SOUTHSIDE BANCSHARES INC

IMPORTANT INFORMATION ABOUT THIS REPORT

In this report, the words “the Company,” “we,” “us,” and “our” refer to the combined entities of Southside Bancshares, Inc. and its subsidiaries, including Southside Bank. The words “Southside” and “Southside Bancshares” refer to Southside Bancshares, Inc. The words “Southside Bank” and “the Bank” refer to Southside Bank.

PART I

ITEM 1. BUSINESS

FORWARD-LOOKING INFORMATION

The disclosures set forth in this item are qualified by the section captioned “Cautionary Notice Regarding Forward-Looking Statements” in “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations” of this Annual Report on Form 10-K and other cautionary statements set forth elsewhere in this report.

GENERAL

Southside Bancshares, Inc., incorporated in Texas in 1982, is a bank holding company for Southside Bank, a Texas state bank headquartered in Tyler, Texas that was formed in 1960. We operate through 55 branches, 13 of which are located in grocery stores, in addition to wealth management and trust services, and/or loan production, brokerage or other financial services offices.

At December 31, 2023, our total assets were $8.28 billion, total loans were $4.52 billion, total deposits were $6.55 billion and total equity was $773.3 million. For the years ended December 31, 2023 and 2022, our net income was $86.7 million and $105.0 million, respectively. For the years ended December 31, 2023 and 2022, diluted earnings per common share was $2.82 and $3.26, respectively. We have paid a cash dividend to shareholders every year since 1970 (including dividends paid by Southside Bank prior to the incorporation of Southside Bancshares).

We are a community-focused financial institution that offers a full range of financial services to individuals, businesses, municipal entities and nonprofit organizations in the communities that we serve. These services include consumer and commercial loans, deposit accounts, wealth management, trust and brokerage services.

Our consumer loan services include 1-4 family residential loans, home equity loans, home improvement loans, automobile loans and other consumer related loans. Commercial loan services include short-term working capital loans for inventory and accounts receivable, short- and medium-term loans for equipment or other business capital expansion, commercial real estate loans and municipal loans. We also offer construction loans for 1-4 family residential and commercial real estate.

We offer a variety of deposit accounts with a wide range of interest rates and terms, including savings, money market, interest and noninterest bearing checking accounts and CDs.

Our trust and wealth management services include investment management, administration of irrevocable, revocable and testamentary trusts, estate administration, and custodian services, primarily for individuals and, to a lesser extent, partnerships and corporations. Additionally, we offer retirement and employee benefit accounts, including but not limited to, IRAs, 401(k) plans and profit sharing plans. At December 31, 2023, our wealth management and trust assets under management were approximately $1.48 billion.

Our business strategy includes evaluating expansion opportunities through acquisitions of financial institutions in market areas that could complement our existing franchise. We generally seek merger partners that are culturally similar, have experienced management teams and possess either significant market presence or have potential for improved profitability through financial management, economies of scale or expanded services.

We and our subsidiaries are subject to comprehensive regulation, examination and supervision by the Federal Reserve, the TDB and the FDIC and are subject to numerous laws and regulations relating to internal controls, the extension of credit, making of loans to individuals, deposits and all other facets of our operations.

Our primary executive offices are located at 1201 South Beckham Avenue, Tyler, Texas 75701 and our telephone number is 903-531-7111. Our website can be found atwww.southside.com. Our public filings with the SEC may be obtained free of charge on either our website, https://investors.southside.com/ under the topic Financials, or the SEC’s website, www.sec.gov, as soon as reasonably practicable after filing with the SEC.

MARKET AREA

We are headquartered in Tyler, Texas. The Tyler metropolitan area has an estimated population of 240,000 and is located approximately 90 miles east of Dallas, Texas and 90 miles west of Shreveport, Louisiana.

We consider our primary market areas to be East Texas, Southeast Texas, as well as the greater Dallas-Fort Worth, Austin and Houston, Texas areas. Our expectation is that our presence in all of the market areas we serve should grow in the future. In addition, we continue to explore new markets in which we believe we can successfully expand.

The principal economic activities in our market areas include medical services, retail, education, financial services, technology, distribution, manufacturing, government and to a lesser extent, oil and gas industries. These economic activities support a growing regional system of medical service, retail and education centers. Tyler, Dallas-Fort Worth, Austin and Houston are home to several nationally recognized health care systems that represent all major specialties.

Our 55 branches and 38 drive-thru facilities are located in and around Arlington, Austin, Bullard, Chandler, Cleburne, Cleveland, Diboll, Euless, Fort Worth, Frisco, Granbury, Grapevine, Gresham, Gun Barrel City, Hawkins, Hemphill, Houston, Irving, Jacksonville, Jasper, Kingwood, Lindale, Longview, Lufkin, Nacogdoches, Palestine, Pineland, San Augustine, Splendora, Tyler, Watauga, Weatherford and Whitehouse. Our advertising is designed to target the market areas we serve. The type and amount of advertising in each location is directly attributable to our market share in that area, combined with overall cost.

Additionally, our customers may access various banking services through a wide network of ATMs, ITMs and through automated telephone, internet and mobile banking products. These products allow our customers to apply for loans, open deposit accounts, access account information and conduct various other transactions online from their smart phones or computers.

RECENT DEVELOPMENTS

During the year ended December 31, 2023, we closed one traditional branch location in Lufkin, due to close proximity to another Southside branch and a shift in customer preferences and their transition from in-branch banking to digital banking.

During the year ended December 31, 2023, we entered into a lease for a loan production office in Preston Center in Dallas which opened during January 2024.

In January 2024, we announced our plan to close a traditional branch location in Jasper on May 3, 2024, due to close proximity to another Southside branch and a shift in customer preferences and their transition from in-branch banking to digital banking.

THE BANKING INDUSTRY IN TEXAS

The banking industry is affected by general economic conditions such as interest rates, inflation, recession, unemployment and other factors beyond our control. During the last 30 years the Texas economy has continued to diversify, decreasing the overall impact of fluctuations in oil and gas prices; however, the oil and gas industry is still a significant component of the Texas economy. The economic conditions and growth prospects for our markets, even against the headwinds of inflation and potential recessionary concerns, continue to reflect a solid and positive overall outlook. Ongoing elevated inflation levels and higher interest rates could have a negative impact on both our consumer and commercial borrowers. However, currently the Texas markets we serve continue to remain healthy due to both job and population growth.

COMPETITION

The activities we are engaged in are highly competitive. Financial institutions such as credit unions, fintech companies, consumer finance companies, insurance companies, brokerage companies and other financial institutions with varying degrees of regulatory restrictions compete vigorously for a share of the financial services market. Fintech, brokerage and insurance companies continue to become more competitive in the financial services arena and pose an ever-increasing challenge to banks. Legislative changes also greatly affect the level of competition we face. Federal legislation allows credit unions to use their expanded membership capabilities, combined with tax-free status, to compete more openly for traditional bank business. The tax-free status granted to credit unions provides them with a significant competitive advantage. Many of the largest banks operating in Texas, including some of the largest banks in the country, have offices in our market areas with capital resources, broader geographic markets and legal lending limits substantially in excess of those available to us. We face competition from institutions that offer products and services we do not or cannot currently offer. Some institutions we compete with offer interest rate levels on loan and deposit products that we are unwilling to offer due to interest rate risk and overall profitability concerns. We expect the level of competition to continue to increase.

HUMAN CAPITAL RESOURCES

At December 31, 2023, we employed approximately 815 full time equivalent persons. None of our employees are represented by any unions or similar groups, and we have not experienced any type of strike or labor dispute. We consider the relationship with our employees to be good, which we believe to be reflected in the average tenure of our employees exceeding eight years, with the tenure of 35% of our employees exceeding ten years.

During 2023, Southside was awarded “Best Banks to Work For” by American Banker and obtained the number one spot among all Texas Banks. The award identifies banks that excel at creating positive and supportive workplaces for employees. We continuously work toward an outstanding workplace with competitive benefits for employees through our initiatives outlined below.

We value diversity and are committed to creating a diverse and inclusive workforce. Our DEI officer oversees our diversity, equity and inclusion efforts, which includes implementation of a three-year DEI training strategic plan company-wide. As of December 31, 2023, women and ethnic minorities represented approximately 69% and 38% of our workforce, respectively.

The health, safety and wellness of our employees is a top priority. In 2023, we continued to focus on the health and wellness of our employees through several company-wide efforts including: a wellness program that allows employees to earn cash rewards; a three-week wellness challenge to encourage healthy habits; on-site biometric screenings, as well as wellness communications and webinars throughout the year. We maintain a comprehensive employee handbook, code of business conduct, as well as other policies, including a harassment policy, whistleblower policy and a human rights policy statement, to promote a safe and supportive workplace culture.

We believe employees to be our greatest asset and that our future success depends on our ability to attract, retain and develop employees. Professional development is a key priority, which is facilitated through our many corporate initiatives including extensive training programs, corporate mentoring, leadership programs, educational reimbursement and corporate and personal development coaching.

As part of our effort to attract and retain employees, we offer a broad range of benefits, including, but not limited to, 15-30 days of annual paid time off based on length of employment, sick leave, participation in our ESOP, 401(k) match for eligible employees and up to 20 hours of paid time off annually to volunteer. We believe our compensation package and benefits are competitive with others in our industry. For additional information regarding our employee benefit plans, see “Note 10 - Employee Benefits” to our consolidated financial statements included in this report.

SUPERVISION AND REGULATION

General

Banking is a complex, highly regulated industry. As a bank holding company under federal law, the Company is subject to regulation, supervision and examination by the Federal Reserve. In addition, under state law, as the parent company of a Texas-chartered state bank that is not a member of the Federal Reserve, the Company is subject to supervision and examination by the TDB. As a Texas-chartered state bank, Southside Bank is subject to regulation, supervision and examination by the TDB, as its chartering authority, and by the FDIC, as its primary federal regulator and deposit insurer. This system of regulation and supervision provides a comprehensive legal framework for our operations and is intended primarily for the protection of bank depositors, the FDIC’s DIF and the public, rather than our shareholders and creditors.

In addition to the system of regulation and supervision outlined above, the CFPB has authority to supervise and examine depository institutions with more than $10 billion in assets for compliance with these federal consumer laws. The CFPB also has rulemaking authority for a range of consumer financial protection laws (such as TILA, the Electronic Fund Transfer Act and RESPA, among others). The authority to supervise and examine depository institutions with $10 billion or less in assets (such as Southside Bank) for compliance with federal consumer laws remains largely with those institutions’ primary regulators. However, the CFPB may participate in examinations of these smaller institutions on a “sampling basis” and may refer potential enforcement actions against such institutions to their primary regulators. Accordingly, the CFPB may participate in examinations of Southside Bank, and could supervise and examine other direct or indirect subsidiaries of the Company that offer consumer financial products or services.

The earnings of Southside Bank and, therefore, the earnings of the Company, are affected by general economic conditions, changes in federal and state laws and regulations and actions of various regulatory authorities, including those referenced above.

Significant changes to federal and state laws, changes in the interpretation or application of such laws by regulators, and/or the enactment of new legislation or adoption of new regulations could (i) materially impact the profitability of our business, the value of assets we hold, or the value of collateral available for our loans; (ii) require changes to our business practices; (iii) force us to discontinue certain businesses lines; and/or (iv) otherwise expose us to additional costs, taxes, liabilities, enforcement actions and reputational risk. The likelihood, timing and scope of any such change of law, and the impact that any such change may have on us, are impossible to determine with any certainty.

Set forth below are brief descriptions of the significant federal and state laws and regulations to which we are currently subject. These descriptions do not purport to be complete and are qualified in their entirety by reference to the particular statutory or regulatory provisions.

Holding Company Regulation

As a bank holding company regulated under the BHCA, as amended, the Company is registered with and subject to regulation, supervision and examination by the Federal Reserve. The Company is required to file annual and other reports with, and furnish information to, the Federal Reserve, which makes periodic inspections of the Company. The Federal Reserve may also examine our nonbank subsidiaries.

Permitted Activities. Under the BHCA, a bank holding company is generally permitted to engage in, or acquire direct or indirect control of more than five percent of the voting shares of any company engaged in, the following activities:

•banking or managing or controlling banks;

•furnishing services to or performing services for its subsidiaries; and

•any activity that the Federal Reserve determines to be so closely related to banking as to be a proper incident to the business of banking, including:

◦factoring accounts receivable;

◦making, acquiring, brokering or servicing loans and usual related activities;

◦leasing personal or real property;

◦operating a nonbank depository institution, such as a savings association;

◦performing trust company functions;

◦conducting financial and investment advisory activities;

◦conducting discount securities brokerage activities;

◦underwriting and dealing in government obligations and money market instruments;

◦providing specified management consulting and counseling activities;

◦performing selected data processing services and support services;

◦acting as agent or broker in selling credit life insurance and other types of insurance in connection with credit transactions;

◦performing selected insurance underwriting activities;

◦providing certain community development activities (such as making investments in projects designed primarily to promote community welfare); and

◦issuing and selling money orders and similar consumer-type payment instruments.

The Federal Reserve has the authority to order a bank holding company or its subsidiaries to terminate any of these activities or to terminate its ownership or control of any subsidiary when the Federal Reserve has reasonable cause to believe that the bank holding company’s continued ownership, activity or control constitutes a serious risk to the financial safety, soundness or stability of it or any of its bank subsidiaries.

Under the BHCA, a bank holding company meeting certain eligibility requirements may elect to become a “financial holding company,” which is a form of bank holding company with authority to engage in certain additional activities. Specifically, a financial holding company and companies under its control may engage in activities that are “financial in nature,” as defined by the GLBA and Federal Reserve interpretations, and therefore may engage in a broader range of activities than those permitted for bank holding companies and their subsidiaries. Financial activities include insurance brokerage and underwriting, securities underwriting and dealing, merchant banking, investment advisory and lending activities. Financial holding companies and their subsidiaries also may engage in additional activities that are determined by the Federal Reserve, in consultation with the U.S. Department of the Treasury, to be “financial in nature or incidental to” a financial activity or are determined by the Federal Reserve unilaterally to be “complementary” to financial activities.

The Company has elected to become a financial holding company. Our election was declared effective based in part upon a finding by the Federal Reserve that all of our depository institution subsidiaries satisfy the Federal Reserve’s “well capitalized” and “well managed” standards and have at least a satisfactory rating under the CRA (discussed below). We do not currently engage in financial activities beyond those permissible for a bank holding company. However, if we undertake expanded financial activities (i.e., those that are not permissible for a bank holding company) and we subsequently fail to continue to meet any of the prerequisites for “financial holding company” status, including those described above, we would be required to enter into an agreement with the Federal Reserve to restore our compliance with all applicable requirements, including specifically the “well-capitalized” and “well-managed” standards. If we do not return to compliance within 180 days of such an agreement, the Federal Reserve may order the Company to divest its Bank, or the Company may discontinue (or divest investments in companies engaged in) those expanded activities that are only permissible for financial holding companies.

Capital Adequacy. Each of the federal banking agencies, including the Federal Reserve and the FDIC, has issued substantially similar risk-based and minimum leverage capital guidelines applicable to the banking organizations they supervise.

Under existing capital standards, a banking organization is required to continually monitor the ratio of its assets against its capital so as to gauge its ability to absorb unexpected losses in an economic downturn.

The Bank is subject to the following minimum capital ratios: 4.5 percent Common Equity Tier 1 capital to risk-weighted assets; 6.0 percent Tier 1 capital to risk-weighted assets; 8.0 percent total capital to risk-weighted assets; and 4.0 percent Tier 1 leverage ratio to average consolidated assets. The Bank must also maintain a minimum “capital conservation buffer” equal to 2.5% of its total risk-weighted assets. The “capital conservation buffer,” which must consist entirely of CET1, is designed to absorb losses during periods of economic stress. The capital rules provide for a number of deductions from and adjustments to CET1, which include the requirement that mortgage servicing rights, deferred tax assets arising from temporary differences that could not be realized through net operating loss carrybacks and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1.

Certain regulatory capital ratios of the Company and Southside Bank, as of December 31, 2023, are shown in the following table.

On March 27, 2020 the federal bank agencies announced a final rule that permits banks that have adopted the CECL standard to defer recognition of the estimated impact of credit losses on regulatory capital by permitting a three-year “phase-in” approach commencing in 2022. We elected to adopt the transition option.

Eligible community banks and holding companies with less than $10 billion in consolidated assets may opt into the CBLR framework. A “qualifying community banking organization” is one that has (i) less than $10 billion in total consolidated assets; (ii) a leverage ratio greater than 9%; (iii) off-balance sheet exposures of 25% or less of total consolidated assets; and (iv) trading assets and liabilities of 5% or less of total consolidated assets. Qualifying banks that meet these thresholds and elect the CBLR framework, are exempt from the agencies’ current capital framework, including the risk-based capital requirements and capital conservation buffer, and are deemed well-capitalized under the agencies’ prompt corrective action regulations. Southside Bank has not elected to use the CBLR framework at this time.

Source of Strength. A bank holding company, such as us, is required to act as a source of financial and managerial strength to its subsidiary banks. As a result, a bank holding company may be required to contribute additional capital to its subsidiaries in the form of capital notes or other instruments which qualify as capital under regulatory rules. Any loans from the holding company to its subsidiary banks likely will be unsecured and subordinated to the bank’s depositors and perhaps to other creditors of the bank. In addition to the foregoing requirements, the Federal Reserve and other federal banking regulators are authorized to require a company that directly or indirectly controls a bank to submit reports that are designed both to assess the ability of such company to comply with its source of strength obligations and to enforce the company’s compliance with these obligations. As of December 31, 2023, the Federal Reserve and other federal banking regulators have not issued rules implementing this requirement.

In addition, if a bank holding company enters into bankruptcy or becomes subject to the orderly liquidation process established by the Dodd-Frank Act, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank would be assumed by the bankruptcy trustee or the FDIC, as appropriate, and entitled to a priority of payment. Furthermore, the FDIA provides that any insured depository institution generally will be liable for any loss incurred by the FDIC in connection with the default of, or any assistance provided by the FDIC to, a commonly controlled insured depository institution. Southside Bank is an FDIC-insured depository institution and thus subject to these requirements. See also Bank Regulation - Prompt Corrective Action and Undercapitalization.

Dividends. The principal source of our liquidity at the parent company level is dividends from Southside Bank. Southside Bank is subject to federal and state restrictions on its ability to pay dividends to the Company. We must pay essentially all of our operating expenses from funds we receive from Southside Bank. Therefore, shareholders may receive dividends from us only to the extent that funds are available after payment of our operating expenses. Consistent with its source of strength policy, the Federal Reserve discourages bank holding companies from paying dividends except out of operating earnings and prefers that dividends be paid only if, after the payment, the prospective rate of earnings retention appears consistent with the bank holding company’s capital needs, asset quality and overall financial condition.

The ability of the Company or Southside Bank to pay dividends, and the contents of their respective dividend policies, is subject to changes of law, as well as possible supervisory restrictions imposed by the TDB, FDIC or Federal Reserve. See also Bank Regulation - Dividends for additional information.

Change in Control. Subject to certain exceptions, under the BHCA, the CBCA and the regulations promulgated thereunder, persons who intend to acquire direct or indirect control of a depository institution or a bank holding company are required to obtain the prior approval of the Federal Reserve. With respect to the Company, “control” is conclusively presumed to exist where an acquiring party directly or indirectly owns, controls or has the power to vote at least 25% of our voting securities. Under the Federal Reserve’s CBCA regulations, a rebuttable presumption of control would arise with respect to an acquisition where, after the transaction, the acquiring party owns, controls or has the power to vote at least 10% (but less than

25%) of our voting securities. Under the Federal Reserve’s “Tiered Presumptions” framework, promulgated in 2010, the Federal Reserve will consider the nature and extent of “controlling influences” that exist between a party and a banking organization at different levels of voting security ownership (i.e., between 0% and 4.99%, or between 5% and 9.99%). The Federal Reserve will presume that no control exists when a company owns 9.99% or less of another company, and no other indicators of control exists.

Acquisitions. The BHCA provides that a bank holding company must obtain the prior approval of the Federal Reserve (i) for the acquisition of more than five percent of the voting stock in any bank or bank holding company, (ii) for the acquisition of substantially all the assets of any bank or bank holding company, or (iii) in order to merge or consolidate with another bank holding company.

Regulatory Examination. Federal and state banking agencies require the Company and Southside Bank to prepare annual reports on financial condition and to conduct an annual audit of financial affairs in compliance with minimum standards and procedures. Southside Bank, and in some cases the Company and any nonbank affiliates, must undergo regular on-site examinations by the appropriate regulatory agency, which will examine for adherence to a range of legal and regulatory compliance responsibilities. A bank regulator conducting an examination has complete access to the books and records of the examined institution, and the results of the examination are confidential. The cost of examinations may be assessed against the examined organization as the agency deems necessary or appropriate. The FDIC has developed a method for insured depository institutions to provide supplemental disclosure of the estimated fair value of assets and liabilities, to the extent feasible and practicable, in any balance sheet, financial statement, report of condition or any other report.

Enforcement Authority. The Federal Reserve has broad enforcement powers over bank holding companies and their nonbank subsidiaries, as well as “institution-affiliated parties,” including management, employees, agents, independent contractors and consultants, such as attorneys and accountants and others who participate in the conduct of the institution’s affairs, and has authority to prohibit activities that represent unsafe or unsound banking practices or constitute knowing or reckless violations of laws or regulations. These powers may be exercised through the issuance of cease and desist orders, civil money penalties or other actions. Civil money penalties can be as high as $1,000,000 for each day the activity continues and criminal penalties for some financial institution crimes may include imprisonment for 20 years. Regulators have flexibility to commence enforcement actions against institutions and institution-affiliated parties, and the FDIC has the authority to terminate deposit insurance. When issued by a banking agency, cease and desist and similar orders may, among other things, require affirmative action to correct any harm resulting from a violation or practice, including restitution, reimbursement, indemnifications or guarantees against loss. A financial institution may also be ordered to restrict its growth, dispose of certain assets, rescind agreements or contracts, refrain from declaring or paying dividends, or take other actions determined to be appropriate by the ordering agency. The federal banking agencies also may remove a director or officer from an insured depository institution (or bar them from the industry) if a violation is willful or reckless.

Bank Regulation

Southside Bank is a Texas-chartered commercial bank, the deposits of which are insured up to the applicable limits by the FDIC. Southside Bank is not a member of the Federal Reserve. The Bank is subject to extensive regulation, examination and supervision by the TDB, as its chartering authority, and by the FDIC, as its primary federal regulator and deposit insurer. In addition, the CFPB could participate in examinations of the Bank (as described above) regarding the Bank’s offering of consumer financial products and services. The federal and state laws applicable to banks regulate, among other things, the scope of their activities and investments, lending and deposit-taking activities, borrowings, maintenance of retained earnings and reserve accounts, distribution of earnings and payment of dividends.

Permitted Activities and Investments. Under the FDIA, the activities and investments of state nonmember banks are generally limited to those permissible for national banks, notwithstanding state law. With FDIC approval, a state nonmember bank may engage in activities not permissible for a national bank if the FDIC determines that the activity does not pose a significant risk to the DIF and that the bank meets its minimum capital requirements. Similarly, under Texas law, a state bank may engage in those activities permissible for national banks domiciled in Texas. The TDB may permit a Texas state bank to engage in additional activities so long as the performance of the activity by the bank would not adversely affect the safety and soundness of the bank.

In 2013, federal regulators promulgated the “Volcker Rule” to prohibit insured depository institutions and their affiliates from proprietary trading and acquiring certain interests in hedge or private equity funds. The final rules contain certain exemptions from the prohibition and permit the retention of certain ownership interests. Subsequent amendments to the Volcker Rule exempt from coverage those banks with (i) total consolidated assets equal to $10 billion or less; and (ii) total trading assets and liabilities equal to 5 percent or less of total consolidated assets. Based on this amendment, Southside Bank is exempt from the Volcker Rule’s restrictions and prohibitions.

Brokered Deposits. Southside Bank also may be restricted in its ability to accept, renew or roll over brokered deposits, depending on its capital classification. Subject to certain exceptions, deposits are “brokered” if they are placed at a bank through the intervention of a third party in the business of facilitating the placement of deposits with FDIC-insured banks. Only “well-capitalized” banks are permitted to accept, renew or roll over brokered deposits. The FDIC may, on a case-by-case basis, permit banks that are adequately capitalized to accept brokered deposits if the FDIC determines that acceptance of such deposits would not constitute an unsafe or unsound banking practice with respect to the bank. Undercapitalized banks generally may not accept, renew or roll over brokered deposits. On December 15, 2020, the FDIC approved a final rule, effective April 1, 2021, setting forth a new framework for determining when deposits accepted by an insured depository institution qualify as “brokered deposits.” The new rule also clarifies when a third party may qualify as a “deposit broker,” and identifies several business relationships between banks and third parties that are exempt from the brokered deposit restrictions. Additional guidance was released by the FDIC on July 15, 2022, regarding how banks should treat the placement of deposits by third-parties under “sweep arrangements” with broker-dealers.

Loans to One Borrower. Under Texas law, without the approval of the TDB and subject to certain limited exceptions for loans secured by livestock, stored agricultural products, or readily marketable collateral, the maximum aggregate amount of loans that Southside Bank is permitted to make to any one borrower is 25% of Tier 1 capital. For purposes of applying this limit, loans to one borrower may be combined with loans to another borrower (i) when proceeds of the loan are to be used for the direct benefit of the other borrower, to the extent of the proceeds so used, or (ii) when a “common enterprise” is deemed to exist between the borrowers.

Insider Loans. Under Regulation O of the Federal Reserve, as made applicable to state nonmember banks by section 18(j)(2) of the FDIA, Southside Bank is subject to quantitative restrictions on extensions of credit to its executive officers and directors, the executive officers and directors of the Company, any owner of 10% or more of its stock or the stock of Southside Bancshares, Inc. and certain entities affiliated with any such persons. In general, any such extensions of credit must (i) not exceed certain dollar limitations, (ii) be made on substantially the same terms, including interest rates and collateral, as those prevailing at the time for comparable transactions with third parties and (iii) not involve more than the normal risk of repayment or present other unfavorable features. Additional restrictions are imposed on extensions of credit to executive officers. Certain extensions of credit also require the approval of a bank’s board of directors. On December 22, 2020, the federal banking agencies issued an Interagency Statement clarifying that they will not apply the quantitative and qualitative restrictions of Regulation O to investors in large funds (e.g., mutual funds) that may hold an investment position in banks, and therefore could qualify as an “insider” under current Regulation O definitions. On December 22, 2022, the agencies extended this relief to January 1, 2024, and on December 15, 2023, the agencies extended this relief to January 1, 2025.

Deposit Insurance and Assessments. The deposits of Southside Bank are insured by the FDIC, up to the applicable limits established by law and are subject to the deposit insurance premium assessments of the DIF. By statute, the DRR must be at least 1.35 percent of estimated insured deposits. Based on circumstances related to the COVID-19 pandemic, the DRR dropped below the statutory minimum in 2020, and the FDIC adopted a restoration plan to return the DRR to 1.35 percent by September 30, 2028. To that end, on October 24, 2022, the FDIC adopted a final rule raising the DIF assessment rate on all insured depository institutions, including Southside Bank, by two basis points. This assessment rate became effective January 1, 2023, with the first quarterly assessment due June 30, 2023. As a result of bank failures in March and May 2023, the DRR fell to 1.10 percent as of June 30, 2023. However, the FDIC projected that the reserve ratio will still reach the statutory minimum of 1.35 percent by the statutory deadline of September 30, 2028 as a result of the FDIC’s prior assessment rate adjustment. On November 16, 2023, the FDIC approved a final rule to implement a special assessment to recover the loss to the DIF associated with protecting uninsured depositors following the closures of Silicon Valley Bank and Signature Bank. The special assessment is targeted primarily at larger banks with significant uninsured deposit levels. Specifically, the assessment base for the special assessment is equal to a bank’s estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion. As of December 31, 2022, Southside Bank had less than $5 billion in estimated uninsured deposits.

Capital Adequacy.

See Holding Company Regulation - Capital Adequacy.

Prompt Corrective Action and Undercapitalization. The FDICIA established a system of prompt corrective action to resolve the problems of undercapitalized insured depository institutions. Under this system, the federal banking regulators are required to rate insured depository institutions based on five capital categories as described below. The federal banking regulators are also required to take mandatory supervisory actions and are authorized to take other discretionary actions, with respect to insured depository institutions in the three undercapitalized categories, the severity of which will depend upon the capital category in which the insured depository institution is assigned. Generally, subject to a narrow exception, the FDICIA requires the banking regulator to appoint a receiver or conservator for an insured depository institution that is critically undercapitalized. The federal banking agencies have specified by regulation the relevant capital level for each category.

Under the regulations, all insured depository institutions are assigned to one of the following capital categories:

•Well Capitalized - The insured depository institution exceeds the required minimum level for each relevant capital measure. A well-capitalized insured depository institution is one (1) having a total risk-based capital ratio of 10 percent or greater, (2) having a Tier 1 risk-based capital ratio of 8 percent or greater, (3) having a CET1 capital ratio of 6.5 percent or greater, (4) having a leverage capital ratio of 5 percent or greater and (5) that is not subject to any order or written directive to meet and maintain a specific capital level for any capital measure.

•Adequately Capitalized - The insured depository institution meets the required minimum level for each relevant capital measure. An adequately-capitalized depository institution is one having (1) a total risk based capital ratio of 8 percent or more, (2) a Tier 1 capital ratio of 6 percent or more, (3) a CET1 capital ratio of 4.5 percent or more and (4) a leverage ratio of 4 percent or more.

•Undercapitalized - The insured depository institution fails to meet the required minimum level for any relevant capital measure. An undercapitalized depository institution is one having (1) a total capital ratio of less than 8 percent, (2) a Tier 1 capital ratio of less than 6 percent, (3) a CET1 capital ratio of less than 4.5 percent or (4) a leverage ratio of less than 4 percent.

•Significantly Undercapitalized - The insured depository institution is significantly below the required minimum level for any relevant capital measure. A significantly undercapitalized institution is one having (1) a total risk-based capital ratio of less than 6 percent (2) a Tier 1 capital ratio of less than 4 percent, (3) a CET1 ratio of less than 3 percent or (4) a leverage capital ratio of less than 3 percent.

•Critically Undercapitalized - The insured depository institution fails to meet a critical capital level set by the appropriate federal banking agency. A critically undercapitalized institution is one having a ratio of tangible equity to total assets that is equal to or less than 2 percent.

The prompt corrective action regulations permit the appropriate federal banking regulator to downgrade an institution to the next lower category if the regulator determines after notice and opportunity for hearing or response that (1) the institution is in an unsafe or unsound condition or (2) that the institution has received and not corrected a less-than-satisfactory rating for any of the categories of asset quality, management, earnings or liquidity in its most recent examination. Supervisory actions by the appropriate federal banking regulator depend upon an institution’s classification within the five capital categories. Our management believes that we and our Bank subsidiary have the requisite capital levels to qualify as well-capitalized institutions under the FDICIA regulations.

If an institution fails to remain well capitalized, it will be subject to a variety of enforcement remedies that increase as the capital condition worsens. For instance, the FDICIA generally prohibits a depository institution from making any capital distribution, including payment of a dividend, or paying any management fee to its holding company if the depository institution would thereafter be undercapitalized as a result. Undercapitalized depository institutions are also subject to restrictions on borrowing from the Federal Reserve, may not accept brokered deposits, are subject to growth limitations and are required to submit capital restoration plans for regulatory approval. A depository institution’s holding company must guarantee any required capital restoration plan, up to an amount equal to the lesser of 5 percent of the depository institution’s assets at the time it becomes undercapitalized or the amount of the capital deficiency when the institution fails to comply with the plan. Federal banking agencies may not accept a capital plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the depository institution’s capital. If a depository institution fails to submit an acceptable plan, it is treated as if it is significantly undercapitalized.

Significantly undercapitalized depository institutions may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become adequately capitalized, requirements to reduce total assets and cessation of receipt of deposits from correspondent banks. In addition to the “prompt corrective action” directives, failure to meet capital guidelines may subject a banking organization to a variety of other enforcement remedies, including additional substantial restrictions on its operations and activities, termination of deposit insurance by the FDIC and, under certain conditions, the appointment of a conservator or receiver.

Standards for Safety and Soundness. The FDIA requires the federal banking regulatory agencies to prescribe, by regulation or guideline, operational and managerial standards for all insured depository institutions relating to: (i) internal controls; (ii) information systems and internal audit systems; (iii) loan documentation; (iv) credit underwriting; (v) interest rate risk exposure; and (vi) asset quality. The agencies also must prescribe standards for asset quality, earnings and stock valuation, as well as standards for compensation, fees and benefits. The federal banking agencies have adopted regulations and Guidelines to implement these required standards. The Guidelines set forth the safety and soundness standards that the federal banking agencies use to identify and address problems at insured depository institutions before capital becomes impaired. If the FDIC determines that Southside Bank fails to meet any standards prescribed by the Guidelines, it may require Southside Bank to submit an acceptable plan to achieve compliance, consistent with deadlines for the submission and review of such safety and soundness compliance plans. Notably, in June 2020, the federal financial regulators issued the Interagency Examiner Guidance for Assessing Safety and Soundness Considering the Effect of the COVID-19 Pandemic on Institutions. The guidance directs bank examiners to focus specifically on how challenges created by the COVID-19 pandemic are being addressed by the institution, particularly with respect to credit risk and asset quality.

The Dodd-Frank Act requires federal banking regulators to issue regulations or guidelines to prohibit incentive-based compensation arrangements that encourage inappropriate risk taking by providing excessive compensation or that may lead to material loss at certain financial institutions with $1 billion or more in assets. A joint proposed rule was published in the Federal Register on April 14, 2011, and a second joint proposed rule was published on June 10, 2016; however, as of December 31, 2023, regulators have yet to issue a final rule (or further guidance) on the topic.

In addition, on May 8, 2020, the federal banking regulators published Interagency Guidance on Risk Systems, applicable to all regulated depository institutions regardless of asset size, to be used in creating an appropriate “credit risk review system” consistent with the existing Guidelines. The guidance encourages banks to consider (i) the qualification of the bank’s reviewing personnel; (ii) the frequency, scope and depth of credit reviews; and (iii) appropriate internal distribution of credit review results.

Dividends. All dividends paid by Southside Bank are paid to the Company, as the sole shareholder of Southside Bank. The ability of Southside Bank, as a Texas state bank, to pay dividends is restricted under federal and state law and regulations. The FDICIA and the regulations of the FDIC generally prohibit an insured depository institution from making a capital distribution (including payment of dividend) if, thereafter, the institution would not be at least adequately capitalized. Under Texas law, Southside Bank generally may not pay a dividend reducing its capital and surplus without the prior approval of the Texas Banking Commissioner. All dividends must be paid out of net profits then on hand, after deducting expenses, including losses and provisions for loan losses.

Southside Bank’s general dividend policy is to pay dividends at levels consistent with maintaining liquidity and preserving applicable capital ratios and servicing obligations. Southside Bank’s dividend policies are subject to the discretion of its board of directors and will depend upon such factors as future earnings, financial conditions, cash needs, capital adequacy, compliance with applicable statutory and regulatory requirements and general business conditions. The exact amount of future dividends paid by Southside Bank will be a function of its general profitability (which cannot be accurately estimated or assured), applicable tax rates in effect from year to year and the discretion of its board of directors.

Transactions with Affiliates. Southside Bank is subject to sections 23A and 23B of the FRA and the Federal Reserve’s Regulation W, as made applicable to state nonmember banks by section 18(j) of the FDIA. Sections 23A and 23B of the FRA restrict a bank’s ability to engage in certain transactions with its affiliates. An affiliate of a bank is any company or entity that controls, is controlled by or is under common control with the bank. In a holding company context, the parent bank holding company and any companies controlled by such parent bank holding company are generally affiliates of the bank.

Specifically, section 23A places limits on the amount of “covered transactions” between a bank and its affiliates, including loans or extensions of credit to, investments in or certain other transactions with, affiliates. It also limits the amount of any advances to third parties that are collateralized by the securities or obligations of affiliates. The aggregate of all covered transactions is limited to 10 percent of the bank’s capital and surplus for any one affiliate and 20 percent for all affiliates. Additionally, within the foregoing limitations, each credit transaction with an affiliate must meet specified collateral requirements ranging from 100 to 130 percent of the loan amount, depending on the type of collateral. Further, banks are prohibited from purchasing low quality assets from an affiliate. The definition of “covered transactions” has been broadened to include derivative transactions and the borrowing or lending of securities if the transaction will cause a bank to have credit exposure to an affiliate. The revised definition also includes the acceptance of debt obligations of an affiliate as collateral for a loan or extension of credit to a third party. Furthermore, reverse repurchase transactions are viewed as extensions of credit (instead of asset purchases) and thus become subject to collateral requirements.

Section 23B, among other things, prohibits a bank from engaging in certain transactions with affiliates unless the transactions are on terms substantially the same, or at least as favorable to the bank, as those prevailing at the time for comparable transactions with non-affiliated companies. Except for limitations on low quality asset purchases and transactions that are deemed to be unsafe or unsound, Regulation W generally excludes affiliated depository institutions from treatment as affiliates.

Anti-Tying Regulations. Under the BHCA and the Federal Reserve’s regulations, a bank is prohibited from engaging in certain tying or reciprocity arrangements with its customers. In general, a bank may not extend credit, lease, sell property, or furnish any services or fix or vary the consideration for these products or services on the condition that either: (i) the customer obtain or provide some additional credit, property, or services from or to the bank, the bank holding company or subsidiaries thereof or (ii) the customer not obtain credit, property, or service from a competitor, except to the extent reasonable conditions are imposed to assure the soundness of the credit extended. A bank may, however, offer combined-balance products and may otherwise offer more favorable terms if a customer obtains two or more traditional bank products. Also, certain foreign transactions are exempt from the general rule.

Community Reinvestment Act. Under the CRA, Southside Bank has a continuing and affirmative obligation, consistent with safe and sound banking practices, to help meet the needs of our entire community, including low- and moderate-income neighborhoods. The CRA does not establish specific lending requirements or programs for banks nor does it limit a bank’s discretion to develop the types of products and services that it believes are best suited to its particular community.

On a periodic basis, the FDIC is charged with preparing a written evaluation of our record of meeting the credit needs of the entire community and assigning a rating - outstanding, satisfactory, needs to improve or substantial noncompliance. Banks are rated based on their actual performance in meeting community credit needs. The FDIC will take that rating into account in its evaluation of any application made by the bank for, among other things, approval of the acquisition or establishment of a branch or other deposit facility, an office relocation, a merger or the acquisition of shares of capital stock of another financial institution. A bank’s CRA rating may be used as the basis to deny or condition an application. In addition, as discussed above, a bank holding company may not become a financial holding company unless each of its subsidiary banks has a CRA rating of at least “satisfactory.” As of September 7, 2021, the most recent exam date, Southside Bank has a CRA rating of “outstanding.”

On October 24, 2023, the federal banking agencies jointly issued a final rule modernizing and overhauling the prior CRA regulations. Key elements of the final rule include (i) encouragement of expanded access to credit, investment, and basic banking services in low- and moderate-income communities; (ii) updated CRA assessment areas by including activities associated with online and mobile banking, branchless banking, and hybrid models; (iii) greater clarity and consistency in the application of CRA regulations; and (iv) better tailoring CRA evaluations and data collection requirements by bank size and type. Most of the final rule’s requirements will be applicable beginning January 1, 2026. The remaining requirements, including new data reporting requirements, will be applicable on January 1, 2027.

Branch Banking. Pursuant to the Texas Finance Code, all banks located in Texas are authorized to branch statewide. Accordingly, a bank located anywhere in Texas has the ability, subject to regulatory approval, to establish branch facilities near any of our facilities and within our market area. Similarly, under applicable Federal law, out-of-state banks are permitted to establish branches in Texas. If other banks were to establish branch facilities near our facilities, it is uncertain whether these branch facilities would have a material adverse effect on our business.

De novo interstate branching by Southside Bank is also subject to the Federal interstate branching rules. All branching in which Southside Bank may engage remains subject to regulatory approval and adherence to applicable legal and regulatory requirements.

Consumer Protection Regulation. The activities of Southside Bank are subject to a variety of statutes and regulations designed to protect consumers. Interest and other charges collected or contracted for by banks are subject to state usury laws and federal laws concerning interest rates. Loan operations are also subject to federal laws and regulations applicable to credit transactions, such as:

•the Truth in Lending Act and Regulation Z, governing disclosures of credit terms to consumer borrowers;

•the Home Mortgage Disclosure Act and Regulation C, requiring financial institutions to provide information to enable the public and public officials to determine whether a financial institution is fulfilling its obligation to help meet the housing needs of the community it serves;

•the Equal Credit Opportunity Act and Regulation B, prohibiting discrimination on the basis of race, creed or other prohibited factors in extending credit;

•the Fair Credit Reporting Act and Regulation V, governing the use and provision of information to consumer reporting agencies;

•the Fair Debt Collection Act, governing the manner in which consumer debts may be collected by collection agencies; and

•the guidance of the various federal agencies charged with the responsibility of implementing such federal laws.

Deposit and other operations also are subject to:

•the Truth in Savings Act and Regulation DD, governing disclosure of deposit account terms to consumers;

•the Right to Financial Privacy Act, which imposes a duty to maintain confidentiality of consumer financial records and prescribes procedures for complying with administrative subpoenas of financial records; and

•the Electronic Fund Transfer Act and Regulation E, which governs automatic deposits to and withdrawals from deposit accounts and customers’ rights and liabilities arising from the use of ATMs and other electronic banking services, which the CFPB has expanded to include a new compliance regime that governs consumer-initiated cross border electronic transfers.

The foregoing laws and regulations are amended periodically. Notably, several were changed as a direct result of the COVID-19 pandemic. For example, during the pandemic, the CFPB was particularly active and adopted several amendments to Regulation Z. These included: (i) an interpretive rule clarifying that consumers can waive required waiting periods under TILA/RESPA, and Regulation Z rescission rules, so as to enable consumers to obtain mortgage credit more quickly; (ii) amending the definition of “qualified mortgage loan” to expand the number of mortgage loans that will be exempted from the “ability to repay” consideration; and (iii) amending the asset-size threshold for purposes of determining when a creditor can be exempted from the requirement to establish an escrow account for higher-price mortgages. The CFPB also issued a “COVID-19 Mortgage Servicing Rule” on June 28, 2021, affording borrowers greater procedural safeguards designed to limit situations in which a servicer can initiate foreclosures. While most of these protections expired in 2022, on January 18, 2023, in its revised Mortgage Servicing Examination Procedures, the CFPB stated it expected servicers to continue to utilize these safeguards, regardless of their expiration.

We cannot predict the extent to which new or modified regulations focused on consumer financial protection, whether adopted by the TDB, the CFPB, or the federal banking agencies will have on our businesses. We are particularly unable to predict a resurgence of COVID-19 (or the emergence of a similar pandemic), its long term impact on the Company, Southside Bank, or its customers, or whether the federal or state legislatures, federal banking agencies, or the TDB will adopt new laws intended to provide relief to borrowers adversely affected by the pandemic. Any such new laws may materially adversely affect our business, financial condition or results of operations.

Commercial Real Estate Lending. Lending operations that involve a significant concentration of commercial real estate loans are subject to enhanced scrutiny by federal banking regulators. The regulators have issued guidance with respect to the risks posed by CRE lending concentrations. CRE loans generally include land development, construction loans, land and lot loans to individuals, loans secured by multi-family property and nonfarm nonresidential real property where the primary source of repayment is derived from rental income associated with the property. The guidance prescribes the following guidelines for examiners to help identify institutions that are potentially exposed to concentration risk and may warrant greater supervisory scrutiny:

•total reported loans for construction, land development and other land represent 100 percent or more of the institution’s total capital, or

•total CRE loans represent 300 percent or more of the institution’s total capital and the outstanding balance of the institution’s CRE loan portfolio has increased by 50 percent or more during the prior 36 months.

In addition, Federal regulations requiring risk retention of assets may impact our business by reducing the amount of our CRE lending and increasing the cost of borrowing. A loan originator or a securitizer of asset-backed securities is required to retain a percentage of the credit risk of securitized assets. On June 29, 2023, in response to the increased risks on CRE loans created by the COVID-19 pandemic, the federal banking agencies issued an Interagency Policy Statement on prudent CRE Loan Accommodations and Workouts. On December 18, 2023, the FDIC issued an advisory on Managing Commercial Real Estate Concentrations in a Challenging Economic Environment.

Anti-Money Laundering. Southside Bank is subject to the regulations of the FinCEN, a bureau of the U.S. Department of the Treasury, which implements the Bank Secrecy Act, as amended by the USA PATRIOT Act and the Anti-Money Laundering Act of 2020. The USA PATRIOT Act gives the federal government the power to address terrorist threats through enhanced domestic security measures, expanded surveillance powers, increased information sharing and broadened anti-money laundering requirements. Title III of the USA PATRIOT Act includes measures intended to encourage information sharing among banks, regulatory agencies and law enforcement bodies. Further, certain provisions of Title III impose affirmative obligations on a broad range of financial institutions, including state-chartered banks like Southside Bank. Most recently, the Anti-Money Laundering Act of 2020 expanded the coverage of the Bank Secrecy Act to include new categories of “financial institutions,” expanding the types of monetary transactions that must be monitored and reported, and increasing the enforcement authority of the U.S. Department of Justice with respect to federal anti-money laundering laws.

The Bank Secrecy Act, USA PATRIOT Act, and Anti-Money Laundering Act of 2020, along with the related FinCEN regulations, impose numerous requirements with respect to financial institution operations, including the following:

•establishment of AML programs, including adoption of written procedures and an ongoing employee training program, designation of a compliance officer and auditing of the program;

•establishment of a program specifying procedures for obtaining information from customers seeking to open new accounts, including verifying the identity of customers within a reasonable period of time;

•establishment of enhanced due diligence policies, procedures and controls designed to detect and report money laundering, for financial institutions that administer, maintain or manage private bank accounts or correspondent accounts for non-U.S. persons;

•prohibitions on correspondent accounts for foreign shell banks and compliance with recordkeeping obligations with respect to correspondent accounts of foreign banks;

•filing of suspicious activities reports if a bank believes a customer may be violating U.S. laws and regulations; and

•requirements that bank regulators consider bank holding and bank compliance with federal anti-money laundering laws in connection with proposed merger or acquisition transactions.

In addition, under applicable FinCEN regulations, covered financial institutions, subject to certain exclusions and exemptions, are required to identify and verify the identity of beneficial owners of legal entity customers. On August 13, 2020, the federal banking agencies issued a joint statement addressing the circumstances under which an agency will issue a mandatory “cease-and-desist” order to a regulated financial institution for failure to comply with its AML obligations, emphasizing that the “effectiveness” of a bank’s AML program will be the key factor in the agency's decision. On June 30, 2021, FinCEN published the first set of “national AML priorities,” as required by the Bank Secrecy Act, which include, but are not limited to, cybercrime, terrorist financing, fraud, and drug/human trafficking. FinCEN is required to implement regulations to specify how covered financial institutions, such as Southside Bank, should incorporate these national priorities into their AML programs. As of December 31, 2023, no such regulations have been proposed.

The Corporate Transparency Act was enacted in 2021, and FinCEN regulations promulgating the Act’s requirements became effective on January 1, 2024. The regulations will require certain entities created or registered to do business in the United States to disclose personal information about their beneficial owners, senior officers and other control persons to the federal government. The Corporate Transparency Act requires FinCEN to promulgate rules to revise financial institutions’ customer due diligence obligations to bring them into conformity with the new beneficial ownership requirements. FinCEN has not yet proposed this rule, but it must finalize the new rule by January 1, 2025.

Bank regulators routinely examine institutions for compliance with anti-money laundering obligations and have been active in imposing cease and desist and other regulatory orders, and money penalty sanctions, against institutions found to be violating these obligations. In addition, the Federal Bureau of Investigation can send bank regulatory agencies lists of the names of persons suspected of involvement in terrorist activities. Southside Bank can be requested to search its records for any relationships or transactions with persons on those lists and be required to report any identified relationships or transactions.

OFAC. OFAC is responsible for helping to ensure that U.S. entities, including banks, do not engage in transactions with certain prohibited parties, as defined by various Executive Orders and Acts of Congress. OFAC publishes, and routinely updates, lists of names of persons and organizations suspected of aiding, harboring or engaging in terrorist acts, including the Specially Designated Nationals List. If we find a name on any transaction, account or wire transfer that is on an OFAC list, we must undertake certain specified activities, which could include blocking or freezing the account or transaction requested, and we must notify the appropriate authorities.

Privacy and Data Security; Cybersecurity. Under federal law, financial institutions are generally prohibited from disclosing consumer nonpublic personal information to non-affiliated third parties unless the consumer has been given the opportunity to object and has not objected to such disclosure. Financial institutions are further required, subject to certain exceptions, to disclose their privacy policies to customers annually. Generally, Southside Bank must disclose its privacy policy for collecting and protecting NPI to consumers, permit consumers to “opt out” of having NPI disclosed to non-affiliated third parties, with some exceptions, and allow consumers to opt out of receiving marketing solicitations based on information about the consumer received from another affiliate. Many states have also recently implemented or modified their data privacy laws and some may apply to financial institutions. For example, in California, the California Privacy Rights Act became effective on January 1, 2023, and provides new protections for those Southside Bank customers who reside in that state.

In addition, federal and state banking agencies have prescribed standards for maintaining the security and confidentiality of consumer information, to which Southside Bank is subject. Pursuant to these standards, Southside Bank is required to have an information security program to safeguard the confidentiality and security of customer information and to ensure proper disposal. Southside Bank is also subject to state and federal laws for notifying individuals and regulators in the event of a security breach affecting their personal information. Under federal law, customers must be notified when a financial institution becomes aware of unauthorized access of sensitive customer information and misuse has occurred or is reasonably possible.

More broadly, on November 23, 2021, the federal banking regulators imposed a new cybersecurity-related notification rule that would require banking organizations, including the Company and Southside Bank, to notify their primary federal regulator as soon as possible (but within 36 hours) of incidents that have materially disrupted or degraded, or are reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. The rule also imposes requirements on bank service providers to notify their affected banking organization customers of certain computer-security incidents. This rule became effective on April 1, 2022. At the state level, as of January 2, 2020, Texas state banks are required to notify the TDB of “cybersecurity incidents” within specified timeframes.

Regulatory Examination.

See Holding Company Regulation - Regulatory Examination.

Enforcement Authority. Southside Bank and its “institution-affiliated parties,” including management, employees, agents, independent contractors and consultants, such as attorneys and accountants and others who participate in the conduct of the institution’s affairs, are subject to potential civil and criminal penalties for violations of law, regulations or written orders of a government agency. Violations can include failure to timely file required reports, filing false or misleading information or submitting inaccurate reports. Civil penalties may be as high as $1,000,000 a day for such violations, and criminal penalties for some financial institution crimes may include imprisonment for 20 years. Regulators have flexibility to commence enforcement actions against institutions and institution-affiliated parties, and the FDIC has the authority to terminate deposit insurance. When issued by a banking agency, cease and desist orders may, among other things, require affirmative action to correct any harm resulting from a violation or practice, including restitution, reimbursement, indemnifications or guarantees against loss. A financial institution may also be ordered to restrict its growth, dispose of certain assets, rescind agreements or contracts, or take other actions determined to be appropriate by the ordering agency. The federal banking agencies also may remove a director or officer from an insured depository institution (or bar them from the industry) if a violation is willful or reckless.

Governmental Monetary Policies. The commercial banking business is affected not only by general economic conditions but also by the monetary policies of the Federal Reserve. Changes in the discount rate on member bank borrowings, control of borrowings, open market operations, the imposition of and changes in reserve requirements against member banks, deposits and assets of foreign branches, the imposition of and changes in reserve requirements against certain borrowings by banks and their affiliates and the placing of limits on interest rates which member banks may pay on time and savings deposits are some of the instruments of monetary policy available to the Federal Reserve. These monetary policies influence to a significant extent the overall growth of all bank loans, investments and deposits and the interest rates charged on loans or paid on time and savings deposits. The nature of future monetary policies and the effect of such policies on Southside Bank’s future business and earnings, therefore, cannot be predicted accurately.

Other Regulatory Matters. The Company and its affiliates are subject to oversight by the SEC, the NASDAQ Stock Market, various state securities regulators and other regulatory authorities. The Company and its subsidiaries have from time to time received requests for information from regulatory authorities in various states, including state attorneys general, securities regulators and other regulatory authorities, concerning their business practices. Such requests are considered incidental to the normal conduct of business.