SOUTHSIDE BANCSHARES INC

IMPORTANT INFORMATION ABOUT THIS REPORT

In this report, the words “the Company,” “we,” “us,” and “our” refer to the combined entities of Southside Bancshares, Inc. and its subsidiaries, including Southside Bank. The words “Southside” and “Southside Bancshares” refer to Southside Bancshares, Inc. The words “Southside Bank” and “the Bank” refer to Southside Bank.

PART I

ITEM 1. BUSINESS

FORWARD-LOOKING INFORMATION

The disclosures set forth in this item are qualified by the section captioned “Cautionary Notice Regarding Forward-Looking Statements” in “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations” of this Annual Report on Form 10-K and other cautionary statements set forth elsewhere in this report.

GENERAL

Southside Bancshares, Inc., incorporated in Texas in 1982, is a bank holding company for Southside Bank, a Texas state bank headquartered in Tyler, Texas that was formed in 1960. We operate through 53 branches, 12 of which are located in grocery stores, in addition to wealth management and trust services, and/or loan production, brokerage or other financial services offices.

At December 31, 2024, our total assets were $8.52 billion, total loans were $4.66 billion, total deposits were $6.65 billion and total equity was $811.9 million. For the years ended December 31, 2024 and 2023, our net income was $88.5 million and $86.7 million, respectively. For the years ended December 31, 2024 and 2023, diluted earnings per common share was $2.91 and $2.82, respectively. We have paid a cash dividend to shareholders every year since 1970 (including dividends paid by Southside Bank prior to the incorporation of Southside Bancshares).

We are a community-focused financial institution that offers a full range of financial services to individuals, businesses, municipal entities and nonprofit organizations in the communities that we serve. These services include consumer and commercial loans, deposit accounts, wealth management, trust and brokerage services.

Our consumer loan services include 1-4 family residential loans, home equity loans, home improvement loans, automobile loans and other consumer related loans. Commercial loan services include short-term working capital loans for inventory and accounts receivable, short- and medium-term loans for equipment or other business capital expansion, commercial real estate loans and municipal loans. We also offer construction loans for 1-4 family residential and commercial real estate.

We offer a variety of deposit accounts with a wide range of interest rates and terms, including savings, money market, interest and noninterest bearing checking accounts and CDs.

Our trust and wealth management services include investment management, administration of irrevocable, revocable and testamentary trusts, estate administration, and custodian services, primarily for individuals and, to a lesser extent, partnerships and corporations. Additionally, we offer retirement and employee benefit accounts, including but not limited to, IRAs, 401(k) plans and profit-sharing plans. At December 31, 2024, our wealth management and trust assets under management were approximately $1.44 billion.

Our business strategy includes evaluating expansion opportunities through acquisitions of financial institutions in market areas that could complement our existing franchise. We generally seek merger partners that are culturally similar, have experienced management teams and possess either significant market presence or have potential for improved profitability through financial management, economies of scale or expanded services.

We and our subsidiaries are subject to comprehensive regulation, examination and supervision by the SEC, the Federal Reserve, the TDB and the FDIC and are subject to numerous laws and regulations relating to internal controls, the extension of credit, making of loans to individuals, deposits and all other facets of our operations.

Our primary executive offices are located at 1201 South Beckham Avenue, Tyler, Texas 75701 and our telephone number is 903-531-7111. Our website can be found atwww.southside.com. Our public filings with the SEC may be obtained free of charge on either our website, https://investors.southside.com/ under the topic Financials, or the SEC’s website, www.sec.gov, as soon as reasonably practicable after filing with the SEC. We include our website address throughout the filing only as textual references. The information contained on our website is not incorporated in this document by reference.

MARKET AREA

We are headquartered in Tyler, Texas. The Tyler metropolitan area has an estimated population of 245,000 and is located approximately 90 miles east of Dallas, Texas and 90 miles west of Shreveport, Louisiana.

We consider our primary market areas to be East Texas, Southeast Texas, as well as the greater Dallas-Fort Worth, Austin and Houston, Texas areas. Our expectation is that our presence in all of the market areas we serve should grow in the future. In addition, we continue to explore new markets in which we believe we can successfully expand.

The principal economic activities in our market areas include medical services, retail, education, financial services, technology, distribution, manufacturing, government and to a lesser extent, oil and gas industries. These economic activities support a growing regional system of medical service, retail and education centers. Tyler, Dallas-Fort Worth, Austin and Houston are home to several nationally recognized health care systems that represent all major specialties.

Our 53 branches and 37 drive-thru facilities are located in and around Arlington, Austin, Bullard, Chandler, Cleburne, Cleveland, Dallas, Diboll, Euless, Fort Worth, Frisco, Granbury, Grapevine, Gresham, Gun Barrel City, Hawkins, Hemphill, Houston, Irving, Jacksonville, Jasper, Lindale, Longview, Lufkin, Nacogdoches, Palestine, Pineland, San Augustine, Splendora, The Woodlands, Tyler, Watauga, Weatherford and Whitehouse. Our advertising is designed to target the market areas we serve. The type and amount of advertising in each location is determined based on our market share in that area, combined with overall cost by market.

Additionally, our customers may access various banking services through a wide network of ATMs, ITMs, automated telephone, internet and mobile banking products. Customers can apply for loans, open deposit accounts, access account information and conduct various other transactions online from their smart phones or computers.

RECENT DEVELOPMENTS

During the year ended December 31, 2024, we closed a traditional branch location in Jasper due to close proximity to another Southside Bank branch, and a grocery store branch location in Kingwood. During 2024, we also opened loan production offices in Dallas, Texas and The Woodlands, Texas.

THE BANKING INDUSTRY IN TEXAS

The banking industry is affected by general economic conditions such as interest rates, inflation, recession, unemployment and other factors beyond our control. During the last 30 years the Texas economy has continued to diversify, decreasing the overall impact of fluctuations in oil and gas prices; however, the oil and gas industry is still a significant component of the Texas economy. The economic conditions and growth prospects for our markets continue to reflect a solid and positive overall outlook. Higher inflation levels and elevated interest rates could have a negative impact on both our consumer and commercial borrowers. Currently, the Texas markets we serve continue to remain healthy due to both job and population growth.

COMPETITION

The activities we are engaged in are highly competitive. Financial institutions such as credit unions, fintech companies, consumer finance companies, insurance companies, brokerage companies and other financial institutions with varying degrees of regulatory restrictions compete vigorously for a share of the financial services market. Fintech, brokerage and insurance companies continue to become more competitive in the financial services arena and pose an ever-increasing challenge to banks. Legislative changes also greatly affect the level of competition we face. Federal legislation allows credit unions to use their expanded membership capabilities, combined with tax-free status, to compete more openly for traditional bank business. The tax-free status granted to credit unions provides them with a significant competitive advantage. Many of the largest banks operating in Texas, including some of the largest banks in the country, have offices in our market areas with capital resources, broader geographic markets and legal lending limits substantially in excess of those available to us. We face competition from institutions that offer products and services we do not or cannot currently offer. Some institutions we compete with offer interest rate levels on loan and deposit products that we are unwilling to offer due to interest rate risk and overall profitability concerns. We expect the level of competition in the financial services market to continue to increase.

HUMAN CAPITAL RESOURCES

At December 31, 2024, we employed approximately 778 full time equivalent persons. None of our employees are represented by any unions or similar groups. We consider the relationship with our employees to be good, which we believe to be reflected in the average tenure of our employees exceeding eight years, with the tenure of 33% of our employees exceeding ten years. As of December 31, 2024, women and ethnic minorities represented approximately 69% and 40% of our workforce, respectively.

During 2024, Southside was awarded “Best Banks to Work For” by American Banker for the third consecutive year and “Best Companies to Work For in Fort Worth” for the second consecutive year. These awards identify organizations that excel at creating positive and supportive workplaces for employees. We continuously work toward an outstanding workplace with competitive benefits for employees through our initiatives outlined below.

The health, safety and wellness of our employees is a top priority. In 2024, we continued to focus on the health and wellness of our employees through several company-wide efforts including: a wellness program that allows employees to earn cash rewards; a wellness challenge to encourage healthy habits; as well as wellness communications and webinars throughout the year. We maintain a comprehensive employee handbook, code of business conduct, as well as other policies, including a harassment policy, whistleblower policy and a human rights policy statement, to promote a safe and supportive workplace culture.

We believe employees to be our greatest asset and that our future success depends on our ability to attract, retain and develop employees. Professional development is a key priority, which is facilitated through our many corporate initiatives including extensive training programs, corporate mentoring, leadership programs, educational reimbursement and corporate and personal development coaching. We recognize and award employees through several different initiatives centered around service to Southside and initiatives that will impact their communities.

Effective communication is critical to supporting our employees and is carried out through our weekly newsletters, executive announcements, quarterly Town Hall meetings and our intranet.

As part of our effort to attract and retain employees, we offer a broad range of benefits, including, but not limited to, 15-30 days of annual paid time off based on length of employment, sick leave, participation in our ESOP, 401(k) match for eligible employees and up to 20 hours of paid time off annually to volunteer. We believe our compensation packages and benefits are competitive with others in our industry. For additional information regarding our employee benefit plans, see “Note 10 - Employee Benefits” to our consolidated financial statements included in this report.

SUPERVISION AND REGULATION

General

Banking is a complex, highly regulated industry. As a bank holding company under federal law, the Company is subject to regulation, supervision and examination by the Federal Reserve. In addition, under state law, as the parent company of a Texas-chartered state bank that is not a member of the Federal Reserve, the Company is subject to supervision and examination by the TDB. As a Texas-chartered state bank, Southside Bank is subject to regulation, supervision and examination by the TDB, as its chartering authority, and by the FDIC, as its primary federal regulator and deposit insurer. This system of regulation and supervision provides a comprehensive legal framework for our operations and is intended primarily for the protection of bank depositors, the FDIC’s DIF and the public, rather than our shareholders and creditors.

In addition to the system of regulation and supervision outlined above, the CFPB has authority to supervise and examine depository institutions with more than $10 billion in assets for compliance with these federal consumer laws. The CFPB also has rulemaking authority for a range of consumer financial protection laws (such as TILA, the Electronic Fund Transfer Act and RESPA, among others). The authority to supervise and examine depository institutions with $10 billion or less in assets (such as Southside Bank) for compliance with federal consumer laws remains largely with those institutions’ primary regulators. However, the CFPB may participate in examinations of these smaller institutions on a “sampling basis” and may refer potential enforcement actions against such institutions to their primary regulators. Accordingly, the CFPB may participate in examinations of Southside Bank, and could supervise and examine other direct or indirect subsidiaries of the Company that offer consumer financial products or services. On February 9, 2025, the presidential administration ordered the CFPB to halt substantially all of its operations. The next day, dozens of CFPB employees were terminated. However, the administration has agreed to temporarily pause its actions pending lawsuits in response to the employment terminations. At this time, the scope and continued existence of the CFPB remain unknown.

The earnings of Southside Bank and, therefore, the earnings of the Company, are affected by general economic conditions, changes in federal and state laws and regulations and actions of various regulatory authorities, including those referenced above.

Significant changes to federal and state laws, changes in the interpretation or application of such laws by regulators, and/or the enactment of new legislation or adoption of new regulations could (i) materially impact the profitability of our business, the value of assets we hold, or the value of collateral available for our loans; (ii) require changes to our business practices; (iii) force us to discontinue certain business lines; and/or (iv) otherwise expose us to additional costs, taxes, liabilities, enforcement actions and reputational risk. The likelihood, timing and scope of any such change of law, and the impact that any such change may have on us, are impossible to determine with any certainty. However, a change in Presidential administration, as occurred January 20, 2025, increases the likelihood of such changes. In particular, the Trump administration has signaled in its first weeks that it will continue to focus on the level of government oversight of financial institutions.

Set forth below are brief descriptions of the significant federal and state laws and regulations to which we are currently subject. These descriptions do not purport to be complete and are qualified in their entirety by reference to the particular statutory or regulatory provisions.

Holding Company Regulation

As a bank holding company regulated under the BHCA, as amended, the Company is registered with and subject to regulation, supervision and examination by the Federal Reserve. The Company is required to file annual and other reports with, and furnish information to, the Federal Reserve, which makes periodic inspections of the Company. The Federal Reserve may also examine our nonbank subsidiaries.

Permitted Activities. Under the BHCA, a bank holding company is limited to managing or controlling banks, furnishing services to or performing services for our subsidiaries, and engaging in other activities that the Federal Reserve determines by regulation or order to be the business of banking, managing, or controlling banks, furnishing services to or performing services for its subsidiaries and certain other activities determined by the Federal Reserve to be closely related to banking. In determining whether a particular activity is permissible, the Federal Reserve must consider whether the performance of such an activity reasonably can be expected to produce benefits to the public that outweigh possible adverse effects. Possible benefits include greater convenience, increased competition, and gains in efficiency. Possible adverse effects include undue concentration of resources, decreased or unfair competition, conflicts of interest and unsound banking practices. Examples of activities the Federal Reserve has previously determined are closely related to banking include:

◦factoring accounts receivable;

◦making, acquiring, brokering or servicing loans and usual related activities;

◦leasing personal or real property;

◦operating a nonbank depository institution, such as a savings association;

◦performing trust company functions;

◦conducting financial and investment advisory activities;

◦conducting discount securities brokerage activities;

◦underwriting and dealing in government obligations and money market instruments;

◦providing specified management consulting and counseling activities;

◦performing selected data processing services and support services;

◦acting as agent or broker in selling credit life insurance and other types of insurance in connection with credit transactions;

◦performing selected insurance underwriting activities;

◦providing certain community development activities (such as making investments in projects designed primarily to promote community welfare); and

◦issuing and selling money orders and similar consumer-type payment instruments.

The Federal Reserve has the authority to order a bank holding company or its subsidiaries to terminate any of these activities or to terminate its ownership or control of any subsidiary when the Federal Reserve has reasonable cause to believe that the bank holding company’s continued ownership, activity or control constitutes a serious risk to the financial safety, soundness or stability of it or any of its bank subsidiaries.

Under the BHCA, a bank holding company meeting certain eligibility requirements may elect to become a “financial holding company.” A financial holding company and companies under its control may engage in activities that are “financial in nature,” as defined by the GLBA and Federal Reserve interpretations, and therefore may engage in a broader range of activities than those permitted for bank holding companies and their subsidiaries. Financial activities include insurance brokerage and underwriting, securities underwriting and dealing, merchant banking, investment advisory and lending activities. Financial holding companies and their subsidiaries also may engage in additional activities that are determined by the Federal Reserve, in consultation with the U.S. Department of the Treasury, to be “financial in nature or incidental to” a financial activity or are determined by the Federal Reserve unilaterally to be “complementary” to financial activities.

The Company has elected to become a financial holding company. Our election was declared effective based in part upon a finding by the Federal Reserve that all of our depository institution subsidiaries satisfy the Federal Reserve’s “well capitalized” and “well managed” standards and have at least a satisfactory rating under the CRA. We do not currently engage in financial activities beyond those permissible for a bank holding company. However, if we undertake expanded financial activities (i.e., those that are not permissible for a bank holding company) and we subsequently fail to continue to meet any of the prerequisites for “financial holding company” status, including those described above, we would be required to enter into an agreement with the Federal Reserve to restore our compliance with all applicable requirements, including specifically the “well-capitalized” and “well-managed” standards. If we do not return to compliance within 180 days of such an agreement, the Federal Reserve may order the Company to divest its Bank, or the Company may discontinue (or divest investments in companies engaged in) those expanded activities that are only permissible for financial holding companies.

Capital Adequacy. Each of the federal banking agencies, including the Federal Reserve and the FDIC, has issued substantially similar risk-based and minimum leverage capital guidelines applicable to the banking organizations they supervise.

Under existing capital standards, a banking organization is required to continually monitor the ratio of its assets against its capital so as to gauge its ability to absorb unexpected losses in an economic downturn. The federal banking agencies may determine that a banking organization based on its size, complexity, or risk profile must maintain a higher level of capital in order to operate in a safe and sound manner. Risks such as concentration of credit risks and the risk arising from nontraditional activities, as well as the institution’s exposure to a decline in the economic value of its capital due to changes in interest rates, and an institution’s ability to manage those risks, are important factors in assessing an institution’s overall capital adequacy. The following is a brief description of the relevant provisions of these capital rules and their potential impact on our capital levels.

The Company and the Bank are subject to the following risk-based capital ratios: a Common Equity Tier 1 risk-based capital ratio, a Tier 1 risk-based capital ratio, which includes CET1 and additional Tier 1 capital, and a total risk-based capital ratio, which includes Tier 1 and Tier 2 capital. CET1 is primarily comprised of the sum of common stock instruments and related surplus net of treasury stock plus retained earnings less certain adjustments and deductions, including with respect to goodwill, intangible assets, mortgage servicing assets, and deferred tax assets subject to temporary timing differences. Additional Tier 1 capital is primarily comprised of noncumulative perpetual preferred stock. Tier 2 capital consists of instruments disqualified from Tier 1 capital, including qualifying subordinated debt and a limited amount of loan loss reserves up to a maximum of 1.25% of risk-weighted assets, subject to certain eligibility criteria. The capital rules also define the risk-weights assigned to assets and off-balance sheet items to determine the risk-weighted asset components of the risk-based capital rules, including, for example, certain “high volatility” commercial real estate, past due assets, structured securities, and equity holdings.

The leverage capital ratio, which serves as a minimum capital standard, is the ratio of Tier 1 capital to quarterly average total consolidated assets, net of goodwill, certain other intangible assets, and certain required deduction items. The required minimum leverage ratio for all banks and bank holding companies is 4%.

In addition, the capital rules required a “capital conservation buffer” of 2.5% above each of the minimum risk-based capital ratio requirements (CET1, Tier 1, and total capital), which is designed to absorb losses during periods of economic stress. These buffer requirements must be met for a bank or bank holding company to be able to pay dividends, engage in share buybacks, or make discretionary bonus payments to executive management without restriction. The capital rules provide for a number of deductions from and adjustments to CET1, which include the requirement that mortgage servicing rights, deferred tax assets arising from temporary differences that could not be realized through net operating loss carrybacks and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1 .

In addition to the minimum leverage ratio and the capital conversion buffer discussed above, the Company and the Bank are also subject to the following minimum capital ratios: 4.5% CET1 capital to risk-weighted assets; 6% Tier 1 capital to risk-weighted assets; and 8% total capital to risk-weighted assets.

The Federal Deposit Insurance Corporation Improvement Act of 1991, among other things, requires the federal bank regulatory agencies to take “prompt corrective action” regarding depository institutions that do not meet minimum capital requirements. The FDICIA establishes five regulatory capital tiers: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” A depository institution’s capital tier will depend upon how its capital levels compare to various relevant capital measures and certain other factors, as established by regulation. The FDICIA generally prohibits a depository institution from making any capital distribution (including payment of a dividend) or paying any management fee to its holding company if the depository institution would thereafter be undercapitalized. The FDICIA imposes progressively more restrictive restraints on operations, management, and capital distributions depending on the category in which an institution is classified. Undercapitalized depository institutions are subject to restrictions on borrowing from the Federal Reserve. In addition, undercapitalized depository institutions may not accept brokered deposits absent a waiver from the FDIC, are subject to growth limitations, and are required to submit capital restoration plans for regulatory approval. A depository institution's holding company must guarantee any required capital restoration plan up to an amount equal to the lesser of 5 percent of the depository institution's assets at the time it becomes undercapitalized or the amount of the capital deficiency when the institution fails to comply with the plan. Federal banking agencies may not accept a capital plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the depository institution's capital. If a depository institution fails to submit an acceptable plan, it is treated as if it is significantly undercapitalized.

To be well-capitalized, the Bank must maintain at least the following capital ratios:

• 6.5% CET1 to risk-weighted assets;

• 8% Tier 1 capital to risk-weighted assets;

• 10% Total capital to risk-weighted assets; and

• 5% leverage ratio.

The Federal Reserve has not yet revised the well-capitalized standard for bank holding companies to reflect the higher capital requirements imposed under the current capital rules applicable to banks. For purposes of the Federal Reserve’s Regulation Y, including determining whether a bank holding company meets the requirements to be a financial holding company, bank holding companies, such as the Company, must maintain a Tier 1 risk-based capital ratio of 6% or greater and a total risk-based capital ratio of 10% or greater to be well-capitalized. Also, the Federal Reserve may require bank holding companies, including the Company, to maintain capital ratios substantially in excess of mandated minimum levels depending upon general economic conditions and a bank holding company’s particular condition, risk profile, and growth plans.

Failure to be well-capitalized or to meet minimum capital requirements could result in certain mandatory and possible additional discretionary actions by regulators that, if undertaken, could have an adverse material effect on our operations or financial condition. Failure to meet minimum capital requirements could also result in restrictions on the Company’s or the

Bank’s ability to pay dividends or otherwise distribute capital or to receive regulatory approval of applications or other restrictions on its growth.

In 2024, the Company’s and the Bank’s regulatory capital ratios were above the applicable well-capitalized standards and met the capital conservation buffer. Based on current estimates, we believe that the Company and the Bank will continue to exceed all applicable well-capitalized regulatory capital requirements and the capital conservation buffer in 2025.

Certain regulatory capital ratios of the Company and Southside Bank, as of December 31, 2024, are shown in the following table.

On March 27, 2020, the federal bank agencies announced a final rule that permits banks that have adopted the CECL standard to defer recognition of the estimated impact of credit losses on regulatory capital by permitting a three-year “phase-in” approach commencing in 2022. We elected to adopt the transition option.

Eligible community banks and holding companies with less than $10 billion in consolidated assets may opt into the CBLR framework. A “qualifying community banking organization” is one that has (i) less than $10 billion in total consolidated assets; (ii) a leverage ratio greater than 9%; (iii) off-balance sheet exposures of 25% or less of total consolidated assets; and (iv) trading assets and liabilities of 5% or less of total consolidated assets. Qualifying banks that meet these thresholds and elect the CBLR framework, are exempt from the agencies’ current capital framework, including the risk-based capital requirements and capital conservation buffer, and are deemed well-capitalized under the agencies’ prompt corrective action regulations. The Bank has not elected to use the CBLR framework at this time.

Source of Strength. A bank holding company, such as us, is required to act as a source of financial and managerial strength to its subsidiary banks. As a result, a bank holding company may be required to contribute additional capital to its subsidiaries in the form of capital notes or other instruments which qualify as capital under regulatory rules. The appropriate federal banking agency for the depository institution (in the case of the Bank, the FDIC) may require reports from us to assess our ability to serve as a source of strength and to enforce compliance with the source of strength requirements by requiring us to provide financial assistance to the Bank in the event of financial distress. Any loans from the holding company to its subsidiary banks likely will be unsecured and subordinated to the bank’s depositors and perhaps to other creditors of the bank. In addition to the foregoing requirements, the Federal Reserve and other federal banking regulators are authorized to require a company that directly or indirectly controls a bank to submit reports that are designed both to assess the ability of such company to comply with its source of strength obligations and to enforce the company’s compliance with these obligations. As of December 31, 2024, the Federal Reserve and other federal banking regulators have not issued rules implementing this requirement.

In addition, if a bank holding company enters into bankruptcy or becomes subject to the orderly liquidation process established by the Dodd-Frank Act, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank would be assumed by the bankruptcy trustee or the FDIC, as appropriate, and entitled to a priority of payment. Furthermore, the FDIA provides that any insured depository institution generally will be liable for any loss incurred by the FDIC in connection with the default of, or any assistance provided by the FDIC to, a commonly controlled insured depository institution. The Bank is an FDIC-insured depository institution and thus subject to these requirements. See also Bank Regulation - Prompt Corrective Action and Undercapitalization.

Safety and Soundness. There are a number of obligations and restrictions imposed on bank holding companies and their subsidiary banks by law and regulatory policy that are designed to minimize potential loss to the depositors of such depository institutions and the DIF in the event of a depository institution default. For example, under the FDICIA, to avoid receivership of an insured depository institution subsidiary, a bank holding company is required to guarantee the compliance of any subsidiary bank that may become “undercapitalized” with the terms of any capital restoration plan filed by such subsidiary with its appropriate federal bank regulatory agency up to the lesser of (i) an amount equal to 5% of the institution’s total assets at the time the institution became undercapitalized or (ii) the amount that is necessary (or would have been necessary) to bring the institution into compliance with all applicable capital standards as of the time the institution fails to comply with such capital restoration plan.

Dividends. The principal source of our liquidity at the parent company level is dividends from the Bank. The Bank is subject to federal and state restrictions on its ability to pay dividends to the Company. We must pay essentially all of our operating expenses from funds we receive from the Bank. Therefore, shareholders may receive dividends from us only to the extent that funds are available after payment of our operating expenses. Under a Federal Reserve policy adopted in 2009, the board of directors of a bank holding company must consider certain factors to ensure that its dividend level is prudent relative to maintaining a strong financial position, and is not based on overly optimistic earnings scenarios, such as potential events that could affect its ability to pay, while still maintaining a strong financial position. As a general matter, the Federal Reserve has indicated that the board of directors of a bank holding company should consult with the Federal Reserve and eliminate, defer or significantly reduce the bank holding company’s dividends if:

• its net income available to shareholders for the past four quarters, net of dividends previously paid during that period, is not sufficient to fully fund the dividends;

• its prospective rate of earnings retention is not consistent with its capital needs and overall current and prospective financial condition; or

• it will not meet, or is in danger of not meeting, its minimum regulatory capital adequacy ratios.

The ability of the Company or the Bank to pay dividends, and the contents of their respective dividend policies, is subject to changes of law, as well as possible supervisory restrictions imposed by the TDB, FDIC or Federal Reserve. See also Bank Regulation - Dividends for additional information.

Incentive Compensation. The Dodd-Frank Act required the federal banking agencies and the SEC to establish joint rules or guidelines for financial institutions with more than $1 billion in assets, such as the Company and the Bank, which prohibit incentive compensation arrangements that the agencies determine to encourage inappropriate risks by the institution. In 2016, the federal banking agencies and the SEC proposed rules that would, depending upon the assets of the institution, directly regulate incentive compensation arrangements and would require enhanced oversight and recordkeeping. As of December 31, 2024, these rules have not been implemented, although the SEC did adopt final rules implementing the clawback provisions of the Dodd-Frank Act in 2022 and the NYSE did adopt corresponding listing standards for clawback policies in 2023. We and the Bank have undertaken efforts to ensure that our incentive compensation plans do not encourage inappropriate risks, consistent with three key principles: incentive compensation arrangements should appropriately balance risk and financial rewards, be compatible with effective controls and risk management, and be supported by strong corporate governance.

Change in Control. Subject to certain exceptions, under the BHCA, the CBCA and the regulations promulgated thereunder, persons who intend to acquire direct or indirect control of a depository institution or a bank holding company are required to obtain the prior approval of the Federal Reserve. With respect to the Company, “control” is conclusively presumed to exist where an acquiring party directly or indirectly owns, controls or has the power to vote at least 25% of our voting securities. Under the Federal Reserve’s CBCA regulations, a rebuttable presumption of control would arise with respect to an acquisition where, after the transaction, the acquiring party owns, controls or has the power to vote at least 10% (but less than 25%) of our voting securities. Under the Federal Reserve’s “Tiered Presumptions” framework, promulgated in 2010, the Federal Reserve will consider the nature and extent of “controlling influences” that exist between a party and a banking organization at different levels of voting security ownership (i.e., between 0% and 4.99%, or between 5% and 9.99%). The Federal Reserve will presume that no control exists when a company owns 9.99% or less of another company, and no other indicators of control exists.

Acquisitions. The BHCA provides that a bank holding company must obtain the prior approval of the Federal Reserve to (i) acquire direct or indirect ownership or control of more than five percent of the outstanding shares of any class of voting securities of any bank or bank holding company, (ii) acquire all or substantially all of the assets of another bank or bank holding company or (iii) merge or consolidate with any other bank holding company. The Federal Reserve, with the input of the Department of Justice, may not approve any such transaction that would result in a monopoly or would be in furtherance of any combination or conspiracy to monopolize or attempt to monopolize the business of banking in any section of the United States, or the effect of which may be substantially to lessen competition or to tend to create a monopoly in any section of the country, or that in any other manner would be in restraint of trade unless the anticompetitive effects of the proposed transaction are clearly outweighed in the public interest by the probable effect of the transaction in meeting the convenience and needs of the community to be served. The Federal Reserve is also required to consider (i) the financial and managerial resources of the companies involved, including pro forma capital ratios, (ii) the risk to the stability of the United States banking or financial system, (iii) the convenience and needs of the communities to be served, including performance under the CRA and (iv) the effectiveness of the company in combatting money laundering.

Regulatory Examination. Federal and state banking agencies require the Company and the Bank to prepare annual reports on financial condition and to conduct an annual audit of financial affairs in compliance with minimum standards and procedures. The Bank, and in some cases the Company and any nonbank affiliates, must undergo regular on-site examinations by the appropriate regulatory agency, which will examine for adherence to a range of legal and regulatory compliance responsibilities. A bank regulator conducting an examination has complete access to the books and records of the examined institution, and the results of the examination are confidential. The cost of examinations may be assessed against the examined organization as the agency deems necessary or appropriate. The FDIC has developed a method for insured depository institutions to provide supplemental disclosure of the estimated fair value of assets and liabilities, to the extent feasible and practicable, in any balance sheet, financial statement, report of condition or any other report.

Enforcement Authority. The Federal Reserve has broad enforcement powers over bank holding companies and their nonbank subsidiaries, as well as “institution-affiliated parties,” including management, employees, agents, independent contractors and consultants, such as attorneys and accountants and others who participate in the conduct of the institution’s affairs, and has authority to prohibit activities that represent unsafe or unsound banking practices or constitute knowing or reckless violations of laws or regulations. These powers may be exercised through the issuance of cease-and-desist orders, civil money penalties or other actions. Civil money penalties can be as high as $1,000,000 for each day the activity continues and criminal penalties for some financial institution crimes may include imprisonment for 20 years. Regulators have flexibility to commence enforcement actions against institutions and institution-affiliated parties, and the FDIC has the authority to terminate deposit insurance. When issued by a banking agency, cease-and-desist and similar orders may, among other things, require affirmative action to correct any harm resulting from a violation or practice, including restitution, reimbursement, indemnifications or guarantees against loss. A financial institution may also be ordered to restrict its growth, dispose of certain assets, rescind agreements or contracts, refrain from declaring or paying dividends, or take other actions determined to be appropriate by the ordering agency. The federal banking agencies also may remove a director or officer from an insured depository institution (or bar them from the industry) if a violation is willful or reckless.

Bank Regulation

The Bank is a Texas-chartered commercial bank, the deposits of which are insured up to the applicable limits by the FDIC. The Bank is not a member of the Federal Reserve. The Bank is subject to extensive regulation, examination and supervision by the TDB, as its chartering authority, and by the FDIC, as its primary federal regulator and deposit insurer. In addition, the CFPB could participate in examinations of the Bank (as described above) regarding the Bank’s offering of consumer financial products and services. The federal and state laws applicable to banks regulate, among other things, the scope of their activities and investments, lending and deposit-taking activities, borrowings, maintenance of retained earnings and reserve accounts, distribution of earnings and payment of dividends.

Broadly, regulations applicable to the Bank include limitations on loans to a single borrower and to its directors, officers and employees, restrictions on the opening and closing of branch offices, the maintenance of required capital ratios, the granting of credit under equal and fair conditions, the disclosure of the costs and terms of such credit, requirements to maintain reserves against deposits and loans, limitations on the types of investment that may be made by the Bank and requirements governing risk management practices. Certain of these laws and regulations are referenced above under “Supervision and Regulation – Holding Company Regulation.”

Permitted Activities and Investments. Under the FDIA, the activities and investments of state nonmember banks are generally limited to those permissible for national banks, notwithstanding state law. With FDIC approval, a state nonmember bank may engage in activities not permissible for a national bank if the FDIC determines that the activity does not pose a significant risk to the DIF and that the bank meets its minimum capital requirements. Similarly, under Texas law, a state bank may engage in those activities permissible for national banks domiciled in Texas. The TDB may permit a Texas state bank to engage in additional activities so long as the performance of the activity by the bank would not adversely affect the safety and soundness of the bank.

Volcker Rule Section 619 of the Dodd-Frank Act prohibits insured depository institutions and their affiliates from proprietary trading and acquiring certain interests in hedge or private equity funds. The Volker Rule contains certain exemptions from the prohibition and permit the retention of certain ownership interests. Subsequent amendments to the Volcker Rule exempt from coverage those banks with (i) total consolidated assets equal to $10 billion or less; and (ii) total trading assets and liabilities equal to 5 percent or less of total consolidated assets. Based on this amendment, the Bank is exempt from the Volcker Rule’s restrictions and prohibitions.

Brokered Deposits. The Bank also may be restricted in its ability to accept, renew or roll over brokered deposits, depending on its capital classification. Subject to certain exceptions, deposits are “brokered” if they are placed at a bank through the intervention of a third party in the business of facilitating the placement of deposits with FDIC-insured banks. Only “well-capitalized” banks are permitted to accept, renew or roll over brokered deposits. The FDIC may, on a case-by-case basis, permit banks that are adequately capitalized to accept brokered deposits if the FDIC determines that acceptance of such deposits would not constitute an unsafe or unsound banking practice with respect to the bank. Undercapitalized banks generally may not accept, renew or roll over brokered deposits. On December 15, 2020, the FDIC approved a final rule, effective April 1, 2021, setting forth a new framework for determining when deposits accepted by an insured depository institution qualify as “brokered deposits.” The new rule also clarifies when a third party may qualify as a “deposit broker,” and identifies several business relationships between banks and third parties that are exempt from the brokered deposit restrictions. On July 15, 2022, the FDIC released guidance regarding how banks should treat the placement of deposits by third parties under “sweep arrangements” with broker-dealers. However, on July 30, 2024, the FDIC approved a notice of proposed rulemaking relating to the agency’s brokered deposit rules which would inter alia rollback certain aspects and exceptions to the brokered deposit rules originally introduced by the 2020 rule. As of December 31, 2024, the notice of proposed rulemaking had not been finalized.

Loans to One Borrower. Under Texas law, without the approval of the TDB and subject to certain limited exceptions for loans secured by livestock, stored agricultural products, or readily marketable collateral, the maximum aggregate amount of loans that the Bank is permitted to make to any one borrower is 25% of Tier 1 capital. For purposes of applying this limit, loans to one borrower may be combined with loans to another borrower (i) when proceeds of the loan are to be used for the direct benefit of the other borrower, to the extent of the proceeds so used, or (ii) when a “common enterprise” is deemed to exist between the borrowers.

Insider Loans. Under Regulation O of the Federal Reserve, as made applicable to state nonmember banks by section 18(j)(2) of the FDIA, the Bank is subject to quantitative restrictions on extensions of credit to its executive officers and directors, the executive officers and directors of the Company, any owner of 10% or more of its stock or the stock of the Company and certain entities affiliated with any such persons. In general, any such extensions of credit must (i) not exceed certain dollar limitations, (ii) be made on substantially the same terms, including interest rates and collateral, as those prevailing at the time for comparable transactions with third parties and (iii) not involve more than the normal risk of repayment or present other unfavorable features. Additional restrictions are imposed on extensions of credit to executive officers. Certain extensions of credit also require the approval of a bank’s board of directors. On December 22, 2020, the federal banking agencies issued an Interagency Statement clarifying that they will not apply the quantitative and qualitative restrictions of Regulation O to investors in large funds (e.g., mutual funds) that may hold an investment position in banks, and therefore could qualify as an “insider” under current Regulation O definitions. On December 22, 2022, the agencies extended this relief to January 1, 2024, on December 15, 2023, the agencies extended this relief to January 1, 2025 and on December 27, 2024, the agencies extended this relief to January 1, 2026.

Deposit Insurance and Assessments. As an FDIC-insured bank, the Bank must pay deposit insurance assessments to the FDIC based on the Bank’s average total consolidated assets minus its average tangible equity during the assessment period. Deposits are insured up to applicable limits by the FDIC and such insurance is backed by the full faith and credit of the United States Government. The coverage limit of $250,000 is per depositor, per insured depository institution for each account ownership category. Banks must maintain a minimum DIF reserve ratio equal to 1.35 percent of estimated insured deposits. Based on circumstances related to the COVID-19 pandemic, the DRR dropped below the statutory minimum in 2020, and the FDIC adopted a restoration plan to return the DRR to 1.35 percent by September 30, 2028. To that end, on October 24, 2022, the FDIC adopted a final rule raising the DIF assessment rate on all insured depository institutions, including the Bank, by two basis points. This assessment rate became effective January 1, 2023, with the first quarterly assessment due June 30, 2023. As a result of bank failures in March and May 2023, the DRR fell to 1.10 percent as of June 30, 2023. However, the FDIC projected that the reserve ratio will still reach the statutory minimum of 1.35 percent by the statutory deadline of September 30, 2028 as a result of the FDIC’s prior assessment rate adjustment. On November 16, 2023, the FDIC approved a final rule to implement a special assessment to recover the loss to the DIF associated with protecting uninsured depositors following the closures of Silicon Valley Bank and Signature Bank. The special assessment is targeted primarily at larger banks with significant uninsured deposit levels. Specifically, the assessment base for the special assessment is equal to a bank’s estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion. As of December 31, 2022, the Bank had less than $5 billion in estimated uninsured deposits.

Under the FDIA, the FDIC may terminate deposit insurance upon a finding that an institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order, or condition imposed by the FDIC.

Capital Adequacy.

See Holding Company Regulation - Capital Adequacy.

Prompt Corrective Action and Undercapitalization. The FDICIA established a system of prompt corrective action to resolve the problems of undercapitalized insured depository institutions. Under this system, the federal banking regulators are required to rate insured depository institutions based on five capital categories as described below. The federal banking regulators are also required to take mandatory supervisory actions and are authorized to take other discretionary actions, with respect to insured depository institutions in the three undercapitalized categories, the severity of which will depend upon the capital category in which the insured depository institution is assigned. Generally, subject to a narrow exception, the FDICIA requires the banking regulator to appoint a receiver or conservator for an insured depository institution that is critically undercapitalized. The federal banking agencies have specified by regulation the relevant capital level for each category.

Under the regulations, all insured depository institutions are assigned to one of the following capital categories:

•Well Capitalized - The insured depository institution exceeds the required minimum level for each relevant capital measure. A well-capitalized insured depository institution is one (1) having a total risk-based capital ratio of 10% or greater, (2) having a Tier 1 risk-based capital ratio of 8% or greater, (3) having a CET1 capital ratio of 6.5% or greater, (4) having a leverage capital ratio of 5% or greater and (5) that is not subject to any order or written directive to meet and maintain a specific capital level for any capital measure.

•Adequately Capitalized - The insured depository institution meets the required minimum level for each relevant capital measure. An adequately-capitalized depository institution is one having (1) a total risk based capital ratio of 8% or more, (2) a Tier 1 capital ratio of 6% or more, (3) a CET1 capital ratio of 4.5% or more and (4) a leverage ratio of 4% or more.

•Undercapitalized - The insured depository institution fails to meet the required minimum level for any relevant capital measure. An undercapitalized depository institution is one having (1) a total capital ratio of less than 8%, (2) a Tier 1 capital ratio of less than 6%, (3) a CET1 capital ratio of less than 4.5% or (4) a leverage ratio of less than 4%.

•Significantly Undercapitalized - The insured depository institution is significantly below the required minimum level for any relevant capital measure. A significantly undercapitalized institution is one having (1) a total risk-based capital ratio of less than 6% (2) a Tier 1 capital ratio of less than 4%, (3) a CET1 ratio of less than 3% or (4) a leverage capital ratio of less than 3%.

•Critically Undercapitalized - The insured depository institution fails to meet a critical capital level set by the appropriate federal banking agency. A critically undercapitalized institution is one having a ratio of tangible equity to total assets that is equal to or less than 2%.

The prompt corrective action regulations permit the appropriate federal banking regulator to downgrade an institution to the next lower category if the regulator determines after notice and opportunity for hearing or response that (1) the institution is in an unsafe or unsound condition or (2) that the institution has received and not corrected a less-than-satisfactory rating for any of the categories of asset quality, management, earnings or liquidity in its most recent examination. Supervisory actions by the appropriate federal banking regulator depend upon an institution’s classification within the five capital categories. As previously noted, our management believes that we and our Bank subsidiary have the requisite capital levels to qualify as well-capitalized institutions under the FDICIA regulations.

If an institution fails to remain well capitalized, it will be subject to a variety of enforcement remedies that increase as the capital condition worsens. For instance, the FDICIA generally prohibits a depository institution from making any capital distribution, including payment of a dividend, or paying any management fee to its holding company if the depository institution would thereafter be undercapitalized as a result. Undercapitalized depository institutions are also subject to restrictions on borrowing from the Federal Reserve, may not accept brokered deposits, are subject to growth limitations and are required to submit capital restoration plans for regulatory approval. A depository institution’s holding company must guarantee any required capital restoration plan, up to an amount equal to the lesser of 5% of the depository institution’s assets at the time it becomes undercapitalized or the amount of the capital deficiency when the institution fails to comply with the plan. Federal banking agencies may not accept a capital plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the depository institution’s capital. If a depository institution fails to submit an acceptable plan, it is treated as if it is significantly undercapitalized.

Significantly undercapitalized depository institutions may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become adequately capitalized, requirements to reduce total assets and cessation of receipt of deposits from correspondent banks. In addition to the “prompt corrective action” directives, failure to meet capital guidelines may subject a banking organization to a variety of other enforcement remedies, including additional substantial restrictions on its operations and activities, termination of deposit insurance by the FDIC and, under certain conditions, the appointment of a conservator or receiver.

Standards for Safety and Soundness. The FDIA requires the federal banking regulatory agencies to prescribe, by regulation or guideline, operational and managerial standards for all insured depository institutions relating to: (i) internal controls; (ii) information systems and internal audit systems; (iii) loan documentation; (iv) credit underwriting; (v) interest rate risk exposure; and (vi) asset quality. The agencies also must prescribe standards for asset quality, earnings and stock valuation, as well as standards for compensation, fees and benefits. The federal banking agencies have adopted regulations and Interagency Guidelines Establishing Standards for Safety and Soundness to implement these required standards. These guidelines set forth the safety and soundness standards that the federal banking agencies use to identify and address problems at insured depository institutions before capital becomes impaired. If the FDIC determines that the Bank fails to meet any standards prescribed by the guidelines, it may require the Bank to submit an acceptable plan to achieve compliance, consistent with deadlines for the submission and review of such safety and soundness compliance plans. Notably, in June 2020, the federal financial regulators issued the Interagency Examiner Guidance for Assessing Safety and Soundness Considering the Effect of the COVID-19 Pandemic on Institutions. The guidance directs bank examiners to focus specifically on how challenges created by the COVID-19 pandemic are being addressed by the institution, particularly with respect to credit risk and asset quality.

In addition, on May 8, 2020, the federal banking regulators published Interagency Guidance on Risk Systems, applicable to all regulated depository institutions regardless of asset size, to be used in creating an appropriate “credit risk review system” consistent with the existing guidelines. The guidance encourages banks to consider (i) the qualification of the bank’s reviewing personnel; (ii) the frequency, scope and depth of credit reviews; and (iii) appropriate internal distribution of credit review results.

Incentive Compensation.

See “Holding Company Regulation – Incentive Compensation.”

Dividends. All dividends paid by the Bank are paid to the Company, as the sole shareholder of the Bank. The ability of the Bank, as a Texas state bank, to pay dividends is restricted under federal and state law and regulations. The FDICIA and the regulations of the FDIC generally prohibit an insured depository institution from making a capital distribution (including payment of dividend) if, thereafter, the institution would not be at least adequately capitalized. Under Texas law, the Bank generally may not pay a dividend reducing its capital and surplus without the prior approval of the Texas Banking Commissioner. All dividends must be paid out of net profits then on hand, after deducting expenses, including losses and provisions for loan losses.

The Bank’s general dividend policy is to pay dividends at levels consistent with maintaining liquidity and preserving applicable capital ratios and servicing obligations. The Bank’s dividend policies are subject to the discretion of its board of directors and will depend upon such factors as future earnings, financial conditions, cash needs, capital adequacy, compliance with applicable statutory and regulatory requirements and general business conditions. The exact amount of future dividends paid by the Bank will be a function of its general profitability (which cannot be accurately estimated or assured), applicable tax rates in effect from year to year and the discretion of its board of directors.

Transactions with Affiliates. The Bank is subject to sections 23A and 23B of the FRA and the Federal Reserve’s Regulation W, as made applicable to state nonmember banks by section 18(j) of the FDIA. Sections 23A and 23B of the FRA restrict a bank’s ability to engage in certain transactions with its affiliates. An affiliate of a bank is any company or entity that controls, is controlled by or is under common control with the bank. In a holding company context, the parent bank holding company and any companies controlled by such parent bank holding company are generally affiliates of the bank.

Specifically, section 23A places limits on the amount of “covered transactions” between a bank and its affiliates, including loans or extensions of credit to, investments in or certain other transactions with, affiliates. It also limits the amount of any advances to third parties that are collateralized by the securities or obligations of affiliates. The aggregate of all covered transactions is limited to 10% of the bank’s capital and surplus for any one affiliate and 20% for all affiliates. Additionally, within the foregoing limitations, each credit transaction with an affiliate must meet specified collateral requirements ranging from 100 to 130% of the loan amount, depending on the type of collateral. Further, banks are prohibited from purchasing low quality assets from an affiliate. The definition of “covered transactions” has been broadened to include derivative transactions and the borrowing or lending of securities if the transaction will cause a bank to have credit exposure to an affiliate. The revised definition also includes the acceptance of debt obligations of an affiliate as collateral for a loan or extension of credit to a third party. Furthermore, reverse repurchase transactions are viewed as extensions of credit (instead of asset purchases) and thus become subject to collateral requirements.

Section 23B, among other things, prohibits a bank from engaging in certain transactions with affiliates unless the transactions are on terms substantially the same, or at least as favorable to the bank, as those prevailing at the time for comparable transactions with non-affiliated companies. Except for limitations on low quality asset purchases and transactions that are deemed to be unsafe or unsound, Regulation W generally excludes affiliated depository institutions from treatment as affiliates.

Anti-Tying Regulations. Under the BHCA and the Federal Reserve’s regulations, a bank is prohibited from engaging in certain tying or reciprocity arrangements with its customers. In general, a bank may not extend credit, lease, sell property, or furnish any services or fix or vary the consideration for these products or services on the condition that either: (i) the customer obtain or provide some additional credit, property, or services from or to the bank, the bank holding company or subsidiaries thereof or (ii) the customer not obtain credit, property, or service from a competitor, except to the extent reasonable conditions are imposed to assure the soundness of the credit extended. A bank may, however, offer combined-balance products and may otherwise offer more favorable terms if a customer obtains two or more traditional bank products. The law also expressly permits banks to engage in other forms of tying and authorizes the Federal Reserve Board to grant additional exceptions by regulation or order. Also, certain foreign transactions are exempt from the general rule.

Community Reinvestment Act. Under the CRA, the Bank has a continuing and affirmative obligation, consistent with safe and sound banking practices, to help meet the needs of our entire community, including low- and moderate-income neighborhoods. The CRA does not establish specific lending requirements or programs for banks, nor does it limit a bank’s discretion to develop the types of products and services that it believes are best suited to its particular community.

On a periodic basis, the FDIC is charged with preparing a written evaluation of our record of meeting the credit needs of the entire community and assigning a rating - outstanding, satisfactory, needs to improve or substantial noncompliance. Banks are rated based on their actual performance in meeting community credit needs. The FDIC will take that rating into account in its evaluation of any application made by the bank for, among other things, approval of the acquisition or establishment of a branch or other deposit facility, an office relocation, a merger or the acquisition of shares of capital stock of another financial institution. A bank’s CRA rating may be used as the basis to deny or condition an application. In addition, as discussed above, a bank holding company may not become a financial holding company unless each of its subsidiary banks has a CRA rating of at least “satisfactory.” As of September 30, 2024, the most recent exam date, the Bank has a CRA rating of “satisfactory.”

On October 24, 2023, the federal banking agencies jointly issued a final rule modernizing and overhauling the prior CRA regulations. Key elements of the final rule include (i) encouragement of expanded access to credit, investment, and basic banking services in low- and moderate-income communities; (ii) updated CRA assessment areas by including activities associated with online and mobile banking, branchless banking, and hybrid models; (iii) greater clarity and consistency in the application of CRA regulations; and (iv) better tailoring CRA evaluations and data collection requirements by bank size and type. Most of the final rule’s requirements will be applicable beginning January 1, 2026. The remaining requirements, including new data reporting requirements, will be applicable on January 1, 2027. The final rule is likely to make it more challenging and/or costly for the Bank to receive a rating of at least “Satisfactory” on its CRA exam. However, the CRA modernization rules were subsequently challenged in court, and the impact of these challenges on the Bank therefore remain uncertain.

Branch Banking. Pursuant to the Texas Finance Code, all banks located in Texas are authorized to branch statewide. Accordingly, a bank located anywhere in Texas has the ability, subject to regulatory approval, to establish branch facilities near any of our facilities and within our market area. Similarly, under applicable Federal law, out-of-state banks are permitted to establish branches in Texas. If other banks were to establish branch facilities near our facilities, it is uncertain whether these branch facilities would have a material adverse effect on our business.

De novo interstate branching by the Bank is also subject to the Federal interstate branching rules. All branching in which the Bank may engage remains subject to regulatory approval and adherence to applicable legal and regulatory requirements.

Consumer Protection Regulation. The activities of the Bank are subject to a variety of statutes and regulations designed to protect consumers. Interest and other charges collected or contracted for by banks are subject to state usury laws and federal laws concerning interest rates. Loan operations are also subject to federal laws and regulations applicable to credit transactions, such as:

•the Truth in Lending Act and Regulation Z, governing disclosures of credit terms to consumer borrowers;

•the Home Mortgage Disclosure Act and Regulation C, requiring financial institutions to provide information to enable the public and public officials to determine whether a financial institution is fulfilling its obligation to help meet the housing needs of the community it serves;

•the Equal Credit Opportunity Act and Regulation B, prohibiting discrimination on the basis of race, creed or other prohibited factors in extending credit;

•the Fair Credit Reporting Act and Regulation V, governing the use and provision of information to consumer reporting agencies;

•the Fair Debt Collection Act, governing the manner in which consumer debts may be collected by collection agencies; and

•the guidance of the various federal agencies charged with the responsibility of implementing such federal laws.

Deposit and other operations also are subject to:

•the Truth in Savings Act and Regulation DD, governing disclosure of deposit account terms to consumers;

•the Right to Financial Privacy Act, which imposes a duty to maintain confidentiality of consumer financial records and prescribes procedures for complying with administrative subpoenas of financial records; and

•the Electronic Fund Transfer Act and Regulation E, which governs automatic deposits to and withdrawals from deposit accounts and customers’ rights and liabilities arising from the use of ATMs and other electronic banking services, which the CFPB has expanded to include a new compliance regime that governs consumer-initiated cross border electronic transfers.

The foregoing laws and regulations are amended periodically. We cannot predict the extent to which new or modified regulations focused on consumer financial protection, whether adopted by the TDB, the CFPB, or the federal banking agencies will have on our businesses. Any such new laws may materially adversely affect our business, financial condition or results of operations.

Commercial Real Estate Lending. Lending operations that involve a significant concentration of commercial real estate loans are subject to enhanced scrutiny by federal banking regulators. CRE loans generally include land development, construction loans, land and lot loans to individuals, loans secured by multi-family property and nonfarm nonresidential real property where the primary source of repayment is derived from rental income associated with the property. The guidance prescribes the following guidelines for examiners to help identify institutions that are potentially exposed to concentration risk and may warrant greater supervisory scrutiny:

•total reported loans for construction, land development and other land represent 100 percent or more of the institution’s total capital, or

•total CRE loans represent 300 percent or more of the institution’s total capital and the outstanding balance of the institution’s CRE loan portfolio has increased by 50 percent or more during the prior 36 months.

In addition, Federal regulations requiring risk retention of assets may impact our business by reducing the amount of our CRE lending and increasing the cost of borrowing. A loan originator or a securitizer of asset-backed securities is required to retain a percentage of the credit risk of securitized assets. On June 29, 2023, in response to the increased risks on CRE loans created by the COVID-19 pandemic, the federal banking regulators published a “Final Interagency Policy Statement on Prudent Commercial Real Estate Loan Accommodations and Workouts.” It builds on the “Interagency Statement on Prudent Risk Management for Commercial Real Estate Lending” released in December 2015, and reaffirms risk management practices that financial institutions should exercise when entering into a loan agreement with a borrower. In the CRE Guidance, the federal banking regulators (i) expressed concerns with institutions that ease commercial real estate underwriting standards, (ii) directed financial institutions to maintain underwriting discipline and exercise risk management practices to identify, measure and monitor lending risks, and (iii) indicated that they will continue to pay special attention to commercial real estate lending activities and concentrations going forward. On December 18, 2023, the FDIC issued an advisory on Managing Commercial Real Estate Concentrations in a Challenging Economic Environment.

Anti-Money Laundering. The Bank is subject to the regulations of the FinCEN, a bureau of the U.S. Department of the Treasury, which implements the Bank Secrecy Act, as amended by the USA PATRIOT Act and the Anti-Money Laundering Act of 2020. The USA PATRIOT Act gives the federal government the power to address terrorist threats through enhanced domestic security measures, expanded surveillance powers, increased information sharing and broadened anti-money laundering requirements. Title III of the USA PATRIOT Act includes measures intended to encourage information sharing among banks, regulatory agencies and law enforcement bodies. Further, certain provisions of Title III impose affirmative obligations on a broad range of financial institutions, including state-chartered banks like the Bank. The Anti-Money Laundering Act of 2020 expanded the coverage of the Bank Secrecy Act to include new categories of “financial institutions,” expanding the types of monetary transactions that must be monitored and reported, and increasing the enforcement authority of the U.S. Department of Justice with respect to federal anti-money laundering laws.

The Bank Secrecy Act, USA PATRIOT Act, and Anti-Money Laundering Act of 2020, along with the related FinCEN regulations, impose numerous requirements with respect to financial institution operations, including the following:

•establishment of AML programs, including adoption of written procedures and an ongoing employee training program, designation of a compliance officer and auditing of the program;

•establishment of a program specifying procedures for obtaining information from customers seeking to open new accounts, including verifying the identity of customers within a reasonable period of time;

•establishment of enhanced due diligence policies, procedures and controls designed to detect and report money laundering, for financial institutions that administer, maintain or manage private bank accounts or correspondent accounts for non-U.S. persons;

•prohibitions on correspondent accounts for foreign shell banks and compliance with recordkeeping obligations with respect to correspondent accounts of foreign banks;

•filing of suspicious activities reports if a bank believes a customer may be violating U.S. laws and regulations; and

•requirements that bank regulators consider bank holding and bank compliance with federal AML laws in connection with proposed merger or acquisition transactions.

In addition, under applicable FinCEN regulations, covered financial institutions, subject to certain exclusions and exemptions, are required to identify and verify the identity of beneficial owners of legal entity customers. On August 13, 2020, the federal banking agencies issued a joint statement addressing the circumstances under which an agency will issue a mandatory “cease-and-desist” order to a regulated financial institution for failure to comply with its AML obligations, emphasizing that the “effectiveness” of a bank’s AML program will be the key factor in the agency's decision. Sanctions for violations of the USA PATRIOT Act can be imposed in an amount equal to twice the sum involved in the violating transaction up to $1 million.

On June 30, 2021, FinCEN published the first set of “national AML priorities,” as required by the Bank Secrecy Act, which include, but are not limited to, cybercrime, terrorist financing, fraud, and drug/human trafficking. On June 28, 2024, FinCEN issued a proposed rule that was drafted to implement the new AML program requirements in line with the national AML priorities. Thereafter, on August 9, 2024, the federal banking regulators published a notice of proposed rulemaking that would update the requirements each agency has issued for its supervised institutions to establish, implement, and maintain effective, risk-based, and reasonably designed AML programs. As of December 31, 2024, the proposed rules have yet to be finalized.

Bank regulators routinely examine institutions for compliance with anti-money laundering obligations and have been active in imposing cease and desist and other regulatory orders, and money penalty sanctions, against institutions found to be violating these obligations. In addition, the Federal Bureau of Investigation can send bank regulatory agencies lists of the names of persons suspected of involvement in terrorist activities. The Bank can be requested to search its records for any relationships or transactions with persons on those lists and be required to report any identified relationships or transactions.

OFAC. OFAC is responsible for helping to ensure that U.S. entities, including banks, do not engage in transactions with certain prohibited parties, as defined by various Executive Orders and Acts of Congress. OFAC publishes, and routinely updates, lists of names of persons and organizations suspected of aiding, harboring or engaging in terrorist acts, including the Specially Designated Nationals List. If we find a name on any transaction, account or wire transfer that is on an OFAC list, we must undertake certain specified activities, which could include blocking or freezing the account or transaction requested, and we must notify the appropriate authorities.

Privacy and Data Security; Cybersecurity. Under federal law, financial institutions are generally prohibited from disclosing consumer nonpublic personal information to non-affiliated third parties unless the consumer has been given the opportunity to object and has not objected to such disclosure. Financial institutions are further required, subject to certain exceptions, to disclose their privacy policies to customers annually. Generally, the Bank must disclose its privacy policy for collecting and protecting NPI to consumers, permit consumers to “opt out” of having NPI disclosed to non-affiliated third parties, with some exceptions, and allow consumers to opt out of receiving marketing solicitations based on information about the consumer received from another affiliate. Many states have also recently implemented or modified their data privacy laws and some may apply to financial institutions. For example, in California, the California Privacy Rights Act became effective on January 1, 2023, and provides new protections for those the Bank customers who reside in that state.

In addition, federal and state banking agencies have prescribed standards for maintaining the security and confidentiality of consumer information, to which the Bank is subject. Pursuant to these standards, the Bank is required to have an information security program to safeguard the confidentiality and security of customer information and to ensure proper disposal. The Bank is also subject to state and federal laws for notifying individuals and regulators in the event of a security breach affecting their personal information. Under federal law, customers must be notified when a financial institution becomes aware of unauthorized access of sensitive customer information and misuse has occurred or is reasonably possible.

More broadly, on November 23, 2021, the federal banking regulators imposed a new cybersecurity-related notification rule that would require banking organizations, including the Company and the Bank, to notify their primary federal regulator as soon as possible (but within 36 hours) of incidents that have materially disrupted or degraded, or are reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. The rule also imposes requirements on bank service providers to notify their affected banking organization customers of certain computer-security incidents. This rule became effective on April 1, 2022. Additionally, effective as of December 2023, the SEC issued a new rule that requires registrants to disclose material cybersecurity incidents within four business days. At the state level, as of January 2, 2020, Texas state banks are required to notify the TDB of “cybersecurity incidents” within specified timeframes.

Debit Interchange Fees. Interchange fees are fees that merchants pay to credit card companies and card-issuing banks such as the Bank for processing electronic payment transactions on their behalf. The maximum permissible interchange fee that an issuer may receive for an electronic debit transaction is the sum of 21 cents per transaction and 5 basis points multiplied by the value of the transaction, subject to an upward adjustment of 1 cent if an issuer certifies that it has implemented policies and procedures reasonably designed to achieve the fraud-prevention standards set forth by the Federal Reserve. In addition, the legislation prohibits card issuers and networks from entering into arrangements requiring that debit card transactions be processed on a single network or only two affiliated networks and allows merchants to determine transaction routing. On October 25, 2023, the Federal Reserve proposed to lower the maximum interchange fee that a large debit card issuer can receive for a debit card transaction. The proposal would also establish a regular process for updating the maximum amount every other year going forward. We continue to monitor the development of these proposed rule revisions.

Anti-Bribery Laws. Federal law prohibits offering or giving a bank official or any third party (or for the bank official to solicit or receive for himself or a third party) “anything of value” other than what is given or offered to the bank itself. Further, the Foreign Corrupt Practices Act makes it unlawful to make payments to foreign government officials to assist in obtaining or retaining business. The Company and the Bank have implemented a Code of Business Ethics that governs the behavior of its officers and employees.

Regulatory Examination.

See “Holding Company Regulation - Regulatory Examination.”

Enforcement Authority. The Bank and its “institution-affiliated parties,” including management, employees, agents, independent contractors and consultants, such as attorneys and accountants and others who participate in the conduct of the institution’s affairs, are subject to potential civil and criminal penalties for violations of law, regulations or written orders of a government agency. Violations can include failure to timely file required reports, filing false or misleading information or submitting inaccurate reports. Civil penalties may be as high as $25,000 per day or, in especially egregious examples, $1,000,000 a day for such violations, and criminal penalties for some financial institution crimes may include imprisonment for 20 years. Regulators have flexibility to commence enforcement actions against institutions and institution-affiliated parties, and the FDIC has the authority to terminate deposit insurance. When issued by a banking agency, cease and desist orders may, among other things, require affirmative action to correct any harm resulting from a violation or practice, including restitution, reimbursement, indemnifications or guarantees against loss. A financial institution may also be ordered to restrict its growth, dispose of certain assets, rescind agreements or contracts, or take other actions determined to be appropriate by the ordering agency. The federal banking agencies also may remove a director or officer from an insured depository institution (or bar them from the industry) if a violation is willful or reckless.

Governmental Monetary Policies. The commercial banking business is affected not only by general economic conditions but also by the monetary policies of the Federal Reserve. Changes in the discount rate on member bank borrowings, control of borrowings, open market operations, the imposition of and changes in reserve requirements against member banks, deposits and assets of foreign branches, the imposition of and changes in reserve requirements against certain borrowings by banks and their affiliates and the placing of limits on interest rates which member banks may pay on time and savings deposits are some of the instruments of monetary policy available to the Federal Reserve. These monetary policies influence to a significant extent the overall growth of all bank loans, investments and deposits and the interest rates charged on loans or paid on time and savings deposits. The nature of future monetary policies and the effect of such policies on the Bank’s future business and earnings, therefore, cannot be predicted accurately.

Other Regulatory Matters. The Company and its affiliates are subject to oversight by the SEC, the NYSE, various state securities regulators and other regulatory authorities. The Company and its subsidiaries have from time to time received requests for information from regulatory authorities in various states, including state attorneys general, securities regulators and other regulatory authorities, concerning their business practices. Such requests are considered incidental to the normal conduct of business.

Future Legislation and Regulation. Congress may enact legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of the proposed legislation could affect the regulatory structure under which we operate and may significantly increase our costs, impede the efficiency of our internal business processes, require us to increase our regulatory capital or modify our business strategy, or limit our ability to pursue business opportunities in an efficient manner. Our business, financial condition, results of operations or prospects may be adversely affected, perhaps materially, as a result.