NYSE: SFBS

Our business is conducted through a single reportable segment, and our principal business is to accept deposits from the public and to make loans and other investments. Our principal sources of funds for loans and investments are demand, time, savings and other deposits and the amortization and prepayment of loans and borrowings. Our principal sources of income are interest and fees collected on loans, interest and dividends collected on other investments, and service charges. Our principal expenses are interest paid on savings and other deposits, interest paid on our other borrowings, employee compensation, office expenses and other overhead expenses.

Certain of our subsidiaries hold and manage participations in residential mortgages and commercial real estate loans originated by our bank in Alabama, Florida, Georgia and Tennessee, respectively, and have elected to be treated as a real estate investment trust, or REIT, for U.S. income tax purposes. The financial results of each of these entities is consolidated into the Company’s financial results.

As a bank holding company, we are subject to regulation by the Board of Governors of the Federal Reserve System (the “Federal Reserve”). We are required to file reports with the Federal Reserve and are subject to regular examinations by that agency.

Markets and Competition

We operate primarily from locations in Alabama, Florida, Georgia, North and South Carolina, Tennessee and Virginia. We also operate a loan production office in Florida. As of December 31, 2025, we operated through 33 banking offices and one loan production office. We draw most of our deposits from, and conduct most of our lending transactions in, these markets.

Our retail and commercial divisions operate in highly competitive markets. We compete directly in retail and commercial banking markets with other commercial banks, savings and loan associations, credit unions, mortgage brokers and mortgage companies, mutual funds, securities brokers, consumer finance companies, other lenders and insurance companies, locally, regionally and nationally. Many of our competitors compete by using offerings by mail, telephone, computer and/or the Internet. Interest rates, both on loans and deposits, and prices of services are significant competitive factors among financial institutions generally. Providing convenient locations, desired financial products and services, convenient office hours, quality customer service, quick local decision making, a strong community reputation and long-term personal relationships are all important competitive factors that we emphasize.

5

In our markets, our five largest competitors are Regions Financial Corporation, Wells Fargo & Company, PNC Financial Services Group, Inc., Truist Financial Corporation, and Pinnacle Financial Partners, Inc. (formerly Synovus Financial Corp.). These institutions, as well as other competitors of ours, may have greater resources, serve broader geographic markets, have higher lending limits, offer various services that we do not offer and may better afford, and make broader use of, media advertising, support services, and electronic technology than us. To offset these competitive disadvantages, we depend on our reputation for greater personal service, consistency, flexibility and the ability to make credit and other business decisions quickly.

Lending Services

Commercial Loans

Our commercial lending activity is directed principally toward businesses and professional service firms whose demand for funds falls within our legal lending limits, and we offer a variety of commercial lending products to meet the needs of business and professional service firms in our service areas. We make seasonal loans, bridge loans, and term loans to small- and medium-sized businesses in our markets for a variety of business purposes, including, but not limited to, expanding business, acquiring property, upgrading plant and equipment, buying inventory and for general working capital. Typically, targeted business borrowers have annual sales between $2 million and $250 million. This category of loans includes loans made to individual, partnership and corporate borrowers. We also offer commercial lines of credit. The repayment terms of our commercial loans will vary according to the needs of each customer.

Our commercial loans usually are collateralized. Generally, collateral consists of business assets, including accounts receivable, inventory, equipment, and/or real estate. Collateral is subject to the risk that we may have difficulty converting it to a liquid asset if necessary, as well as risks associated with degree of specialization, mobility and general collectability in a default situation. To mitigate this risk, we have strict collateral underwriting standards, including valuations and general acceptability based on our ability to monitor its ongoing condition and value.

We underwrite our commercial loans primarily on the basis of the borrower’s cash flow, ability to service debt, and degree of management expertise. As a general practice, we take as collateral a security interest in any available real estate, equipment or personal property. Under limited circumstances, we may make commercial loans on an unsecured basis. Commercial loans may be subject to many different types of risks, including fraud, bankruptcy, economic downturn, deteriorated or non-existent collateral, and changes in interest rates. Perceived and actual risks may differ depending on the particular industry in which a borrower operates. General risks to an industry, such as an economic downturn or instability in the capital markets, or to a particular segment of an industry are monitored by senior management on an ongoing basis. When warranted, loans to individual borrowers who may be at risk due to an industry condition may be more closely analyzed and reviewed by the credit review committee or Board of Directors. Commercial and industrial borrowers are required to submit financial statements to us on a regular basis. We analyze these statements, looking for weaknesses and trends, and will assign the loan a risk grade accordingly. Based on this risk grade, the loan may receive an increased degree of scrutiny by management.

Real Estate Loans

We make commercial real estate loans, 1-4 family residential real estate loans, and construction and development loans.

Commercial Real Estate. We make both owner-occupied and non-owner-occupied commercial real estate loans. Commercial real estate loans are generally limited to terms of five years or less, although payments are usually structured based on a longer amortization. Interest rates may be fixed or adjustable, although rates generally will not be fixed for a period exceeding five years.

Commercial real estate lending presents risks not found in traditional residential real estate lending. Repayment is dependent upon successful management and marketing of properties and on the level of expense necessary to maintain the property. Repayment of these loans may be adversely affected by conditions in the real estate market or the general economy. Also, commercial real estate loans typically involve relatively large loan balances to a single borrower. To mitigate these risks, we closely monitor our borrower concentration and report these to the Board of Directors on a quarterly basis. These loans generally have shorter maturities than other loans, giving us an opportunity to reprice, restructure or decline renewal. As with other loans, all commercial real estate loans are graded depending upon strength of credit and performance, and a higher risk grade will bring increased scrutiny by our management, the credit review committee, and the Board of Directors. In addition, we generally require personal guarantees from the principal owners of the property supported by a review by our management of the principal owners’ personal financial statements.

6

Commercial real estate has received increased regulatory scrutiny in recent quarters due to valuation concerns associated with interest rates. Our Credit Administration department works with vendors to conduct an annual stress test for all commercial loans, and the results are presented to our Board of Directors.

In managing the risks associated with our commercial real estate portfolio, we utilize several practices. We have three independent loan reviews performed each year that cover 35-40% (approximately 400 relationships) of the entire commercial loan portfolio on a committed basis. Two of these reviews include commercial real estate loans and construction and development loans. These independent reviews, conducted by a third-party vendor, address underwriting, servicing, and risk grade confirmation and result in written findings and recommendations. We also hold formal quarterly meetings—including Lenders, Regional Credit Officers, and Regional CEOs—to discuss all problem credits and potential workout plans in detail. In addition, we prepare monthly and quarterly reports for our Board of Directors and management covering problem loans, concentrations, exceptions, regulatory requirements (including HVCRE and Regulation H), and notable trends. Furthermore, every year during the first quarter, our Credit Administration department prepares a comprehensive report on our commercial real estate and commercial construction portfolios, including analysis of current performance, industry information, and trends across multifamily, retail, office, hotel, and nursing/assisted living facilities, all of which is presented to our Board.

Owner-Occupied Commercial Real Estate. We focus on the banking needs of established operating companies, which includes owner-occupied office and industrial real estate loans. Risks associated with owner-occupied commercial real estate include the quality of the borrower’s management and operations, fluctuations in the value of real estate, and the overall strength of the economy. In addition to a proven management team and track record, we target businesses with strong historical cash flows. Loans are conservatively underwritten and typically carry the personal guarantee of the business owners. We believe this portfolio segment is well diversified by industry type.

At year-end 2025, owner-occupied commercial real estate totaled approximately $2.74 billion, representing 20.0% of our total loan portfolio. Substandard loans in this segment totaled $21.1 million, and we recorded approximately $4.0 million in net charge-offs during 2025. In addition to the credit quality monitoring actions described above, we also require annual reviews for relationships greater than $3.0 million, which are completed by the responsible Lender and submitted to Credit Administration for approval. These reviews include a discussion of key credit issues and collateral monitoring and help ensure any emerging risks are quickly identified and addressed.

Non-Owner-Occupied Commercial Real Estate. Risks associated with non-owner-occupied commercial real estate include fluctuations in the value of real estate, the overall strength of the economy, tenant vacancy rates, and the quality of the borrower’s management. We lend to developers and owners with a proven history of success, who demonstrate sufficient equity in their projects and strong liquidity. Loans are conservatively underwritten, with interest rates, vacancy levels, and rental rates stressed to gauge performance through various economic conditions. These loans typically carry personal guarantees from the owners.

At year-end 2025, non-owner-occupied commercial real estate amounted to approximately $4.60 billion, representing 33.6% of our total loan portfolio. Substandard loans in this category totaled $88.7 million, we recorded approximately $1.2 million in net charge-offs during 2025. In order to manage the risk inherent in these credits, we prepare a quarterly report to the Board of Directors detailing the top 20 metropolitan areas in which our collateral is located. In addition to the credit quality monitoring actions described above for non-owner-occupied commercial real estate loans over $3.0 million, we perform a more granular loan-level stress test using updated borrower financial information and data provided by a third-party vendor. These loan-level stress test results are shared with the Risk Management Committee for further oversight. Relationships exceeding $3.0 million are subject to the same annual review requirement that applies to owner-occupied properties and construction loans.

1-4 Family Mortgage. Our 1-4 family mortgage residential loans consist primarily of residential second mortgage loans, residential construction loans, and traditional mortgage lending for one-to-four family residences. We will originate fixed-rate mortgages with long-term maturities; however, most of these fixed-rate loans are sold in the secondary mortgage market. All 1-4 family mortgage loans are made in accordance with our appraisal policy, with the ratio of the loan principal to the value of the collateral established by an independent appraisal generally not exceeding 85%.

Risks associated with these loans are generally less significant than those for our other real estate loan types. Potential risks include bankruptcies, economic downturns, customer financial problems, and fluctuations in real estate values. We have not made, and do not expect to make, any “Alt-A” or subprime loans. At year-end 2025, our 1-4 family mortgage portfolio was approximately $1.67 billion, representing 12.2% of our total loan portfolio. Substandard loans totaled $10.0 million, and we recorded approximately $303,000 in charge-offs for 2025. In addition to the credit quality monitoring actions described above, our quarterly regional credit meetings and monthly/quarterly reports to the Board also include details on problem 1-4 family mortgage loans and broader portfolio trends.

7

Construction and Development Loans. We make construction and development loans on both a pre-sold and speculative basis. If the borrower has entered into an agreement to sell the property prior to beginning construction, the loan is considered pre-sold; otherwise, it is deemed speculative. Construction and development loans are generally made with terms of 12 to 36 months, with interest payable monthly. The ratio of loan principal to the value of collateral, as determined by an independent appraisal, typically does not exceed 80% for residential construction loans. Speculative construction loans are underwritten based on the borrower’s financial strength and cash flow position, while development loans are generally limited to 75% of the appraised value. Loan proceeds are disbursed proportionally with construction progress and only after the project has been inspected by either an experienced construction lender or a qualified third-party inspector. Construction and development loans generally carry a higher degree of risk than other loan types during times of economic stress.

Construction and development loans are monitored by our Credit Administration department, and we provide quarterly reports on this portfolio to the Board of Directors. The Credit Administration department also reviews and approves loan draws on commercial construction loans with a committed balance exceeding $3.0 million. These reviews include monitoring interest reserve sufficiency and assessing occupancy or absorption levels at six months post-completion for newly completed projects. Relationships in excess of $3.0 million are also subject to annual review by the responsible Lender, with final approval required from Credit Administration, ensuring any potential concerns in this portfolio are identified and addressed proactively.

To mitigate the risk of construction loan defaults in our portfolio, management tracks and monitors these loans closely, with oversight from the Board of Directors. Total construction loans decreased $31.7 million, or 2.1%, at December 31, 2025, compared to December 31, 2024. There were $16,000 in net charge-offs on construction loans during 2025 and $(8,000) in net charge-offs (recoveries) on construction loans during 2024. There were $36.8 million in construction loans rated as substandard at December 31, 2025 and $3.5 million construction loans rated as substandard at December 31, 2024.

Consumer Loans

We offer a variety of loans to retail customers in the communities we serve. Consumer loans in general carry a moderate degree of risk compared to other loans. They are generally more risky than traditional residential real estate loans but less risky than commercial loans. Risk of default is usually determined by the well-being of the local economies. During times of economic stress, there is usually some level of job loss both nationally and locally, which directly affects the ability of the consumer to repay debt. Risk on consumer-type loans is generally managed through policy limitations on debt levels consumer borrowers may carry and limitations on loan terms and amounts depending upon collateral type.

Our consumer loans include home equity loans (open and closed-end), vehicle financing, loans secured by deposits, and secured and unsecured personal loans. These types of consumer loans all carry varying degrees of risk.

Commitments and Contingencies

As of December 31, 2025, we had commitments to extend credit beyond current amounts funded of $3.78 billion, had issued standby letters of credit in the amount of $117.4 million, and had commitments for credit card arrangements of $395.8 million.

Investments

In addition to loans, we purchase investments in securities, primarily in mortgage-backed securities and state and municipal securities. No investment in any of those instruments will exceed any applicable limitation imposed by law or regulation. Our Board of Directors reviews the investment portfolio on an ongoing basis in order to ensure that the investments conform to the policy as set by the Board of Directors. Our investment policy provides that no more than 30% of our total investment portfolio may be composed of municipal securities. All securities held are traded in liquid markets, and we have no auction-rate securities. We had no investments in any one security, restricted or liquid, in excess of 10% of our stockholders’ equity at December 31, 2025.

Deposit Services

We seek to establish solid core deposits, including checking accounts, money market accounts, savings accounts and a variety of certificates of deposit and individual retirement arrangements, or IRA accounts. To attract deposits, we employ an aggressive marketing plan throughout our service areas that features a broad product line and competitive services. The primary sources of core deposits are residents of, and businesses and their employees located in, our market areas. We have obtained deposits primarily through personal solicitation by our officers and directors, through reinvestment in the community, and through our stockholders, who have been a substantial source of deposits and referrals. We make deposit services accessible to customers by offering traditional banking services, including direct deposit, wire transfer, night depository, banking-by-mail and remote capture for non-cash items. Our bank is a member of the FDIC, and thus our deposits (subject to applicable FDIC limits) are FDIC-insured.

8

Other Banking Services

Given client demand for increased convenience and account access, we offer a range of products and services, including 24-hour telephone banking, direct deposit, Internet banking, mobile banking, traveler’s checks, safe deposit boxes, attorney trust accounts and automatic account transfers. We also participate in a shared network of automated teller machines and a debit card system that our customers are able to use, and, in certain accounts subject to certain conditions, we rebate to the customer the ATM fees automatically after each business day. Additionally, we offer Visa® credit cards.

Asset, Liability and Risk Management

We manage our assets and liabilities with the aim of providing an optimum and stable net interest margin, a profitable after-tax return on assets and return on equity, and adequate liquidity. These management strategies are conducted within the framework of written loan and investment policies. To monitor and manage the interest rate margin and related interest rate risk, we have established policies and procedures to monitor and report on interest rate risk, devise strategies to manage interest rate risk, monitor loan originations and deposit activity and approve all pricing strategies. We attempt to maintain a balanced position between rate-sensitive assets and rate-sensitive liabilities. Specifically, we chart assets and liabilities on a matrix by maturity, effective duration, and interest adjustment period, and endeavor to manage any gaps in maturity ranges.

Seasonality and Cycles

We do not consider our commercial banking business to be seasonal.

Supervision and Regulation

Both we and our bank are subject to extensive state and federal banking laws and regulations that impose restrictions on, and provide for general regulatory oversight of, our operations. These laws and regulations restrict our permissible activities and investments, impose conditions and requirements on the products and services we offer and the manner in which they are offered and sold, and require compliance with protections for loan, deposit, brokerage, fiduciary, and other customers, among other things. They also restrict our ability to repurchase stock or pay dividends, or to receive dividends from our bank subsidiary, and they impose capital adequacy and liquidity requirements. These laws and regulations generally are intended to protect customers (including depositors), the FDIC’s Deposit Insurance Fund and the banking system as a whole, and generally are not intended for the protection of stockholders or other investors. The consequences of noncompliance with these, or other applicable laws or regulations, can include substantial monetary and nonmonetary sanctions.

In addition, we and the Bank are subject to comprehensive supervision and periodic examination by the Federal Reserve, the FDIC, the Alabama State Banking Department (the “Alabama Banking Department”), and the U.S. Consumer Financial Protection Bureau (the “CFPB”), among other regulatory bodies. Those agencies consider not only compliance with applicable laws, regulations and supervisory policies, but also capital levels, asset quality, risk management effectiveness, the ability and performance of management and the Board of Directors, the effectiveness of internal controls, earnings, liquidity and various other factors. Regarding the CFPB, we became subject to more comprehensive regulation by the CFPB in 2021. The CFPB’s supervisory focus primarily involves an institution’s compliance with federal consumer protection laws.

The results of examination activity by any of our federal or state bank regulators potentially can result in the imposition of significant limitations on our activities and growth. These regulatory agencies generally have broad discretion to impose restrictions and limitations on the operations of a regulated entity and take enforcement action, including the imposition of substantial monetary penalties and nonmonetary requirements, against a regulated entity where the relevant agency determines, among other things, that such operations fail to comply with applicable law or regulations or are conducted in an unsafe or unsound manner. This supervisory framework, including the examination reports and supervisory ratings (which are not publicly available) of the agencies, could materially impact the conduct, growth and profitability of our operations.

The following discussion describes select material elements of the regulatory framework that applies to us. The description is not intended to summarize all laws, regulations and supervisory policies applicable to us and is qualified in its entirety by reference to the full text of the statutes, regulations and supervisory policies described. Further, the following discussion addresses the select material elements of the regulatory framework as in effect as of the date of this Form 10-K. Legislation and regulatory action to revise federal and state banking laws and regulations, sometimes in a substantial manner, are continually under consideration by the U.S. Congress, state legislatures and federal and state regulatory agencies. The recent changes in the U.S. presidential administration and the composition of the U.S. Congress has led to significant changes to the existence, priorities, scope, practices and/or staffing levels of various regulatory agencies. For example, in February 2025, the Trump administration directed the CFPB to, among other things, suspend rule implementations and cease supervision activities. Accordingly, the following discussion must be read in light of the enactment of any new federal or state banking laws or regulations or any amendment or repeal of existing laws or regulations, or any change in the policies of the regulatory agencies with jurisdiction over our operations, after the date of this Form 10-K.

9

Bank Holding Company Supervision and Regulation

Because we own all of the capital stock of the Bank, we are a bank holding company under the federal Bank Holding Company Act of 1956, as amended (the “BHC Act”). As a result, we are primarily subject to the supervision, examination and reporting requirements of the BHC Act and the regulations of the Federal Reserve.

Acquisition of Banks

The BHC Act requires every bank holding company to obtain the Federal Reserve’s prior approval before:

● acquiring direct or indirect ownership or control of any voting shares of any bank if, after the acquisition, the bank holding company will, directly or indirectly, own or control more than 5% of the bank’s voting shares;

● acquiring all or substantially all of the assets of any bank; or

● merging or consolidating with any other bank holding company.

In reviewing merger and other acquisition transactions, the Federal Reserve is required to consider the financial and managerial resources and future prospects of the bank holding companies and banks concerned and the convenience and needs of the community to be served. The Federal Reserve’s consideration of financial resources generally focuses on capital adequacy, which is discussed in the section below titled “Supervision and Regulation—Bank Supervision and Regulation – Capital Adequacy.” The consideration of convenience and needs of the community to be served includes the institution’s performance under the Community Reinvestment Act (the “CRA”).

Additionally, the BHC Act provides that the Federal Reserve may not approve a merger or other acquisition transaction if the transaction would result in or tend to create a monopoly or substantially lessen competition or otherwise function as a restraint of trade, unless the anti-competitive effects of the proposed transaction are clearly outweighed by the public interest in meeting the convenience and needs of the community to be served.

Change in Bank Control

Subject to various exceptions, the BHC Act and the Change in Bank Control Act, together with related regulations, require Federal Reserve approval prior to any person’s or company’s acquiring “control” of a bank holding company. Under a rebuttable presumption established by the Federal Reserve, the acquisition of 10% or more of a class of voting stock of a bank holding company would, under the circumstances set forth in the presumption, constitute acquisition of control of the bank holding company. In addition, any person or group of persons acting in concert must obtain the approval of the Federal Reserve before acquiring 25% or more of the outstanding common stock of a bank holding company or otherwise obtaining control or a “controlling influence” over the bank holding company (certain presumptions of control may apply once an acquiror owns 5% or more of the common stock and certain other factors are present).

Permissible Activities Under the BHC Act

Under the BHC Act, a bank holding company is generally permitted to engage in or acquire direct or indirect control of more than 5% of the voting shares of any company engaged in the following activities:

● banking or managing or controlling banks; and

● any activity that the Federal Reserve determines to be so closely related to banking as to be a proper incident to the business of banking.

Activities that the Federal Reserve has found to be so closely related to banking as to be a proper incident to the business of banking include: factoring accounts receivable; making, acquiring, brokering or servicing loans and usual lending-related activities; leasing personal property; operating a non-bank depository institution, such as a savings association; trust company functions; financial and investment advisory activities; certain agency securities brokerage activities; underwriting and dealing in government obligations and money market instruments; providing specified management consulting and counseling activities; performing selected data processing services and support services; and acting as an agent or broker in selling credit life insurance and other types of insurance in connection with credit transactions. Despite prior approval, the Federal Reserve may order a bank holding company or its subsidiaries to terminate any of these activities or to terminate its ownership or control of any subsidiary when it has reasonable cause to believe that the bank holding company’s continued ownership, activity or control constitutes a serious risk to the financial safety, soundness, or stability of it or any of its bank subsidiaries.

10

In addition to the permissible bank holding company activities listed above, a bank holding company may qualify and elect to become a financial holding company, permitting the bank holding company to engage in activities that are financial in nature or incidental or complementary to financial activity without posing a substantial risk to the safety and soundness of a depository institution or to the financial system generally. The BHC Act expressly lists the following activities as financial in nature: lending, trust and other banking activities; insuring, guaranteeing, or indemnifying against loss or harm, or providing and issuing annuities, and acting as principal, agent, or broker for these purposes, in any state; providing financial, investment, or economic advisory services; issuing or selling instruments representing interests in pools of assets permissible for a bank to hold directly; underwriting, dealing in or making a market in securities; other activities that the Federal Reserve may determine to be so closely related to banking or managing or controlling banks as to be a proper incident to managing or controlling banks; activities permitted outside of the United States if the Federal Reserve has determined them to be usual in connection with banking operations abroad; merchant banking through securities or insurance affiliates; and insurance company portfolio investments. For us to qualify to become a financial holding company, the bank and any other depository institution subsidiary of ours must be well-capitalized and well-managed and must have a CRA rating of at least “satisfactory”. Additionally, we must file an election with the Federal Reserve to become a financial holding company and must provide the Federal Reserve with 30 days written notice after engaging in a permitted financial activity. We have not elected to become a financial holding company at this time.

Support of Subsidiary Institutions

The Federal Deposit Insurance Act and Federal Reserve policy require a bank holding company to act as a source of financial and managerial strength to its bank subsidiaries. Under these requirements, a bank holding company is expected to commit financial resources and take other measures to support its bank subsidiaries even at times when the holding company may not be in a financial position to provide such resources or when the holding company may not be inclined to provide them. In addition, where a bank holding company has more than one bank or thrift subsidiary, each of the bank holding company’s subsidiary depository institutions is responsible for any losses to the FDIC as a result of an affiliated depository institution’s failure. As a result of these requirements, a bank holding company may, among other things, be compelled to loan money to a bank subsidiary in the form of subordinate capital notes or other instruments that qualify as capital under bank regulatory rules. Any loans from the holding company to such subsidiary banks likely would be unsecured and subordinated to such bank’s depositors and perhaps to other creditors of the bank.

Repurchase or Redemption of Securities

A bank holding company is generally required to give the Federal Reserve prior written notice of any purchase or redemption of its own then-outstanding equity securities if the gross consideration for the purchase or redemption, when combined with the net consideration paid for all such purchases or redemptions during the preceding 12 months, is equal to 10% or more of the company’s consolidated net worth. The Federal Reserve may disapprove such a purchase or redemption if it determines that the proposal would constitute an unsafe and unsound practice, or would violate any law, regulation, Federal Reserve order or directive, or any condition imposed by, or written agreement with, the Federal Reserve. The Federal Reserve has adopted an exception to this approval requirement for well-capitalized bank holding companies that meet certain conditions.

Bank Supervision and Regulation

Generally

The Bank is an Alabama state-chartered bank and, as such, is subject to examination and regulation by the Alabama Banking Department. The Bank is not a member of the Federal Reserve System but is subject to various regulations and requirements promulgated by the Federal Reserve, the CFPB, the Federal Trade Commission, the Financial Crimes Enforcement Network, the Office of Foreign Assets Control (“OFAC”), and other federal regulatory agencies. State non-member banks are, in addition to regulation by the applicable state regulatory authority, subject to supervision and regular examination by the FDIC. The FDIC and the Alabama Banking Department regularly examine the Bank’s operations and have the authority to approve or disapprove mergers, the establishment of branches and similar corporate actions. Both regulatory agencies have the power to prevent the development or continuance of unsafe or unsound banking practices or other violations of law. Additionally, the Bank’s deposits are insured by the FDIC to the maximum extent provided by law. The extensive state and federal banking laws and regulations to which the Bank is subject are generally intended to protect the Bank’s customers (including depositors), the FDIC’s Deposit Insurance Fund and the banking system as a whole, and generally is not intended for the protection of stockholders or other investors. The following discussion describes the material elements of the regulatory framework that applies to the Bank.

11

FDIC Insurance Assessments

The Bank’s deposits are insured by the FDIC to the full extent provided in the Federal Deposit Insurance Act, and the Bank pays assessments to the FDIC for that coverage. Under the FDIC’s risk-based deposit insurance assessment system, an insured institution’s deposit insurance premium is computed by multiplying the institution’s assessment base by the institution’s assessment rate. An institution's assessment base and assessment rate are determined each quarter.

An institution’s assessment base equals the institution’s average consolidated total assets during a particular assessment period, minus the institution’s average tangible equity capital (that is, Tier 1 capital) during such period. The method for determining an institution's risked-based assessment rate differs for small banks and large banks. Large banks (generally, those with $10 billion or more in assets) are assigned an individual rate based on a scorecard. The scorecard combines the following measures to produce a score that is converted to an assessment rate: CAMELS component ratings, financial measures used to measure a bank's ability to withstand asset-related and funding-related stress, and a measure of loss severity that estimates the relative magnitude of potential losses to the FDIC in the event of the bank's failure. Assessment rates for both large and small banks are subject to adjustment. Assessment rates: (1) decrease for issuance of long-term unsecured debt, including senior unsecured debt and subordinated debt; (2) increase for holdings of long-term unsecured or subordinated debt issued by other insured banks (the Depository Institution Debt Adjustment or DIDA); and (3) for large banks that are not well-rated or not well-capitalized, increase for significant holdings of brokered deposits. In November 2023, the FDIC issued a final rule implementing a special assessment to recover the loss to the Deposit Insurance Fund associated with protecting uninsured depositors following the closures of Silicon Valley Bank and Signature Bank. The assessment base for the special assessment equals an insured depository institution’s estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion. The special assessment will be collected at an annual rate of approximately 13.4 basis points for an initial total of eight quarterly assessment periods. The amount the Bank pays to the FDIC in assessments is affected not only by the risk the Bank poses to the Deposit Insurance Fund, but also by the adequacy of the fund to cover the risk posed by all insured institutions. From 2008 to 2013, the United States experienced an unusually high number of bank failures, resulting in significant losses to the Deposit Insurance Fund. Moreover, the Dodd-Frank Act permanently increased the standard maximum deposit insurance amount from $100,000 to $250,000, and raised the minimum required Deposit Insurance Fund reserve ratio (i.e., the ratio of the amount on reserve in the Deposit Insurance Fund to the total estimated insured deposits) from 1.15% to 1.35%. To support the Deposit Insurance Fund in response to those circumstances, the FDIC took several extraordinary actions, including imposing a one-time special assessment on insured institutions in 2023, with an updated assessment in 2024, and requiring institutions to prepay quarterly assessments attributable to a three-year period. The FDIC also has established a higher long-term target Deposit Insurance Fund ratio of 2%. We cannot predict whether, as a result of an adverse change in economic conditions or other reasons, the FDIC will take similar extraordinary actions or otherwise increase deposit insurance assessment levels in the future. Any future increases could have a negative impact on our bank’s earnings.

Termination of Deposit Insurance

The FDIC may terminate its insurance of deposits of a bank if it finds that the bank has engaged in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC.

Community Reinvestment Act

The CRA requires that, in connection with examinations of financial institutions within their respective jurisdictions, the Federal Reserve or the FDIC will evaluate the record of each financial institution in meeting the needs of its local community, including low and moderate-income neighborhoods. These factors are also considered in evaluating mergers, acquisitions, and applications to open an office or facility. Failure to adequately meet these criteria could impose additional requirements and limitations on the Bank. Additionally, we must publicly disclose the terms of various CRA-related agreements.

On October 24, 2023, the federal banking agencies adopted a final rule to modernize the CRA regulations. Under the final rule, (1) the federal banking agencies will evaluate bank performance across the varied activities they conduct and communities in which they operate in order to encourage banks to expand access to credit, investment, and banking services in low- and moderate-income communities, (2) the CRA regulations are updated to evaluate lending outside traditional assessment areas generated by the growth of non-branch delivery systems, such as online and mobile banking, branchless banking, and hybrid models, (3) a new metrics-based approach was adopted to evaluate bank retail lending and community development financing, using benchmarks based on peer and demographic data and (4) CRA evaluations and data collection are tailored according to bank size and type. In addition, the final rule also exempts small and intermediate banks from new data requirements that apply to banks with assets of at least $2 billion and limits certain new data requirements to large banks with assets greater than $10 billion. Most of the new rule's requirements were originally scheduled to become applicable on January 1, 2026 with the remaining requirements, including the data reporting requirements, becoming applicable on January 1, 2027. However, a federal court issued an injunction in March 2024 that indefinitely extended the compliance date until the injunction is lifted. Further, in July 2025, the federal banking agencies issued a notice of proposed rulemaking to rescind the October 2023 final rulemaking and replace it with the prior CRA regulation.

12

Interest Rate Limitations

Interest and other charges collected or contracted for by the Bank are subject to state usury laws and federal laws concerning interest rates.

Federal Laws Applicable to Consumer Credit and Deposit Transactions

The Bank’s loan and deposit operations are subject to a number of federal consumer protection laws and regulations, including, among others:

●

the Truth-In-Lending Act, as implemented by Regulation Z issued by the CFPB, governing, among other things, the disclosure of credit terms to consumers;

●

the Real Estate Settlement Procedures Act, as implemented by Regulation X issued by the CFPB, prescribing, among other things, requirements in connection with residential mortgage loan applications, settlements, and servicing;

●

the Home Mortgage Disclosure Act, as implemented by Regulation C issued by the CFPB, requiring financial institutions to provide information to enable the public and public officials to determine whether a financial institution is fulfilling its obligation to help meet the housing needs of the community it serves;

●

the Equal Credit Opportunity Act, as implemented by Regulation B issued by the CFPB, prohibiting discrimination on the basis of race, color, religion, national origin, sex, marital status, age, or certain other prohibited factors in all aspects of credit transactions, imposing certain requirements regarding credit applications, and prescribing certain disclosure obligations;

●

the Fair Credit Reporting Act, as implemented in part by Regulation V issued by the CFPB, governing the use and provision of information to credit reporting agencies by imposing, among other things, requirements for financial institutions to develop policies and procedures to identify potential identity theft, requirements for entities that furnish information to consumer reporting agencies (which would include the Bank) to implement procedures and policies regarding the accuracy and integrity of the furnished information and respond to disputes from consumers regarding credit reporting issues, requirements for mortgage lenders to disclose credit scores to consumers, and limitations on the ability of a business that receives consumer information from an affiliate to use that information for marketing purposes;

●

the Fair Debt Collection Practices Act, as implemented in part by Regulation F issued by the CFPB, governing the manner in which consumer debts may be collected by debt collectors;

●

the Servicemembers’ Civil Relief Act, governing the repayment terms of, and property rights underlying, secured obligations of persons in military service;

●

the Right to Financial Privacy Act, imposing a duty to maintain the confidentiality of consumer financial records and prescribing procedures for complying with administrative subpoenas of financial records;

●

the Electronic Funds Transfer Act, as implemented by Regulation E issued by the CFPB, governing automatic deposits to and withdrawals from deposit accounts and customers’ rights and liabilities arising from the use of automated teller machines and other electronic banking services;

●

the Truth in Savings Act, as implemented by Regulation DD issued by the CFPB, governing, among other things, the disclosure of deposit terms to consumers; and

●

the Fair Housing Act, prohibiting discrimination in most housing-related activities, including financing, based on race, color, sex, national origin or religion.

Additionally, the Dodd-Frank Act permits states to adopt consumer protection laws and standards that are more stringent than those adopted at the federal level and, in certain circumstances, permits state attorneys general to enforce compliance with both the state and federal laws and regulations.

Capital Adequacy

General Information. The federal banking agencies view capital levels as important indicators of an institution’s financial soundness. In this regard, we and the Bank are required to comply with the capital adequacy standards established by the Federal Reserve (in our case) and the FDIC and the Alabama Banking Department (in the case of the Bank). Such standards are based on the December 2010 final capital framework for strengthening international capital standards, known as Basel III, of the Basel Committee on Banking Supervision (the “Basel Committee”). The implementation of Basel III for United States institutions began on January 1, 2015.

Current capital standards are designed to make regulatory capital requirements more sensitive to differences in risk profiles among banks and bank holding companies, to account for off-balance-sheet exposure, and to minimize disincentives for holding liquid assets. Assets and off-balance-sheet items, such as letters of credit and unfunded loan commitments, are assigned to broad risk categories, each with appropriate risk weights. The resulting capital ratios represent capital as a percentage of total risk-weighted assets and off-balance-sheet items.

13

Failure to meet capital guidelines could subject a bank or bank holding company to a variety of enforcement remedies, including issuance of a capital directive, the termination of deposit insurance by the FDIC, a prohibition on accepting brokered deposits, and certain other restrictions on its business. Significant additional restrictions can be imposed on FDIC-insured depository institutions that fail to meet applicable capital requirements.

United States Implementation of Basel III. In July 2013, the federal banking agencies published final rules (the “Basel III Capital Rules”) to implement, in part, the Basel III framework issued by the Basel Committee and certain provisions of the Dodd-Frank Act. The Basel III Capital Rules apply to banking organizations, including us and the Bank.

Among other things, the Basel III Capital Rules: (i) emphasize common equity tier 1 capital, or “CET1,” which is predominately made up of retained earnings and common stock instruments; (ii) specify that an institution’s tier 1 capital consists of CET1 and additional financial instruments satisfying specified requirements that permit inclusion in tier 1 capital; (iii) define CET1 narrowly by requiring that most deductions or adjustments to regulatory capital measures be made to CET1 and not to the other components of capital; and (iv) expand the scope of the deductions or adjustments from capital as compared to the previous regulations. The Basel III Capital Rules also provide a permanent exemption from a proposed phase out of existing trust preferred securities and cumulative perpetual preferred stock from regulatory capital for banking organizations with less than $15 billion in total consolidated assets as of December 31, 2009.

The Basel III Capital Rules provide for the following minimum capital to risk-weighted assets ratios:

● 4.5% based upon CET1;

● 6.0% based upon tier 1 capital; and

● 8.0% based upon total regulatory capital (tier 1 plus tier 2).

A minimum leverage ratio (tier 1 capital as a percentage of total assets) of 4.0% is also required under the Basel III Capital Rules. The Basel III Capital Rules additionally require institutions to retain a capital conservation buffer of 2.5% above these required minimum capital ratio levels. The capital conservation buffer, which must consist of CET1, is designed to absorb losses during periods of economic stress. Banking organizations that fail to maintain the minimum 2.5% capital conservation buffer could face restrictions on capital distributions or discretionary bonus payments to executive officers.

The Basel III Capital Rules became effective as applied to us and the Bank on January 1, 2015, with a phase in period that generally extended from January 1, 2015 through January 1, 2019. We and the Bank are currently in compliance with Basel III Capital Rules.

Since the initial implementation of the Basel III Capital Rules, the U.S. federal banking agencies and other interested parties have proposed and, in certain cases, made changes to the rules based on a number of factors, including prevailing economic conditions and policy initiatives. For example, in September 2017 the U.S. federal banking agencies proposed revisions to the Basel III Capital Rules to simplify the capital treatment of certain types of assets, including certain types of mortgage servicing rights and tax deferred assets. Those revisions, with certain modifications, took effect in April 2020.

In December 2017, the Basel Committee published revisions to its regulatory framework that it described as the finalization of the Basel III post-crisis regulatory reforms. Among other things, these revisions are meant to strengthen credibility in the calculation of risk-weighted assets by enhancing the robustness and risk sensitivity of the standardized approaches for credit risk and operational risk and to add new capital requirements for certain “unconditional cancellable commitments,” such as credit card lines. These revisions were generally effective on January 1, 2022, with an aggregate output floor phasing in through January 1, 2027. Operational risk capital requirements and a capital floor only apply to advanced approaches institutions under current U.S. capital rules.

New proposals for changes to bank capital rules will continue to be made over time. We will monitor and adapt to changes to those rules as they occur.

Prompt Corrective Action. The Federal Deposit Insurance Corporation Improvement Act of 1991 established a system of “prompt corrective action” to resolve the problems of undercapitalized financial institutions. Under this system, which was modified by the Basel III Capital Rules, the federal banking agencies have established five capital categories (well capitalized, adequately capitalized, undercapitalized, significantly undercapitalized and critically undercapitalized) into which all institutions are placed. The federal banking agencies have also specified by regulation the relevant capital thresholds for each of those categories. At December 31, 2025, the Bank was well-capitalized under the regulatory framework for prompt corrective action. To be categorized as well-capitalized, the Bank had to maintain minimum total risk-based, tier 1 risk-based, CET1 risk-based, and tier 1 leverage ratios of 10%, 8%, 6.5% and 5%, respectively, and must not be subject to any order or written agreement or directive by a federal banking agency to meet and maintain a specific capital level for any capital measure.

14

Federal banking agencies are required to take various mandatory supervisory actions and are authorized to take other discretionary actions with respect to institutions in the three undercapitalized categories. The severity of the action depends upon the capital category in which the institution is placed. Generally, subject to a narrow exception, the banking regulator must appoint a receiver or conservator for an institution that is critically undercapitalized.

An institution that is categorized as undercapitalized, significantly undercapitalized, or critically undercapitalized is required to submit an acceptable capital restoration plan to its appropriate federal banking agency. A bank holding company must guarantee that a subsidiary depository institution meets its capital restoration plan, subject to various limitations. The controlling holding company’s obligation to fund a capital restoration plan is limited to the lesser of (i) 5% of an undercapitalized subsidiary’s assets at the time it became undercapitalized and (ii) the amount required to meet regulatory capital requirements. An undercapitalized institution also is generally prohibited from increasing its average total assets, making acquisitions, establishing any branches or engaging in any new line of business, except under an accepted capital restoration plan or with FDIC approval. The regulations also establish procedures for downgrading an institution to a lower capital category based on supervisory factors other than capital. Banks that are not well capitalized may not accept or renew brokered deposits without a waiver from the FDIC and are subject to restrictions on the interest rates that can be paid on deposits.

Liquidity

Financial institutions are subject to significant regulatory scrutiny regarding their liquidity positions. This scrutiny has increased over the last decade, as the economic downturn in the late 2000s negatively affected the liquidity of many financial institutions. Various bank regulatory publications, including FDIC Financial Institution Letter FIL-13-2010 (Funding and Liquidity Risk Management) and FDIC Financial Institution Letter FIL-84-2008 (Liquidity Risk Management), address the identification, measurement, monitoring and control of funding and liquidity risk by financial institutions. Regulatory scrutiny became even more enhanced during 2023 due to the failures of Silicon Valley Bank, Signature Bank and First Republic Bank. In July 2023, the agencies issued updated guidance to remind depository institutions to maintain actionable contingency funding plans that take into account a range of possible stress scenarios.

Basel III also addresses liquidity management by proposing two new liquidity metrics for financial institutions. The first metric is the “Liquidity Coverage Ratio,” and it aims to require a financial institution to maintain sufficient high quality liquid resources to survive an acute stress scenario that lasts for one month. The second metric is the “Net Stable Funding Ratio,” and its objective is to require a financial institution to maintain a minimum amount of stable sources relative to the liquidity profiles of the institution’s assets, as well as the potential for contingent liquidity needs arising from off-balance sheet commitments, over a one-year horizon.

In the Basel III Capital Rules, the federal banking agencies did not address either the Liquidity Coverage Ratio or the Net Stable Funding Ratio. However, in September 2014, the federal banking agencies adopted final rules implementing a Liquidity Coverage Ratio requirement in the United States for larger banking organizations. In February 2021, the federal banking agencies adopted final rules implementing a Net Stable Funding Ratio requirement, also for larger U.S. banking organizations. Neither we nor the Bank is subject to either set of rules.

While we are not subject to the Liquidity Coverage Ratio or the Net Stable Funding Ratio rules, increased liquidity requirements generally would be expected to cause the Bank to invest its assets more conservatively—and therefore at lower yields—than it otherwise might invest. Such lower-yield investments likely would reduce the Bank’s revenue stream, and in turn its earnings potential.

Payment of Dividends

We are a legal entity separate and distinct from the Bank. Our principal source of cash flow, including cash flow to pay dividends to our stockholders, is dividends the Bank pays to us as the Bank’s sole shareholder. Statutory and regulatory limitations apply to the Bank’s payment of dividends to us as well as to our payment of dividends to our stockholders. The requirement that a bank holding company must serve as a source of strength to its subsidiary banks also results in the position of the Federal Reserve that a bank holding company should not maintain a level of cash dividends to its stockholders that places undue pressure on the capital of its bank subsidiaries or that can be funded only through additional borrowings or other arrangements that may undermine the bank holding company’s ability to serve as such a source of strength. Our ability to pay dividends is also subject to the provisions of Delaware corporate law.

The Alabama Banking Department also regulates the Bank’s dividend payments. Under Alabama law, a state-chartered bank may not pay a dividend in excess of 90% of its net earnings until the Bank’s surplus is equal to at least 20% of its capital (our bank’s surplus currently exceeds 20% of its capital). Moreover, our bank is also required by Alabama law to obtain the prior approval of the Superintendent of Banks (“Superintendent”) for its payment of dividends if the total of all dividends declared by the bank in any calendar year will exceed the total of (i) the bank’s net earnings (as defined by statute) for that year, plus (ii) its retained net earnings for the preceding two years, less any required transfers to surplus. Based on this, our bank would be limited to paying $500.3 million in dividends as of December 31, 2025, subject to maintaining certain required capital levels. In addition, no dividends, withdrawals or transfers may be made from the bank’s surplus without the prior written approval of the Superintendent.

15

Our and the Bank’s payment of dividends may also be affected or limited by other factors, such as the requirement to maintain adequate capital above regulatory guidelines. The federal banking agencies have indicated that paying dividends that deplete a depository institution’s capital base to an inadequate level would be an unsafe and unsound banking practice. Under the Federal Deposit Insurance Corporation Improvement Act of 1991, a depository institution may not pay any dividends if payment would cause it to become undercapitalized or if it already is undercapitalized. We and the Bank are also restricted from paying dividends if we fail to maintain capital above the Basel III capital conservation buffer. Moreover, the federal agencies have issued policy statements that provide that bank holding companies and insured banks should generally only pay dividends out of current operating earnings. If, in the opinion of the federal banking agencies, we or the Bank were engaged in or about to engage in an unsafe or unsound practice (such as paying an excessive dividend), the federal banking agencies could require, after notice and a hearing, that we or the Bank stop or refrain from engaging in the questioned practice.

Restrictions on Transactions with Affiliates and Insiders

We are subject to Section 23A of the Federal Reserve Act, which places limits on the amount of: a bank’s loans or extensions of credit to affiliates; a bank’s investment in affiliates; assets a bank may purchase from affiliates, except for real and personal property exempted by the Federal Reserve; loans or extensions of credit made by a bank to third parties collateralized by the securities or obligations of affiliates; a bank’s guarantee, acceptance or letter of credit issued on behalf of an affiliate; a bank’s transactions with an affiliate involving the borrowing or lending of securities to the extent they create credit exposure to the affiliate; and a bank’s derivative transactions with an affiliate to the extent they create credit exposure to the affiliate. The total amount of the above transactions is limited in amount, as to any one affiliate, to 10% of a bank’s capital and surplus and, as to all affiliates combined, to 20% of a bank’s capital and surplus. In addition to the limitation on the amount of these transactions, certain of these transactions must also meet specified collateral requirements. The bank must also comply with other provisions designed to avoid the taking of low-quality assets from an affiliate. An affiliate for purposes of Sections 23A and 23B includes a bank’s parent holding company and any subsidiary owned by the parent holding company.

We are also subject to Section 23B of the Federal Reserve Act, which, among other things, prohibits a bank from engaging in these transactions with affiliates unless the transactions are on terms substantially the same, or at least as favorable to the bank or its subsidiaries, as those prevailing at the time for comparable transactions with nonaffiliated companies.

The bank is also subject to restrictions on extensions of credit to its executive officers, directors, principal shareholders and their related interests. These extensions of credit (i) must be made on substantially the same terms, including interest rates and collateral, as those prevailing at the time for comparable transactions with third parties and (ii) must not involve more than the normal risk of repayment or present other unfavorable features. There is also an aggregate limitation on all loans to insiders and their related interests. These loans cannot exceed the institution’s total unimpaired capital and surplus, and the FDIC may determine that a lesser amount is appropriate. Insiders are subject to enforcement actions for knowingly accepting loans in violation of applicable restrictions. Alabama state banking laws also have similar provisions.

Lending Limits

Under Alabama law, the amount of loans which may be made by a bank in the aggregate to one person is limited. Alabama law provides that unsecured loans by a bank to one person may not exceed an amount equal to 10% of the capital and unimpaired surplus of the bank or 20% in the case of secured loans. For purposes of calculating these limits, loans to various business interests of a single borrower, including companies in which a substantial portion of the stock is owned or partnerships in which a person is a partner, must be aggregated with those made to the borrower individually. Loans secured by certain readily marketable collateral are exempt from these limitations, as are loans secured by deposits and certain government securities.

Commercial Real Estate Concentration Limits

The Federal Reserve and other federal banking agencies promulgated guidance governing financial institutions with concentrations in commercial real estate lending entitled “Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices”. The guidance describes the criteria the agencies will use as indicators to identify institutions potentially exposed to commercial real estate (“CRE”) concentration risk. An institution that has (i) experienced rapid growth in CRE lending, (ii) notable exposure to a specific type of CRE, (iii) total reported loans for construction, land development, and other land representing 100% or more of the institution’s capital, or (iv) total non-owner occupied CRE loans representing 300% or more of the institution’s capital, and the outstanding balance of the institution’s CRE portfolio has increased by 50% or more in the prior 36 months, may be identified for further supervisory analysis of the level and nature of its CRE concentration risk. If a concentration is present, management must employ heightened risk management practices that address, among other things, board and management oversight and strategic planning, portfolio management, development of underwriting standards, risk assessment and monitoring through market analysis and stress testing, and maintenance of increased capital levels as needed to support the level of commercial real estate lending. In 2015, the U.S. bank regulatory agencies issued additional guidance entitled “Statement on Prudent Risk Management for Commercial Real Estate Lending” to remind financial institutions of existing guidance on prudent risk management practices for CRE lending activity. The agencies noted their belief that financial institutions had eased CRE underwriting standards in recent years and went on to identify actions that financial institutions should take to protect themselves from CRE-related credit losses during difficult economic cycles. The guidance also indicated that the agencies would pay special attention in the future to potential risks associated with CRE lending.

16

Privacy and Data Security

We are subject to a number of U.S. federal, state, local and foreign laws and regulations relating to consumer privacy and data protection. Under privacy protection provisions of the Gramm-Leach-Bliley Act of 1999 and its implementing regulations and guidance, we are limited in our ability to disclose certain non-public information about consumers to nonaffiliated third parties. Financial institutions, such as the Bank, are required by statute and regulation to notify consumers of their privacy policies and practices and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a nonaffiliated third party. In addition, such financial institutions must appropriately safeguard their customers’ nonpublic, personal information.

Federal law and regulations also establish certain information security guidelines that require each financial institution, under the supervision and ongoing oversight of its board of directors or an appropriate committee thereof, to develop, implement, and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information, to protect against anticipated threats or hazards to the security or integrity of such information, and to protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. Under federal guidance, banks have to provide notice to affected customers of a data breach under certain circumstances.

In recent years, privacy laws have been a particular focus in the United States, Europe, and elsewhere. Many new privacy laws, including the California Consumer Privacy Act and the Virginia Consumer Data Protection Act, create new individual privacy rights and impose increased obligations on companies handling personal data. In addition, multiple other states, the U.S. Congress, and regulators in and outside the United States are considering similar laws or regulations which could create new individual privacy rights and impose increased obligations on companies handling personal data. For example, in November 2021, the U.S. federal banking agencies adopted a rule regarding notification requirements for banking organizations related to significant computer security incidents. Under the final rule, a banking organization must notify its primary federal regulator within 36 hours of incidents that have materially disrupted or degraded, or are reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector.

From an operational standpoint, cyberattacks and similar attempts to gain access to confidential customer information maintained by banks and other financial institutions have prompted the federal banking agencies to issue extensive guidance on cybersecurity. Among other things, financial institutions are expected to design multiple layers of security controls to establish lines of defense and ensure that their risk management processes address the risks posed by compromised customer credentials, including security measures to authenticate customers accessing internet-based services. A financial institution also should have a robust business continuity program to recover from a cyberattack and procedures for monitoring the security of third-party service providers that may have access to nonpublic data at the institution.

We take privacy and data security matters very seriously, and we work hard to protect confidential customer information. We will continue to monitor these areas, including applicable laws, rules, and regulatory guidance, very closely.

Anti-Terrorism and Money Laundering Legislation

Our bank is subject to federal laws that are designed to counter money laundering and terrorist financing, and transactions with persons, companies, or foreign governments sanctioned by the United States. These include the USA Patriot Act, the Bank Secrecy Act, the Money Laundering Control Act, and the requirements of the OFAC. These statutes and related rules and regulations impose requirements and limitations on specified financial transactions and account or other relationships, including obligations of a depository institution to verify customer identity, conduct customer due diligence, report on suspicious activity, file reports of transactions in currency, and conduct enhanced due diligence on certain accounts. They also prohibit us from engaging in transactions with certain designated restricted countries and persons. We are required by our regulators to maintain policies and procedures to comply with the foregoing restrictions.

Failure to comply with these statutes, rules and regulations, or failure to maintain an adequate compliance program, could lead to monetary penalties and reputational damage to our bank. Our banking regulators evaluate the effectiveness of our policies and procedures when determining whether to approve certain proposed banking activities, including acquisitions and branch applications. We believe the policies and procedures implemented by our Board of Directors are sufficient to be compliant with these laws.

17

Effect of Governmental Monetary Policies

Our bank’s earnings are affected by domestic economic conditions and the monetary and fiscal policies of the United States government and its agencies. The Federal Reserve’s monetary policies have had, and are likely to continue to have, an important impact on the operating results of commercial banks through its power to implement national monetary policy in order, among other things, to curb inflation or combat a recession. The monetary policies of the Federal Reserve affect the levels of bank loans, investments and deposits through its control over the issuance of United States government securities, its regulation of the discount rate applicable to member banks and its influence over reserve requirements to which member banks are subject. We cannot predict, and have no control over, the nature or impact of future changes in monetary and fiscal policies.

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act represents a comprehensive revision of laws affecting corporate governance, accounting obligations and corporate reporting. The Sarbanes-Oxley Act is applicable to all companies with equity securities registered, or that file reports, under the Exchange Act. In particular, the act established (i) requirements for audit committees, including independence, expertise and responsibilities; (ii) responsibilities regarding financial statements for the chief executive officer and chief financial officer of the reporting company and new requirements for them to certify the accuracy of periodic reports; (iii) standards for auditors and regulation of audits; (iv) disclosure and reporting obligations for the reporting company and its directors and executive officers; and (v) civil and criminal penalties for violations of the federal securities laws. The legislation also established a new accounting oversight board to enforce auditing standards and restrict the scope of services that accounting firms may provide to their public company audit clients.

Overdraft Fees

Regulation E imposes restrictions on banks’ abilities to charge overdraft fees. The rule prohibits financial institutions from charging fees for paying overdrafts on ATM and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions.

Open Banking Rule

On October 22, 2024, the CFPB issued its final rule implementing Section 1033 of the Dodd-Frank Act with respect to personal financial data rights, more commonly known as the “Open Banking Rule.” The final rule, among other things, requires banks, credit unions, and other financial service providers to make a consumer’s data available upon request to the consumer and their authorized third parties in a secure and reliable manner, and establishes obligations for third parties accessing consumers’ data, including data security and privacy protections. According to the CFPB, the rule is designed to foster competition and innovation in the financial services industry by making it easier for consumers to switch financial providers and for new companies to offer innovative products and services. The rule is in a current state of flux as a federal court has issued a preliminary injunction prohibiting the CFPB from enforcing the rule until the CFPB can complete its reconsideration of the rule. In August 2025, the CFPB issued an advance notice of proposed rulemaking seeking comments as it evaluates issuing a proposed rule that would replace the current rule.

Interchange Fees

The Dodd-Frank Act, through a provision known as the Durbin Amendment, required the Federal Reserve to establish standards for interchange fees that are “reasonable and proportional” to the cost of processing a debit card transaction and imposes other requirements on card networks. In June 2011, the Federal Reserve implemented a rule, which includes a cap of 21 cents plus .05% of the transaction on the interchange fee for debit card issuers with $10 billion or more in assets. The Bank exceeded $10 billion in assets for the first time as of June 30, 2020, and the Durbin Amendment rules became effective for us on July 1, 2022. The Durbin Amendment rules did not have a material impact on our revenue. In October 2023, the Federal Reserve requested comment on a proposal to lower the maximum interchange fee that a large debit card issuer can receive for a debit card transaction. The proposal would also establish a regular process for updating the maximum amount every other year going forward. The proposed rule is pending and has not been finalized.

Compensation Practices

Our compensation practices are subject to guidance provided by federal banking agencies. The federal banking agencies have issued comprehensive guidance on incentive compensation policies. This guidance is designed to ensure that a financial institution’s incentive compensation structure does not encourage imprudent risk taking, which may undermine the safety and soundness of the institution. The guidance, which applies to all employees that have the ability to materially affect an institution’s risk profile, either individually or as part of a group, is based upon three primary principles: (i) balanced risk taking incentives; (ii) compatibility with effective controls and risk management; and (iii) strong corporate governance.

18

The scope and content of the U.S. banking agencies’ policies on compensation may continue to evolve in the near future. It cannot be determined at this time whether compliance with such policies will adversely affect the company’s or the bank’s ability to hire, retain and motivate its key employees.

The Volcker Rule

In December 2013, five U.S. financial regulators, including the Federal Reserve and the FDIC, adopted a final rule implementing the so-called “Volcker Rule.” The Volcker Rule was created by Section 619 of the Dodd-Frank Act and prohibits “banking entities” from engaging in “proprietary trading” and making investments and conducting certain other activities with “private equity funds and hedge funds.” Although the final rule provides some tiering of compliance and reporting obligations based on size, the fundamental prohibitions of the Volcker Rule apply to banking entities of any size, including us and the Bank.

Since the adoption of the final rule in 2013, U.S. financial regulators and other federal agencies have further adopted several changes to the final rule. On January 14, 2014, the agencies adopted an interim final rule permitting banking entities to retain interests in certain collateralized debt obligations backed primarily by trust preferred securities if certain qualifications are met. On July 9, 2019, the agencies adopted a final rule excluding community banks (i.e., those banks having $10 billion or less in total consolidated assets and trading assets and liabilities of 5% or less of total consolidated assets) from the Volcker Rule. On October 8, 2019, the agencies finalized revisions to the Volcker rule that simplified and streamlined compliance requirements for banking entities that do not have significant trading activities, while banking entities with significant trading activities would become subject to more stringent compliance requirements. The revisions continue to prohibit proprietary trading, while providing greater clarity and certainty for activities allowed under the law. With the changes, the agencies expect that the universe of trades that are considered prohibited proprietary trading will remain generally the same as under the agencies' 2013 final rule. These revisions became effective on January 1, 2020, with a required compliance date of January 1, 2021.

To date, the prohibitions under the Volcker Rule and the final rule adopted thereunder have not had, and we do not currently expect them to have in the future, a material effect on our businesses or revenue, but they do limit the scope of permissible activities in which we might engage.

The Dodd-Frank Act

The Dodd-Frank Act was signed into law in July 2010 and has significantly changed the bank regulatory environment and the lending, deposit, investment, trading and operating activities of financial institutions and their holding companies. The Dodd-Frank Act required various federal agencies to adopt a broad range of new implementing rules and regulations and to prepare numerous studies and reports for Congress. The federal agencies were given significant discretion in drafting the implementing rules and regulations.

In May 2018, the Economic Growth, Regulatory Relief and Consumer Protection Act (“EGRRCPA”) was signed into law. In many instances the EGRRCPA increased the Dodd-Frank mandated asset thresholds, to which enhanced supervision and prudential standards are applied. Previously, bank holding companies with assets of $10 billion or more were subject to stress testing. The asset threshold has been increased to $250 billion.

A number of the effects of the Dodd-Frank Act are described or otherwise accounted for in various parts of this Bank Supervision and Regulation section. The following items provide a brief description of certain other provisions of the Dodd-Frank Act that may be relevant to us and the Bank.

● The Dodd-Frank Act created the CFPB and gave it broad powers to supervise and enforce consumer protection laws. The CFPB has broad rule-making authority for a wide range of consumer protection laws that apply to all banks, including the authority to prohibit “unfair, deceptive or abusive” acts and practices. The CFPB has examination and enforcement authority over all banks with more than $10 billion in assets for four consecutive quarters. We are now subject to CFPB supervisory and enforcement authority and expenses related to regulatory compliance are likely to increase as a result.

● The Dodd-Frank Act imposed new requirements regarding the origination and servicing of residential mortgage loans. The law created a variety of new consumer protections, including limitations on the manner by which loan originators may be compensated and an obligation on the part of lenders to verify a borrower’s “ability to repay” a residential mortgage loan.

● The Dodd-Frank Act imposes many investor-protection, corporate governance and executive compensation rules that have affected most U.S. publicly traded companies. The Dodd-Frank Act (i) requires publicly traded companies to give stockholders a non-binding vote on executive compensation and golden parachute payments; (ii) enhances independence requirements for compensation committee members; (iii) requires companies listed on national securities exchanges to adopt incentive-based compensation clawback policies for executive officers; (iv) authorizes the SEC to promulgate rules that would allow stockholders to nominate their own candidates using a company’s proxy materials; and (v) directs the federal banking agencies to issue rules prohibiting incentive compensation that encourages inappropriate risks.

19

● Although insured depository institutions have long been subject to the FDIC’s resolution process, the Dodd-Frank Act creates a new mechanism for the FDIC to conduct the orderly liquidation of certain “covered financial companies,” including bank holding companies and systemically significant non-bank financial companies. Upon certain findings being made, the FDIC may be appointed receiver for a covered financial company and would conduct an orderly liquidation of the entity. The FDIC liquidation process is modeled on the existing Federal Deposit Insurance Act bank resolution process, and generally gives the FDIC more discretion than in the traditional bankruptcy context.

● Pursuant to the Dodd-Frank Act, national and state-chartered banks may open an initial branch in a state other than its home state (e.g., a host state) by establishing a de novo branch at any location in such host state at which a bank chartered in such host state could establish a branch. Applications to establish such branches must still be filed with the appropriate primary state and federal banking agencies.

On March 30, 2023, the CFPB issued a final rule implementing Section 1071 of the Dodd-Frank Act. The final rule requires financial institutions to collect and report data to the CFPB on small business loan applicants, including demographic data, lending decisions and the price and terms of credit. The purpose of the rulemaking is to increase transparency and combat discrimination in small business lending. The CFPB issued a Notice of Proposed Rulemaking in November 2025 that would make certain changes to the rule, including reducing the number of data points banks must collect and report as well as extending the compliance deadline to January 1, 2028.

As noted above, the implementation of the Dodd-Frank Act is ongoing. In addition, we are subject to heightened regulatory scrutiny and requirements as a result of our total assets exceeding $10 billion for four consecutive quarters ending with the first quarter in 2021. It is difficult to anticipate the overall financial impact of the Dodd-Frank Act on the Bank and us. However, compliance with the Dodd-Frank Act and its implementing regulations has resulted in, and is expected to continue to result in, additional operating and compliance costs that could have a material adverse effect on our business, financial condition and results of operations.

Regulation Extends Beyond Banking Agencies

In addition to regulations issued by the Alabama Banking Department and federal banking agencies, we are subject to regulations issued by other state and federal agencies with respect to certain financial products and services we offer and our operations generally. These include, for example, the SEC, various taxing authorities, and various state insurance regulators.

Other Legislation and Regulatory Action relating to Financial Institutions

Government efforts made over the last decade to strengthen the United States financial system, including the Dodd-Frank Act and its related rules and regulations, subject us and the Bank to a number of new regulatory compliance obligations, many of which may impose additional fees, costs, requirements, and restrictions. These fees, costs, requirements, and restrictions, as well as any others that may be imposed in the future, may have a material adverse effect on our business, financial condition, and results of operations.

New proposals to change the laws and regulations governing the banking industry are frequently introduced in the United States Congress, in the state legislatures and before the various bank regulatory agencies. Additionally, the future implementation and enforcement of regulations may be affected by current and future Presidential administrations. The likelihood and timing of any such changes and the impact such changes might have on us and the Bank, however, cannot be determined at this time. In this regard, bills are presently pending before Congress and certain state legislatures, and additional bills may be introduced in the future in Congress and state legislatures, to alter the structure, regulation and competitive relationships of financial institutions. We cannot predict whether or in what form any of these proposals will be adopted or the extent to which our business may be affected by any new regulation or statute.

Human Capital Resources

At ServisFirst Bancshares, we believe that our employees are truly our most valuable asset and that each of us directly contributes to our continued mutual success. As of December 31, 2025, we had 666 full-time equivalent employees. We have 216 employees located in our corporate office, including sales and operations, and 450 in our regional offices and branches. Our management believes that we have good relations with our employees.

20

Hiring, Promotion and Talent Development

We are always looking to build our workforce from within and promote from our current talent pool whenever possible. When this is not the case, we look to career fairs and local colleges to network on an ongoing basis, as well as utilizing professional networking platforms, such as LinkedIn. We also have a referral bonus program for current employees, which we believe helps us to diversify our workforce at the same time. We are also committed to the continued development of our employees. Compliance, information technology and other banking industry-related training is completed by employees throughout the year. We also aim to assist our employees with position-related training and development when available. We recruit the best people for the job regardless of gender, race, ethnicity, age, disability, sexual orientation, gender identity, cultural background or religious belief. It is our policy to fully comply with all state and federal laws applicable to discrimination in the workplace.

Health and Safety

The success of our business is fundamentally connected to the well-being of our employees. At the Bank, the health and safety of our employees are our top priority. We are committed to providing a safe and supportive work environment where every team member can thrive. We continuously assess and improve our safety practices, ensuring compliance with all relevant regulations, and promote a culture of open communication.

Compensation and Benefits

We provide robust compensation and benefits programs to help meet the needs of our employees. In addition to competitive salaries, these programs include annual bonuses, a 401(k) Retirement Plan, full medical, dental and vision insurance, life insurance and paid time off. Our Compensation Committee has retained a consultant to advise on pay structure for our executive officers. As part of our compensation philosophy, we believe that we must offer and maintain market competitive total rewards programs for our employees in order to attract and retain superior talent.

Available Information

Our corporate website is www.servisfirstbank.com. We have direct links on this website to our Code of Ethics and the charters for our Audit, Compensation and Corporate Governance and Nominations Committees, accessible on the “Investor Relations” section of our website. We also have direct links to our filings with the SEC, including, but not limited to, our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, proxy statements and any amendments to these filings, which are available free of charge through our corporate website as soon as reasonably practicable after they are electronically filed with, or furnished to, the SEC. Stockholders may request hard copies of our filings, free of charge, by contacting our Senior Vice President of Corporate Treasury and Investor Relations, Davis Mange, at 2500 Woodcrest Place, Birmingham, AL 35209, telephone (205) 949-3420.