NASDAQ: CVBF

The principal executive offices of CVB and the Bank are located at 701 North Haven Avenue, Suite 350, Ontario, California. Our phone number is (909) 980-4030.

Citizens Business Bank, National Association

The Bank commenced operations on August 9, 1974. Effective December 15, 2025, the Bank converted from a California-chartered bank to a national banking association chartered under the laws of the United States. The Bank is a member of the Federal Reserve System and of the Federal Home Loan Bank of San Francisco (“FHLB”), which is a member bank of the Federal Home Loan Bank System. The Bank’s deposit accounts are insured under the Federal Deposit Insurance Act up to maximum amount currently allowable under federal law. The Bank is currently subject to the examination and regulation by the Office of the Comptroller of the Currency (the “OCC”) and the Federal Deposit Insurance Corporation (“FDIC”).

At December 31, 2025, the Bank had $15.63 billion in assets, $8.62 billion in net loans, $12.13 billion in deposits, and $2.27 billion in total equity.

As of December 31, 2025, the Bank had 62 Banking Centers (“Centers”) and one loan production office located throughout California. We also have three trust offices located in Ontario, Newport Beach, and Pasadena. These offices serve as sales offices for the Bank’s wealth management, trust and investment products.

The Bank's goal is to be the premier financial services company operating throughout the state of California, servicing the comprehensive financial needs of successful small-and medium-sized businesses and their owners. Through our network of Centers, we emphasize personalized service combined with a wide array of banking and trust services for businesses, professionals and individuals located in the service areas of our Centers. Although we focus the marketing of our services to small-and medium-sized businesses, a wide range of banking, investment and trust services are made available to the markets we serve.

We offer a wide range of bank deposit instruments. These include checking, savings, money market and certificates of time deposit for both business and personal accounts, municipalities and districts, and specialized deposit products for title and escrow. We also serve as a federal tax depository for our business customers.

3

We provide a full complement of lending products, including commercial, agribusiness, consumer, SBA, real estate, and construction loans, as well as equipment and vehicle leasing. Commercial products include lines of credit and other working capital financing, accounts receivable lending and letters of credit. Agribusiness products are loans to finance the operating needs of wholesale dairy farm operations, cattle feeders, livestock raisers, and farmers. We provide bank qualified lease financing for municipal governments. Commercial real estate and construction loans are secured by a range of property types and include both owner-occupied and investor owned properties. We also offer borrowers the ability to enter into interest rate swaps. Financing products for consumers include automobile leasing and financing, lines of credit, credit cards, home mortgages, and home equity loans and lines of credit.

We also offer a wide range of specialized services designed for the needs of our commercial customers. These services include treasury management systems for monitoring and managing cash flow, a merchant card processing program, armored pick-up and delivery, payroll services, remote deposit capture, electronic funds transfers, domestic and international wires and automated clearinghouse, on-line account access, and international business activities including foreign exchange and letters of credit for international trade. We make available investment products offered by other providers to our customers, including mutual funds, a full array of fixed income vehicles and a program to diversify our customers’ funds in federally insured time certificates of deposit of other institutions.

In addition, we offer a wide range of financial services and trust services through our CitizensTrust division. These services include fiduciary services, mutual funds, annuities, 401(k) plans and individual investment accounts.

Pending Acquisition

On December 17, 2025, the Company entered into an Agreement and Plan of Merger (the “Merger Agreement”) with Heritage Commerce Corp. In accordance with the terms and conditions set forth in the Merger Agreement, Heritage will merge with and into the Company in an all-stock transaction, with the Company continuing as the surviving corporation. Promptly following the Merger, Heritage Bank of Commerce, a California banking corporation and wholly-owned subsidiary of Heritage will merge with and into CBB, with CBB continuing as the surviving bank (the “Bank Merger”).

Under the terms of the Merger Agreement, Heritage shareholders will receive 0.65 shares of the Company’s common stock for each share of Heritage common stock they own. Upon closing, CVB shareholders will own approximately 77% and Heritage shareholders will own approximately 23% of the combined company. The combined company will have approximately $22 billion in assets, more than 80 centers and offices, and a deeply rooted presence in the State of California’s key economic centers. The acquisition is presently expected to close in the second quarter of 2026, subject to satisfaction of regulatory approvals, Heritage and CVB shareholder approvals, and other customary closing conditions.

Business Segments

We are a community bank with one reportable operating segment. See Note 3 — Summary of Significant Accounting Policies — Business Segments of the notes to the consolidated financial statements.

Human Capital

We employed 1,079 associates as of December 31, 2025. This was a 1.0% decrease from 1,089 associates at December 31, 2024. Our Code of Personal and Business Conduct and Ethics (“Code”) addresses both business and social relationships that may present legal and ethical concerns and also sets forth a code of conduct to guide the members of the Board of Directors and associates. Our associates acknowledge annually they have read and understood their responsibility to conduct business in accordance with the highest ethical standards in order to merit and maintain the confidence and trust of our customers and the public in general.

The Company promotes Five Core Values that we believe provides a continuing commitment and direction to our business activities and our underlying culture. These core values are fundamental to the Company’s performance and strategy.

Our Five Core Values are:

1) Financial Strength;

2) Superior People;

3) Customer Focus;

4) Cost-Effective Operation; and

5) Having Fun.

4

The Company’s Citizens Experience Service Awards and Recognition Program recognizes associates who exemplifying our Five Core Values. In addition, the Company has a long held tradition of an annual awards program that recognizes outstanding job performance. Our 2025 annual awards ceremony recognized 38 associates, who stood out for their commitment to our high standards of performance.

The Company is committed to supporting the physical and financial wellness of our associates and their families. We offer a comprehensive set of health insurance and retirement benefits, as well as wellness programs and resources. As of December 2025, 72% of our associates were enrolled in our medical insurance plans and 81% of our associates participated in at least one wellness activity during 2025. In addition, the Company makes an annual 401(k) retirement contribution to all eligible associates, which includes a profit sharing component. In 2025, the combined Company 401(k) contribution was 5% of associate’s eligible salary and 92% of our associates made individual participant contributions to the 401(k) plan during 2025.

Recruiting, training and development, and retention of key associates is vital to the Company’s strategy and success. The Company promotes leadership and associate development through various programs, including succession planning, top talent program, and leadership essentials training. At December 31, 2025, we had 129 positions within the Company designated as “leadership” positions. This represents approximately 12% of our total associates. The average tenure at the Company among our leadership group at the end of 2025 was greater than 10 years. In 2025, turnover among our leadership group was 10% and during the year we promoted 3 associates and hired 3 new associates into our leadership group.

The Company’s Development and Engagement Program is designed to invest in the professional development of our associates and increase workplace engagement. We strive to reward talent, with a commitment to equal opportunity. Oversight is provided by the Company’s Engagement Committee, which is guided by our Five Core Values and various policies that support a framework which we use to create and strengthen our associate engagement and well-being, as well as sound procurement and business practices. The Engagement Committee is co-chaired by our Chief Operating Officer and Human Resources Director and includes our Chief Financial Officer, Chief Risk Officer, and General Counsel. The Company's Engagement Council was established to continue our commitment to associate engagement, as well as fostering, cultivating, and preserving a culture of diversity and inclusion. The Council is led by our Director of Human Resources and the Associate Engagement Manager, as well as an additional member of our Senior Leadership team. Members of the Council represent a cross section of our associates across numerous departments. The Council discusses ways to promote engagement among associates and serve as ambassadors when it comes to implementing our Core Values. We monitor diversity throughout our organization, including the percentage of our total associates who are female and racially or ethnically diverse. The following represents the Company’s diversity at December 31, 2025:

In addition, 33% of our Board of Directors are female or ethnically diverse.

5

The Board of Directors oversees executive compensation, as well as the Company’s compensation and benefit plans, through the Board’s Compensation Committee. The Management Compensation Compliance Committee, under the direction of the Compensation Committee, identifies, assesses, and manages exposure to and compliance with applicable compensation laws, regulations, and other related issues. In general, the Management Compensation Compliance Committee is responsible for ensuring that the Company has designed and implemented risk management processes that (1) evaluate the nature of inherent risks in compensation programs; (2) are consistent with the Company’s strategic plan; and (3) foster a culture of risk-awareness and risk-adjusted decision making throughout the Company. All of our associates are eligible for incentive compensation awards. In 2025, 95% of our associates earned an incentive bonus, which compares to 92% in 2024.

Competition

The banking and financial services business is highly competitive. The competitive environment faced by banks is a result primarily of changes in laws and regulations, changes in technology and product delivery systems, and the ongoing consolidation among insured financial institutions. We compete for loans, deposits, and customers with other commercial banks, savings and loan associations, savings banks, securities and brokerage companies, mortgage companies, insurance companies, finance companies, money market funds, credit unions, and other nonbank financial service providers, including online banks and “peer-to-peer” or “marketplace” payment processors, FinTech companies, lenders and other small business and consumer lenders. Many competitors are much larger in total assets and capitalization, have greater access to capital markets and/or offer a broader range of financial products and services. Additionally, some smaller competitors, including non-bank entities, may be more nimble and responsive to customer preferences or requirements.

Economic Conditions/Government Policies

Our profitability, like most financial institutions, is primarily dependent on interest rate spreads and noninterest income. In general, the difference between the interest rates paid by the Bank on interest-bearing liabilities, such as deposits and borrowings, and the interest rates received by the Bank on interest-earning assets, such as loans extended to customers and securities held in the investment portfolio, will comprise the major portion of our earnings. These rates are highly sensitive to many factors that are beyond our control, such as inflation, recession and unemployment, government fiscal and monetary and other policies, and the impact which future changes in domestic and foreign economic conditions might have on us cannot be predicted.

Opportunity for banks to earn fees and other noninterest income have also been limited by restrictions imposed by the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”) and other government regulations. As the following sections indicate, the impact of current and future changes in government laws and regulations on our ability to maintain current levels of fees and other noninterest income could be material and cannot be predicted.

Our business is also influenced by the monetary and fiscal policies of the federal government and the policies of regulatory agencies, particularly the Federal Reserve. The Federal Reserve implements national monetary policies (with objectives such as curbing inflation, increasing employment and combating recession) through its open-market operations in U.S. Government securities by buying and selling treasury and mortgage-backed securities, by adjusting the required level of reserves for depository institutions subject to its reserve requirements, and by varying the target federal funds and discount rates applicable to borrowings by depository institutions. The actions of the Federal Reserve in these areas influence the growth and performance of bank loans, investments, and deposits and also affect interest earned on interest-earning assets and paid on interest-bearing liabilities. Recent actions by the Federal Reserve have impacted deposits due to expansion and contraction of the money supply. Government fiscal and budgetary policies, including deficit spending, can also have a significant impact on the capital markets and interest rates. The nature and impact of any future changes in monetary and fiscal policies on us cannot be predicted.

6

Regulation and Supervision

General

The Company and the Bank are subject to significant regulation and restrictions under applicable federal and state laws and by various regulatory agencies. These regulations and restrictions are intended primarily for the protection of depositors and the Federal Deposit Insurance Corporation (“FDIC”) Deposit Insurance Fund (“DIF”) and secondarily for the stability of the U.S. banking system. The following discussion of statutes and regulations is a summary and does not purport to be complete nor does it address all applicable statutes and regulations. This discussion is qualified in its entirety by reference to the statutes and regulations referred to in this discussion. From time to time, federal and state legislation is enacted and implemented by regulations which may have the effect of materially increasing the cost of doing business, limiting or expanding permissible activities, or affecting the competitive balance between banks and other financial services providers. Following the Bank’s December 15, 2025 conversion from a California state depository institution to a national bank, the Bank’s primary federal regulator became the OCC.

We cannot predict whether or when other legislation or new regulations may be enacted, and if enacted, the effect that new legislation or any implemented regulations and supervisory policies would have on our financial condition and results of operations. Such developments may further alter the structure, regulation, and competitive relationship among financial institutions, may limit the types or pricing of the products and services we offer, and may subject us to increased regulation, disclosure, and reporting requirements. We also cannot predict whether or when regulatory requirements may be reduced or eliminated and the overall affect such reduction or elimination may have on the Company and the Bank.

Legislation and Regulatory Developments

Federal banking agencies have authority to issue regulations and guidelines to ensure safety and soundness of banks and the stability of the U.S. banking system. Changes in administration can influence regulatory priorities, including rulemaking, supervision, examination and enforcement. While future changes may occur, the scope and impact of such changes cannot currently be determined.

Capital Adequacy Requirements

Bank holding companies and banks are subject to similar regulatory capital requirements administered by the Federal Reserve and, in the case of national banks, the OCC. The risk-based capital guidelines for bank holding companies, and additionally for banks, require capital ratios that vary based on the perceived degree of risk associated with a banking organization’s operations, both for transactions reported on the balance sheet as assets, such as loans, and for those recorded as off-balance sheet items, such as loan commitments, letters of credit and recourse arrangements. The risk-based capital ratio is determined by classifying assets and certain off-balance sheet financial instruments into weighted categories, with higher levels of capital being required for those categories perceived as representing greater risks, and with the applicable ratios calculated by dividing qualifying capital by total risk-adjusted assets and off-balance sheet items. Capital amounts and classifications are also subject to qualitative judgments by regulators about components, risk weighting and other factors. Bank holding companies and banks engaged in significant trading activity may also be subject to the market risk capital guidelines and be required to incorporate additional market and interest rate risk components into their risk-based capital standards. Bank holding companies are also required to act as a source of financial strength to their subsidiary banks. Under this policy, the Company must commit resources to support the Bank even when the Company may not be in a financial position to provide it. The Federal Reserve monitors our capital adequacy on a consolidated basis, and the OCC primarily monitors the capital adequacy of our Bank.

Regulatory Capital and Risk-weighted Assets

The capital adequacy rules implement the Basel III international regulatory capital standards in the United States, as well as certain provisions of the Dodd-Frank Act. These quantitative calculations are minimums, and the Federal Reserve, OCC or FDIC may determine that a banking organization, based on its size, complexity or risk profile, must maintain a higher level of capital in order to operate in a safe and sound manner.

Under the Basel III Capital Rules, the Company’s and the Bank’s assets, exposures and certain off-balance sheet items are subject to risk weights used to determine the institutions’ risk-weighted assets. These risk-weighted assets are used to calculate the following minimum capital ratios for the Company and the Bank:

•
Tier 1 Leverage Ratio, equal to the ratio of Tier 1 capital to quarterly average assets (net of goodwill, certain other intangible assets and certain other deductions).

7

•
CET1 Risk-Based Capital Ratio, equal to the ratio of CET1 capital to risk-weighted assets. CET1 capital primarily includes common stockholders’ equity subject to certain regulatory adjustments and deductions, including with respect to goodwill, intangible assets and certain deferred tax assets. Because we are not an advanced approach banking organization, we were permitted to make a one-time permanent election to exclude accumulated other comprehensive income items from regulatory capital. We made this election in order to avoid significant variations in our levels of capital depending upon the impact of interest rate fluctuations on the fair value of our Bank’s available-for-sale securities portfolio.

•
Tier 1 Risk-Based Capital Ratio, equal to the ratio of Tier 1 capital to risk-weighted assets. Tier 1 capital is primarily comprised of CET1 capital, perpetual preferred stock and certain qualifying capital instruments.

•
Total Risk-Based Capital Ratio, equal to the ratio of total capital, including CET1 capital, Tier 1 capital and Tier 2 capital, to risk-weighted assets. Tier 2 capital primarily includes qualifying subordinated debt and qualifying allowance for credit losses. Tier 2 capital also includes, among other things, certain trust preferred securities.

The total minimum regulatory capital ratios and well-capitalized minimum ratios are reflected elsewhere in this document. For purposes of the Federal Reserve’s Regulation Y, including determining whether a bank holding company meets the requirements to be a financial holding company, bank holding companies, such as the Company, must maintain a Tier 1 Risk-Based Capital Ratio of 6.0% or greater and a Total Risk-Based Capital Ratio of 10.0% or greater.

Failure to be well-capitalized or to meet minimum capital requirements could result in certain mandatory and possible additional discretionary actions by regulators that, if undertaken, could have a material adverse effect on our operations or financial condition. Failure to be well-capitalized or to meet minimum capital requirements could also result in restrictions on the Company’s or the Bank’s ability to pay dividends or otherwise distribute capital or obtain regulatory approvals.

In addition to meeting the minimum capital requirements, under the Basel III Capital Rules, the Company and the Bank must also maintain the required Capital Conservation Buffer to avoid becoming subject to restrictions on capital distributions and certain discretionary bonus payments to management. The Capital Conservation Buffer is calculated as a ratio of CET1 capital to risk-weighted assets, and it effectively increases the required minimum risk-based capital ratios. The Capital Conservation Buffer is now at its fully phased-in level of 2.5%.

The Tier 1 Leverage Ratio is not impacted by the Capital Conservation Buffer, and a banking institution may be considered well-capitalized while remaining out of compliance with the Capital Conservation Buffer.

The table below summarizes the capital requirements that the Company and the Bank must satisfy to avoid limitations on capital distributions and certain discretionary bonus payments (i.e., the required minimum capital ratios plus the Capital Conservation Buffer):

Minimum Basel III Regulatory

Capital Ratio Plus Capital

Conservation Buffer

Effective January 1, 2019

CET1 risk-based capital ratio

7.0

%

Tier 1 risk-based capital ratio

8.5

%

Total risk-based capital ratio

10.5

%

As permitted by Basel III, the Company and the Bank have elected to opt-out of the requirement to include accumulated other comprehensive income in 2015. As of December 31, 2025 the Company and the Bank are well-capitalized for regulatory purposes. For a tabular presentation of the Company’s and Bank’s capital ratios as of December 31, 2025, see Note 16 — Regulatory Matters of the notes to the consolidated financial statements.

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms (the standards are commonly referred to as “Basel IV”). Among other things, these standards revise the Basel Committee’s standardized approach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain “unconditionally cancellable commitments,” such as unused credit card lines of credit) and provides a new standardized approach for operational risk capital. Under the Basel framework, as amended, these standards were effective on January 1, 2023, with an aggregate output floor phasing in through January 1, 2028. Under the current U.S. capital rules, operational risk capital requirements and a capital floor apply only to advanced approaches institutions, and not to the Company and the Bank.

8

In July, 2023, the FRB, OCC and FDIC proposed significant changes to the Basel III capital rules which replaces the advanced approaches risk-weighted assets framework with a new enhanced risk-based framework and requires banking organizations with generally more than $100 billion in assets to calculate their regulatory capital using more enhanced requirements applicable to even larger organizations. The impact of any changes to capital requirements and calculations and the implementation of Basel IV on us will depend on the manner in which it is implemented by the federal bank regulators with respect to smaller-sized institutions.

Prompt Corrective Action Provisions

The Federal Deposit Insurance Act requires the federal bank regulatory agencies to take “prompt corrective action” with respect to a depository institution if that institution does not meet certain capital adequacy standards, including requiring the prompt submission of an acceptable capital restoration plan. Depending on the bank’s capital ratios, the agencies’ regulations define five categories in which an insured depository institution will be placed: well-capitalized, adequately capitalized, undercapitalized, significantly undercapitalized, and critically undercapitalized. At each successive lower capital category, an insured bank is subject to more restrictions, including restrictions on the bank’s activities, operational practices or the ability to pay dividends or executive bonuses. Based upon its capital levels, a bank that is classified as well-capitalized, adequately capitalized, or undercapitalized may be treated as though it were in the next lower capital category if the appropriate federal banking agency, after notice and opportunity for hearing, determines that an unsafe or unsound condition, or an unsafe or unsound practice, warrants such treatment.

The prompt corrective action standards were changed to conform with the new capital rules. Under the new standards, in order to be considered well-capitalized, the bank will be required to meet the new common equity Tier 1 ratio of 6.5%, an increased Tier 1 ratio of 8% (increased from 6%), a total capital ratio of 10% (unchanged) and a leverage ratio of 5% (unchanged).

The federal banking agencies also may require banks and bank holding companies subject to enforcement actions to maintain capital ratios in excess of the minimum ratios otherwise required to be deemed well capitalized, in which case institutions may no longer be deemed to be well capitalized and may therefore be subject to certain restrictions such as obtaining new brokered deposits.

Volcker Rule

In December 2013, the federal bank regulatory agencies adopted final rules that implement a part of the Dodd-Frank Act commonly referred to as the “Volcker Rule.” Under these rules and subject to certain exceptions, banking entities are restricted from engaging in activities that are considered proprietary trading and from sponsoring or investing in certain entities, including hedge or private equity funds that are considered “covered funds.” These rules became effective on April 1, 2014, although certain provisions are subject to delayed effectiveness under rules promulgated by the FRB. In 2020, the OCC, Federal Reserve, FDIC, SEC, and Commodity Futures Trading Commission finalized further amendments to the Volcker Rule. The amendments include new exclusions from the Volcker Rule’s general prohibitions on banking entities investing in and sponsoring private equity funds, hedge funds, and certain other investment vehicles (collectively “covered funds”). The amendments in the final rule, which became effective on October 1, 2020, clarify and expand permissible banking activities and relationships under the Volcker Rule. The Company held small investment positions in three financial technology private equity funds at December 31, 2025, with aggregate potential commitments in such funds of approximately $5 million, which were subject to the final rule. While these rules may require us to conduct certain internal analysis and reporting to ensure continued compliance, they did not require any material changes in our operations or business.

Brokered Deposits

The FDIC limits the ability to accept brokered deposits to those insured depository institutions that are well capitalized. Institutions that are less than well capitalized cannot accept, renew or roll over any brokered deposit unless they have applied for and been granted a waiver by the FDIC. As of December 31, 2025, the Bank had $300 million of deposit liabilities categorized as brokered deposits.

Bank Holding Company Regulation

Bank holding companies and their subsidiaries are subject to significant regulation and restrictions by Federal and State laws and regulatory agencies, which may affect the cost of doing business, and may limit permissible activities and expansion or impact the competitive balance between banks and other financial services providers.

9

A wide range of requirements and restrictions are contained in both federal and state banking laws, which together with implementing regulatory authority:

•
Require periodic reports and such additional reports of information as the Federal Reserve may specify;

•
Require bank holding companies to meet or exceed increased levels of capital (See “Capital Adequacy Requirements”);

•
Require that bank holding companies serve as a source of financial and managerial strength to subsidiary banks and commit resources as necessary to support each subsidiary bank;

•
Limit dividends (or other distributions) payable to shareholders and restrict the ability of bank holding companies to obtain dividends or other distributions from their subsidiary banks. The Company’s ability to pay dividends is subject to legal and regulatory restrictions. Substantially all of CVB’s funds to pay dividends or to pay principal and interest on our debt obligations are derived from dividends paid by the Bank to CVB which are also subject to regulatory restrictions primarily from the OCC;

•

•
Require a bank holding company to terminate an activity or terminate control of or liquidate or divest certain subsidiaries, affiliates or investments if the Federal Reserve believes the activity or the control of the subsidiary or affiliate constitutes a significant risk to the financial safety, soundness or stability of any bank subsidiary;

•
Require the prior approval of senior executive officer or director changes and prohibit golden parachute payments, including change in control agreements, or new employment agreements with such payment terms, which are contingent upon termination if an institution is in “troubled condition”;

•
Regulate provisions of certain bank holding company debt, including the authority to impose interest ceilings and reserve requirements on such debt and require prior approval to purchase or redeem securities in certain situations;

•
Require prior approval for the acquisition of 5% or more of the voting stock of a bank or bank holding company by bank holding companies or other acquisitions and mergers with banks and consider certain competitive, management, financial, anti-money-laundering compliance, potential impact on U.S. financial stability or other factors in granting these approvals, in addition to similar California or other state banking agency approvals which may also be required; and

•
Require prior notice and/or prior approval of the acquisition of control of a bank or a bank holding company by a shareholder or individuals acting in concert with ownership or control of certain percentage thresholds of the voting stock being a presumption of control.

Change in Bank Control

Federal law and regulation set forth the types of transactions that require prior notice under the Change in Bank Control Act (“CIBCA”). Pursuant to CIBCA and Regulation Y, any person (acting directly or indirectly) that seeks to acquire control of a bank or its holding company must provide prior notice to the Federal Reserve. A “person” for this purpose includes an individual, bank, corporation, partnership, trust, association, joint venture, pool, syndicate, sole proprietorship, unincorporated organization, or any other form of entity. A person acquires “control” of a banking organization whenever the person acquires ownership, control, or the power to vote 25 percent or more of any class of voting securities of the institution. The applicable regulations also provide for certain other “rebuttable” presumptions of control.

In April 2020, the Federal Reserve adopted a final rule to revise its regulations related to determinations of whether a company has the ability to exercise a controlling influence over another company for purposes of the BHCA. The final rule expands and codifies the presumptions for use in such determinations. By codifying the presumptions, the final rule provides greater transparency on the types of relationships that the Federal Reserve generally views as supporting a facts-and-circumstances determination that one company controls another company. The Federal Reserve’s final rule applies to questions of control under the BHCA, but it does not extend to CIBCA or other applicable provisions of state or federal law.

10

Other Restrictions on the Company’s Activities

Subject to prior notice or Federal Reserve approval, bank holding companies may generally engage in, or acquire shares of companies engaged in activities determined by the Federal Reserve to be so closely related to banking or managing or controlling banks as to be a proper incident thereto. Bank holding companies which elect and retain “financial holding company” status pursuant to the Gramm-Leach-Bliley Act of 1999 (“GLBA”) may engage in these nonbanking activities and broader securities, insurance, merchant banking and other activities that are determined to be “financial in nature” or are incidental or complementary to activities that are financial in nature without prior Federal Reserve approval. Pursuant to GLBA and Dodd-Frank, in order to elect and retain financial holding company status, a bank holding company and all depository institution subsidiaries of a bank holding company must be considered well capitalized and well managed, and, except in limited circumstances, depository subsidiaries must be in satisfactory compliance with the Community Reinvestment Act (“CRA”), which requires banks to help meet the credit needs of the communities in which they operate. Failure to sustain compliance with these requirements or correct any non-compliance within a fixed time period could lead to divestiture of subsidiary banks or require all activities to conform to those permissible for a bank holding company. CVB has not elected financial holding company status and neither CVB nor the Bank has engaged in any activities determined by the Federal Reserve to be “financial in nature” or incidental or complementary to activities that are “financial in nature.”

Securities Exchange Act of 1934

CVB’s common stock is publicly held and listed on the NASDAQ Stock Market (“NASDAQ”), and CVB is subject to the periodic reporting, information, proxy solicitation, insider trading, corporate governance and other requirements and restrictions of the Securities Exchange Act of 1934 and the regulations of the Securities and Exchange Commission (“SEC”) promulgated thereunder as well as listing requirements of NASDAQ.

Sarbanes-Oxley Act

The Company is subject to the accounting oversight and corporate governance requirements of the Sarbanes-Oxley Act of 2002, including, among other things, required executive certification of financial presentations, requirements for board audit committees and their members, and disclosure of controls and procedures and internal control over financial reporting.

Bank Regulation

On December 15, 2025 the Bank converted from a California state-chartered bank to a national bank association, chartered under the laws of the United States and thereby is subject to the supervision, periodic examination, and regulation by the OCC and must additionally comply with certain applicable regulations of the FDIC and Federal Reserve. Specific federal and state laws and regulations which are applicable to banks regulate, among other things, the scope of their business, their investments, their reserves against deposits, the timing of the availability of deposited funds, their activities relating to dividends, investments, loans, the nature and amount of and collateral for certain loans, servicing and foreclosing on loans, borrowings, capital requirements, certain check-clearing activities, branching, and mergers and acquisitions. The Bank is subject to Federal Reserve Regulation O and Federal Reserve Act Sections 23A and 23B and Regulation W, which restrict or limit loans or extensions of credit to “insiders”, including officers, directors, and principal shareholders, and loans or extension of credit by banks to affiliates or purchases of assets from affiliates, including parent bank holding companies, except pursuant to certain exceptions and only on terms and conditions at least as favorable to those prevailing for comparable transactions with unaffiliated parties. Failure to comply with applicable bank regulations or adverse results from any examinations of the Bank could affect our costs of doing business, and may also limit or impede otherwise permissible activities and expansion activities by the Bank.

The Bank may form subsidiaries to engage in the many so-called “closely related to banking” or “nonbanking” activities in operating subsidiaries or in subsidiaries of bank holding companies and may conduct certain “financial” activities in a “financial subsidiary” as a national bank, provided the bank is and remains “well-capitalized,” “well-managed” and in satisfactory compliance with the CRA, and otherwise complies with the rules and regulations of the OCC. The Bank currently has no financial subsidiaries.

11

FDIC and OCC Enforcement Authority

The federal banking regulatory framework grants the FDIC and OCC broad discretion in connection with their supervisory and enforcement activities and examination policies, including policies with respect to the classification of assets and the establishment of appropriate loan loss reserves for regulatory purposes. The regulatory agencies have adopted guidelines to assist in identifying and addressing potential safety and soundness concerns before an institution’s capital becomes impaired. The guidelines establish operational and managerial standards generally relating to: (1) internal controls, information systems, and internal audit systems; (2) loan documentation; (3) credit underwriting; (4) interest-rate exposure; (5) asset growth and asset quality; and (6) compensation, fees, and benefits. Further, the regulatory agencies have adopted safety and soundness guidelines for asset quality and for evaluating and monitoring earnings to ensure that earnings are sufficient for the maintenance of adequate capital and reserves. If, as a result of an examination, the OCC or the FDIC should determine that the financial condition, capital resources, asset quality, earnings prospects, management, liquidity, or other aspects of the Bank’s operations are unsatisfactory or that the Bank or its management is violating or has violated any law or regulation, the OCC and the FDIC, and separately the FDIC as insurer of the Bank’s deposits, have residual authority to:

•
Require prompt affirmative action to correct any conditions resulting from any violation or practice;

•
Direct an increase in capital and the maintenance of higher specific minimum capital ratios, which could preclude the Bank from being deemed well-capitalized and restrict its ability to accept certain brokered deposits;

•
Restrict the Bank’s growth geographically, by products and services, or by mergers and acquisitions, including bidding in FDIC receiverships for failed banks;

•
Enter into or issue informal or formal enforcement actions, including required Board resolutions, matters requiring board attention, written agreements and consent or cease and desist orders or prompt corrective action orders to take corrective action and cease unsafe and unsound practices;

•
Require prior approval of senior executive officer or director changes; remove officers and directors and assess civil monetary penalties; and

•
Terminate FDIC insurance, revoke the Bank’s charter and/or take possession of and close and liquidate the Bank or appoint the FDIC as receiver.

Mergers and Acquisitions

In 2024, the OCC and FDIC issued policy statements which conveyed a heightened level of scrutiny for bank merger and acquisition activity. Following the election of President Trump, in May 2025 the FDIC rescinded its 2024 policy statement on bank merger review and instead reverted to prior guidance from 1998. Similarly, the OCC issued an interim final rule that rescinded its 2024 policy statement and reinstated regulatory provisions allowing for automatic expedited processing for certain eligible mergers and acquisitions. Subsequently, President Trump executed a resolution, which, among other things, prevents an agency from reissuing a substantially similar rule. Accordingly, with the FDIC and OCC reinstating pre-2024 policies, we believe applicants have a more predictable merger approval path for qualifying transactions. The FRB has not issued new merger and acquisition regulations or policy statements but has recently approved a number of larger acquisitions. The full impact of the election of President Trump on bank mergers and acquisition policy has yet to be fully determined.

In September, 2024, the Department of Justice (“DOJ”) announced that it withdrew its 1995 Bank Merger Guidelines and, instead, for purposes of evaluating the competitive impact of bank mergers, will rely on its 2023 Merger Guidelines which apply to all industries. For banks considering combinations where there may be even a remote possibility of antitrust concerns under the 2023 Merger Guidelines, the DOJ will review “market realities” in analyzing the competitive effects of a particular transaction. While branch deposit concentration may be one area of focus (i.e., traditional Herfindahl Hirschman Index (“HHI”) analysis for deposit concentration utilizing the 2023 Merger Guideline baselines), the DOJ will drill down into the products and services that a bank merger may affect prior to fully assessing the impact of a combination. This type of analysis may involve a more robust review of the competitive landscape (i.e., the impact of credit unions and other non-bank competitors), and a closer analysis of interest rates, types of mortgages and other loans offered, quality of service and convenience at branch locations, the types of customers served, and the unique needs in a particular bank market for bespoke financing.

12

Deposit Insurance

The FDIC is an independent federal agency that insures deposits, up to prescribed statutory limits, of federally insured banks and savings institutions and safeguards the safety and soundness of the banking and savings industries. The FDIC insures our customer deposits through the DIF up to prescribed limits for each depositor. The Dodd-Frank Act revised the FDIC’s DIF management authority by setting requirements for the Designated Reserve Ratio (the “DRR”, calculated as the DIF balance divided by estimated insured deposits) and redefining the assessment base, which is used to calculate banks’ quarterly assessments. The amount of FDIC assessments paid by each DIF member institution is based on its asset size and relative risk of default as measured by regulatory capital ratios and other supervisory factors. The FDIC may terminate a depository institution’s deposit insurance upon a finding that the institution’s financial condition is unsafe or unsound or that the institution has engaged in unsafe or unsound practices that pose a risk to the DIF or that may prejudice the interest of the bank’s depositors. The termination of deposit insurance for a bank would also result in the revocation of the bank’s charter by the OCC.

We are generally unable to control the amount of premiums that we are required to pay for FDIC insurance, which can be affected by the cost of bank failures to the FDIC, among other factors. The FDIC is an independent federal agency that insures deposits through the DIF up to prescribed statutory limits of federally insured banks and savings institutions and safeguards the safety and soundness of the banking and savings industries.

The FDIC has set the target DRR at 2.00%. In October 2022, in order to increase the likelihood that the reserve ratio would be restored to at least 1.35% by the statutory deadline of September 30, 2029, the FDIC increased the initial base deposit insurance assessment rate schedules uniformly by two (2) basis points. The FDIC will, at least semi-annually, update its income and loss projections for the DIF and, if necessary, propose rules to further increase assessment rates.

In addition, in November 2023, the FDIC approved a final rule to implement a special deposit insurance assessment (the “FDIC Special Assessment”) to recover losses to the DIF arising from the protection of uninsured depositors following the receiverships of failed institutions in the spring of 2023. The Company recognized special assessment expense of $9.2 million in the fourth quarter of 2023. In addition, the FDIC retained the ability to make further adjustments to the special assessment depending on subsequent adjustments to the DIF's estimated loss. During 2024, the FDIC revised its loss estimate and projected that the special assessment could be collected beyond its initial eight-quarter collection period. As a result, the Company recorded an additional FDIC Special Assessment charge of $1.6 million during 2024. On December 16, 2025, the FDIC approved a reduction in the special deposit insurance assessment for the eighth quarterly installment and reduced the rate from 3.36 basis points to 2.97 basis points. The Company recorded a reduction of $133,000 of the special assessment expense in 2025.

Any future increases in FDIC insurance premiums may have a material and adverse effect on our earnings and could have a material adverse effect on the value of, or market for, our common stock.

Dividends and Stock Repurchases

It is the Federal Reserve’s policy that bank holding companies should generally pay dividends on common stock only out of net income available over prior four quarters (net of dividends previously paid during such period), and only if prospective earnings retention is consistent with the organization’s expected future capital needs and financial condition. It is also the Federal Reserve’s policy that bank holding companies should not maintain dividend levels that undermine their ability to be a source of strength to its banking subsidiaries. The Federal Reserve also discourages dividend payment ratios that are at maximum allowable levels unless both asset quality and capital are very strong. In addition, a bank holding company may be unable to pay dividends on its common stock if it fails to maintain an adequate capital conservation buffer under current capital rules. There can be no assurance regarding the payment and the amount of dividends that the Company will pay to its shareholders in the future or that the Company will continue to pay dividends to its shareholders at all.

13

The Federal Reserve also maintains a policy that redemptions of instruments included in regulatory capital and repurchases of common stock from investors be consistent with an organization’s current and prospective capital needs. We consult with the Federal Reserve regarding our plans for common stock repurchases. A bank holding company may be required to give the Federal Reserve prior written notice before purchasing or redeeming its equity securities if the gross consideration for the purchase or redemption, when aggregated with the net consideration paid by the bank holding company for all such purchases or redemptions during the preceding 12 months, is equal to 10.00% or more of the bank holding company’s consolidated net worth. The Federal Reserve may disapprove such a purchase or redemption if it determines that the proposal would constitute an unsafe or unsound practice or would violate any law, regulation, Federal Reserve order, or any condition imposed by or written agreement with the Federal Reserve. However, this prior notice requirement does not apply to any bank holding company that meets certain “well-capitalized” and “well-managed” standards and is not the subject of any unresolved supervisory issues.

The Bank is a legal entity that is separate and distinct from its holding company. CVB relies on dividends received from the Bank for use in the operation of the Company and the ability of CVB to pay dividends to shareholders. Future cash dividends by the Bank will also depend upon management’s assessment of future capital requirements, contractual restrictions, and other factors. Current capital rules may restrict dividends by the Bank if the additional capital conservation buffer is not achieved. See “Capital Adequacy Requirements”.

A national bank may not declare any cash dividend in an amount greater than the sum of current period net income and retained earnings. In addition, a national bank also must obtain prior approval from the OCC to pay a cash dividend if the dividend would exceed the sum of current period net income and retained earnings from the past two years, after deducting the following transactions during that period: (i) any dividends previously declared, (ii) extraordinary transfers required by the OCC, and (iii) payments made for the retirement of preferred stock.

A depository institution may not pay any dividend if payment would cause the institution to become “undercapitalized” or if it already is “undercapitalized.” The OCC may prevent the payment of a dividend if it determines that the payment would be an unsafe and unsound banking practice.

Compensation

Under regulatory guidance applicable to all banking organizations, incentive compensation policies must be consistent with safety and soundness principles. Under this guidance, financial institutions must review their compensation programs to ensure that they: (i) provide employees with incentives that appropriately balance risk and reward and that do not encourage imprudent risk, (ii) are compatible with effective controls and risk management, and (iii) are supported by strong corporate governance, including active and effective oversight by the banking organization’s board of directors. Monitoring methods and processes used by a banking organization should be commensurate with the size and complexity of the organization and its use of incentive compensation. During 2016, as required by the Dodd-Frank Act, the federal bank regulatory agencies and the SEC proposed revised rules on incentive-based payment arrangements at specified regulated entities having at least $1 billion of total assets (including the Company and Bank).

In October 2022, the SEC adopted final rules implementing the incentive-based compensation recovery (clawback) provisions of the Dodd-Frank Act. In response to the final rules, the Nasdaq Stock Market implemented new clawback listing standards which are applicable to the Company. The Company has adopted a Nasdaq compliant clawback policy which is included as an exhibit with this Annual Report on Form 10-K.

Cybersecurity and Data Breaches

Federal regulators have issued multiple statements regarding cybersecurity and that financial institutions need to design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. In addition, a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations in the event of a cyber-attack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or one of its critical service providers fall victim to a cyber-attack. Effective May 1, 2022, banking organizations are required to notify their primary banking regulator within 36 hours of determining that a “computer-security incident” has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.

14

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, a number of states, notably including California where we conduct substantially all our banking business, have adopted laws and/or regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many such states have also implemented or modified their data breach notification and data privacy requirements, including California and New York. We expect this trend of state-level activity in those areas to continue, and we continue to monitor relevant legislative and regulatory developments in California and other states in which our customers are located or in which we conduct business.

In the ordinary course of business, we rely on electronic communications and information systems, as well as certain third-party service providers’ electronic communication and information systems, to conduct our operations and to store sensitive data. We employ a layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. We also seek to evaluate and monitor the cybersecurity policies and practices of key third-party service providers which utilize electronic and information systems that interface with our Bank’s systems, in the manner and to the extent required by applicable banking laws and regulations. Notwithstanding the strength of our defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our customers and third-party service providers are under constant threat, and it is possible that we or they could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our customers. In addition, to the extent we experience any data breaches, we may become subject to governmental fines or enforcement actions and reputation risk as well as potential liability arising out of governmental or private litigation. See