NYSE: NPB

In the large and fragmented mortgage marketplace, we believe we are well-positioned as a specialty bank that uses a widely accepted and growing digitally-enabled platform to serve the borrowing and payment needs of increasingly sophisticated mortgage warehouse clients and the rapidly evolving demands of professional mortgage originators and retail borrowers.

We have strategically built our primary business channels to provide us with synergies across our lines of business. We believe this approach offers us substantial insulation from cyclical economic changes, credit swings and rate volatility. Within our lines of business, we pursue very focused strategies that we believe have (1) historically proven to be well received by borrowers, (2) allowed us to differentiate ourselves from the competition and (3) resulted in strong financial performance during high volume cycles and durable performance during low volume cycles. We believe our platform has been able to dynamically and profitably scale up and down with the changes in volume in the mortgage industry. We have demonstrated an ability to generate and scale revenues while proactively managing variable costs and containing fixed costs, resulting in attractive financial results. As evidence of our platform’s proactive adaptability, we completed our strategic repositioning efforts over 23 months starting in 2022, which included the following: (i) quickly exiting the correspondent lending business as margins declined in the sector, (ii) entering into private- labelled subservicing agreements for non-specialized mortgage products, such as conforming agency mortgage loans, and (iii) remixing our available lending capacities by (a) increasing Mortgage Purchase Program clients and balances as other lenders exited the sector and (b) holding more specialized residential loan products. These actions resulted in long-term cost reductions that outpaced revenue reduction which, in combination with increased yields on assets, delivered strong performance metrics and substantial growth in profitability for 2025 compared to 2024. These strategic actions are consistent with our rate, liquidity and credit risk strategies.

Business Segments

We offer financial products and services through our two primary business segments, Mortgage Purchase Program and Retail Banking.

Mortgage Purchase Program (“MPP”). Through our Mortgage Purchase Program business (which we refer to as “MPP”), we provide independent mortgage banking platforms nationwide with an alternative to traditional mortgage warehouse lending. MPP utilizes a collateralized mortgage purchase facility, marketed to independent mortgage bankers nationwide. These facilities enable our MPP clients to close and fund their mortgages and during a relatively short period (typically less than 30 days), the originated loans are sold into the secondary market via government agencies (Fannie Mae, Freddie Mac or Ginnie Mae) or institutional investors (banks, large mortgage companies, insurance companies, mortgage REIT’s) or are securitized. Our MPP facilities provide a key source of liquidity to the residential mortgage marketplace.

Retail Banking. Our Retail Banking business includes residential lending, digital deposit banking and loan servicing.

(a)Residential Lending. Our residential lending division provides a comprehensive range of financing options for home purchases and refinancing, serving borrowers nationwide through two main channels: Consumer Direct and Traditional Retail. These channels combine the convenience of online, self-service platforms with the personalized service of traditional, referral-based interactions. Through our point of sale platform, borrowers can easily apply for loans, upload documents, speak with loan officers, track progress, and make payments — all from one secure, user-friendly interface. Northpointe offers a broad spectrum of loan programs, including conventional, government, and non-Qualified Mortgage (“QM”) loans, catering to a wide variety of borrowers’ needs. As a direct seller/servicer to Fannie Mae, Freddie Mac, Ginnie Mae and other end investors, we ensure competitive rates and efficient processing. With a focus on speed, quality, and client satisfaction, we leverage our customized technology in our underwriting process, leading to faster decisions and document delivery.

We also specialize in the origination and servicing of first-lien home equity lines which are tied seamlessly to a demand deposit sweep account through our proprietary technology (we commonly refer to these loans as “All-in-One” or “AIO” loans). These first-lien home equity lines combine the benefits of a revolving equity line of credit, a market rate cost of a first mortgage and the sweep benefits of a deposit account. The borrower benefits through reduced interest charges on the credit line as a result of the daily sweep from the linked bank checking account.

Our digitized loan origination processes give borrowers and origination professionals easy access to our proprietary application and point-of-sale support features to quickly, intelligently, and securely gather personal and loan information. Borrowers also have access to account advisors to help borrowers on their journey when they need human assistance. We believe our processes have allowed us to improve upon traditional mortgage offering with products advancements such as: Lock & Shop, Temporary Buydown, TrueApproval, Delayed Financing, and Rate Refresh along with Jumbo, Renovation, traditional HELOC, VA Loans and our first-lien home equity loans.

(b)Digital Deposit Banking. Our automated account opening, direct to customer deposit platform and product suite provide our depositors with effective, competitive, modern digital banking services and provide us with reliable access to deposit funding. We offer and utilize the full spectrum of deposit products, including noninterest- bearing accounts, savings, money-market demand accounts; but we typically focus upon term CDs. Our digital platform (supported by one central branch) offers very competitive rates (typically priced in the top 25 of average nationwide industry deposit rates for similar maturities) that allow us to attract deposits at an attractive all-in cost to us. We successfully compete with other digital-only banks by offering a simple online account opening experience, friendly features such as ATM fee rebates, no/low overdraft fees and a dynamic mobile banking solution. In addition to retail deposits, we offer commercial deposits which are primarily noninterest bearing custodial deposits related to our loan servicing business or deposits from our MPP clients.

(c)Loan Servicing. We service and sub-service specialized loans on behalf of our borrowers and investors, which includes a monthly fee paid by the investor. In 2024, we refined our servicing strategy to focus solely on in-house servicing of select loan types such as first-lien home equity lines which are tied seamlessly to a demand deposit sweep account through our proprietary technology; and the private label outsourcing of non-specialized mortgage servicing to a scaled sub-servicer. Our servicing duties include handling the recording, acceptance, and remittance of principal and interest payments from borrowers, holding FDIC-insured deposits, calculating variable rate interest payments, as well as the administration of taxes, insurance and escrow payments, as applicable; and may also include negotiations of loan workouts and modifications upon default or other proceedings. Critical to the success of our servicing platform is being an approved seller/servicer for the largest government-related mortgage agencies (Federal National Mortgage Association “FNMA”, Federal Home Loan Mortgage Corporation “FHLMC”, Federal Home Loan Bank “FHLB”) as well as being rated by a third-party rating agency (Fitch) as a qualified servicer for investor-owned securitizations and other non-agency products.

Market Area

While our headquarters is located in Grand Rapids, Michigan, our market area is nationwide. Our delivery systems are primarily digital, enabling clients across all 50 states and the District of Columbia to access our mortgage and deposit products. In addition to our digital platform, we operate loan production offices in 25 cities across 15 states, which support our lending activities and are backed by our centralized operating center in Grand Rapids. This structure allows us to efficiently serve a geographically diverse customer base and participate broadly in the national residential mortgage market.

Competition

We compete in a number of areas, including deposit banking, residential mortgage lending and servicing, and mortgage warehouse lending. These industries are highly competitive, and our Bank faces strong direct competition for loans and deposits. We compete with other nondepository financial institutions and community banks, thrifts and credit unions. In

addition, we compete with large banks and other financial intermediaries, such as consumer finance companies, mortgage banking companies, and online banks. Competition from financial technology (“fintech”) companies and technology-enabled financial service providers has also increased and continues to intensify as these providers offer digital-first platforms for lending, payments, and deposit-like products that may compete directly with traditional banking services.

Continued consolidation and rapid technological changes within the financial services industry will likely change the nature and intensity of competition, but also will create opportunities for the Company to demonstrate and leverage its competitive advantages. The continuing consolidation within the financial services industry is leading to larger, better capitalized and geographically diverse institutions with enhanced product and technology capabilities. Additionally, competition from fintechs is increasing. In addition to fintechs, certain technology companies are working to provide financial services directly to their customers. These nontraditional financial service providers have been successful in developing digital and other products and services that effectively compete with traditional banking services, but are in some cases subject to fewer regulatory restrictions than banks and bank holding companies, allowing them to operate with greater flexibility and lower cost structures.

Fintech companies, digital payment platforms, and other non‑bank financial service providers increasingly offer alternatives to traditional bank deposits and payment services, which may reduce customer reliance on traditional banking relationships and contribute to deposit disintermediation. Advances in real‑time payments and customer expectations for instantaneous funds availability may further intensify competitive pressures on banks, particularly those offering digital deposit products. Certain fintech competitors may also benefit from operating under different regulatory frameworks or reduced capital, liquidity, or supervisory requirements, which can allow for faster product development cycles, lower operating costs, or more flexible pricing relative to traditional banks.

Competitors include not only financial institutions based in Michigan, but also a number of large out-of-state and foreign banks, bank holding companies and other financial institutions that have an established market presence in Michigan or that offer internet-based products. Many of the Company's competitors are engaged in local, regional, national and international operations and have greater assets, personnel and other resources. Some of these competitors are subject to less regulation and/or more favorable tax treatment. Many of these institutions have greater resources, broader geographic markets and higher lending limits, and may offer services that the Company does not offer. In addition, these institutions may be able to better afford and make broader use of media advertising, support services, and electronic and other technology. To offset these potential competitive disadvantages, the Company depends on its reputation for superior service, ability to make credit and other business decisions quickly, and the delivery of an integrated distribution of a traditional branch and bankers, with digital technology. We believe that the range and quality of products that we offer, the knowledge of our personnel and our emphasis on building long-lasting relationships sets us apart from our competitors.

Risk Management

We believe that effective risk management and control processes are critical to our safety and soundness, our ability to predict and manage the challenges that we face and, ultimately, our long-term corporate success. Risk management refers to the activities by which we identify, measure, monitor, evaluate and manage the risks we face in the course of our banking activities. These include liquidity, interest rate, credit, operational, compliance, regulatory, strategic, financial and reputational risk exposures. Our board of directors, both directly and through its committees, is responsible for overseeing our risk management processes, including routinely conducting enterprise risk management assessments, cyber, BSA/anti-money laundering and third-party risk assessments, with each of the committees of our board of directors assuming a different and important role in overseeing the management of the risks we face. Our risk management processes are designed to address both existing and emerging risks, including those arising from changes in economic conditions, technology, cybersecurity threats, third-party relationships and the evolving regulatory environment.

The Audit Committee of our board of directors is responsible for overseeing risks associated with financial matters (particularly financial reporting, accounting practices and policies, disclosure controls and procedures and internal control over financial reporting). The Compensation Committee of our board of directors has primary responsibility for risks and exposures associated with our compensation policies, plans and practices, regarding both executive compensation and our compensation structure generally. In particular, our Compensation Committee, in conjunction with our President and our Chief Executive Officer and other members of our management, as appropriate, reviews our incentive compensation arrangements to ensure these programs are consistent with applicable laws and regulations, including safety and soundness requirements, and do not encourage imprudent or excessive risk-taking by our employees. The Corporate Governance and Nominating Committee of our board of directors oversees risks associated with the independence of our board of directors and potential conflicts of interest.

Our senior management is responsible for implementing our risk management processes, including by assessing and managing the risks we face, including strategic, operational, regulatory, investment and execution risks, on a day-to-day basis, and reporting to our board of directors regarding our risk management processes. Our senior management is also responsible for creating and recommending to our board of directors for approval appropriate risk appetite metrics reflecting the aggregate levels and types of risk we are willing to accept in connection with the operation of our business and pursuit of our business objectives.

The role of our board of directors in our risk oversight is consistent with our leadership structure, with our President, Chief Financial Officer and Chief Executive Officer, along with the other members of senior management having responsibility for assessing and managing our risk exposure, and our board of directors and its committees providing oversight in connection with those efforts. We believe this division of risk management responsibilities presents a consistent, systemic and effective approach for identifying, managing and mitigating risks throughout our operations.

Properties

Our principal executive office is located at 3333 Deposit Drive Northeast, Grand Rapids, Michigan 49546. In addition to our principal executive office, we operate loan production offices across 25 cities in 15 states that are supported through our centralized operating center in Grand Rapids, Michigan.

Human Capital

To facilitate talent attraction and retention, we strive to create an inclusive, safe and healthy workplace with opportunities for our employees to grow and develop in their careers, supported by strong compensation, benefits and health and welfare programs.

Employee Profile

As of December 31, 2025, we had 483 full-time employees and 8 part-time employees. None of our employees are covered by a collective bargaining agreement. We consider our relationship with our employees to be good and have not experienced interruptions of operations due to labor disagreements.

Compensation and Benefits

We provide a competitive compensation and benefits program to help meet the needs of our employees. Our compensation programs are designed to be market-competitive and performance-based, while remaining consistent with applicable laws, regulations and safety and soundness considerations. In addition to salaries, these programs include annual bonus opportunities, a 401(k) plan with an employer matching contribution, healthcare and insurance benefits, flexible spending accounts, paid time off and family leave and an employee assistance program. Restricted stock awards are also available to certain employees.

Learning and Development

We invest in the growth and development of our employees by providing a multi-dimensional approach to learning that empowers, intellectually grows, and professionally develops our colleagues. In particular, we facilitate the educational and professional development of our employees through support to attend conferences and obtain degrees, licenses and certifications while employed by us.

Corporate Information

Our principal executive offices are located at 3333 Deposit Drive Northeast, Grand Rapids, Michigan 49546, and our telephone number at that address is (616) 940-9400. Our website address is www.northpointe.com. The information contained on our website is not a part of, or incorporated by reference into this Form 10-K.

Public Information

Persons interested in obtaining information on the Company may read and copy any materials that we file with the U.S. Securities and Exchange Commission ("SEC"). The Commission maintains an Internet site that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC at www.sec.gov. We make available, free of charge, on or through our website, https://ir.northpointe.com/, our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and other filings pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, and amendments to such filings, as soon as reasonably practicable after each is electronically filed with, or furnished to, the SEC.

Also available on the Company's website are its Code of Business Conduct and Ethics, Corporate Governance Guidelines, the charter of each active committee of the Board of Directors, and other materials outlining the Company's corporate governance practices.

SUPERVISION AND REGULATION

We are extensively regulated under federal and state law. The following is a brief summary that does not purport to be a complete description of all regulations that affect us or all aspects of those regulations. This discussion is qualified in its entirety by reference to the particular statutory and regulatory provisions described below and is not intended to be an exhaustive description of the statutes or regulations applicable to the Company’s and the Bank’s business. In addition, proposals to change the laws and regulations governing the banking industry are frequently raised at both the state and federal levels. The likelihood and timing of any changes in these laws and regulations, and the impact such changes may have on us and the Bank, are difficult to predict. Regulatory agencies may issue enforcement actions, policy statements, interpretive letters, and similar written guidance applicable to us or to the Bank. Changes in applicable laws, regulations, or regulatory guidance, or their interpretation by regulatory agencies or courts may have a material adverse effect on our and the Bank’s business, operations, and earnings.

We, the Bank, and in some cases, our nonbank affiliates, must undergo regular examinations by the appropriate regulatory agency, which will examine for adherence to a range of legal and regulatory compliance responsibilities. A bank regulator conducting an examination has complete access to the books and records of the examined institution. The results of the examination are confidential. Supervision and regulation of banks, their holding companies, and affiliates is intended primarily for the protection of depositors and clients, the Deposit Insurance Fund (“DIF”) of the FDIC, and the U.S. banking and financial system rather than holders of our securities.

Regulation of the Company

We are registered as a bank holding company with the Federal Reserve under the BHC Act. As such, we are subject to comprehensive supervision and regulation by the Federal Reserve and are subject to its regulatory reporting requirements. Federal law subjects bank holding companies, such as the Company, to restrictions on the types of activities in which they may engage, and to a range of supervisory requirements. Various federal and state bodies regulate and supervise our non-bank activities including our trust and insurance agency activities.

Violations of laws and regulations, or other unsafe and unsound practices, may result in regulatory agencies imposing fines or penalties, cease and desist orders, or taking other enforcement actions. Under certain circumstances, these agencies may enforce remedies directly against officers, directors, employees, and other parties participating in the affairs of a bank or bank holding company. Under federal and state laws and regulations pertaining to the safety and soundness of insured depository institutions, state banking regulators, the Federal Reserve, and separately the FDIC as the insurer of bank deposits have the authority to compel or restrict certain actions on our part if they determine that we have insufficient capital or other resources, or are otherwise operating in a manner that may be deemed to be inconsistent with safe and sound banking practices. Under this authority, our regulators can require us or our subsidiary to enter into informal or formal supervisory agreements, including board resolutions, memoranda of understanding, written agreements, and consent or cease and desist orders pursuant to which we would be required to take identified corrective actions to address cited concerns and to refrain from taking certain actions.

If we become subject to and are unable to comply with the terms of any regulatory actions or directives, supervisory agreements or orders, then we could become subject to additional, heightened supervisory actions and orders, possibly including prompt corrective action restrictions and/or other regulatory actions, including prohibitions on the payment of dividends on our common stock and preferred stock. If our regulators were to take such supervisory actions, then we could, among other things, become subject to significant restrictions on our ability to develop any new business, as well as restrictions on our existing business, and we could be required to raise additional capital, dispose of certain assets and liabilities within a prescribed period of time, or both. The terms of any such action could have a material negative effect on our business, reputation, operating flexibility, financial condition, and the value of our common stock and preferred stock.

Activity Limitations

Bank holding companies are generally restricted to engaging in the business of banking, managing or controlling banks and certain other activities determined by the Federal Reserve to be closely related to banking. In addition, the Federal Reserve has the power to order a bank holding company or its subsidiaries to terminate any nonbanking activity or terminate its ownership or control of any nonbank subsidiary when it has reasonable cause to believe that continuation of such activity or such ownership or control constitutes a serious risk to the financial safety, soundness, or stability of any bank subsidiary of that bank holding company.

Source of Strength Obligations

A bank holding company, such as us, is required to act as a source of financial and managerial strength to its subsidiary bank. The term “source of financial strength” means the ability of a company, such as us, that directly or indirectly owns or controls an insured depository institution, such as the Bank, to provide financial assistance to such insured depository institution in the event of financial distress. The appropriate federal banking agency for the depository institution (in the case of the Bank, this agency is the FDIC) may require reports from us to assess our ability to serve as a source of strength and to enforce compliance with the source of strength requirements by requiring us to provide financial assistance to the Bank in the event of financial distress. If we were to enter bankruptcy or become subject to the orderly liquidation process established by the Dodd-Frank Act, any commitment by us to a federal bank regulatory agency to maintain the capital of the Bank would be assumed by the bankruptcy trustee or the FDIC, as appropriate, and entitled to a priority of payment. In addition, the FDIC provides that any insured depository institution generally will be liable for any loss incurred by the FDIC in connection with the default of, or any assistance provided by the FDIC to, a commonly controlled insured depository institution. The Bank is an FDIC-insured depository institution and thus subject to these requirements.

Acquisitions

The BHC Act permits acquisitions of banks by bank holding companies, such that we and any other bank holding company, whether located in Michigan or elsewhere, may acquire a bank located in any other state, subject to certain deposit-percentage, age of bank charter requirements, and other restrictions. The BHC Act requires that a bank holding company obtain the prior approval of the Federal Reserve before (i) acquiring direct or indirect ownership or control of more than 5% of the voting shares of any additional bank or bank holding company, (ii) taking any action that causes an additional bank or bank holding company to become a subsidiary of the bank holding company, or (iii) merging or consolidating with any other bank holding company. The Federal Reserve may not approve any such transaction that would result in a monopoly or would be in furtherance of any combination or conspiracy to monopolize or attempt to monopolize the business of banking in any section of the United States, or the effect of which may be substantially to lessen competition or to tend to create a monopoly in any section of the country, or that in any other manner would be in restraint of trade unless the anticompetitive effects of the proposed transaction are clearly outweighed in the public interest by the probable effect of the transaction in meeting the convenience and needs of the community to be served. The Federal Reserve is also required to consider: (i) the financial and managerial resources of the companies involved, including pro forma capital ratios; (ii) the risk to the stability of the United States banking or financial system; (iii) the convenience and needs of the communities to be served, including performance under the CRA; and (iv) the effectiveness of the company in combating money laundering.

Change in Control

Federal law restricts the amount of voting stock of a bank holding company or a bank that a person may acquire without the prior approval of banking regulators. Under the Change in Bank Control Act and the regulations thereunder, a person or group must give advance notice to the Federal Reserve before acquiring control of any bank holding company, such as the Company, or to the appropriate regulator before acquiring control of any FDIC-insured bank, such as the Bank. Upon receipt of such notice, the regulator may approve or disapprove the acquisition. The Change in Bank Control Act creates a rebuttable presumption of control if a person or group acquires the power to vote 10% or more of our outstanding common stock. The overall effect of such laws is to make it more difficult to acquire a bank holding company and a bank by tender offer or similar means than it might be to acquire control of another type of corporation. Consequently, stockholders of the Company may be less likely to benefit from the rapid increases in stock prices that may result from tender offers or similar efforts to acquire control of other companies. Investors should be aware of these requirements when acquiring shares of our stock.

Repurchase or Redemption of Shares

A BHC is generally required to give the Federal Reserve prior written notice of any purchase or redemption of its own then-outstanding equity securities if the gross consideration for the purchase or redemption, when combined with the net consideration paid for all such purchases or redemptions during the preceding twelve months, is equal to 10.0% or more of the company’s consolidated net worth. The Federal Reserve may disapprove such a purchase or redemption if it determines that the proposal would constitute an unsafe and unsound practice, or would violate any law, regulation, Federal Reserve order or

directive, or any condition imposed by, or written agreement with, the Federal Reserve. The Federal Reserve has adopted an exception to this approval requirement for BHCs that meet certain “well-capitalized” and “well-managed” standards and are not the subject of any unresolved supervisory issue.

Incentive Compensation

The Dodd-Frank Act required the federal banking agencies and the SEC to establish joint rules or guidelines for financial institutions with more than $1 billion in assets, such as us and the Bank, which prohibit incentive compensation arrangements that the agencies determine to encourage inappropriate risks by the institution. The federal banking agencies issued proposed rules in 2011 and previously issued guidance on sound incentive compensation policies. In 2016, the federal banking agencies and the SEC proposed rules that would, depending upon the assets of the institution, directly regulate incentive compensation arrangements and would require enhanced oversight and recordkeeping. As of December 31, 2025, these rules have not been implemented, although the SEC did adopt final rules implementing the clawback provisions of the Dodd-Frank Act in 2022. We and the Bank have undertaken efforts to ensure that our incentive compensation plans do not encourage inappropriate risks, consistent with three key principles - that incentive compensation arrangements should appropriately balance risk and financial rewards, be compatible with effective controls and risk management, and be supported by strong corporate governance.

Capital Requirements

We and the Bank are required under federal law to maintain certain minimum capital levels based on ratios of capital to total assets and capital to risk-weighted assets. The required capital ratios are minimums, and the regulators may determine that a banking organization based on its size, complexity, or risk profile must maintain a higher level of capital in order to operate in a safe and sound manner. Risks such as concentration of credit risks and the risk arising from non-traditional activities, as well as the institution’s exposure to a decline in the economic value of its capital due to changes in interest rates, and an institution’s ability to manage those risks, are important factors that are to be taken into account in assessing an institution’s overall capital adequacy. The following is a brief description of the relevant provisions of these capital rules and their potential impact on our capital levels.

We and the Bank are subject to the following risk-based capital ratios: a CET1 risk-based capital ratio, a Tier 1 risk-based capital ratio, which includes CET1 and additional Tier 1 capital, and a total risk-based capital ratio, which includes Tier 1 and Tier 2 capital. CET1 is primarily comprised of the sum of common stock instruments and related surplus net of treasury stock plus retained earnings less certain adjustments and deductions, including with respect to goodwill, intangible assets, mortgage servicing assets, and deferred tax assets subject to temporary timing differences. Additional Tier 1 capital is primarily comprised of noncumulative perpetual preferred stock. Tier 2 capital consists of instruments disqualified from Tier 1 capital, including qualifying subordinated debt and a limited amount of loan loss reserves up to a maximum of 1.25% of risk-weighted assets, subject to certain eligibility criteria. The capital rules also define the risk-weights assigned to assets and off-balance sheet items to determine the risk-weighted asset components of the risk-based capital rules, including, for example, certain “high volatility” commercial real estate, past due assets, structured securities, and equity holdings.

The leverage capital ratio, which serves as a minimum capital standard, is the ratio of Tier 1 capital to quarterly average total consolidated assets net of goodwill, certain other intangible assets, and certain required deduction items. The required minimum leverage ratio for all banks and bank holding companies is 4%.

In addition, effective January 1, 2019, the capital rules required a capital conservation buffer of 2.5% above each of the minimum risk-based capital ratio requirements (CET1, Tier 1, and total capital), which is designed to absorb losses during periods of economic stress. These buffer requirements must be met for a bank or bank holding company to be able to pay dividends, engage in share buybacks, or make discretionary bonus payments to executive management without restriction.

The FDICIA, among other things, requires the federal bank regulatory agencies to take “prompt corrective action” regarding depository institutions that do not meet minimum capital requirements. FDICIA establishes five regulatory capital tiers: “well capitalized”, “adequately capitalized”, “undercapitalized”, “significantly undercapitalized”, and “critically undercapitalized”. A depository institution’s capital tier will depend upon how its capital levels compare to various relevant capital measures and certain other factors, as established by regulation. FDICIA generally prohibits a depository institution from making any capital distribution (including payment of a dividend) or paying any management fee to its holding company if the depository institution would thereafter be undercapitalized. The FDICIA imposes progressively more restrictive restraints on operations, management, and capital distributions depending on the category in which an institution is classified. Undercapitalized depository institutions are subject to restrictions on borrowing from the Federal Reserve System. In addition, undercapitalized depository institutions may not accept brokered deposits absent a waiver from the FDIC, are subject to growth limitations, and are required to submit capital restoration plans for regulatory approval. A depository institution's holding company must guarantee any required capital restoration plan up to an amount equal to the lesser of 5% of the depository institution's assets at

the time it becomes undercapitalized or the amount of the capital deficiency when the institution fails to comply with the plan. Federal banking agencies may not accept a capital plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the depository institution's capital. If a depository institution fails to submit an acceptable plan, it is treated as if it is significantly undercapitalized.

To be well-capitalized, the Bank must maintain at least the following capital ratios:

•6.5% CET1 to risk-weighted assets;

•8.0% Tier 1 capital to risk-weighted assets;

•10.0% Total capital to risk-weighted assets; and

•5.0% leverage ratio.

The Federal Reserve has not yet revised the well-capitalized standard for bank holding companies to reflect the higher capital requirements imposed under the current capital rules applicable to banks. For purposes of the Federal Reserve’s Regulation Y, including determining whether a bank holding company meets the requirements to be a financial holding company, bank holding companies, such as the Company, must maintain a Tier 1 risk-based capital ratio of 6.0% or greater and a total risk-based capital ratio of 10.0% or greater to be well-capitalized. Also, the Federal Reserve may require bank holding companies, including the Company, to maintain capital ratios substantially in excess of mandated minimum levels depending upon general economic conditions and a bank holding company’s particular condition, risk profile, and growth plans.

Failure to be well-capitalized or to meet minimum capital requirements could result in certain mandatory and possible additional discretionary actions by regulators that, if undertaken, could have an adverse material effect on our operations or financial condition. Failure to meet minimum capital requirements could also result in restrictions on the Company’s or the Bank’s ability to pay dividends or otherwise distribute capital or to receive regulatory approval of applications or other restrictions on its growth.

As of December 31, 2025, the Company’s and the Bank’s regulatory capital ratios were above the applicable well-capitalized standards and met the capital conservation buffer. Based on current estimates, we believe that the Company and the Bank will continue to exceed all applicable well-capitalized regulatory capital requirements and the capital conservation buffer in 2026.

Additional information on our capital ratios may be found in Item 7 of this report under the heading "Capital Resources" included in "Management’s Discussion and Analysis of Results of Operations and Financial Condition" and in Item 8 of this report in the Notes to the Consolidated Financial Statements.

Payment of Dividends

We are a legal entity separate and distinct from the Bank. The primary sources of funds for our payment of dividends to our stockholders are cash on hand and dividends from the Bank. Various federal and state statutory provisions and regulations limit the amount of dividends that the Bank may pay. Under Michigan law, banks may not declare dividends out of capital or surplus. The Bank may only declare dividends on its common stock out of net income on hand, after deducting losses and bad debts, and provided the bank will have a surplus of 20.0% or more of its capital after payment of the proposed dividend. Moreover, a bank must transfer to surplus at least 10.0% of its net income (a) for the prior six months, in the case of quarterly or semiannual dividends or (b) for the two prior six-month periods, in the case of annual dividends.

In addition, we and the Bank are subject to various general regulatory policies and requirements relating to the payment of dividends, including requirements to maintain adequate capital above regulatory minimums. The FDIC has indicated that paying dividends that deplete a bank’s capital base to an inadequate level would be an unsafe and unsound banking practice. The Federal Reserve has indicated that holding companies should generally pay dividends only out of current operating earnings.

Under a Federal Reserve policy adopted in 2009, the board of directors of a bank holding company must consider different factors to ensure that its dividend level is prudent relative to maintaining a strong financial position and is not based on overly optimistic earnings scenarios, such as potential events that could affect its ability to pay, while still maintaining a strong financial position. As a general matter, the Federal Reserve has indicated that the board of directors of a bank holding company should consult with the Federal Reserve and eliminate, defer, or significantly reduce the bank holding company’s dividends if:

•its net income available to stockholders for the past four quarters, net of dividends previously paid during that period, is not sufficient to fully fund the dividends;

•its prospective rate of earnings retention is not consistent with its capital needs and overall current and prospective financial condition; or

•it will not meet, or is in danger of not meeting, its minimum regulatory capital adequacy ratios.

Additional information about restrictions on payment of dividends by the Bank may be found in Item 8 of this report in the Notes to the Consolidated Financial Statements.

Regulation of the Bank

The Bank is subject to comprehensive supervision and regulation by the FDIC, and is subject to its regulatory reporting requirements, as well as supervision and regulation by the DIFS.

Broadly, regulations applicable to the Bank include limitations on loans to a single borrower and to its directors, officers, and employees; restrictions on the opening and closing of branch offices; the maintenance of required capital ratios; the granting of credit under equal and fair conditions; the disclosure of the costs and terms of such credit; requirements to maintain reserves against deposits and loans; limitations on the types of investment that may be made by the Bank; and requirements governing risk management practices. Subject to FDIC approval and certain state filing requirements, the Bank is permitted under federal law to branch on a de novo basis across state lines wherever the laws of that state would permit a bank chartered by that state to establish a branch.

Transactions with Affiliates and Insiders

The Bank is subject to restrictions on extensions of credit and certain other transactions between the Bank and the Company or any nonbank affiliate as defined. Generally, these covered transactions with either the Company or any affiliate are limited to 10% of the Bank’s capital and surplus, and all such transactions between the Bank and the Company and all of its nonbank affiliates combined are limited to 20% of the Bank’s capital and surplus. Loans and other extensions of credit from the Bank to the Company or any affiliate generally are required to be secured by eligible collateral in specified amounts. In addition, any transaction between the Bank and the Company or any affiliate is required to be on an arm’s length basis. Federal banking laws also place similar restrictions on certain extensions of credit by insured banks, such as the Bank, to their directors, executive officers, and principal stockholders.

FDIC Insurance Assessments and Depositor Preference

The Bank’s deposits are insured by the FDIC’s DIF up to the limits under applicable law, which currently are set at $250,000 per depositor, per insured bank, for each account ownership category. The Bank is subject to FDIC assessments for its deposit insurance. The FDIC calculates quarterly deposit insurance assessments based on an institution’s average total consolidated assets less its average tangible equity and applies one of four risk categories determined by reference to its capital levels, supervisory ratings, and certain other factors. The assessment rate schedule can change from time to time, at the discretion of the FDIC, subject to certain limits.

As of June 30, 2020, the DIF reserve ratio fell to 1.30%, below the statutory minimum of 1.35%. The FDIC, as required under the Federal Deposit Insurance Act, established a plan on September 15, 2020 to restore the DIF reserve ratio to meet or exceed the statutory minimum of 1.35% within eight years. On October 18, 2022, the FDIC adopted an amended restoration plan to increase the likelihood that the reserve ratio would be restored to at least 1.35% by September 30, 2028. The FDIC's amended restoration plan increases the initial base deposit insurance assessment rate schedules uniformly by 2 bps, beginning in the first quarterly assessment period of 2023. The FDIC could further increase the deposit insurance assessments for certain insured depository institutions, including the Bank, if the DIF reserve ratio is not restored as projected.

In November 2023, the FDIC approved a final rule to implement a special assessment to recover the loss to the DIF associated with several bank failures that occurred during early 2023. The assessment base for the special assessment is equal to estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion, to be collected at an annual rate of approximately 13.4 basis points for an anticipated total of eight quarterly assessment periods, beginning the first quarterly assessment period of 2024. Based on current information and assumptions, we estimate our annual assessment rate to be 13 basis points in 2026.

Insurance of deposits may be terminated by the FDIC upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by a bank’s federal regulatory agency. In addition, the Federal Deposit Insurance Act provides that, in the event of the liquidation or other resolution of an insured depository institution, the claims of depositors of the institution,

including the claims of the FDIC as subrogee of insured depositors, and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution, including those of the parent bank holding company.

Standards for Safety and Soundness

The Federal Deposit Insurance Act requires the federal bank regulatory agencies to prescribe, by regulation or guideline, operational and managerial standards for all insured depository institutions relating to: (i) internal controls; (ii) information systems and audit systems; (iii) loan documentation; (iv) credit underwriting; (v) interest rate risk exposure; and (vi) asset quality. The federal banking agencies have adopted regulations and Interagency Guidelines Establishing Standards for Safety and Soundness to implement these required standards. These guidelines set forth the safety and soundness standards used to identify and address problems at insured depository institutions before capital becomes impaired. Under the regulations, if a regulator determines that a bank fails to meet any standards prescribed by the guidelines, the regulator may require the bank to submit an acceptable plan to achieve compliance, consistent with deadlines for the submission and review of such safety and soundness compliance plans.

Anti-Money Laundering

A continued focus of governmental policy relating to financial institutions in recent years has been combating money laundering and terrorist financing. The USA PATRIOT Act broadened the application of anti-money laundering regulations to apply to additional types of financial institutions such as broker-dealers, investment advisors, and insurance companies, and strengthened the ability of the U.S. government to help prevent, detect and prosecute international money laundering and the financing of terrorism. The principal provisions of Title III of the USA PATRIOT Act require that regulated financial institutions, including state banks: (i) establish an anti-money laundering program that includes training and audit components; (ii) comply with regulations regarding the verification of the identity of any person seeking to open an account; (iii) take additional required precautions with non-U.S. owned accounts; and (iv) perform certain verification and certification of money laundering risk for their foreign correspondent banking relationships. Failure of a financial institution to comply with the USA PATRIOT Act’s requirements could have serious legal and reputational consequences for the institution. The Bank has augmented its systems and procedures to meet the requirements of these regulations and will continue to revise and update its policies, procedures, and controls to reflect changes required by law.

FinCEN has adopted rules that require financial institutions to obtain beneficial ownership information with respect to legal entities with which such institutions conduct business, subject to certain exclusions and exemptions. FinCEN has adopted a beneficial ownership information reporting framework under the Corporate Transparency Act, which has been subject to subsequent regulatory modifications and currently applies on a limited basis, and financial institutions continue to be subject to existing customer due diligence requirements under applicable law. Bank regulators are focusing their examinations on anti-money laundering compliance, and we continue to monitor and augment, where necessary, our anti-money laundering compliance programs. Banking regulators will consider compliance with the USA PATRIOT Act’s money laundering provisions in acting upon merger and acquisition proposals. Bank regulators routinely examine institutions for compliance with these obligations and have been active in imposing cease and desist and other regulatory orders and civil money penalties against institutions found to be violating these obligations. Sanctions for violations of the USA PATRIOT Act can be imposed in an amount equal to twice the sum involved in the violating transaction, up to $1 million.

Economic Sanctions

The OFAC is responsible for helping to ensure that U.S. entities do not engage in transactions with certain prohibited parties, as defined by various executive orders and acts of Congress. OFAC publishes, and routinely updates, lists of names of persons and organizations suspected of aiding, harboring, or engaging in terrorist acts, including the Specially Designated Nationals and Blocked Persons List. If we find a name on any transaction, account, or wire transfer that is on an OFAC list, we must undertake certain specified activities, which could include blocking or freezing the account or transaction requested, and we must notify the appropriate authorities.

Concentrations in Lending

During 2006, the federal bank regulatory agencies released guidance on “Concentrations in Commercial Real Estate Lending” (the “Guidance”) and advised financial institutions of the risks posed by CRE lending concentrations. The Guidance requires that appropriate processes be in place to identify, monitor, and control risks associated with real estate lending concentrations. Higher allowances for loan losses and capital levels may also be required. The Guidance is triggered when CRE loan concentrations exceed either:

•total reported loans for construction, land development, and other land of 100% or more of a bank’s total risk-based capital; or

•total reported loans secured by multifamily and nonfarm nonresidential properties and loans for construction, land development, and other land of 300% or more of a bank’s total risk-based capital.

The Guidance also applies when a bank has a sharp increase in CRE loans or has significant concentrations of CRE secured by a particular property type. We have always had exposures to loans secured by CRE due to the nature of our markets and the borrowing needs of both consumer and commercial clients. We believe our long-term experience in CRE lending, underwriting policies, internal controls, and other policies currently in place, as well as our loan and credit monitoring and administration procedures, are generally appropriate in managing our concentrations as required under the Guidance.

Community Reinvestment Act

The Bank is subject to the provisions of the CRA, which imposes a continuing and affirmative obligation, consistent with safe and sound operation, to help meet the credit needs of entire communities where the bank accepts deposits, including low- and moderate-income neighborhoods. The FDIC’s assessment of the Bank’s CRA record is made available to the public. CRA agreements with private parties must be disclosed and annual CRA reports must be made to the FDIC. Federal CRA regulations require, among other things, that evidence of discrimination against applicants on a prohibited basis and illegal or abusive lending practices be considered in the CRA evaluation. The Bank has a rating of “Satisfactory” in its most recent CRA evaluation.

In 2023, the Federal Reserve, OCC and FDIC issued a final rule to modernize their respective CRA regulations. The revised rules would substantially alter the methodology for assessing compliance with the CRA, with material aspects taking effect January 1, 2026 and revised data reporting requirements taking effect January 1, 2027. The revised CRA regulations have been subject to an injunction since March 29, 2024. On July 16, 2025, the Federal Reserve, OCC and FDIC issued a joint proposal to rescind the 2023 modernization rule. The agencies continued to apply the CRA rules as they existed before the 2023 modernization, considering the injunction and pending finalization of the rescission of the modernization rule.

Anti-Tying Restrictions

In general, a bank may not extend credit, lease, sell property, or furnish any services or fix or vary the consideration for them on the condition that (i) the client obtain or provide some additional credit, property, or services from or to the bank or bank holding company or their subsidiaries or (ii) the client not obtain some other credit, property, or services from a competitor, except to the extent reasonable conditions are imposed to assure the soundness of the credit extended. A bank may, however, offer combined-balance products and may otherwise offer more favorable terms if a client obtains two or more traditional bank products. The law also expressly permits banks to engage in other forms of tying and authorizes the Federal Reserve Board to grant additional exceptions by regulation or order. Also, certain foreign transactions are exempt from the general rule.

Consumer Financial Services

The structure of federal consumer protection regulation applicable to all providers of consumer financial products and services changed significantly on July 21, 2011, when the CFPB commenced operations to oversee and enforce consumer protection laws. The CFPB has broad rulemaking authority for a wide range of consumer protection laws that apply to all providers of consumer products and services, including our Bank, as well as the authority to prohibit “unfair, deceptive or abusive” acts and practices. The CFPB has examination and enforcement authority over insured depository institutions and their holding companies with more than $10 billion in assets. (The CFPB has similar authority over certain nonbanking organizations.) Banks and savings institutions with $10 billion or less in assets, like our Bank, will continue to be examined by their primary federal regulators, which can be expected to nonetheless look to the rulings and enforcement actions of the CFPB as they carry out their supervision of larger institutions.

Because abuses in connection with residential mortgages were a significant factor contributing to the financial crisis, many new rules issued by the CFPB and required by the Dodd-Frank Act address mortgage and mortgage-related products, their underwriting, origination, servicing and sales. The Dodd-Frank Act significantly expanded underwriting requirements applicable to loans secured by 1-4 family residential real property and augmented federal law combating predatory lending practices. In addition to numerous disclosure requirements, the Dodd-Frank Act imposed new standards for mortgage loan originations on all lenders, including banks and savings associations, in an effort to strongly encourage lenders to verify a borrower’s ability to repay, while also establishing a presumption of compliance for certain “qualified mortgages.” In addition, the Dodd-Frank Act generally required lenders or securitizers to retain an economic interest in the credit risk relating to loans that the lender sells, and other asset-backed securities that the securitizer issues, if the loans do not comply with the ability-to-repay standards described below. The risk retention requirement generally is 5.0%, but the statute and its implementing

regulations, exempt certain transactions from the requirement. The CFPB’s rules have impacted our operations, and have resulted in higher compliance costs for the Bank.

Consumer Laws

Numerous federal, state and local consumer protection laws impose substantive requirements upon mortgage lenders, servicers and holders of mortgage loans in connection with the origination, servicing and enforcement of mortgage loans.

The Bank must comply with many federal laws including:

•the Truth in Lending Act (“TILA”) and Regulation Z promulgated thereunder, which (among other things) require specific disclosures to the borrowers regarding the terms of the mortgage loans and inclusion of certain terms in an originator’s underwriting guidelines;

•the Consumer Financial Protection Act, enacted as part of the Dodd-Frank Act, which (among other things) created the CFPB and gave it broad rulemaking, supervisory and enforcement jurisdiction over mortgage lenders and servicers, and proscribes any unfair, deceptive or abusive acts or practices in connection with any consumer financial product or services;

•the Equal Credit Opportunity Act and Regulation B promulgated thereunder, which (among other things) prohibit discrimination on the basis of age, race, color, sex, religion, marital status, national origin, receipt of public assistance or the exercise of any right under the Consumer Credit Protection Act, in the extension of credit; and

•the Fair Credit Reporting Act, as amended by the Fair and Accurate Transactions Act, which (among other things) regulates the use and reporting of information related to the borrower’s credit experience.

Other federal laws also may apply, including but not limited to the, Alternative Mortgage Transactions Parity Act, BSA, Electronic Funds Transfer Act, Fair Debt Collection Practices Act, Fair Housing Act, Federal Trade Commission Act, Flood Disaster Protection Act of 1998, Gramm-Leach-Bliley Act, Home Mortgage Disclosure Act, Real Estate Settlement Procedures Act (“RESPA”), Right to Financial Privacy Act, SAFE Mortgage Licensing Act, and the Servicemembers Civil Relief Act.

Our mortgage lending activities are also subject to applicable state and local laws that regulate among other things, interest rates and other charges, require specific disclosure, regulate specific practices and require licensing of various participants in the transaction. In addition, other state and local laws, public policy and general principles of equity relating to the protection of consumers, unfair and deceptive practices and debt collection practices may apply to the origination, ownership, servicing or collection of mortgage loans.

The CFPB, state and federal banking regulatory agencies, state attorneys general offices, the Federal Trade Commission, the U.S. Department of Justice, the U.S. Department of Housing and Urban Development and state and local governmental authorities continue to monitor lending practices. State, local and federal governmental agencies have imposed sanctions on originators for practices including, but not limited to, charging borrowers excessive fees, steering borrowers to loans with higher costs or more onerous terms, imposing higher interest rates than the borrower’s credit risk warrants, failing to adequately disclose the material terms of loans to the borrowers and otherwise engaging in discriminatory lending practices or unfair, deceptive or abusive acts or practices.

S.A.F.E. Act

Regulations issued under the Secure and Fair Enforcement for Mortgage Licensing Act of 2008 (the “S.A.F.E. Act”) require residential mortgage loan originators who are employees of institutions regulated by the foregoing agencies to meet the registration requirements of the S.A.F.E. Act. The S.A.F.E. Act requires residential mortgage loan originators who are employees of regulated financial institutions to register with the Nationwide Mortgage Licensing System and Registry, a database created by the Conference of State Bank Supervisors and the American Association of Residential Mortgage Regulators to support the licensing of mortgage loan originators by the states. The S.A.F.E. Act generally prohibits employees of regulated financial institutions from originating residential mortgage loans unless they obtain and annually maintain registration as a registered mortgage loan originator.

The Bank conducts all its mortgage origination and warehouse alternative finance activities directly from our Bank itself, and is exempt from most state, but not all, licensing requirements by virtue of being a state-chartered bank. The Bank is licensed to originate and service loans in Maine, Maryland, New Mexico and Utah, and has filed an exemption registration in Nevada. Other states may require our Bank to obtain mortgage or servicer licenses in their respective jurisdictions.

Loan Originator Compensation

On January 20, 2013, the CFPB issued a final rule under the Truth in Lending Act (Regulation Z) which imposed several requirements and restrictions on the compensation of mortgage loan originators. These compensation rules are intended to prevent originators from steering consumers into higher cost mortgages.

The California Homeowner Bill of Rights

The California Homeowner Bill of Rights, which became effective on January 1, 2013 and was amended effective January 1, 2019, among other measures (i) prohibits “dual track” foreclosures (servicers will be required to halt the foreclosure process while any modification is being considered), (ii) creates a single point of contact for homeowners while negotiating a loan modification, (iii) expands upon notice requirements to a borrower before taking action on a loan modification application or pursuing foreclosure and (iv) allows for injunctions against foreclosure until violations are corrected and permits civil penalties (including monetary damages) against servicers that file multiple inaccurate mortgage documents or otherwise violate California law. The California Homeowner Bill of Rights is likely to extend foreclosure times in California and lead to increased litigation of the foreclosure process.

Homeowner Association Super Priority Liens May Take Priority Over the Mortgage Liens

In some states it is possible that the first lien of the mortgages may be extinguished by super priority liens of homeowner associations (“HOA”), potentially resulting in a loss of the mortgage loan’s outstanding principal balance. In at least 20 states, and the District of Columbia, HOA or condominium association assessment liens can take priority over first lien mortgages under certain circumstances. The number of these so called “super lien” states has increased in the past few decades and may increase further. Rulings by the highest courts of Nevada and the District of Columbia have held that the “super lien statute” provides the HOA or condominium association with a true lien priority rather than a payment priority from the proceeds of the sale, creating the ability to extinguish the senior mortgage and greatly increasing the risk of losses on mortgage loans secured by homes whose owners fail to pay HOA or condominium fees.

The laws of these “super lien” states that provide for HOA super liens vary in terms of (a) the duration of the priority period (with many at six months and some with no limitations); (b) the assessments secured by the HOA lien (charges can include not only unpaid HOA assessments, but also late charges, collection costs, attorneys’ fees, foreclosure costs, fines, and interest); (c) whether the HOA must give lenders with liens encumbering the mortgaged property notice of the homeowner’s failure to pay the assessment; and (d) the statute of limitations on HOA foreclosure rights.

Predatory Lending Laws/High Cost Loans

Various federal, state and local laws have been enacted to discourage predatory lending practices. The federal Home Ownership and Equity Protection Act of 1994, commonly known as HOEPA, amends TILA to prohibit inclusion of certain provisions in mortgage loans that have mortgage rates or origination costs in excess of prescribed levels, and require that borrowers be given certain disclosures prior to the origination of mortgage loans. Some states have enacted, similar laws or regulations, which in some cases impose restrictions and requirements greater than those in HOEPA.

In addition, under federal law and the anti-predatory lending laws of some states, the origination of certain mortgage loans (including loans that are not classified as “high cost” loans under applicable law) must satisfy a net tangible benefits test with respect to the related borrower. This test may be highly subjective and open to interpretation. As a result, a court may determine that a mortgage loan does not meet the test even if the related originator reasonably believed that the test was satisfied,

Failure to comply with these laws, to the extent applicable to any of the mortgage loans, could subject the originator and its assignees to monetary penalties and could result in the voiding or rescission of the affected mortgage loans. Lawsuits have been brought in various states making claims against assignees of high-cost loans for violations of state law. Named defendants in these cases have included numerous participants within the secondary mortgage market, including some securitization trusts.

Substantially all of the Mortgage Loans Originated by our Bank Are Subject to the “Know Before You Owe” TRID Disclosures

Substantially all of our mortgage loans are subject to the CFPB’s Know Before You Owe TRID rule, which became effective for mortgage loans whose applications were received on or after October 3, 2015. The purpose of the TRID rule was to reconcile overlapping disclosure obligations under TILA and RESPA and to provide for integrated closing disclosure and loan estimate forms that would satisfy those requirements under both TILA and RESPA.

Regular instances of potential non-compliance with the TRID rule have been reported in the marketplace since it became effective. Certain TILA-based disclosure provisions of the TRID rule carry assignee liability. Violations of TILA-based disclosure provisions of the TRID rule are limited in individual actions to actual damages, statutory damages for certain violations of not more than $4,000 per mortgage loan plus attorney’s fees and court costs, and can potentially result in liability for assignees where the violation is apparent on the face of the disclosure and the assignment was voluntary. While the statute of limitations under TILA is generally one year from the date of origination for most TRID violations, mortgagors may raise a violation of the TRID rules as a matter of defense by recoupment or set-off to an action to collect the debt beyond the one-year period, if permitted by state law. Further, for certain mortgage loans, while not changed by TRID requirements, TILA’s right of rescission may be extended to three years from consummation if there are errors in certain “material disclosures” such as the required disclosures of finance charges and payment schedule, which are contained within the TRID closing disclosure.

Risks Associated with Ability to Repay Laws

TILA provides that subsequent purchasers of mortgage loans originated in violation of certain requirements specified in TILA that require lenders to consider consumers’ “ability to repay” before extending them credit may have liability for such violations. The CFPB issued implementing regulations, which became effective January 10, 2014 for mortgage loans for which the application from the related mortgagor was taken on or after January 10, 2014, specifying the standards for a “qualified mortgage” that would have the benefit of a safe harbor from such liability if certain requirements are satisfied, or a rebuttable presumption of compliance with respect to such liability if certain requirements are satisfied and the annual percentage rate of the loan exceeds certain thresholds. The regulations apply to mortgage loans made for a personal, family, or household purpose secured by a one-to-four unit dwelling for which the application from the related mortgagor was taken on or after January 10, 2014.

Revised QM Rules

On December 10, 2020, the CFPB, issued the revised qualified mortgage rules (the “QM Rules”) that replaced Appendix Q and the strict 43.0% debt-to-income ratio (“DTI”) underwriting threshold with a price-based “Qualified Mortgage Loan” definition. The revised QM Rules also terminated the “QM Patch,” under which certain loans eligible for purchase by Fannie Mae and Freddie Mac do not have to be underwritten to Appendix Q or satisfy the capped 43.0% DTI requirement. In order to qualify for QM status, the mortgage loan must continue to meet the statutory requirements regarding the 3.0% points and fees limits, and must not contain negative amortization, a balloon payment (except in the existing limited circumstances), or a term exceeding 30 years. Compliance with the revised QM rules became mandatory on October 1, 2022.

On the same day, the CFPB also issued a final “Seasoned QM” rulemaking that creates a pathway to “safe harbor” QM status for performing non-QM and “rebuttable presumption” QM first lien loans that meet certain performance criteria portfolio requirements over a seasoning period of at least 36 months and that satisfy certain product restrictions, points and fees limits, and underwriting requirements prior to consummation. The “Seasoned QM” rule became effective with respect to applications received on or after March 1, 2021.

Under the revised QM rules, for first-lien transactions, a loan receives a conclusive presumption that the consumer had the ability to repay (and hence receives the safe harbor presumption of QM compliance) if the annual percentage rate does not exceed the average prime offer rate (“APOR”) for a comparable transaction by 1.5 percentage points or more as of the date the interest rate is set. A first-lien loan receives a “rebuttable presumption” that the consumer had the ability to repay if the APR exceeds the APOR for a comparable transaction by 1.5 percentage points or more but by less than 2.25 percentage points. The revised QM rules provide for higher thresholds for loans with smaller loan amounts, for subordinate-lien transactions, and for certain manufactured housing loans.

To qualify for QM status, the mortgage loan must continue to meet the statutory requirements regarding the 3.0% points and fees limits, and it must not contain negative amortization, a balloon payment (except in the existing limited circumstances), or a term exceeding 30 years.

CFPB Mortgage Servicing Rules

In February 2012, the Department of Justice, the Department of Housing and Urban Development and 49 States’ Attorneys General reached a settlement with five leading bank mortgage servicers that requires those servicers to implement comprehensive reforms to their mortgage servicing practices. Consent judgments implementing the agreement were filed in the U.S. District Court in Washington, D.C. in March 2012. The servicing standards outlined in the settlement agreement include (i) preventing mortgage servicers from engaging in robo-signing and other improper foreclosure practices, (ii) requiring servicers to offer loss mitigation alternatives to borrowers before pursuing foreclosure, (iii) increasing the transparency of the

loss mitigation process, (iv) imposing timelines for servicers to respond to borrowers and (v) restricting the practice of “dual tracking,” where foreclosure is initiated despite the borrower’s engagement in a loss mitigation process.

The CFPB Servicing Rules, among other things, incorporate many of the provisions of the servicing settlement discussed above, targets early intervention with borrowers following initial delinquency and imposes detailed requirements applicable in each step of the Servicer’s loss mitigation process. These rules, for example, prohibit the Servicer from commencing a foreclosure until a mortgage loan is more than 120 days delinquent and require the Servicer to provide certain notices and follow specific procedures relating to loss mitigation and foreclosure alternatives. The CFPB Servicing Rules therefore could result in increased delays in foreclosure or the inability to foreclose, which could in turn result in delays in payments on, or losses in respect of, the mortgage loans originated by our Bank.

On August 4, 2016, the CFPB announced amendments to certain of the CFPB Servicing Rules (“2016 Final Servicing Rule Amendments”) relating to force-placed insurance notices, delinquency and early intervention, loss mitigation, periodic monthly statements, and successors-in-interest to borrowers that could further impact servicing and delay foreclosures. Portions of the 2016 Final Servicing Rule Amendments became effective on August 19, 2017, and the remaining provisions became effective on April 19, 2018. On March 8, 2018, the CFPB issued a final rulemaking to amend certain sections of the 2016 Final Servicing Rule Amendments relating to the timing for servicers providing periodic statements and coupon books in connection with borrowers’ bankruptcy cases. As with the 2016 Final Servicing Rule Amendments, this final rule became effective on April 19, 2018. The 2016 Final Servicing Rule Amendments could result in increased delays in foreclosure or the inability to foreclose, which could in turn result in delays in payments on, or losses in respect of, the mortgage loans originated by our Bank.

On July 10, 2024, the CFPB proposed a rule to amend provisions of the CFPB Servicing Rules to significantly revamp requirements relating to borrowers experiencing payment difficulties (the “Proposed Rule”). The Proposed Rule includes a number of key changes to the servicing requirements in Regulation X (12 C.F.R. Part 1024), and would streamline existing requirements when borrowers seek payment assistance in times of distress, add safeguards when borrowers seek help, and revise existing requirements with respect to borrower assistance. The Proposed Rule would also require servicers to provide certain communications in languages other than English, such as when a borrower is seeking payment assistance with their mortgage. While many of the key concepts were anticipated by the industry, the proposed provisions go much further than expected. The CFPB accepted comments on the Proposed Rule through September 9, 2024. The CFPB may finalize, modify, or withdraw the Proposed Rule, or adopt related guidance, during 2026, and any such actions could require changes to mortgage servicing practices and may increase compliance costs.

CFPB Debt Collection Rules

On October 30, 2020, the CFPB issued a final rule to amend Regulation F, which implements the fair Debt Collection Practices Act (“FDCPA”), passed in 1977, to restate and clarify prohibitions on harassment and abuse, false or misleading representations, and unfair practices by debt collectors when collecting consumer debt (the “Debt Collection Rule”). The Debt Collection Rule focuses on debt collection communications and gives consumers more control over how often and through what means debt collectors can communicate with them regarding their debts. The Debt Collection Rule also clarifies how the protections of the FDCPA apply to newer communication technologies, such as email and text messages.

The Debt Collection Rule also contains provisions on disputes, and record retention, among other topics. The rule took effect on November 21, 2020. The CFPB issued a second debt collection final rule focused on consumer disclosures in December 2020. The second rule, issued in December 2020, clarifies disclosures debt collectors must provide to consumers at the beginning of collection communications and also prohibits debt collectors from suing or threatening to sue consumers on time barred debt. Additionally, the second rule requires debt collectors to take specific steps to disclose the existence of a debt to consumers before reporting information about the debt to a consumer reporting agency. Both rules took effect on November 30, 2021.

Privacy, Credit Reporting, and Data Security

The GLB generally prohibits disclosure of non-public consumer information to non-affiliated third parties unless the consumer has been given the opportunity to object and has not objected to such disclosure. Financial institutions are further required to disclose their privacy policies to clients annually. Financial institutions, however, will be required to comply with state law if it is more protective of consumer privacy than the GLB. The GLB also directed federal regulators to prescribe standards for the security of consumer information. The Bank is subject to such standards, as well as standards for notifying clients in the event of a security breach. The Bank utilizes credit bureau data in underwriting activities. Use of such data is regulated under the Fair Credit Reporting Act and Regulation V on a uniform, nationwide basis, including credit reporting, prescreening, and sharing of information between affiliates and the use of credit data. The Fair and Accurate Credit Transactions Act, which amended the

Fair Credit Reporting Act, permits states to enact identity theft laws that are not inconsistent with the conduct required by the provisions of that Act. Clients must be notified when unauthorized disclosure involves sensitive client information that may be misused. The federal banking agencies require banks to notify their primary federal regulator within 36 hours of a “computer-security incident” that rises to the level of a “notification incident.”

The federal banking regulators regularly issue guidance regarding cybersecurity intended to enhance cyber risk management standards among financial institutions. As a result, financial institutions, like us and the Bank, are expected to establish multiple lines of defense and to ensure their risk management processes address the risk posed by potential threats to the institution. A financial institution’s management is expected to maintain sufficient processes to effectively respond and recover the institution’s operations after a cyber-attack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations if a critical service provider of the institution falls victim to this type of cyber-attack. Our information security protocols are designed in part to adhere to the requirements of this guidance.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually monitoring developments in the states in which our clients are located.