TRICO BANCSHARES /

Previous wording

The majority of our assets are loans, which are subject to credits risks.

Current wording

The majority of our assets are loans, which are subject to credit risks.

Previous wording

As a lender, we face a significant risk that we will sustain losses because borrowers, guarantors or related parties may fail to perform in accordance with the terms of the loans we make or acquire. Our earnings are significantly affected by our ability to properly originate, underwrite and service loans. Certain of our credit exposures are concentrated in industries that may be more susceptible to the long-term risks of climate change, natural disasters or global pandemics. To the extent that these risks may have a negative impact on the financial condition of borrowers, it could also have a material adverse effect on our business, financial condition and results of operations. We have underwriting and credit monitoring procedures and credit policies, including the establishment and review of the allowance for credit losses,

Current wording

As a lender, we face a significant risk that we will sustain losses because borrowers, guarantors or related parties may fail to perform in accordance with the terms of the loans we make or acquire. Our earnings are significantly affected by our ability to properly originate, underwrite and service loans. Certain of our credit exposures are concentrated in industries that may be more susceptible to the long-term risks of climate change, natural disasters or global pandemics. To the extent that these risks may have a negative impact on the financial condition of borrowers, it could also have a material adverse effect on our business, financial condition and results of operations. We have underwriting and credit monitoring procedures and credit policies, including the establishment and review of the allowance for credit losses, that we believe appropriately address this risk by assessing the likelihood of nonperformance, tracking loan performance and diversifying our respective loan portfolios. Such policies and procedures, however, may not prevent unexpected losses that could adversely affect our results of operations. We could sustain losses if we incorrectly assess the creditworthiness of our borrowers or fail to detect or respond to deterioration in asset quality in a timely manner or as a result of deteriorating economic conditions, for example.

Previous wording

Like other financial institutions, we maintain an allowance for credit losses to provide for loan defaults and non-performance. Our allowance for credit losses may not be adequate to cover actual loan losses, and future provisions for loan losses would reduce our earnings and could materially and adversely affect our business, financial condition and results of operations. Our allowance for credit losses is based on prior experience, as well as an evaluation of the known risks in the current portfolio, composition and growth of the loan portfolio and actual and forecast economic factors. Determining an appropriate level of allowance is an inherently difficult process and is based on numerous assumptions. The actual amount of future losses is susceptible to changes in economic, operating and other conditions, including changes in interest rates, unemployment and a number of other economic conditions that may be beyond our control and these losses may exceed current estimates. Effective January 1, 2020, we implemented a new accounting standard, “Measurement of Credit Losses on Financial Instruments,” commonly referred to as the “Current Expected Credit Losses” standard, or “CECL.” CECL changed the allowance for credit losses methodology from an incurred loss concept to an expected loss concept, which is more dependent on future economic forecasts, assumptions and models than previous methodology, which could result in increases and add volatility to our allowance for credit losses and future provisions for loan losses. These forecasts, assumptions and models are inherently uncertain and are based upon our management’s reasonable judgment in light of information currently available.

Current wording

11 TriCo Bancshares 2025 10-K assumptions. The actual amount of future losses is susceptible to changes in economic, operating and other conditions, including changes in interest rates, unemployment and a number of other economic conditions that may be beyond our control and these losses may exceed current estimates. Effective January 1, 2020, we implemented a new accounting standard, “Measurement of Credit Losses on Financial Instruments,” commonly referred to as the “Current Expected Credit Losses” standard, or “CECL.” CECL changed the allowance for credit losses methodology from an incurred loss concept to an expected loss concept, which is more dependent on future economic forecasts, assumptions and models than previous methodology, which could result in increases and add volatility to our allowance for credit losses and future provisions for loan losses. These forecasts, assumptions and models are inherently uncertain and are based upon our management’s reasonable judgment in light of information currently available.

Previous wording

A substantial portion of our loan portfolio consists of commercial real estate loans. As of December 31, 2024, we had approximately $4.6 billion of commercial real estate loans outstanding, which represented approximately 67.6% of our total loan portfolio. Consequently, commercial real estate-related credit risks are a significant concern for us. Commercial real estate loans are generally viewed as having more risk of default than some other types of loans because repayment of the loans often depends on the successful operation of the property and the income stream of the borrowers. In addition, these loans often involve larger loan balances to single borrowers or groups of related borrowers compared with other types of loans. In recent years, commercial real estate markets have been particularly impacted by the economic disruption resulting from the COVID-19 pandemic, which has been a catalyst for the evolution of various remote work options which could impact the vacancy rates and the long-term vacancy performance of some types of office properties within our commercial real estate portfolio. Accordingly, the federal banking regulatory agencies have expressed concerns about weaknesses in the current commercial real estate market. The adverse consequences from real estate-related credit risks tend to be cyclical and are often driven by national economic developments that are not controllable or entirely foreseeable by us or our borrowers.

Current wording

A substantial portion of our loan portfolio consists of commercial real estate loans. As of December 31, 2025, we had approximately $4.6 billion of commercial real estate loans outstanding, which represented approximately 67.6% of our total loan portfolio. Consequently, commercial real estate-related credit risks are a significant concern for us. Commercial real estate loans are generally viewed as having more risk of default than some other types of loans because repayment of the loans often depends on the successful operation of the property and the income stream of the borrowers. In addition, these loans often involve larger loan balances to single borrowers or groups of related borrowers compared with other types of loans. In recent years, commercial real estate markets have been particularly impacted by the economic disruption resulting from the COVID-19 pandemic, which has been a catalyst for the evolution of various remote work options which could impact the vacancy rates and the long-term vacancy performance of some types of office properties within our commercial real estate portfolio. Accordingly, the federal banking regulatory agencies have expressed concerns about weaknesses in the current commercial

Previous wording

In the course of our business, we may foreclose and take title to real estate and could be subject to environmental liabilities with respect to these properties. We may be held liable to a governmental entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination, or may be required to investigate or clean-up hazardous or toxic substances, or chemical releases at a property. The costs associated with investigation or remediation activities could be substantial. In addition, if we are the owner or former owner of a contaminated site, we may be subject to common law or contractual claims by third parties based on damages and costs resulting from environmental contamination emanating from the property. When applicable, we establish contingent liability reserves for this purpose based on future reasonable and estimable costs developed by qualified soil and chemical engineering consultants. If we become subject to significant environmental liabilities or if our contingency reserve estimates are incorrect, our business, financial condition and results of operations could be materially adversely affected.

Current wording

In the course of our business, we foreclose and take title to real estate. As a result, we could be subject to environmental liabilities with respect to these properties. We may be held liable to a governmental entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination, or may be required to investigate or clean-up hazardous or toxic substances, or chemical releases at a property. The costs associated with investigation or remediation activities could be substantial. In addition, if we are the owner or former owner of a contaminated site, we may be subject to common law or contractual claims by third parties (including purchasers of a property) based on damages and costs resulting from environmental contamination emanating from the property. When applicable, we establish contingent liability reserves for this purpose based on future reasonable and estimable costs developed by qualified soil and chemical engineering consultants. If we become subject to significant environmental liabilities or if our contingency reserve estimates are incorrect, our business, financial condition and results of operations could be materially adversely affected.

Previous wording

Additionally, consumers can maintain funds that would have historically been held as bank deposits in brokerage accounts or mutual funds. Consumers can also complete transactions such as paying bills and/or transferring funds directly without the assistance of banks. In addition, the emergence, adoption and evolution of new technologies that do not require intermediation, including distributed ledgers such as digital assets and blockchain, as well as advances in robotic process automation, could significantly affect the competition for financial services. The process of eliminating banks as intermediaries, known as “disintermediation,” could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits.

Current wording

Additionally, consumers can maintain funds that would have historically been held as bank deposits in brokerage accounts or mutual funds. Consumers can also complete transactions such as paying bills and/or transferring funds directly without the assistance of banks. The growing experimentation with and adoption of advanced technologies—such as AI, quantum computing, distributed ledgers, tokenized deposits, blockchain, stablecoins, and other digital currencies, including the potential issuance, acceptance, and integration of central bank digital currencies—has the potential to fundamentally reshape the financial services landscape. Regulatory developments related to these emerging technologies, including the recent enactment of the Guiding and Establishing National Innovation for U.S. Stablecoins Act of 2025 (“GENIUS Act”) and the potential passage of the Digital Asset Market Clarity Act of 2025 (“CLARITY Act”), further underscore this shift. This the emergence, adoption and evolution of new technologies that do not require intermediation, as well as advances in robotic process automation, could significantly affect the competition for financial services. The process of eliminating banks as intermediaries, known as “disintermediation,” could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits. Failure to keep pace with technological advancements could adversely affect our competitive position, diminish customer satisfaction, and reduce the accessibility and relevance of our products and services.

Previous wording

During the first half of 2023, the financial services industry was negatively affected by three bank failures. These events caused general uncertainty and concern regarding the adequacy of liquidity within the banking sector as a whole and have decreased investor and customer confidence in banks, notably with regard to mid-sized and larger regional banks. Although we were not directly affected by these bank failures, the resulting speed and ease in which news or rumors, including social media commentary, led depositors to withdraw or attempt to withdraw their funds from these and other financial institutions caused the stock prices of many financial institutions to become volatile, in particular regional, as well as community banks like us. Notably, the Company’s share price decreased by 17% during the month of March 2023, consistent with other community banking organizations. According to data published by the FRB, deposits at domestic commercial banks decreased by approximately $280 billion between the end of February 2023 and the week ended March 29, 2023. The Bank’s deposits decreased by $162 million during this period, which was a decrease of 2%. Customers may choose to maintain deposits with larger financial institutions or in other higher yielding alternatives, which could materially adversely impact the Company’s liquidity, loan funding capacity, net interest margin, capital and results of operations.

Current wording

13 TriCo Bancshares 2025 10-K news or rumors, including social media commentary, led depositors to withdraw or attempt to withdraw their funds from these and other financial institutions caused the stock prices of many financial institutions to become volatile, in particular regional, as well as community banks like us. Notably, the Company’s share price decreased by 17% during the month of March 2023, consistent with other community banking organizations. These developments resulted in—and similar occurrences may again result in—significant and cascading disruptions across financial markets and the deposit environment, increased operating costs, reduced fee income, and increased volatility and downward pressure on the market value of our common stock.

Previous wording

Our success depends, to a certain extent, upon local, national and global economic and political conditions, as well as governmental monetary policies. Conditions such as an economic recession, pandemics, rising unemployment, adverse immigration policies impacting the labor market (notably agriculture), inflation, changes in interest rates, declines in asset values and other factors beyond our control may adversely affect our asset quality, deposit levels and our net income. Adverse changes in the economy may also have a negative effect on the demand for new loans and the ability of our existing borrowers to make timely repayments of their loans, which could adversely impact our growth and earnings. Economic and market conditions may also be affected by political developments in the U.S. and other countries and global conflicts, such the conflicts in Ukraine and the Middle East. Uncertainty about the federal fiscal policymaking process, the fiscal outlook of the federal government, and future tax rates is a concern for businesses, consumers and investors in the United States. While the effects of COVID have reduced, the pandemic and related efforts to contain it have disrupted global economic activity, adversely affected the functioning of financial markets, impacted interest rates, increased economic and market uncertainty, employment and labor markets and disrupted trade and supply chains. If these effects continue for a prolonged period or result in sustained economic stress or recession, many of the risk factors identified in our Form 10-K could be exacerbated and such effects could have a material adverse impact on us in a number of ways related to credit, collateral, customer demand, funding, operations, interest rate risk, and human capital, as described in this document.

Current wording

Our success depends, to a certain extent, upon local, national and global economic and political conditions, as well as governmental monetary policies. Conditions such as an economic recession, pandemics, rising unemployment, adverse immigration policies impacting the labor market (notably agriculture), inflation, changes in interest rates, declines in asset values and other factors beyond our control may adversely affect our asset quality, deposit levels and our net income. Adverse changes in the economy may also have a negative effect on the demand for new loans and the ability of our existing borrowers to make timely repayments of their loans, which could adversely impact our growth and earnings. Economic and market conditions may also be affected by political developments in the U.S. and other countries and global conflicts, such the conflicts in Ukraine and the Middle East. Uncertainty about the federal fiscal policymaking process, the fiscal outlook of the federal government, prolonged government shutdowns, and future tax rates is a concern for businesses, consumers and investors in the United States. If these conditions continue for a prolonged period or result in sustained economic stress or recession, many of the risk factors identified in our Form 10-K could be exacerbated and such effects could have a material adverse impact on us in a number of ways related to credit, collateral, customer demand, funding, operations, interest rate risk, and human capital, as described in this document.

Previous wording

After an extended period at a target rate of 0-0.25%, the Federal Reserve Board began aggressively increasing interest rates in March 2022 and continuing into 2023 with increases of 25 basis points in February, March, May, and July 2023. Most recently, the Federal Reserve Board decreased interest rates 50 basis points in September and 25 basis points in November and December 2024, respectively, resulting in a target rate range of 4.25% to 4.50% at December 31, 2024. Today, there continues to be uncertainty regarding future interest rates. Increases in interest rates can have negative impacts on our business, including reducing our customers’ desire to borrow money from us or adversely affecting their ability to repay their outstanding loans by increasing their debt obligations through the periodic reset of adjustable interest rate loans. If our borrowers’ ability to pay their loans is impaired by increasing interest payment obligations, our level of non-performing assets would increase, producing an adverse effect on operating results. Asset values, especially commercial real estate as collateral, securities or other fixed rate earning assets, can decline significantly with relatively minor changes in interest rates. Conversely, decreases in interest rates can affect the amount of interest we earn on our loans and investment securities, which could have a material adverse effect on our financial condition and results of operations. Elevated inflation and expectations for elevated future inflation can adversely impact economic growth, consumer and business confidence, and our financial condition and results. In addition, elevated inflation may cause unexpected changes in monetary policies and actions which may adversely affect confidence and the economy. Although we have implemented strategies that we believe reduce the potential effects of adverse changes in interest rates on our results of operations, these strategies may not always be successful. Any of these events could adversely affect our results of operations, financial condition and liquidity.

Current wording

After an extended period at a target rate of 0-0.25%, the FRB began aggressively increasing interest rates in March 2022 and continuing into 2023. In late 2024, the FRB began lowering rates as inflationary pressure started to ease, and in late 2025, the FRB again lowered rates. However, the economic and inflationary outlook continues to remain uncertain. If the FRB were to reverse course and rapidly increase rates, the increase could result in further declines in the fair market values of long duration fixed rate investment securities, constrain our interest rate spread and may adversely affect our business forecasts. Increases in interest rates can have negative impacts on our business, including reducing our customers’ desire to borrow money from us or adversely affecting their ability to repay their outstanding loans by increasing their debt obligations through the periodic reset of adjustable interest rate loans. If our borrowers’ ability to pay their loans is impaired by increasing interest payment obligations, our level of non-performing assets would increase, producing an adverse effect on operating results. Asset values, especially commercial real estate as collateral, securities or other fixed rate earning assets, can decline significantly with relatively minor changes in interest rates. Conversely, decreases in interest rates can affect the amount of interest we earn on our loans and investment securities, which could have a material adverse effect on our financial condition and results of operations.

Previous wording

We are subject to extensive regulation, supervision and examination by the DFPI, FDIC, and the FRB as well as regulations and policies of the CFPB. See "Item 1. Business - Regulation and Supervision" of this report for information on the regulation and supervision which governs our activities. Regulatory authorities have extensive discretion in their supervisory and enforcement activities, including the imposition of restrictions on our operations, the classification of our assets and determination of the level of our allowance for credit losses. Banking regulations or the actions of our banking regulators may limit our growth, earnings and the return to our shareholders by restricting certain of our activities, such as:

Current wording

We are subject to extensive regulation, supervision and examination by the DFPI, FDIC, and the FRB as well as regulations and policies of the CFPB. See "Item 1. Business - Regulation and Supervision" of this report for information on the regulation and supervision which governs our activities. Regulatory authorities have extensive discretion in their supervisory and enforcement activities, including the imposition of restrictions on our operations, the classification of our assets and determination of the level of our allowance for credit losses. Banking regulations or the actions of our banking regulators may limit our growth, earnings and the return to our shareholders by restricting certain of our activities, such as the payment of dividends to our shareholders, possible mergers with or acquisitions of or by other institutions, desired investments, loans and interest rates on loans, interest rates paid on deposits, service charges on deposit account transactions, the possible expansion or reduction of branch offices, and the ability to provide new products or services.

Previous wording

Additionally, other regulatory requirements apply to depository institutions and holding companies with $10 billion or more in total consolidated assets, including a cap on interchange transaction fees for debit cards, as required by Federal Reserve Board regulations, which would reduce our interchange revenue, and restrictions on proprietary trading and investment and sponsorship in hedge funds and private equity funds known as the Volcker Rule. See also "Item 1 - Business - Regulation and Supervision - Interchange Fees" in this report. Further, deposit insurance assessment rates are calculated differently, and may be higher, for insured depository institutions with $10 billion or more in total consolidated assets.

Current wording

Additionally, other regulatory requirements apply to depository institutions and holding companies with $10 billion or more in total consolidated assets, including a cap on interchange transaction fees for debit cards, as required by Federal Reserve Board regulations, which would significantly reduce our interchange revenue, and restrictions on proprietary trading and investment and sponsorship in hedge

Previous wording

We have supported our growth through the prior issuance of trust preferred securities from special purpose trusts and accompanying junior subordinated debentures. At December 31, 2024, we had outstanding trust preferred securities and accompanying junior subordinated debentures with principal amount of $98.9 million. Payments of the principal and interest on the trust preferred securities are conditionally guaranteed by us. Further, the accompanying junior subordinated debentures we issued to the trusts are senior to our shares of common stock. As a result, we must make payments on the junior subordinated debentures before we can pay any dividends on our common stock and, in the event of our bankruptcy, dissolution or liquidation, the holders of the junior subordinated debentures must be satisfied before any distributions can be made on our common stock.

Current wording

We have supported our growth through the prior issuance of trust preferred securities from special purpose trusts and accompanying junior subordinated debentures. At December 31, 2025, we had outstanding trust preferred securities and accompanying junior subordinated debentures with principal amount of $41.2 million. Payments of the principal and interest on the trust preferred securities are conditionally guaranteed by us. Further, the accompanying junior subordinated debentures we issued to the trusts are senior to our shares of common stock. As a result, we must make payments on the junior subordinated debentures before we can pay any dividends on our common stock and, in the event of our bankruptcy, dissolution or liquidation, the holders of the junior subordinated debentures must be satisfied before any distributions can be made on our common stock.

Previous wording

The Bank worked with third-party forensic investigators to understand the nature and scope of the incident and to determine what and how much information was impacted. The Bank determined that its internal computer network had been infected with malware which prevented access to certain files on the network. Through its investigation, the Bank determined that an unauthorized actor illegally accessed and acquired data from certain systems, including the personal information of approximately 75,000 individuals, including certain current and former customers, individuals related to current and former customers, current and former employees and their dependents, and others. While the information impacted varied by individual, the types of information that were impacted included name, social security number, driver’s license number, state identification number, financial account information, medical information, health insurance information, date of birth, passport number, digital/electronic signature, tax information, tax identification number, access credentials, and mother’s maiden name. The Bank notified and will continue to notify impacted individuals consistent with state and federal requirements and the Bank is offering impacted individuals credit restoration services and 24 months of credit monitoring services at no cost. The Bank issued a press release regarding this event and posted notice of this event on its website.

Current wording

The Bank worked with third-party forensic investigators to understand the nature and scope of the incident and to determine what and how much information was impacted. The Bank determined that its internal computer network had been infected with malware which prevented access to certain files on the network. Through its investigation, the Bank determined that an unauthorized actor illegally accessed and acquired data from certain systems, including the personal information of approximately 75,000 individuals, including certain current and former customers, individuals related to current and former customers, current and former employees and their dependents, and others. While the information impacted varied by individual, the types of information that were impacted included name, social security number, driver’s license number, state identification number, financial account information, medical information, health insurance information, date of birth, passport number, digital/electronic signature, tax information, tax identification number, access credentials, and mother’s maiden name. The Bank notified and will continue to notify impacted individuals consistent with state and federal requirements and the Bank is offered impacted individuals credit restoration services and 24 months of credit monitoring services at no cost. The Bank issued a press release regarding this event and posted notice of this event on its website.

Previous wording

We face numerous lawsuits related to the 2023 cyberattack, including three purported class action lawsuits that have been filed in California Superior Court for the Counties of Contra Costa and Butte, seeking unspecified monetary damages, equitable relief, costs and attorneys’ fees. The lawsuits allege breach of contract, negligence, violations of various privacy laws and a variety of other legal causes of action. We are currently unable to predict the potential outcome of any of this litigation or whether we may be subject to further private litigation. In addition, the Company has received inquiries from various government authorities related to the 2023 cyberattack, which could result in sanctions, fines or penalties. We are responding to these inquiries and cooperating fully. However, we cannot predict the timing or outcome of any of these inquiries, or whether we may be subject to further governmental inquiries.

Current wording

We face three purported class action lawsuits numerous lawsuits related to the 2023 cyberattack that have been filed in California Superior Court for the Counties of Contra Costa and Butte, seeking unspecified monetary damages, equitable relief, costs and attorneys’ fees. The lawsuits were consolidated (Donna Dryden v. Tri Counties Bank et. al., Superior Court of State of California - Butte County, 23-CV-03115) and allege breach of contract, negligence, violations of various privacy laws and a variety of other legal causes of action. Following mediation, the parties entered into a settlement agreement and on January 21, 2026, the court preliminarily approved the agreement. The Class is being notified by mail and we and hope to resolve this litigation quickly. The cost of the settlement is expected to be covered by insurance. However, we are unable to predict whether we may be subject to further private litigation. In addition, the Company received inquiries from various government authorities related to the 2023 cyberattack, which could result in sanctions, fines or penalties. We responded to these inquiries and cooperated fully. However, we cannot predict the timing or outcome of any of these inquiries, or whether we may be subject to further governmental inquiries.

Previous wording

Given the uncertainties about any further impacts of the incident, including the inherent uncertainties involved in litigation, contractual obligations, government investigations and regulatory enforcement decisions, we face the risk that outcomes from these risks could have a material adverse effect on our reputation, business and/or financial condition. In addition, litigation, government interventions, and negative media reports and any resulting damage to our reputation or loss of confidence in the security of our systems could adversely affect our business. It is possible that we could incur losses associated with these proceedings and inquiries, and the Company will continue to evaluate information as it becomes known and will record an estimate for losses at the time or times when it is both probable that a loss has been incurred and the amount of the loss is reasonably estimable. Ongoing legal and other costs related to these proceedings and inquiries, as well as any potential future proceedings and inquiries, may be substantial, and losses associated with any adverse judgments, settlements, penalties or other resolutions of such proceedings and inquiries could be material to our business, reputation, financial condition and operating results.

Current wording

Given the uncertainties about any further impacts of the incident, including the inherent uncertainties involved in litigation, contractual obligations, government investigations and regulatory enforcement decisions, we face the risk that outcomes from these risks could have a material adverse effect on our reputation, business and/or financial condition. In addition, litigation, government interventions, and negative media reports and any resulting damage to our reputation or loss of confidence in the security of our systems could adversely affect our business. It is possible that we could incur losses associated with these proceedings and inquiries, and the Company will continue to evaluate information as it becomes known and will record an estimate for losses at the time or times when it is both probable that a loss has been incurred and the amount of the loss is reasonably estimable. While we believe we have adequate insurance to cover most of the costs of the cyberattack, ongoing legal and other costs related to these proceedings and inquiries, as well as any potential future proceedings and inquiries, may be substantial, and losses associated with any adverse judgments, settlements, penalties or other resolutions of such proceedings and inquiries could be material to our business, reputation, financial condition and operating results.

Previous wording

The Company, our customers, our vendors, and other third parties have experienced security breaches and cyber attacks in the past, and it is inevitable that additional breaches and attacks will occur in the future. While such breaches and attacks have not materially impacted the Company to date, future security breaches and cyber attacks could result in serious and harmful consequences for us or our clients and customers. A principal reason that we cannot provide absolute security against cyber attacks is that we may not always be possible to anticipate, detect or recognize threats to the Company’s systems, or to implement effective preventive measures against all breaches because: the techniques used in cyber attacks evolve frequently and are increasingly sophisticated, and therefore may not be recognized until launched; cyber attacks can originate from a wide variety of sources, including our own employees, cyber-criminals, hacktivists, groups linked to terrorist organizations or hostile countries, or third parties whose objective is to disrupt the operations of financial institutions more generally; we do not have control over the cybersecurity of the systems of the large number of clients, customers, counterparties and third-party service providers with which we do business; and it is possible that a third party, after establishing a foothold on an internal network without being detected, might obtain access to other networks and systems. The risk of a security breach due to a cyber attack could increase in the future due to factors such as: our ongoing expansion of mobile and digital banking and other internet-based products and applications, and the increased use of remote access to facilitate remote arrangements for employees, vendors and other third parties. In addition, a third party could misappropriate confidential information obtained by intercepting signals or communications from mobile devices used by our employees. A successful penetration or circumvention of the security of our systems or the systems of a vendor, governmental body or another market participant could cause serious negative consequences, including: significant disruption of our operations and those of our clients, customers and counterparties, including: losing access to operational systems; misappropriation of our confidential information or that of our clients, customers, counterparties, employees, regulators, or other individuals; disruption of or damage to our systems and those of our clients, customers and counterparties; the inability, or extended delays in the ability, to fully recover and restore data that has been stolen, manipulated or destroyed or the inability to prevent systems from processing fraudulent transactions; allegations or violations by the Company of applicable privacy and other laws; financial loss to us or to our clients, customers, counterparties, employees, or others; loss of confidence in our cybersecurity and business resiliency measure…

Excerpt shortened here; the source contains the full paragraph.

Current wording

18 TriCo Bancshares 2025 10-K linked to terrorist organizations or hostile countries, or third parties whose objective is to disrupt the operations of financial institutions more generally; we do not have control over the cybersecurity of the systems of the large number of clients, customers, counterparties and third-party service providers with which we do business; and it is possible that a third party, after establishing a foothold on an internal network without being detected, might obtain access to other networks and systems. The risk of a security breach due to a cyber attack could increase in the future due to factors such as: our ongoing expansion of mobile and digital banking and other internet-based products and applications, and the increased use of remote access to facilitate remote arrangements for employees, vendors and other third parties. In addition, a third party could misappropriate confidential information obtained by intercepting signals or communications from mobile devices used by our employees. The techniques used in cyber attacks and breaches change rapidly and are increasingly sophisticated, including through the use of generative AI and deepfakes, and we expect additional risks in the future through the use of quantum computing, and we may not be able to anticipate cyber attacks or other data security breaches. Additionally, cyber attacks and breaches in some cases appear to be supported by foreign governments or other well-financed entities and often originate from less regulated and remote areas of the world. We have seen a higher volume and complexity of attacks during times of increased geopolitical tensions. A successful penetration or circumvention of the security of our systems or the systems of a vendor, governmental body or another market participant could cause serious negative consequences, including: significant disruption of our operations and those of our clients, customers and counterparties, including: losing access to operational systems; misappropriation of our confidential information or that of our clients, customers, counterparties, employees, regulators, or other individuals; disruption of or damage to our systems and those of our clients, customers and counterparties; the inability, or extended delays in the ability, to fully recover and restore data that has been stolen, manipulated or destroyed or the inability to prevent systems from processing fraudulent transactions; allegations or violations by the Company of applicable privacy and other laws; financial loss to us or to our clients, customers, counterparties, employees, or others; loss of confidence in our cybersecurity and business resiliency measures; dissatisfaction among our clients, customers or counterparties; significant exposure to litigation and regulatory fines, penalties or other sanctions; and harm to our reputation, all of which could have a material adverse effect on us. If personal, confidential or proprietary information of c…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Although we devote significant resources to maintain and regularly upgrade our systems and processes that are designed to protect the security of our computer systems, software, networks, and other technology assets and the confidentiality, integrity, and availability of information belonging to us and our customers, there is no assurance that our security measures will be sufficient. We have implemented employee and customer awareness training regarding phishing, malware, and other cyber risks, however there can no assurances that this training will be effective or sufficient. Furthermore, these risks are expected to increase in the future as we continue to increase our electronic payments and other internet-based product offerings and expand our internal usage of web-based products and applications.

Current wording

Although we devote significant resources to maintain and regularly upgrade our systems and processes that are designed to protect the security of our computer systems, software, networks, and other technology assets and the confidentiality, integrity, and availability of information belonging to us and our customers, there is no assurance that our security measures will be sufficient. We have implemented employee and customer awareness training regarding phishing, malware, and other cyber risks, however there can be no assurances that this training will be effective or sufficient. Furthermore, these risks are expected to increase in the future as we continue to increase our electronic payments and other internet-based product offerings and expand our internal usage of web-based products and applications.

Previous wording

Third-party vendors provide key components of our business infrastructure, including certain data processing and information services. On our behalf, third parties may transmit confidential, propriety information. Some of these third parties may engage vendors of their own, which introduces the risk that these "fourth parties" could be the source of operational and/or security failures. Although we require third-party providers and these fourth-party vendors to maintain certain levels of information security, such providers may remain vulnerable to breaches, unauthorized access, misuse, computer viruses, or other malicious attacks that could ultimately compromise sensitive information. Additionally, we do not have control of the cybersecurity systems, breach prevention, and response protocols of our third- or fourth-party vendors, including through our cybersecurity programs or policies. While the Company may have contractual rights to assess the effectiveness of many of our providers’ systems and protocols, we do not have the means to know or assess the effectiveness of all of our providers’ systems and controls at all times. We cannot provide any assurances that actions taken by us, or our third- or fourth-party vendors, including through our cybersecurity programs or policies, will adequately prevent or substantially mitigate the impacts of cybersecurity breaches or misuses of confidential information, unauthorized access to our networks or systems or exploits against third-or fourth-party environments, or that we, or our third- or fourth-party vendors, will be able to effectively identify, investigate, and remediate such incidents in a timely manner or at all. While we may contractually limit our liability in connection with attacks against third-party providers, we remain exposed to the risk of loss associated with such vendors.

Current wording

Third-party vendors provide key components of our business infrastructure, including certain data processing and information services. On our behalf, third parties may transmit confidential, propriety information. Some of these third parties may engage vendors of their own, which introduces the risk that these "fourth parties" could be the source of operational and/or security failures. Although we require third-party providers and these fourth-party vendors to maintain certain levels of information security, such providers may remain vulnerable to breaches, unauthorized access, misuse, computer viruses, or other malicious attacks that could ultimately compromise sensitive information. Additionally, we do not have control of the cybersecurity systems, breach prevention, and response protocols of our third- or fourth-party vendors, including through our cybersecurity programs or policies. While the Company may have contractual rights to assess the effectiveness of many of our providers’ systems and protocols, we do not have the means to know or assess the effectiveness of all of our providers’ systems and controls at all times. We cannot provide any assurances that actions taken by us, or our third- or fourth-party vendors, including through our cybersecurity programs or policies, will adequately prevent or substantially mitigate the impacts of cybersecurity breaches or misuses of confidential information, unauthorized access to our networks or systems or exploits against third-or

Previous wording

Our business involves storing and processing sensitive consumer and business customer data. We depend on internal systems, third party service providers, cloud services and outsourced technology to support these data storage and processing operations. In addition, cloud technologies are also critical to the operation of our systems, and our reliance on cloud technologies is growing. Despite our efforts to ensure the security and integrity of our systems, we may not be able to anticipate, detect or recognize threats to our systems or those of third-party service providers or to implement effective preventive measures against all cybersecurity breaches. Cyberattack techniques change regularly and can originate from a wide variety of sources, including third parties who are or may be involved in organized crime or linked to terrorist organizations or hostile foreign governments, and such third parties may seek to gain access to systems directly or using equipment or security passwords belonging to employees, customers, third-party service providers or other users of our systems. These risks may increase in the future as we continue to increase our mobile, digital and other internet-based product offerings and expands our internal usage of web-based products and applications. A cybersecurity breach or cyberattack could persist for a long time before being detected and could result in theft of sensitive data or disruption of our transaction processing systems.

Current wording

Our business involves storing and processing sensitive consumer and business customer data. We depend on internal systems, third-party service providers, cloud services and outsourced technology to support these data storage and processing operations. In addition, cloud technologies are also critical to the operation of our systems, and our reliance on cloud technologies is growing. Despite our efforts to ensure the security and integrity of our systems, we may not be able to anticipate, detect or recognize threats to our systems or those of third-party service providers or to implement effective preventive measures against all cybersecurity breaches. Cyberattack techniques change regularly and can originate from a wide variety of sources, including third parties who are or may be involved in organized crime or linked to terrorist organizations or hostile foreign governments, and such third parties may seek to gain access to systems directly or using equipment or security passwords belonging to employees, customers, third-party service providers or other users of our systems. These risks may increase in the future as we continue to increase our mobile, digital and other internet-based product offerings and expand our internal usage of web-based products and applications. A cybersecurity breach or cyberattack could persist for a long time before being detected and could result in theft of sensitive data or disruption of our transaction processing systems.

Previous wording

The banking industry is undergoing technological changes with frequent introductions of new technology-driven products and services. In addition to improving customer services, the effective use of technology increases efficiency and enables financial institutions to reduce costs. Our future success will depend, in part, on our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands for convenience as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources than we do to invest in technological improvements. We may not be able to effectively implement new technology-driven products and services or successfully market such products and services to our customers. In addition,

Current wording

The banking industry is undergoing technological changes with frequent introductions of new technology-driven products and services. In addition to improving customer services, the effective use of technology increases efficiency and enables financial institutions to reduce costs. Our future success will depend, in part, on our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands for convenience as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources than we do to invest in technological improvements. We may not be able to effectively implement new technology-driven products and services or successfully market such products and services to our customers. In addition, advances in technology such as digital, mobile, telephone, text, and online banking; e-commerce; and self-service automatic teller machines and other equipment, as well as changing customer preferences to access our products and services through digital channels, could decrease the value of our branch network and other assets. We may close or sell certain branches and restructure or reduce our remaining branches and work force. These actions could lead to losses on assets, expense to reconfigure branches and loss of customers in certain markets. As a result, our business, financial condition or results of operations may be adversely affected.

Previous wording

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services. Our future success depends, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology driven products and services or be successful in marketing these products and services to our customers. In addition, our implementation of certain new technologies, such as those related to artificial intelligence ("AI"), automation and algorithms, in our business processes may have unintended consequences due to their limitations or our failure to use them effectively. In addition, the growing reliance on AI technologies by vendors, business partners, and technology solutions or applications introduces additional risks, including but not limited to: Algorithmic Bias that may result in unintended discriminatory outcomes and harm our reputation, loss of proprietary and confidential information through use of AI technologies, unauthorized access or breaches of data could compromise the integrity of our systems with AI dependency, evolving regulations and legal frameworks surrounding AI may pose challenges leading to legal and financial consequences for non-compliance, and protecting the intellectual property associated with AI technologies may be challenging, and unauthorized use or infringement by third parties could bring harm to our competitive position or reputation. Furthermore, cloud technologies are also critical to the operation of our systems, and our reliance on cloud technologies is growing. Failure to successfully keep pace with technological change affecting the financial services industry could have a material adverse effect on our business, financial condition and results of operations.

Current wording

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services. Our future success depends, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers. In addition, our implementation of certain new technologies, such as those related to artificial intelligence ("AI"), automation and algorithms, in our business processes may have unintended consequences due to their limitations or our failure to use them effectively. In addition, the growing reliance on AI technologies by vendors, business partners, and technology solutions or applications introduces additional risks, including but not limited to: Algorithmic Bias that may result in unintended discriminatory outcomes and harm our reputation, loss of proprietary and confidential information through use of AI technologies, unauthorized access or breaches of data could compromise the integrity of our systems with AI dependency, evolving regulations and legal frameworks surrounding AI may pose challenges leading to legal and financial consequences for non-compliance, and protecting the intellectual property associated with AI technologies may be challenging, and unauthorized use or infringement by third parties could bring harm to our competitive position or reputation. Furthermore, cloud technologies are also critical to the operation of our systems, and our reliance on cloud technologies is growing. Failure to successfully keep pace with

Previous wording

Regardless of the scope or validity of such patents or other intellectual property rights, or the merits of any claims by potential or actual litigants, we may have to engage in litigation that could be expensive, time-consuming, disruptive to our operations, and distracting to management. If we are found to infringe on one or more patents or other intellectual property rights, we may be required to pay substantial damages or royalties to a third-party. In certain cases, we may consider entering into licensing agreements for disputed intellectual property, although no assurance can be given that such licenses can be obtained on acceptable terms or that litigation will not occur. These licenses

Current wording

Regardless of the scope or validity of such patents or other intellectual property rights, or the merits of any claims by potential or actual litigants, we may have to engage in litigation that could be expensive, time-consuming, disruptive to our operations, and distracting to management. If we are found to infringe on one or more patents or other intellectual property rights, we may be required to pay substantial damages or royalties to a third-party. In certain cases, we may consider entering into licensing agreements for disputed intellectual property, although no assurance can be given that such licenses can be obtained on acceptable terms or that litigation will not occur. These licenses may also significantly increase our operating expenses. If legal matters related to intellectual property claims were resolved against us or settled, we could be required to make payments in amounts that could have a material adverse effect on our business, financial condition and results of operations.

Previous wording

The Bank Secrecy Act of 1970, the Patriot Act and other laws and regulations require financial institutions to institute and maintain an effective BSA/AML program, file suspicious activity reports and currency transaction reports and comply with other BSA/AML requirements. Our federal and state banking regulators, regularly review our BSA/AML program FinCEN. If BSA/AML our program is deemed deficient, we could be subject to liability, including fines, civil money penalties and other regulatory enforcement actions, which may include restrictions on our business operations and our ability to pay dividends, restrictions on mergers and acquisitions activity, restrictions on expansion, and restrictions on entering new business lines. Our failure to maintain and implement adequate programs to combat money laundering and terrorist financing could also have significant reputational consequences for us and, in turn, could have a material adverse effect on our business, financial condition or results of operations.

Current wording

The Bank Secrecy Act of 1970, the Patriot Act and other laws and regulations require financial institutions to institute and maintain an effective BSA/AML program, file suspicious activity reports and currency transaction reports and comply with other BSA/AML requirements. Our federal and state banking regulators regularly review our BSA/AML program. If FinCEN BSA/AML our program is deemed deficient, we could be subject to liability, including fines, civil money penalties and other regulatory enforcement actions, which may include restrictions on our business operations and our ability to pay dividends, restrictions on mergers and acquisitions activity, restrictions on expansion, and restrictions on entering new business lines. Our failure to maintain and implement adequate programs to combat money laundering and terrorist financing could also have significant reputational consequences for us and, in turn, could have a material adverse effect on our business, financial condition or results of operations.

Previous wording

Our future operating results depend substantially upon the continued service of our executive officers and key personnel. Our future operating results also depend in significant part upon our ability to attract and retain qualified management, financial, technical, marketing, sales and support personnel. Competition for qualified personnel is intense, including with respect to compensation and emerging workplace practices, accommodations and remote work options, and we cannot ensure success in attracting or retaining qualified personnel. Our current or future approach to in-office and work-from-home arrangements may not meet the needs or expectations of our current or prospective employees or may not be perceived as favorable as compared to the arrangements offered by competitors, which could adversely affect our ability to attract and retain employees. There may be only a limited number of persons with the requisite skills to serve in these positions, and it may be increasingly difficult for us to hire personnel over time. Our business, financial condition or results of operations could be materially adversely affected by the loss of any of our key employees, or our inability to attract and retain skilled employees.

Current wording

Our future operating results depend substantially upon the continued service of our executive officers and key personnel. Our future operating results also depend in significant part upon our ability to attract and retain qualified management, financial, technical, marketing, sales and support personnel. Competition for qualified personnel is intense, including with respect to compensation and emerging workplace practices, accommodations and remote work options, and we cannot ensure success in attracting or retaining qualified personnel. Our current or future approach to in-office and work-from-home arrangements may not meet the needs or expectations of our current or prospective employees or may not be perceived as favorable as compared to the arrangements offered by competitors, which could adversely affect our ability to attract and retain employees. There may be only a limited number of persons with the requisite skills to serve in these positions, and it may be increasingly difficult for us to hire personnel over time. Our business, financial condition or results of

Previous wording

24 TriCo Bancshares 2024 10-K downgrades, or an economic recession in the United States. Many of our investment securities are issued by the U.S. government and government agencies and sponsored entities. As a result of uncertain domestic political conditions, including potential future federal government shutdowns, the possibility of the federal government defaulting on its obligations for a period of time due to debt ceiling limitations or other unresolved political issues, investments in financial instruments issued or guaranteed by the federal government pose liquidity risks. In connection with prior political disputes over U.S. fiscal and budgetary issues leading to the U.S. government shutdown in 2023, both Fitch and S&P lowered their long-term sovereign credit rating on the U.S. from AAA to AA+, and further affirmed the ratings in 2024. A further downgrade, or downgrades by other rating agencies, as well as sovereign debt issues facing the governments of other countries, could have a material adverse impact on financial markets and economic conditions in the U.S. and worldwide.

Current wording

Federal budget deficit concerns and the potential for political conflict over legislation to fund U.S. government operations and raise the U.S. government's debt limit may increase the possibility of a default by the U.S. government on its debt obligations, related credit-rating downgrades, or an economic recession in the United States. Many of our investment securities are issued by the U.S. government and government agencies and sponsored entities. As a result of uncertain domestic political conditions, including potential future federal government shutdowns, the possibility of the federal government defaulting on its obligations for a period of time due to debt ceiling limitations or other unresolved political issues, investments in financial instruments issued or guaranteed by the federal government pose liquidity risks. In connection with prior political disputes over U.S. fiscal and budgetary issues leading to the U.S. government shutdown in 2023, both Fitch and S&P lowered their long-term sovereign credit rating on the U.S. from AAA to AA+, and further affirmed the ratings in 2024. A further downgrade, or downgrades by other rating agencies, as well as sovereign debt issues facing the governments of other countries, could have a material adverse impact on financial markets and economic conditions in the U.S. and worldwide.