OTC: RVRF

Our Products and Services

Through our Bank, we engage in the business of banking, which consists primarily of accepting deposits from the public and making loans and other investments. Our principal sources of funds for loans and investments at our Bank are demand, time, savings, and other deposits (including negotiable orders of withdrawal, or NOW accounts) and the amortization and prepayments of loans and investments. Our principal sources of income are interest and fees collected on loans, interest collected on other investments, fees earned from the origination and sale of residential mortgage loans, and service charges, as well as income from investment brokerage services. Our principal expenses are interest paid on savings and other deposits (including NOW accounts), interest paid on other borrowings, employee compensation, office expenses, and other overhead expenses. As described more fully below under “Employees,” we seek to emphasize a philosophy of “deposit first,” with a pursuit of checking accounts as a funding source and a conservative approach to lending.

3

Deposits

Our principal sources of funds are core deposits, including demand deposits, interest-bearing transaction accounts, money market accounts, savings deposits, and certificates of deposit. As of December 31, 2025, our deposit composition was as follows:

Deposit rates are reviewed weekly by senior management. Management believes that the rates that we offer are competitive with those offered by other institutions in our market areas. We also focus on customer service to attract and retain deposits.

Transaction accounts include demand deposits and NOW accounts, which customers use for cash management and which provide us with a source of fee income, as well as a low-cost source of funds. Time and savings accounts also provide a relatively stable and low-cost source of funds. Our primary source of funds is NOW accounts. Certificates of deposit in excess of $250,000 are held primarily by customers in our market areas. We utilize brokered certificates of deposit to supplement our market funding sources when funding needs or pricing warrants the use of wholesale funding.

4

Lending

We offer a range of lending services, including real estate, consumer, and commercial loans, to individuals, small businesses, and other organizations located in or conducting a substantial portion of their business in our market areas. Our total loans, net of unearned income, at December 31, 2025, were approximately $2.71 billion, or approximately 71.6% of total assets. The interest rates charged on loans vary with the degree of risk, maturity, and amount of the loan and are further subject to competitive pressures, money market rates, availability of funds, and government regulations.

As of December 31, 2025, our loan portfolio composition was classified as follows: (percent of gross loans)

Real Estate Loans. Loans secured by real estate are the primary component of our loan portfolio, constituting approximately $2.1 billion, or 76.6%, of total loans, net of unearned income, at December 31, 2025. We originate consumer and commercial loans for the purpose of acquiring real estate that are secured by such real estate. We also often take real estate as an additional source of collateral to secure commercial and industrial (C&I) loans. Such loans are classified as real estate loans rather than commercial and industrial loans if the real estate collateral is considered significant as a secondary source of repayment for the loan. Loans are typically made on a recourse basis supported by financial statements and a review of the repayment ability of the borrower(s) and/or guarantor(s). Origination fees are charged for many loans secured by real estate.

Real estate lending activities consist of the following:

•
Commercial real estate term loans accrue at either variable or fixed rates. The variable rates approximate current market rates. Amortizations are typically no more than 25 years.

•
The primary type of residential mortgage loan is the single-family first mortgage, typically structured with fixed or adjustable interest rates, based on market conditions. These loans usually have fixed rates for up to 5 years, with maturities of 15 to 30 years.

•
Construction and land development (C&D) loans are typically made on a variable-rate basis. Loan terms usually do not exceed 24 months.

We originate residential loans for sale into the secondary market. These loans are made in accordance with underwriting standards set by the purchaser of the loan, normally as to loan-to-value ratio, interest rate, borrower qualification, and documentation. These loans are generally made under a commitment to purchase from a loan purchaser. We generally collect from the borrower or purchaser a combination of the origination fee, discount points, and/or a service release fee.

Home Equity Lines of Credit: We originate home equity lines of credit secured by residential property. The loans are typically made on a variable rate basis with maturities up to 10 years. At December 31, 2025, home equity lines of credit constituted $157.9 million, or 5.9% of our loan portfolio.

5

Commercial and Industrial Loans. We make loans for commercial purposes in various lines of business. These loans are typically made on terms up to 7 years at fixed or variable rates and are secured by various types of collateral, including accounts receivable, inventory, or, in the case of equipment loans, the financed equipment. We attempt to reduce our credit risk on commercial loans by underwriting the loan based on the borrower’s cash flow and its ability to service the debt from earnings, and by limiting the loan-to-value ratio. Historically, we have typically loaned up to 80% on loans secured by accounts receivable, up to 50% on loans secured by inventory (which are typically also secured by accounts receivable), and up to 100% on loans secured by equipment. We also make some unsecured commercial loans. Commercial and industrial loans constituted $427.3 million, or 15.9% of our loan portfolio, at December 31, 2025. Interest rates are negotiable based upon the borrower’s financial condition, credit history, management stability and collateral.

Consumer Loans. Consumer lending includes installment lending to individuals in our market areas and generally consists of loans to purchase automobiles and other consumer durable goods. Consumer loans constituted $52.7 million, or 2.0% of our loan portfolio, at December 31, 2025. Consumer loans are underwritten based on the borrower’s income, current debt level, past credit history and collateral. Consumer rates are both variable and fixed, with terms negotiable. Terms generally range from one to five years depending on the nature and condition of the collateral. Periodic amortization, generally monthly, is typically required.

Loan Approval. Certain credit risks are inherent in making loans. These include repayment risks, risks resulting from uncertainties in the future value of collateral, risks resulting from changes in economic and industry conditions, and risks inherent in dealing with individual borrowers. In particular, longer maturities increase the risk that economic conditions will change and adversely affect collectability.

We attempt to minimize credit losses through various means and the use of standardized underwriting criteria. We have established a standardized loan policy that may be modified based on local market conditions. In particular, on larger credits, we generally rely on the cash flow of a debtor as the source of repayment and secondarily on the value of the underlying collateral. In addition, we attempt to utilize shorter loan terms in order to reduce the risk of a decline in the value of such collateral.

We address repayment risks by adhering to internal credit policies and procedures. These policies and procedures include officer and customer lending limits, a loan committee approval process for larger loans, documentation examination, and follow-up procedures for loan review and any exceptions to credit policies. The point in the loan approval process at which a loan is approved depends on the size of the borrower’s credit relationship with the bank and the loan authority of the lending officer to whom the loan request is made. Each of our lending officers has the authority to approve loans up to an approved loan authority amount, as approved by the bank’s board of directors. Loans in excess of the highest loan authority amount of a particular lending officer must be approved by the bank’s loan committee, or another officer with sufficient loan authority to approve the request.

Risk Ratings. Loan officers are directly responsible for monitoring the risk in their respective portfolios. On commercial loans, risk grades are assigned by the loan officer for the probability of default following analysis of borrower characteristics and external economic factors. However, on consumer loans, risk grades are determined by a borrower’s credit score and personal debt ratio, as well as the borrower’s repayment history with the bank.

Electronic Banking

We offer electronic banking services to our customers, including commercial and retail online banking, automated bill payment, mobile banking, and remote deposit capture for certain customers.

Competition

The financial services industry is highly competitive. We compete for loans, deposits, and financial services in all of our principal markets. We compete directly with other bank and nonbank institutions located within our markets, internet-based banks, out-of-market banks, and bank holding companies that advertise in or otherwise serve our markets, along with credit unions, money market and mutual funds, brokerage houses, mortgage companies, and insurance companies or other commercial entities that offer financial services products. Competition involves efforts to retain current customers, obtain new loans and deposits, increase the scope and type of services offered, and offer competitive interest rates paid on deposits and charged on loans. Many of our competitors enjoy competitive advantages, including greater financial resources, a wider geographic presence, more accessible branch office locations, the ability to offer additional services, more favorable pricing alternatives, and lower origination and operating costs. Some of our competitors have been in business for a long time and have an established customer base and name recognition. We believe that our competitive pricing, personalized service, and community involvement enable us to effectively compete in the communities in which we operate.

6

Employees

As of December 31, 2025, we had approximately 365 full-time and 23 part-time employees. None of these employees are party to a collective bargaining agreement.

The Company emphasizes a “deposit first” philosophy to provide not only a direct and practical service to its customers but also to provide a stable and adequate funding source for its loans. We seek employees who are familiar with our operations in our 24 offices across six regions in Alabama, including operations in all 10 of the top 10 MSAs in Alabama, and 1 office in Florida. We seek to provide a “one customer at a time” approach to growth and emphasizes the need for employees, especially our relationship managers and office managers, to have a thorough knowledge of local markets and customers to enhance our conservative lending function.

SUPERVISION AND REGULATION

General

We are extensively regulated under both federal and state law. These laws restrict permissible activities and investments and require compliance with various consumer protection provisions applicable to lending, deposit, brokerage, and fiduciary activities. They also impose capital adequacy requirements and conditions on a bank holding company’s ability to repurchase stock or to receive dividends from its subsidiary bank. We are subject to comprehensive examination and supervision by the Federal Reserve and Alabama State Banking Department, and River Bank and Trust is subject to comprehensive examination and supervision by the Federal Deposit Insurance Corporation (FDIC) and the Alabama Banking Department. These regulatory agencies generally have broad discretion to impose restrictions and limitations on our operations. This supervisory framework could materially impact the conduct and profitability of our activities.

To the extent that the following information describes statutory and regulatory provisions, it is qualified in its entirety by reference to the text of the particular provisions. Proposals to change the laws and regulations governing the banking industry are frequently raised at both the state and federal levels. The likelihood and timing of any changes in these laws and regulations, and the impact such changes may have on us, are difficult to ascertain. A change in applicable laws and regulations, or in the manner such laws or regulations are interpreted by regulatory agencies or courts, may have a material effect on our business, operations, and earnings.

Regulation of River Financial Corporation

We are registered as a bank holding company under the Bank Holding Company Act of 1956, as amended (the “BHCA”) and are subject to regulation and supervision by the Federal Reserve and the Alabama Banking Department. The BHCA requires us to secure the prior approval of the Federal Reserve before we own or control, directly or indirectly, more than five percent (5%) of the voting shares or substantially all of the assets of any bank or savings association, or merge or consolidate with another bank or savings and loan holding company. Further, under the BHCA, our activities and those of any nonbank subsidiary are generally limited to those activities that the Federal Reserve determines to be so closely related to banking as to be a proper incident thereto. Prior approval of the Federal Reserve may be required before engaging in certain activities. In making such determinations, the Federal Reserve is required to weigh the expected benefits to the public, such as greater convenience, increased competition, and gains in efficiency, against the possible adverse effects, such as undue concentration of resources, decreased or unfair competition, conflicts of interest, and unsound banking practices.

Subject to various exceptions, the BHCA and the Change in Bank Control Act, together with related regulations, require Federal Reserve approval prior to any person or company acquiring “control” of a bank holding company. Control is conclusively deemed to exist if an individual or company acquires 25% or more of any class of voting securities of the bank holding company, and a rebuttable presumption arises if a person or company acquires 10% or more, but less than 25%, of any class of voting securities and either: (i) the bank holding company has registered securities under Section 12 of the Securities Act; or (ii) no other person owns a greater percentage of that class of voting securities immediately after the transaction. The BHCA’s definition of “control” can also be triggered when a company acquires 5% or more of any class of voting securities and certain other factors are present.

7

The BHCA was substantially amended by the Gramm-Leach-Bliley Act of 1999, or the GLBA, which, among other things, permits a “financial holding company” to engage in a broader range of non-banking activities, and to engage on less restrictive terms in certain activities than were previously permitted. These expanded activities include securities underwriting and dealing, insurance underwriting and sales, and merchant banking activities. To become a financial holding company, a bank holding company must certify that all depository institutions that it controls are both “well capitalized” and “well managed” (as defined by federal law), and have at least a “satisfactory” Community Reinvestment Act ("CRA") rating. The GLBA also imposes certain privacy requirements on all financial institutions and their treatment of consumer information. At this time, we have not elected to become a financial holding company, nor do we expect to make such an election in the foreseeable future.

There are a number of restrictions imposed on us by law and regulatory policy that are designed to minimize potential loss to depositors and to the insurance fund maintained by the FDIC (as discussed in more detail below) in the event that a subsidiary depository institution should become insolvent. For example, federal law requires a bank holding company to serve as a source of financial strength to its subsidiary depository institutions and to commit resources to support such institutions in circumstances where it might not do so in the absence of such a policy. The Federal Reserve also has the authority under the BHCA to require a bank holding company to terminate any activity or to relinquish control of a non-bank subsidiary upon the Federal Reserve’s determination that such activity or control constitutes a serious risk to the financial soundness and stability of any bank subsidiary of the bank holding company.

Any capital loan by a bank holding company to a subsidiary depository institution is subordinate in right of payment to deposits and certain other indebtedness of the institution. In addition, in the event of the holding company’s bankruptcy, any commitment made by the bank holding company to a federal banking regulatory agency to maintain the capital of its subsidiary depository institution(s) will be assumed by the bankruptcy trustee and entitled to a priority of payment.

The Federal Deposit Insurance Act, or FDIA, provides that, in the event of the “liquidation or other resolution” of an insured depository institution, the claims of depositors of the institution (including the claims of the FDIC as a subrogee of insured depositors) and certain claims for administrative expenses of the FDIC as a receiver will have priority over other general unsecured claims against the institution. If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non- deposit creditors, including the institution’s holding company, with respect to any extensions of credit they have made to such insured depository institution.

Regulation of River Bank & Trust

The operations and investments of RB&T are subject to the supervision, examination, and reporting requirements of the FDIC and the Alabama Banking Department, and RB&T is subject to a wide range of federal and state banking statutes and regulations, including with respect to the level of reserves that RB&T must maintain against deposits, restrictions on the types, amount, and terms and conditions of loans it may originate, and limits on the types of other activities in which RB&T may engage and the investments that it may make. The FDIC and Alabama Banking Department also have the power to prevent the continuance or development of unsafe or unsound banking practices or other violations of law.

Acquisitions of Other Banks

If the Bank seeks to acquire another depository institution or branches of another depository institution, it is required to obtain the prior approval of the FDIC and Alabama Banking Department. In reviewing the application, these agencies will consider, among other things, the Bank’s capital level, its financial and managerial resources and future prospects, the impact of the transaction on the Bank’s safety and soundness, the impact of the transaction on competition in the relevant geographic market, its record in combating money laundering activities, the impact on the convenience and needs of the communities served, and the Bank’s record of Community Reinvestment Act performance.

8

Transactions with Affiliates

We are subject to federal laws, such as Sections 23A and 23B of the Federal Reserve Act and Regulation W, that limit the aggregate amount of the transactions that depository institutions may engage in with their affiliates (such as the Company). Under these provisions, transactions (such as loans or investments) by a bank with its affiliates are generally limited to 10% of the bank’s capital and surplus for all covered transactions with any one affiliate, and 20% of capital and surplus for all covered transactions with all affiliates. Any extensions of credit to affiliates, with limited exceptions, must be secured by eligible collateral in specified amounts. Banks are also prohibited from purchasing any “low quality” assets from an affiliate. The Dodd-Frank Act imposes additional requirements on transactions with affiliates, including an expansion of the definition of “covered transactions” and an increase in the amount of time for which collateral requirements regarding covered transactions must be maintained. Section 23B requires any transaction between a bank and its affiliate to be on terms and under circumstances, including credit standards, that are substantially the same, or at least as favorable to the bank, as those prevailing at the time for comparable transactions with or involving nonaffiliates.

We are also subject to restrictions on extensions of credit to our executive officers, directors, principal stockholders, and their related interests. These extensions of credit must be made on substantially the same terms, including interest rates and collateral, as those prevailing at the time for comparable transactions with third parties, and must not involve more than the normal risk of repayment or present other unfavorable features. Furthermore, we are prohibited from engaging in asset purchases or sales transactions with our officers, directors, or principal stockholders unless the transaction is on market terms and, if the transaction represents greater than 10% of the capital and surplus of the bank, a majority of the bank’s disinterested directors has approved the transaction.

Monetary Policy

Our earnings are and will be affected by domestic economic conditions and the monetary and fiscal policies of the United States government and its agencies. The monetary policies of the Federal Reserve have a significant effect upon the operating results of commercial banks. The Federal Reserve has a major impact upon the levels of bank loans, investments and deposits through its open market operations in United States government securities and through its regulation of, among other things, the discount rate on bank borrowings and the reserve requirements against bank deposits. It is not possible for us to predict the nature and impact of future changes in monetary and fiscal policies.

Deposit Insurance

Our deposits are insured up to applicable limits by the FDIC. FDIC-insured banks are required to pay deposit insurance assessments to the FDIC. The amount of the assessment is based on the size of the bank’s assessment base, which is equal to its average consolidated total assets less its average tangible equity, and its risk classification under an FDIC risk-based assessment system. Institutions assigned to higher risk classifications (that is, institutions that pose a higher risk of loss to the Deposit Insurance Fund) pay assessments at higher rates than institutions that pose a lower risk. An institution’s risk classification is assigned based on its capital levels and the level of supervisory concern that the institution poses to the regulators. At certain times, the FDIC updates its loss and income projections for the Deposit Insurance Fund and, if needed, will increase or decrease assessment rates, following notice-and-comment rulemaking, if required. The FDIC can also impose special assessments in certain instances. If there are additional bank or financial institution failures or if the FDIC otherwise determines to increase assessment rates, RB&T may be required to pay higher FDIC insurance premiums.

A significant increase in insurance assessments would likely have an adverse effect on our operating expenses and results of operations. We cannot predict what insurance assessment rates will be in the future. Furthermore, deposit insurance may be terminated by the FDIC upon a finding that the institution has engaged in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order, or condition imposed by the FDIC.

Dividend Restrictions

We are a legal entity separate and distinct from our Bank. Our ability to pay dividends and make other distributions depends in part upon the receipt of dividends from our subsidiary bank and is limited by federal and state law. The specific limits depend upon a number of factors, including recent earnings, recent dividends, level of capital, and regulatory status. The regulators are authorized, and under certain circumstances are required, to determine whether the payment of dividends or other distributions by a bank would be an unsafe or unsound practice and to prohibit such payment. For example, the FDIC generally prohibits a depository institution from making any capital distribution (including payment of a dividend) or paying any management fee to its parent holding company if the depository institution would thereafter be undercapitalized.

9

The Bank generally may not withdraw, either in the form of a dividend or otherwise, any portion of its permanent capital and may not declare a dividend in excess of its retained net profits without prior approval of the Alabama Banking Department and FDIC. Further, the Bank is also required by Alabama law to obtain prior approval of the Alabama Banking Department for its payment of dividends if the total of all dividends declared by the Bank in any calendar year will exceed the total of (i) the bank’s net earnings (as defined by statute) for that year, plus (ii) its retained net earnings (after paying dividends) for the preceding two years.

The ability of a bank holding company to pay dividends and make distributions can also be limited by other laws or regulations. The Federal Reserve, which has authority to prohibit a bank holding company from paying dividends or making other distributions, has issued a Supervisory Letter stating that a bank holding company should not pay cash dividends unless its net income available to common stockholders has been sufficient to fully fund the dividends, and the prospective rate of earnings retention appears to be consistent with the holding company’s capital needs, asset quality, and overall financial condition. Accordingly, a bank holding company should not pay cash dividends that exceed its net income or that can only be funded in ways that weaken the bank holding company’s financial health, such as by borrowing. The Dodd-Frank Act, Basel III (described below), and their respective implementing regulations impose additional restrictions on the ability of banking institutions to pay dividends.

Capital Adequacy Guidelines

The FDIC and Alabama Banking Department monitor the capital adequacy of the Bank by using a combination of risk-based guidelines and leverage ratios. These agencies consider the Bank’s capital levels when taking action on various types of applications and when conducting supervisory activities related to the safety and soundness of the Bank and the banking system. Under the Basel III capital rules, the Bank is required to maintain four minimum capital standards: (1) a leverage ratio of at least 4.0%, (2) a common equity Tier 1 risk-based capital ratio of at least 4.5%, (3) a Tier 1 risk-based capital ratio of at least 6.0%, and (4) a total risk-based capital ratio of at least 8.0%. The Basel III capital rules also require the Bank to establish a capital conservation buffer equal to 2.50% of total risk-weighted assets. The capital conservation buffer is designed to ensure that banks build up capital buffers outside periods of stress, which can be drawn down as losses are incurred. An institution that does not satisfy the capital conservation buffer will be subject to restrictions on certain activities including payment of dividends, stock repurchases, and discretionary bonuses to executive officers. When the 2.5% capital conservation buffer is factored in, the minimum common equity Tier 1 risk-based capital ratio is 7.0%, the minimum Tier 1 risk-based capital ratio is 8.5%, and the minimum total risk-based capital ratio is 10.5%.

For purposes of calculating risk-weighted assets, the federal banking agencies have promulgated risk-based capital guidelines designed to make regulatory capital requirements more sensitive to differences in risk profiles among banks, to account for off-balance sheet exposures, and to minimize disincentives for holding liquid assets. Under these guidelines, assets and off- balance sheet items are assigned to broad risk categories, each with appropriate weights. The resulting capital ratios represent capital as a percentage of total risk-weighted assets and off-balance sheet items. Bank assets are given risk-weights under the Basel III Rules. In addition, certain off-balance sheet items are assigned certain credit conversion factors to convert them to asset- equivalent amounts to which an appropriate risk-weighting will apply. Those computations result in the total risk-weighted assets.

These capital requirements are minimum requirements. The FDIC or Alabama Banking Department may also set higher capital requirements if warranted by the risk profile of the Bank, economic conditions impacting its markets, or other circumstances particular to the Bank. For example, FDIC guidance provides that higher capital may be required to take adequate account of, among other things, interest rate risk and the risks posed by concentrations of credit, nontraditional activities, or securities trading activities. Failure to meet capital guidelines could subject the Bank to a variety of enforcement remedies, including issuance of a capital directive, restrictions on business activities, and other measures under the FDIC’s prompt corrective action regulations.

Because the Company’s consolidated assets exceed $3 billion, we are subject to the same Basel III minimum capital ratios discussed above which apply to the Bank. We and the Bank are currently in compliance with Basel III Capital Rules.

On September 17, 2019, the FDIC and other federal bank regulatory agencies approved the Community Bank Leverage Ratio (CBLR) framework. This optional framework became effective January 1, 2020, and is available to the Company and the Bank as an alternative to the Basel III risk-based capital framework. The CBLR framework provides for a simple measure of capital adequacy for certain community banking organizations. Specifically, depository institutions and depository institution holding companies that have less than $10.0 billion in total consolidated assets and meet other qualifying criteria, including a Tier 1 leverage ratio of greater than 9.00% are eligible to elect to utilize the CBLR framework. The federal banking agencies issued a notice of proposed rulemaking in December 2025 that would, among other things, lower the leverage ratio requirement to 8%.

As of December 31, 2025, the Company and the Bank qualify for the CBLR framework. Management does not intend to utilize the CBLR framework.

10

As an additional means of identifying problems in the financial management of depository institutions, the federal banking regulatory agencies have established certain non-capital safety and soundness standards for institutions for which they are the primary federal regulator. The standards relate generally to operations and management, asset quality, interest rate exposure, and executive compensation. The agencies are authorized to take action against institutions that fail to meet such standards.

Prompt Corrective Action

In addition to the required minimum capital levels described above, federal law establishes a system of “prompt corrective actions” that federal banking agencies are required to take, and certain actions that they have discretion to take, based upon the capital category into which a federally regulated depository institution falls. Regulations set forth detailed procedures and criteria for implementing prompt corrective action in the case of any institution which is not adequately capitalized. Under the prompt corrective action rules, an institution is deemed “well capitalized” if its leverage ratio, Common Equity Tier 1 ratio, Tier 1 Capital ratio, and Total Capital ratio meet or exceed 5%, 6.5%, 8%, and 10%, respectively, and must not be subject to any order or written agreement or directive by a federal banking agency to meet and maintain a specific capital level for any capital measure. An institution is deemed to be “adequately capitalized” if its leverage, Common Equity Tier 1, Tier 1, and Total Capital ratios meet or exceed 4.0%, 4.5%, 6.0%, and 8.0%, and “undercapitalized” if it fails to meet these minimum capital requirements. An institution is “significantly undercapitalized” if its leverage, Common Equity Tier 1, Tier 1, or Total Capital ratios fall below 3%, 3%, 4%, or 6%, respectively, and “critically undercapitalized” if the institution has a ratio of tangible equity to total assets that is equal to or less than 2%.

The prompt corrective action rules require an undercapitalized institution to file a written capital restoration plan, along with a performance guaranty by its holding company or a third party. In addition, an undercapitalized institution becomes subject to certain automatic restrictions, including a prohibition on payment of dividends and a limitation on asset growth and expansion in certain cases, a limitation on the payment of bonuses or raises to senior executive officers, and a prohibition on the payment of certain “management fees” to any “controlling person.” Institutions that are classified as undercapitalized or significantly undercapitalized are also subject to certain additional supervisory actions, including increased reporting burdens and regulatory monitoring; limitations on the institution’s ability to make acquisitions, open new branch offices, or engage in new lines of business; obligations to raise additional capital; restrictions on transactions with affiliates; and restrictions on interest rates paid by the institution on deposits. In certain cases, banking regulatory agencies may require replacement of senior executive officers or directors, or sale of the institution to a willing purchaser. If an institution is deemed to be “critically undercapitalized” and continues in that category for 90 days, the statute requires, with certain narrowly limited exceptions, that the institution be placed in receivership.

Banks that are adequately, but not well, capitalized may not accept, renew, or rollover brokered deposits except with a waiver from the FDIC and subject to restrictions on the interest rates that can be paid on deposits.

Community Reinvestment Act

The CRA requires the federal banking regulatory agencies to assess all financial institutions that they regulate to determine whether these institutions are meeting the credit needs of the communities they serve, including their assessment area(s) (as established for these purposes in accordance with applicable regulations based principally on the location of branch offices). Under the CRA, institutions are assigned a rating of “outstanding,” “satisfactory,” “needs to improve,” or “unsatisfactory.” An institution’s record in meeting the requirements of the CRA is made publicly available and is taken into consideration in connection with any applications it files with federal regulators to engage in certain activities, including approval of a branch or other deposit facility, mergers and acquisitions, office relocations, or expansions into non-banking activities. The Bank received a “satisfactory” rating at its most recent CRA evaluation.

CRA agreements with private parties must be disclosed and annual CRA reports must be made to a bank’s primary federal regulator. A financial holding company election, and such election and financial holding company activities are permitted to be continued, only if any affiliated bank has not received less than a “satisfactory” CRA rating.

USA PATRIOT Act

Under the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT) Act, which amended the U.S. Bank Secrecy Act, financial institutions are subject to prohibitions against specified financial transactions and account relationships, as well as enhanced due diligence and “know your customer” standards in their dealings with foreign financial institutions and foreign customers. The USA PATRIOT Act also mandates that financial institutions establish anti-money laundering programs meeting certain standards and requires the federal banking regulators to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions.

11

The law is intended to enhance the powers of the federal government and law enforcement organizations to combat terrorism, organized crime and money laundering. The USA Patriot Act materially amended and expanded the application of the existing Bank Secrecy Act. It provided enhanced measures, including know your customer, new suspicious activity reporting rules and enhanced anti-money laundering programs. Under the USA Patriot Act, each financial institution is required to establish and maintain anti-money laundering compliance and due diligence programs, which include, at a minimum:

•
the development of internal policies, procedures, and controls;

•
the designation of a compliance officer;

•
an ongoing employee training program; and

•
an independent audit function to test programs.

In addition, the USA Patriot Act requires regulatory agencies to consider the record of a bank or bank holding company in combating money laundering activities in their evaluation of bank and bank holding company merger, acquisition and branch expansion transactions.

Privacy of Customer Information

The GLBA and the implementing regulations issued by federal regulatory agencies require financial institutions (including banks, insurance agencies, and broker/dealers) to adopt policies and procedures regarding the disclosure of nonpublic personal information about their customers to non-affiliated third parties. In general, financial institutions are required to explain to customers their policies and procedures regarding the disclosure of such nonpublic personal information, and in certain circumstances, customers can prevent the disclosure of such information to nonaffiliated third parties. GLBA also established certain information security guidelines that require each financial institution, under the supervision and ongoing oversight of its board of directors or an appropriate committee thereof, to develop, implement, and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information, to protect against anticipated threats or hazards to the security or integrity of such information, and to protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. Under certain circumstances, the regulations require a bank to provide notice to customers of a data breach. Federal banking regulators regularly issue guidance regarding cybersecurity intended to enhance cyber risk management.

The Consumer Financial Protection Bureau

The Dodd-Frank Act created the Consumer Financial Protection Bureau, or the CFPB, which is an independent bureau with broad authority to regulate the consumer finance industry, including regulated financial institutions, non-banks and others involved in extending credit to consumers. The CFPB has authority through rulemaking, orders, policy statements, guidance, and enforcement actions to administer and enforce federal consumer financial laws, to oversee several entities and market segments not previously under the supervision of a federal regulator, and to impose its own regulations and pursue enforcement actions when it determines that a practice is unfair, deceptive, or abusive. The federal consumer financial laws and all of the functions and responsibilities associated with them, many of which were previously enforced by other federal regulatory agencies, were transferred to the CFPB on July 21, 2011. While the CFPB has the power to establish, interpret, administer, and enforce federal consumer financial laws, the Dodd-Frank Act provides that the federal banking regulatory agencies continue to have examination and enforcement powers over the financial institutions that they supervise relating to the matters within the jurisdiction of the CFPB if such institutions have less than $10 billion in assets. The Dodd- Frank Act also gives state attorneys general the ability to enforce federal consumer protection laws. There have been substantial recent developments affecting the CFPB. In early February 2025, the CFPB's Acting Director issued an internal directive to cease virtually all CFPB activities, including supervision, examinations, rulemaking, enforcement actions, and pending investigations. Since that time, the CFPB has remained largely dormant with limited rulemaking issuances or other activity. In November 2025, the Acting Director notified a federal court that the CFPB cannot request funds from the Federal Reserve under the Dodd-Frank Act to fund its operations pursuant to a legal opinion issued by the Department of Justice's Office of Legal Counsel. In December 2025, the federal court rejected this legal interpretation. In January 2026, the Acting Director notified the federal court that he had requested funding from the Federal Reserve to fund its operations for the first quarter of 2026. We cannot predict when or how these matters involving the CFPB will be resolved.

12

Mortgage Loan Origination

The Dodd-Frank Act authorized the CFPB to establish certain minimum standards for the origination of residential mortgages, including a determination of the borrower’s ability to repay. Under the Dodd-Frank Act and the implementing final rule adopted by the CFPB, or the ATR/QM Rule, a financial institution may not make a residential mortgage loan to a consumer unless it first makes a “reasonable and good faith determination” that the consumer has a “reasonable ability” to repay the loan. In addition, the ATR/QM Rule limits prepayment penalties and permits borrowers to raise certain defenses to foreclosure if they receive any loan other than a “qualified mortgage,” as defined by the CFPB. The ATR/QM Rule specifies the types of income and assets that may be considered in the ability-to-repay determination, the permissible sources for verification, and the required methods of calculating the loan’s monthly payments.

Mortgage Loan Servicing

The CFPB issued a series of final rules as part of an effort to address mortgage servicing reforms and create uniform standards for the mortgage servicing industry. The rules contain additional requirements for communications with borrowers, address the maintenance of customer account records, govern procedures for responding to written borrower requests and complaints of errors, and provide guidance regarding servicing delinquent loans, foreclosure proceedings, and loss mitigation efforts, among other measures. These rules have in general led to increased costs to service loans across the mortgage industry.

Concentrated Commercial Real Estate Lending Regulations

The federal bank regulatory agencies have promulgated guidance governing financial institutions with concentrations in commercial real estate lending. The guidance provides that a bank has a concentration in commercial real estate lending if (i) total reported loans for construction, land development, and other land represent 100% or more of total capital or (ii) total reported loans secured by multifamily and nonfarm nonresidential properties and loans for construction, land development, and other land represent 300% or more of total capital and the bank’s commercial real estate loan portfolio has increased 50% or more during the prior 36 months. Owner occupied loans are excluded from this second category. If a concentration is present, management must employ heightened risk management practices that address, among other things, board and management oversight and strategic planning, portfolio management, development of underwriting standards, risk assessment and monitoring through market analysis and stress testing, and maintenance of increased capital levels as needed to support the level of commercial real estate lending. At December 31, 2025, the Bank did not have a concentration in commercial real estate as defined by the regulatory guidance.

The Volcker Rule

On December 10, 2013, five U.S. financial regulators, including the Federal Reserve and FDIC, adopted a final rule implementing the “Volcker Rule.” The Volcker Rule was created by Section 619 of the Dodd-Frank Act and prohibits “banking entities” from engaging in “proprietary trading.” Banking entities also are prohibited from sponsoring or investing in private equity or hedge funds, or extending credit to or engaging in other covered transactions with affiliated private equity or hedge funds. The fundamental prohibitions of the Volcker Rule generally apply to banking entities of any size, including the Company, the Bank, and any other “affiliate” under the Bank Holding Company Act. The Economic Growth Act amended Section 619 to exempt from the Volcker Rule any insured depository institution that has $10.0 billion or less in total consolidated assets and whose total trading assets and trading liabilities are 5.0% or less of total consolidated assets.

Other Provisions of the Dodd-Frank Act

The Dodd-Frank Act, which became law on July 21, 2010, implemented far-reaching changes across the financial regulatory landscape. In addition to the reforms previously mentioned, the Dodd-Frank Act also:

•
Required bank holding companies and banks to be both well-capitalized and well-managed in order to acquire banks located outside their home state and required any bank holding company electing to be treated as a financial holding company to be both well-managed and well-capitalized;

•
Eliminated all remaining restrictions on interstate banking by authorizing national and state banks to establish de novo branches in any state that would permit a bank chartered in that state to open a branch at that location;

•
Repealed Regulation Q, the federal prohibition on the payment of interest on demand deposits, thereby permitting depository institutions to pay interest on business transactions and other accounts;

•
Enhanced insider transaction limitations by strengthening loan restrictions to insiders and applying the various limits to a greater number of types of transactions, including derivative transactions, repurchase agreements, reverse repurchase agreements, and securities lending or borrowing transactions. The law also restricted certain asset sales to and from an insider

13

to an institution, including requirements that such sales be on market terms and, in certain circumstances, approved by the institution’s board of directors;

•
Changed the assessment base for federal deposit insurance from the amount of insured deposits held by the depository institution to the institution’s average total consolidated assets less tangible equity; increased the minimum reserve ratio for the Deposit Insurance Fund from 1.15% to 1.35% and permanently increased the deposit insurance coverage amount from $100,000 to $250,000; and

•
Directed the Federal Reserve to establish interchange fees for debit cards under a restrictive, reasonable, and proportional cost per transaction standard.

While much of the Dodd-Frank Act has been implemented in the form of final rules from the banking agencies, the full extent of its impact on our operations is subject to change based on actions taken by the banking agencies in implementing the rules as well any future modifications to the rules.

Federal Home Loan Bank Membership

The Bank is a member of the Federal Home Loan Bank of Atlanta, or the FHLB. Each member of the FHLB is required to maintain a minimum investment in the Class B stock of the FHLB. The Board of Directors of the FHLB can increase the minimum investment requirements in the event it has concluded that additional capital is required to allow it to meet its own regulatory capital requirements. Any increase in the minimum investment requirements outside of specified ranges requires the approval of the Federal Housing Finance Agency. Because the extent of any obligation to increase the level of investment in the FHLB depends entirely upon the occurrence of a future event, we are unable to determine the extent of future required potential payments to the FHLB at this time. Additionally, in the event that a member financial institution fails, the right of the FHLB to seek repayment of funds loaned to that institution will take priority (a super lien) over the rights of all other creditors.

Other Laws and Regulations

Our operations are subject to several additional laws, some of which are specific to banking and others of which are applicable to commercial operations generally. For example, with respect to our lending practices, we are subject to the following laws and regulations, among several others:

•
Truth-In-Lending Act, governing disclosures of credit terms to consumer borrowers;

•
Home Mortgage Disclosure Act of 1975, requiring financial institutions to provide information to enable the public and public officials to determine whether a financial institution is fulfilling its obligation to help meet the housing needs of the community it serves;

•
Equal Credit Opportunity Act, prohibiting discrimination on the basis of race, creed, or other prohibited factors in extending credit;

•
Fair Credit Reporting Act of 1978, as amended by the Fair and Accurate Credit Transactions Act, governing the use and provision of information to credit reporting agencies, certain identity theft protections, and certain credit and other disclosures;

•
Fair Debt Collection Practices Act, governing the manner in which consumer debts may be collected by collection agencies;

•
Real Estate Settlement Procedures Act, requiring certain disclosures concerning loan closing costs and escrows, and governing transfers of loan servicing and the amounts of escrows in connection with loans secured by one-to-four family residential properties;

•
Bank Secrecy Act, as amended by the USA PATRIOT Act, imposing requirements and limitations on specific financial transactions and account relationships, intended to guard against money laundering and terrorism financing;

•
Rules and regulations established by the National Flood Insurance Program;

•
Sections 22(g) and 22(h) of the Federal Reserve Act which set lending restrictions and limitations regarding loans and other extensions of credit made to executive officers, directors, principal stockholders, and other insiders;

•
Sections 23A and 23B of the Federal Reserve Act, imposing restrictions regarding loans and other extensions of credit made by a bank to one or more of its affiliates; and

•
Rules and regulations of the various federal agencies charged with the responsibility of implementing these federal laws.

14

Our deposit operations are subject to federal laws applicable to depository accounts, including:

•
Right to Financial Privacy Act, which imposes a duty to maintain confidentiality of consumer financial records and prescribes procedures for complying with administrative subpoenas of financial records;

•
Truth-In-Savings Act, requiring certain disclosures for consumer deposit accounts;

•
Electronic Funds Transfer Act and Regulation E of the Federal Reserve, which govern automatic deposits to and withdrawals from deposit accounts and customers’ rights and liabilities arising from the use of automated teller machines and other electronic banking services; and

•
Rules and regulations of the various federal agencies charged with the responsibility of implementing these federal laws.

We are also subject to a variety of laws and regulations that are not limited to banking organizations. For example, in lending to commercial and consumer borrowers, and in owning and operating our own property, we are subject to regulations and potential liabilities under state and federal environmental laws. In addition, we must comply with privacy and data security laws and regulations at both the federal and state level.

We are heavily regulated by regulatory agencies at the federal and state levels. Like most of our competitors, we have faced and expect to continue to face increased regulation and regulatory and political scrutiny, which creates significant uncertainty for us, as well as for the financial services industry in general.

Enforcement Powers

The bank regulatory agencies have broad enforcement powers, including the power to terminate deposit insurance and impose substantial fines and other civil and criminal penalties. Failure to comply with applicable laws, regulations, and supervisory agreements, breaches of fiduciary duty, or the maintenance of unsafe and unsound conditions or practices, could subject us or our subsidiaries, including the Bank, as well as their respective officers, directors, and other institution-affiliated parties, to administrative sanctions, enforcement actions and potentially substantial civil money penalties.

Future Legislation and Regulation

From time to time regulators increase their focus on the regulation of the financial services industry, leading in many cases to greater uncertainty and compliance costs for regulated entities. For example, the provisions of the Dodd-Frank Act required us to make material expenditures, particularly in the form of personnel training costs and additional compliance expenses. Future regulations may require us to change certain of our business practices in order to comply, which in turn could adversely affect our ability to pursue business opportunities that we might otherwise consider pursuing, cause business disruptions, and/or have other impacts. Failure to comply with these laws or regulations, even if inadvertent, could result in negative publicity, fines, or additional expenses.

Furthermore, proposals that could substantially intensify the regulation of the financial services industry may be introduced in the United States Congress, in state legislatures, and by applicable regulatory authorities. These proposals may change banking statutes and regulations and our operating environment in substantial and unpredictable ways. If enacted, these proposals could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance among banks, savings associations, credit unions, and other financial institutions. We cannot predict whether any of these proposals will be enacted and, if enacted, the effect that these proposals, or any implementing regulations, would have on our business, results of operations, or financial condition.

Website Information

We maintain a website at www.riverbankandtrust.com through which we make available, free of charge under the tab “Investor Relations,” our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and all amendments to those reports filed or furnished pursuant to Section 13(a) of the Exchange Act as soon as reasonably practicable after such material is electronically filed with the SEC. These reports are also available on the SEC’s website, www.sec.gov. We also include our Code of Business Conduct and Ethics under the tab "Investor Relations" of our website. We will provide paper copies of these reports to stockholders free of charge upon written request to: River Financial Corporation, Attention: Corporate Secretary, P.O. Box 680249, Alabama 36068. Information on, or accessible through, our website is not part of this Annual Report on Form 10-K. We have included our website address only as an inactive textual reference and do not intend it to be an active link to our website.

15