CENTRAL PACIFIC FINANCIAL CORP

Federal regulators have issued multiple statements regarding cybersecurity that requires financial institutions to design and implement multiple layers of security controls to establish lines of defense to ensure strong cyber risk management processes. Risks associated with compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution must also be addressed. In addition, a financial institution’s management is expected to maintain sufficient business continuity planning processes and capabilities to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations, including California and New York. Other states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. We expect this trend of state-level activity in those areas to continue, and are continually monitoring developments in the states in which our customers are located in or in which we conduct business.

In November 2021, the federal banking agencies adopted a final rule, with compliance required by May 1, 2022, that requires banking organizations to notify their primary banking regulator within 36 hours of determining that a "computer-security incident" has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss, or its operations that would impact the stability of the United States. Failure to observe the regulatory guidance could result in various regulatory sanctions, including financial penalties.

In July 2023, the SEC adopted rules requiring registrants to disclose material cybersecurity incidents experienced and describe the material aspects of their nature, scope and timing. The rules, which supersede their previously interpretive guidance published in February 2018, also require annual disclosures describing a company's cybersecurity risk management, strategy and governance. These SEC rules, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations.

In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. We employ a layered defense-in-depth approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of our defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not experienced a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our customers and third-party service providers are under constant threat and it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of internet banking, mobile banking and other technology-based products and services by us and our customers. See "Risk Factors" under Part I, Item 1A of this report for a further discussion of risks related to cybersecurity and "Cybersecurity" under Part I, Item 1C for a further discussion of our cybersecurity risk management, strategy and governance.

Office of Foreign Assets Control ("OFAC") Regulation

The U.S. Treasury Department’s Office of Foreign Assets Control, or OFAC, administers and enforces economic and trade sanctions against targeted foreign countries and regimes, under authority of various laws, including designated foreign countries, nationals and others. OFAC publishes lists of specially designated targets and countries. We are responsible for, among other things, blocking accounts of, and transactions with, such targets and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence. Failure to comply with these sanctions could have serious financial, legal and reputational consequences, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required. Regulatory authorities have imposed cease and desist orders and civil money penalties against institutions found to be violating these obligations.

Operations and Consumer Compliance Laws

The Bank must comply with numerous federal and state anti-money laundering and consumer protection and privacy statutes and implementing regulations, including the USA Patriot Act of 2001, GLBA, the Bank Secrecy Act, the Foreign Account Tax Compliance Act, the CRA, the Fair Debt Collection Practices Act, the Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactions Act, the Equal Credit Opportunity Act, the Truth in Lending Act, the Fair Housing Act, the Home Mortgage Disclosure Act, the Real Estate Settlement Procedures Act, the National Flood Insurance Act, and various federal and state privacy protection laws, including the Telephone Consumer Protection Act and the CAN-SPAM Act. Noncompliance with these laws could subject the Bank to lawsuits and could also result in administrative penalties, including, fines and reimbursements. The Company and the Bank are also subject to federal and state laws prohibiting unfair or fraudulent business practices, untrue or misleading advertising and unfair competition. In addition, recent joint regulatory pronouncements by the federal banking agencies have emphasized the importance of managing all the risks, including operational and compliance risks, associated with any BaaS relationships.

These laws and regulations mandate certain disclosure and reporting requirements and regulate the manner in which financial institutions must deal with customers when taking deposits, making loans, servicing, collecting, and foreclosing on loans, and providing other services. Failure to comply with these laws and regulations can subject the Bank to various penalties, including but not limited to enforcement actions, injunctions, fines or criminal penalties, punitive damages, and the loss of certain contractual rights.

The Anti-Money Laundering Act of 2020 ("AMLA"), which amends the Bank Secrecy Act of 1970 (“BSA”), was enacted in January 2021. The AMLA is intended to be a comprehensive reform and modernization to U.S. bank secrecy and anti-money laundering laws. Among other things, it codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the development of standards for evaluating technology and internal processes for BSA compliance; expands enforcement- and investigation-related authority, including increasing available sanctions for certain BSA violations and instituting BSA whistleblower incentives and protections.

The CRA is intended to encourage insured depository institutions, while operating safely and soundly, to help meet the credit needs of their communities. The CRA specifically directs the federal bank regulatory agencies, in examining insured depository institutions, to assess their record of helping to meet the credit needs of their entire community, including low and moderate income neighborhoods, consistent with safe and sound banking practices. The CRA further requires the agencies to take a financial institution’s record of meeting its community credit needs into account when evaluating applications for, among other things, domestic branches, consummating mergers or acquisitions or holding company formations. The Bank received an "Outstanding" rating in the FDIC's 2022 CRA Performance Evaluation that measures how financial institutions support their communities in the areas of lending, investment and service.

On October 24, 2023, the OCC, FDIC, and FRB issued a final rule intended to modernize and strengthen regulations implementing the CRA. For banks with total assets in excess of $2 billion, which includes our Bank, the Bank’s CRA evaluation will be based on four tests: (i) retail lending; (ii) retail services and products (including digital delivery systems for banks with more than $10 billion in assets or banks which request consideration of such systems); (iii) community development (CD) financing; and (iv) CD services. Weighting of each test is applied to those banks (such as the Bank) when regulators are evaluating CRA performance based on multiple tests. Alternatively, banks (including the bank) have the option to be evaluated based on a regulator-approved strategic plan. In addition, banks with total assets in excess of $2 billion are subject to revised and more comprehensive data collection, reporting and maintenance requirements. Regulators will downgrade an institution’s CRA rating in the case of illegal or discriminatory credit practices.

The final CRA rule was intended to take effect on April 1, 2024 with staggered compliance dates, including compliance with the new tests, data collection requirements, with the requirement to define retail lending assessment areas, all of which become applicable on January 1, 2026 and revised data reporting requirements taking effect January 1, 2027. The final CRA rule was enjoined from implementation by a Texas federal court on April 1, 2024, extending the effective date of April 1, 2024, as well as all other implementation dates, on a day-for-day basis for each day that the injunction remains in effect. The decision of the district court is currently on appeal. We are continuing to evaluate the impact of these changes to bank and holding company regulations and their impact to our financial condition, results of operations, and/or liquidity, which cannot be predicted at this time.

Consumer Financial Protection Bureau ("CFPB")

The Dodd-Frank Act provided for the creation of the CFPB as an independent entity with broad rule making, supervisory and enforcement authority over consumer financial products and services, including deposit products, residential mortgages, home equity loans and credit cards. The CFPB’s functions include investigating consumer complaints, conducting market research, rule making, and enforcing rules related to consumer financial products and services. CFPB regulations and guidance, including supervision and examination, apply to all covered persons, and banks with $10 billion or more in assets. Banks with less than $10 billion in assets, including the Bank, will continue to be examined for compliance by their primary federal banking agency.

The CFPB has finalized a number of significant rules which impact nearly every aspect of the lifecycle of a residential mortgage loan. These rules implement the Dodd-Frank Act amendments to the Equal Credit Opportunity Act, the Truth in Lending Act and the Real Estate Settlement Procedures Act. Among other things, the rules adopted by the CFPB require covered persons including banks making residential mortgage loans to: (i) develop and implement procedures to ensure compliance with an "ability-to-repay" test and identify whether a loan meets a new definition for a "qualified mortgage", in which case a rebuttable presumption exists that the creditor extending the loan has satisfied the ability-to-repay test; (ii) implement new or revised disclosures, policies and procedures for originating and servicing mortgages including, but not limited to, pre-loan counseling, early intervention with delinquent borrowers and specific loss mitigation procedures for loans secured by a borrower's principal residence; (iii) comply with additional restrictions on mortgage loan originator hiring and compensation; (iv) comply with new disclosure requirements and standards for appraisals and certain financial products; and (v) maintain escrow accounts for higher-priced mortgage loans for a longer period of time.

The review of products and practices to prevent unfair, deceptive or abusive acts or practices ("UDAAP") has been a focus of the CFPB, and of banking regulators more broadly. In addition, the Dodd-Frank Act provides the CFPB with broad supervisory, examination and enforcement authority over various consumer financial products and services, including the ability to require reimbursements and other payments to customers for alleged violations of UDAAP. The Dodd-Frank Act also provides the CFPB the ability to impose significant penalties, as well as injunctive relief that prohibits lenders from engaging in allegedly unlawful practices. The CFPB also has the authority to obtain cease and desist orders providing for affirmative relief or monetary penalties. The Dodd-Frank Act does not prevent states from adopting stricter consumer protection standards. State regulation of financial products and potential enforcement actions could also adversely affect the Bank’s business, financial condition or results of operations.

The federal bank regulators have adopted rules limiting the ability of banks and other financial institutions to disclose non-public information about consumers to unaffiliated third parties. These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a non-affiliated third party. These regulations affect how consumer information is transmitted through diversified financial companies and conveyed to outside vendors. In addition, consumers may also prevent disclosure of certain information among affiliated companies that is assembled or used to determine eligibility for a product or service, such as that shown on consumer credit reports and asset and income information from applications. Consumers also have the option to direct banks and other financial institutions not to share information about transactions and experiences with affiliated companies for the purpose of marketing products or services.

Under the Durbin Amendment to the Dodd-Frank Act, the Federal Reserve adopted rules establishing standards for assessing whether the interchange fees that may be charged with respect to certain electronic debit transactions are “reasonable and proportional” to the costs incurred by issuers for processing such transactions.

Interchange fees, or “swipe” fees, are charges that merchants pay to us and other card-issuing banks for processing electronic payment transactions. Under the final rules, the maximum permissible interchange fee is equal to no more than 21 cents plus 5 basis points of the transaction value for many types of debit interchange transactions. The Federal Reserve also adopted a rule to allow a debit card issuer to recover one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements required by the Federal Reserve. The Federal Reserve also has rules governing routing and exclusivity that require issuers to offer two unaffiliated networks for routing transactions on each debit or prepaid product.

Currently, we qualify for the small issuer exemption from the interchange fee cap, which applies to any debit card issuer that, together with its affiliates, has total assets of less than $10 billion as of the end of the previous calendar year. We will become subject to the interchange fee cap beginning July 1 of the year following the time when our total assets reaches or exceeds $10 billion. Reliance on the small issuer exemption does not exempt us from federal regulations prohibiting network exclusivity arrangements or from routing restrictions.

Commercial Real Estate Concentration Limits

In December 2006, the federal banking regulators issued guidance entitled “Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices” to address increased concentrations in commercial real estate and construction, or "CRE", loans. In addition, in December 2015, the federal bank agencies issued additional guidance entitled “Statement on Prudent Risk Management for Commercial Real Estate Lending.” Together, these guidelines describe the criteria the agencies will use as indicators to identify institutions potentially exposed to CRE concentration risk. An institution that has (i) experienced rapid growth in CRE lending, (ii) notable exposure to a specific type of CRE, (iii) total reported loans for construction, land development, and other land representing 100% or more of the institution’s total risk-based capital, or (iv) total CRE loans representing 300% or more of the institution’s total risk-based capital, and the outstanding balance of the institutions CRE portfolio has increased by 50% or more in the prior 36 months, may be identified for further supervisory analysis of the level and nature of its CRE concentration risk. As of December 31, 2024, the Bank’s construction, land development, and other land loans represented less than 100% of its total risk-based capital. As of December 31, 2024, the Bank's total CRE loans represented less than 300% of its total risk-based capital and has increased by less than 50% from the prior 36 months.

Changes in Federal, State, or Local Tax Laws

We are subject to changes in federal and applicable state tax laws and regulations that may impact our effective tax rates. Changes in these tax laws may be retroactive to previous periods and as a result could impact our current and future financial performance. For example, the Tax Cuts and Jobs Act of 2017 resulted in a reduction of our federal tax rate from a minimum of 35% in 2017 to 21% in 2018 through current, which had a favorable impact on our earnings. Conversely, this legislation also enacted limitations on certain deductions, including the deduction of FDIC deposit insurance premiums, which partially offset the expected increase in net earnings from the lower tax rate.

On August 16, 2022, the Inflation Reduction Act of 2022 (the "IRA") was enacted into law. The IRA imposes a non-deductible 1% excise tax on the aggregate fair market value of stock repurchased by certain public companies, if any, including the Company, occurring after December 31, 2022.

The foregoing description of the impact of changes in federal and applicable state tax laws on us should be read in conjunction with Note 16 - Income Taxes of the notes to consolidated financial statements for more information.

Future Legislation and Regulation

Congress may enact, modify or repeal legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact, modify or repeal legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of proposed legislation (or modification or repeal of existing legislation) could impact the regulatory structure under which the Company and Bank operate and may significantly increase its costs, impede the efficiency of its internal business processes, require the Bank to increase its regulatory capital and modify its business strategy, and limit its ability to pursue business opportunities in an efficient manner.

Under these circumstances, the Company's business, financial condition, results of operations or prospects may be adversely affected, perhaps materially.

Employees and Workforce

We believe that the success of our business is largely due to the quality of our employees, the development of each employee's full potential, and our ability to provide timely and satisfying rewards to our employees. At December 31, 2024, we employed 741 persons, 697 on a full-time basis and 44 on a part-time basis. We are not a party to any collective bargaining agreement. At December 31, 2024, our workforce was over 92% ethnically diverse (non-Caucasian or two or more races) and 64% female, with 55% of all management staff having a supervisory role being female.

We encourage and support the growth and development of our employees and, wherever possible, seek to fill positions by promotion and transfer from within the organization. Continual learning and career development are advanced through ongoing development conversations and annual performance reviews with employees, internally developed training programs, conferences, and other training events that employees are encouraged to attend in connection with their job duties. Additionally, we invest in continual learning and development through tuition reimbursement for courses or degree programs, and fees paid for certifications. A cohort of two to three high potential employees are sent to the Pacific Coast Banking School annually. Our CPB Toastmasters helps participating employees gain public speaking, communication and leadership skills. Our CPB Women's Leadership Program provides opportunities for CPB's top women leaders to develop leadership skills, build a support network and give back to the broader community through service projects.

The safety, health and wellness of our employees is a top priority. We promote the health and wellness of our employees by strongly encouraging work-life balance, offering flexible work schedules including hybrid, keeping the employee portion of health care premiums to a minimum and sponsoring various wellness programs.

Employee retention helps us operate efficiently and achieve one of our business objectives, which is being an exceptional service provider. We believe our commitment to living out our core values, actively prioritizing concern for our employees’ well-being, supporting our employees’ career goals, offering a competitive compensation and benefits package that includes health insurance and retirement savings plans, aids in retention of our top-performing employees. In addition to base salary, our compensation program includes variable pay (e.g., commission, incentive, bonus) for all employees. Our variable pay programs are designed to motivate and reward high levels of individual performance that aligns with our corporate strategy and business plan, and contributes to CPB’s success. At December 31, 2024, the employee average years of service was 10 years and 36% of our current staff had been with us for ten years or more.

Available Information

Our internet website can be found at www.cpb.bank. Our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and all amendments to those reports can be found on our internet website as soon as reasonably practicable after such materials are electronically filed with or furnished to the SEC. Copies of the Company's filings with the SEC may also be obtained directly from the SEC's website at www.sec.gov. These documents may also be obtained in print upon request to our Investor Relations Department.

Also posted on our website and available in print upon request to our Investor Relations Department, are the charters for our Audit Committee, Compensation Committee and Governance Committee, as well as our Corporate Governance Guidelines and Code of Conduct and Ethics. Within the time period required by the SEC and NYSE, we will post on our website any amendment to the Code of Conduct and Ethics and any waiver applicable to our senior financial officers, as defined by the SEC, and our executive officers or directors. In addition, our website includes information concerning purchases and sales of our equity securities by our executive officers and directors, as well as disclosure relating to certain non-GAAP financial measures (as defined in the SEC's Regulation G) that we may make public orally, telephonically, by webcast, by broadcast or by similar means from time to time.