OTC: CBKM

Supervision and Regulation

The Company and the Bank are subject to regulation by the Securities and Exchange Commission (SEC), the Board of Governors of the Federal Reserve System (Federal Reserve Board), the Office of the Comptroller of the Currency (OCC), and other federal and state regulators. The regulatory framework is intended primarily for the protection of depositors, federal deposit insurance funds, and the banking system as a whole and not for the protection of shareholders and creditors. Earnings and dividends of the Company are affected by state and federal laws and regulations and by policies of various regulatory authorities. Changes in applicable law or in the policies of various regulatory authorities could materially affect the business and prospects of the Company and the Bank. The following describes selected federal and state statutory and regulatory provisions that have, or could have, a material impact on the Company. The following discussion of supervision and regulation is qualified in its entirety by reference to the statutory and regulatory provisions discussed.

Regulation of the Company

The Bank Holding Company Act: As a bank holding company, the Company is subject to regulation under the BHCA, and the examination and reporting requirements of the Federal Reserve Board. Under the BHCA, the Company is subject to periodic examination by the Federal Reserve Board and is required to file periodic reports regarding its operations and any additional information that the Federal Reserve Board may require.

The BHCA generally limits the activities of a bank holding company to banking, managing or controlling banks, furnishing services to or performing services for its subsidiaries and engaging in any other activities that the Federal Reserve Board has determined to be so closely related to banking or to managing or controlling banks as to be a proper incident to those activities. In addition, subject to certain exceptions, the BHCA requires every bank holding company to obtain the approval of the Federal Reserve Board prior to acquiring substantially all the assets of any bank, acquiring direct or indirect ownership or control of more than 5% of the voting shares of a bank or merging or consolidating with another bank holding company.

Under Federal Reserve Board policy, a bank holding company is expected to act as a source of financial strength to each subsidiary bank and to commit resources to support those subsidiary banks. Under this policy, the Federal Reserve Board may require a bank holding company to contribute additional capital to an undercapitalized subsidiary bank and may disapprove of the payment of dividends to shareholders if the Federal Reserve Board believes the payment of such dividends would be an unsafe or unsound practice. The Federal Reserve Board has extensive enforcement authority over bank holding companies for violations of laws and regulations and unsafe or unsound practices.

4

Privacy Provisions of Gramm-Leach-Bliley Act: The Gramm-Leach-Bliley Act of 1999 contains extensive provisions on a customer’s right to privacy of non-public personal information. Under these provisions, a financial institution must provide its customers with the institution’s policies and procedures regarding the handling of customers’ non-public personal information. Except in certain cases, an institution may not provide personal information to unaffiliated third parties unless the institution discloses that such information may be disclosed, and the customer is given the opportunity to opt out of such disclosure. The Company and the Bank are also subject to certain state laws that deal with the use and distribution of non-public personal information.

Sarbanes-Oxley Act: The Sarbanes-Oxley Act of 2002 contains important requirements for public companies in the areas of financial disclosure and corporate governance. In accordance with section 302(a) of the Sarbanes-Oxley Act, written certifications by the Company’s Chief Executive Officer and Chief Financial Officer are required. These certifications attest that the Company’s quarterly and annual reports filed with the SEC do not contain any untrue statement of a material fact or omit to state a material fact.

Regulation of the Bank

As a national bank, the Bank is subject to regulation, supervision, and examination by the OCC and by the Federal Deposit Insurance Corporation (FDIC). These examinations are designed primarily for the protection of the depositors of the Bank.

Dividend Restrictions: Dividends from the Bank are the primary source of funds for payment of dividends to the Company’s shareholders. There are statutory limits, however, on the amount of dividends the Bank can pay without regulatory approval. Under regulations promulgated by the OCC, the Bank may not declare a dividend in excess of its undivided profits. Additionally, the Bank may not declare a dividend if the total amount of all dividends, including the proposed dividend, declared by the Bank in any calendar year exceeds the total of its retained net income of that year to date, combined with its retained net income of the two preceding years, unless the dividend is approved by the OCC. The Bank may not declare or pay any dividend if, after making the dividend, the Bank would be “undercapitalized,” as defined in the federal regulations.

FDIC: The FDIC is an independent federal agency, which insures the deposits of federally insured banks and savings associations up to certain prescribed limits and safeguards the safety and soundness of financial institutions. The deposits of the Bank are subject to the deposit insurance assessments of the Deposit Insurance Fund of the FDIC. Under the FDIC’s deposit insurance assessment system, the assessment rate for any insured institution varies according to regulatory capital levels of the institution and other factors such as supervisory evaluations.

The FDIC is authorized to prohibit any insured institution from engaging in any activity that poses a serious threat to the insurance fund and may initiate enforcement actions against banks, after first giving the institution’s primary regulatory authority an opportunity to take such action. The FDIC may also terminate the deposit insurance of any institution that has engaged in or is engaging in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, order or condition imposed by the FDIC.

In November 2025, the FDIC adopted amendments to Part 363, Annual Independent Audits and Reporting Requirements, that became effective January 1, 2026. Among other changes, the amendments increased the threshold for internal control over financial reporting requirements from $1 billion to $5 billion in consolidated total assets. As a result, the Bank remains subject to the annual audit requirements of Part 363 but is no longer required to comply with certain internal control reporting and auditor attestation provisions of the regulation. The Company will continue to maintain a system of internal controls designed to provide reasonable assurance regarding the reliability of financial reporting and compliance with applicable laws and regulations.

Current Expected Credit Loss Model: In December 2018, the OCC, the Federal Reserve Board, and the FDIC issued a final rule to address regulatory treatment of credit loss allowances under the current expected credit loss (CECL) model. The rule revised the federal banking agencies’ regulatory capital rules to identify which credit loss allowances under the CECL model are eligible for inclusion in regulatory capital and to provide banking organizations the option to phase in over three years the day one adverse effects on regulatory capital that may result from the adoption of the CECL model. The Bank adopted the CECL model on July 1, 2023 since it’s a smaller reporting company and elected to phase in the day-one effect of adopting CECL for regulatory capital purposes.

Risk-Based Capital Requirements: The Federal Reserve Board and the OCC employ similar risk-based capital guidelines in their examination and regulation of bank holding companies and national banks, respectively. The Company meets the definition of a Small Bank Holding Company and, therefore, was exempt from maintaining consolidated regulatory capital ratios. Instead, regulatory capital ratios only apply at the subsidiary bank level. The guidelines involve a process of assigning various risk weights to different classes of assets, then evaluating the sum of the risk-weighted balance sheet structure against the capital base. If capital falls below the minimum levels established by the guidelines, the bank holding company or bank may be denied approval to acquire or establish additional banks or non-bank businesses or to open new facilities. In addition, failure to satisfy capital guidelines could subject a banking institution to a variety of enforcement actions by federal bank regulatory authorities, including the termination of deposit insurance by the FDIC and a prohibition on the acceptance of “brokered deposits.”

5

Effective January 1, 2020, qualifying community banking organizations may elect to comply with a greater than 9% community bank leverage ratio (CBLR) requirement in lieu of the currently applicable requirements for calculating and reporting risk-based capital ratios. The CBLR is equal to Tier 1 capital divided by average total consolidated assets. In order to qualify for the CBLR election, a community bank must (i) have a leverage capital ratio greater than 9 percent, (ii) have less than $10 billion in average total consolidated assets, (iii) not exceed certain levels of off-balance sheet exposure and trading assets plus trading liabilities and (iv) not be an advanced approaches banking organization. A community bank that meets the above qualifications and elects to utilize the CBLR is considered to have satisfied the risk-based and leverage capital requirements in the generally applicable capital rules and is also considered to be "well capitalized" under the prompt corrective action rules. As of June 30, 2026, the Bank had not elected to be subject to the CBLR. Effective July 1, 2026, the leverage capital ratio minimum requirement needed to qualify for the CBLR election was lowered to 8%, and management intends to elect the CBLR framework effective September 30, 2026. Based on the Company's capital levels and other qualifying criteria, management believes the Bank will qualify for the CBLR framework upon election.

Unless a community bank qualifies for and elects to comply with the CBLR, national banks are required to maintain the Basel III minimum levels of regulatory capital. The Basel III capital requirements for U.S. banking organizations became effective on January 1, 2015 and were fully phased in by January 1, 2019. Under Basel III, the Bank is required to maintain a minimum common equity Tier 1 capital ratio of 4.5%, a Tier 1 capital ratio of 6%, a total capital ratio of 8%, and a Tier 1 leverage ratio of 4%. Basel III also established a “capital conservation buffer” of 2.5% above the new regulatory minimum capital requirements, which effectively resulted in a minimum common equity Tier 1 capital ratio of 7%, a Tier 1 capital ratio of 8.5%, a total capital ratio of 10.5% and a Tier 1 leverage ratio of 6.5%. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a common equity Tier 1 ratio to risk-weighted assets above the minimum but below the conservation buffer will face constraints on dividends, equity repurchases, and compensation based on the amount of the shortfall.

The OCC and the FDIC may take various corrective actions against any undercapitalized bank and any bank that fails to submit an acceptable capital restoration plan or fails to implement a plan accepted by the OCC or the FDIC. These powers include, but are not limited to, requiring the institution to be recapitalized, prohibiting asset growth, restricting interest rates paid, requiring prior approval of capital distributions by any bank holding company that controls the institution, requiring divestiture by the institution of its subsidiaries or by the holding company of the institution itself, requiring new election of directors, and requiring the dismissal of directors and officers. The OCC’s final supervisory judgment concerning an institution’s capital adequacy could differ significantly from the conclusions that might be derived from the absolute level of an institution’s risk-based capital ratios. Therefore, institutions generally are expected to maintain risk-based capital ratios that exceed the minimum ratios. As of June 30, 2026, the Bank exceeded minimum regulatory capital requirements to be considered well-capitalized.

Dodd-Frank Wall Street Reform and Consumer Protection Act: The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) established the Consumer Financial Protection Bureau (CFPB), which regulates consumer financial products and services and certain financial services providers. The CFPB is authorized to prevent unfair, deceptive, and abusive acts or practices and seeks to ensure consistent enforcement of laws so that consumers have access to fair, transparent, and competitive markets for consumer financial products and services. Since it was established the CFPB has exercised extensive rulemaking and interpretive authority.

Interstate Banking and Branching: The Interstate Banking and Branch Efficiency Act of 1995 has eased restrictions on interstate expansion and consolidation of banking operations by, among other things: (i) permitting interstate bank acquisitions regardless of host state laws, (ii) permitting interstate merger of banks unless specific states have opted out of this provision, and (iii) permitting banks to establish new branches outside the state provided the law of the host state specifically allows interstate bank branching.

Community Reinvestment Act: The Community Reinvestment Act (CRA) requires depository institutions to assist in meeting the credit needs of their market areas, including low- and moderate-income areas, consistent with safe and sound banking practices. Under this Act, each institution is required to adopt a statement for each of its market areas describing the depository institution’s efforts to assist in its community’s credit needs. Depository institutions are periodically examined for compliance and assigned ratings. Banking regulators consider these ratings when considering approval of a proposed transaction by an institution. The Bank’s most recent CRA rating is satisfactory.

USA PATRIOT Act: In 2001, Congress enacted the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (Patriot Act). The Patriot Act is designed to deny terrorists and criminals the ability to obtain access to the United States’ financial system and has significant implications for depository institutions, brokers, dealers, and other businesses involved in the transfer of money. The Patriot Act mandates that financial services companies implement additional policies and procedures with respect to additional measures designed to address any or all the following matters: money laundering, terrorist financing, identifying, and reporting suspicious activities and currency transactions, and currency crimes.

6

The Anit-Money Laundering Act: In 2021, Congress enacted the Anti-Money Laundering Act of 2020 (AMLA), which amended the Bank Secrecy Act of 1970 (BSA). The AMLA is intended to be a comprehensive reform and modernization to U.S. bank secrecy and anti-money laundering laws. Among other things, the AMLA codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the development of standards for evaluating technology and internal processes for BSA compliance; expands enforcement-related and investigation-related authority, including increasing available sanctions for certain BSA violations and instituting BSA whistleblower initiatives and protections.

Office of Foreign Assets Control Regulation: The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) administers and enforces economic and trade sanctions against targeted foreign countries and regimes, under authority of various laws, including designated foreign countries, nationals, and others. OFAC publishes lists of specially designated targets and countries. We are responsible for, among other things, blocking accounts of, and transactions with, such targets and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence. Failure to comply with these sanctions could have serious financial, legal, and reputational consequences, including applicable bank regulatory authorities not approving merger or acquisition transactions when regulatory approval is required or prohibiting such transactions even if approval is not required. Regulatory authorities have imposed cease and desist orders and civil money penalties against institutions found to be violating these obligations.

Cybersecurity: In March 2015, federal regulators issued two related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption, and maintenance of the institution’s operations after a cyberattack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyberattack.

In February 2018, the SEC published interpretive guidance to assist public companies in preparing disclosures about cybersecurity risks and incidents. These SEC guidelines are in addition to notification and disclosure requirements under state and federal banking law and regulations. In addition, in July 2023, the SEC issued a final rule that requires disclosure of material cybersecurity incidents, as well as cybersecurity risk management, strategy and governance. Under this rule, banking organizations that are SEC registrants must disclose information about any material cybersecurity incident within four business days of determining whether such incident is material and provide periodic updates as to the status of the incident in subsequent filings as necessary.

In November 2021, the OCC, the FRB and the FDIC issued a final rule, which became effective in May 2022, requiring banking organizations that experience a computer-security incident to notify certain entities. A computer-security incident occurs when actual or potential harm to the confidentiality, integrity, or availability of an information system or the information occurs, or there is a violation or imminent threat of a violation to banking security policies and procedures. The affected bank must notify its respective federal regulator of the computer-security incident as soon as possible and no later than 36 hours after the bank determines a computer-security incident that rises to the level of a notification event has occurred. These notifications are intended to promote early awareness of threats to banking organizations and will help banks react to those threats before they manifest into larger incidents. This rule also requires bank service providers to notify their bank organization customers of a computer-security incident that has caused, or is reasonably likely to cause, a material service disruption or degradation.

Furthermore, once administrative rules are adopted by the Cybersecurity & Infrastructure Security Agency (CISA), the Cyber Incident Reporting for Critical Infrastructure Act enacted in March 2022, will require certain covered entities, including those in the financial services industry, to report a covered cyber incident to CISA within 72 hours once the covered entity reasonably believes an incident has occurred. Separate reporting to CISA will also be required within 24 hours if a ransom payment is made as a result of a ransomware attack.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and many states have also recently implemented or modified their data breach notification, information security and data privacy requirements. We expect this trend of state-level activity in those areas to continue and we are monitoring developments in the states in which our customers are located.

Environmental Regulation: Compliance with federal, state, and local provisions regulating the discharge of materials into the environment, or otherwise relating to the protection of the environment, has not had a material effect upon the capital expenditures, earnings, or competitive position of the Company. In the opinion of management, the Company does not have exposure to material costs associated with compliance with environmental laws and regulations or material expenditures related to environmental hazardous waste mitigation or cleanup.

7

The Company believes its primary exposure to environmental risk is through the lending activities of the Bank. In cases where management believes environmental risk potentially exists, we mitigate our environmental risk exposure by requiring environmental site assessments at the time of loan origination to confirm collateral quality as to commercial real estate parcels posing higher than normal potential for environmental impact, as determined by reference to present and past uses of the subject property and adjacent sites. In addition, environmental assessments are typically required prior to any foreclosure activity involving non-residential real estate collateral.

Government Monetary Policy: The earnings of the Company are affected by general and local economic conditions and by the policies of various governmental regulatory authorities. In particular, the Federal Reserve Board regulates money and credit conditions and interest rates to influence general economic conditions, primarily through open market acquisitions or dispositions of United States Government securities, varying the discount rate on member bank borrowings and setting reserve requirements against member and nonmember bank deposits. Federal Reserve Board monetary policies have had a significant effect on the interest income and interest expense of commercial banks, including the Bank, and are expected to continue to do so in the future.

Executive and Incentive Compensation: Under the Dodd-Frank Act and rules adopted by the SEC in October 2022, public companies listed on the New York Stock Exchange or Nasdaq Stock Market are now required to adopt and implement “clawback” policies for incentive compensation payments and to disclose the details of the procedures for recovery of incentive compensation that was paid on the basis of erroneous financial information necessitating an accounting restatement due to material noncompliance with financial reporting requirements. Such clawback policies are intended to apply to compensation paid within the three completed fiscal years immediately preceding the date the issuer is required to prepare a restatement and would cover all executives (including former executives) who received incentive awards. The Company is not listed on the New York Stock Exchange or Nasdaq Stock Market and, therefore, not required to adopt a clawback policy. However, the Company implemented a clawback policy on December 13, 2018, which was further revised and adopted by the Compensation Committee of the Company’s Board of Directors effective March 12, 2024.

Employees

As of June 30, 2026, the Bank employed 190 full-time and 11 part-time employees. None of the employees are represented by a collective bargaining group. Management considers its relations with employees to be good.

Available Information

The Company files annual, quarterly, and current reports, proxy statements, and other information with the SEC. The SEC maintains a website at www.sec.gov that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC. We file electronically with the SEC.

The Company’s reports on Forms 10-K, 10-Q and 8-K, and amendments to those reports, are available, free of charge, on our website (www.consumers.bank) as soon as reasonably practicable after such reports are filed with or furnished to the SEC. The Company’s Code of Ethics Policy, which is applicable to all directors, officers and employees of the Company, and its Code of Ethics for Principal Financial Officers, which is applicable to the principal executive officer and the principal financial officer, are each available on the Investor Relations section under Corporate Governance of the Company’s website. The Company intends to post amendments to or waivers from either of its Code of Ethics Policies on its website. A printed copy of any of these documents will be provided to any requesting shareholder.