NASDAQ: ISBA

Deposit services offered include checking accounts, savings accounts, certificates of deposit, direct deposits, cash management services, mobile and internet banking, and ATMs. We also offer full-service investment management, trust, and estate services.

Competition

The banking and financial services industry is highly competitive, and we compete with a wide range of financial institutions within our markets, including local, regional, and national commercial banks and credit unions. We also compete with mortgage companies, trust companies, brokerage firms, consumer finance companies, mutual funds, securities firms, third-party payment processors, financial technology companies, and other financial intermediaries for certain of our products and services. Some of our competitors are not subject to the regulatory restrictions and level of regulatory supervision applicable to us. Many of our competitors are much larger financial institutions that have greater financial resources than we do and compete aggressively for market share. Interest rates on loans and deposits, as well as prices on fee-based services, are typically significant competitive factors within the banking and financial services industry.

Human Capital Resources

As of December 31, 2025, we had 362 full-time equivalent employees, consisting of 341 full-time employees and 38 part-time employees. We provide group life, health, accident, disability, and other insurance programs as well as a number of other employee benefit programs and management considers its employee relations to be satisfactory.

Available Information

Our SEC filings (including our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Definitive Proxy Statements, Current Reports on Form 8-K, and amendments to those reports) are available through our website (www.isabellabank.com). We will provide paper copies of our SEC reports free of charge upon request by a shareholder as soon as reasonably practicable after filing or furnishing such reports with the SEC. The information on our website address is not incorporated by reference into this report, and the information on the website is not part of this report.

The SEC maintains a website (www.sec.gov) that contains reports, proxy and information statements, and other information regarding Isabella Bank Corporation (CIK #0000842517) and other issuers.

Supervision and Regulation

The following is a general summary of the material aspects of certain statutes and regulations that are applicable to us. These summary descriptions are not complete, and you should refer to the full text of the statutes, regulations, and corresponding guidance for more information. These statutes and regulations are subject to change, and additional statutes, regulations, and corresponding guidance may be adopted. We are unable to predict these future changes or the effects, if any, that these changes could have on our business or our revenues.

General

Financial institutions and their holding companies are extensively regulated under federal and state law. Consequently, our growth and earnings performance can be affected not only by management decisions and general and local economic conditions, but also by the statutes administered by, and the regulations and policies of, various governmental regulatory authorities. Those authorities include, but are not limited to, the FRB, the FDIC, the DIFS, the Internal Revenue Service, and state taxing authorities. The effect of such statutes, regulations and policies and any changes thereto can be significant and cannot necessarily be predicted.

Federal and state laws and regulations generally applicable to financial institutions and their holding companies regulate, among other things, the scope of business, investments, reserves against deposits, capital levels, lending activities and practices, the nature and amount of collateral for loans, the establishment of branches, mergers, consolidations, and dividends. The system of supervision and regulation applicable to us establishes a comprehensive framework for our operations and is intended primarily for the protection of the FDIC’s deposit insurance fund, our depositors, and the public, rather than our shareholders.

The following is a summary of the material elements of the supervisory and regulatory framework applicable to the Corporation and the Bank. It does not describe all of the statutes, regulations, and regulatory policies that apply, nor does it restate all of the requirements of those that are described. The descriptions are qualified in their entirety by reference to the particular statutory and regulatory provision.

Capital Requirements. We and the Bank are required under federal law to maintain certain minimum capital levels based on ratios of capital to total assets and capital to risk-weighted assets. The required capital ratios are minimums, and the regulators may determine that a banking organization based on its size, complexity, or risk profile must maintain a higher level of capital in order to operate in a safe and sound manner. Risks such as concentration of credit risks and the risk arising from non-traditional activities, as well as the institution’s exposure to a decline in the economic value of its capital due to changes in interest rates, and an institution’s ability to manage those risks, are important factors that are to be taken into account in assessing an institution’s overall capital adequacy. The following is a brief description of the relevant provisions of these capital rules and their potential impact on our capital levels.

We and the Bank are subject to the following risk-based capital ratios: a Common Equity Tier 1 (“CET1”) risk-based capital ratio, a Tier 1 risk-based capital ratio, which includes CET1 and additional Tier 1 capital, and a total risk-based capital ratio, which includes Tier 1 and Tier 2 capital. CET1 is primarily comprised of the sum of common stock instruments and related surplus net of treasury stock plus retained earnings less certain adjustments and deductions, including with respect to goodwill, intangible assets, mortgage servicing assets, and deferred tax assets subject to temporary timing differences. Additional Tier 1 capital is primarily comprised of noncumulative perpetual preferred stock. Tier 2 capital consists of instruments disqualified from Tier 1 capital, including qualifying subordinated debt and a limited amount of loan loss reserves up to a maximum of 1.25% of risk-weighted assets, subject to certain eligibility criteria. The capital rules also define the risk-weights assigned to assets and off-balance sheet items to determine the risk-weighted asset components of the risk-based capital rules, including, for example, certain “high volatility” commercial real estate, past due assets, structured securities, and equity holdings.

The leverage capital ratio, which serves as a minimum capital standard, is the ratio of Tier 1 capital to quarterly average total consolidated assets net of goodwill, certain other intangible assets, and certain required deduction items. The required minimum leverage ratio for all banks and bank holding companies is 4%. In addition, effective January 1, 2019, the capital rules required a capital conservation buffer of 2.5% above each of the minimum risk-based capital ratio requirements (CET1, Tier 1, and total capital), which is designed to absorb losses during periods of economic stress. These buffer requirements must be met for a bank or bank holding company to be able to pay dividends, engage in share buybacks, or make discretionary bonus payments to executive management without restriction.

The Federal Deposit Insurance Corporation Improvement Act of 1991, as amended (“FDICIA”), among other things, requires the federal bank regulatory agencies to take “prompt corrective action” regarding depository institutions that do not meet minimum capital requirements. FDICIA establishes five regulatory capital tiers: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” A depository institution’s capital tier will depend upon how its capital levels compare to various relevant capital measures and certain other factors, as established by

regulation. FDICIA generally prohibits a depository institution from making any capital distribution (including payment of a dividend) or paying any management fee to its holding company if the depository institution would thereafter be undercapitalized. The FDICIA imposes progressively more restrictive restraints on operations, management, and capital distributions depending on the category in which an institution is classified. Undercapitalized depository institutions are subject to restrictions on borrowing from the FRB. In addition, undercapitalized depository institutions may not accept brokered deposits absent a waiver from the FDIC, are subject to growth limitations, and are required to submit capital restoration plans for regulatory approval. A depository institution’s holding company must guarantee any required capital restoration plan up to an amount equal to the lesser of 5% of the depository institution’s assets at the time it becomes undercapitalized or the amount of the capital deficiency when the institution fails to comply with the plan. Federal banking agencies may not accept a capital plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the depository institution’s capital. If a depository institution fails to submit an acceptable plan, it is treated as if it is significantly undercapitalized. To be well-capitalized, the Bank must maintain at least the following capital ratios:

•6.5% CET1 to risk-weighted assets;

•8.0% Tier 1 capital to risk-weighted assets;

•10.0% Total capital to risk-weighted assets; and

•5.0% leverage ratio.

The FRB has not yet revised the well-capitalized standard for bank holding companies to reflect the higher capital requirements imposed under the current capital rules applicable to banks. For purposes of the FRB’s Regulation Y, including determining whether a bank holding company meets the requirements to be a financial holding company, bank holding companies, such as the Corporation, must maintain a Tier 1 risk-based capital ratio of 6.0% or greater and a total risk-based capital ratio of 10.0% or greater to be well-capitalized. Also, the FRB may require bank holding companies, including the Corporation to maintain capital ratios substantially in excess of mandated minimum levels depending upon general economic conditions and a bank holding company’s particular condition, risk profile, and growth plans.

Failure to be well-capitalized or to meet minimum capital requirements could result in certain mandatory and possible additional discretionary actions by regulators that, if undertaken, could have an adverse material effect on our operations or financial condition. Failure to meet minimum capital requirements could also result in restrictions on the Corporation’s or the Bank’s ability to pay dividends or otherwise distribute capital or to receive regulatory approval of applications or other restrictions on its growth.

As of December 31, 2025, the Corporation’s and the Bank’s regulatory capital ratios were above the applicable well-capitalized standards and met the capital conservation buffer. Based on current estimates, we believe that the Corporation and the Bank will continue to exceed all applicable well-capitalized regulatory capital requirements and the capital conservation buffer in 2026.

Certain additional information concerning regulatory guidelines for capital adequacy and other regulatory matters is presented herein under the caption “Capital” in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations and in “Note 9 – Capital Ratios and Shareholders’ Equity” and “Note 14 – Off-Balance-Sheet Activities, Commitments and Other Matters” of “Notes to Consolidated Financial Statements” in Item 8. Financial Statements and Supplementary Data.

Community Bank Leverage Ratio. On September 17, 2019, the federal banking agencies jointly finalized a rule effective as of January 1, 2020 and intended to simplify the regulatory capital requirements described above for qualifying community banking organizations (“QCBO”) that opt into the Community Bank Leverage Ratio (“CBLR”) framework, as required by Section 201 of the EGRRCPA. The final rule became effective on January 1, 2020, and the CBLR framework became available for banks to use beginning with their March 31, 2020 Call Reports. Under the final rule, if a QCBO opts into the CBLR framework and meets all requirements under the framework, it will be considered to have met the well-capitalized ratio requirements under the Prompt Corrective Action regulations described below and will not be required to report or calculate risk-based capital. In order to qualify for the CBLR framework, a QCBO must have a tier 1 leverage ratio of greater than 9%, less than $10 billion in total consolidated assets, and limited amounts of off-balance-sheet exposures and trading assets and liabilities.

Although the Corporation and the Bank are QCBOs, the Corporation and the Bank have currently not elected to opt in to the CBLR framework at this time and will continue to follow the capital requirements under the Basel III Capital Rules as described above.

The Corporation

We are a financial holding company and, as such, are registered with, and subject to regulation by, the FRB under the BHC Act. Under the BHC Act, we are subject to reporting requirements, inspections, and audits. Federal law also subjects bank holding companies, such as the Corporation, to restrictions on the types of activities in which they may engage, and to a range of supervisory requirements.

Source of Strength. Under FRB policy, bank holding companies are expected to act as a source of financial strength to their bank subsidiaries and to commit resources to support those subsidiaries. The term “source of financial strength” means the ability of a company, such as us, that directly or indirectly owns or controls an insured depository institution, such as the Bank, to provide financial assistance to such insured depository institution in the event of financial distress. This support may be required by the FRB at times when, in the absence of such FRB policy, it would not otherwise be required to provide support.

Activity Limitations. Bank holding companies are generally restricted to engaging in the business of banking, managing, or controlling banks and certain other activities determined by the FRB to be closely related to banking. In addition, bank holding companies that qualify and elect to be financial holding companies may engage in any activities that are financial in nature or complementary to a financial activity and do not pose a substantial risk to the safety and soundness of depository institutions or the financial system without prior approval of the FRB. Activities that are financial in nature include securities underwriting and dealing, insurance underwriting, and making merchant banking investments. The Corporation has elected to be a financial holding company.

In order for the Corporation to maintain financial holding company status, the Bank must be categorized as “well-capitalized” and “well-managed” under applicable regulatory guidelines. If the Corporation or the Bank ceases to meet these requirements, the FRB may impose corrective capital and/or managerial requirements and place limitations on the Corporation’s ability to conduct the broader financial activities permissible for financial holding companies. In addition, if the deficiencies persist, the FRB may require the Corporation to divest of the Bank. The Bank was categorized as “well-capitalized” and “well-managed” as of December 31, 2025.

Imposition of Liability for Undercapitalized Subsidiaries. Bank regulators are required to take “prompt corrective action” to resolve problems associated with insured depository institutions whose capital declines below certain levels. In the event an institution becomes “undercapitalized,” it must submit a capital restoration plan to its regulators. The capital restoration plan will not be accepted by the regulators unless each company having control of the undercapitalized institution guarantees the subsidiary’s compliance with the capital restoration plan up to a certain specified amount. Any such guarantee from a depository institution’s holding company is entitled to a priority of payment in bankruptcy.

The aggregate liability of the holding company of an undercapitalized bank is limited to the lesser of 5% of the institution’s assets at the time it became undercapitalized or the amount necessary to cause the institution to be “adequately capitalized.” The bank regulators have greater power in situations where an institution becomes “significantly” or “critically” undercapitalized or fails to submit a capital restoration plan. For example, a bank holding company controlling such an institution can be required to obtain prior FRB approval of proposed dividends, or it may be required to consent to a consolidation or to divest the troubled institution or other affiliates.

Acquisitions. The BHC Act permits acquisitions of banks by bank holding companies, such that we and any other bank holding company, whether located in Michigan or elsewhere, may acquire a bank located in any other state, subject to certain deposit-percentage, age of bank charter requirements, and other restrictions. In general, any direct or indirect acquisition by a bank holding company of any voting shares of any bank which would result in the bank holding company’s direct or indirect ownership or control of more than 5% of any class of voting shares of such bank, and any merger or consolidation of the bank holding company with another bank holding company, will require the prior written approval of the FRB under the BHC Act. In acting on such applications, the FRB must consider various statutory factors including the effect of the proposed transaction on competition in relevant geographic and product markets and each party’s financial condition, managerial resources, and record of performance under the Community Reinvestment Act of 1977, as amended (“CRA”).

Michigan banking laws do not significantly restrict interstate banking. The Michigan Banking Code permits, in appropriate circumstances and with the approval of DIFS, (1) acquisition of Michigan banks by FDIC-insured banks, savings banks or savings and loan associations located in other states, (2) sale by a Michigan bank of branches to an FDIC-insured bank, savings bank or savings and loan association located in a state in which a Michigan bank could purchase branches of the purchasing entity, (3) consolidation of Michigan banks and FDIC-insured banks, savings banks or savings and loan associations located in other states having laws permitting such consolidation, (4) establishment of branches in Michigan by FDIC-insured banks located in other states, the District of Columbia or U.S. territories or protectorates having laws permitting a Michigan bank to establish a branch in such jurisdiction, and (5) establishment by foreign banks of branches located in Michigan.

Change in Control Limitations. Federal law restricts the amount of voting stock of a bank holding company or a bank that a person may acquire without the prior approval of banking regulators. Under the Change in Bank Control Act and the regulations thereunder, a person or group must give advance notice to the FRB before acquiring control of any bank holding company, such as the Corporation, or to the appropriate regulator before acquiring control of any FDIC-insured bank, such as the Bank. Upon receipt of such notice, the regulator may approve or disapprove the acquisition. The Change in Bank Control Act creates a rebuttable presumption of control if a person or group acquires the power to vote 10% or more of our outstanding common stock. The overall effect of such laws is to make it more difficult to acquire a bank holding company and a bank by tender offer or similar means than it might be to acquire control of another type of corporation. Consequently, shareholders of the Corporation may be less likely to benefit from the rapid increases in stock prices that may result from tender offers or similar efforts to acquire control of other companies. Investors should be aware of these requirements when acquiring shares of our stock.

Dividends. The primary sources of funds for our payment of dividends to our shareholders are cash on hand and dividends from the Bank. Various federal and state statutory provisions and regulations limit the amount of dividends that the Bank may pay. For example, a Michigan state chartered bank may not declare a cash dividend or a dividend in kind except out of net profits then on hand after deducting all losses and bad debts, and then only if it will have a surplus amounting to not less than 20% of its capital after the payment of the dividend. Moreover, a Michigan state chartered bank may not declare or pay any cash dividend or dividend in kind until the cumulative dividends on its preferred stock, if any, have been paid in full. Further, if the surplus of a Michigan state chartered bank is at any time less than the amount of its capital, before the declaration of a cash dividend or dividend in kind, it must transfer to surplus not less than 10% of its net profits for the preceding six months (in the case of quarterly or semi-annual dividends) or the preceding two consecutive six month periods (in the case of annual dividends). In addition, as a member of the FRB, the Bank is required to obtain the prior approval of the FRB for the declaration or payment of a dividend if the total of all dividends declared in any year will exceed the total of (a) the Bank’s retained net income (as defined by federal regulation) for that year, plus (b) the Bank’s retained net income for the preceding two years

The payment of dividends by the Corporation and the Bank is also affected by various regulatory requirements and policies, such as the requirement to keep adequate capital in compliance with regulatory guidelines. Federal laws impose further restrictions on the payment of dividends by insured banks that fail to meet specified capital levels. The FDIC may prevent an insured bank from paying dividends if the bank is in default of payment of any assessment due to the FDIC. In addition, payment of dividends by a bank may be prevented by the applicable federal regulatory authority if such payment is determined, by reason of the financial condition of such bank, to be an unsafe and unsound banking practice.

The FRB and the FDIC have issued policy statements providing that bank holding companies and insured banks should generally pay dividends only out of current operating earnings. The FRB has issued a policy statement that provides that a bank holding company should not pay dividends unless: (1) its net income over the last four quarters (net of dividends paid) has been sufficient to fully fund the dividends; (2) the prospective rate of earnings retention appears to be consistent with the capital needs, asset quality and overall financial condition of the bank holding company and its subsidiaries; and (3) the bank holding company will continue to meet minimum required capital adequacy ratios. Additionally, the FRB requires a bank holding company to notify the FRB prior to increasing its cash dividend by more than 10% over the prior year.

Repurchase or Redemption of Shares. A bank holding company is generally required to give the FRB prior written notice of any purchase or redemption of its own then-outstanding equity securities if the gross consideration for the purchase or redemption, when combined with the net consideration paid for all such purchases or redemptions during the preceding twelve months, is equal to 10.0% or more of the company’s consolidated net worth. The FRB may disapprove such a purchase or redemption if it determines that the proposal would constitute an unsafe and unsound practice, or would violate any law, regulation, FRB order or directive, or any condition imposed by, or written agreement with, the FRB. The FRB has adopted an exception to this approval requirement for bank holding companies that meet certain “well-capitalized” and “well-managed” standards and are not the subject of any unresolved supervisory issue.

Isabella Bank

The Bank is supervised and regulated by DIFS and the FRB. These agencies and federal and state laws extensively regulate various aspects of the banking business including, among other things, permissible types and amounts of loans, investments and other activities, capital adequacy, branching, interest rates on loans and deposits, and the safety and soundness of banking practices.

FDIC Insurance Assessments and Depositor Preference. The Bank’s deposits are insured up to applicable limits by the FDIC’s DIF and the Bank is subject to deposit insurance assessments to maintain the DIF. The FDIC assesses insurance premiums based upon a financial ratios method that takes into account asset and capital levels and supervisory ratings.

Any capital loans by a bank holding company to any of its subsidiary banks are subordinate in right of payment to deposits and to certain other indebtedness of such subsidiary bank. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to a priority of payment. This priority would apply to guarantees of capital plans under the FDICIA.

DIF Assessments. Under Michigan law, if the capital of a Michigan state chartered bank has become impaired by losses or otherwise, the Commissioner of the DIFS may require that the deficiency in capital be met by assessment upon the bank’s shareholders. Each shareholder would be responsible for a pro rata share of the deficiency, based on the amount of capital stock held by each shareholder. If an assessment is not paid by any shareholder within 30 days of the date of notice to the shareholder, sale of their stock will occur in order to pay such assessment.

Insider and Affiliate Transactions. Banking laws and regulations restrict transactions by insured banks owned by a bank holding company. These restrictions include loans to and certain purchases from the parent holding company, non-bank and bank subsidiaries of the parent holding company. Generally, these covered transactions with either the Corporation or any affiliate are limited to 10% of the Bank’s capital and surplus, and all such transactions between the Bank and the Corporation and all of its non-bank affiliates combined are limited to 20% of the Bank’s capital and surplus. Loans and other extensions of credit from the Bank to the Corporation or any affiliate generally are required to be secured by eligible collateral in specified amounts. In addition, any transaction between the Bank and the Corporation or any affiliate are required to be on an arm’s length basis. Additional restrictions apply to principal shareholders, officers, directors and their affiliates, and investments by the subsidiary bank in the shares or securities of the parent holding company (or any of the other non-bank or bank affiliates), or acceptance of such shares or securities as collateral security for loans to any borrower.

Safety and Soundness Standards. The Federal Deposit Insurance Act (“FDI Act”) requires the federal bank regulatory agencies to prescribe, by regulation or guideline, operational and managerial standards for all insured depository institutions relating to: (i) internal controls; (ii) information systems and audit systems; (iii) loan documentation; (iv) credit underwriting; (v) interest rate risk exposure; and (vi) asset quality. The federal banking agencies have adopted regulations and Interagency Guidelines Establishing Standards for Safety and Soundness to implement these required standards. These guidelines set forth the safety and soundness standards used to identify and address problems at insured depository institutions before capital becomes impaired. Under the regulations, if a regulator determines that a bank fails to meet any standards prescribed by the guidelines, the regulator may require the bank to submit an acceptable plan to achieve compliance, consistent with deadlines for the submission and review of such safety and soundness compliance plans.

Anti-Money Laundering and OFAC. The bank is subject to a number of financial recordkeeping and anti-money laundering laws and regulations including the Bank Secrecy Act of 1970 and the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001, as well as similar rules and guidelines implemented and enforced by the Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”) and the FFIEC. These laws and regulations require the bank to take certain steps to prevent the use of the bank or its systems from facilitating the flow of illegal or illicit money or terrorist funds. These regulations include FinCEN’s Customer Due Diligence Requirements for Financial Institutions, which is designed to identify and verify the identity of natural persons (known as beneficial owners) of legal entity customers who own, control and profit from companies when those companies open accounts.

The Office of Foreign Assets Control (“OFAC”), is responsible for helping to ensure that U.S. entities do not engage in transactions with certain prohibited parties, as defined by various Executive Orders and Acts of Congress. OFAC publishes lists of persons and organizations suspected of aiding, harboring or engaging in terrorist acts, known as Specially Designated Nationals and Blocked Persons. Generally, if the Bank identifies a transaction, account or wire transfer relating to a person or entity on an OFAC list, it must freeze the account or block the transaction, file a suspicious activity report and notify the appropriate authorities.

Bank regulators routinely examine institutions for compliance with these obligations and they must consider an institution’s compliance in connection with the regulatory review of applications, including applications for banking mergers and acquisitions. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing and comply with OFAC sanctions, or to comply with relevant laws and regulations, could have serious legal, reputational and financial consequences for the institution.

Anti-Tying Restrictions. In general, a bank may not extend credit, lease, sell property, or furnish any services or fix or vary the consideration for them on the condition that (i) the client obtain or provide some additional credit, property, or services from or to the bank or bank holding company or their subsidiaries or (ii) the client not obtain some other credit, property, or services from a competitor, except to the extent reasonable conditions are imposed to assure the soundness of the credit extended. A bank may, however, offer combined-balance products and may otherwise offer more favorable terms if a client obtains two or

more traditional bank products. The law also expressly permits banks to engage in other forms of tying and authorizes the FRB to grant additional exceptions by regulation or order. Also, certain foreign transactions are exempt from the general rule.

Community Reinvestment Act. The Bank is subject to the provisions of the CRA, which imposes a continuing and affirmative obligation, consistent with safe and sound operation, to help meet the credit needs of entire communities where the bank accepts deposits, including low- and moderate-income neighborhoods. The FRB’s assessment of the Bank’s CRA record is made available to the public. CRA agreements with private parties must be disclosed and annual CRA reports must be made to the FRB. Federal CRA regulations require, among other things, that evidence of discrimination against applicants on a prohibited basis and illegal or abusive lending practices be considered in the CRA evaluation. The Bank has a rating of “Satisfactory” in its most recent CRA evaluation.

On October 24, 2023, the Office of the Comptroller of the Currency (“OCC”), FRB, and FDIC issued a final rule to modernize their respective CRA regulations. The revised rules substantially alter the methodology for assessing compliance with the CRA, with material aspects taking effect January 1, 2026 and revised data reporting requirements taking effect January 1, 2027. Among other things, the revised rules evaluate lending outside traditional assessment areas generated by the growth of non-branch delivery systems, such as online and mobile banking, apply a metrics-based benchmarking approach to assessment, and clarify eligible CRA activities. The revised CRA regulations have been subject to an injunction since March 29, 2024. The effective dates will be extended for each day the injunction remains in place, pending the resolution of the lawsuit.

Cybersecurity. The federal banking agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a financial institution’s board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial products and services. The federal banking agencies expect financial institutions to establish lines of defense and ensure that their risk management processes also address the risk posed by compromised customer credentials, and also expect financial institutions to maintain sufficient business continuity planning processes to ensure rapid recovery, resumption, and maintenance of the institution’s operations after a cyber attack. If the Bank fails to meet the expectations set forth in this regulatory guidance, it could be subject to various regulatory actions and any remediation efforts may require significant resources of the Bank. In addition, all federal and state bank regulatory agencies continue to increase focus on cybersecurity programs and risks as part of regular supervisory exams.

In November 2021, the federal banking agencies approved a final rule that requires banking organizations to notify their primary regulator within 36 hours of becoming aware of a “computer-security incident” that rises to the level of a “notification incident”, among other things, the rule also requires bank service providers to notify their banking organization customers as soon as possible after becoming aware of similar incidents.

Consumer Laws and Regulations. The Bank’s business includes making a variety of types of loans to individuals. In making these loans, the Bank is subject to state usury and other consumer protection laws and to various federal statutes, including provisions of the Gramm Leach-Bliley Act aimed at protecting the privacy of consumer financial information, the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Truth in Lending Act (TILA), the Real Estate Settlement Procedures Act (RESPA), the Home Mortgage Disclosure Act, and the regulations promulgated under these statutes, which (among other things) prohibit discrimination, specify disclosures to be made to borrowers regarding credit and settlement costs, and regulate the mortgage loan servicing activities of our bank, including the maintenance and operation of escrow accounts and the transfer of mortgage loan servicing. In receiving deposits, the Bank is subject to extensive regulation under state and federal law and regulations, including the Truth in Savings Act, the Expedited Funds Availability Act, the Electronic Funds Transfer Act, and the FDI Act. Violation of these laws could result in the imposition of significant damages and fines upon the Bank and its directors and officers.

A number of consumer protection laws were implemented following the 2008 recession, including the Dodd-Frank Act. The Dodd-Frank Act created the CFPB, which was given the power to issue and enforce certain consumer protection laws. The CFPB has issued a number of consumer protection regulations, including regulations that impact residential mortgage lending and servicing.

Impact of Monetary Policies

The earnings and growth of the banking industry are affected by the credit policies of monetary authorities, including the FRB. An important function of the FRB is to regulate the national supply of bank credit in order to combat recessions and respond to inflationary pressures. Among the instruments of monetary policy used by the FRB to implement these objectives are open market operations in U.S. Treasury and U.S. Government Agency securities, changes in the discount rate on member bank borrowings, and changes in reserve requirements against member bank deposits. These methods are used in varying combinations to influence overall growth of bank loans, investments, and deposits and also affect interest rates charged on loans or paid for deposits. The monetary policies of the FRB have had a significant effect on the operating results of commercial

banks and related financial service providers in the past and are expected to continue to do so in the future. The effect of such policies upon our future business and earnings cannot be predicted.

Future Legislation and Regulation

Various other legislative and regulatory initiatives, including proposals to overhaul the bank regulatory system, are from time to time introduced in Congress and state legislatures, as well as regulatory agencies. Such future legislation regarding financial institutions may change banking statutes and our operating environment in substantial and unpredictable ways and could increase or decrease the cost of doing business, limit or expand permissible activities, or affect the competitive balance among organizations within the industry. The nature and extent of future legislative and regulatory changes affecting financial institutions is very unpredictable. We cannot determine the ultimate effect that any such potential legislation, if enacted, would have upon our financial condition or results of operations.