has broad enforcement powers over us, including the power to impose orders, remove officers and directors, impose fines and appoint supervisors and conservators.

Deposit Insurance

The FDIC is an independent federal agency that insures deposits, up to prescribed statutory limits, of federally insured banks and savings institutions and safeguards the safety and soundness of the banking and savings industries. The FDIC insures our customer deposits through the DIF up to prescribed limits of $250,000 for each depositor pursuant to the Dodd-Frank Act. The amount of FDIC assessments paid by each DIF member institution is based on its relative risk of default as measured by regulatory capital ratios and other supervisory factors. The FDIC uses a performance score and a loss-severity score to calculate an initial assessment rate for the Bank. In calculating these scores, the FDIC uses the Bank’s capital level and regulatory supervisory ratings and certain financial measures to assess the Bank’s ability to withstand asset-related stress and funding-related stress. The FDIC also has the ability to make discretionary adjustments to the total score based upon significant risk factors that are not adequately captured in the calculations. In addition to ordinary assessments described above, the FDIC has the ability to impose special assessments in certain instances.

We are generally unable to control the amount of assessments that we are required to pay for FDIC insurance. If there are additional bank or financial institution failures or if the FDIC otherwise determines, we may be required to pay even higher FDIC assessments than the recently increased levels. These increases in FDIC insurance assessments may have a material and adverse effect on our earnings and could have a material adverse effect on the value of, or market for, our common stock.

Under the FDIA, the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC.

Due to the decline in the DIF reserve ratio below the statutory minimum of 1.35% as of June 30, 2020, caused by extraordinary growth in insured deposits during the first and second quarters of 2020, the FDIC established a Restoration Plan in September 2020 to restore the DIF reserve ratio to meet or exceed the statutory minimum of 1.35% within eight years. The Restoration Plan did not include an increase in the deposit insurance assessment rate. On June 21, 2022, however, the FDIC adopted an Amended Restoration Plan and notice of proposed rulemaking to increase the deposit insurance assessment rates as it was otherwise at risk of not reaching the statutory minimum by the statutory deadline of September 30, 2028. In conjunction with the Amended Restoration Plan, the FDIC adopted a final rule on October 18, 2022 that increased initial base deposit insurance assessment rates by 2 basis points, beginning with the first quarterly assessment period of 2023, to improve the likelihood that the reserve ratio would be restored to 1.35% by September 30, 2028. The proposed rule was adopted as final without change.

Also, in the final rule adopted on October 18, 2022, the FDIC incorporated Accounting Standards Update (“ASU”) 2022-02, Financial Instruments - Credit Losses (ASC 326) Troubled Debt Restructurings and Vintage Disclosures in the risk-based deposit insurance assessment system applicable to all large and highly complex IDIs. In March 2022, the FASB issued ASU 2022-02, which eliminates accounting guidance for troubled debt restructurings (“TDRs”) and introduces new disclosures and enhances existing disclosures concerning certain loan refinancings and restructurings when a borrower is experiencing financial difficulty. The FDIC final rule amends the assessment regulations to include a new term, “modifications to borrowers experiencing financial difficulty,” in two financial measures—the underperforming assets ratio and the higher-risk assets ratio—used to determine deposit insurance assessments for large and highly complex IDIs. The final rule became effective on January 1, 2023, and was applicable to the first quarterly assessment period of 2023.

In November 2023, the FDIC issued a final rule to implement a special assessment to recover losses to the DIF arising from the protection of uninsured depositors following the closures of Silicon Valley Bank and Signature Bank in March 2023. The special assessment is based on an IDI’s estimated uninsured deposits as of December 31, 2022, adjusted to exclude the first $5.0 billion of estimated uninsured deposits and will be assessed at a quarterly rate of 3.36 bps, over eight quarterly assessment periods beginning in the first quarter of 2024. The FDIC approved an interim final rule in December 2025 to reduce the special assessment for the eighth collection quarter to 2.97 bps. The interim final rule aims to ensure the FDIC will collect the exact amount needed through the special assessment to match the total losses preventing either over- or under-collection. The interim final rule also requires the FDIC to provide an offset to regular quarterly deposit insurance assessments for banks subject to the special assessment if the aggregate amount collected exceeds losses, following the final resolution of litigation between the FDIC and one of the bank entities. Our deposits have been below $5 billion and therefore the Bank has not been subject to this special assessment. To the extent to which any such additional future assessments will impact our future deposit insurance expense is currently uncertain.

Operations, Consumer and Privacy Compliance Laws

The Bank is also subject to certain consumer laws and regulations that are designed to protect consumers in transactions with banks. These laws include, among others: Truth in Lending Act; Truth in Savings Act; Electronic Funds Transfer Act; Expedited Funds Availability Act; Equal Credit Opportunity Act; Fair and Accurate Credit Transactions Act; Fair Housing Act; Fair Credit Reporting Act; Fair Debt Collection Act; Home Mortgage Disclosure Act; Real Estate Settlement Procedures Act; laws regarding unfair and deceptive acts and practices; and usury laws. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must deal with customers when taking deposits or making loans to such customers. The Bank must comply with the applicable provisions of these consumer protection laws and regulations as part of their ongoing customer relations. Many states and local jurisdictions have consumer protection laws analogous, and in addition, to those listed above. Failure to comply with these laws and regulations could give rise to regulatory sanctions, customer rescission rights, action by state and local attorneys general, and civil or criminal liability.

Pursuant to the Dodd-Frank Act, the CFPB has broad authority to regulate and supervise the retail consumer financial products and services activities of banks and various nonbank providers. The CFPB has authority to promulgate regulations, issue orders, guidance and policy statements, conduct examinations and bring enforcement actions with regard to consumer financial products and services. The creation of the CFPB by the Dodd-Frank Act has led to, and is likely to continue to lead to, enhanced and strengthened enforcement of consumer financial protection laws.

Federal law currently contains extensive customer privacy protection provisions. Under these provisions, a financial institution must provide to its customers, at the inception of the customer relationship and annually thereafter, the institution’s policies and procedures regarding the handling of customers’ nonpublic personal financial information. These provisions also provide that, except for certain limited exceptions, a financial institution may not provide such personal information to unaffiliated third parties unless the institution discloses to the customer that such information may be provided and the customer is given the opportunity to opt out of such disclosure. In June 2018, the California legislature passed the California Consumer Privacy Act of 2018 (the “CCPA”), which took effect on January 1, 2020. The CCPA, which covers businesses that obtain or access personal information on California resident consumers, grants consumers enhanced privacy rights and control over their personal information, and imposes significant requirements on covered companies with respect to consumer data privacy rights. We expect this trend of state-level activity to continue, and are continually monitoring developments in other states in which we operate.

The Federal Reserve and other bank regulatory agencies also have adopted guidelines for safeguarding confidential, personal customer information. These guidelines require financial institutions to create, implement and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazards to the security or integrity of such information and protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. Financial institutions are also required to implement policies and procedures regarding the disclosure of nonpublic personal information about consumers to non-affiliated third parties. In general, financial institutions must provide explanations to consumers on policies and procedures regarding the disclosure of such nonpublic personal information and, except as otherwise required by law, prohibits disclosing such information. The Bank has adopted a customer information security and privacy program to comply with such requirements.

Operations, consumer and privacy compliance laws and regulations also mandate certain disclosure and reporting requirements and regulate the manner in which financial institutions must deal with customers when taking deposits, making loans, collecting loans, and providing other services. Failure to comply with these laws and regulations can subject the Bank to lawsuits and penalties, including enforcement actions, injunctions, fines or criminal penalties, punitive damages to consumers, and the loss of certain contractual rights.

Federal Home Loan Bank System

The Bank is a member of the Federal Home Loan Bank (“FHLB”) of San Francisco. Among other benefits, each FHLB serves as a reserve or central bank for its members within its assigned region. Each FHLB is financed primarily from the sale of consolidated obligations of the FHLB system. Each FHLB makes available loans or advances to its members in compliance with the policies and procedures established by the board of directors of the individual FHLB. Each member of the FHLB of San Francisco is required to own stock in an amount equal to the greater of (i) a membership stock requirement, or (ii) an activity based stock requirement (based on a percentage of outstanding advances). There can be no assurance that the FHLB will pay dividends at the same rate it has paid in the past, or that it will pay any dividends in the future.

Securities and Corporate Governance

The Company is subject to the disclosure and regulatory requirements of the Securities Act and the Exchange Act, both as administered by the SEC. As a company listed on the NASDAQ Global Select Market, we are subject to NASDAQ listing standards for listed companies. The Company is also subject to the Sarbanes-Oxley Act, provisions of the Dodd-Frank Act, and other federal and state laws and regulations which address, among other issues, required executive certification of financial presentations, corporate governance requirements for board audit and compensation committees and their members, and disclosure of controls and procedures and internal control over financial reporting, auditing and accounting, executive compensation, and enhanced and timely disclosure of corporate information. NASDAQ has also adopted corporate governance rules, which are intended to allow stockholders and investors to more easily and efficiently monitor the performance of companies and their directors. Under the Sarbanes-Oxley Act, management and the Company's independent registered public accounting firm are required to assess the effectiveness of the Company’s internal control over financial reporting. These assessments are included in Part II—Item 9A. Controls and Procedures.

Incentive Compensation Guidance

The federal bank regulatory agencies have issued comprehensive guidance intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of those organizations by encouraging excessive risk-taking. The incentive compensation guidance sets expectations for banking organizations concerning their incentive compensation arrangements and related risk-management, control and governance processes. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors. In accordance with the Dodd-Frank Act, the federal banking agencies prohibit incentive-based compensation arrangements that encourage inappropriate risk taking by covered financial institutions (generally institutions, like us, that have over $1 billion in assets) and are deemed to be excessive, or that may lead to material losses.

The Federal Reserve will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Company, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness, and the organization is not taking prompt and effective measures to correct the deficiencies.

The Dodd-Frank Act requires that the federal banking agencies issue a rule related to incentive-based compensation. No final rule implementing this provision of the Dodd-Frank Act has, as of the date of the filing of this Annual Report on Form 10-K, been adopted, but a proposed rule was published in May 2024. The proposed rule is intended to (i) prohibit incentive-based payment arrangements that the banking agencies determine could encourage certain financial institutions to take inappropriate risks by providing excessive compensation or that could lead to material financial loss, (ii) require the board of directors of those financial institutions to take certain oversight actions related to incentive-based compensation, and (iii) require those financial institutions to disclose information concerning incentive-based compensation arrangements to the appropriate federal regulator. Although a final rule has not been issued, the Company and the Bank have undertaken efforts to ensure that their incentive compensation plans do not encourage inappropriate risks, consistent with the principles identified above.

Future Legislative Developments

Various legislative acts are from time to time introduced in Congress and the California legislature. This legislation may change banking statutes and the environment in which we operate in substantial and unpredictable ways. We cannot determine the ultimate effect that potential legislation, if enacted, or implementing regulations and interpretations with respect thereto, would have on our financial condition or results of operations.

The new presidential administration and many members of Congress have advocated for changes in financial services regulation, potentially including amendments to the Dodd-Frank Act and other federal banking laws, and structural changes to the CFPB. It is possible, though uncertain, that Congress and/or the relevant federal agencies may seek to roll back or modify some or much of the rulemaking and regulatory guidance issued under the previous presidential administration. Additionally, the full impact of the leadership changes at banking regulatory agencies on the enforcement and supervisory priorities of each agency is not fully known at this time. It is therefore unclear at the present time what effect the aforementioned changes will have on the banking industry as a whole or the Company specifically.

Regulation of Non-Bank Subsidiaries

Non-bank subsidiaries are subject to additional or separate regulation and supervision by other state, federal and self-regulatory bodies. Additionally, any foreign-based subsidiaries would also be subject to foreign laws and regulations.

Federal and State Taxation

Bancorp and the Bank report their income on a consolidated basis using the accrual method of accounting and are subject to federal income taxation in the same manner as other corporations with some exceptions. We have not been audited by the Internal Revenue Service. For 2025, 2024, and 2023, we were subject to a maximum federal income tax rate of 21.00%, California state income tax rate of 10.84% and various other state and local tax rates, including a New York state and New York City income tax rate of 9.43% and 8.85%.

Item 1A. Risk Factors.

Risks Related to Interest Rates

Fluctuations in interest rates may reduce net interest income and otherwise negatively impact our financial condition and results of operations.

Shifts in short-term interest rates may reduce net interest income, which is the principal component of our earnings. Net interest income is the difference between the amounts received by us on our interest-earning assets and the interest paid by us on our interest-bearing liabilities. When interest rates rise, the rate of interest we receive on our assets, such as loans, may rise more quickly than the rate of interest that we pay on our interest-bearing liabilities, such as deposits, which may cause our profits to increase. When interest rates rise, the rate of interest we receive on our assets, such as loans, rises more quickly than the rate of interest that we pay on our interest-bearing liabilities, such as deposits, which may cause our profits to increase. However, when interest rates decrease, the rate of interest we receive on our assets, such as loans, may decline more quickly than the rate of interest that we pay on our interest-bearing liabilities, such as deposits, which may cause our profits to decrease. When interest rates decrease, the rate of interest we receive on our assets, such as loans, declines more quickly than the rate of interest that we pay on our interest-bearing liabilities, such as deposits, which may cause our profits to decrease. The impact on earnings is more adverse when the slope of the yield curve flattens or becomes inverted, that is, when short-term interest rates remain constant or increase more than long-term interest rates or when long-term interest rates decrease more than short-term interest rates. The impact on earnings is more adverse when the slope of the yield curve flattens, that is, when short-term interest rates increase more than long-term interest rates or when long-term interest rates decrease more than short-term interest rates.

Interest rate increases often result in larger payment requirements for our borrowers, which increases the potential for default. At the same time, the marketability of the underlying property may be adversely affected by any reduced demand resulting from higher interest rates. In a declining interest rate environment, there may be an increase in prepayments on loans as borrowers refinance their mortgages and other indebtedness at lower rates. At December 31, 2025, total loans held for investment ("HFI") were 84.4% of our earning assets and exhibited a positive 4% sensitivity to rising interest rates in a 100 basis point parallel shock. At December 31, 2023, total loans held for investment were 80.2% of our earning assets and exhibited a positive 4% sensitivity to rising interest rates in a 100 basis point parallel shock.

Changes in interest rates also can affect the value of loans, securities and other assets. An increase in interest rates that adversely affects the ability of borrowers to pay the principal or interest on loans may lead to an increase in nonperforming assets and a reduction of income recognized, which could have a material adverse effect on our results of operations and cash flows. Further, when we place a loan on nonaccrual status, we reverse any accrued but unpaid interest receivable, which decreases interest income. Subsequently, we continue to have a cost to fund the loan, which is reflected as interest expense, without any interest income to offset the associated funding expense. Thus, an increase in the amount of nonperforming assets would have an adverse impact on net interest income.

Rising interest rates will result in a decline in the value of the fixed-rate debt securities we hold in our investment securities portfolio. The unrealized losses resulting from holding these securities would be recognized in accumulated other comprehensive income (loss) and reduce total shareholders’ equity. Unrealized losses do not negatively impact our regulatory capital ratios; however, tangible common equity and the associated ratios would be reduced. If debt securities in an unrealized loss position are sold, such losses become realized and will reduce our regulatory capital ratios.

If short-term interest rates remain constant but longer-term interest rates fall, we could experience net interest margin compression as our interest earning assets would continue to reprice downward while our interest-bearing liability rates could fail to decline in tandem. This would have a material adverse effect on our net interest income and our results of operations.

We could recognize losses on securities held in our securities portfolio, particularly if interest rates increase or economic and market conditions deteriorate.

As of December 31, 2025, the fair value of our securities portfolio was approximately $411.3 million. Factors beyond our control can significantly influence the fair value of securities in our portfolio and can cause potential adverse changes to the fair value of these securities. For example, fixed-rate securities acquired by us are generally subject to decreases in market value when interest rates rise. Additional factors include, but are not limited to, rating agency downgrades of the securities or our own analysis of the value of the security, defaults by the issuer or individual mortgagors with respect to the underlying securities, and continued instability in the credit markets. Any of the foregoing factors could cause other-than-temporary impairment in future periods and result in realized losses. The process for determining whether impairment is other-than-temporary usually requires difficult, subjective judgments about the future financial performance of the issuer and any collateral underlying the security in order to assess the probability of receiving all contractual principal and interest payments on the security. Because of changing economic and market conditions affecting interest rates, the financial condition of issuers of the securities and the performance of the underlying collateral, we may recognize realized and/or unrealized losses in future periods, which could have an adverse effect on our financial condition and results of operations.

At December 31, 2025, $407.2 million of our securities were classified as AFS with an aggregate pre-tax net unrealized loss of $18.9 million. We increase or decrease shareholders’ equity by the amount of change from the unrealized gain or loss (the difference between the estimated fair value and the amortized cost) of our AFS securities portfolio, net of the related tax, under the category of accumulated other comprehensive income (loss). We increase or decrease shareholders’ equity by the amount of change from the unrealized gain or loss (the difference between the estimated fair value and the amortized cost) of our available-for-sale securities portfolio, net of the related tax, under the category of accumulated other comprehensive income (loss). Therefore, a decline in the estimated fair value of this portfolio will result in a decline in reported shareholders’ equity, book value per common share, and tangible book value per common share. This decrease will occur even though the securities are not sold. In the case of debt securities, if these securities are never sold and there are no credit impairments, the decrease will be recovered over the life of the securities. In the case of equity securities, which have no stated maturity, the declines in fair value may or may not be recovered over time.

Risks Related to Our Business

Changes in general business and economic conditions and any regulatory responses to such conditions could have a material adverse effect on our business, financial position, results of operations and growth prospects.

Our business and operations are sensitive to general business and economic conditions in the United States, generally, and particularly in the states of California, Nevada, Illinois, New Jersey, Hawaii and New York, and the Los Angeles, New York City, Chicago, Las Vegas and Honolulu metropolitan areas. Unfavorable or uncertain economic and market conditions could lead to credit quality concerns related to repayment ability and collateral protection as well as reduced demand for the products and services we offer. In addition, economic conditions in foreign countries, including global political hostilities, U.S. and foreign tariff policies and uncertainty over the stability of the euro currency, could affect the stability of global financial markets, which could hinder domestic economic growth. Concerns about the performance of international economies can impact the economy and financial markets here in the U.S. in several ways. For example, a significant deterioration of economic conditions in Asia could expose us to, among other things, economic and transfer risk, and we could experience an outflow of deposits by those of our customers with connections to Asia. A significant deterioration of economic conditions in Asia could expose us to, among other things, economic and transfer risk, and we could experience an outflow of deposits by those of our customers with connections to Asia. Transfer risk may result when an entity is unable to obtain the foreign exchange needed to meet its obligations or to provide liquidity. This may adversely impact the recoverability of investments with, or loans made to, such entities.

If the national, regional and local economies experience a decline in economic conditions, including high levels of unemployment, our growth and profitability could be constrained. Weak economic conditions are characterized by, among other indicators, deflation, elevated levels of unemployment, fluctuations in the debt and equity capital markets, increased delinquencies on mortgage, commercial and consumer loans, residential and commercial real estate price declines, lower home sales and commercial activity, and fluctuations in the commercial and Federal Housing Administration financing sector. A significant outbreak of disease pandemics or other adverse public health developments in the population could result in a widespread health crisis that could adversely affect the economies and financial markets of many countries, resulting in an economic downturn that could adversely affect our customers’ businesses and results of operations. Our business is significantly affected by monetary and other regulatory policies of the U.S. federal government, its agencies and government-sponsored entities.

In recent years, economic growth has been uneven, and opinions vary on the strength and direction of the economy. Uncertainties also have arisen regarding the potential for a reversal or renegotiation of international trade agreements with China, the European Union and the United Kingdom, and the impact such actions may have on economic and market conditions. Uncertainties also have arisen regarding the potential for a reversal or renegotiation of international trade agreements, as the current US administration has with China, the European Union and the United Kingdom. A trade war or other governmental action related to tariffs or international trade agreements or policies, as well as military conflicts, including the military actions between Ukraine and Russia, war and conflicts in the Middle East and tension between China and Taiwan, or other potential epidemics or pandemics, have the potential to negatively impact our and/or our customers’ costs, demand for our customers’ products, and/or the U.S. economy or certain sectors thereof and, thus, adversely affect our business, financial condition, and results of operations.

Although inflation levels moved closer to the Federal Open Market Committee’s (“FOMC”) target rate of 2% in 2025, as of December 31, 2025, inflation rates remained elevated above the target rate. To the extent inflation persists, it poses a risk to the economy overall, and could pose direct or indirect challenges to our clients and to our business. Elevated inflation can impact our business customers through loss of purchasing power for their customers, leading to lower sales. Elevated inflation can also increase input and inventory costs for our customers, forcing them to raise their prices or lower their profitability. Rising inflation can also increase input and inventory costs for our customers, forcing them to raise their prices or lower their profitability. Supply chain disruption, also leading to inflation, can delay our customers’ shipping ability, or timing on receiving inputs for their production or inventory. Inflation can lead to higher wages for our business customers, increasing costs. All of these inflationary risks for our business customer base can be financially detrimental, leading to increased likelihood that the customer may become delinquent or otherwise default on a loan. To the extent such conditions exist or worsen, we could experience adverse effects on our business, financial condition, and results of operations.

Health crises have in the past, and could in the future, materially and adversely affect our business and our customers, counterparties, employees, and third-party service providers.

Pandemics, epidemics, or other health crises, including COVID-19, have had and could have repercussions that could impact household, business, economic, and market conditions. These events have in the past caused, and could in the future cause, us to implement measures to combat such health crises, including restrictions impacting individuals, including our current and potential investors and customers, and the manner in which business continues to operate. These events have caused and could in the future, cause us to implement measures to combat such health crises, including restrictions impacting individual, including our current and potential investors and customers, and the manner in which business continues to operate. Additionally, our operations may be impacted by the need to close certain offices and limit how customers conduct business through our branch network.

Pandemics, epidemics, or other health crises could impact our business, capital, liquidity, financial position, results of operations, and business prospects due to the potential effect on our customers, employees, and third-party service providers. In addition, health crises can lead to lingering impacts on economies and markets, for example, the unprecedented extent of economic stimulus during the COVID-19 pandemic that caused and/or exacerbated inflationary pressures.

We are subject to liquidity risk, which could adversely affect our financial condition and results of operations.

Effective liquidity management is essential for the operation of our business. Although we have implemented strategies to maintain sufficient and diverse sources of funding to accommodate planned, as well as unanticipated, changes in assets, liabilities, and off-balance sheet commitments under various economic conditions, an inability to raise funds through deposits, borrowings, the sales of investment securities and other sources could have a material adverse effect on our liquidity. Our access to funding sources in amounts adequate to finance our activities could be impaired by factors that affect us specifically or the financial services industry in general. Factors that could detrimentally impact our access to liquidity sources include a decrease in the level of our business activity due to a market disruption, a decrease in the borrowing capacity assigned to our pledged assets by our secured creditors, or adverse regulatory action against us. Deterioration in economic conditions and the loss of confidence in financial institutions may increase our cost of funding and limit our access to some of our customary sources of liquidity, including, but not limited to, inter-bank borrowings and borrowings from the Federal Reserve and FHLB. Our ability to acquire deposits or borrow, and the possibility of deposit outflows, could also be impaired by various stress environments and other factors that are not specific to us, including a severe disruption of the financial markets or negative views and expectations about the prospects for the financial services industry generally as a result of conditions faced by banking organizations in the domestic and international credit markets. Other factors, for example a cybersecurity breach that is specific to us, could also impair our ability to acquire or retain deposits. The inability to maintain adequate liquidity could materially and adversely affect our business, results of operations or financial condition.

Our business depends on our ability to attract and retain Asian-American immigrants as clients.

A significant portion of our business is based on successfully attracting and retaining Asian-American immigrants as clients for both our non-qualified residential mortgage loans and deposits. We may be limited in our ability to attract Asian-American clients to the extent the U.S. adopts restrictive domestic immigration laws. Changes to U.S. immigration policies that restrain the flow of immigrants may inhibit our ability to meet our goals and budgets for non-qualified SFR mortgage loans and deposits, which may adversely affect our net interest income and net income.

Risks Related to Our Loans

Because a significant portion of our loan portfolio is comprised of real estate loans, negative changes in the economy affecting real estate values and liquidity could impair the value of collateral securing our real estate loans and result in loan and other losses.

At December 31, 2025, approximately 94.0% of our loan portfolio was comprised of loans with real estate as a primary or secondary component of collateral. The market value of real estate can fluctuate significantly in a short period of time as a result of market conditions in the area in which the real estate is located. Adverse changes affecting real estate values and the liquidity of real estate in one or more of our markets could increase the credit risk associated with our loan portfolio, significantly impair the value of property pledged as collateral on loans and affect our ability to sell the collateral upon foreclosure without a loss or additional losses, which could result in losses that would adversely affect profitability. Such declines and losses would have a material adverse impact on our business, results of operations and growth prospects.

Many of our loans are to commercial borrowers, which have a higher degree of risk than other types of loans.

At December 31, 2025, we had $1.6 billion of commercial loans, consisting of $1.3 billion of CRE loans, $140.1 million of C&I loans for which real estate is not the primary source of collateral and $155.5 million of C&D loans. Commercial loans are often larger and involve greater risks than other types of lending. Because payments on such loans are often dependent on the successful operation or development of the property or business involved, repayment of such loans is often more sensitive than other types of loans to adverse conditions in the real estate market or the general business climate and economy. Accordingly, a downturn in the real estate market and a challenging business and economic environment may increase our risk related to commercial loans, particularly commercial real estate loans. Unlike residential mortgage loans, which generally are made on the basis of the borrowers’ ability to make repayment from their employment and other income and which are secured by real property whose value tends to be more easily ascertainable, commercial loans typically are made on the basis of the borrowers’ ability to make repayment from the cash flow of the commercial venture. Our C&I loans, which represented 4.2% of our total loan portfolio at December 31, 2025, are primarily made based on the identified cash flow of the borrower and secondarily on the collateral underlying the loans. Most often, this collateral consists of accounts receivable, inventory and equipment. Inventory and equipment may depreciate over time, may be difficult to appraise and may fluctuate in value based on the success of the business. If the cash flow from business operations is reduced, the borrower’s ability to repay the loan may be impaired. Due to the larger average size of each commercial loan as compared with other loans such as residential loans, as well as collateral that is generally less readily-marketable, losses incurred on a small number of commercial loans could have a material adverse impact on our financial condition and results of operations.

We have a concentration in commercial real estate, which could cause our regulators to restrict our ability to grow.

As a part of their regulatory oversight, the federal regulators have issued the CRE Concentration Guidance on sound risk management practices with respect to a financial institution’s concentrations in commercial real estate lending activities. These guidelines were issued in response to the agencies’ concerns that rising CRE concentrations might expose institutions to unanticipated earnings and capital volatility in the event of adverse changes in the commercial real estate market. The CRE Concentration Guidance identifies certain concentration levels that, if exceeded, will expose the institution to additional supervisory analysis with regard to the institution’s CRE concentration risk. The CRE Concentration Guidance is designed to promote appropriate levels of capital and sound loan and risk management practices for institutions with a concentration of CRE loans. In general, the CRE Concentration Guidance establishes the following supervisory criteria as preliminary indications of possible CRE concentration risk: (1) the institution’s total construction, land development and other land loans represent 100% or more of total risk-based capital; or (2) total CRE loans as defined in the regulatory guidelines represent 300% or more of total risk-based capital, and the institution’s CRE loan portfolio has increased by 50% or more during the prior 36-month period. Pursuant to the CRE Concentration Guidelines, loans secured by owner occupied commercial real estate are not included for purposes of CRE Concentration calculation. As of December 31, 2025, our CRE loans represented 226% of our Bank total risk-based capital, as compared to 207% as of December 31, 2024. We actively work to manage our CRE concentration and we have discussed the CRE Concentration Guidance with the FDIC and believe that our underwriting policies, management information systems, independent credit administration process, and monitoring of real estate loan concentrations are currently sufficient to address the CRE Concentration Guidance. Nevertheless, the FDIC or the DFPI could become concerned about our CRE loan concentrations, and they could limit our ability to grow by restricting their approvals for the establishment or acquisition of branches, or approvals of mergers or other acquisition opportunities. Nevertheless, the FDIC could become concerned about our CRE loan concentrations, and they could limit our ability to grow by restricting their approvals for the establishment or acquisition of branches, or approvals of mergers or other acquisition opportunities.

Our SFR loan product consists primarily of non-qualified SFR mortgage loans, which may be considered less liquid and more risky.

As of December 31, 2025, our SFR mortgage loan portfolio amounted to $1.66 billion or 50.0% of our loan portfolio. As of that date, 97.4% of our SFR mortgage loans consisted of non-qualified mortgage loans, which are considered to have a higher degree of risk and are less liquid than qualified mortgage loans. We offer two SFR mortgage products, a low loan-to-value, alternative document hybrid non-qualified SFR mortgage loan, which we refer to as non-qualified SFR mortgage loan, and a qualified SFR mortgage loan. As of December 31, 2025, our non-qualified SFR mortgage loans had an average loan-to-value of 54.6% and an average FICO score of 763. As of December 31, 2025, 3.0% of our total SFR mortgage loan portfolio were loans originated to foreign nationals. The non-qualified SFR mortgage loans that we originate are designed to assist Asian-Americans who have recently immigrated to the United States and as such are willing to provide higher down payment amounts and pay higher interest rates and fees in return for reduced documentation requirements. The non-qualified single-family residential mortgage loans that we originate are designed to assist Asian-Americans who have recently immigrated to the United States and as such are willing to provide higher down payment amounts and pay higher interest rates and fees in return for reduced documentation requirements. Non-qualified SFR mortgage loans are considered less liquid than qualified SFR mortgage loans because such loans are not able to be securitized and can only be sold directly to other financial institutions. Since non-qualified loans may be considered more risky than qualified mortgage loans, we attempt to address this enhanced risk through our underwriting process, including requiring larger down payments and, in some cases, interest reserves. Such non-qualified loans may be considered more risky than qualified mortgage loans although we attempt to address this enhanced risk through our underwriting process, including requiring larger down payments and, in some cases, interest reserves.

We also have a concentration in our SFR secondary sale market, as a substantial portion of our non-qualified mortgage loans have been historically sold to a small number of banks. We are taking steps to reduce our dependence on these banks by expanding the number of banks that we sell our non-qualified SFR mortgages to, but may not be successful in expanding our sales market for our non-qualified mortgage loans. These loans also present a pricing risk as rates change, and our sale premiums cannot be guaranteed. These loans also present pricing risk as rates change, and our sale premiums cannot be guaranteed. Further, the criteria for our loans to be purchased by other banks may change from time to time, which could result in a lower volume of corresponding loan originations.

Mortgage production, including refinancing activity, historically declines in rising interest rate environments, which we have experienced in recent years.

The non-guaranteed portion of SBA loans that we retain on our balance sheet as well as the guaranteed portion of SBA loans that we sell could expose us to various credit and default risks.

We originated $27.2 million of SBA loans for the year ended December 31, 2025. We sold $10.8 million of the guaranteed portion of our SBA loans for the year ended December 31, 2025. Consequently, as of December 31, 2025, we held $56.0 million of SBA loans on our balance sheet, of which $45.1 million or 80.5% consisted of the non-guaranteed portion of SBA loans and $10.9 million or 19.5% consisted of the guaranteed portion of SBA loans. The non-guaranteed portion of SBA loans have a higher degree of credit risk and risk of loss as compared to the guaranteed portion of such loans. We attempt to limit this risk by generally requiring such loans to be collateralized and limiting the overall amount that can be held on our balance sheet to 75% of our total capital.

When we sell the guaranteed portion of SBA loans in the ordinary course of business, we are required to make certain representations and warranties to the purchaser about the SBA loan and the manner in which they were originated. Under these agreements, we may be required to repurchase the guaranteed portion of the SBA loan if we have breached any of these representations or warranties, in which case we may record a loss. In addition, if repurchase and indemnity demands increase on loans that we sell from our portfolios, our liquidity, results of operations and financial condition could be adversely affected. Further, we generally retain the non-guaranteed portions of the SBA loans that we originate and sell, and to the extent the borrowers of such loans experience financial difficulties, our financial condition and results of operations could be adversely impacted.

Curtailment of government guaranteed loan programs could affect a segment of our business.

A significant segment of our business consists of originating and periodically selling U.S. government guaranteed loans, in particular those guaranteed by the SBA. Presently, the SBA guarantees 75% of the principal amount of each qualifying SBA loan originated under the SBA’s 7(a) loan program. There is no assurance that the U.S. government will maintain the SBA 7(a) loan program or if it does, that such guaranteed portion will remain at its current level. In addition, from time to time, the government agencies that guarantee these loans reach their internal limits and cease to guarantee future loans. In addition, these agencies may change their rules for qualifying loans or Congress may adopt legislation that would have the effect of discontinuing or changing the loan guarantee programs. Non-governmental programs could replace government programs for some borrowers, but the terms might not be equally acceptable. Therefore, if these changes occur, the volume of loans to small businesses, industrial and agricultural borrowers of the types that now qualify for government guaranteed loans could decline. Therefore, if these changes occur, the volume of loans to small business, industrial and agricultural borrowers of the types that now qualify for government guaranteed loans could decline. Also, the profitability associated with the sale of the guaranteed portion of these loans could decline as a result of market displacements due to increases in interest rates, and could cause the premiums realized on the sale of the guaranteed portions to decline from current levels. As the funding and sale of the guaranteed portion of SBA 7(a) loans is a portion of our business and a part of our noninterest income, any significant changes to the funding for the SBA 7(a) loan program and any prolonged government shutdown may have an unfavorable impact on our prospects, future performance and results of operations. As the funding and sale of the guaranteed portion of SBA 7(a) loans is a major portion of our business and a significant portion of our noninterest income, any significant changes to the funding for the SBA 7(a) loan program may have an unfavorable impact on our prospects, future performance and results of operations.

Real estate construction loans are based upon estimates of costs and values associated with the complete project. These estimates may be inaccurate, and we may be exposed to significant losses on loans for these projects.

Real estate construction loans, including land development loans, comprised approximately 4.7% of our total loan portfolio as of December 31, 2025. Such lending involves additional risks because funds are advanced upon the security of the project, which is of uncertain value prior to its completion, and costs may exceed realizable values in declining real estate markets. Because of the uncertainties inherent in estimating construction costs and the realizable market value of the completed project and the effects of governmental regulation of real property, it is relatively difficult to evaluate accurately the total funds required to complete a project and the related loan-to-value ratio. As a result, construction loans often involve the disbursement of substantial funds with repayment dependent, in part, on the success of the ultimate project and the ability of the borrower to sell or lease the property, rather than the ability of the borrower or guarantor to repay principal and interest. If our appraisal of the value of the completed project proves to be overstated or market values or rental rates decline, we may have inadequate security for the repayment of the loan upon completion of construction of the project. If we are forced to foreclose on a project prior to or at completion due to a default, we may not be able to recover all of the unpaid balance of, and accrued interest on, the loan as well as related foreclosure and holding costs. In addition, we may be required to fund additional amounts to complete the project and may have to hold the property for an unspecified period of time while we attempt to dispose of it. If any of these events occur, our financial condition, results of operations and cash flows could be materially and adversely affected.

Nonperforming assets take significant time to resolve and adversely affect our results of operations and financial condition, and could result in further losses in the future.

As of December 31, 2025, our nonperforming assets totaled $53.5 million, or 1.27%, of total assets, comprised of nonperforming loans of $44.6 million and other real estate owned ("OREO") of $8.8 million. Nonaccrual loans HFI were 1.35% of our loan HFI portfolio at December 31, 2025.

Our nonperforming assets adversely affect our net income in various ways. We do not record interest income on nonaccrual loans or OREO, thereby adversely affecting our net income and returns on assets and equity, increasing our loan administration costs and adversely affecting our efficiency ratio. When we take collateral in foreclosure and similar proceedings, we are required to mark the collateral to its then-fair market value, which may result in a loss. These nonperforming assets also increase our risk profile and the level of capital our regulators believe is appropriate for us to maintain in light of such risks. These nonperforming loans and other real estate owned also increase our risk profile and the level of capital our regulators believe is appropriate for us to maintain in light of such risks. The resolution of nonperforming assets requires significant time commitments from management and can be detrimental to the performance of their other responsibilities. If we experience increases in nonperforming loans and nonperforming assets, our net interest income may be negatively impacted and our loan administration costs could increase, each of which could have an adverse effect on our net income and related ratios, such as return on assets and equity.

Risks Related to Our Deposits

Our deposit portfolio includes significant concentrations and a large percentage of our deposits are attributable to a relatively small number of clients.

As a commercial bank, we provide services to a number of clients whose deposit levels vary considerably and have a significant amount of seasonality. Our deposits include $1.3 billion, or approximately 40%, of the Bank's total deposits, related to 166 client relationships who maintain balances greater than $2 million, when aggregating all related accounts, including multiple business entities and personal funds of business owners, at December 31, 2025. In addition, our ten largest depositor relationships accounted for approximately 12.5% of our deposits at December 31, 2025. Our largest depositor relationship accounted for approximately 2.0% of our deposits at December 31, 2025. These deposits can and do fluctuate. The loss of any combination of these depositors, or a significant decline in the deposit balances due to ordinary course fluctuations related to these customers’ businesses, would adversely affect our liquidity and require us to raise deposit rates to attract new deposits, or otherwise purchase federal funds or borrow funds on a short-term basis to replace such deposits. Depending on the interest rate environment and competitive factors, low cost deposits may need to be replaced with higher cost funding, resulting in a decrease in net interest income and net income. Consequently, the occurrence of these events could have a material adverse impact to our operations and financial results.

Risk Related to our Allowance for Credit Losses (“ACL”)

If we do not effectively manage our credit risk, we may experience increased levels of delinquencies, nonperforming loans and charge-offs, which could require increases in our provision for credit losses.

There are risks inherent in making any loan, including risks inherent in dealing with individual borrowers, risks of nonpayment, risks resulting from uncertainties as to the future value of collateral and cash flows available to service debt and risks resulting from changes in economic and market conditions. We cannot guarantee that our credit underwriting and monitoring procedures will reduce these credit risks, and they cannot be expected to completely eliminate our credit risks. If the overall economic climate in the U.S., generally, or our market areas, specifically, declines, our borrowers may experience difficulties in repaying their loans, and the level of nonperforming loans, charge-offs and delinquencies could rise and require further increases in the provision for credit losses, which would cause our net income, return on equity and capital to decrease.

Our ACL may prove to be insufficient to absorb potential credit losses in our loan portfolio.

We establish our ACL and maintain it at a level that management considers adequate to absorb expected credit losses based on an analysis of our portfolio and market environment. The ACL represents our estimate of expected credit losses in the portfolio at each balance sheet date and is based upon relevant information available to us. The allowance contains provisions for expected credit losses that have been identified relating to specific borrowing relationships, as well as expected credit losses inherent in the loan portfolio and credit undertakings that are not specifically identified. Additions to the ACL, which are charged to earnings through the provision for credit losses, are determined based on a variety of factors, including an analysis of the loan portfolio, historical loss experience, reasonable and supportable forecasts and an evaluation of current economic conditions in our market areas. The actual amount of credit losses is affected by changes in economic, operating and other conditions within our markets, which may be beyond our control, and such losses may exceed current estimates.

We estimate credit losses using the CECL model, which incorporates the use of and is more reliant on reasonable and supportable forecasts of economic conditions, including, but not limited to: forecasts of GDP growth rates, levels of unemployment, vacancy rates, and changes in the value of commercial real estate properties. Because the CECL methodology is more dependent on future economic forecasts, assumptions, and models than the previous accounting standards, it may result in increases and add volatility to our ACL and future provisions for credit losses. The forecasts, assumptions, and models required by CECL are based upon third-party forecasts, subject to management’s review and adjustment in light of information currently available.

As of December 31, 2025, our ACL as a percentage of total loans HFI was 1.32% and as a percentage of total nonperforming loans HFI was 98.3%. Although management believes that the ACL is adequate to absorb losses on any existing loans that may become uncollectible, we may be required to take additional provisions for credit losses in the future to further supplement the ACL, due to a variety of factors. Although management believes that the ACL is adequate to absorb losses on any existing loans that may become uncollectible, we may be required to take additional provisions for credit losses in the future to further supplement the ACL, either due to management’s decision to do so or because our banking regulators require us to do so. Our bank regulatory agencies will periodically review our ACL and the value attributed to nonaccrual loans or to OREO and may require us to adjust our determination of the value for these items. Our bank regulatory agencies will periodically review our ACL and the value attributed to nonaccrual loans or to real estate acquired through foreclosure and may require us to adjust our determination of the value for these items. These adjustments may adversely affect our business, financial condition and results of operations.

Risks Related to our Growth Strategy

Acquisitions may disrupt our business.

We successfully completed six whole bank acquisitions and one branch acquisition since July 2011. The success of future acquisitions we may consummate may depend, in part, on the ability to realize the estimated cost savings and combine the acquired businesses with our existing operations in a manner that does not materially disrupt the existing customer relationships of either institution, or result in decreased revenues resulting from any loss of customers, and that permits growth opportunities to occur. If we are not able to successfully achieve these objectives, the anticipated benefits of future acquisitions may not be realized fully or at all or may take longer to realize than expected.

There are risks associated with our growth strategy. To the extent that we grow through acquisitions, we cannot ensure that we will be able to adequately or profitably manage this growth. Acquiring other banks, branches or other assets, as well as other expansion activities, involves various risks including the risks of incorrectly assessing the credit quality of acquired assets, encountering greater than expected costs of integrating acquired banks or branches, the risk of loss of customers and/or employees of the acquired institution or branch, executing cost savings measures, not achieving revenue enhancements and otherwise not realizing the transaction’s anticipated benefits. Our ability to address these matters successfully cannot be assured. There is also the risk that the requisite regulatory approvals might not be received and other conditions to consummation of a transaction might not be satisfied during the anticipated timeframes, or at all. In addition, our strategic efforts may divert resources or management’s attention from ongoing business operations, may require investment in integration and in development and enhancement of additional operational and reporting processes and controls, and may subject us to additional regulatory scrutiny. To finance an acquisition, we may borrow funds, thereby increasing our leverage and diminishing our liquidity, or raise additional capital, which could dilute the interests of our existing stockholders.

It is possible that the potential cost savings of one or more acquisitions could turn out to be more difficult to achieve than anticipated and the integration process associated with an acquisition could result in the loss of key employees, the disruption of ongoing businesses or inconsistencies in standards, controls, procedures, and policies that adversely affect our ability to maintain relationships with clients, customers, depositors, and employees or to achieve the anticipated benefits of the acquisitions. Integration efforts could also divert management attention and resources. These integration matters could have an adverse effect on the combined Company.

In addition, if we were to conclude that the value of an acquired business has decreased and that the related goodwill had been impaired, that conclusion would result in an impairment of goodwill charge to us, which would adversely affect our results of operations.

Our business strategy includes plans for organic growth, and our financial condition and results of operation could be adversely affected if we fail to grow or fail to manage our growth effectively.

As part of our general growth strategy, we expect to continue to pursue organic growth, while also continuing to evaluate potential acquisitions and expansion opportunities that we believe provide a strategic or geographic fit with our business. There can be no assurance that we will successfully execute our organic growth strategy, that we will be able to negotiate or finance such activities or that such activities, if undertaken, will be successful.

Our growth initiatives may also require us to recruit experienced personnel to assist in such initiatives. Accordingly, the failure to identify and retain such personnel would place significant limitations on our ability to successfully execute our growth strategy. In addition, to the extent we expand our lending beyond our current market areas, we could incur additional risks related to those new market areas. We may not be able to expand our market presence in our existing market areas or successfully enter new markets.

If we do not successfully execute our growth plan, it could adversely affect our business, financial condition, results of operations, reputation and growth prospects. While we believe we have the executive management resources and internal systems in place to successfully manage our future growth, there can be no assurance growth opportunities will be available or that we will successfully manage growth.

As we expand our business outside of California markets, we may encounter risks that could adversely affect us.

We primarily operate in California, New York, New Jersey and Illinois markets with a concentration of Asian-American individuals and businesses; however, one of our strategies is to expand beyond California into other domestic markets that have concentrations of Asian-American individuals and businesses. We also currently have operations in Las Vegas, Nevada and Honolulu, Hawaii, including operating a branch office, and would consider strategic opportunities for additional branch expansion. In the course of any expansion, we may encounter significant risks and uncertainties that could have a material adverse effect on our operations. These risks and uncertainties include increased expenses and operational difficulties arising from, among other things, our ability to attract sufficient business in new markets, to manage operations in noncontiguous market areas, to comply with all of the various local laws and regulations, and to anticipate events or differences in markets in which we have no current experience. Expansion of our business beyond California could have a material adverse effect on our operations and financial results.

Other Risks Related to Our Business

If we fail to maintain effective internal control over financial reporting, we may not be able to report our financial results accurately and timely.

Our management is responsible for establishing and maintaining adequate internal control over financial reporting and for evaluating and reporting on that system of internal control. In the past, material weaknesses have been identified in our internal controls over financial reporting. A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our financial statements will not be prevented or detected on a timely basis. Our actions to maintain effective controls and remedy any weakness or deficiency may not be sufficient to result in an effective internal control environment and any future failure to maintain effective internal control over financial reporting could impair the reliability of our financial statements, which in turn could harm our business, impair investor confidence in the accuracy and completeness of our financial reports, impair our access to the capital markets, cause the price of our common stock to decline and subject us to increased regulatory scrutiny and/or penalties, and higher risk of shareholder litigation.

We are exposed to risks related to fraud and cyber-attacks.

We continue to enhance and expand our digital products and services to meet client needs and business objectives. These digital products and services often require storing, transmitting, and processing sensitive client, employee, financial, and proprietary business information. These digital products and services often include storing, transmitting, and processing confidential client, employee, monetary, and business information. Because this information can be valuable to threat actors, we and our third-party service providers remain exposed to cyber-attacks, fraud attempts, and other malicious activities seeking to gain unauthorized access to systems or data, misuse or steal information, disrupt operations, or deploy malicious software.

In addition, our clients and vendors rely on technology and systems not managed by us—such as personal computers, mobile devices, networking equipment, and software—to conduct business with us. If the technology or systems of our clients or vendors is compromised, it could result in unauthorized access to, misuse of, or loss of confidential client, employee, financial, or business information. Threat actors using stolen personal or financial information may attempt to fraudulently obtain loans, lines of credit, or other financial products from us, or attempt to deceive our employees, clients, or other users of our systems to disclose additional information to obtain unauthorized access to our systems.

We maintain robust preventive, detective, and administrative safeguards designed to reduce the likelihood and impact of a material cybersecurity event. However, because the tactics used by threat actors evolve rapidly and may not be identified until after an incident has occurred, we may be unable to anticipate or implement timely protections against all emerging threats.

Cybersecurity remains a priority for us, and we continue to develop and enhance controls, processes, and practices designed to protect client information, systems, computers, software, data, and networks. As threats continue to evolve, we may be required to allocate additional resources to further strengthen our security measures.

To date, we have no knowledge of any successful cyber-attack or material information security breach affecting our systems. However, our exposure remains heightened due to the evolving nature of the threats, the continued use of remote work arrangements by employees and service providers, our ongoing expansion of digital banking services, and our reliance on third-party information systems including cloud-based infrastructure, platforms, and software. Recent attacks targeting financial services institutions demonstrate that the risk to our systems remains significant. A successful cyber-attack or data breach involving us or a critical third-party vendor could result in reputational harm, productivity losses, remediation and response costs associated with investigation and resumption of services, client notification and credit monitoring expenses, increased insurance premiums, regulatory investigations or penalties, civil litigation, and other costs, any of which could have a material adverse effect on our business, financial condition, and results of operations. Certain aspects of current or proposed regulatory or legislative changes to laws applicable to the financial industry, if enacted or adopted, may impact the profitability of our business activities, require more oversight or change certain of our business practices, including the ability to offer new products, obtain financing, attract deposits, make loans and achieve satisfactory interest spreads and could expose us to additional costs, including increased compliance costs.

We also incur costs when our customers become the victims of cyber-attacks. For example, various retailers have reported that they have been the victims of a cyber-attack in which large amounts of their clients’ data, including debit and credit card information, is obtained. Our clients may be the victims of phishing scams, providing cyber criminals access to their accounts, or credit or debit card information. In these situations, we incur costs to replace compromised cards and address fraudulent transaction activity affecting our clients.

Both internal and external fraud and theft present significant risks. Mishandling or misuse of confidential client, employee, financial, or business information—whether through system errors, employee actions, or third-party misconduct—could result in regulatory consequences, reputational harm, and financial loss. Fraud can occur in connection with loan originations, lines of credit, ACH transactions, wire transfers, ATM activity, and other transactions, or could result from unauthorized access, employee misconduct, or the interception or theft of information by third parties resulting in financial losses as well as reputational damage.

Operational errors—including information system misconfiguration, clerical mistakes, or disruptions caused by technology failures—may be repeated or amplified before detection due to the high volume of transactions we process. With these transactions, there is a risk that technical flaws, tampering, or manipulation of automated systems, arising from events wholly or partially beyond our control, may give rise to disruption of service to customers and to financial loss or liability. We are also exposed to the risk that our business continuity and data security systems may prove inadequate under certain circumstances.

The occurrence of any of these risks could impair our ability to operate effectively, result in additional costs to remediate issues, expose us to client claims, or cause reputational harm, any of which could have a material adverse effect on our business, financial condition and results of operations.

The development and use of new technologies, including artificial intelligence ("AI"), can present risks and uncertainties that could adversely affect our business and financial condition.

Banking and financial services technology is rapidly evolving, including the development and deployment of AI. We and our third party vendors may develop or integrate AI or other emerging technologies into certain business products, processes, or services to increase efficiency and better serve our customers at a reduced cost. The ability to successfully deploy and manage these emerging technologies, or to integrate them into existing systems, may adversely impact operations resulting in the disruption of service to our customers and liability or financial loss.

AI technologies may produce undesirable results such as producing false data, generating inaccurate calculations, improperly handling or leaking sensitive information, reflecting unintended bias, or otherwise failing to perform as intended. Using third-party providers may result in limited visibility and control over these risks. Any failures in the use of AI or related-technologies, or evolving legal and regulatory requirements governing their use, could result in regulatory consequences, reputational harm, and financial loss, and could have a material adverse effect on our business, results of operations, and financial condition.

Potential environmental liabilities associated with commercial lending could materially and adversely affect our business and financial condition.

In the course of our business, we may foreclose and take title to real estate, and could be subject to environmental liabilities with respect to these properties. We may be held liable to a governmental entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination, or may be required to investigate or clear up hazardous or toxic substances, or chemical releases at a property. The costs associated with investigation or remediation activities could be substantial. In addition, as the owner or former owner of any contaminated site, we may be subject to common law claims by third parties based on damages, and costs resulting from environmental contamination emanating from the property. If we ever become subject to significant environmental liabilities, our business, financial condition, liquidity, and results of operations could be materially and adversely affected. In addition, if hazardous or toxic substances are found on properties pledged as collateral, the value of the real estate could be impaired. If we foreclose on and take title to such properties, we may be liable for remediation costs, as well as for personal injury and property damage. Environmental laws may require us to incur substantial expenses to address unknown liabilities and may materially reduce the affected property’s value or limit our ability to use or sell the affected property.

A natural or man-made disaster or recurring energy shortage in our geographic markets, especially in California, could harm our business.

We are based in California and at December 31, 2025, approximately 58.8% of the aggregate outstanding principal of our total loan portfolio was secured by real estate located in California or businesses in California. In addition, the computer systems that operate our Internet websites and some of their back-up systems are located in California. Historically, California has been vulnerable to natural disasters. Therefore, we are susceptible to the risks of natural disasters, such as earthquakes, wildfires, floods and mudslides. Certain of these natural disasters may be exacerbated by climate change. Natural or man-made disasters and recurring energy shortages could harm our operations directly through interference with communications, including the interruption or loss of our information technology structure and websites, which could prevent us from gathering deposits, originating loans and processing and controlling our flow of business, as well as through the destruction of facilities and our operational, financial and management information systems. A natural or man-made disaster or recurring power outages may also impair the value of our largest class of assets, our loan portfolio, which is comprised substantially of real estate loans. Uninsured or underinsured disasters may reduce borrowers’ ability to repay mortgage loans. Disasters may also reduce the value of the real estate securing our loans, impairing our ability to recover on defaulted loans through foreclosure and making it more likely that we would suffer losses on defaulted loans. California has also experienced energy shortages, which, if they recur, could impair the value of the real estate in those areas affected. Although we have implemented several back-up systems and protections (and maintain business interruption insurance), these measures may not protect us fully from the effects of a natural disaster. For example, the California wildfires in Los Angeles County in January 2025 destroyed considerable commercial and residential properties impacting the businesses and lives of clients, employees and other shareholders. Direct and indirect costs and impacts from wildfires may include potential adverse changes to the level of our nonperforming assets and charge-offs. The occurrence of natural and man-made disasters or energy shortages in California could have a material adverse effect on our business prospects, financial condition and results of operations.

Climate change could have a material negative impact on us and clients.

Our business, as well as the operations and activities of our clients, could be negatively impacted by climate change. Climate change presents both immediate and long-term risks to us and our clients, and these risks are expected to increase over time. Climate change presents both immediate and long-term risks to the Company and its clients, and these risks are expected to increase over time. Climate change presents multi-faceted risks, including: operational risk from the physical effects of climate events on us and our clients’ facilities and other assets; credit risk from borrowers with significant exposure to climate risk; transition risks associated with the transition to a less carbon-dependent economy; and reputational risk from stakeholder concerns about our practices related to climate change, our carbon footprint, and our business relationships with clients who operate in carbon-intensive industries. Climate change presents multi-faceted risks, including: operational risk from the physical effects of climate events on the Company and its clients’ facilities and other assets; credit risk from borrowers with significant exposure to climate risk; transition risks associated with the transition to a less carbon- dependent economy; and reputational risk from stakeholder concerns about our practices related to climate change, the Company’s carbon footprint, and the Company’s business relationships with clients who operate in carbon-intensive industries.

In addition, California remains at the forefront of climate-related disclosure regulations, including the Climate-Related Financial Risk Act (SB 261), as amended by California Senate Bill 219. While these laws are currently subject to legal challenge and the extent to which these laws may be pre-empted by federal law is uncertain, in the absence of federal preemption the Climate-Related Financial Act would apply to us. Related compliance costs represent hard costs beyond current regulatory costs and would also involve the cost of management and personnel resources. In addition, we have multiple stakeholders, among them stockholders, customers, federal and state regulatory authorities, and political entities, who often have differing, and sometimes conflicting, priorities and expectations regarding environmental, social and governance issues. For instance, we operate extensively in California, which is at the forefront of requiring climate-related disclosures, but we also operate in states throughout the country, and there is an increasing number of state-level initiatives opposing environmental, social and governance practices.

New or increased regulations could result in increased compliance costs or capital requirements. Additionally, our reputation and customer relationships may be damaged due to our practices related to climate change, including our involvement, or our customers’ involvement, in certain industries or projects associated with causing or exacerbating climate change, as well as any decisions we make to continue to conduct or change our activities in response to considerations relating to climate change. Ongoing legislative or regulatory developments and changing climate risk management and related practices may result in higher regulatory, compliance and credit risks and costs. Ongoing legislative or regulatory uncertainties and changes regarding climate risk management and practices may result in higher regulatory, compliance, credit, and reputational risks and costs.

We are making efforts to enhance our governance of climate change-related risks and integrate climate considerations into our risk governance framework. Nonetheless, the risks associated with climate change are rapidly changing and evolving in an escalating fashion, making them difficult to assess due to limited data and other uncertainties. We could experience increased expenses resulting from strategic planning, litigation, and technology and market changes, and reputational harm as a result of negative public sentiment, regulatory scrutiny, and reduced investor and stakeholder confidence due to our response to climate change and our climate change strategy, which, in turn, could have a material negative impact on our business, results of operations, and financial condition.

We face strong competition from financial services companies and other companies that offer banking and mortgage banking services, which could harm our business.

Our operations consist of offering banking and mortgage banking services to generate both interest and noninterest income. Many of our competitors offer the same, or a wider variety of, banking and related financial services within our market areas. These competitors include national banks, regional banks and other community banks. We also face competition from many other types of financial institutions, including savings and loan institutions, finance companies, brokerage firms, insurance companies, credit unions, mortgage banks and other financial intermediaries. In addition, a number of out-of-state financial intermediaries have opened production offices or otherwise solicit deposits in our market areas. Additionally, we face growing competition from so-called “online businesses” with few or no physical locations, including online banks, lenders and consumer and commercial lending platforms, as well as automated retirement and investment service providers. Increased competition in our markets may result in reduced loans, deposits and commissions and brokers’ fees, as well as reduced net interest margin and profitability. Ultimately, we may not be able to compete successfully against current and future competitors. If we are unable to attract and retain banking and mortgage loan customers and expand our sales market for such loans, we may be unable to continue to grow our business, which could have a material negative impact on our business, results of operations and financial condition. If we are unable to attract and retain banking and mortgage loan customers and expand our sales market for such loans, we may be unable to continue to grow our business, and our financial condition and results of operations may be adversely affected.

Legislative and regulatory actions taken now or in the future may increase our costs and impact our business, governance structure, financial condition or results of operations.

Our operations are subject to extensive regulation by federal, state and local governmental authorities and are subject to various laws and judicial and administrative decisions imposing requirements and restrictions on part or all of our operations. Federal and state banking regulators have significant discretion and authority to prevent or remedy unsafe or unsound practices or violations of laws or regulations by financial institutions and bank holding companies in the performance of their supervisory and enforcement duties. The exercise of regulatory authority may have a negative impact on our financial condition and results of operations. Additionally, in order to conduct certain activities, including acquisitions, we are required to obtain regulatory approval. There can be no assurance that any required approvals can be obtained, or obtained without conditions or on a timeframe acceptable to us.

In addition, other new proposals for legislation continue to be introduced in the U.S. Congress that could further substantially increase regulation of the bank and non-bank financial services industries and impose restrictions on the operations and general ability of firms within the industry to conduct business consistent with historical practices. Federal and state regulatory agencies also frequently adopt changes to their regulations or change the manner in which existing regulations are applied. Certain aspects of current or proposed regulatory or legislative changes to laws applicable to the financial industry, if enacted or adopted, may impact the profitability of our business activities, require more oversight or change certain of our business practices, including the ability to offer new products, obtain financing, attract deposits, make loans and achieve satisfactory interest spreads and could expose us to additional costs, including increased compliance costs. These changes also may require us to invest significant management attention and resources to make any necessary changes to operations to comply and could have an adverse effect on our business, financial condition and results of operations.

Our use of third party vendors and our other ongoing third party business relationships are subject to increasing regulatory requirements and attention.

We regularly use third party vendors as part of our business. We also have substantial ongoing business relationships with other third parties. These types of third party relationships are subject to increasingly demanding regulatory requirements and attention by our federal bank regulators. Recent regulation requires us to enhance our due diligence, ongoing monitoring and control over our third party vendors and other ongoing third party business relationships. In certain cases, we may be required to renegotiate our agreements with these vendors to meet these enhanced requirements, which could increase our costs. We expect that our regulators will hold us responsible for deficiencies in our oversight and control of our third party relationships and in the performance of the parties with which we have these relationships. As a result, if our regulators conclude that we have not exercised adequate oversight and control over our third party vendors or other ongoing third party business relationships or that such third parties have not performed appropriately, we could be subject to enforcement actions, including civil money penalties or other administrative or judicial penalties or fines as well as requirements for customer remediation, any of which could have a material adverse effect our business, financial condition or results of operations.

Risks Related to an Investment in Our Common Stock

The price of our common stock may fluctuate significantly, and this may make it difficult for you to sell shares of common stock owned by you at times or at prices you find attractive.

The trading price of our common stock may fluctuate widely as a result of a number of factors, many of which are outside our control. In addition, the stock market is subject to fluctuations in the share prices and trading volumes that affect the market prices of the shares of many companies. These broad market fluctuations could adversely affect the market price of our common stock. Among the factors that could affect our stock price are:

actual or anticipated quarterly fluctuations in our operating results and financial condition and prospects;

changes in revenue or earnings estimates or publication of research reports and recommendations by financial analysts;

failure to meet analysts’ revenue or earnings estimates;

speculation in the press or investment community;

strategic actions by us or our competitors, such as acquisitions or restructurings;

acquisitions of other banks or financial institutions;

actions by institutional stockholders;

fluctuations in the stock price and operating results of our competitors;

general market conditions and, in particular, developments related to market conditions for the financial services industry;

adverse audit opinion on the effectiveness of our internal controls;

existing or increased regulatory compliance requirements, changes or proposed changes in laws or regulations, or differing interpretations thereof, affecting our business, or enforcement of laws and regulations;

anticipated or pending investigations, proceedings, or litigation that involve or affect us;

successful management of reputational risk;

geopolitical and public health conditions such as acts or threats of terrorism, military conflicts, pandemics and public health issues or crises; and

domestic and international economic factors, such as interest rates or foreign exchange rates, stock, commodity, credit, or asset valuations or volatility, unrelated to our performance.

The stock market and, in particular, the market for financial institution stocks, has experienced significant volatility. As a result, the market price of our common stock may be volatile. In addition, the trading volume in our common stock may fluctuate more than usual and cause significant price variations to occur. The trading price of the shares of our common stock and the value of our other securities will depend on many factors, which may change from time to time, including, without limitation, our financial condition, performance, creditworthiness and prospects, future sales of our equity or equity related securities, and other factors identified above in “Forward-Looking Statements,” and in this Item 1A. Risk Factors. The capital and credit markets can experience volatility and disruption. Such volatility and disruption can reach unprecedented levels, resulting in downward pressure on stock prices and credit availability for certain issuers without regard to their underlying financial strength. A significant decline in our stock price could result in substantial losses for individual stockholders and could lead to costly and disruptive securities litigation.

Our dividend policy may change.

We have paid quarterly dividends since our initial public offering in the third quarter of 2017. We paid total dividends of $0.64 per share in 2023, 2024, and 2025. We have no obligation to pay dividends and we may change our dividend policy at any time without notice to our shareholders. Holders of our common stock are only entitled to receive such cash dividends as our board of directors, in its discretion, may declare out of funds legally available for such payments. Furthermore, consistent with our strategic plans, growth initiatives, capital availability and requirements, projected liquidity needs, financial condition, and other factors, we have made, and will continue to make, capital management decisions and policies that could adversely impact the amount of dividends paid to our common shareholders.

We are a separate and distinct legal entity from our subsidiaries, including the Bank. We receive substantially all of our revenue from dividends from the Bank, which we use as the principal source of funds to pay our expenses. We receive substantially all of our revenue from dividends from the Bank and RAM, which we use as the principal source of funds to pay our expenses. Various federal and/or state laws and regulations limit the amount of dividends that the Bank and certain of our non-bank subsidiaries may pay us. Such limits are also tied to the earnings of our subsidiaries. If the Bank does not receive regulatory approval or if our subsidiaries’ earnings are not sufficient to make dividend payments to us while maintaining adequate capital levels, our ability to pay our expenses and our business, financial condition or results of operations could be materially and adversely impacted.

Our business and financial results could be impacted materially by adverse results in legal proceedings.

Various aspects of our operations involve the risk of legal liability. We have been, and expect to continue to be, named or threatened to be named as defendants in legal proceedings arising from our business activities. We establish accruals for legal proceedings when information related to the loss contingencies represented by those proceedings indicates both that a loss is probable and that the amount of the loss can be reasonably estimated, but we do not have accruals for all legal proceedings where we face a risk of loss. In addition, amounts accrued may not represent the ultimate loss to us from those legal proceedings. Thus, our ultimate losses may be higher or lower, and possibly significantly so, than the amounts accrued for loss contingencies arising from legal proceedings, and these losses could have a material and adverse effect on our business, financial condition, results of operations and the value of our common stock.

Future sales or equity issuances could result in dilution, which could cause our common stock price to decline.

We have outstanding options to purchase 151,000 shares of our common stock and unvested restricted stock units of 191,091 as of December 31, 2025, that may be exercised or vest and then otherwise be sold (assuming all vesting requirements are met), and we have the ability to issue equity awards for up to an additional 878,916 shares of common stock pursuant to our 2017 Omnibus Stock Incentive Plan. The sale of any such shares could cause the market price of our stock to decline, and concerns that those sales may occur could cause the trading price of our common stock to decrease or to be lower than it might otherwise be. The sale of any of such shares could cause the market price of our stock to decline, and concerns that those sales may occur could cause the trading price of our common stock to decrease or to be lower than it might otherwise be.

We are also generally not restricted from issuing additional shares of our common stock, up to the 100 million shares of common stock and 100 million shares of preferred stock authorized in our articles of incorporation, which in each case could be increased by a vote of a majority of our shares. We may issue additional shares of our common stock in the future pursuant to current or future equity compensation plans, upon conversions of preferred stock or debt, upon exercise of warrants or in connection with future acquisitions or financings. If we choose to raise capital by selling shares of our common stock for any reason, the issuance would have a dilutive effect on the holders of our common stock and could have a material negative effect on the market price of our common stock.

Provisions in our charter documents and California law may have an anti-takeover effect, and there are substantial regulatory limitations on changes of control of bank holding companies.

Provisions of our charter documents and the California General Corporation Law (“CGCL”) could make it more difficult for a third party to acquire us, even if doing so would be perceived to be beneficial by our shareholders. Furthermore, with certain limited exceptions, federal regulations prohibit a person or company or a group of persons deemed to be “acting in concert” from, directly or indirectly, acquiring more than 10% (5% if the acquirer is a bank holding company) of any class of our voting stock or obtaining the ability to control in any manner the election of a majority of our directors or otherwise direct the management or policies of our company without prior notice or application to and the approval of the Federal Reserve. Accordingly, prospective investors need to be aware of and comply with these requirements, if applicable, in connection with any purchase of shares of our common stock. Moreover, the combination of these provisions effectively inhibits certain mergers or other business combinations, which, in turn, could adversely affect the market price of our common stock.

Item 1B. Unresolved Staff Comments.

None.

Item 1C. Cybersecurity.

Cybersecurity threats continue to evolve as the threat landscape evolves. The Company continuously works to evolve its cybersecurity practices with the changing landscape. The Bank continuously works to evolve its cybersecurity practices with the changing landscape. Significant resources are devoted to protecting and enhancing the security of networks, computer systems, data storage devices, and other systems and technology. The Company's security efforts and implemented controls are designed to protect against, among other things, cybersecurity attacks that can result in unauthorized access of confidential information, the destruction of data, disruptions to or degradations of service, the sabotaging of systems or other damage. The Bank’s security efforts and implemented controls are designed to protect against, among other things, cybersecurity attacks that can result in unauthorized access to confidential information, the destruction of data, disruptions to or degradations of service, the sabotaging of systems or other damage.

Third parties with which the Company does business, which facilitate the Company's business activities, e.g., vendors, supply chain, exchanges, clearing houses, central depositories, and financial intermediaries are sources of cybersecurity risk to the Company. Third-party incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber-attacks, including ransomware and supply-chain compromises could have a material adverse effect on the Company, including in circumstances in which an affected third party is unable to deliver a product or service to the Company or results in lost or compromised information of the Company or its clients or customers. Third-party incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber-attacks, including ransomware and supply-chain compromises could have a material adverse effect on the Bank, including in circumstances in which an affected third party is unable to deliver a product or service to the Bank or results in lost or compromised information of the Bank or its clients or customers.

Company customers are also sources of cybersecurity risk to the Company and its information assets, particularly when their activities and systems are beyond the Company’s own security and control systems. The Company provides information to its customers and other external parties concerning cybersecurity risks, including opportunities to reduce cybersecurity risk. The Bank provides information to its customers and other external parties concerning cybersecurity risks including opportunities to reduce cybersecurity risk.

The security program is commensurate with the size and complexity of the Company. Risks from cybersecurity threats, including any previous cybersecurity events, have not materially affected the Company or its business strategy, results of operations or financial condition. Risks from cybersecurity threats, including any previous cybersecurity events, have not materially affected the Bank or its business strategy, results of operations or financial condition.

Cybersecurity Risk Management

The Company maintains an Information Security and Cybersecurity Program to support the management of cybersecurity risk as a component of the Company’s Enterprise Risk Management (“ERM”) framework. The information security and cybersecurity program is designed to manage risks relating to cybersecurity threats and leverages controls, best practices recommendations, and standards from the Federal Financial Institutions Examination Council (“FFIEC”), the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (CSF) 2.0, the ISO/IEC 27001 Security Framework, and standards set by relevant legal and regulatory authorities. The information security and cybersecurity program is designed to assess, identify, and manage risks from cybersecurity threats and leverages controls, best practices recommendations, and standards from the Federal Financial Institutions Examination Council (“FFIEC”) and the National institute of Standards and Technology (“NIST”) Cybersecurity Framework, and standards set by relevant legal and regulatory authorities.

The Information Security Officer (“ISO”) oversees the Company's Information Security and Cybersecurity Program and leads the Information Security team. Reporting to the Chief Risk Officer (“CRO”) and Chief Information Officer (“CIO”), the ISO and his team are responsible for identifying, assessing and managing information security and cybersecurity risks, and for implementing and maintaining controls to prevent, detect and respond to cybersecurity threats and incidents, safeguarding the confidentiality, integrity and availability of the Company s information systems and data.

As part of the Information Security and Cybersecurity Program, the Company conducts periodic employee training to educate employees on information and cybersecurity risks and to reinforce security management practices and compliance with the Company's security policies and standards. Training is mandatory for all employees and is supplemented by testing initiatives, including periodic phishing tests. The training is mandatory for all employees and is supplemented by testing initiatives, including periodic phishing tests.

The Company's policies and procedures concerning cybersecurity matters include processes to safeguard its information systems, monitor these systems, protect the confidentiality and integrity of its data, detect intrusions into its systems, and respond to cybersecurity incidents. Extensive technical controls are in place for identifying and managing cybersecurity risks and safeguarding Company information systems and information. Extensive technical controls are in place for identifying and managing cybersecurity risks and safeguarding our information systems and information. The Company uses sophisticated industry-recognized monitoring and threat detection technologies that continuously monitor its information systems and provide threat detection alerts. The Bank uses sophisticated industry-recognized monitoring and threat detection technologies that continuously monitor our information systems and provide threat detection alerts. The Company’s strategy for assessing, identifying, and managing cybersecurity risks and for evaluating the effectiveness of its cybersecurity program includes periodic risk assessments and testing of its systems, processes and procedures through audits, penetration testing, vulnerability scans, tabletop exercises, and other related exercises. The Bank’s strategy for assessing, identifying, and managing cybersecurity risks and for evaluating the effectiveness of its cybersecurity program includes periodic risk assessments and testing of our systems, processes and procedures through audits, penetration testing, vulnerability scans, tabletop exercises, and other related exercises.

The Company has an incident response program designed to enable the Company to respond to cybersecurity incidents, coordinate as appropriate with law enforcement and other government agencies, notify clients and customers, as applicable, and recover from such incidents. In addition, the Company actively partners with appropriate government and law enforcement agencies and peer industry forums to participate in threat intelligence discussions and simulations to assist with understanding the full spectrum of cybersecurity risks and enhancing defenses and improving resiliency in the Company’s operating environment. In addition, the Bank actively partners with appropriate government and law enforcement agencies and peer industry forums to participate in threat intelligence discussions and simulations to assist with understanding the full spectrum of cybersecurity risks and enhancing defenses and improving resiliency in the Bank’s operating environment.

The Company engages third parties on a regular basis to assess, test, audit or assist with the implementation of risk management strategies, policies, and procedures to enhance the detection and management of cybersecurity risks. Cybersecurity risk management strategies include but are not limited to, consultants who assist with assessing risks, assessing systems alignment with the NIST Cybersecurity Framework and FFIEC standards, penetration testing, tabletop exercises and other regulatory agency requirements.

The Company maintains a process to evaluate and manage risks associated with third-party service providers. We conduct a full vendor due diligence review before engagement, review specific security measures in our contracts, and maintain continued monitoring during the engagement including yearly due diligence reviews.

Governance

The IT Committee and Audit Committee are the principal board committees that oversee the Company’s assessment and management of cybersecurity risk, including oversight of the implementation and maintenance of appropriate controls in support of the Company’s Information Security and Cybersecurity Program. Both the IT and Audit Committees are comprised of professionals with risk management and information technology expertise to manage any material risk from a cybersecurity threat standpoint.

The membership of the IT Committee includes members of the executive management team and directors of the Company. The CIO and ISO actively participate in all IT Committee meetings. The CIO has over 20 years of work experience in the development, operation and management of Information Technology at financial institutions. The ISO has over 10 years of work experience in building and overseeing cybersecurity programs at financial institutions. Both CIO and ISO have extensive experience and qualifications in various technology and information security disciplines, including relevant experience at the Company. Additionally, the Audit Committee has oversight of the management of cybersecurity risk via validation and review of IT and cybersecurity risk assessments and audits. The ISO provides reporting metrics on cybersecurity risks to the IT Committee, which meets at least four times a year. The IT and Audit Committees assist the Board of Directors in its oversight.

As part of its oversight of management’s implementation and maintenance of the Company’s risk management framework, the Company’s Board of Directors receives regular updates directly from both IT and Audit Committees concerning cybersecurity matters. These updates generally include information regarding cybersecurity and technology developments, the Company’s Information Security Program and recommended changes to that program, cybersecurity policies and practices, and ongoing initiatives to improve information security, as well as any significant cybersecurity incidents and the Company's efforts to address those incidents. These updates generally include information regarding cybersecurity and technology developments, the Bank’s Information Security Program and recommended changes to that program, cybersecurity policies and practices, and ongoing initiatives to improve information security, as well as any significant cybersecurity incidents and the Bank's efforts to address those incidents.

Notwithstanding the Company's efforts at cybersecurity, the Company cannot guarantee that those efforts will successfully prevent or mitigate a cybersecurity incident that could have a material adverse effect on it. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors – Risks Related to Our Business. Risk Factors–Risks Related to Our Business.

Recently Filed
Click on a ticker to see risk factors
Ticker * File Date
RBB an hour ago
TETEF an hour ago
CHGG an hour ago
SABS an hour ago
TREE 2 hours ago
CHRS 2 hours ago
ACIC 2 hours ago
EDIT 2 hours ago
AMPY 2 hours ago
GLRE 2 hours ago
NL 2 hours ago
FSP 2 hours ago
OYSE 2 hours ago
OWLT 2 hours ago
RAIL 2 hours ago
SVCC 2 hours ago
HTBK 2 hours ago
FIGX 2 hours ago
OSUR 2 hours ago
ACCO 2 hours ago
NPWR 2 hours ago
ZVRA 2 hours ago
MYO 2 hours ago
CRBP 2 hours ago
RBOT 2 hours ago
RPAY 2 hours ago
SEPN 2 hours ago
KRO 2 hours ago
MGNX 2 hours ago
DSGN 2 hours ago
EGBN 2 hours ago
FISI 2 hours ago
BOX 2 hours ago
CTM 2 hours ago
ALXO 2 hours ago
DDD 2 hours ago
TIPT 2 hours ago
VYGR 2 hours ago
EBMT 3 hours ago
BCBP 5 hours ago
BETA 9 hours ago
CRCL 10 hours ago
DY 10 hours ago
GBTG 10 hours ago
SPRB 11 hours ago
DNTH 11 hours ago
BOLD 11 hours ago
RNAC 11 hours ago
CCRN 12 hours ago
MASS 12 hours ago

OTHER DATASETS

House Trading

Dashboard

Corporate Flights

Dashboard

App Ratings

Dashboard