NYSE: BY

Strategic plan

As part of our strategic plan, we explore potential opportunities for expansion in our primary and adjacent market areas through organic growth and the acquisition of financial institutions, branches, and non-banking organizations. Our aspiration to be the preeminent commercial bank in Chicago drives our focus on market expansion, deepening client relationships, and fostering a strong-cross sell culture to enhance retention and revenue diversification. We also prioritize process improvement and productivity enhancements, leveraging technology and best practices to improve efficiency, scalability, and the overall customer experience, all with commitment to disciplined oversight and aligned risk practices.

Organic Growth

We believe our local presence and our scale are essential to the continued growth of our deposit base. Small businesses are a significant source of low-cost deposits and represent opportunities for future growth. We believe our small business customers value our ability to provide convenience and access to local, responsive decision makers. As of December 31, 2025, commercial deposits accounted for 43.0% of total deposits and were 85.1% of non-interest bearing deposits. Commercial accounts generally have higher deposit balances and transaction volumes than individual deposit accounts.

Our ability to originate loans and leases across a range of industries and product types helps us maintain a diversified loan and lease portfolio across various sectors, including commercial and industrial lending, leasing, U.S. government guaranteed loans and real estate loans, allowing us to efficiently manage our credit exposures and capitalize on more lending opportunities. We have continued to enhance our product and lending capabilities with the addition of experienced lending teams hired from larger banks.

The following charts outline the composition of our loan and lease and deposit portfolios as of December 31, 2025:

4

Table of Contents

Acquisitions

Our ability to engage in certain merger or acquisition transactions depends on a number of factors, including opportunities in our market areas, access to capital, our bank regulators' views at the time as to the capital levels, quality of management and our overall financial condition, in addition to their assessment of a variety of other factors, including our compliance with laws and regulations. We have successfully completed a number of strategic acquisitions since our recapitalization in 2013, which include:

Year

Company Acquired

2025

First Security Bancorp, Inc.

2023

Inland Bancorp, Inc.

2019

Oak Park River Forest Bankshares, Inc.

2018

First Evanston Bancorp, Inc.

2016

Ridgestone Financial Services, Inc.

2014

Baytree Leasing Company LLC

On April 1, 2025, we completed our acquisition of First Security Bancorp, Inc., a Delaware corporation ("First Security Bancorp"), and First Security Bancorp's wholly-owned bank subsidiary, First Security Trust and Savings Bank (“First Security’), an Illinois chartered bank (collectively "First Security acquisition" or "acquisition of First Security"). Refer to Note 3—Acquisition of a Business contained within Part II, Item 8, Notes to the Consolidated Financial Statements of this document.

Branch network and distribution channels

The primary market in which we operate is the Chicago metropolitan area, and our 44 branch network in this area is our core distribution channel. We take advantage of our focused footprint and deep-rooted relationships to target local customers with a diversified product offering.

Our local branch network enables us to gather low cost deposits, promote the Byline brand and customer loyalty, originate loans, leases and other products and maintain relationships with our customers through regular community involvement. We believe our branch network is fundamental to our ability to achieve successful customer outreach in line with our culture, which promotes high touch engagement with our customers and proactive solutions.

While our branch network continues to be our primary delivery channel, we understand the evolving banking environment requires digital interaction to keep pace with our customers’ needs. We continually perform strategic reviews of our branch network and our existing banking footprint. With technology improvements and changes to customers’ banking preferences, we regularly examine both branch growth and consolidation potential, including customer usage, branch profitability, services provided, markets served and proximity to other locations.

Since our recapitalization in June 2013, our branch network has been reduced from 88 to 45, including 24 branches added through acquisition. During 2025, one branch was closed and consolidated into existing branch locations, and one leased branch location was assumed as part of the First Security acquisition and was subsequently closed after acquisition.

We plan to continue to leverage our seasoned management team, the attractive market opportunity in the Chicago metropolitan area, our diversified lending approach and our track record of successfully integrating acquisitions to drive future growth. We believe that having a deep understanding of customers, longstanding ties to the communities in which we operate, a strong market position, and exceptional employees allow us to provide the attention, responsiveness, and customized service our customers seek while offering a diverse range of products to serve a variety of needs.

Segments

We have one reportable segment. Our chief operating decision makers evaluate our business and operations using consolidated information for purposes of allocating resources and assessing performance. Refer to Note 26—Segment Information of the notes to our audited Consolidated Financial Statements contained in Part II, Item 8 of this report for additional information.

Our Products and Services

We are a full service, commercial bank offering a broad range of deposit products and lending services to small and medium sized businesses, commercial real estate and financial sponsors, and consumers around our 44 branch locations in the Chicago metropolitan area and one branch in Wauwatosa, Wisconsin. The products and services we offer are described below.

Commercial banking

Commercial banking is a fundamental component of our business. We define commercial banking as lending to small and medium sized businesses, real estate and financial sponsors. We offer a comprehensive range of commercial loan, deposit and treasury management products. Our primary commercial lending groups are described below:

Commercial & Industrial. Our commercial and industrial ("C&I") group focuses on small and lower middle market businesses with up to $100 million of annual revenue and seeks to establish long term relationships. We believe this customer segment is underserved by larger institutions that do not focus on this space, as well as by smaller institutions that lack product sophistication and

5

Table of Contents

capabilities. We offer a broad range of lending products including term loans, revolving lines of credit and treasury management products and services. As of December 31, 2025, the C&I group managed a portfolio of $3.3 billion in loans outstanding.

Commercial real estate. Our commercial real estate ("CRE") group focuses on experienced real estate professionals with long track records of performance and access to ample equity capital sources. We believe our specialized expertise and efficient decision making process differentiate us from our competitors. We offer fixed and floating rate term loans, construction financing and revolving lines of credit with a wide range of term options. Our portfolio is broadly diversified by geography and property type including loans secured by multifamily, industrial, retail, and office properties. As of December 31, 2025, the CRE group had $1.4 billion in loans outstanding.

Sponsor finance. Our sponsor finance group provides senior secured financing solutions to private equity backed lower middle market companies throughout the U.S. with earnings before interest, tax, depreciation and amortization generally between $2.0 million and $10.0 million. We support the acquisition, recapitalization and growth investment efforts of private equity firms operating in the lower middle market, and we believe our expertise in this niche is unique for a bank our size. As of December 31, 2025, we had $805.9 million in sponsor finance loans outstanding.

Syndications. From time to time, our syndications group seeks to deploy excess liquidity by opportunistically participating in syndicated loans, acquiring whole loans, or purchasing participations from lead banks that have existing relationships with well capitalized and experienced sponsors. We employed this strategy extensively following our recapitalization by leveraging our relationships with local, regional and national lenders as we developed our own lending capabilities and had excess liquidity. Now, given our sophisticated, full-service lending capabilities, our participation in syndications has decreased and represents a smaller portion of our portfolio. The syndications group targets transactions in the home mortgage, CRE, and C&I categories that provide attractive risk/reward characteristics, and we continue to maintain the ability to sell loan positions to manage credit and specific customer and industry concentrations. As of December 31, 2025, the group had $183.8 million in loan syndications outstanding.

Commercial deposits and treasury management. We also support our business customers with deposit and treasury management products, along with business transaction accounts. Our comprehensive suite of products includes treasury services, third party payment processing, information reporting, fraud management, cash collection, and interest rate derivative products. We believe these tailored products allow us to provide a robust service offering to our customers and to support their day-to-day funding and risk management needs. These services are provided through multiple points of contact including branch, online, and mobile interfaces.

Small Business Capital. Our U.S. government guaranteed lending business serves small businesses in need of, and qualifying for, SBA and USDA loans (referred to together as "U.S. government guaranteed loans"). We provide SBA lending services throughout the country, with a primary focus on the Midwest, Tennessee, Florida, Texas, Colorado, Utah, and California. We generally sell the government guaranteed portion of SBA and USDA loans into the secondary market while retaining the non-guaranteed portion of the loan and the servicing rights. This allows us to realize one time gain on sale income along with a recurring servicing and interest revenue stream. In addition to the business development officers who we rely on to generate new business, we also have a dedicated servicing, portfolio management and workout staff with specialized expertise in U.S. government guaranteed loans. As of December 31, 2025, total loans and leases included $533.0 million in SBA and USDA loans, of which $97.8 million are guaranteed by the U.S. government. The total unpaid principal balances of SBA and USDA loans serviced for others was $1.6 billion at December 31, 2025.

Community banking

We offer customers traditional deposit products through our branch network, consumer and business online account opening through our website, and customer access to their accounts through online and mobile banking platforms. The wide variety of deposit products we offer include non-interest-bearing accounts, money market demand accounts, savings accounts, interest-bearing checking accounts and time deposits with maturities ranging from seven days to five years. We consider our core deposits, defined as all deposits except time deposits exceeding $100,000, to be our primary and most valuable funding source. As of December 31, 2025, core deposits represented 87.0% of our total deposits. In addition to these products, we offer ATM and debit cards as well as online, mobile, and text banking. We strive to retain an attractive deposit mix from both large and small customers as well as a broad market reach, which has resulted in our top 50 customers accounting for approximately 13.6% of all deposits as of December 31, 2025. Our bankers are incentivized to acquire and maintain quality core deposits as we depend on these deposits to fund the majority of our loans and leases. We believe that our long standing and high-quality relationships with our depositors who provide us with long term funding are due to the convenience and dedicated service we offer. We leverage our expansive branch locations and deep network of customer relationships in the Chicago metropolitan area to provide both low cost funding sources for our lending business and deposit related fee income. We had $7.6 billion of deposits at December 31, 2025, and our average cost of deposits was 2.17% for the year ended December 31, 2025.

Small ticket equipment leasing

Through our Bank’s subsidiary, Byline Financial Group ("BFG"), we provide financing solutions for equipment vendors and their end users. The vertical markets served by our equipment vendors specialize primarily in manufacturing, small equipment construction, wholesalers, and healthcare. The end users (i.e., our lessees and borrowers) are primarily manufacturers, retailers, wholesalers, physician group practices and other healthcare related entities. The average lease size at origination for BFG for the year ended December 31, 2025 was approximately $84,000. Our sales team originates leases throughout the country, and we have lessees in nearly every state. As of December 31, 2025, BFG had $752.3 million in leases outstanding with a weighted average life of approximately 3.1 years.

6

Table of Contents

Trust and wealth management

We provide investment, trust and wealth management services to our customers, such as foundations and endowments and high net worth individuals, which include fiduciary and executor services, financial planning solutions, investment advisory services, and private banking services. These services are provided through credentialed investment, legal, tax, and wealth management professionals who identify opportunities and provide services tailored to our customers’ goals and objectives. Assets under administration were $823.2 million as of December 31, 2025, and include $115.2 million of money market demand accounts included in interest-bearing deposits on the Consolidated Statements of Financial Condition.

Competition

The financial services industry is highly competitive as we compete for loans, leases, deposits and customer relationships within and outside of our markets. Competition involves efforts to retain current customers, make new loans and leases, obtain new deposits, increase the scope and sophistication of services offered, the availability, ease of use, and range of banking services provided on the internet and through mobile devices, and offer competitive interest rates paid on deposits and charged on loans and leases. We face competition not only from other financial holding companies and commercial banks, but also from internet banks, savings and loan associations, FinTech companies, credit unions, trust and wealth management providers, and other providers of financial services and products. Competition is generally based on the variety, rates and terms of products and services offered to customers and the performance of funds under management.

Human Capital

At Byline, we are a bank that believes in putting our name behind everything we do, and we are here to roll up our sleeves and help our customers write their stories. Our #1 core value, reflected in our "Things That Matter," is our People, all of whom are encouraged to live out a shared purpose of making people’s lives better, helping businesses thrive, and strengthening the communities we serve. We are dedicated to attracting, retaining, and developing top talent to accomplish our long-term strategy which is critical to our success.

As of December 31, 2025, we had 1,027 employees (1,018 full time, and nine part time) in locations primarily across the Chicagoland and greater Milwaukee, Wisconsin areas. Our employees are not represented by a collective bargaining agreement. We consider our relationship with our employees to be good.

At Byline Bank we recognize the value of our People. We strive to become an employer of choice and many of our advantages are found within our four Total Rewards pillars: Pay, Benefits, Health and Wellness, Work-Life Harmony, and Professional Development. We believe our compensation strategy supports our core principles and provides every employee with a competitive compensation package that fairly reflects their individual contributions to Byline.

Employee Recognition and Engagement

We conduct an annual employee engagement survey with over 94% participation and observe consistently favorable levels of employee engagement and satisfaction.

To facilitate talent attraction, development and retention across our franchise, we strive to make Byline an inclusive, safe and healthy workplace, with opportunities for our employees to grow and develop in their careers, supported by strong compensation, benefits, and health and welfare programs.

We seek to leverage our current workforce and prominent community outreach efforts to further define and enhance our engagement in four key areas:

•
Workforce – Promoting representation at all levels and in all areas and business lines of the Bank, with attention on recruiting, developing, and retaining high performing talent and focusing on engagement and employee recognition.

•
Workplace – Creating a culture where everyone brings their authentic self to work and knows their unique background, ethnicity, experiences, perspective, and contribution serve to strengthen the Bank.

•
Community – Building meaningful, supportive relationships in the communities we work.

•
Marketplace – Providing greater accessibility to banking products, services, and education to minority owned small businesses ("SMB") and SMBs in low-and moderate-income areas.

Our employee resource groups were formed to support development, engagement and inclusion across the organization, and are open to all employees.

For additional information, please see our definitive proxy statement for our 2026 Annual Meeting of Stockholders, a copy of which will be filed with the SEC no later than 120 days after the end of our fiscal year.

7

Table of Contents

Information About Our Executive Officers

The following list sets forth the name, current age, principal position and recent business experience of each of our executive officers:

Thomas Abraham, 60, became President of Byline Bank’s Small Business Capital ("SBC") line of business in May 2019. Mr. Abraham previously served as Senior Vice President, SBA Sales Manager of SBC since October 2016.

John M. Barkidjija, 62, became Executive Vice President and Head of Commercial Real Estate and Specialty Finance of Byline Bank in January 2019. Mr. Barkidjija previously served as Senior Vice President, Group Head, Commercial Real Estate of Byline Bank since January 2014.

Thomas J. Bell III, 59, became Executive Vice President and Chief Financial Officer of Byline and Byline Bank in August 2022. Mr. Bell previously served as Corporate Treasurer of Byline Bank from August 2013 to December 2025, when Douglas Howe was appointed Corporate Treasurer of Byline Bank.

Megan Biggam, 47, became Executive Vice President of Community Banking of Byline Bank in February 2020. Ms. Biggam previously served as Senior Vice President of Community Banking of Byline Bank since June 2013.

Brian Doran, 67, became Executive Vice President, General Counsel and Corporate Secretary for Byline and Byline Bank in January 2025. Prior to that, Mr. Doran was General Counsel at Republic First Bancorp, Inc. and Republic Bank from 2023 to 2024. He also served as General Counsel and Corporate Secretary for Investors Bancorp, Inc. and Investors Bank from 2015 to 2022.

Mark Fucinato, 69, became Executive Vice President and Chief Credit Officer for Byline and Byline Bank in August 2020. He previously served as Senior Vice President and Senior Credit Officer of Byline Bank since August 2019.

Roberto R. Herencia, 66, became Chairman of Byline Bancorp, Inc. and Byline Bank in June 2013, and Executive Chairman and Chief Executive Officer in February, 2021.

Michelle Johnson, 44, became Executive Vice President and Chief Risk Officer of Byline Bank in October 2019. Prior to that, Ms. Johnson served as Deputy Chief Risk Officer since 2018. Ms. Johnson joined Byline Bank in 2015 as Director of IT Risk Management.

Nicolas Mando, 54, became Executive Vice President and Chief Technology and Operations Officer of Byline Bank in November 2021. He served as Director of Special Projects of Byline Bank since 2019.

Sherylle Olano, 47, became Senior Vice President and Chief Accounting Officer of Byline and Byline Bank in August 2022. Prior to that, Ms. Olano previously served as Controller since 2014.

Alberto J. Paracchini, 55, is President and a Director of Byline Bancorp, Inc. and Chief Executive Officer, President and a Director of Byline Bank. He joined Byline in June 2013.

Brogan Ptacin, 65, became Executive Vice President and Head of Commercial Banking for Byline Bank in January 2019. Prior to that, Mr. Ptacin served as a Managing Director of First Bank & Trust since 2009 until First Bank & Trust was acquired by Byline in 2018.

Dana Rose, 56, became Executive Vice President and Chief Human Resources Officer of Byline Bank in November 2019.

Corporate Information

Our principal executive offices are located at 180 North LaSalle Street, Suite 300, Chicago, Illinois 60601, and our telephone number at that address is (773) 244-7000. Our website address is www.bylinebancorp.com. We make available at this address, under the "Investor Relations" tab, free of charge, our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended (the "Exchange Act") as soon as reasonably practicable after such material is electronically filed with, or furnished to, the SEC. These filings are also available on the SEC's website at www.sec.gov. The contents of our website are not incorporated by reference into this report.

Supervision and Regulation

We and our subsidiaries are subject to extensive regulation under federal and state banking laws that establish a comprehensive framework for our operations, and are subject to oversight and supervision by multiple federal and state banking agencies, including the Federal Deposit Insurance Corporation (the "FDIC"), the Board of Governors of the Federal Reserve System (the "FRB") and the Illinois Department of Financial and Professional Regulation (the "IDFPR"). This framework may materially affect our growth potential and financial performance and is intended primarily for the protection of depositors, customers, federal deposit insurance funds and the banking system as a whole, and not for the protection of our stockholders and creditors. Any change in applicable laws or regulations, whether by the FDIC, the FRB, the IDFPR or the U.S. Congress, could have a material adverse impact on the operations and financial performance of us and our subsidiaries.

8

Table of Contents

Set forth below is a brief description of the significant elements of the statutes, regulations and policies applicable to us and our subsidiaries. The description below is limited to certain material aspects of the statutes and regulations addressed and is not intended to be a complete description of such statutes and regulations and their effects on us and our subsidiaries.

Regulatory Agencies

We are a bank holding company under the Bank Holding Company Act of 1956 (the "BHCA"). Consequently, we and our subsidiaries are subject to supervision, regulation and examination by the FRB. The BHCA provides generally for "umbrella" regulation of bank holding companies and functional regulation of holding company subsidiaries by applicable regulatory agencies. We are also subject to the rules and regulations of the SEC under the federal securities laws, including the disclosure and regulatory requirements of the Securities Act and the Exchange Act as administered by the SEC, and the rules adopted by the New York Stock Exchange (the "NYSE") applicable to NYSE-listed companies.

Byline Bank, our bank subsidiary, is an FDIC-insured commercial bank chartered under the laws of Illinois. Our bank is not a member of the FRB. Consequently, the FDIC and the IDFPR are the primary regulators of our bank and also regulate our bank’s subsidiaries. As the owner of an Illinois-chartered commercial bank, we are also subject to supervision and examination by the IDFPR.

Permissible Activities for Bank Holding Companies

In general, the BHCA limits the business of bank holding companies to banking, managing or controlling banks and other activities that the FRB has determined to be so closely related to banking as to be a proper incident thereto, which include, among other things, certain activities relating to extending credit or acting as an investment or financial advisor. We currently do not conduct any non-banking activities through any non-bank subsidiaries.

Bank holding companies that qualify and elect to be treated as "financial holding companies" may engage in a broader range of additional activities than bank holding companies that are not financial holding companies. In particular, financial holding companies may engage in activities that are (i) financial in nature or incidental to such financial activities or (ii) complementary to a financial activity and do not pose a substantial risk to the safety and soundness of depository institutions or the financial system generally. These activities include securities underwriting and dealing, insurance underwriting and making merchant banking investments. We have not elected to be treated as a financial holding company and currently have no plans to make a financial holding company election.

The FRB has the power to order any bank holding company or any of its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the FRB has reasonable grounds to believe that continuing such activity, ownership or control constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company.

Permissible Activities for Banks

As an Illinois-chartered commercial bank, our bank’s business is subject to extensive supervision and regulation by state and federal bank regulatory agencies. Our business is generally limited to activities permitted by Illinois law and any applicable federal laws. Under the Illinois Banking Act, our bank may generally engage in all usual banking activities, including, among other things, accepting deposits; lending money on personal and real estate security; issuing letters of credit; buying, discounting, and negotiating promissory notes and other forms of indebtedness; buying and selling foreign currency and, subject to certain limitations, certain investment securities; engaging in certain insurance activities and maintaining safe deposit boxes on premises.

Illinois law also imposes restrictions on Byline Bank’s activities intended to ensure the safety and soundness of our bank. For example, Byline Bank is restricted under the Illinois Banking Act from investing in certain types of investment securities and is generally limited in the amount of money it can lend to a single borrower or invest in securities issued by a single issuer.

Acquisitions by Bank Holding Companies

The BHCA, Section 18(c) of the Federal Deposit Insurance Act, popularly known as the "Bank Merger Act," the Illinois Banking Act, the Illinois Bank Holding Company Act and other federal and state statutes regulate acquisitions of commercial banks and other FDIC-insured depository institutions. We must obtain the prior approval of the FRB under the BHCA before (i) acquiring more than 5% of the voting stock of any FDIC-insured depository institution or other bank holding company(other than directly through our bank), (ii) acquiring all or substantially all of the assets of any bank or bank holding company or (iii) merging or consolidating with any other bank holding company. Under the Bank Merger Act, the prior approval of the FDIC is required for our bank to merge with another bank or purchase all or substantially all of the assets or assume any of the deposits of another FDIC-insured depository institution or to assume certain liabilities of non-banks. In reviewing applications seeking approval of merger and acquisition transactions, banking regulators consider, among other things, the competitive effect and public benefits of the transactions, the capital position and managerial resources of the combined organization, the risks to the stability of the U.S. banking or financial system, the applicant’s performance record under the Community Reinvestment Act of 1977 ("CRA"), the applicant’s compliance with fair housing and other consumer protection laws and the effectiveness of all organizations involved in combating money laundering activities. In addition, failure to implement or maintain adequate compliance programs could cause banking regulators not to approve an acquisition where regulatory approval is required or to prohibit an acquisition even if approval is not required.

Dividends

We are a legal entity separate and distinct from Byline Bank and other subsidiaries. As a bank holding company, we are subject to certain restrictions on our ability to pay dividends under applicable banking laws and regulations.

9

Table of Contents

As a Delaware corporation, we are subject to the limitations of the Delaware General Corporation Law (the "DGCL"). The DGCL allows us to pay dividends only out of our surplus (as defined and computed in accordance with the provisions of the DGCL) or if we have no such surplus, out of our net profits for the fiscal year in which the dividend is declared and/or the preceding fiscal year. Federal banking regulators are authorized to determine under certain circumstances relating to the financial condition of a bank holding company or a bank that the payment of dividends would be an unsafe or unsound practice and to prohibit payment thereof. In particular, federal banking regulators have stated that paying dividends that deplete a banking organization’s capital base to an inadequate level would be an unsafe and unsound banking practice and that banking organizations should generally pay dividends only out of current operating earnings. In addition, the FRB has indicated that bank holding companies should carefully review their dividend policy and has discouraged payment ratios that are at maximum allowable levels unless both asset quality and capital are very strong. Under the capital rules defined in the Regulatory Capital Requirements section, institutions that seek to pay dividends must maintain 2.5% in Common Equity Tier 1 capital attributable to the capital conservation buffer. For more information on these financial measures at the Company and Byline Bank - refer to Note 20 of the notes to our audited consolidated financial statements contained in Part II, Item 8 of this report.

A significant portion of our income, on a stand-alone basis, comes from dividends from our bank, which is also the primary source of our liquidity. In addition to the restrictions discussed previously, our bank is subject to limitations under Illinois law regarding the level of dividends that it may pay to us. Under the Illinois Banking Act, Byline Bank generally may not pay dividends in an amount greater than its net profits then on hand, deducting first therefrom its losses and bad debts. Under these restrictions, Byline Bank could pay aggregate dividends of approximately $241.0 million to us without obtaining affirmative regulatory approvals as of December 31, 2025.

Transactions with Affiliates and Insiders

Transactions between our bank and its subsidiaries, on the one hand, and us or any other subsidiary, on the other hand, are regulated under Sections 23A and 23B of the Federal Reserve Act and the FRB’s Regulation W. The Federal Reserve Act imposes quantitative and qualitative requirements and collateral requirements on covered transactions by Byline Bank with, or for the benefit of, its affiliates. Generally, Sections 23A and 23B of the Federal Reserve Act limit the extent to which our bank or its subsidiaries may engage in "covered transactions" with any one affiliate to an amount equal to 10% of our bank’s capital stock and surplus, limit the aggregate amount of all such transactions with all affiliates to an amount equal to 20% of such capital stock and surplus, and require those transactions to be on terms at least as favorable to our bank as if the transaction were conducted with an unaffiliated third party. Covered transactions are defined by statute to include a loan or extension of credit, as well as a purchase of securities issued by an affiliate, a purchase of assets (unless otherwise exempted by the FRB) from the affiliate, certain derivative transactions with an affiliate, the acceptance of securities issued by the affiliate as collateral for a loan, and the issuance of a guarantee, acceptance or letter of credit on behalf of an affiliate. In addition, any credit transactions with any affiliate must be secured by designated amounts of specified collateral.

Sections 22(g) and 22(h) of the Federal Reserve Act also limit our bank’s authority to extend credit to its insiders, which is defined under applicable law to include its directors, executive officers and owners of 10% or more of its stock, as well as to entities controlled by such persons, or their immediate family members as defined under the FRB’s Regulation O. Among other things, extensions of credit to insiders are required to be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with unaffiliated persons. Also, the terms of such extensions of credit may not involve more than the normal risk of non-repayment or present other unfavorable features and may not exceed certain limitations on the amount of credit extended to such persons individually and in the aggregate. In addition, we have certain stockholders who are foreign nationals, and we and these foreign national stockholders have entered into commitments with the FRB that restrict our ability to engage in certain business transactions without the consent of the FRB.

Source of Strength

FRB policy and federal law require bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. Under this requirement, we are expected to commit resources to support Byline Bank, including at times when we may not be in a financial position to provide such resources, and it may not be in our, or our stockholders’ or creditors’, best interests to do so. In addition, any capital loans we make to our bank are subordinate in right of payment to depositors and to certain other indebtedness of our bank. In the event of our bankruptcy, any commitment by us to a federal banking regulatory agency to maintain the capital of our bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Regulatory Capital Requirements

The FRB monitors the capital adequacy of our holding company on a consolidated basis, and the FDIC and the IDFPR monitor the capital adequacy of our bank. The banking regulators use a combination of risk-based guidelines and a leverage ratio to evaluate capital adequacy. The risk-based capital guidelines applicable to us and our bank are based on the Basel Committee’s December 2010 final capital framework for strengthening international capital standards, known as Basel III, as implemented by the federal banking regulators, as well as various other rules implemented by the federal banking regulators as described below. The risk-based guidelines are intended to make regulatory capital requirements sensitive to differences in credit and market risk profiles among banks and bank holding companies, to account for off-balance sheet exposure and to minimize disincentives for holding liquid assets.

The Capital Rules. Over the past several years, the federal banking regulators have adopted a number of final rules, which we refer to as the Capital Rules, implementing Basel III, various provisions of the Dodd-Frank Wall Street and Consumer Protection Act

10

Table of Contents

(the "Dodd-Frank Act"), various provisions of the Economic Growth Regulatory Relief and Consumer Protection Act (the "Consumer Protection Act") and certain other statutory and regulatory provisions relating to capital requirements. The Capital Rules, among other things, (i) include a capital measure called "Common Equity Tier 1" ("CET1"), (ii) specify that Tier 1 capital consists of CET1 and "Additional Tier 1 capital" instruments meeting certain revised requirements, (iii) define CET1 narrowly by requiring that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital and (iv) expand the scope of the deductions/adjustments to capital as compared to prior regulations. The Capital Rules also address risk-based capital requirements and risk weights and other issues affecting regulatory capital ratio calculations.

Under the Capital Rules, the minimum capital ratios are (i) 4.5% CET1 to risk-weighted assets, (ii) 6% Tier 1 capital (that is, CET1 plus Additional Tier 1 capital) to risk-weighted assets, (iii) 8% total capital (that is, Tier 1 capital plus Tier 2 capital) to risk- weighted assets and (iv) 4% Tier 1 capital to average consolidated assets as reported on consolidated financial statements (known as the "leverage ratio").

The current Capital Rules also include a capital conservation buffer designed to absorb losses during periods of economic stress. The capital conservation buffer, which is composed entirely of CET1, is in addition to these minimum risk-weighted asset ratios. The capital conservation buffer is equal to 2.5% of CET1. In addition, the Capital Rules provide for a countercyclical capital buffer applicable only to certain covered institutions. We do not expect the countercyclical capital buffer to be applicable to us or our bank. Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the capital conservation buffer (or below the combined capital conservation buffer and countercyclical capital buffer, when the latter is applied) will face constraints on dividends, equity repurchases, and compensation based on the amount of the shortfall.

As a result of the fully phased-in capital conservation buffer rule, we and our bank are required to maintain an additional capital conservation buffer of 2.5% of CET1, effectively resulting in minimum ratios of (i) 7% CET1 to risk-weighted assets, (ii) 8.5% Tier 1 capital to risk-weighted assets, (iii) 10.5% total capital to risk-weighted assets and (iv) a minimum leverage ratio of 4%.

The Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, certain deferred tax assets and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. The Capital Rules also generally preclude certain hybrid securities, such as trust preferred securities, from being counted as Tier 1 capital for most bank holding companies. Bank holding companies such as us who had less than $15 billion in assets as of December 31, 2009 (and who continue to have less than $15 billion in assets) are permitted to include qualifying trust preferred securities issued prior to May 19, 2010 as Additional Tier 1 capital under the Capital Rules, however.

In addition, under the general risk-based Capital Rules, the effects of accumulated other comprehensive income items included in capital were excluded for the purposes of determining regulatory capital ratios. Under the Capital Rules, the effects of certain accumulated other comprehensive income items are not excluded; however, non-advanced approaches banking organizations, including us and Byline Bank, were able to make a one-time permanent election to continue to exclude these items.

The Capital Rules also include a standardized approach for risk weightings of assets that include more risk-sensitive categories compared to previous capital rules. Higher levels of capital are required for asset categories perceived to present greater risk. These risk-weighting categories depend on the nature of the assets, generally ranging from 0%, for U.S. government and agency securities, to 600% for certain equity exposures, and result in higher risk weights for a variety of asset categories.

With respect to our bank, the Capital Rules also revised the prompt corrective action regulations pursuant to Section 38 of the Federal Deposit Insurance Act (the "FDIA"). On September 17, 2019, pursuant to the Consumer Protection Act, the federal banking regulators issued a final rule meant to simplify the capital rules for community banks. Under the final rule, most depository institutions and depository institution holding companies that have less than $10 billion in total consolidated assets, that have limited amounts of off-balance sheet exposures and trading assets and liabilities, and that have a community bank leverage ratio of greater than 9% would be eligible to opt into a community bank leverage ratio framework beginning on January 1, 2020. Under the final rule, a qualified community bank or its holding company that elects to use the community bank leverage ratio and maintains a community bank leverage ratio of greater than 9% is not subject to other risk-based and leverage capital requirements, including the risk-based capital rules relating to high volatility commercial real estate, mortgage servicing rights, certain deferred tax assets and significant investments in non-consolidated financial entities, and is considered to have met the well capitalized ratio requirements for purposes of Section 38 of the FDIA and the generally applicable capital requirements under the federal banking regulators’ capital rules. On November 25, 2025, federal banking regulators, including the FDIC, issued a proposed rule that would lower the community bank leverage ratio from 9% to 8% and extend the grace period for falling below the threshold from two to four quarters, reducing compliance pressure on financial institutions that elect to adopt the community bank leverage ratio framework. While the community bank leverage ratio framework is available to us and Byline Bank, neither we nor Byline Bank have elected to adopt the community bank leverage ratio framework at this time.

As part of the adoption of Accounting Standards Update ("ASU") 2016-13, the Company elected to opt into the regulators’ joint current expected credit losses ("CECL") transition provision, which allowed the Company and Byline Bank to phase in the capital impact of the adoption of CECL over three years beginning January 1, 2022. Accordingly, capital ratios as of December 31, 2024 reflected 75% of the CECL impact. As of January 1, 2025, the capital impact of the adoption of CECL is fully phased in.

11

Table of Contents

Liquidity Regulations

Historically, the regulation and monitoring of bank and bank holding company liquidity has been addressed as a supervisory matter, without required formulaic measures. The Basel III final framework requires banks and bank holding companies to measure their liquidity against specific liquidity tests that, although similar in some respects to liquidity measures historically applied by banks and regulators for management and supervisory purposes, going forward would be required by regulation. One test, referred to as the liquidity coverage ratio ("LCR"), is designed to ensure that the banking entity maintains an adequate level of unencumbered high-quality liquid assets equal to the entity’s expected net cash outflow for a 30-day time horizon (or, if greater, 25% of its expected total cash outflow) under an acute liquidity stress scenario. The other test, referred to as the net stable funding ratio, or the ("NSFR"), is designed to promote more medium- and long-term funding of the assets and activities of banking entities over a one-year time horizon. These requirements incentivize banking entities to increase their holdings of U.S. Department of Treasury ("U.S. Treasury") securities and other direct obligations of the U.S. government as a component of assets and increase the use of long-term debt as a funding source.

Federal banking regulators approved final rules implementing the LCR for advanced approaches banking organizations (i.e., banking organizations with $250 billion or more in total consolidated assets or $10 billion or more in total on-balance sheet foreign exposure) and a modified version of the LCR for bank holding companies with at least $50 billion in total consolidated assets that are not advanced approaches banking organizations. Neither of these final versions of the LCR apply to us or our bank. Federal banking regulators also approved a final rule implementing the NSFR that requires certain U.S. banking organizations to ensure that they have access to stable funding over a defined time period. However, the final rule implementing the NSFR does not apply to U.S. banking organizations with less than $50 billion in total consolidated assets such as us and Byline Bank.

Prompt Corrective Action Framework

The FDIA requires federal banking regulators to take prompt corrective action in respect of depository institutions that fail to meet specified capital requirements. The FDIA establishes five capital categories: "well capitalized", "adequately capitalized", "undercapitalized", "significantly undercapitalized", and "critically undercapitalized". Federal banking regulators are required to take certain mandatory supervisory actions, and are authorized to take other discretionary actions, with respect to institutions that are undercapitalized, significantly undercapitalized or critically undercapitalized. The severity of these mandatory and discretionary supervisory actions depends upon the capital category in which the institution is placed. The relevant capital measures are the total capital ratio, the CET1 capital ratio, the Tier 1 capital ratio and the leverage ratio.

A bank will be (i) "well capitalized" if the institution has a total risk-based capital ratio of 10% or greater, a CET1 capital ratio of 6.5% or greater, a Tier 1 risk-based capital ratio of 8% or greater and a leverage ratio of 5% or greater, and is not subject to any order or written directive by any such regulatory authority to meet and maintain a specific capital level for any capital measure;(ii) "adequately capitalized" if the institution has a total risk-based capital ratio of 8% or greater, a CET1 capital ratio of 4.5% or greater, a Tier 1 risk- based capital ratio of 6% or greater and a leverage ratio of 4% or greater and is not "well capitalized"; (iii) "undercapitalized" if the institution has a total risk-based capital ratio that is less than 8%, a CET1 capital ratio less than 4.5%, a Tier 1 risk-based capital ratio of less than 6% or a leverage ratio of less than 4%; (iv) "significantly undercapitalized" if the institution has a total risk-based capital ratio of less than 6%, a CET1 capital ratio less than 3%, a Tier 1 risk-based capital ratio of less than 4% or a leverage ratio of less than 3%; and (v) "critically undercapitalized" if the institution’s tangible equity is equal to or less than 2% of average quarterly tangible assets. A bank’s capital category is determined solely for the purpose of applying prompt corrective action regulations, and the capital category may not constitute an accurate representation of Byline Bank’s overall financial condition or prospects for other purposes.

The FDIA generally prohibits a depository institution from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the depository institution would thereafter be "undercapitalized." An institution that is categorized as undercapitalized, significantly undercapitalized or critically undercapitalized is required to submit an acceptable capital restoration plan to its appropriate federal banking regulator. Under the FDIA, in order for the capital restoration plan to be accepted by the appropriate federal banking agency, a bank holding company must guarantee that a subsidiary depository institution will comply with its capital restoration plan, subject to certain limitations. The bank holding company must also provide appropriate assurances of performance. The obligation of a controlling bank holding company under the FDIA to fund a capital restoration plan is limited to the lesser of 5% of an undercapitalized subsidiary’s assets or the amount required to meet regulatory capital requirements. An undercapitalized institution is also generally prohibited from increasing its average total assets, making acquisitions and capital distributions, establishing any branches or engaging in any new line of business, except in accordance with an accepted capital restoration plan or with the approval of the FDIC. Institutions that are undercapitalized and either fail to submit an acceptable capital restoration plan or fail to implement an approved capital restoration plan may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become adequately capitalized, requirements to reduce total assets and cessation of receipt of deposits from correspondent banks.

Significantly undercapitalized depository institutions may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become adequately capitalized, requirements to reduce total assets, and cessation of receipt of deposits from correspondent banks. Critically undercapitalized depository institutions are subject to appointment of a receiver or conservator.

The appropriate federal banking agency may, under certain circumstances, reclassify a well-capitalized insured depository institution as adequately capitalized. The FDIA provides that an institution may be reclassified if the appropriate federal banking agency

12

Table of Contents

determines (after notice and opportunity for hearing) that the institution is in an unsafe or unsound condition or deems the institution to be engaging in an unsafe or unsound practice. The appropriate agency is also permitted to require an adequately capitalized or undercapitalized institution to comply with the supervisory provisions as if the institution were in the next lower category (but not treat a significantly undercapitalized institution as critically undercapitalized) based on supervisory information other than the capital levels of the institution. An institution may be downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios if it is determined to be in an unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters.

As of December 31, 2025, our bank was considered "well capitalized" with a Tier 1 capital ratio of 13.35%, total capital ratio of 14.57%, Tier 1 leverage ratio of 12.56%, and a CET1 capital ratio of 13.35%, as calculated under Basel III. For more information on these financial measures at the Company and Byline Bank, refer to Note 20 of the notes to our audited consolidated financial statements contained in Part II, Item 8 of this report.

Safety and Soundness Standards

The FDIA requires the federal banking agencies to prescribe standards, by regulations or guidelines, relating to internal controls, information systems and internal audit systems, loan documentation, credit underwriting, interest rate risk exposure, asset growth, asset quality, earnings, stock valuation and compensation, fees and benefits, and such other operational and managerial standards as the agencies deem appropriate. Federal banking agencies adopted the Interagency Guidelines for Establishing Standards for Safety and Soundness. Such guidelines establish general standards relating to internal controls and information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, asset quality, earnings and compensation, fees and benefits. In general, these guidelines require, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines. These guidelines also prohibit excessive compensation as an unsafe and unsound practice and describe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal stockholder. In addition, the agencies adopted regulations that authorize, but do not require, an agency to order an institution that has been given notice by an agency that it is not satisfying any of such safety and soundness standards to submit a compliance plan. If, after being so notified, an institution fails to submit an acceptable compliance plan or fails in any material respect to implement an acceptable compliance plan, the banking regulator must issue an order directing action to correct the deficiency and may issue an order directing other actions of the types to which an undercapitalized institution may be subject under the FDIA. See Item 1. "Business—Supervision and Regulation—Prompt Corrective Action Framework." If an institution fails to comply with such an order, the banking regulator may seek to enforce such order in judicial proceedings and to impose civil money penalties.

On October 30, 2025, the FDIC and OCC also issued a notice of proposed rulemaking that would define an "unsafe or unsound practice" as this term has not previously been formally defined by the bank regulatory agencies. In addition, the proposed rulemaking seeks to revise the framework for issuing "matters requiring attention" during an examination. With respect to unsafe or unsound practices, the proposed rule seeks to base the determination of whether a practice is unsafe or unsound on whether the practice is likely to have material financial impact on the institution. Specifically, the FDIC and OCC noted in the proposed rulemaking that, based on their supervisory experience and as a matter of policy, the agencies propose implementing a definition of "unsafe or unsound practice" for purposes of section 8 of the FDI Act that would focus on material risks to the financial condition of an institution and would generally require that an imprudent practice, act, or failure to act, if continued, be likely to materially harm the institution’s financial condition. With respect to matters requiring attention, the proposed rule provides that the agencies may only issue a matter requiring attention for a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that (i) is contrary to generally accepted standards of prudent operation; and if continued, could reasonably be expected to, under current or reasonably foreseeable conditions, materially harm the financial condition of the institution; or present a material risk of loss to the FDIC deposit insurance fund (the "DIF"); or has already caused material harm to the financial condition of the institution; or (ii) is an actual violation of a banking or banking-related law or regulation. This proposed rule is intended to ensure supervision efforts are appropriately focused on material financial risks, increase consistency in supervisory reviews and provide more clarity on what constitutes an unsafe or unsound practice and what may trigger a matter requiring attention finding.

Deposit Insurance

FDIC insurance assessments

As an FDIC-insured bank, our bank must pay deposit insurance assessments to the FDIC based on its average total assets minus its average tangible equity. Deposits are insured up to applicable limits by the FDIC and such insurance is backed by the full faith and credit of the U.S. government.

As an institution with less than $10 billion in assets, our bank’s assessment rates are based on the level of risk it poses to the DIF. The FDIC has the authority to increase insurance assessments and published a final rule in October 2022 to increase initial base deposit insurance assessment rate schedules uniformly by 2 basis points, which began in the first quarterly assessment period of 2023. The stated purpose of the increase in assessment rate schedules is to increase the likelihood that the reserve ratio of the DIF reaches the statutory minimum of 1.35% by the statutory deadline of September 30, 2028. The FDIC also concurrently maintained the Designated Reserve Ratio for the DIF at 2% for 2025 and will maintain it at that level for 2026. For established smaller institutions, like Byline Bank, supervisory ratings are used along with (i) an initial base assessment rate, (ii) an unsecured debt adjustment (which can be positive

13

Table of Contents

or negative) and (iii) a brokered deposit adjustment, to calculate a total base assessment rate. Currently, the total base assessment rate range, which does not include the depository institution debt adjustment, for institutions of Byline Bank’s size is 2.5 basis points to 32 basis points.

Deposit accounts at our bank are insured up to the maximum of $250,000. The coverage limit is per depositor, per insured depository institution for each account ownership category. The minimum DIF reserve ratio is 1.35% of estimated insured deposits. Under the FDIA, the FDIC may terminate deposit insurance upon a finding that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC. We do not know of any practice or condition of the bank or violation of any applicable law, regulation, rule, order or condition imposed by the FDIC that could lead to the FDIC terminating our bank’s deposit insurance.

Other assessments

All Illinois state-chartered banks are required to pay supervisory assessments to the IDFPR to fund the operations of that agency. The amount of the assessment is calculated on the basis of Byline Bank’s total assets.

The Volcker Rule

The Dodd-Frank Act, pursuant to a statutory provision commonly called the "Volcker Rule," prohibits banks and their affiliates from engaging in proprietary trading and investing in and sponsoring hedge funds and private equity funds. On July 9, 2019, pursuant to the Consumer Protection Act, the federal banking regulators issued a final rule to exempt community banks that have total assets of $10 billion or less and total consolidated trading assets and liabilities equal to or less than 5% of total consolidated assets from the Volcker Rule. Although we and Byline Bank presently qualify for exemption under the final rule, the Volcker Rule would not significantly affect the operations of us and our subsidiaries, as we do not have any significant engagement in the businesses covered by the Volcker Rule.

Depositor Preference

The FDIA provides that, in the event of the "liquidation or other resolution" of an insured depository institution, the claims of depositors of the institution, including the claims of the FDIC as subrogee of insured depositors, and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution. If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors, including depositors whose deposits are payable only outside of the U.S. and the parent bank holding company, with respect to any extensions of credit they have made to such insured depository institution.

Interchange Fees

The Dodd-Frank Act includes provisions that restrict interchange fees to those which are reasonable and proportionate for certain debit card issuers and limits the ability of networks and issuers to restrict debit card transaction routing, known as the Durbin Amendment. In October 2023, the FRB proposed rules that would reduce the maximum permissible interchange fee cap and would adopt an approach for future adjustments to such cap. Although the Durbin Amendment generally does not apply to debit card issuers with total assets of less than $10 billion, which would include Byline Bank, interchange fee levels and network pricing applicable to all debit card transactions may be negatively impacted.

In addition, various aspects of the debit card interchange framework, including the FRB’s Regulation II, have been the subject of ongoing industry litigation and legal challenges. The ultimate outcome of such litigation, as well as the timing and scope of any final regulatory changes, remains uncertain.

Interstate Branching

Illinois state-chartered banks, such as Byline Bank, have the authority under Illinois law to establish branches anywhere in the State of Illinois, subject to receipt of all required regulatory approvals.

Federal law permits state and national banks to merge with banks in other states subject to: (i) regulatory approval; (ii) federal and state deposit concentration limits; and (iii) any state law limitations requiring the merging bank to have been in existence for a minimum period of time (not to exceed five years) prior to the merger. The establishment of new interstate branches or the acquisition of individual branches of a bank in another state (rather than the acquisition of an out-of-state bank in its entirety) has historically been permitted only in those states the laws of which expressly authorize such expansion. However, the Dodd-Frank Act permits well-capitalized and well-managed banks to establish new branches across state lines without these impediments.

Consumer Financial Protection

We are subject to a number of federal and state consumer protection laws that extensively govern our relationship with our customers. These laws include the Equal Credit Opportunity Act (the "ECOA"), the Fair Credit Reporting Act, the Truth in Lending Act (the "TILA"), the Truth in Savings Act, the Electronic Fund Transfer Act, the Expedited Funds Availability Act, the Home Mortgage Disclosure Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Fair Debt Collection Practices Act, the Fair Credit Reporting Act, the Service Members Civil Relief Act, the Right to Financial Privacy Act, the Telephone Consumer Protection Act, the CAN-SPAM Act, and these laws’ respective state-law counterparts, as well as state usury laws and laws regarding unfair and deceptive acts and practices. These and other federal laws, among other things, require disclosures of the cost of credit and terms of deposit

14

Table of Contents

accounts, provide substantive consumer rights, prohibit discrimination in credit transactions, regulate the use of credit report information, provide financial privacy protections, restrict our ability to raise interest rates on extensions of credit and subject us to substantial regulatory oversight. Violations of applicable consumer protection laws can result in significant potential liability from litigation brought by customers, including actual damages, restitution and attorneys’ fees. Federal banking regulators, state attorneys general and state and local consumer protection agencies may also seek to enforce consumer protection requirements and obtain these and other remedies, including regulatory sanctions, customer rescission rights, action by the state and local attorneys general in each jurisdiction in which we operate and civil money penalties. Failure to comply with consumer protection requirements may also result in our failure to obtain any required bank regulatory approval for merger or acquisition transactions we may wish to pursue or our prohibition from engaging in such transactions even if approval is not required.

The Consumer Financial Protection Bureau (the "CFPB") has broad rulemaking, supervisory and enforcement powers under various federal consumer financial protection laws with respect to certain consumer financial products and services, including the ability to require reimbursements and other payments to customers for alleged legal violations. The CFPB has the authority to impose significant penalties, as well as injunctive relief that prohibits lenders from engaging in allegedly unlawful practices. The CFPB is also authorized to engage in consumer financial education, track consumer complaints, request data and promote the availability of financial services to underserved consumers and communities. Although all institutions are subject to rules adopted by the CFPB and examination by the CFPB in conjunction with examinations by the institution’s primary federal regulator, the CFPB has primary examination and enforcement authority over banks with assets of $10 billion or more. The FDIC has primary responsibility for examination of our bank and enforcement with respect to various federal consumer protection laws so long as our bank has total consolidated assets of less than $10 billion, and state authorities are responsible for monitoring our compliance with all state consumer laws. The CFPB also has the authority to require reports from institutions with less than $10 billion in assets, such as our bank, to support the CFPB in implementing federal consumer protection laws, supporting examination activities, and assessing and detecting risks to consumers and financial markets. Uncertainty regarding the CFPB’s future authority, staffing and regulatory priorities under the current administration, including as a result of ongoing litigation and potential administrative efforts to reduce the agency’s footprint, could impact the CFPB’s supervisory and enforcement activity.

Federal Home Loan Bank System

Byline Bank is a member of the Federal Home Loan Bank of Chicago ("FHLB"), which serves as a central credit facility for its members. The FHLB is funded primarily from proceeds from the sale of obligations of the FHLB system. It makes loans to member banks in the form of FHLB advances. All advances from the FHLB are required to be fully collateralized as determined by the FHLB. As a member of the FHLB of Chicago, Byline Bank is required to acquire and hold shares of capital stock in the FHLB of Chicago based on Byline Bank’s asset size and level of borrowings from the FHLB. Byline Bank was in compliance with this requirement as of December 31, 2025.

Ability-to-Pay Rules and Qualified Mortgages

As required by the Dodd-Frank Act, the CFPB issued a series of final rules amending Regulation Z, the implementing regulation of the TILA. These rules require mortgage lenders to make a reasonable and good-faith determination, based on verified and documented information, that a consumer applying for a residential mortgage loan has a reasonable ability to repay the loan according to its terms. These rules prohibit creditors, such as Byline Bank, from extending residential mortgage loans without regard for the consumer’s ability to repay and add restrictions and requirements to residential mortgage origination and servicing practices. In addition, these rules restrict the imposition of prepayment penalties and restrict compensation practices relating to residential mortgage loan origination.

On April 27, 2021, the CFPB issued two new rules that modified qualified mortgage loan requirements and provided flexibility to banks and other lenders in determining consumers’ ability-to-repay. Compliance with these rules was required by October 1, 2022. Byline Bank complies with, and will continue to comply with, all applicable qualified mortgage loan requirements.

Commercial Real Estate Guidance

The federal banking regulators previously released a statement entitled "Interagency Statement on Prudent Risk Management for Commercial Real Estate Lending" (the "CRE Guidance"). In the CRE Guidance, the federal banking regulators (i) expressed concerns with institutions that ease commercial real estate underwriting standards, (ii) directed financial institutions to maintain underwriting discipline and exercise risk management practices to identify, measure and monitor lending risks and (iii) indicated that they will continue to pay special attention to commercial real estate lending activities and concentrations going forward. The federal banking regulators also previously issued guidance, entitled "Interagency Guidance on Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices," which stated that an institution is potentially exposed to significant commercial real estate concentration risk, and should employ enhanced risk management practices, where (1) total commercial real estate loans represent 300% or more of its total capital and (2) the outstanding balance of such institution’s commercial real estate loan portfolio has increased by 50% or more during the prior 36 months.

Leveraged Lending Guidance

On December 5, 2025, federal banking regulators jointly issued guidance on leveraged lending that rescinds and replaces prior guidance for leveraged finance activities. The new leveraged lending guidance describes regulatory expectations for the sound risk management of leveraged lending activities, including the importance for institutions to apply the FDIC’s and the OCC’s general principles for prudent risk management of commercial loans and other types of lending to their leveraged lending activities.

15

Table of Contents

Community Reinvestment Legislation

Community Reinvestment Act of 1977 (Federal)

Under the CRA, our bank has an obligation, consistent with safe and sound operations, to help meet the credit needs of the market areas where it operates, which includes providing credit to low- and moderate-income individuals and communities. In connection with its examination of our bank, the FDIC is required to assess our bank’s compliance with the CRA. Our bank’s failure to comply with the CRA could, among other things, result in the denial or delay of certain corporate applications filed by us or our bank, including applications for branch openings or relocations and applications to acquire, merge or consolidate with another banking institution or holding company. Our bank received a rating of "Satisfactory" in its most recently completed CRA examination during March of 2023.

On October 24, 2023, the Office of the Comptroller of the Currency, the FDIC and the FRB jointly issued a final rule to revise the CRA’s implementing regulations. The final rule implements a revised regulatory framework that, like the current framework, is based on bank asset size and business model. Under the final rule, banks with over $2 billion in total assets as of December 31 in either of the prior two calendar years, such as Byline Bank, are required to be evaluated under the new "Retail Lending Test," the new "Retail Products and Services Test," the new "Community Development Financing Test" and the new "Community Development Services Test," but banks of all sizes maintain the option to elect to be evaluated under a strategic plan with the final rule updating the standards for obtaining approval for such plan. The applicability date for the majority of the provisions in the final rule was January 1, 2026, and additional requirements will be applicable on January 1, 2027. However, the new CRA regulations have been subject to litigation and, on July 16, 2025, the agencies issued a joint notice of proposed rulemaking to rescind the final rule issued in October 2023 and reinstate the CRA framework that existed prior to the October 2023 final rule.

Illinois Community Reinvestment Act (State)

The Illinois Community Reinvestment Act ("IL-CRA"), which became law in March 2021, requires banks, credit unions and nonbank mortgage companies to invest in, loan to and serve historically disinvested communities. On May 1, 2024, IDFPR’s proposed rules to implement the IL-CRA were adopted and filed with the Illinois Secretary of State. Among other factors, the IDFPR takes into account the record of a bank’s performance under the IL-CRA in considering an application for approval of a relocation of a bank’s main office or a branch and a merger, consolidation, acquisition of assets or assumption of liabilities.

Small Business Lending Rule

On March 30, 2023, the CFPB issued a final rule amending Regulation B, the implementing regulation of the ECOA, to implement section 1071 of the Dodd-Frank Act. Consistent with section 1071, covered financial institutions are required to collect and report to the CFPB data on applications for credit for small businesses, including those that are owned by women or minorities. The rule also addresses the CFPB’s approach to privacy interests and the publication of section 1071 data, shielding certain demographic data from underwriters and other persons, record-keeping requirements and enforcement provisions. The 2023 final rule initially required large lenders to comply by October 1, 2024, with later compliance dates for institutions with a moderate transaction volume (i.e., at least 500 but less than 2,500 covered originations in both 2022 and 2023) and institutions with the lowest volume (i.e., at least 100 but less than 500 covered originations in both 2022 and 2023). While Byline Bank was initially required to comply by October 1, 2024, the CFPB issued interim final rules on June 25, 2024 and June 18, 2025 to extend compliance deadlines. Accordingly, under the interim final rules, Byline Bank is required to be in compliance with the final rule by July 1, 2026. However, on November 13, 2025, the CFPB issued a notice of proposed rulemaking that would further revise the small business lending rule. In the notice, the CFPB indicated that it believes that a potentially long-term data collection regime for small business lending should initially focus on core lending products, lenders, small businesses and data points, rather than the broad initial coverage of lenders, products, small businesses and data points included in the original 2023 rule. As a result, the CFPB is proposing changes that would reduce the number of institutions subject to the rule and the amount of data to be collected. In addition, the proposed rule would extend the compliance date for all entities subject to the rule to January 1, 2028.

Financial Privacy

The federal banking regulators have adopted rules limiting the ability of banks and other financial institutions to disclose non-public information about consumers to unaffiliated third parties. These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to an unaffiliated third party. These regulations affect how consumer information is transmitted through diversified financial companies and conveyed to outside vendors.

Anti-Money Laundering and the USA PATRIOT Act

A major focus of governmental policy on financial institutions in recent years has been combating money laundering and terrorist financing. The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001, or the USA PATRIOT Act, substantially broadened the scope of U.S. anti-money laundering laws and regulations by imposing significant new compliance and due diligence obligations, creating new crimes and penalties and expanding the extra-territorial jurisdiction of the U.S. in these areas: customer identification programs, money laundering, terrorist financing, identifying and reporting suspicious activities and currency transactions, currency crimes, and cooperation between financial institutions and law enforcement authorities. The U.S. Treasury’s Financial Crimes Enforcement Network ("FinCEN"), among other federal agencies, also promulgates rules and regulations regarding the USA PATRIOT Act with which financial institutions are required to comply. Financial institutions are prohibited from entering into specified financial transactions and account relationships and must use enhanced due

16

Table of Contents

diligence procedures in their dealings with certain types of high-risk customers and implement a written customer identification program. Financial institutions must take certain steps to assist government agencies in detecting and preventing money laundering and report certain types of suspicious transactions. Regulatory authorities routinely examine financial institutions for compliance with these obligations, and failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal and reputational consequences for the institution, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required. Regulatory authorities have imposed cease and desist orders and significant civil money penalties against institutions found to be violating these obligations and have in some cases brought criminal actions against some institutions for these types of violations.

On January 1, 2021, the U.S. Congress passed the Corporate Transparency Act as part of the National Defense Authorization Act, which enacted the most significant overhaul of the anti-money laundering laws since the USA PATRIOT Act. Notable amendments include (i) significant changes to the collection of beneficial ownership information ("BOI") and the establishment of a beneficial ownership registry, which requires corporate entities (generally, any corporation, limited liability company or other similar entity with 20 or fewer employees and annual gross income of $5 million or less) to report BOI to FinCEN (which will be maintained by FinCEN and made available upon request to financial institutions); (ii) enhanced whistleblower provisions, which provide that one or more whistleblowers who voluntarily provide original information leading to the successful prosecution of violations of the anti-money laundering laws in any judicial or administrative action brought by the Secretary of the U.S. Treasury or the U.S. Attorney General resulting in monetary sanctions exceeding $1 million (including disgorgement and interest but excluding forfeiture, restitution or compensation to victims) will receive not more than 30% of the monetary sanctions collected and will receive increased protections; (iii) increased penalties for violations of anti-money laundering laws and regulations; (iv) improvements to existing information-sharing provisions that permit financial institutions to share information relating to suspicious activity reports with foreign branches, subsidiaries and affiliates (except those located in the People's Republic of China, the Russian Federation or certain other jurisdictions) for the purpose of combating illicit finance risks; and (v) expanded duties and enforcement powers for FinCEN. Many of the amendments, including those with respect to beneficial ownership, require FinCEN to promulgate rules. However, in March 2025, FinCEN issued an interim final rule that removes the requirement for U.S. companies and U.S. persons to report BOI to FinCEN under the Corporate Transparency Act.

On July 19, 2024, the federal banking agencies proposed amendments to update the requirements for supervised institutions to establish, implement and maintain effective, risk-based and reasonably designed AML and CFT programs. The proposed amendments would require supervised institutions to identify, evaluate and document the regulated institution’s money laundering, terrorist financing and other illicit finance activity risks, as well as consider FinCEN’s published AML/CFT priorities. We are currently evaluating the effect, if any, of the proposed amendments on Byline Bank were they to be adopted as final.

Office of Foreign Assets Control Regulation

OFAC, under authority of various laws, administers and enforces economic and trade sanctions against targeted foreign countries and regimes, including designated foreign countries, nationals and others. OFAC publishes lists of specially designated targets and countries. We and our bank are responsible for, among other things, blocking accounts of, and transactions with, such targets and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence. Failure to comply with these sanctions could have serious legal and reputational consequences and could result in civil money penalties imposed on the institution by OFAC. Failure to comply with these sanctions could also cause applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required.

Cybersecurity

In March 2015, federal regulators issued two related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing Internet-based services of the financial institution. The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyberattack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyberattack. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.

In November 2021, the federal regulators finalized a rule concerning notification requirements for banks related to significant computer security incidents. Under the final rule, a bank or its bank holding company is required to notify its applicable federal banking regulators within 36 hours of incidents that have materially disrupted or degraded, or are reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the organization, or impact the stability of the financial sector. The rule was effective April 1, 2022 and compliance was required by May 1, 2022.

In March 2022, the Cyber Incident Reporting for Critical Infrastructure Act of 2022 ("CIRCIA") was signed into law. The enactment of CIRCIA requires the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency ("CISA") to develop and implement regulations requiring covered entities to report covered cyber incidents and ransomware payments to CISA

17

Table of Contents

in an effort to better equip CISA to provide resources and assistance to victims suffering attacks and share information necessary to warn other potential victims. In part, CIRCIA requires CISA to develop and issue regulations requiring covered entities to report to CISA within 72 hours from the time an entity reasonably believes a covered cyber incident occurred and within 24 hours of making any ransom payments made as a result of a ransomware attack. CISA is required to complete mandatory rulemaking activities before the reporting requirements go into effect. It is possible, but not yet confirmed, that banks could be subject to CIRCIA.

In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. We employ an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of our defensive measures, the threat from cyberattacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to-date we have not experienced a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our customers and third-party service providers are under constant threat and it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity vulnerabilities and attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use, scope, availability and complexity of Internet banking, mobile banking, electronic payment systems and other technology-based products and services. See