NASDAQ: BANF

BancFirst’s strategy focuses on providing a full range of commercial banking services to retail customers and small to medium-sized businesses in both the non-metropolitan trade centers and cities in the metropolitan statistical areas of Oklahoma.

BancFirst maintains a strong community orientation by, among other things, selecting members of the communities in which BancFirst’s branches operate to local consulting boards that assist in marketing and providing feedback on BancFirst’s products and services to meet customer needs. As a result of the development of broad banking relationships with its customers and community branch network, BancFirst’s lending and investing activities are funded almost entirely by core deposits.

BancFirst centralizes virtually all of its processing, support and investment functions in order to achieve consistency and operational efficiencies. BancFirst maintains centralized control functions such as operations support, bookkeeping, accounting, loan review, compliance and internal auditing to ensure effective risk management. BancFirst also provides, on a centralized basis, certain specialized financial services that require unique expertise.

BancFirst provides a wide range of retail and commercial banking services, including: commercial, real estate, energy, agricultural and consumer lending; depository and funds transfer services; collections; safe deposit boxes; cash management services; trust services; and other services tailored for both individual and corporate customers. BancFirst provides item processing, research and other correspondent banking services to financial institutions and governmental units.

BancFirst’s primary lending activity is the financing of business and industry in its market areas. Its commercial loan customers are generally small to medium-sized businesses engaged in light manufacturing, local wholesale and retail trade, commercial and residential real estate development and construction, services, agriculture and the energy industry. Most forms of commercial lending are offered, including commercial mortgages, other forms of asset-based financing and working capital lines of credit. In addition, BancFirst offers Small Business Administration (“SBA”) guaranteed loans through BancFirst Commercial Capital, a division established in 1991.

Consumer lending activities of BancFirst consist of traditional forms of financing for automobiles, home equity loans and other personal loans. Residential loans consist primarily of home loans in non-metropolitan areas, which are generally shorter in duration than typical mortgages and reprice within five years.

BancFirst’s range of deposit services include checking accounts, Negotiable Order of Withdrawal (“NOW”) accounts, savings accounts, money market accounts, Health Savings Accounts, Coverdell Education Accounts, individual retirement accounts and certificates of deposit. Overdraft protection and auto draft services are also offered.

Trust services offered through BancFirst’s Trust and Investment Management Division (the “Trust Division”) consist primarily of investment management and administration of trusts for individuals, corporations and employee benefit plans. In addition, the Trust Division serves as bond trustee and paying agent for various Oklahoma municipalities and governmental entities.

Insurance services offered through BancFirst Insurance Services, Inc. consists of business and personal insurance, employee benefits, surety bonds and claims and risk management.

BancFirst has the following 100% owned principal subsidiary: BFTower, LLC (which owns a 49% ownership interest in SFPG, LLC, a parking garage, and a 100% ownership interest in ParcFirst@Bricktown, LLC, a parking garage). All of these companies are Oklahoma entities.

Pegasus and Worthington's lending activities include private banking, commercial and residential real estate, commercial and industrial and energy loans. They each have a full complement of deposit products including sweep accounts and securities investment products. They provide a wide range of banking services to individual and corporate customers and are subject to competition from other local, regional, and national financial institutions.

Human Capital Resources

As of December 31, 2025, the Company employed 2,260 full time equivalent employees. None of its employees are represented by collective bargaining agreements. The Company views its employees as a differentiator, enabling the Company to meet customer needs through highly trained and motivated employees. The Company’s approach to human capital resources focuses on objectives that include, but are not limited to, providing fair and equitable compensation, training employees to reach heightened skill sets and standards of motivation, identifying and developing the proficiencies of all employees, encouraging transparent and open communication between managers and team members, and providing employees with opportunities to gain a deeper appreciation for how they are making an impact within and outside the Company.

The Company recognizes the importance of maintaining a culture of feedback and employee recognition and asks its supervisors to focus on ensuring that the Company’s employees feel a sense of belonging at work, fostering peer-to-peer connections and appropriate subordinate/supervisor relationships and communications. The Company provides its employees with competitive compensation and benefits packages. The Company encourages its employees to be alert for opportunities to improve quality and efficiency. In addition, the Company affords its employees opportunities to learn how their work fits into the bigger picture and to gain a deeper appreciation for how they are making an impact within and outside the Company. Training resources and educational assistance are readily available and the Company strives to promote, where practical, from within the Company. The Company identifies high potential candidates and provides specifically tailored plans for actualizing their development goals and career trajectories. The Company is committed to a policy of consistent treatment and equal employment opportunity in all recruitment and employment practices and is an affirmative action employer.

Climate-Related and Other Environmental, Social and Governance Developments

In recent years, federal, state and international lawmakers and regulators have increased their focus on risk oversight, disclosures and practices in connection with climate change and other environmental, social and governance matters. For example, in March 2024, the SEC adopted a rule on the enhancement and standardization of climate-related disclosures for investors. The rule would require public issuers, including us, to significantly expand the scope of climate-related disclosures in their SEC filings, but the SEC has stayed the enforcement of those rules to permit judicial review of those rules and, in March 2025 informed the United States Circuit Court of Appeals for the Eighth Circuit that the SEC was ending its defense of this rule. Subsequently, in July, 2025, the SEC asked the court to make a decision on the rule and, in September 2025, the court placed the case in indefinite abeyance.

The SEC has also announced plans to propose rules to require enhanced disclosure regarding human capital management and board diversity for public issuers; those rules have not, however, been proposed and the status of those plans is unclear.

Market Areas and Competition

The banking environment in Oklahoma is very competitive. The geographic dispersion of BancFirst’s banking locations presents several different levels and types of competition. In general, however, each location competes with other banking institutions, savings and loan associations, brokerage firms, personal loan finance companies and credit unions within their respective market areas. The communities in which BancFirst maintains offices are generally local trade centers throughout Oklahoma. The major areas of competition include interest rates charged on loans, underwriting terms and conditions, interest rates paid on deposits, fees on non-credit services, levels of service charges on deposits, completeness of product lines and quality of service.

BancFirst operates as a “super community bank”, managing its community banking offices on a decentralized basis, which permits them to be responsive to local customer needs. Underwriting, funding, customer service and pricing decisions are made by presidents in each market within BancFirst’s strategic parameters. At the same time, BancFirst generally has a larger lending capacity, broader product line and greater operational scale than its principal competitors do in the non-metropolitan market areas (which typically are independently owned community banks). Each full-service banking office has senior management with significant lending experience who exercise substantial autonomy over credit and pricing decisions. This decentralized management approach, coupled with continuity of service by the same staff members, enables BancFirst to develop long-term customer relationships, maintain high-quality service and respond quickly to customer needs. The majority of its competitors in the non-metropolitan areas are much smaller and do not offer the range of products and services nor have the lending capacity of BancFirst. In the metropolitan markets served by BancFirst, the Company’s strategy is to focus on the needs of local businesses and seek to provide more responsive services than are available at larger institutions. As reported by the Federal Deposit Insurance Corporation (“FDIC”), the Company’s (including ABOK acquired November 17, 2025) market share of deposits within the state of Oklahoma was 7.58% as of June 30, 2025 and 6.84% as of June 30, 2024.

Marketing to existing and potential customers is performed through a variety of media advertising, direct mail and direct personal contacts. BancFirst monitors the needs of its customer base through its Product Development Group, which develops and enhances products and services in response to such needs. Sales, customer service, compliance and product training are coordinated with incentive programs to sell BancFirst’s products and services.

The banking environment in North Texas is one of the most competitive in the nation. Pegasus and Worthington's marketing avoids media campaigns and their growth is dependent on the experience, knowledge and contacts of their relationship officers and directors.

Operating Segments

The Company has six principal business units: BancFirst metropolitan banks, BancFirst community banks, Pegasus, Worthington, other financial services and executive operations and support. For more information on the Company’s Operating Segments, see Note (23), “Segment Information,” to the Company’s Consolidated Financial Statements.

Control of Company

Affiliates of the Company beneficially own approximately 35% of the outstanding shares of the Company’s common stock as of January 31, 2026. Under the Company’s Bylaws, holders of a majority of the outstanding shares of common stock are able to elect all of the directors and approve significant corporate actions, including business combinations. Accordingly, while the Company’s affiliates do not have legal control, i.e., a majority of the outstanding shares of common stock, they have effective control of the Company.

Supervision and Regulation

Banking is a complex, highly regulated industry. The growth and earnings performance of the Company, BancFirst, Pegasus and Worthington can be affected by management decisions, general and local economic conditions, statutes and the regulations and policies administered by various governmental regulatory authorities. These authorities include, but are not limited to, the Board of Governors of the Federal Reserve System (the “Federal Reserve Board”), the FDIC, the Oklahoma Banking Department and the Texas Department of Banking.

The primary goals of the bank regulatory framework are to maintain a safe and sound banking system and to facilitate the conduct of monetary policy. This regulatory framework is intended primarily for the protection of a financial institution’s depositors, rather than the institution’s stockholders and creditors. The following discussion describes certain of the material elements of the regulatory framework applicable to bank holding companies and financial holding companies and their subsidiaries and provides certain specific information relevant to the Company, which is both a bank holding company and a financial holding company. The descriptions are

qualified in their entirety by reference to the specific statutes and regulations discussed. Further, such statutes, regulations and policies are continually under review by Congress and state legislatures, and federal and state regulatory agencies. A change in statutes, regulations or regulatory policies applicable to the Company, including changes in interpretation or implementation thereof, could have a material effect on the Company’s business.

Regulatory Agencies

In the U.S., banking is regulated at both the federal and state level. Commercial banks in the United States are able to choose to organize as national banks with a charter issued by the Office of the Comptroller of the Currency (“OCC”) or as state banks with a charter issued by a state government. The choice of charter determines which agency will supervise the bank: the primary supervisor of nationally chartered banks is the OCC, whereas state-chartered banks are supervised jointly by their state chartering authority and either the FDIC or the Federal Reserve Board, depending upon whether the state-chartered bank is a member of the Federal Reserve System. BancFirst is chartered by the State of Oklahoma and at the state level is supervised and regulated by the Oklahoma Banking Department under the Oklahoma Banking Code. Pegasus and Worthington are chartered by the State of Texas and at the state level are supervised and regulated by the Texas Department of Banking. Each of BancFirst, Worthington and Pegasus is a Federal Reserve System member bank whose primary federal regulator is the Federal Reserve System. Their deposits are insured by the Deposit Insurance Fund (“DIF”) of the FDIC to the extent provided by law.

As a financial holding company and a bank holding company, the Company is subject to comprehensive regulation by the Federal Reserve Board under the BHC Act, as amended by the Gramm-Leach-Bliley Act of 1999 (the “GLB Act”), the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), and other legislation, as well as other federal and state laws governing the banking business. The BHC Act provides generally for regulation of financial holding companies and bank holding companies such as the Company by the Federal Reserve Board, and for functional regulation of banking activities by bank regulators, securities activities by securities regulators, and insurance activities by insurance regulators. Additionally, the Company is under the jurisdiction of the Securities and Exchange Commission (“SEC”) and is subject to the periodic reporting, information, proxy solicitation, insider trading, corporate governance and other restrictions and requirements of the SEC under the Securities Exchange Act of 1934, as amended (the “Exchange Act”). The Company’s common stock is listed on the NASDAQ Global Select Market System under the trading symbol “BANF,” and is subject to the listing and marketplace rules of the NASDAQ Stock Market, Inc. (the “NASDAQ”).

The Federal Reserve Board supervises non-banking activities conducted by companies directly and indirectly owned by the Company. In addition, the Company’s non-banking subsidiaries are subject to various other laws, regulations, supervision and examination by other regulatory agencies, all of which directly or indirectly affect the operations and management of the Company and its ability to make distributions to stockholders.

Bank Holding Company and Financial Holding Company Activities

The BHC Act generally limits the activities in which the Company and its non-banking subsidiaries may engage, to managing or controlling banks and to a range of activities that are considered to be closely related to banking. The list of activities permitted by the Federal Reserve Board includes, among other things: lending; operating a savings institution, mortgage company, finance company, credit card company or factoring company; performing certain data processing operations; providing certain investment and financial advice; underwriting and acting as an insurance agent for certain types of credit-related insurance; leasing property on a full-payout, non-operating basis; selling money orders; real estate and personal property appraising; providing tax planning and preparation services; and, subject to certain limitations, providing securities brokerage services for customers. These activities may also be affected by other federal legislation.

Bank holding companies that have elected to be treated as financial holding companies, such as the Company, may engage in a broader range of activities considered “financial in nature”. “Financial in nature” activities include securities underwriting, dealing and market making, sponsoring mutual funds and investment companies, insurance underwriting and agency, merchant banking and other activities that the Federal Reserve Board, in consultation with the Secretary of the U.S. Treasury, determines from time to time to be financial in nature or incidental to such financial activity or is complementary to a financial activity and does not pose a safety and soundness risk.

To maintain financial holding company status, a financial holding company and all of its depository institution subsidiaries must be “well capitalized” and “well managed.” A depository institution subsidiary is considered “well capitalized” if it satisfies the requirements for this status discussed in the section captioned “Capital Requirements”, included elsewhere in this item. A depository institution subsidiary is considered “well managed” if it received a composite rating and management rating of at least “satisfactory” in its most recent examination. A financial holding company’s status will also depend upon it maintaining its status as “well capitalized”

and “well managed” under applicable Federal Reserve Board regulations. If a financial holding company ceases to meet these capital and management requirements, the Federal Reserve Board’s regulations provide that the financial holding company must enter into an agreement with the Federal Reserve Board to comply with all applicable capital and management requirements. Until the financial holding company returns to compliance, the Federal Reserve Board may impose limitations or conditions on the conduct of its activities, and the company may not commence any of the broader financial activities permissible for financial holding companies or acquire a company engaged in such financial activities without prior approval of the Federal Reserve Board. If the company does not return to compliance within 180 days, the Federal Reserve Board may require divestiture of the holding company’s depository institutions. Bank holding companies and banks must also be both well capitalized and well managed in order to acquire banks located outside their home state.

In order for a financial holding company to commence any new activity permitted by the BHC Act or to acquire a company engaged in any new activity permitted by the BHC Act, each insured depository institution subsidiary of the financial holding company must have received a rating of at least “satisfactory” in its most recent examination under the Community Reinvestment Act. See the section captioned “Community Reinvestment Act” included elsewhere in this item.

The Federal Reserve Board has the power to order any bank holding company or its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the Federal Reserve Board has reasonable grounds to believe that continuation of such activity or such ownership or control constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company.

Federal and state laws impose notice and approval requirements for mergers and acquisitions of other depository institutions or bank holding companies. The BHC Act requires the prior approval of the Federal Reserve Board for the direct or indirect acquisition by a bank holding company of more than 5% of the voting shares or substantially all of the assets of a commercial bank or its parent holding company (including a financial holding company). Additionally, under the Bank Merger Act, the prior approval of the Federal Reserve Board or other appropriate bank regulatory authority is required for a bank to merge with another bank, purchase the assets or assume the deposits of another bank. In determining whether to approve a proposed bank acquisition or merger, bank regulatory authorities will consider, among other factors, the competitive effect and public benefits of the transactions, the capital position of the combined organization, the risks to the stability of the U.S. banking or financial system, the applicant’s performance record under the Community Reinvestment Act (see the section captioned “Community Reinvestment Act” included elsewhere in this item) and its compliance with fair housing and other consumer protection laws and the effectiveness of the subject organizations in combating money laundering activities.

Dividend Restrictions

The principal source of the Company’s liquidity is dividends from BancFirst. Various federal and state statutory provisions and regulations limit the amount of dividends the Company’s subsidiary banks and certain other subsidiaries may pay without regulatory approval. The payment of dividends by its subsidiary banks may also be affected by other regulatory requirements and policies, such as the maintenance of adequate capital. If, in the opinion of the applicable regulatory authority, a bank under its jurisdiction is engaged in, or is about to engage in, an unsafe or unsound practice (which, depending on the financial condition of the bank, could include the payment of dividends), such authority may require, after notice and hearing, that such bank cease and desist from such practice. The appropriate federal regulatory authorities have stated that paying dividends that deplete a bank’s capital base to an inadequate level would be an unsafe and unsound banking practice and that banking organizations should generally pay dividends only out of current operating earnings. In addition, in the current financial and economic environment, the Federal Reserve Board has indicated that bank holding companies should carefully review their dividend policy and has discouraged payment ratios that are at maximum allowable levels unless both asset quality and capital are very strong.

Transactions with Affiliates

The Company, BancFirst, Pegasus and Worthington are deemed affiliates of each other within the meaning of the Federal Reserve Act, and covered transactions between affiliates are subject to certain restrictions, including compliance with Sections 23A and 23B of the Federal Reserve Act and their implementing regulations. These regulations limit the types and amounts of covered transactions engaged in by a financial institution and its affiliates, and generally require those transactions to be on an arm’s-length basis. “Covered transactions” are defined by statute to include a loan or extension of credit, as well as a purchase of securities issued by an affiliate, a purchase of assets (unless otherwise exempted by the Federal Reserve Board) from the affiliate, certain derivative transactions that create a credit exposure to an affiliate, the acceptance of securities issued by the affiliate as collateral for a loan and the issuance of a guarantee, acceptance or letter of credit on behalf of an affiliate. In general, these regulations require that any such transaction by a

financial institution with an affiliate must be secured by designated amounts of specified collateral and must be limited to certain thresholds on an individual and aggregate basis.

Federal law also limits a bank’s authority to extend credit to its directors, executive officers and 10% stockholders, as well as to entities controlled by such persons. Among other things, extensions of credit to insiders are required to be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with unaffiliated persons. In addition, the terms of such extensions of credit may not involve more than the normal risk of non-repayment or present other unfavorable features and may not exceed certain limitations on the amount of credit extended to such persons individually and in the aggregate.

Source of Strength

Federal Reserve Board policy requires bank holding companies to act as a source of financial and managerial strength to their subsidiary banks and, under appropriate circumstances, to commit resources to support each such subsidiary bank. This support may be required at times when the bank holding company may not have the resources to provide the support. If a bank holding company were unable to pay mandated assessments in support of its subsidiary banks, the FDIC could order the sale of the bank holding company’s stock in the subsidiary banks to cover the deficiency.

Capital loans by a bank holding company to its subsidiary banks are subordinate in right of payment to deposits and certain other indebtedness of the subsidiary banks. In addition, in the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of its subsidiary banks would be assumed by the bankruptcy trustee and entitled to priority of payment.

Capital Requirements

The Company, BancFirst, Pegasus and Worthington were required to comply with applicable capital adequacy standards established by the Federal Reserve Board and the FDIC. The current risk-based capital standards applicable to the Company, BancFirst, Pegasus and Worthington are based on the Basel III Capital Rules established by the Basel Committee on Banking Supervision (the “Basel Committee”). The Basel Committee is a committee of central banks and bank supervisors/regulators from the major industrialized countries that develops broad policy guidelines for use by each country’s supervisors in determining the supervisory policies they apply. The requirements are intended to ensure that banking organizations have adequate capital given the risk levels of assets and off-balance sheet financial instruments.

As an additional means to identify problems in the financial management of depository institutions, the Federal Deposit Insurance Act (the “FDI Act”) requires federal bank regulatory agencies to establish certain non-capital safety and soundness standards for institutions for which they are the primary federal regulator. The standards relate generally to operations and management, asset quality, interest rate exposure and executive compensation. The agencies are authorized to take action against institutions that fail to meet such standards.

The Basel III Capital Rules, among other things, (i) include a capital measure called “Common Equity Tier 1” (“CET1”), (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting specified requirements, (iii) define CET1 narrowly by requiring that most deductions/adjustments to regulatory capital measures be made to CETI and not to the other components of capital, and (iv) require certain deductions/adjustments to capital.

Under the Basel III Capital Rules, the initial minimum capital ratios are as follows:

•
4.5% CET1 to risk-weighted assets.

•
6.0% Tier 1 capital to risk-weighted assets.

•
8.0% Total capital to risk-weighted assets.

•
4.0% Tier 1 capital to average quarterly assets (known as the “leverage ratio”).

The Basel III Capital Rules also require a “capital conservation buffer”, composed entirely of CET1, on top of these minimum risk-weighted asset ratios. The capital conservation buffer is 2.5%. The Basel III Capital Rules also provide for a “countercyclical capital buffer” that is only applicable to certain covered institutions and does not have any current applicability to the Company, BancFirst,

Pegasus and Worthington. The capital conservation buffer is designed to absorb losses during periods of economic stress and effectively increases the minimum required risk-weighted capital ratios. Banking institutions with a ratio of CET1 to risk-weighted assets below the effective minimum (4.5% plus the capital conservation buffer and, if applicable, the countercyclical capital buffer) will face constraints on dividends, equity repurchases and compensation based on the amount of the shortfall.

The Basel III Capital Rules require the Company, BancFirst, Pegasus and Worthington to maintain an additional capital conservation buffer of 2.5% of CET1, effectively resulting in minimum ratios of (i) CET1 to risk-weighted assets of at least 7%, (ii) Tier 1 capital to risk-weighted assets of at least 8.5%, (iii) a minimum ratio of total capital to risk-weighted assets of at least 10.5%; and (iv) a minimum leverage ratio of 4%. For more information on the Company’s Capital Ratios, see Note (15), “Stockholders’ Equity,” to the Company’s Consolidated Financial Statements.

Liquidity Coverage Ratio

The liquidity framework under the Basel III Capital Rules (the "Basel III liquidity framework") applies a balance sheet perspective to establish quantitative standards designed to ensure that a banking organization is appropriately positioned to satisfy its short- and long-term funding needs. One test to address short-term liquidity risk is referred to as the liquidity coverage ratio ("LCR"), designed to calculate the ratio of a banking entities' ratio of high-quality liquid assets to its total net cash flows over a 30-day time horizon. The other test, referred to as the net stable funding ratio ("NSFR"), is designed to promote more medium- and long-term asset funding by incenting banking entities to increase their holdings of U.S. Treasury securities and other sovereign debt, as well as increase the use of long-term debt as a funding source. Rules applicable to certain large banking organizations have been implemented for LCR and for NSFR; however, based on our asset size, these rules do not currently apply to the Company, BancFirst, Pegasus or Worthington.

Prompt Corrective Action

The FDI Act requires federal bank regulatory agencies to take “prompt corrective action” with respect to FDIC-insured depository institutions that do not meet minimum capital requirements. A depository institution’s treatment for purposes of the prompt corrective action provisions will depend upon how its capital levels compare to various capital measures and certain other factors, as established by regulation.

Under this system, the federal banking regulators have established five capital categories: well capitalized, adequately capitalized, undercapitalized, significantly undercapitalized and critically undercapitalized, in which all depository institutions are placed. The federal banking regulators have specified by regulation the relevant capital levels for each of the categories. Under certain circumstances, a well-capitalized, adequately capitalized or undercapitalized institution may be treated as if the institution were in the next lower capital category. Federal banking regulators are required to take various mandatory supervisory actions and are authorized to take other discretionary actions with respect to institutions in the three undercapitalized categories. The severity of the action depends upon the capital category in which the institution is placed. A depository institution that is undercapitalized is required to submit a capital restoration plan. Failure to meet capital guidelines could subject a bank to a variety of enforcement remedies by federal bank regulatory agencies, including termination of deposit insurance by the FDIC, restrictions on certain business activities and appointment of the FDIC as conservator or receiver. Generally, subject to a narrow exception, the banking regulator must appoint a receiver or conservator for an institution that is critically undercapitalized.

A bank will be (i) “well capitalized” if the institution has a total risk-based capital ratio of 10.0% or greater, a CET1 capital ratio of 6.5% or greater, a Tier 1 risk-based capital ratio of 8.0% or greater, and a leverage ratio of 5.0% or greater, and is not subject to any order or written directive by any such regulatory authority to meet and maintain a specific capital level for any capital measure; (ii) “adequately capitalized” if the institution has a total risk-based capital ratio of 8.0% or greater, a CET1 capital ratio of 4.5% or greater, a Tier 1 risk-based capital ratio of 6.0% or greater, and a leverage ratio of 4.0% or greater and is not “well capitalized”; (iii) “undercapitalized” if the institution has a total risk-based capital ratio that is less than 8.0%, a CET1 capital ratio less than 4.5%, a Tier 1 risk-based capital ratio of less than 6.0% or a leverage ratio of less than 4.0%; (iv) “significantly undercapitalized” if the institution has a total risk-based capital ratio of less than 6.0%, a CET1 capital ratio less than 3.0%, a Tier 1 risk-based capital ratio of less than 4.0% or a leverage ratio of less than 3.0%; and (v) “critically undercapitalized” if the institution’s tangible equity is equal to or less than 2.0% of average quarterly tangible assets. An institution may be downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios if it is determined to be in an unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters. A bank’s capital category is determined solely for applying prompt corrective action regulations, and the capital category may not constitute an accurate representation of the bank’s overall financial condition or prospects for other purposes.

The FDI Act generally prohibits a depository institution from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the depository institution would thereafter be “undercapitalized.” “Undercapitalized” institutions are subject to growth limitations and are required to submit a capital restoration plan. The agencies may not accept such a plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the depository institution’s capital. In addition, for a capital restoration plan to be acceptable, the depository institution’s parent holding company must guarantee that the institution will comply with such capital restoration plan. The bank holding company must also provide appropriate assurances of performance. The aggregate liability of the parent holding company is limited to the lesser of (i) an amount equal to 5.0% of the depository institution’s total assets at the time it became undercapitalized and (ii) the amount which is necessary (or would have been necessary) to bring the institution into compliance with all capital standards applicable with respect to such institution as of the time it fails to comply with the plan. If a depository institution fails to submit an acceptable plan, it is treated as if it is “significantly undercapitalized.”

“Significantly undercapitalized” depository institutions may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become “adequately capitalized,” requirements to reduce total assets, and cessation of receipt of deposits from correspondent banks. “Critically undercapitalized” institutions are subject to the appointment of a receiver or conservator.

The appropriate federal banking agency may, under certain circumstances, reclassify a well-capitalized insured depository institution as adequately capitalized. The FDI Act provides that an institution may be reclassified if the appropriate federal banking agency determines (after notice and opportunity for hearing) that the institution is in an unsafe or unsound condition or deems the institution to be engaging in an unsafe or unsound practice. The appropriate agency is also permitted to require an adequately capitalized or undercapitalized institution to comply with the supervisory provisions as if the institution were in the next lower category (but not treat a significantly undercapitalized institution as critically undercapitalized) based on supervisory information other than the capital levels of the institution.

The Company believes that, as of December 31, 2025, BancFirst, Pegasus, Worthington and ABOK were “well capitalized” based on the ratios provided in Note (15), “Stockholders’ Equity,” in the notes to consolidated financial statements included in Item 8.

Deposit Insurance Assessments

The deposits of BancFirst, Pegasus and Worthington are insured by the FDIC. This insurance is funded through assessments on insured depository institutions. The FDIC’s risk-based assessment system requires members to pay varying assessment rates into the DIF, depending upon the level of the institution’s capital and the degree of supervisory concern over the institution.

The FDIC insures the deposits of federally insured banks up to prescribed statutory limits for each depositor, currently $250,000 per depositor for each account ownership category. The amount of FDIC assessments paid by each insured depository institution is based on its relative risk of default as measured by regulatory capital ratios and other supervisory factors. The FDIC’s deposit insurance premium assessment is based on an institution’s average consolidated total assets minus average tangible equity. At least semi-annually, the FDIC will update its loss and income projections for the DIF and, if needed, will increase or decrease assessment rates, following notice-and-comment rulemaking, if required. If there are additional bank or financial institution failures or if the FDIC otherwise determines to increase assessment rates, BancFirst, Pegasus and Worthington may be required to pay higher FDIC insurance premiums. Any future increases in FDIC insurance premiums may have a material and adverse effect on BancFirst’s, Pegasus’ and Worthington's and hence the Company’s, earnings. In October 2022, the FDIC adopted a final rule to increase the initial base deposit insurance assessment rate schedules uniformly by 2 basis points beginning with the first quarterly assessment period of 2023. The increased assessment was expected to improve the likelihood that the DIF reserve ratio would reach the statutory minimum of 1.35% by the statutory deadline prescribed under the FDIC's amended restoration plan. As of June 30, 2025, the reserve ratio exceeded the statutory minimum and, beginning with third quarter 2025, the FDIC no longer operated under a restoration plan.

The Company’s FDIC deposit insurance assessment expense totaled $6.8 million, $6.3 million and $5.8 million in 2025, 2024 and 2023, respectively.

As insurer, the FDIC is authorized to conduct examinations of and to require reporting by DIF-insured institutions. It also may prohibit any DIF-insured institution from engaging in any activity the FDIC determines by regulation or order to pose a serious threat to the DIF. The FDIC also has the authority to take enforcement actions against insured institutions.

Insurance of deposits may be terminated by the FDIC upon a finding that the institution has engaged or is engaging in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order

or condition imposed by the FDIC or written agreement entered into with the FDIC. The Company does not know of any practice, condition or violation that might lead to termination of deposit insurance for its banking subsidiaries.

Safety and Soundness Standards

The FDI Act requires the federal bank regulatory agencies to prescribe standards, by regulations or guidelines, relating to internal controls, information systems and internal audit systems, loan documentation, credit underwriting, interest rate risk exposure, asset growth, asset quality, earnings, stock valuation and compensation, fees and benefits and such other operational and managerial standards as the agencies deem appropriate. In general, the guidelines require, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines. The guidelines prohibit excessive compensation as an unsafe and unsound practice and describe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal stockholder. In addition, the agencies adopted regulations that authorize, but do not require, an agency to order an institution that has been given notice by an agency that it is not satisfying any of such safety and soundness standards to submit a compliance plan. If, after being so notified, an institution fails to submit an acceptable compliance plan or fails in any material respect to implement an acceptable compliance plan, the agency must issue an order directing action to correct the deficiency and may issue an order directing other actions of the types to which an undercapitalized institution is subject under the “prompt corrective action” provisions of the FDI Act. See “--Prompt Corrective Action” above. If an institution fails to comply with such an order, the agency may seek to enforce such order in judicial proceedings and to impose civil money penalties.

Federal Banking Agency Compensation Guidelines

The Federal Reserve Board reviews, as part of its regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Company, that are not “large, complex banking organizations.” These reviews are tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of this supervisory initiative will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

Guidance issued by the Federal Reserve Board, OCC and FDIC is intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk-management and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

In May 2024, the FDIC, the Federal Housing Financing Agency, the National Credit Union Administration and the Office of the Comptroller of the Currency re-proposed rules on incentive-based payment arrangements at specified regulated entities having at least $1 billion in total assets (which would include the Company, BancFirst and Pegasus) that were originally proposed in April 2016. In March 2025, the FDIC withdrew its proposal. The scope, content and application of the U.S. banking regulators' policies on incentive compensation may change in the future and it cannot be determined at this time whether compliance with such policies will adversely affect the ability of the Company, BancFirst, Pegasus and Worthington to hire, retain and motivate key employees.

NASDAQ has adopted listing standards mandating the recovery or “clawback” of excess incentive-based compensation earned by a current or former executive officer during the three fiscal years preceding the date the listed company is required to prepare an accounting restatement, including to correct an error that would result in a material misstatement if the error were corrected in the current period or left uncorrected in the current period. Each listed company is required to have a compliant policy governing recovery of erroneously awarded compensation as required by the new listing standards. The Company has adopted a compliant policy governing the recovery of erroneously awarded compensation as required by the listing standards, which is filed as Exhibit 97 to this Form 10-K.

Cybersecurity

Federal agencies have issued statements regarding cybersecurity. Financial institutions are expected to design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures, to reliably authenticate customers accessing internet-based services of the financial institution. Management is expected to maintain sufficient business continuity planning processes to ensure the rapid

recovery, resumption and maintenance of the institution’s operations after a cyber-attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack. Failure to observe the regulatory guidance could subject the Company, BancFirst, Pegasus and Worthington to various regulatory sanctions, including financial penalties.

In the ordinary course of business, the Company, BancFirst, Pegasus and Worthington rely on electronic communications and information systems to conduct operations and to store sensitive data. They employ an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. The Company, BancFirst, Pegasus and Worthington employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of their defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date, the Company, BancFirst, Pegasus and Worthington have not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, the Company, BancFirst, Pegasus and Worthington's systems and those of their customers and third-party service providers are under constant threat and it is possible that the Company, BancFirst, Pegasus or Worthington could experience a significant event in the future.

Federal banking agencies, including the Federal Reserve Board and the FDIC, issued a rule to improve the sharing of information about cyber incidents. Under the rule a banking organization’s primary federal regulator must receive notification as soon as possible and no later than 36 hours after the banking organization determines that a significant computer-security incident, known as a “notification incident,” has occurred. Further, the rule separately requires a bank service provider to notify each of its affected banking organization customers as soon as possible when the provider determines that it has experienced a computer-security incident that has caused, or is reasonably likely to cause, a material service disruption or degradation for four or more hours.

Under the Federal Trade Commission's amendments to the Gramm-Leach-Bliley Act's Safeguards Rule financial institutions are required to: (i) appoint a qualified individual to oversee and implement their information security programs; (ii) implement additional criteria for information security risk assessments; (iii) implement safeguards identified by assessments, including access controls, data inventory, data disposal, change management, and monitoring, among other things; (iv) implement information system monitoring in the form of either "continuous monitoring" or "periodic penetration testing;" (v) implement additional controls including training for security personnel, periodic assessment of service providers, written incident response plans, and periodic reports from the qualified individual to the board of directors.

See