OTC: FMCB

In March 2002, F&M Bancorp, Inc. was created to protect the name “F&M Bank.” During 2002, the Company completed a fictitious business name filing in California to begin using the streamlined name, “F&M
Bank,” as part of a larger effort to enhance the Company’s image and build brand name recognition. Since 2002, the Company has converted all of its daily operating and image advertising to the “F&M Bank” name and the Company’s logo, slogan and
signage were redesigned to incorporate the trade name, “F&M Bank.”

In 2003, the Company formed a wholly-owned Connecticut statutory business trust, FMCB Statutory Trust I, for the sole purpose of issuing trust-preferred securities. See Note 9 “Long-Term Subordinated Debentures”,
located in Item 8 “Financial Statements and Supplementary Data” in this Form 10-K.

Market Area

The Company’s primary service area is the mid Central Valley of California, including Sacramento, San Joaquin, Solano, Stanislaus and Merced counties, and the east region of the San Francisco Bay Area, including
Napa, Alameda, and Contra Costa counties. The Company operates 30 full-service branches and 3 stand-alone ATMs. The following statistical data, for the counties in our market area, as of the most recent date available, are set forth below:

•

Sacramento County, with branches in Sacramento, Elk Grove, Galt and Walnut Grove. This county had a Population of 1.6 million and a Median Household Income of approximately $92,175. Significant employment sectors include the following:
government, education & health trade, and transportation & utilities. Unemployment was at 5.2%.

•

San Joaquin County with branches in Lodi, Linden, Stockton, Lockeford, and Manteca. This county had a Population of 0.8 million and a Median Household Income of approximately $92,179. Significant employment sectors include the following:
trade, transportation & utilities, government, and education & health services. Unemployment was at 6.5%.

•

Solano County, with a branch in Rio Vista. This county had a Population of 0.45 million and a Median Household Income of approximately $100,401. Significant employment in the following industries: education and health services, trade,
transportation and utilities, and government. Unemployment was at 5.6%.

•

Stanislaus County, with branches in Modesto, Riverbank and Turlock. This county had a Population of 0.56 million and a Median Household Income of approximately $81,468. Significant employment in the following sectors: trade,
transportation & utilities, educational & health services, and government. Unemployment was at 6.6%.

•

Merced County, with branches in Hilmar and Merced. This county had a Population of 0.29 million and a Median Household Income of approximately $65,510. Significant employment in the following sectors: government, trade, transportation
& utilities, and farming. Unemployment was at 8.5%.

•

Alameda County, with a branch in Oakland. This county had a Population of 1.7 million and a Median Household Income of approximately $129,367. Significant employment in the following sectors: professional & business services,
educational & health services, trade, and transportation & utilities. Unemployment was at 4.9%.

•

Contra Costa County, with branches in Concord, Danville, and Walnut Creek. This county had a Population of 1.2 million and a Median Household Income of approximately $127,229. Significant employment in the following sectors: professional
& business services, educational & health services, trade, and transportation & utilities. Unemployment was at 5.0%.

•

Napa County, with a branch in Napa. This county had a Population of 0.14 million and a Median Household Income of approximately $111,471. Significant employment in the following sectors: manufacturing, leisure & hospitality, trade,
agriculture, and educational & health services. Unemployment was at 4.1%.

Through its network of banking offices, the Company emphasizes personalized service along with a broad range of banking services to businesses and individuals located in the service areas of its offices. Although the
Company focuses on marketing its services to small and medium-sized businesses, a broad range of retail banking services are also made available to the local consumer market.

The Company offers a wide range of deposit products. These include checking, savings, money market, time certificates of deposit, individual retirement accounts and online banking services for both business and
personal accounts.

The Company provides a broad complement of lending products, including commercial, commercial real estate, real estate construction, agribusiness, consumer, credit card, residential real estate loans, and equipment
leases. Commercial products include term loans, leases, lines of credit and other working capital financing and letters of credit. Financing products for individuals include automobile financing, lines of credit, residential real estate, home
improvement and home equity lines of credit.

The Company also offers a wide range of specialized services designed for the needs of its commercial accounts. These services include a credit card program for merchants, lockbox and other collection services,
account reconciliation, investment sweep, on-line account access, and electronic funds transfers by way of domestic and international wire and automated clearinghouse.

The Company makes investment products available to customers, including mutual funds and annuities. These investment products are offered through a third party, which employs investment advisors to meet with and
provide investment advice to the Company’s customers.

Competition

The banking and financial services industry in California generally, and in the Company’s market areas specifically, is highly competitive. The competitive environment is a result primarily of changes in regulation,
changes in technology and product delivery systems, and the accelerating pace of consolidation among financial service providers. The Company competes with other major commercial banks, diversified financial institutions, credit unions, savings
institutions, money market and other mutual funds, mortgage companies, and a variety of other non-banking financial services and advisory companies. Federal legislation encourages competition between different types of financial service providers
and has fostered new entrants into the financial services market. Non-traditional financial services firms, such as financial technology companies, are less regulated and continue to expand their offerings of services traditionally provided by
financial institutions. It is anticipated that this trend will continue. Using the financial holding company structure, insurance companies and securities firms may compete more directly with banks and bank holding companies. Further, the current
Trump Administration has taken a number of actions to promote innovation across the financial services industry through a regulatory environment that is favorable to cryptocurrencies, digital assets, open banking initiatives and financial
technology companies, which has the potential to further increase competition within the banking industry. In 2025, the Office of the Comptroller of the Currency (“OCC”) announced its conditional approval of five national trust bank charter
applications to either newly charter or convert existing institutions into national trust banks that propose to offer digital asset products and services. While national trust banks generally do not take insured deposits or engage in commercial
lending, these new non-traditional trust banks offer deposit-like products, although lacking FDIC insurance and core consumer protections, and they are not subject to the same capital, liquidity or supervisory standards as banks.

Many of our competitors are much larger in total assets and capitalization, have greater access to capital markets and offer a broader range of financial services than the Company. In order to compete with other
financial service providers, the Company relies upon personal contact by its officers, directors, employees, and shareholders, along with various promotional activities and specialized services. In those instances where the Company is unable to
accommodate a customer’s needs, the Company may arrange for those services to be provided through its correspondents.

The market shares of the Bank and all other banks within the eight counties in California in which we operate, at June 30, 2025 (the most recent data available), as reported by FDIC, are as follows:

County

F&M Bank

Deposits

All Banks

Deposits

F&M Bank

Deposit Share

(Dollars in thousands)

San Joaquin

$

2,030,802

$

15,159,437

13.40

%

Stanislaus

1,040,302

11,285,773

9.22

%

Merced

306,096

3,319,794

9.22

%

Solano

160,377

6,618,864

2.42

%

Sacramento

712,316

72,068,170

0.99

%

Contra Costa

441,694

51,645,077

0.86

%

Napa

31,699

4,310,646

0.74

%

Alameda

41,413

66,805,956

0.06

%

Total

$

4,764,699

$

231,213,717

2.06

%

Human Capital Resources

As of December 31, 2025, we employed 383 full-time-equivalent employees. The Company believes that its employee relations are satisfactory. For the year ended December 31, 2025, salaries and employee benefits expense
totaled $74.1 million, representing 67% of our total non-interest expense. The Company makes significant investments in employee education, training, and recruiting.

We are led by an experienced management team with substantial experience in the markets we serve and the financial products we offer. Our business strategy focuses on providing products and services through long-term
relationship managers. As a result, our success depends heavily on the performance of our employees, as well as on our ability to attract, motivate and retain highly qualified employees at all levels of the Company. We believe that our work
environment contributes to employee satisfaction and retention.

We are committed to maintaining a work environment where every employee is treated with dignity and respect, free from the threat of discrimination and harassment. As stated in our Board approved (i) Code of Conduct
and (ii) Prohibited Harassment Policy, we expect these same standards to apply to all stakeholders, and to our interactions with customers, vendors and independent contractors.

We are firmly committed to providing equal employment and advancement opportunities to all qualified individuals and will not tolerate any discrimination or harassment of any kind. Team members are encouraged to
immediately report any discrimination or harassment to their supervisor and human resources.

Policies and Planning

We are proud to be an Equal Opportunity Employer and enforce those values throughout all of our operations. We prohibit discrimination in hiring or advancement against any individual on the basis of race, color,
religion, gender, sex, national origin, age, marital status, pregnancy, physical or mental disability, genetics, veteran status, sexual orientation, or any other characteristic protected by applicable law.

We strive to ensure our team members have access to working conditions that provide a safe and healthy environment, free from work-related injuries and illnesses. Many of our locations employ badges and keypads to
enter or to enter restricted areas of locations that have a public presence.

Each year our annual planning and budgeting process involves an assessment of staffing levels and skills and results in the development of targets for recruitment and training. In addition, our Board of Directors
reviews all succession plans in place for key personnel.

Recruitment

We strive to recruit talent from both local educational institutions and the banking industry. The Company has full-time staff dedicated to our recruitment efforts and we utilize many of the major recruitment firms
and websites. Annually, we visit local colleges and universities for job fairs and other recruitment events, which we believe allows us to identify those students who have the skills and aptitudes we need in the Company. The results of these
efforts has been a consistent flow of candidates to fill our staffing needs as we grow.

Compensation

Salary and Bonuses

We have job descriptions and salary grade ranges for all of our positions. Annually, we use outside survey firms to provide information on market pay. We also pay performance-based bonuses to our employees. We use
different performance-based bonus programs for those in business generating roles and those in administrative support roles to ensure incentives align with job responsibilities and proper segregation of duties. We believe that this
“pay-for-performance” approach allows us to effectively recruit and retain key employees.

Retirement Plans

All employees are eligible to participate and make contributions into the 401(k) portion of the Profit Sharing Plan after completing 120 days of service. The Company makes contributions equal to 5% of the employee’s
eligible compensation plus a discretionary contribution determined annually by the Board of Directors. Eligible employees begin participating in the employer contributions portion of the Profit Sharing Plan if they have worked at least 1,000 hours
during the year and are employed by the Company on December 31st. This is not a matching based program; employees receive these contributions regardless of whether they make individual contributions to our 401(k) program. Contributions
by the Company for the Profit Sharing Plan are made at a level that we believe helps us in recruitment and retention.

The Company, through the Bank, sponsored an Executive Retirement Plan (“ERP”) for certain executive level employees and a Senior Management Retention Plan (“SMRP”) for certain senior level employees. The ERP and SMRP
were non-qualified deferred compensation plans and were developed to supplement the Company’s Profit Sharing Plan. Effective November 29, 2024, both plans were terminated and frozen. The liquidation of both plans occurred on December 10, 2025.
These plans were replaced with a new restricted stock compensation plan as described in the following paragraph.

Stock Compensation Plan

At the special meeting of shareholders held on November 25, 2024, the Company’s shareholders approved the Farmers & Merchants Bancorp 2025 Restricted Stock Retirement Plan (the “2025 Plan”). The 2025 Plan permits
stock-based compensation awards to employees, officers and directors of the Company and its subsidiaries and affiliates. The 2025 Plan authorized awards up to 80,000 shares. Under the 2025 Plan, the first grant was awarded in February 2025 and two
additional grant awards were made during the remainder of 2025. The 2025 Plan was designed to replace the ERP and SMRP plans described above.

Medical and Other Benefits

In addition to competitive salaries, incentives and retirement benefits, we provide comprehensive medical, dental, and vision plans, health savings accounts, paid sick time, long-term disability, basic life and
accidental death and dismemberment insurance, flexible spending accounts, and employee assistance and wellness programs.

Training

Job Related

We support team members, should they wish to continue their education in subjects and fields that are directly related to our operations, activities, and objectives. We encourage our team members to pursue
educational opportunities that will help improve job performance and professional development. To further this goal, we reimburse tuition and certain fees for satisfactory completion of approved educational courses and certain certifications.
Included are college credit courses at accredited colleges and universities, continuing education courses and certification exams.

Harassment Prevention

The Company assigns all employees harassment prevention training. Every two years, non-supervisory employees receive one hour of harassment prevention training while
supervisors receive two hours of harassment prevention training. Newly hired employees are assigned harassment prevention and must complete the training within six months of hire or promotion. Following the initial training, all employees must
complete training every two years, at minimum. As of December 31, 2025, all employees had met their harassment prevention training requirements for 2025.

Performance Evaluation

The Company has implemented a Performance Planning, Coaching and Evaluation (“PPC&E”) system that requires each year that employees and their managers establish detailed goals and objectives. Annually, employees
are reviewed relative to their progress in achieving those goals, with the objective of reducing performance surprises and encouraging behavior that is consistent with Company objectives. We believe that this PPC&E discipline is important in
retaining and growing the skills of our employees.

Succession Planning

The Company has a succession planning process led by the Board of Directors and executive management. The Board engages in strategic planning sessions, which includes board succession plans and succession plans for
executive management and other key positions. Succession plans are designed to ensure a smooth and orderly transition. These succession plans are discussed with our regulators during the examination process.

Government Policies

The Company’s profitability, like that of most financial institutions, is significantly dependent on interest rate differentials. The difference between the interest rates received by the Company on its
interest-earning assets, such as loans and leases extended to its customers and securities held in its investment portfolio, and the interest rates paid by the Company on interest-bearing liabilities, such as deposits and other borrowings, comprise
the major portion of the Company’s earnings.

These rates are highly sensitive to many factors that are beyond the control of the Company and the Bank, such as inflation, recession, unemployment, and the monetary policy of the Federal Reserve. The impact that
changes in economic conditions and governmental policies might have on the Company and the Bank cannot be predicted.

The business of the Company is also influenced by the monetary and fiscal policies of the federal government and the policies of regulatory agencies, particularly the Federal Reserve. The Federal Reserve implements
national monetary policies (with objectives such as curbing inflation and maximum employment, stable prices, and moderate long-term interest rates) through its open-market operations in U.S. Government securities by adjusting the required level of
reserves for depository institutions subject to its reserve requirements, and by varying the target federal funds and discount rates applicable to borrowings by depository institutions. The actions of the Federal Reserve in these areas influence
the growth of bank loans and leases, investments, and deposits and affect interest rates earned on interest-earning assets and paid on interest-bearing liabilities. The nature and impact on the Company of any future changes in monetary and fiscal
policies cannot be predicted.

From time to time, legislative acts, as well as regulations, are enacted which have the effect of increasing the Company’s cost of doing business, limiting or expanding permissible activities, or affecting the
competitive balance between banks and other financial services providers. Proposals to change the laws and regulations governing the operations and taxation of banks, bank holding companies, and other financial institutions and financial services
providers are frequently made in the U.S. Congress, in the state legislatures including California’s, and before various regulatory agencies. This legislation may change banking statutes and the operating environment of the Company and the Bank in
substantial and unpredictable ways. If enacted, such legislation or regulations could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance among banks, savings institutions,
credit unions, and other financial institutions and financial service providers. The Company cannot predict whether any of this potential legislation will be enacted, and if enacted, the effect that it, or any implementing regulations, would have
on the financial condition or results of operations of the Company or any of its subsidiaries.

Supervision and Regulation

General

Bank holding companies and banks are extensively regulated under both federal and state law. The regulation is intended primarily for the protection of the banking system and the FDIC’s Deposit Insurance Fund
(“DIF”) and clients of insured depository institutions and not for the benefit of shareholders of the Company. This supervisory and regulatory framework subjects banks and bank holding companies to regular examination by their respective
regulatory agencies, which results in examination reports and ratings that, while not publicly available, can affect the conduct and growth of their businesses. These examinations consider not only compliance with applicable laws and regulations,
but also capital levels, asset quality and risk, management ability and performance, earnings, liquidity, and various other factors. The regulatory agencies generally have broad discretion to impose restrictions and limitations on the operations
of a regulated entity where the agencies determine, among other things, that such operations are unsafe or unsound, fail to comply with applicable law or are otherwise inconsistent with laws and regulations or with the supervisory policies of
these agencies.

Set forth below is a summary description of the material laws and regulations which relate to the operations of the Company and the Bank. This description does not purport to be complete and is qualified in its
entirety by reference to the applicable laws and regulations.

The Company

The Company is a registered bank holding company and is subject to regulation under the Bank Holding Company Act of 1956, as amended (“BHCA”). Accordingly, the Company’s operations are subject to extensive
regulation, supervision, and examination by the Federal Reserve. The Company is required to file with the Federal Reserve quarterly and annual reports and such additional information as the Federal Reserve may require pursuant to the BHCA. The
Federal Reserve conducts periodic examinations of the Company.

The Federal Reserve may require that the Company terminate an activity, terminate control of, liquidate, or divest certain subsidiaries or affiliates when the Federal Reserve believes the activity or the control of
the subsidiary or affiliate constitutes a significant risk to the financial safety, soundness or stability of any of its banking subsidiaries. The Federal Reserve also has the authority to regulate provisions of certain bank holding company debt.
Under certain circumstances, the Company must file written notice with, and obtain approval from, the Federal Reserve prior to purchasing or redeeming its equity securities.

Under the BHCA and regulations adopted by the Federal Reserve, a bank holding company and its non-banking subsidiaries are prohibited from requiring certain tie-in arrangements in connection with an extension of
credit, lease or sale of property, or furnishing of services. For example, with certain exceptions, a bank may not condition an extension of credit on a promise by its customer to obtain other services provided by it, its holding company or other
subsidiaries, or on a promise by its customer not to obtain other services from a competitor. In addition, federal law imposes certain restrictions on transactions between Farmers & Merchants Bancorp and its subsidiaries. Further, the Company
is required by the Federal Reserve to maintain certain levels of capital. See “Capital Standards.”

The Company is prohibited by the BHCA, except in certain statutorily prescribed instances, from acquiring direct or indirect ownership or control of more than 5% of the outstanding voting shares of any company that
is not a bank or bank holding company and from engaging directly or indirectly in activities other than those of banking, managing or controlling banks, or furnishing services to its subsidiaries. However, the Company, subject to the prior notice
to, and/or approval of, the Federal Reserve, may engage in any, or acquire shares of companies engaged in any, activities that are deemed by the Federal Reserve to be so closely related to banking or managing or controlling banks as to be a proper
incident thereto.

A bank holding company is required to serve as a source of financial and managerial strength to its subsidiary banks and may not conduct its operations in an unsafe or unsound manner. In addition, it is the Federal
Reserve’s policy that, in serving as a source of strength to its subsidiary banks, a bank holding company should stand ready to use available resources to provide adequate capital funds to its subsidiary banks during periods of financial stress or
adversity and should maintain the financial flexibility and capital-raising capacity to obtain additional resources for assisting its subsidiary banks. This support may be required at times when a bank holding company may not be able to provide
such support. A bank holding company’s failure to meet its obligations to serve as a source of strength to its subsidiary banks will generally be considered by the Federal Reserve to be an unsafe and unsound banking practice or a violation of the
Federal Reserve’s regulations or both. The Company is not a financial holding company for purposes of the BHCA.

The Company is also a bank holding company within the meaning of the California Financial Code. As such, the Company and its subsidiaries are subject to examination by, and may be required to file reports with, the
DFPI.

The Company’s common stock is registered with the Securities and Exchange Commission (“SEC”) under Section 12(g) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”). As such, the Company is
subject to the reporting, proxy solicitation and other requirements and restrictions of the Exchange Act.

The Bank

The Bank, as a California-chartered non-Federal Reserve member bank, is subject to primary supervision, periodic examination and regulation by the DFPI and the FDIC. If, as a result of an examination of the Bank, the
FDIC should determine that the financial condition, capital resources, asset quality, earnings prospects, management, liquidity, or other aspects of the Bank’s operations are unsatisfactory, or that the Bank or its management is violating or has
violated any law or regulation, various remedies are available to the FDIC.

Such remedies include the power to issue cease and desist orders regarding or to enjoin “unsafe or unsound” practices, to require affirmative action to correct any conditions resulting from any violation or practice,
to issue an administrative order that can be judicially enforced, to direct an increase in capital, to restrict the growth of the Bank, to assess civil monetary penalties, to remove or suspend officers and directors, and ultimately to terminate the
Bank’s deposit insurance, which for a California-chartered bank would result in a revocation of the Bank’s charter. The DFPI has many of the same remedial powers. The term ‘‘unsafe or unsound practice’’ appears in the FDIA for purposes of the
agencies’ enforcement authority; however, it is not defined in the statute. In October 2025, the FDIC issued a proposed rule which seeks to implement a consistent definition of ‘‘unsafe or unsound practice’’ that would focus on material risks to
the financial condition of an institution and would generally require that an imprudent practice, act, or failure to act, if continued, would be likely to materially harm the institution’s financial condition or present a material risk of loss to
the FDIC’s DIF.

Various requirements and restrictions under the laws of the State of California and the United States affect the operations of the Bank. State and federal statutes and regulations relate to many aspects of the Bank’s
operations, including reserves against deposits, ownership of deposit accounts, interest rates payable on deposits, loans and leases, investments, mergers and acquisitions, borrowings, dividends, locations of branch offices, and capital
requirements. Further, the Bank is required to maintain certain levels of capital. See “Capital Standards.”

The Dodd Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”) - The Dodd-Frank Act implemented sweeping reform across the U.S.
financial regulatory framework, including, among other changes:

•

creating a Financial Stability Oversight Council tasked with identifying and monitoring systemic risks in the financial system;

•

creating the Consumer Financial Protection Bureau (“CFPB”), which is responsible for implementing, examining and enforcing compliance with federal consumer financial protection laws;

•

requiring the FDIC to make its capital requirements for insured depository institutions countercyclical, so that capital requirements increase in times of economic expansion and decrease in times of economic contraction;

•

imposing more stringent capital requirements on bank holding companies and subjecting certain activities, including interstate mergers and acquisitions, to heightened capital conditions;

•

changing the assessment base for federal deposit insurance from the amount of the insured deposits held by the depository institution to the depository institution’s average total consolidated assets less tangible equity, eliminating the
ceiling on the size of the FDIC’s DIF and increasing the floor on the size of the FDIC’s DIF;

•

eliminating all remaining restrictions on interstate banking by authorizing state banks to establish de novo banking offices in any state that would permit a bank chartered in that state to open a banking office at that location;

•

repealing the federal prohibitions on the payment of interest on demand deposits, thereby permitting depository institutions to pay interest on business transaction and other accounts; and

•

in the so-called “Volcker Rule,” subject to numerous exceptions, prohibiting insured depository institutions and affiliates from certain investments in, and sponsorship of, hedge funds and private equity funds and from engaging in
proprietary trading.

Many of the law’s provisions have been implemented by rules and regulations of the federal banking agencies. The law contains many provisions which have particular relevance to our business, including provisions that
have resulted in adjustments to our FDIC deposit insurance premiums and that resulted in increased capital and liquidity requirements, increased supervision, increased regulatory and compliance risks and costs and other operational costs and
expenses, reduced fee-based revenues and restrictions on some aspects of our operations, and increased interest expense on our demand deposits.

On May 24, 2018, President Trump signed the Economic Growth, Regulatory Relief and Consumer Protection Act (“Economic Growth Act”), which repealed or modified certain provisions of the Dodd-Frank
Act and eased regulations on all but the largest banks.

The Economic Growth Act’s highlights include improving consumer access to mortgage credit that, among other things: (i) exempt banks with less than $10 billion in assets from the ability-to-repay
requirements for certain qualified residential mortgage loans; (ii) do not require appraisals for certain transactions valued at less than $400,000 in rural areas; (iii) exempt banks and credit unions that originate fewer than 500 open-end and
500 closed-end mortgages from the Home Mortgage Disclosure Act’s (“HMDA”) expanded data disclosures (the provision would not apply to nonbanks and would not exempt institutions from HMDA reporting altogether); (iv) amend the SAFE Mortgage
Licensing Act by providing registered mortgage loan originators in good standing with 120 days of transitional authority to originate loans when moving from a federal depository institution to a non-depository institution or across state lines;
(v) require the CFPB to clarify how Truth in Lending Disclosure (“TRID”) rules apply to mortgage assumption transactions and construction-to-permanent home loans as well as outline certain liabilities related to model disclosure use; and (vi)
provide that federal banking regulators may not impose higher capital standards on High Volatility Commercial Real Estate exposures unless they are for acquisition, development or construction (“ADC”), and clarifies ADC status. In addition, the
Economic Growth Act’s highlights also include regulatory relief for certain institutions, including among other things, simplifying capital calculations by requiring regulators to adopt a threshold for a community bank leverage ratio of between
8% to 10%.

Institutions under $10 billion in assets that meet such community bank leverage ratio will automatically be deemed to be “well-capitalized”, although regulators retain the flexibility to determine
that a depository institution may not qualify for the community bank leverage ratio test based on the institution’s risk profile. The Economic Growth Act also exempts community banks from the Volcker Rule’s proprietary trading ban if they have
less than $10 billion in total consolidated assets and total trading assets and liabilities not exceeding more than five percent of their total assets.

The Economic Growth Act also added certain protections for consumers, including veterans and active duty military personnel, expanded credit freezes and created an identity theft protection
database. The Economic Growth Act also made changes applicable to bank holding companies, as it raises the threshold for automatic designation as a systemically important financial institution from $50 billion to $250 billion in assets, subjects
banks with $100 billion to $250 billion in total assets to periodic stress tests, exempts from stress test requirements entirely banks with under $100 billion in assets, and required the federal banking regulators , within 180 days of passage, to
raise the asset threshold under the Small Bank Holding Company Policy Statement from $1 billion to $3 billion. The Economic Growth Act also added certain protections for student borrowers.

The current Trump Administration has indicated a desire to reduce the regulatory burden on U.S. companies, including financial institutions. Further, in January 2025, the Acting Chairman of the FDIC
issued a statement in which he indicated that a matter of FDIC focus (among other things) will include conducting a “wholesale” review of the agency’s regulations, guidance and manuals. President Trump is likely to appoint, or has already
appointed, new acting leadership of bank regulatory agencies, including the CFPB, and, once appointed, this new agency leadership can rescind informal agency guidance, including advisory opinions, interpretive rules and policy statements,
creating opportunities for deregulation. On January 20, 2025, President Trump signed an executive order to pause all pending regulations. Sweeping in nature, the order applied to “all executive departments and agencies” while directing them to
“not propose or issue any rule in any manner, including by sending a rule to the Office of the Federal Register (the “OFR”), until a department or agency head appointed or designated by the President after noon on January 20, 2025, reviews and
approves the rule.” The order also stated that agencies must “immediately withdraw any rules that have been sent to the OFR but not published in the Federal Register, so that they can be reviewed and approved.” The executive order also stated
that agencies must “consider postponing for 60 days from the date of this memorandum the effective date for any rules that have been published in the Federal Register, or any rules that have been issued in any manner but have not taken effect,
for the purpose of reviewing any questions of fact, law, and policy that the rules may raise.”

At this time, no details on potential or proposed reforms have been published, and we are uncertain whether the intended deregulation will, in fact, occur, or have a significant impact on the
Company. Whether and the extent to which any new legislation will result in additional regulatory initiatives and policies, or modifications of existing regulations and policies, which may impact our business, cannot be predicted at this time. No
current assurance may be given that any other such legislative changes will not have a negative impact on the results of operations and financial condition of the Company and the Bank.

Capital Standards

The federal banking agencies have risk-based capital adequacy guidelines intended to provide a measure of capital adequacy that reflects the degree of risk associated with a banking organization’s
operations, both for transactions reported on the balance sheet as assets and for transactions, such as letters of credit and recourse arrangements, that are recorded as off-balance sheet items. In 2013, the Federal Reserve, FDIC, and Office of
the Comptroller of the Currency issued final rules (the “Basel III Capital Rules”) establishing a new comprehensive capital framework for U.S. banking organizations.

The rules implement the Basel Committee’s December 2010 framework, commonly referred to as Basel III, for strengthening international capital standards, as well as implementing certain provisions of
the Dodd-Frank Act.

The Basel III Capital Rules became effective for the Company and the Bank on January 1, 2015 (subject to phase-in periods for some of their components). The Basel III Capital Rules: (i) introduce a
new capital measure called Common Equity Tier 1 (“CET1”), and a related regulatory capital ratio of CET1 to risk-weighted assets; (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments, which are instruments
treated as Tier 1 instruments under the prior capital rules that meet certain revised requirements; (iii) mandate that most deductions or adjustments to regulatory capital measures be made to CET1 and not to the other components of capital; and
(iv) expand the scope of the deductions from and adjustments to capital, as compared to existing regulations. Under the Basel III Capital Rules, for most banking organizations, the most common form of additional Tier 1 capital is non-cumulative
perpetual preferred stock and the most common form of Tier 2 capital is subordinated notes and a portion of the allowance for credit losses, in each case, subject to the Basel III Capital Rules’ specific requirements.

Under the Basel III Capital Rules, the following are the minimum capital ratios applicable to the Company and the Bank:

•

4.0% Tier 1 leverage ratio;

•

4.5% CET1 to risk-weighted assets, plus the capital conservation buffer, effectively resulting in a minimum ratio of CET1 to risk-weighted assets of at least 7%;

•

6.0% Tier 1 capital to risk-weighted assets, plus the capital conservation buffer, effectively resulting in a minimum Tier 1 capital ratio of at least 8.5%; and

•

8.0% total capital to risk-weighted assets, plus the capital conservation buffer, effectively resulting in a minimum total capital ratio of at least 10.5%.

The Basel III Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that: (i) mortgage servicing rights, (ii) deferred tax assets
arising from temporary differences that could not be realized through net operating loss carrybacks, and (iii) significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds
10% of CET1 or all such items, in the aggregate, exceed 15% of CET1. Under the Basel III Capital Rules, the effects of certain accumulated other comprehensive income or loss items are not excluded for the purposes of determining regulatory
capital ratios; however, non-advanced approaches banking organizations (i.e., banking organizations with less than $250 billion in total consolidated assets or with less than $10 billion of on-balance sheet foreign exposures), including the
Company and the Bank, may make a one-time permanent election to exclude these items. The Company and the Bank made this election in 2015 in order to avoid significant variations in the level of capital depending upon the impact of interest rate
fluctuations on the fair value of its available-for-sale investment securities portfolio, changes of which are included in accumulated other comprehensive income or loss.

The Basel III Capital Rules prescribe a standardized approach for risk weightings that expands the risk weighting categories from the previous four Basel I-derived categories (0%, 20%, 50% and 100%)
to a larger and more risk-sensitive number of categories, generally ranging from 0% for U.S. Government and agency securities, to 600% for certain equity exposures, depending on the nature of the assets. The Basel III capital rules generally
result in higher risk weights for a variety of asset classes. Additional aspects of the Basel III Capital Rules that are relevant to the Company and the Bank include:

•

consistent with the Basel I risk-based capital rules, assigning exposures secured by single-family residential properties to either a 50% risk weight for first-lien mortgages that meet prudent underwriting standards or a 100% risk weight
category for all other mortgages;

•

providing for a 20% credit conversion factor for the unused portion of a commitment with an original maturity of one year or less that is not unconditionally cancellable (set at 0% under the Basel I risk-based capital rules);

•

assigning a 150% risk weight to all exposures that are nonaccrual or 90 days or more past due (set at 100% under the Basel I risk-based capital rules), except for those secured by single-family residential properties, which will be
assigned a 100% risk weight, consistent with the Basel I risk-based capital rules;

•

applying a 150% risk weight instead of a 100% risk weight for certain high volatility commercial real estate acquisition, development and construction loans; and

•

applying a 250% risk weight to the portion of mortgage servicing rights and deferred tax assets arising from temporary differences that could not be realized through net operating loss carrybacks that are not deducted from CET1 capital
(set at 100% under the Basel I risk-based capital rules).

With respect to the Bank, the Basel III capital rules also revise the prompt corrective action regulations pursuant to Section 38 of the FDIA.

As of December 31, 2025, the Company’s and the Bank’s capital ratios exceeded the minimum capital adequacy guideline percentage requirements of the federal banking agencies for a “well-capitalized”
institution under the Basel III capital rules on a fully phased-in basis.

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms, which standards are commonly referred to as Basel IV.
Among other things, these standards revise the Basel Committee’s standardized approach for credit risk (including the recalibration of the risk weights and the introduction of new capital requirements for certain “unconditionally cancellable
commitments,” such as unused credit card lines of credit) and provides a new standardized approach for operational risk capital.

Under the Basel framework, these standards were generally effective on January 1, 2022, with an aggregate output floor phasing in through January 1, 2027.

On July 27, 2023, the federal banking agencies issued a proposed rule to implement the final components of the Basel III standards set by the Basel Committee on Banking Supervision in 2017, also known
as the “Basel III end game.” The proposed rule, which would not apply to the Company and the Bank as proposed, would substantially revise the existing regulatory capital framework for institutions with $100 billion or more of assets. The proposed
rule faced delays and opposition from both banks and regulators through 2023 and 2024. Following President Trump’s reelection, the Basel III end game rules were expected to undergo significant revisions or re-proposals. Recently, it has been
reported that the Federal Reserve is actively working with the FDIC and the OCC on a re-proposal of the Basel III end game rule, which is expected to be released sometime in early 2026. This re-proposal is expected to reflect a more risk-based
approach and significantly ease the earlier proposal for the biggest banks.

Under the current U.S. capital rules, operational risk capital requirements and a capital floor apply only to advanced approaches institutions, and not to the Bank. The impact of Basel IV on us will
depend on how it is implemented by the federal bank regulators.

The current Trump Administration may consider adjustments to these capital and liquidity rules. Whether and the extent to which these proposed rules, or modifications of existing regulations and
policies, which may impact our business, will be enacted and implemented is uncertain and cannot be predicted at this time.

Prompt Corrective Action (“PCA”)

The FDIA requires federal banking agencies to take PCA in respect of depository institutions that do not meet minimum capital requirements. The FDIA includes the following five capital tiers: “well
capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” A depository institution’s capital tier will depend upon how its capital levels compare with various relevant capital
measures and certain other factors, as established by regulation. The Basel III Capital Rules revised the PCA requirements effective January 1, 2015. Under the revised PCA provisions of the FDIA, an insureddepository institution generally will be
classified in the following categories based on the capital measures indicated:

Minimum to be

Categorized as

"Well

Capitalized"

Minimum to be

Categorized as

"Adequately

Capitalized"

Under-

capitalized

Significantly

Under-

capitalized

Critically

Under-

capitalized

Risk-based capital to risk-weighted assets

10.00%+

8.00%+

< 8.00%

< 6.00%

N/A

Tier 1 capital to risk-weighted assets

8.00%+

6.00%+

< 6.00%

< 4.00%

N/A

CET1 capital to risk-weighted assets

6.50%+

4.50%+

< 4.50%

< 3.00%

N/A

Tier 1 leverage capital ratio

5.00%+

4.00%+

< 4.00%

< 3.00%

N/A

Tangible equity to assets

N/A

N/A

N/A

N/A

< 2.00%

Supplemental leverage ratio

N/A

3.00%+

< 3.00%

N/A

N/A

An institution may be downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios, if it is determined to be operating in an unsafe or unsound condition
or if it receives an unsatisfactory examination rating with respect to certain matters. A bank’s capital category is determined solely for the purpose of applying PCA regulations and the capital category may not constitute an accurate
representation of the bank’s overall financial condition or prospects for other purposes.

The FDIA generally prohibits a depository institution from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company, if the
depository institution would thereafter be “undercapitalized.” “Undercapitalized” institutions are subject to growth limitations and are required to submit capital restoration plans. If a depository institution fails to submit an acceptable plan,
it is treated as if it is “significantly undercapitalized.” “Significantly undercapitalized” depository institutions may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become
“adequately capitalized,” requirements to reduce total assets, and cessation of receipt of deposits from correspondent banks. “Critically undercapitalized” institutions are subject to the appointment of a receiver or conservator by the bank
regulators.

The capital classification of a bank holding company and a bank affects the frequency of regulatory examinations, the bank holding company’s and the bank’s ability to engage in certain activities
and the deposit insurance premium paid by the bank to the FDIC. As of December 31, 2025, we met the requirements to be classified as “well-capitalized” based upon the aforementioned ratios for purposes of the PCA regulations.

The Community Bank Leverage Ratio

On November 4, 2019, the federal banking agencies jointly issued a final rule that provides for an optional, simplified measure of capital adequacy, known as the community bank leverage ratio
(“CBLR”) framework, for qualifying community banking organizations consistent with Section 201 of the Economic Growth Act. The CBLR framework is designed to reduce the capital burden by removing the requirements for calculating and reporting
risk-based capital ratios for qualifying community banking organizations that opt into the framework. The final rule was effective on January 1, 2020.

In order to qualify for the CBLR framework, a community banking organization must have a tier 1 leverage ratio of greater than 9%, less than $10 billion in total consolidated assets,
off-balance-sheet exposures of 25% or less of total consolidated assets, and trading assets and liabilities of 5% or less of total consolidated assets. A qualifying community banking organization that opts into the CBLR framework and meets all
requirements under the framework will be considered to have met the “well capitalized” ratio requirements under the PCA regulations. Such a community banking organization would not be subject to other risk-based and leverage capital requirements
(including the Basel III and Basel IV requirements). The CBLR is determined by dividing a financial institution’s tangible equity capital by its average total consolidated assets. The rule describes what is included in tangible equity capital and
average total consolidated assets. The CBLR framework was available for banks to use in their March 31, 2020, call report. A CBLR bank that ceases to meet any of the qualifying criteria in a future period but maintains a leverage ratio greater
than 8% will be allowed a grace period of two reporting periods to satisfy the CBLR qualifying criteria or to otherwise comply with the generally applicable capital requirements. Further, a CBLR bank may opt out of the framework at any time,
without restriction, by reverting to the generally applicable capital requirements. On November 25, 2025, the US federal banking regulators proposed changes to the CBLR framework intended to encourage additional community banks to opt into the
CBLR framework. This proposal would reduce the CBLR requirement from 9% to 8% and extend the grace period for qualifying institutions that fall below the 8% ratio to return to compliance from the current two quarters to four quarters, provided
they maintain a 7% leverage ratio. While we are a qualifying community banking organization, the Company and Bank have not opted into the CBLR framework.

Anti-Money Laundering and Office of Foreign Assets Control Regulation

Title III of the United and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (the “USA Patriot Act”), is designed to deny terrorists and criminals the
ability to obtain access to the U.S. financial system and has significant implications for depository institutions, brokers, dealers and other businesses involved in the transfer of money.

The USA Patriot Act mandates financial services companies to have policies and procedures with respect to measures designed to address any or all of the following matters: (i) customer identification programs; (ii)
money laundering; (iii) terrorist financing; (iv) identifying and reporting suspicious activities and currency transactions; (v) currency crimes; and (vi) cooperation between financial institutions and law enforcement authorities. Regulatory
authorities routinely examine financial institutions for compliance with these obligations, and failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all
of the relevant laws or regulations, could have serious legal and reputational consequences for the institution, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is
required or to prohibit such transactions even if approval is not required. Regulatory authorities have imposed cease and desist orders and civil money penalties against institutions found to be violating these obligations.

The U.S. Treasury’s Office of Foreign Assets Control (“OFAC”) administers and enforces economic and trade sanctions against targeted foreign countries and regimes under authority of various laws, including designated
foreign countries, nationals and others. OFAC publishes lists of specially designated targets and countries. Financial institutions are responsible for, among other things, blocking accounts of and transactions with such targets and countries,
prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence. Banking regulators examine banks for compliance with the economic sanctions regulations administered by OFAC, and failure
of a financial institution to maintain and implement adequate OFAC programs, or to comply with all of the relevant laws or regulations, could have serious legal and reputational consequences for the institution.

Privacy Restrictions

The Gramm-Leach-Bliley Act (“GLBA”) requires financial institutions in the U.S. to provide certain privacy disclosures to customers and consumers, to comply with certain restrictions on the sharing and usage of
personally identifiable information, and to implement and maintain commercially reasonable customer information safeguarding standards.

The Company believes that it complies with all provisions of the GLBA and all implementing regulations and that the Bank has developed appropriate policies and procedures to meet its responsibilities in connection
with the privacy provisions of the GLBA.

Certain state laws and regulations designed to protect the privacy and security of customer information also apply to us and our subsidiaries, including laws requiring notification to affected individuals and
regulators of data security breaches and laws prohibiting sharing of customer information without the customer’s prior permission.

In June 2018, the State of California enacted The California Consumer Privacy Act of 2018 (“CCPA”). This law became effective on January 1, 2020, and provides consumers with expansive rights and controls over their
personal information which is obtained by or shared with “covered businesses”, which includes the Bank and most other banking institutions subject to California law. The CCPA gives consumers the right to request disclosure of information collected
about them and whether that information has been sold or shared with others, the right to request deletion of personal information subject to certain exceptions, the right to opt out of the sale of the consumer’s personal information and the right
not to be discriminated against because of choices regarding the consumer’s personal information. The CCPA provides for certain monetary penalties and for its enforcement by the California Attorney General or consumers whose rights under the law
are not observed. It also provides for damages as well as injunctive or declaratory relief if there has been unauthorized access, theft or disclosure of personal information due to failure to implement reasonable security procedures. The CCPA
contains several exemptions, including a provision to the effect that the CCPA does not apply where the information is collected, processed, sold or disclosed pursuant to the GLBA if the GLBA is in conflict with the CCPA. In November 2020,
California voters approved state-wide Proposition 24, also known as the California Privacy Rights and Enforcement Act of 2020 (the “CPREA”) which expanded and amended certain provisions of the CCPA and created the California Privacy Protection
Agency to enforce privacy rights for Californians and impose fines for violations of such rights. The CPREA requires businesses to share a consumer’s personal information upon the consumer’s request, provides consumers with an opt-out option for
having their sensitive personal information used or disclosed for advertising or marketing, to obtain permission for collecting data on certain minors, and to correct a consumer’s inaccurate information upon the consumer’s request. It also removed
the ability of businesses to remedy violations before being penalized for violations and increased the penalties for such violations. Most of the provisions of the CPREA took effect in 2023 but some portions, such as the creation of the new state
agency, went into effect immediately. While GLBA-regulated nonpublic, personal information generally is exempt under the CCPA, the CCPA and certain other state laws apply to the personal information of representatives of any business contacts that
the Bank engages with who are California residents, employees who are California residents, and any other personal information that the Bank collects outside of the scope of GLBA, such as with respect to certain data collected from visitors to our
website. The impact of these laws on the business of the Bank could result in increased operating expenses as well as additional exposure to the risk of litigation by or on behalf of consumers.

Dividends and Other Transfer of Funds

Dividends from the Bank constitute the principal source of cash to the Company. The Company is a legal entity separate and distinct from the Bank. The Bank is subject to various statutory and regulatory restrictions
on its ability to pay dividends to the Company. Under such restrictions, the amount available for payment of dividends to the Company by the Bank totaled $131.8 million at December 31, 2025. During 2025, the Bank paid $51.8 million in dividends to
the Company of which $13.4 million was used for cash dividends to shareholders, $34.7 million was allocated for share repurchases and $3.7 million was used to cover expenses and maintain a cash reserve.

The FDIC and the DFPI also have authority to prohibit the Bank from engaging in activities that, in their opinion, constitute unsafe or unsound practices in conducting its business. It is possible, depending upon the
financial condition of the bank in question and other factors, that the FDIC or the DFPI could assert that the payment of dividends or other payments might, under some circumstances, be an unsafe or unsound practice. Further, the Federal Reserve
and the FDIC have established guidelines with respect to the maintenance of appropriate levels of capital by banks and bank holding companies under their jurisdiction. Compliance with the standards set forth in such guidelines and the restrictions
that are or may be imposed under the PCA provisions of federal law could limit the amount of dividends that the Bank or the Company may pay. An insured depository institution is prohibited from paying management fees to any controlling persons or,
with certain limited exceptions, making capital distributions if after such transaction the institution would be undercapitalized. The DFPI may impose similar limitations on the Bank. See “Prompt Corrective Action” and “Capital Standards”, above,
for a discussion of these additional restrictions on capital distributions.

Transactions with Affiliates

The Bank is subject to certain restrictions imposed by federal law on any extensions of credit to, or the issuance of a guarantee or letter of credit on behalf of the Company or other affiliates, the purchase of, or
investments in, stock or other securities of the Company or other affiliates, the taking of such securities as collateral for loans and leases, and the purchase of assets of the Company or other affiliates. Such restrictions prevent the Company and
other affiliates from borrowing from the Bank unless the loans are secured by marketable obligations of designated amounts. Further, such secured loans and investments by the Bank to or in the Company or to or in any other affiliates are limited,
individually, to 10% of the Bank’s capital and surplus (as defined by federal regulations), and such secured loans and investments are limited, in the aggregate as to all affiliates, to 20% of the Bank’s capital and surplus (as defined by federal
regulations).

In addition, the Company and its operating subsidiaries generally may not purchase a low-quality asset from an affiliate, and other specified transactions between the Company or its operating subsidiaries and an
affiliate must be on terms and conditions that are consistent with safe and sound banking practices.

Also, the Bank and its operating subsidiaries may engage in transactions with affiliates only on terms and under conditions that are substantially the same, or at least as favorable to the Bank or its subsidiaries,
as those prevailing at the time for comparable transactions with (or that in good faith would be offered to) non-affiliated companies. California law also imposes certain restrictions with respect to transactions with affiliates. Additionally,
limitations involving transactions with affiliates may be imposed on the Bank under the PCA provisions of federal law. See “Prompt Corrective Action.”

Safety and Soundness Standards

The federal banking agencies have adopted guidelines that establish operational and managerial standards to promote the safety and soundness of federally insured depository institutions. The
guidelines set forth standards for internal controls, information systems, internal audit systems, loan documentation; credit underwriting, interest rate exposure, asset growth, compensation, fees and benefits, asset quality and earnings.

In general, the safety and soundness guidelines prescribe the goals to be achieved in each area, and each institution is responsible for establishing its own procedures to achieve those goals. If an
institution fails to comply with any of the standards set forth in the guidelines, the financial institution’s primary federal regulator may require the institution to submit a plan for achieving and maintaining compliance. If a financial
institution fails to submit an acceptable compliance plan, or fails in any material respect to implement a compliance plan that has been accepted by its primary federal regulator, the regulator is required to issue an order directing the
institution to cure the deficiency. Until the deficiency cited in the regulator’s order is cured, the regulator may restrict the financial institution’s rate of growth, require the financial institution to increase its capital, restrict the rates
the institution pays on deposits or require the institution to take any action the regulator deems appropriate under the circumstances. Noncompliance with the standards established by the safety and soundness guidelines may also constitute
grounds for other enforcement action by the federal bank regulatory agencies, including cease and desist orders and civil money penalty assessments.

In October 2025, the FDIC issued a proposed rule which would define the term “unsafe or unsound practice” for purposes of the statute that authorizes federal banking agencies to take formal
enforcement actions – including cease-and-desist orders, civil money penalties, and removal of personnel – against insured depository institutions engaging in unsafe or unsound practices. If implemented, this proposed rule would also revise the
supervisory framework for the issuance of matters requiring attention (MRA) and other supervisory communications and is intended to promote greater clarity and certainty regarding certain enforcement and supervision standards and to ensure that
these standards prioritize material financial risks.

Since the financial crisis of 2008-2009, the bank regulatory agencies have increasingly emphasized the importance of sound risk management processes and strong internal controls when evaluating the
activities of the financial institutions they supervise. Properly managing risks has been identified as critical to the conduct of safe and sound banking activities and has become even more important as new technologies, product innovation, and
the size and speed of financial transactions have changed the nature of banking markets. The agencies have identified a spectrum of risks facing a banking institution including, but not limited to, credit, market, liquidity, operational, legal,
and reputational risk.

In particular, regulatory pronouncements in the past few years have focused on operational risk, which arises from the potential that inadequate information systems, operational problems, breaches
in internal controls, fraud, or unforeseen catastrophes will result in unexpected losses. New products and services, third-party risk management and cyber-security are critical sources of operational risk that financial institutions are expected
to address in the current environment. The Bank is expected to have active board and senior management oversight; adequate policies, procedures, and limits; adequate risk measurement, monitoring, and management information systems; and
comprehensive internal controls.

Deposit Insurance

As an FDIC-insured institution, the Bank is required to pay deposit insurance premium assessments to the FDIC. The premiums fund the Deposit Insurance Fund (“DIF”). The FDIC assesses a quarterly
deposit insurance premium on each insured institution based on risk characteristics of the institution and may also impose special assessments in emergency situations. Effective July 1, 2016, the FDIC changed the deposit insurance assessment system
for banks, such as the Bank, with less than $10 billion in assets that have been federally insured for at least five years. Among other changes, the FDIC eliminated risk categories for such banks and now uses the “financial ratios method” to
determine assessment rates for all such banks. Under the financial ratios method, the FDIC determines assessment rates based on a combination of financial data and supervisory ratings that estimate a bank’s probability of failure within three
years. The assessment rate determined by considering such information is then applied to the amount of the institution’s average assets minus average tangible equity to determine the institution’s insurance premium.

On October 18, 2022, the FDIC adopted a final rule, applicable to all insured depository institutions to increase the initial base deposit insurance assessment rate schedules uniformly
by two basis points consistent with the Amended Restoration Plan approved by the FDIC on June 21, 2022. The FDIC indicated that it was taking this action in order to restore the DIF reserve ratio to the required statutory minimum of 1.35% by the statutory deadline of September 30, 2028. The FDIC said that the reserve ratio had declined below this level because of the increase in insured deposits since the
start of the COVID-19 pandemic and other factors that affect the level of the DIF. Under the final rule, the increase in rates began with the first quarterly assessment period of 2023 and will remain in effect unless and until the reserve ratio
meets or exceeds 2% in order to support growth in the DIF in progressing toward the FDIC’s long-term goal of a 2% reserve ratio.

On November 16, 2023, the FDIC issued a final rule to implement a special assessment to recover the loss to the DIF associated with protecting uninsured depositors following the closures in early 2023 of Silicon
Valley Bank and Signature Bank. Under the final rule, the assessment base for an insured depository institution will be equal to the institution’s estimated uninsured deposits as of December 31, 2022, adjusted to exclude the first $5 billion in
estimated uninsured deposits. Under the final rule, the FDIC will collect the special assessment at an annual rate of 13.4 basis points (with the special assessment rate for the final collection quarter reduced from 3.36 basis points to 2.97 basis
points) beginning with the first quarterly assessment period of 2024 and will continue to collect special assessments for an anticipated total of eight quarterly assessment periods (with a final invoice date of March 30, 2026). This special
assessment does not apply to the Bank.

The Bank’s FDIC premiums were $2.5 million, $2.4 million, and $2.4 million for the three years ended December 31, 2025, 2024, and 2023, respectively. Future increases in insurance premiums could have adverse effects
on the operating expenses and results of operations of the Company. Management cannot predict what the FDIC insurance assessment rates will be in the future.

Insurance of a bank’s deposits may be terminated by the FDIC upon a finding that the institution has engaged in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations, or has
violated any applicable law, regulation, rule, order, or condition imposed by the FDIC or the Bank’s primary regulator. Management of the Company is not aware of any practice, condition or violation that might lead to termination of the Company’s
deposit insurance.

Community Reinvestment Act (“CRA”) and Fair Lending

The Bank is subject to certain fair lending requirements involving lending, investing, and other CRA activities. CRA requires each insured depository institution to identify the communities served by the
institution’s offices and to identify the types of credit and investments the institution is prepared to extend within such communities including low and moderate-income neighborhoods. It also requires the institution’s regulators to assess the
institution’s performance in meeting the credit needs of its community and to consider such assessment in reviewing applications for mergers, acquisitions, relocation of existing branches, opening of new branches, and other transactions. A bank may
be subject to substantial penalties and corrective measures for a violation of certain fair lending laws.

A bank’s compliance with the CRA is assessed using an evaluation system, which bases CRA ratings on an institution’s lending, service and investment performance. An unsatisfactory rating may be the basis for denying
a merger application. The Bank’s latest CRA examination was completed by the FDIC in December 2025 and the Bank received an overall Outstanding rating in complying with its CRA obligations.

On October 24, 2023, the federal banking agencies jointly issued a final rule to strengthen and modernize the existing CRA regulations. The final rule took effect on April 1, 2024; however, on March 21, 2024 the
agencies issued a supplemental final rule extending the applicability date for certain provisions to January 1, 2026. In July 2025, the Federal bank regulatory agencies jointly issued a proposal to rescind the CRA final rule issued in October 2023
and replace it with the prior CRA regulations that were originally adopted by the agencies in 1995 (and that the agencies continue to apply), with certain technical amendments. The Bank continues to monitor and stay informed on changes to ensure
compliance with the evolving regulatory framework.

Consumer Protection Regulations

Banks and other financial institutions are subject to numerous laws and regulations intended to protect consumers in their transactions with banks. These laws include, among others, laws regarding
unfair and deceptive acts and practices and usury laws, as well as the following consumer protection statutes: Truth in Lending Act, Truth in Savings Act, Electronic Fund Transfer Act, Expedited Funds Availability Act, Equal Credit Opportunity
Act, Fair and Accurate Credit Transactions Act, Fair Housing Act, Fair Credit Reporting Act, Fair Debt Collection Practices Act, GLBA, Home Mortgage Disclosure Act, Right to Financial Privacy Act, Servicemembers Civil Relief Act, Military Lending
Act and Real Estate Settlement Procedures Act. The FDIC regularly conducts compliance examinations of insured depository institutions to determine whether the institution is meeting its responsibility to comply with the requirements of consumer
protection laws and regulations.

Many states and local jurisdictions have consumer protection laws analogous, and in addition, to those listed above. These federal, state and local laws regulate the manner in which financial
institutions deal with customers when taking deposits, making loans or conducting other types of transactions. Failure to comply with these laws and regulations could give rise to regulatory sanctions, customer rescission rights, action by state
and local attorneys general and civil or criminal liability. Failure to comply with consumer protection requirements may also result in our failure to obtain any required bank regulatory approval for merger or acquisition transactions we may wish
to pursue or our prohibition from engaging in such transactions even if approval is not required.

The structure of federal consumer protection regulation applicable to all providers of consumer financial products and services changed significantly on July 21, 2011, when the CFPB commenced
operations to supervise and enforce federal consumer protection laws. The consumer protection provisions of the Dodd-Frank Act and the examination, supervision and enforcement of those laws and implementing regulations by the CFPB have created a
more intense and complex environment for consumer finance regulation. The CFPB has significant authority to implement and enforce federal consumer protection laws and new requirements for financial services products provided for in the Dodd-Frank
Act, as well as the authority to identify and prohibit unfair, deceptive or abusive acts and practices. The review of products and practices to prevent such acts and practices have been a continuing focus of the CFPB, and of banking regulators
more broadly. The ultimate impact of this heightened scrutiny is uncertain but could result in changes to pricing, practices, products and procedures. It could also result in increased costs related to regulatory oversight, supervision and
examination, additional remediation efforts and possible penalties. The Dodd-Frank Act also provided the CFPB with broad supervisory, examination and enforcement authority over various consumer financial products and services, including the
ability to require reimbursements and other payments to customers for alleged legal violations and to impose significant penalties, as well as injunctive relief that prohibits lenders from engaging in allegedly unlawful practices. The CFPB also
has the authority to obtain cease and desist orders providing for affirmative relief or monetary penalties. The Dodd-Frank Act does not prevent states from adopting stricter consumer protection standards. State regulation of financial products
and potential enforcement actions could also adversely affect our business, financial condition or results of operations.

The CFPB is authorized to issue rules for both bank and non-bank companies that offer consumer financial products and services, subject to consultation with the prudential banking regulators. In
general, however, banks with assets of $10 billion or less, such as the Bank, will continue to be examined for consumer compliance by their primary bank regulator.

In February 2025, the director of the CFPB was dismissed by the current Trump Administration and the new Director of the Office of Management and Budget was appointed as acting director of the CFPB.
The acting director of the CFPB directed agency staff to stop virtually all work, including supervision activities and pending investigations, and announced that the CFPB would not be taking its next draw of federal funding. In May 2025, the CFPB
revoked nearly 70 guidance documents, and, since February 2025, has dismissed most of its enforcement actions. The funding of the CFPB is the subject of ongoing legal actions and disputes over the amount of funds legally available under statutory
authorities for the CFPB to request from the Federal Reserve, with Trump Administration officials, including the CFPB’s Acting Director, reportedly saying that they want to abolish the CFPB. In November 2025, in letters to Congressional
appropriators and President Trump, the CFPB’s Acting Director reported that the CFPB will run out of funds sometime during the first quarter of 2026. In January 2026, the CFPB’s Acting Director, in compliance with a December court order,
requested $145 million from the Federal Reserve; with this funding, the CFPB will be able to remain open through March 2026. It cannot be predicted at this time what impact these changes will have on the CFPB and its regulatory responsibilities
in the consumer protection area.

Notice and Approval Requirements Related to Control

Banking laws impose notice, approval and ongoing regulatory requirements on any stockholder or other party that seeks to acquire direct or indirect "control" of an FDIC-insured depository institution. These laws
include the BHCA and the Change in Bank Control Act. Among other things, these laws require regulatory filings by a stockholder or other party that seeks to acquire direct or indirect "control" of an FDIC-insured depository institution or bank
holding company. The determination whether an investor "controls" a depository institution is based on all of the facts and circumstances surrounding the investment. As a general matter, a party is deemed to control a depository institution or
other company if the party owns or controls 25% or more of any class of voting stock. Subject to rebuttal, a party may be presumed to control a depository institution or other company if the investor owns or controls 10% or more of any class of
voting stock. Ownership by family members, affiliated parties, or parties acting in concert, is typically aggregated for these purposes. If a party's ownership of the Company were to exceed certain thresholds, the investor could be deemed to
"control" the Company for regulatory purposes. This could subject the investor to regulatory filings or other regulatory consequences.

In addition, except under limited circumstances, bank holding companies are prohibited from acquiring, without prior approval:

•

control of any other bank or bank holding company or all or substantially all the assets thereof; or

•

more than 5% of the voting shares of a bank or bank holding company which is not already a subsidiary.

In September 2024, the FDIC and the Office of the Comptroller of the Currency issued new policy statements on bank merger transactions. The FDIC’s new policy statement, which supersedes the agency’s
prior policy statement and was intended to provide transparency and clarity around the FDIC’s approach to bank mergers, was opposed by the now Acting Chairman of the FDIC, who argued that this new supervisory guidance potentially makes the bank
merger process longer, more difficult and less predictable. Further, in his recent statement, the Acting Chairman of the FDIC has indicated that a matter of FDIC focus (among other things) will include improving the bank merger approval process
and replacing the 2024 Statement of Policy to ensure that merger transactions that satisfy the Bank Merger Act are approved in a timely way. At this time, it cannot be predicted whether and the extent to which this supervisory guidance might be
modified or withdrawn, or a new approach to bank merger transactions might be implemented.

Incentive Compensation

In 2010, the federal bank regulatory agencies issued comprehensive guidance intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and
soundness of those organizations by encouraging excessive risk-taking. The incentive compensation guidance sets expectations for banking organizations concerning their incentive compensation arrangements and related risk management, control and
governance processes. The incentive compensation guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon three primary
principles: (1) balanced risk-taking incentives; (2) compatibility with effective controls and risk management; and (3) strong corporate governance. Any deficiencies in compensation practices that are identified may be incorporated into the
organization’s supervisory ratings, which can affect its ability to make acquisitions or take other actions. In addition, under the incentive compensation guidance, a banking organization’s federal supervisor may initiate enforcement action if
the organization’s incentive compensation arrangements pose a risk to the safety and soundness of the organization.

In 2016, several federal financial agencies (including the Federal Reserve and FDIC) re-proposed restrictions on incentive-based compensation pursuant to Section 956 of the Dodd-Frank Act for
financial institutions with $1 billion or more in total consolidated assets.

For institutions with at least $1 billion but less than $50 billion in total consolidated assets, the proposal would impose principles-based restrictions that are broadly consistent with existing
interagency guidance on incentive-based compensation. Such institutions would be prohibited from entering into incentive compensation arrangements that encourage inappropriate risks by the institution: (i) by providing an executive officer,
employee, director, or principal shareholder with excessive compensation, fees, or benefits; or (ii) that could lead to material financial loss to the institution. The comment period for these proposed regulations has closed, but a final rule has
not been published. Depending upon the outcome of the rule making process, the application of this rule to us could require us to revise our compensation strategy, increase our administrative costs and adversely affect our ability to recruit and
retain qualified employees. Further, as discussed above, the Basel III Capital Rules limit discretionary bonus payments to bank executives if the institution’s regulatory capital ratios fail to exceed certain thresholds that started being phased
in on January 1, 2016.

Available Information

Company reports filed with the SEC, including the Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, proxy statements and ownership reports filed by directors, executive officers and principal
shareholders, can be accessed free of charge through the Company’s website at http://www.fmbonline.com, as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC. The link to the SEC is on
the About Us page. The Company’s reports may also be accessed at the SEC’s Internet website (http://www.sec.gov).