NASDAQ: BAFN

Community Banking

The Bank has structured its community banking services and charges for such services in a manner designed to attract consumers, small and medium sized businesses, and professionals located primarily in Pinellas, Hillsborough, Sarasota, Manatee, and Pasco Counties. The Bank focuses on customers that are seeking the flexibility and personalized relationships that a community bank can provide. The Bank offers specialized business and personal checking accounts, internet banking and online bill payment, lock box services, remote capture and deposit, cash management, wire transfers, safety deposit boxes, courier services, retail investment services, and ACH originations, among other services.

The Bank also offers customary community bank deposit products, including interest-bearing and noninterest-bearing checking accounts, MMDAs, savings accounts, certificates of deposit and IRAs. The consumer product offering also includes unique programs, including, among others: 1) the Essential checking that assists customers in rebuilding their access to the banking system, 2) the TrendSetters Club which offers special benefits for those customers age 50+ years, and 3) the Cash Kids’ Club savings account that offers those age 12 and under special rates while teaching children basic financial skills through interactive and mobile application tools. The Bank’s business deposit products and related services include free checking accounts, interest-bearing checking accounts, savings accounts, MMDA, and access to business mobile and online banking, treasury management, cash management, merchant processing services, lock box services, remote deposit capture, and night depository.

A wide range of loans are also offered, including commercial, consumer, and real estate loans. The commercial lending efforts are directed principally toward businesses and professionals who otherwise do business with us, and include commercial real estate mortgages, construction and development loans, working capital loans, and business expansion loans. The Bank has a healthcare banking solution with flexible lending options and other financial solutions designed specifically for healthcare businesses to help healthcare practitioners and their employees thrive. In addition, the Bank has a minority lending program for women or minority business owners looking to take their business to the next level. BayFirst focuses its government guaranteed and commercial lending divisions on providing the customer quick turnaround, competitive rates, and an easy application process. The Bank offers personal lines of credit, auto, boat, and recreational vehicle loans, residential mortgages, and home equity lines of credit. The Bank has been particularly successful in penetrating the small business community.

As of December 31, 2025, the Community Banking Division operated from twelve banking centers in the Tampa Bay area: five in Pinellas County, two in Hillsborough County, one in Manatee County, and four in Sarasota County.

Government Guaranteed Lending

In the fourth quarter of 2025, management discontinued its nationwide SBA 7(a) lending business.The Bank continues to offer SBA 504 and USDA loans through the community banking centers. The USDA guarantees up to 80% of USDA B&I loan balances as an incentive for financial institutions to make loans to businesses located in rural areas. The loans can be priced competitively relative to conventional financing.

Residential Mortgage Division

In the third quarter of 2022, management decided to discontinue its nationwide residential lending business. Prior to those decisions, the Residential Mortgage Division operated from the banking centers in the Tampa Bay/Sarasota area and loan production offices nationwide. As a result of the discontinuance, the nationwide residential line of business was reclassified as a discontinued operation and reported in the financial statements as such. The Bank continues to offer fixed and variable rate home mortgages for the purchase and refinance of residential properties through the community banking centers.

Competition

All phases of the Bank’s operations are highly competitive. Many commercial banks and other competitors have assets, capital, lending limits, and name recognition that are materially larger than the Bank’s. The Bank competes with other financial service providers for loans and deposits. These competitors include:

•national, super-regional, and regional financial institutions that have well-established branches and significant market share in the communities the Bank serves;

•finance companies, investment banking and brokerage firms, and insurance companies that offer bank-like products;

•credit unions, which can offer highly competitive rates on loans and deposits because they receive tax advantages not available to commercial banks;

•other community banks that compete with the Bank for clients desiring a high level of service; and

•technology-based financial institutions, including large national, super-regional, and regional banks offering online deposit, bill payment and mortgage loan application services.

Some of the non-traditional financial institution competitors are not subject to the same degree of regulatory oversight to which the Bank is subject.

Among the advantages that the larger competitors have over the Bank are their ability to finance wide-ranging marketing campaigns and to allocate their investment assets to products with the highest yields and demands. Several of the competitors offer certain services, such as trust departments, that the Bank does not offer. By virtue of their greater total capital, these financial service providers have substantially higher loan-to-one borrower limits than the Bank (loans-to-one borrower limits apply to an individual customer’s total extension of credit as a percentage of a bank’s total capital). These competitors may intensify their advertising and other marketing activities to counter any efforts by the Bank to attract new business.

To compete with the financial institutions in its primary service area, the Bank capitalizes upon the flexibility that its independent status allows, including making decisions locally. This includes solicitation of business, professional, and personal accounts through the personal efforts of the Bank’s directors and officers. The Bank believes that a locally-based bank is often perceived by the local business community as possessing a clearer understanding of local commerce and the needs of the community. Consequently, its customers expect that the Bank will be able to make prudent lending decisions quicker and with a better understanding of the market than larger competitors. The Bank focuses on the smaller commercial customer because this segment offers the greatest concentration of potential business and historically has tended to demonstrate a higher degree of loyalty in their banking relationships. The Bank can respond quickly to changes in the interest rates paid on time and savings deposits and charged on loans, and to charges imposed on depository accounts, so as to remain competitive in the marketplace. If there are customers whose loan demands exceed the Bank’s loan limits, the Bank can arrange for such loans on a participation basis with other financial institutions.

Various legislative actions in recent years have led to increased competition among financial institutions. With the enactment of various laws and regulations affecting interstate banking expansion, it is easier for financial institutions located outside of Florida to enter the Florida market, including the Bank’s target markets. In addition, recent legislative and regulatory changes and technological advances have enabled customers to conduct banking activities without regard to

geographic barriers, through internet and telephone-based banking and similar services. There can be no assurance that the United States Congress, the Florida Legislature, or the applicable bank regulatory agencies will not enact legislation or promulgate regulations that may further increase competitive pressures on the Bank.

Lending Philosophy and Credit Risk Management

Historically, the Bank believes they have made sound, high-quality loans while recognizing that lending involves a degree of risk. The Bank’s centralized credit approval process and loan policies are designed to assist management in managing this risk. The policies provide a general framework for loan origination, monitoring, and funding. The Bank’s loan approval process is characterized by centralized authority supported by a risk control environment that provides for prompt and thorough underwriting of loans. The loan approval process begins with obtaining detailed financial and other information from the Bank’s borrowers. The Bank also relies on its loan and executive officers’ in-depth knowledge of its markets and borrowers.

Regardless of the loan type or amount, no single individual has sole loan approval authority. The objective of the loan approval process is to provide a disciplined, consistent, predictable, and collaborative approach to larger credits, while maintaining responsiveness to client needs. Commercial loan decisions are documented as to the borrower’s business, loan purpose, the evaluation of the repayment source and associated risks, the evaluation of collateral, loan covenants, loan monitoring requirements, and the risk rating rationale. The Bank’s strategy for approving loans is to follow conservative loan policies and consistent underwriting practices which include:

• Granting credit on a sound basis with full knowledge of the purpose and source of repayment for such credit;

• Ensuring that primary and secondary sources of repayment are adequate in relation to the amount of the loan;

• Requiring documentation, including appraisals or valuations, sufficient to enable informed underwriting;

• Developing and adhering to desired levels of diversification for the loan portfolio as a whole and for loans within each category; and

• Ensuring that each loan is properly documented and that any insurance coverage requirements are satisfied.

The loan policies generally include other underwriting guidelines for loans collateralized by real estate. These underwriting standards are designed to determine the maximum loan amount that a borrower has the capacity to repay based, in part, upon the borrower’s cash flow and income. The loan policies include maximum amortization schedules and loan terms for each category of loans. In addition, the loan policies provide guidelines for personal guarantees, appraisals and valuations, loan-to-value ratios, environmental review, loans to employees, executive officers and directors, problem loan identification, maintenance of an adequate credit loss reserve, and other matters relating to lending practices.

The community banking centers originate residential mortgage, consumer and commercial loans. The Bank utilizes a broker arrangement to originate residential mortgage loans to be sold in the secondary market. These residential mortgage loans are underwritten to meet secondary market standards. Some residential mortgage loans are held for the Bank’s portfolio. Portfolio loans are primarily underwritten by the Bank on the borrowers’ financial strength and cash flow, with conservative loan-to-value requirements. Consumer loans include loans to individuals for automobiles, boats, and other major personal, family, or household purposes. They are underwritten on the credit quality of the individual borrower and may be secured or unsecured. Commercial lending products include a wide variety of credit facilities, such as owner occupied and non-owner occupied commercial real estate, multifamily real estate, construction, land acquisition, and commercial and industrial loans. In general, the Bank’s commercial lending strategy focuses on the financial strength and successful track record of commercial loan applicants more than the project or type of property that would serve as collateral for a loan. These loans are underwritten by an independent in-house Credit Underwriting Department in accordance with its credit policy.

The Bank originates loans through the USDA’s B&I program. The Bank also originates loans through the SBA’s 504 loan program. All government guaranteed loans regardless of size which require projection-based underwriting or have other complex characteristics, such as business acquisition financing, are underwritten subject to SBA or USDA B&I guidelines and contain a thorough underwriting analysis based on the credit quality of any guarantor as well as the historical and projected debt service coverage.

Risk Management

The Company believes that effective risk management and control processes are critical to safety and soundness of the Bank, the ability to predict and manage the challenges that they face, and, ultimately, the long-term corporate success. Risk management refers to the activities by which the Company identifies, measures, monitors, evaluates, and manages the risks they face in the course of banking activities. These risks include liquidity, interest rate, credit, operational, compliance, regulatory, strategic, financial, and reputational risk exposures. The Board of Directors, both directly and through their committees, are responsible for overseeing the risk management processes, including quarterly enterprise risk management assessments and annual assessments in the following areas: (i) cyber; (ii) BSA/anti-money laundering; and (iii) third-party risk, with each of the committees of the Board of Directors assuming a different and important role in overseeing the management of the risks.

The Audit and Risk Management Committees of the Board of Directors are responsible for overseeing risks associated with financial matters (particularly financial reporting, accounting practices and policies, disclosure controls and procedures, and internal control over financial reporting) as well as other enterprise risks. The Compensation Committee of the Board of Directors has primary responsibility for risks and exposures associated with the compensation policies, plans, and practices regarding executive compensation, Board compensation, and the compensation structure generally. The Compensation Committee, in conjunction with the Chief Executive Officer and other members of the management team, as appropriate, reviews the incentive compensation arrangements to ensure these programs are consistent with applicable laws and regulations, including safety and soundness requirements, and do not encourage imprudent or excessive risk-taking by the employees. The Nominating Committee of the Board of Directors oversees risks associated with the independence of the Board of Directors and potential conflicts of interest.

The senior management team is responsible for implementing the risk management processes by assessing and managing the risks we face, including strategic, operational, regulatory, investment, and execution risks, on a day-to-day basis, and reporting to the Board of Directors regarding the risk management processes. The senior management team is also responsible for creating and recommending to the Board of Directors for approval of appropriate risk appetite metrics reflecting the aggregate levels and types of risk they are willing to accept in connection with the operation of the business and pursuit of the business objectives.

The role of the Board of Directors in the Company’s risk oversight is consistent with the leadership structure, with the Chief Executive Officer and the other members of senior management having responsibility for assessing and managing the risk exposure, and the Board of Directors and their committees providing oversight in connection with those efforts. The Company believes this division of risk management responsibilities presents a consistent, systemic, and effective approach for identifying, managing, and mitigating risks throughout the Company’s operations.

Information Technology Systems

The Company has made, and continues to make, significant investments in its information technology systems and staff to support banking activities. The Company believes this investment will support continued growth and enable them to enhance the capabilities to offer new products, improve overall customer experience, improve profitability through efficiencies, maintain and improve cybersecurity, and provide scalability for future growth. The Company utilizes nationally recognized software vendors and their cloud/hosted models, which allow them to outsource the processing of data. The Company’s internal network and e-mail systems are administered by a managed service provider specializing in financial institutions, and they maintain production infrastructure in a data center facility near Tampa, Florida. This site provides for power and connectivity redundancy, and they maintain a disaster recovery program, including a cloud-based recovery environment.

The majority of the other systems, including electronic funds transfer, transaction processing, and online banking services are hosted by third-party service providers. The scalability of this infrastructure will support the Bank’s growth strategy. In addition, the tested capability of these vendors to automatically switch over to standby systems should allow the Bank to recover the systems and provide business continuity quickly in case of a disaster.

Privacy, Data Protection and Cybersecurity

The regulatory framework for data privacy and cybersecurity is rapidly evolving. Current federal law requires financial institutions to periodically disclose their privacy policies and practices related to sharing client information. Such laws allow consumer clients to opt out of having their information shared with unaffiliated third parties under certain circumstances. Other federal and state laws and regulations impact the ability to share certain information with affiliates

and non-affiliates for marketing and/or non-marketing purposes, or to contact clients with marketing offers. Current federal law also requires financial institutions to implement a comprehensive information security program. Such programs must include administrative, procedural, and physical safeguards to ensure the security and confidentiality of client records and personal information. These security and privacy policies and procedures are in effect across the Bank.

Federal banking agencies pay close attention to the cybersecurity practices of banks. Such agencies review an institution’s information technology program and its ability to prevent cyberattacks. The FFIEC’s Architecture, Infrastructure, and Operations (AIO) Booklet, calls for a layered security approach that incorporates administrative, procedural, and physical controls to include employee, vendor, and client awareness training. The Bank’s cybersecurity and information security practices incorporate preventative, detective, corrective, compensatory, and deterrent controls. Failing to have adequate cybersecurity safeguards in place, in accordance with AIO and other applicable regulations and laws, can result in supervisory criticism, monetary penalties and reputational harm.

The Federal Reserve, OCC, and FDIC adopted regulations for computer-security incident notification requirements for banking organizations and their bank service providers. Among other things, this regulation requires a bank to notify its primary federal regulator within 36 hours after identifying a "computer-security incident" that the bank believes in good faith could: (i) materially disrupt or degrade its business or operations in a manner that would threaten the viability of its operations and result in clients being unable to access their deposit and other accounts; (ii) result in a material loss of revenue, earnings or franchise value; or (iii) pose a threat to the financial stability of the United States.

Data privacy and data protection are also areas of increasing regulatory and legislative focus. The Bank is subject to rules and regulations issued by the Federal Trade Commission, which regulates unfair or deceptive acts or practices, including those related to data privacy and cybersecurity. Like other lenders, the Bank uses credit bureaus in its underwriting activities. Use of such data is regulated under the Fair Credit Reporting Act, which also regulates identity theft prevention programs, reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information between affiliates, and using affiliate data for marketing purposes. Federal law further requires financial institutions to explain their information-sharing practices to their clients and to protect sensitive client information.

Human Capital

Since opening in 1999, BayFirst has grown significantly without losing sight of its commitment to make an impact in the communities served and be Here for What’s Next® in the lives of the Company’s customers, communities, employees, and investors. As of December 31, 2025, BayFirst had 145 employees (144 full-time and 1 part-time) and recognizes that they are its greatest asset. Providing a work environment that is inclusive, transparent, and comfortable for all is foundational to the Bank’s core beliefs. The Company is an organization that values open communication and collaboration in a professional and challenging, yet informal atmosphere.

Total Rewards

The Bank’s competitive compensation and benefits package helps attract and retain top talent and demonstrates its belief that engaged and satisfied employees directly correlate to engaged and satisfied customers, generating long-term value for the Company’s stakeholders.

The Bank’s goal is to provide the most competitive compensation and benefit plans possible. BayFirst maintains a living minimum wage of $20 per hour. The Bank has a generous 401(k) plan. Additionally, employees have the opportunity to grow their ownership in the Company through a discounted non-qualified Employee Stock Purchase Plan.

BayFirst offers a wide range of health and welfare plans designed to fit its diverse population. The Bank provides 100% employer-paid premiums for medical, dental, vision, disability, and life insurance for the employee. The Bank offers an employee wellness program designed to support the whole employee which encompasses physical, mental, social, and financial wellness.

BayFirst provides both paid maternity and paternity leave through the parental leave program. In addition, the Banks’ no-cost, salary continuation policy is administered in-house and provides up to 12 weeks of medical disability leave at 100% pay. The Bank recognizes the burdensome expense of dependent care and provides a company match to employees’ dependent care FSA accounts. The Bank provides paid volunteer time off to encourage all employees to give back to their community, while building engagement and pride in the organization.

Training and Development

As part of the commitment to being a top employer in the industry and the premier community bank of Tampa Bay, BayFirst offers a growing internal Learning and Development Center where employees not only learn compliance and regulation, but also have the opportunity to strengthen core competencies for career growth and personal development.

The Bank offers both a tuition reimbursement and student loan assistance program to all eligible employees. The Bank offers these programs to nurture the professional development of the Bank’s colleagues and ease the financial burden associated with continuing education.

Corporate Social Responsibility

The Bank’s cultural foundation of being current and comfortable for all drives inclusion throughout the entire organization. This inclusive culture enhances its workforce, expands the markets and fosters a culture of belonging for its employees, customers and communities in which the Bank serves.

As of December 31, 2025, the Bank’s employee base was comprised of individuals from all walks of life, genders, ethnicities, races, ages and differing economic and social backgrounds. Females represented 60% of the Company’s employee base while minorities represented 34% of its population. The officer base was 57% female and 16% minority.

BayFirst has an active employee council with the purpose of ensuring BayFirst reflects the values, respects the viewpoints, and acknowledges the differences of not only the community members it serves, but also the people it employs. Through its focus on these three core components, the council seeks to build an environment where everyone belongs, everyone is heard, everyone is aware of what’s next, and everyone is given the opportunity to succeed. The council actively advocates for the ongoing implementation and evaluation of internal and external programs, initiatives, and procedures to ensure the bank remains forward-thinking and aligned with the ever-evolving societal landscape. Through its focus on cultural responsibility, the council works to fulfill its obligation to be the voice for all associated with BayFirst.

Employee Engagement

The Bank believes employee engagement is what sets the Bank apart from the competition. The Bank endeavors to recruit and retain some of the best and brightest talent across the United States. When highly talented, skilled and driven individuals join the organization, they bring with them some of the best ideas, strategies, procedures and thoughts.

BayFirst understands that harnessing this level of engagement is critical to its success and has developed several channels to do so. The Bank’s Bright Ideas Submission Portal allows any employee to submit their ideas for improvement or change of policies, procedures, benefits or any other item they believe will improve the organization. To ensure employees understand the commitment of listening to feedback, each Bright Idea submission is reviewed by the CEO and executive team.

The CEO also hosts a quarterly CEO’s council where individuals from across the organization spend the day with the CEO and executive team, providing feedback and input on improvement opportunities. The Bank also completes periodic Officer’s Surveys where each officer is asked to provide feedback on specific areas of the organization and its strategy.

One of the greatest engagement and communication tools is the “What’s Next” call where ALL employees are invited to a bi-weekly video conference where ideas are exchanged, updates are provided, and business and individual recognitions are communicated.

Supervision and Regulation

General

As a bank holding company, the Company is subject to an extensive body of state and federal banking laws and regulations that impose specific requirements and restrictions on virtually all aspects of the Company’s operations. The Company is affected by government monetary policy and by regulatory measures affecting the banking industry in general.

The following is a summary of some of the statutes, rules, and regulations that affect the operations. This summary is qualified in its entirety by reference to the particular statutory and regulatory provision referred to below, and is not intended to be an exhaustive description of the applicable statutes or regulations. Any change in applicable laws or regulations may have a material adverse effect on the business.

BayFirst Financial Corp.

BayFirst is a bank holding company within the meaning of the Bank Holding Company Act of 1956, as amended. As such, the Company is required to file annual reports and other information with the Federal Reserve regarding the Company’s business operations and those of the subsidiary. The Company is also subject to the supervision of, and to periodic inspections by, the Federal Reserve.

The BHCA generally requires every bank holding company to obtain approval from the Federal Reserve before:

•acquiring all or substantially all of the assets of a bank;

•acquiring direct or indirect ownership or control of 5% or more of the voting shares of any bank or bank holding company; or

•merging or consolidating with another bank holding company.

The BHCA and the Change in Bank Control Act, together with regulations promulgated by the Federal Reserve, require that, depending on the particular circumstances, either the Federal Reserve’s approval must be obtained or notice must be furnished to the Federal Reserve and not disapproved prior to any person or company, not a bank holding company, acquiring control of a bank holding company, subject to certain exemptions. Control is conclusively presumed to exist when an individual or company acquires 25% or more of any class of voting securities of a bank holding company. Control is rebuttably presumed to exist if a person acquires 10% or more, but less than 25%, of any class of voting securities.

Additionally, the BHCA provides that the Federal Reserve may not approve any of these transactions if it would result in or tend to create a monopoly or substantially lessen competition or otherwise function as a restraint of trade, unless the anti-competitive effects of the proposed transaction are clearly outweighed by the public interest in meeting the convenience and needs of the community to be served. The Federal Reserve is also required to consider the financial and managerial resources and future prospects of the bank holding companies and banks concerned and the convenience and needs of the community to be served. The Federal Reserve’s consideration of financial resources generally focuses on capital adequacy, which is discussed below. As a result of the USA Patriot Act, the Federal Reserve is also required to consider the record of a bank holding company and its subsidiary bank(s) in combating money laundering activities in its evaluation of bank holding company merger or acquisition transactions.

Except as authorized by the BHCA and Federal Reserve regulations or order, a bank holding company is generally prohibited from engaging in, or acquiring direct or indirect control of 5% or more of the voting shares of any company engaged in any business other than the business of banking or managing and controlling banks. The primary exception allows the ownership of shares by a bank holding company in any company the activities of which the Federal Reserve has determined to be so closely related to banking or to managing or controlling banks that ownership of shares of that company is appropriate. Activities the Federal Reserve has determined by regulation to be proper incidents to the business of banking, and thus permissible for bank holding companies, include:

•making or servicing loans and certain types of leases;

•engaging in certain insurance and discount brokerage activities;

•performing certain data processing services;

•acting in certain circumstances as a fiduciary or investment or financial advisor;

•providing management consulting services;

•owning savings associations; and

•making investments in corporations or projects designed primarily to promote community welfare.

In accordance with Federal Reserve policy, a bank holding company is expected to act as a source of financial strength to its subsidiary banks. In adhering to the Federal Reserve’s policy, the Company may be required to provide financial support to the Bank at a time when, absent such Federal Reserve policy, it might not be deemed advisable to provide such assistance. Under the BHCA, the Federal Reserve may also require a bank holding company to terminate any activity or relinquish control of a nonbank subsidiary (other than a nonbank subsidiary of a bank) upon the Federal Reserve’s determination that the activity or control constitutes a serious risk to the financial soundness or stability of any subsidiary depository institution of the bank holding company. Further, federal bank regulatory authorities have additional discretion to require a bank holding company to divest itself of any bank or nonbank subsidiary if the agency determines that

divestiture may aid the depository institution’s financial condition. The Dodd-Frank Act codified the Federal Reserve’s policy on serving as a source of financial strength. Such support may be required at times when, absent this Federal Reserve policy, a holding company may not be inclined to provide it. A bank holding company, in certain circumstances, could be required to guarantee the capital plan of an undercapitalized banking subsidiary.

The Federal Reserve also has authority to prohibit activities of bank holding companies and their nonbanking subsidiaries which represent unsafe and unsound banking practices, or which constitute violations of laws or regulations. The Federal Reserve may impose civil money penalties for activities conducted by a bank holding company, its nonbanking subsidiaries, and officials of either on a knowing and reckless basis, if those activities caused a substantial loss to a depository institution. The penalties can be as high as $1.0 million for each day the activity continues.

National Banks

National Banks are subject to regulation, periodic examination, enforcement authority and oversight by the OCC extending to all aspects of the bank’s operations. OCC regulations govern permissible activities, capital requirements, dividend limitations, investments, loans and other matters. Deposits are insured by the FDIC for a maximum of $250,000 per account ownership. For this protection, banks must pay a quarterly statutory assessment and comply with the rules and regulations of the FDIC. The assessment levied on a bank for deposit insurance varies, depending on the capital position of each bank, and other supervisory factors.

The FDIA provides that, in the event of the “liquidation or other resolution” of a bank, the claims of depositors of the bank, including the claims of the FDIC as subrogee of insured depositors, and certain claims for administrative expenses of the FDIC as a receiver will have priority over other general unsecured claims against the bank. If a bank fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors.

Areas regulated and monitored by the bank regulatory authorities include but are not limited to requirements concerning security devices and procedures, adequacy of capitalization and loss reserves, loans, investments, borrowings, deposits, mergers, issuances of securities, payment of dividends, establishment of branches, corporate reorganizations, transactions with affiliates, maintenance of books and records, and adequacy of staff training to carry out safe lending and deposit gathering practices.

Restrictions on Transactions with Affiliates and Loans to Insiders

Sections 23A and 23B of the Federal Reserve Act restrict transactions by banks with their affiliates. An affiliate of a bank is any company or entity which controls, is controlled by or is under common control with the bank. Generally, Sections 23A and 23B: (1) limit the extent to which a bank or its subsidiaries may engage in “covered transactions” with any one affiliate to an amount equal to 10% of that bank’s capital stock and surplus (i.e., tangible capital); and (2) require that all such transactions be on terms substantially the same, or at least as favorable to the bank or subsidiary, as those provided to a non-affiliate. The term “covered transaction” includes the making of loans, purchase of assets, issuance of a guarantee and other similar types of transactions.

Section 23A also covers investment funds managed by an institution as an affiliate, as well as other procedural and substantive matters. In addition, Sections 23A and 23B include coverage of transactions with insiders relative to credit exposure arising from derivative transactions. An insured depository institution is also prohibited from purchasing or selling an asset to an executive officer, director, or principal shareholder (or any related interest of such a person) unless the transaction is on market terms, and, if the transaction exceeds 10% of the institution’s capital, it is approved in advance by a majority of the disinterested directors.

A bank’s authority to extend credit to executive officers, directors and greater than 10% shareholders, as well as entities controlled by such persons, is subject to Sections 22(g) and 22(h) of the Federal Reserve Act and Regulation O promulgated thereunder by the Federal Reserve. Among other things, these loans must be made on terms substantially the same as those offered to unaffiliated individuals. The amount of loans a bank may make to these persons is based, in part, on the bank’s capital position, and specified approval procedures must be followed in making loans which exceed specified amounts.

Anti-tying Restrictions

Bank holding companies and affiliates are prohibited from tying the provision of services, such as extensions of credit, to other services offered by a holding company or its affiliates.

Capital Adequacy Requirements

Banks are subject to regulatory capital requirements imposed by the Federal Reserve and the FDIC. Until a bank holding company reaches $3 billion in assets, the risk-based capital and leverage guidelines issued by the Federal Reserve are applied to bank holding companies on a nonconsolidated basis, unless the bank holding company is engaged in nonbank activities involving significant leverage, or it has a significant amount of outstanding debt held by the general public. Instead, a bank holding company with less than $3 billion in assets generally applies the risk-based capital and leverage capital guidelines on a bank only basis and must only meet a debt-to-equity ratio at the holding company level. The Federal Reserve risk-based capital guidelines apply directly to banks, regardless of whether they are subsidiaries of a bank holding company. Both agencies’ requirements, which are substantially similar, establish minimum capital ratios in relation to assets, both on an aggregate basis as adjusted for credit risks and off-balance sheet exposures. The risk weights assigned to assets are based primarily on credit risks. Depending upon the riskiness of a particular asset, it is assigned to a risk category. Under the guidelines, capital is compared to the relative risk related to the balance sheet. To derive the risk included in the balance sheet, risk weights from 0% to 250% are applied to different balance sheet and off-balance sheet assets, primarily based on the relative credit risk of the counterparty. The capital amounts and classification are also subject to qualitative judgments by the regulators about components, risk weightings, and other factors.

Capital is then classified into three categories, Common Equity Tier 1, Additional Tier 1, and Tier 2. CET1 Capital is the sum of common stock instruments and related surplus net of treasury stock, retained earnings, AOCI and qualifying minority interests, less applicable regulatory adjustments and deductions that include AOCI (if an irrevocable option to neutralize AOCI is exercised). Mortgage-servicing assets, deferred tax assets, and investments in financial institutions are limited to an aggregate of 15% of CET1 and 10% of CET1 individually. Additional Tier 1 Capital includes noncumulative perpetual preferred stock, and Tier 1 minority interests, less applicable regulatory adjustments and deductions. Tier 2 Capital includes subordinated notes and preferred stock not included in Additional Tier 1 Capital, total capital minority interests not included in Tier 1, and ACL not exceeding 1.25% percent of risk-weighted assets, less applicable regulatory adjustments and deductions.

Smaller banks are subject to the following capital level threshold requirements:

Capital Category
Threshold Ratios

Total

Risk-Based

Capital Ratio

Tier 1

Risk-Based

Capital Ratio

CET1

Risk-Based

Capital Ratio

Tier 1

Leverage

Capital Ratio

Well capitalized 10.00% 8% 6.5% 5%

Adequately capitalized 8% 6% 4.5% 4%

Undercapitalized < 8% < 6% < 4.5% < 4%

Significantly undercapitalized < 6% < 4% < 3% < 3%

Critically undercapitalized Tangible Equity/Total Assets ≤ 2%

.

Community banks are subject to the following minimum capital requirements.

Minimum CET1 ratio 4.5%

Capital conservation buffer 2.5%

Minimum tier 1 capital 6.0%

Minimum total capital 8.0%

Federal banking regulators have adopted regulations revising the risk-based capital guidelines to further ensure that the guidelines take adequate account of interest rate risk. Interest rate risk is the adverse effect that changes in market interest rates may have on its financial condition and is inherent to the business of banking. Under the regulations, when evaluating a bank’s capital adequacy, the revised capital standards now explicitly include a bank’s exposure to declines in the economic value of its capital due to changes in interest rates. The exposure of a bank’s economic value generally represents the change in the present value of its assets, less the change in the value of its liabilities, plus the change in the value of its interest rate off-balance sheet contracts.

Federal bank regulatory agencies possess broad powers to take prompt corrective action as deemed appropriate for an insured depository institution and its holding company, based on the institution’s capital levels. The extent of these powers depends upon whether the institution in question is considered “well capitalized,” “adequately capitalized,”

“undercapitalized,” “significantly undercapitalized,” or “critically undercapitalized.” Generally, as an institution is deemed to be less than well capitalized, the scope and severity of the agencies’ powers increase, ultimately permitting the agency to appoint a receiver for the institution. Business activities may also be influenced by an institution’s capital classification. For instance, only a “well capitalized” depository institution may accept brokered deposits without prior regulatory approval and can engage in various expansion activities with prior notice, rather than prior regulatory approval. However, rapid growth, poor loan portfolio performance or poor earnings performance, or a combination of these factors, could change the capital position of the bank in a relatively short period of time. Failure to meet these capital requirements could subject the bank to prompt corrective action provisions of the FDIA, which may include filing with the appropriate bank regulatory authorities a plan describing the means and a schedule for achieving the minimum capital requirements. In addition, the Company would not be able to receive regulatory approval of any application that required consideration of capital adequacy, such as a branch or merger application, unless the Company could demonstrate a reasonable plan to meet the capital requirement within an acceptable period of time.

In 2019, the Federal banking regulatory agencies adopted a rule to simplify the methodology for measuring capital adequacy for smaller, uncomplicated banks. The CBLR is calculated as the ratio of tangible equity capital divided by average total consolidated assets. CBLR tangible equity is defined as total equity capital, prior to including minority interests, and excluding accumulated other comprehensive income, deferred tax assets arising from net operating loss and tax credit carryforwards, goodwill, and other intangible assets (other than mortgage servicing assets). Under the rule, a qualifying organization may elect to use the CBLR framework if its CBLR is greater than 9%.

Branching

Subject to OCC approval, national and state banks can establish branches in any state if that state would permit the establishment of the branch by a state bank chartered in that state.

Deposit Insurance Assessments

The deposits of a bank are insured by the FDIC up to the limits under applicable law, which currently is set at $250,000 for accounts under the same ownership. Banks are subject to deposit insurance premium assessments. The FDIC imposes a risk-based deposit premium assessment system. Under this system, the assessment rates for an insured depository institution vary according to the level of risk incurred in its activities. To arrive at an assessment rate for a banking institution, the FDIC places it in one of four risk categories determined by reference to its capital levels and supervisory ratings. In the case of those institutions in the lowest risk category, the FDIC further determines its assessment rate based on certain specified financial ratios or, if applicable, long-term debt ratings. The assessment rate schedule can change from time to time, at the discretion of the FDIC, subject to certain limits. Under the current system, premiums are assessed quarterly. The FDIC has published guidelines on the adjustment of assessment rates for certain institutions. The assessment base on which a bank’s deposit insurance premiums is paid to the FDIC is now calculated based on its average consolidated total assets less its average equity. Congressional bills and other proposals could result in additional significant changes to the financial services and banking system, including, but not limited to, provisions for limitations on deposit insurance coverage or changing the timing and method financial institutions use to pay for deposit insurance. As a consequence of the extensive regulation of commercial banking activities in the United States, the Bank’s business is particularly susceptible to being affected by federal legislation and regulations that may increase the costs of doing business or change the Corporation’s competitive landscape. Whether any future legislation will be enacted or additional regulations will be adopted, and how they might impact the Company, cannot be determined at this time.

Deposit insurance may be terminated by the FDIC upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by a bank’s federal regulatory agency. Deposits and certain claims for administrative expenses and employee compensation against insured depository institutions are afforded a priority over other general unsecured claims against the institution, including federal funds and letters of credit, in the liquidation or other resolution of that institution by any receiver appointed by federal authorities. These priority creditors include the FDIC.

Dividends

BayFirst’s ability to pay cash dividends may depend almost entirely upon the aggregate amount of dividends that the Bank is able to pay and that the Bank is permitted to pay, by statutes or regulations, to the Company. Additionally, the FBCA provides that the Company may only pay dividends if the dividend payment would not render BayFirst insolvent, or cause BayFirst to be unable to meet obligations as they come due. These provisions could have the effect of limiting the ability to pay dividends.

Banking regulations limit the amount of dividends that may be paid. Approval by regulatory authorities is required if the effect of dividends declared would cause the regulatory capital of the Bank to fall below specified minimum levels. Approval is also required if dividends declared exceed the net profits of the Bank for that year combined with the retained net profits for the preceding two years. In July 2025, the Board of Directors suspended payments of dividends to common and preferred shareholders.

Capital Conservation Buffer

(as a percentage of risk weighted assets)

Maximum Payout

Ratio (as a % of

the Previous Four

Quarters of Net

Income)

Greater than 2.5%

No payout limitation

Less than or equal to 2.5% and greater than 1.875% 60%

Less than or equal to 1.875% and greater than 1.25% 40%

Less than or equal to 1.25% and greater than 0.625% 20%

Less than or equal to 0.625% 0%

The Federal Reserve expects bank holding companies to serve as a source of strength to their subsidiary bank(s), which may require them to retain capital for investment in their subsidiary bank(s), rather than pay dividends to shareholders. As stated previously, the Bank may not pay dividends to BayFirst, if, after paying those dividends, the bank would fail to meet the required minimum levels under the risk-based capital guidelines and the minimum leverage ratio requirements. Payment of dividends by the Bank may be restricted at any time at the discretion of its applicable regulatory authorities if they deem such dividends to constitute an unsafe and/or unsound banking practice.

Fiscal and Monetary Policies

The business and earnings of a bank may be significantly affected by the fiscal and monetary policies of the federal government and its agencies. Banks are particularly affected by the policies of the Federal Reserve, which regulates the supply of money and credit in the United States. Among the instruments of monetary policy available to the Federal Reserve are: (i) conducting open market operations in United States government securities; (ii) changing the discount rates of borrowings of depository institutions; (iii) imposing or changing reserve requirements against depository institutions’ deposits; and (iv) imposing or changing reserve requirements against certain borrowings by banks and their affiliates. These methods are used in varying degrees and combinations to directly affect the availability of bank loans and deposits, as well as the interest rates charged on loans and paid on deposits. For that reason alone, the policies of the Federal Reserve have a material effect on the earnings of banks.

Other Laws

State usury and credit laws limit the amount of interest and other charges collected or contracted by a bank on loans. Bank loans are subject to federal laws applicable to credit transactions, such as the:

•Federal Truth-In-Lending Act, which governs disclosures of credit terms to consumer borrowers;

•Community Reinvestment Act, which requires financial institutions to meet their obligations to provide for the total credit needs of the communities they serve, including investing their assets in loans to low and moderate-income borrowers;

•Home Mortgage Disclosure Act requiring financial institutions to provide information to enable public officials to determine whether a financial institution is fulfilling its obligations to meet the housing needs of the community it serves;

•Equal Credit Opportunity Act prohibiting discrimination on the basis of race, creed, or other prohibitive factors in extending credit;

•Real Estate Settlement Procedures Act, which requires lenders to disclose certain information regarding the nature and cost of real estate settlements, and prohibits certain lending practices, as well as limits escrow account amounts in real estate transactions;

•Fair Credit Reporting Act governing the collection of consumer debts by collection agencies; and

•The rules and regulations of various federal agencies charged with the responsibility of implementing such federal laws.

Bank operations are also subject to the:

•Gramm-Leach-Bliley Act of 1999, which contains privacy provisions that requires the Bank to maintain privacy policies intended to safeguard consumer financial information, to disclose these policies to the customers, and allow customers to “opt out” of having their financial service providers disclose their confidential financial information to nonaffiliated third parties, subject to certain exceptions;

•Right to Financial Privacy Act, which imposes a duty to maintain confidentiality of consumer financial records and prescribes procedures for complying with administrative subpoenas of financial records; and

•Electronic Funds Transfer Act and Regulation E, which govern automatic deposits to, and withdrawals from, deposit accounts and customers’ rights and liabilities arising from the use of debit cards, automated teller machines, and other electronic banking services.

Anti-Money Laundering

Banks are subject to significant regulation and supervision relative to anti-money laundering:

•such regulation is broad and includes the extraterritorial jurisdiction of the United States;

•compliance and due diligence obligations are significant and may be costly;

•banks may be compelled to produce documents located both inside and outside the United States, including those of foreign institutions that have a correspondent relationship in the United States; and

•banks enjoy a safe harbor from civil liability to customers for banks’ activities under anti-money laundering laws and regulation.

The U.S. Treasury, in cooperation with the federal banking agencies, the SEC, the Commodity Futures Trading Commission, and the Department of Justice:

•requires customer identification and verification;

•imposes the money-laundering program requirement to the major financial services sectors, including insurance and unregistered investment companies, such as hedge funds; and

•facilitates and permits the sharing of information between law enforcement and financial institutions, as well as among financial institutions themselves.

Enforcement of the anti-money laundering laws and regulations is significant, on the part of both state and federal regulators.

Dodd-Frank Wall Street Reform and Consumer Protection Act

The Dodd-Frank Act has had a broad impact on the financial services industry, imposing significant regulatory and compliance changes, including the designation of certain financial companies as systemically significant, the imposition of increased capital, leverage, and liquidity requirements, and numerous other provisions designed to improve supervision and oversight of, and strengthen safety and soundness within, the financial services sector. Additionally, the Dodd-Frank Act established a framework of authority to conduct systemic risk oversight within the financial system to be distributed among federal regulatory agencies, including the Financial Stability Oversight council, the Federal Reserve, the OCC, and the FDIC. The following items provide a brief description of certain key provisions of the Dodd-Frank Act that affect banks:

•Limitation on debit card transaction fees. The amount a provider can charge for debit card transaction fees, commonly referred to as interchange fees, is now limited to $0.21 plus 0.05% of the price of the transaction (plus $0.01, if the provider has certain fraud prevention standards in place).

•Mortgage loan origination and risk retention. Additional regulatory requirements have been put in place that may affect the operations and result in increased compliance costs. For example, new standards have been created for mortgage loan originations on all lenders, including banks and thrifts, in an effort to require steps to verify a borrower’s ability to repay. In addition, the Dodd-Frank Act generally requires lenders or securitizers to retain an economic interest in the credit risk relating to loans the lender sells or mortgage and other asset-backed securities

that the securitizer issues. These applicable rules generally require a sponsor of this type of transaction to retain an economic interest equal to at least 5% percent of the aggregate credit risk of the assets collateralizing an issuance.

•Expanded FDIC resolution authority. While insured depository institutions have long been subject to the FDIC’s resolution process, the Dodd-Frank Act created a new mechanism for the FDIC to conduct the orderly liquidation of certain “covered financial companies,” including bank and thrift holding companies and systemically significant nonbank financial companies.

•Consumer Financial Protection Bureau. An independent CFPB was created within the Federal Reserve. The CFPB is tasked with establishing and implementing rules and regulations under certain federal consumer protection laws with respect to the conduct of providers of certain consumer financial products and services. The CFPB has rulemaking authority over many of the statutes governing products and services offered to bank and thrift consumers.

•Transactions with affiliates and insiders. The Dodd-Frank Act generally enhanced the restrictions on transactions with affiliates under Section 23A and 23B of the Federal Reserve Act, including an expansion of the definition of “covered transactions.”

•Enhanced lending limits. The Dodd-Frank Act strengthened the limits on a depository institution’s credit exposure to one borrower.

FDICIA

In November 2025, the FDIC adjusted several asset-based regulatory thresholds governing annual independent audit and reporting requirements for insured depository institutions. Under the FDIC’s final rule, the asset threshold for requiring an annual independent audit of the institution has been raised from $500 million in total assets to $1 billion, the threshold for requiring management reports on internal controls has increased from $1 billion to $5 billion, and the threshold for audit committee independence requirements was increased from $3 billion to $5 billion in total assets.

Future Legislation

Various other legislative and regulatory initiatives, including proposals to overhaul the banking regulatory system are from time to time introduced in Congress and state legislatures, as well as regulatory agencies. Future legislation regarding financial institutions may change banking statutes and the operating environment of the Company in substantial and unpredictable ways, and could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance depending upon whether any of this potential legislation will be enacted, and if enacted, the effect that it or any implementing regulations, would have on the financial condition or results of operations of the Company. The nature and extent of future legislative and regulatory changes affecting financial institutions is very unpredictable at this time.

Available Information

The Company’s annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and all amendments to those reports are available free of charge on the Company’s website at www.bayfirstfinancial.com as soon as reasonably practicable after such material is electronically filed with, or furnished to, the Securities and Exchange Commission. These documents are also available on the SEC’s website at www.sec.gov.