HILLS BANCORPORATION

Financial institutions and their holding companies are extensively regulated under federal and state law. As a result, the growth and earnings performance of the Company can be affected not only by management decisions and general economic conditions but also by the requirements of applicable state and federal statutes and regulations and the policies of various governmental regulatory authorities, including the Iowa Superintendent of Banking (the “Superintendent”), the Board of Governors of the Federal Reserve System (the “Federal Reserve”), the Federal Deposit Insurance Corporation (the “FDIC”), the Internal Revenue Service and state taxing authorities and the Securities and Exchange Commission (the “SEC”). The effect of applicable statutes, regulations and regulatory policies can be significant and cannot be predicted with a high degree of certainty.

Federal and state laws and regulations generally applicable to financial institutions regulate, among other things, the scope of business, investments, reserves against deposits, capital levels relative to operations, the nature and amount of collateral for loans, the establishment of branches, mergers, consolidations and dividends. The system of supervision and regulation applicable to the Company and its subsidiary Bank establishes a comprehensive framework for their respective operations and is intended primarily for the protection of the FDIC’s deposit insurance funds and the depositors, rather than the stockholders, of financial institutions. The enforcement powers available to federal and state banking regulators are substantial and include, among other things, the ability to assess civil money penalties, to issue cease-and-desist or removal orders and to initiate injunctive actions.

The following is a summary of the material elements of the regulatory framework applicable to the Company and its subsidiary Bank. It does not describe all of the statutes, regulations and regulatory policies that apply, nor does it restate all of the requirements of the statutes, regulations and regulatory policies that are described. As such, the following is qualified in its entirety by reference to the applicable statutes, regulations and regulatory policies. Any change in applicable law, regulations or regulatory policies may have a material effect on the business of the Company and its subsidiary Bank.

Regulation of the Company

General. The Company, as the sole shareholder of the Bank, is a bank holding company. As a bank holding company, the Company is registered with, and is subject to regulation by, the Federal Reserve under the Bank Holding Company Act, as amended (the “BHCA”). According to Federal Reserve Board policy, bank/financial holding companies are expected to act as a source of financial strength to each subsidiary bank and to commit resources to support each such subsidiary. This support may be required at times when a bank/financial holding company may not be able to provide support. Under the BHCA, the Company is subject to periodic examination by the Federal Reserve. The Company is also required to file with the Federal Reserve periodic reports of the Company’s operations and such additional information regarding the Company and its subsidiary as the Federal Reserve may require.

Investments and Activities. Under the BHCA, a bank holding company must obtain Federal Reserve approval before: (i) acquiring, directly or indirectly, ownership or control of any voting shares of another bank or bank holding company if, after the acquisition, it would own or control more than 5% of the shares of the other bank or bank holding company (unless it already owns or controls the majority of such shares), (ii) acquiring all or substantially all of the assets of another bank or (iii) merging or consolidating with another bank holding company. Subject to certain conditions (including certain deposit concentration limits established by the BHCA), the Federal Reserve may allow a bank holding company to acquire banks located in any state of the United States without regard to whether the acquisition is prohibited by the law of the state in which the target bank is located. On approving interstate acquisitions, however, the Federal Reserve is required to give effect to applicable state law limitations on the aggregate amount of deposits that may be held by the acquiring bank holding company and its insured depository institution affiliates in the state in which the target bank is located (provided that those limits do not discriminate against out-of-state depository institutions or their holding companies) and state laws which require that the target bank have been in existence for a minimum period of time (not to exceed five years) before being acquired by an out-of-state bank holding company.

The BHCA also generally prohibits the Company from acquiring direct or indirect ownership or control of more than 5% of the voting shares of any company which is not a bank and from engaging in any business other than that of banking, managing and controlling banks or furnishing services to banks and their subsidiaries. This general prohibition is subject to a number of exceptions. The principal exception allows bank holding companies to engage in, and to own shares of companies engaged in, certain businesses found by the Federal Reserve to be “so closely related to banking as to be a proper incident thereto.” Under current regulations of the Federal Reserve, the Company either directly or through non-bank subsidiaries would be permitted to engage in a variety of banking-related businesses, including the operation of a thrift, sales and consumer finance, equipment leasing, the operation of a computer service bureau (including software development) and mortgage banking and brokerage. The BHCA generally does not place territorial restrictions on the domestic activities of non-bank subsidiaries of bank holding companies.

Federal law also prohibits any person from acquiring “control” of a bank holding company without prior notice to the appropriate federal bank regulator. “Control” is defined in certain cases as the acquisition of 10% or more of the outstanding shares of a bank or a bank holding company depending on the circumstances surrounding the acquisition.

Regulatory Capital Requirements. Bank holding companies are required to maintain minimum levels of capital in accordance with bank regulatory agencies' capital guidelines. If capital falls below minimum guideline levels, a bank holding company, among other things, may be denied approval to acquire or establish additional banks or non-bank businesses. The guidelines include requirements to maintain certain core capital amounts included as Tier 1 capital at minimum levels relative to total assets (the "Tier 1 Leverage Capital Ratio") and at minimum levels relative to "risk-weighted assets" which is calculated by assigning value to assets, and off balance sheet commitments, based on their risk characteristics (the "Total Risk-Based Capital Ratio"), and to maintain total capital at minimum levels relative to risk-weighted assets (the "Total Risk-Based Capital Ratio").

On January 1, 2015, the final rules of the Federal Reserve Board went into effect implementing in the United States the Basel III regulatory capital reforms from the Basel Committee on Banking Supervision. The final rule also adopted changes to the agencies’ regulatory capital requirements that meet the requirements of section 171 and section 939A of the Dodd-Frank Wall Street Reform and Consumer Protection Act. The rule includes a new Common Equity Tier 1 Capital Ratio, an increased Tier 1 Leverage Capital Ratio and an increased Tier 1 Risk-Based Capital Ratio. Bank holding companies are required to include in Common Equity Tier 1 capital the effects of other comprehensive income adjustments, such as gains and losses on securities held to maturity, that are currently excluded from the definition of Tier 1 capital, but were allowed to make a one-time election not to include those effects. The Company and the Bank meet the well-capitalized requirements under the regulatory framework for prompt corrective action and have made the one-time election to exclude the effects of other comprehensive income adjustments on Tier 1 capital. Under the BASEL III rules, the minimum capital ratios are 4% for Tier 1 Leverage Capital Ratio, 4.5% for the Common Equity Tier 1 Capital Ratio, 6% for the Tier 1 Risk-Based Capital Ratio and 8% for the Total Risk-Based Capital Ratio.

The Bank elected to use the Community Bank Leverage Ratio (CBLR) framework as provided for in the Economic Growth, Regulatory Relief and Consumer Protection Act. Under the CBLR framework, the Bank is required to maintain a CBLR of greater than 9%. As of December 31, 2023, the Company had regulatory capital in excess of the Federal Reserve’s minimum requirement, with a CBLR of 12.77%.

Dividends. The ability of the Company to pay dividends to its shareholders is dependent upon the earnings and capital adequacy of its subsidiary Bank, which directly impact the ability of the Bank to pay dividends to the Company. The Bank is subject to certain statutory and regulatory restrictions on the amount it may pay in dividends, which restrictions are discussed more thoroughly below. The Iowa Business Corporation Act (“IBCA”) allows the Company to make distributions, including cash dividends, to its shareholders unless, after giving effect to such distributions, either (i) the Company would not be able to pay its debts as they become due in the ordinary course of business or (ii) the Company’s total assets would be less than the sum of its total liabilities plus the amount that would be needed to satisfy preferential shareholder rights, if any, that are superior to the rights of those receiving the distribution. Additionally, the Federal Reserve has issued a policy statement with regard to the payment of cash dividends by bank holding companies. The policy statement provides that a bank holding company should not pay cash dividends which exceed its net income or which can only be funded in ways that weaken the bank holding company’s financial health, such as by borrowing. The Federal Reserve also possesses enforcement powers over bank holding companies and their non-bank subsidiaries to prevent or remedy actions that represent unsafe or unsound practices or violations of applicable statutes and regulations. Among these powers is the ability to proscribe the payment of dividends by banks and bank holding companies.

Federal Securities Regulation. The Company’s common stock is registered with the SEC under the Securities Exchange Act of 1934, as amended (the “Exchange Act”). Consequently, the Company is subject to the information, proxy solicitation, insider trading and other restrictions and requirements of the SEC under the Exchange Act.

Regulation of the Bank

General. The Bank is an Iowa-chartered bank, the deposit accounts of which are insured by the FDIC. As an Iowa-chartered, FDIC insured bank, the Bank is subject to the examination, supervision, reporting and enforcement requirements of the Superintendent of Banking of the State of Iowa (the “Superintendent”), as the chartering authority for Iowa banks, and the FDIC, as the Bank’s primary federal regulator.

Deposit Insurance. The deposits of the Bank are insured up to regulatory limits set by the FDIC, and, accordingly in 2023, were subject to deposit insurance assessments based on the Federal Deposit Insurance Reform Act of 2005, as adopted and effective on April 21, 2006. The FDIC maintains the Deposit Insurance Fund (“DIF”) by assessing depository institutions an insurance premium (assessment). The amount assessed to each institution is based on the average total assets of the Company less average tangible equity as well as the degree of risk the institution poses to the DIF. The FDIC assesses higher rates to those institutions that pose greater risks to the insurance fund.

In addition, all institutions with deposits insured by the FDIC are required to pay assessments to fund interest payments on bonds issued by the Financing Corporation (FICO), a mixed-ownership government corporation established in the 1980’s to recapitalize the Federal Savings and Loan Insurance Corporation. The current annualized assessment rate is 5.00 basis points.

Capital Requirements. The Bank is an insured state bank, incorporated under the laws of the state of Iowa. As such, the Bank is subject to regulation, supervision and periodic examination by the Superintendent. Among the requirements and restrictions imposed upon state banks by the Superintendent are the requirements to maintain reserves against deposits, restrictions on the nature and amount of loans, and restrictions relating to investments, opening of bank offices and other activities of state banks. Changes in the capital structure of state banks are also approved by the Superintendent. State banks must have a Tier 1 risk-based leverage ratio of 6.50% plus a fully-funded loan loss reserve. In certain instances, the Superintendent may mandate higher capital, but the Superintendent has not imposed such a requirement on the Bank. In determining the Tier 1 risk-based leverage ratio, the Superintendent uses total equity capital without unrealized securities gains and the allowance for credit losses less any intangible assets. At December 31, 2023, the Community Bank Leverage Ratio of the Bank was 12.82% and exceeded the ratio required by the Superintendent.

Capital adequacy for banks took on an added dimension with the establishment of a formal system of prompt corrective action under the Federal Deposit Insurance Corporation Improvement Act of 1991 (FDICIA) which provides the federal banking regulators of the Bank with broad power to take prompt corrective action to resolve the problems of undercapitalized banking institutions. The extent of the regulators’ powers depends on whether the institution in question is “well-capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” or “critically undercapitalized,” in each case as defined by regulation. Under prompt corrective action, banks that are inadequately capitalized face a variety of mandatory and discretionary supervisory actions. For example, “undercapitalized banks” must restrict asset growth, obtain prior approval for business expansion, and have an approved plan to restore capital. “Critically undercapitalized banks” must be placed in receivership or conservatorship within 90 days unless some other action would result in lower long-term costs to the deposit insurance fund.

The actual amounts of risk-based capital and risk-based capital ratios as of December 31, 2023 and the minimum regulatory requirements for the Company and the Bank are presented below (amounts in thousands):

Supervisory Assessments. All Iowa banks are required to pay supervisory assessments to the Superintendent to fund the Superintendent’s examination and supervision operations. The method of computation of the supervisory assessment is based on the assets of the bank, the expected hours needed to conduct examinations of that size bank and an additional amount if more work is required.

Community Investment and Consumer Protection Laws. The Community Reinvestment Act requires insured institutions to offer credit products and take other actions that respond to the credit needs of the community. Banks and other depository institutions also are subject to numerous consumer-oriented laws and regulations. These laws include the Truth in Lending Act, the Truth in Savings Act, the Real Estate Settlement Procedures Act, the Electronic Funds Transfer Act, the Equal Credit Opportunity Act, the Fair Credit Reporting Act and the Home Mortgage Disclosure Act.

The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (“Dodd-Frank Act”) posed a significant impact on financial regulations. The Dodd-Frank Act created an independent regulatory body, the Bureau of Consumer Financial Protection (“Bureau”), with authority and responsibility to set rules and regulations for most consumer protection laws applicable to all banks – large and small - which adds another regulator to scrutinize and police financial activities. The Bureau has responsibility for mortgage reform and enforcement, as well as broad new powers over consumer financial activities which could impact what consumer financial services would be available and how they are provided. The following consumer protection laws are the designated laws that fall under the Bureau’s rulemaking authority: the Alternative Mortgage Transactions Parity Act of 1928, the Consumer Leasing Act of 1976, the Electronic Fund Transfer Act, the Equal Credit Opportunity Act, the Fair Credit Billing Act, the Fair Credit Reporting Act subject to certain exclusions, the Fair Debt Collection Practices Act, the Home Owners Protection Act, certain privacy provisions of the Gramm-Leach-Bliley Act, the Home Mortgage Disclosure Act (HMDA), the Home Ownership and Equity Protection Act of 1994, the Real Estate Settlement Procedures Act (RESPA), the S.A.F.E. Mortgage Licensing Act of 2008 (SAFE Act), and the Truth in Lending Act.

Dividends. The ability of the Company to pay dividends to its stockholders is dependent upon dividends paid by the Bank. The Bank is subject to certain statutory and regulatory restrictions on the amount it may pay in dividends. The Iowa Banking Act provides that an Iowa bank may not pay dividends in an amount greater than its undivided profits. The payment of dividends by any financial institution or its holding company is affected by the requirement to maintain adequate capital pursuant to applicable capital adequacy guidelines and regulations, and a financial institution generally is prohibited from paying any dividends if, following payment thereof, the institution would be undercapitalized. As described above, the Bank exceeded its minimum capital requirements under applicable guidelines as of December 31, 2023. Notwithstanding the availability of funds for dividends, however, the Superintendent may prohibit the payment of any dividends by the Bank if the Superintendent determines such payment would constitute an unsafe or unsound practice. To maintain acceptable capital ratios in the Bank, certain of its retained earnings are not available for the payment of dividends. To maintain a ratio of total risk-based capital to assets of 9.0%, $161.36 million of the Bank’s Tier 1 capital of $541.57 million as of December 31, 2023, is available for the payment of dividends to the Company. Also, the capital conservation buffer discussed previously could limit the amount of payment of dividends if the Company fails to maintain required capital levels.

Insider Transactions. The Bank is subject to certain restrictions imposed by federal law on extensions of credit to the Company, on investments in the stock or other securities of the Company and the acceptance of the stock or other securities of the Company as collateral for loans. Certain limitations and reporting requirements are also placed on extensions of credit by the Bank to its directors and officers, to directors and officers of the Company and its subsidiary, to principal stockholders of the Company, and to related interests of such directors, officers and principal stockholders. In addition, federal law and regulations may affect the terms upon which any person becoming a director or officer of the Company or one of its subsidiaries or a principal stockholder of the Company may obtain credit from banks with which the Bank maintains a correspondent relationship.

Safety and Soundness Standards. The federal banking agencies have adopted guidelines that establish operational and managerial standards to promote the safety and soundness of federally insured depository institutions. The guidelines set forth standards for internal controls, information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, compensation, fees and benefits, asset quality and earnings.

In general, the safety and soundness guidelines prescribe the goals to be achieved in each area, and each institution is responsible for establishing its own procedures to achieve those goals. If an institution fails to comply with any of the standards set forth in the guidelines, the institution’s primary federal regulator may require the institution to submit a plan for achieving and maintaining compliance. If an institution fails to submit an acceptable compliance plan, or fails in any material respect to implement a compliance plan that has been accepted by its primary federal regulator, the regulator is required to issue an order directing the institution to cure the deficiency. Until the deficiency cited in the regulator’s order is cured, the regulator may restrict the institution’s rate of growth, require the institution to increase its capital, restrict the rates the institution pays on deposits or require the institution to take any action the regulator deems appropriate under the circumstances. Noncompliance with the standards established by the safety and soundness guidelines may also constitute grounds for other enforcement action by the federal banking regulators, including cease and desist orders and civil money penalty assessments.

Branching Authority. Historically, Iowa’s intrastate branching statutes have been rather restrictive when compared with those of other states. Effective July 1, 2004, all limitations on bank office locations were repealed, which effectively allowed statewide branching. Since that date, banks have been allowed to establish an unlimited number of offices in any location in Iowa subject only to regulatory approval.

Under the Riegle-Neal Act, both state and national banks are allowed to establish interstate branch networks through acquisitions of other banks, subject to certain conditions including limitations on the aggregate amount of deposits that may be held by the surviving bank and all of its insured depository institution affiliates. The establishment of new interstate branches or the acquisition of individual branches of a bank in another state (rather than the acquisition of an out-of-state bank in its entirety) is allowed by the Riegle-Neal Act only if specifically authorized by state law. Iowa permits interstate bank mergers, subject to certain restrictions, including a prohibition against interstate mergers involving an Iowa bank that has been in existence and continuous operation for fewer than five years.

State Bank Activities. Under federal law and FDIC regulations, FDIC insured state banks are prohibited, subject to certain exceptions, from making or retaining equity investments of a type, or in an amount, that are not permissible for a national bank. Federal law and FDIC regulations also prohibit FDIC insured state banks and their subsidiaries, subject to certain exceptions, from engaging as principal in any activity that is not permitted for a national bank or its subsidiary, respectively, unless the Bank meets, and continues to meet, its minimum regulatory capital requirements and the FDIC determines the activity would not pose a significant risk to the deposit insurance fund of which the Bank is a member. These restrictions have not had, and are not currently expected to have, a material impact on the operations of the Bank.

Financial Privacy. In accordance with the Gramm-Leach-Bliley Financial Modernization Act of 1999 (the “GLB Act”), federal banking regulators adopted rules that limit the ability of banks and other financial institutions to disclose non-public information about consumers to non-affiliated third parties. These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a non-affiliated third party. The privacy provisions of the GLB Act affect how consumer information is transmitted through diversified financial companies and conveyed to outside vendors.

Anti-Money Laundering Initiatives and the USA Patriot Act. A major focus of governmental policy on financial institutions has been aimed at combating money laundering and terrorist financing. The USA PATRIOT Act of 2001 (the “USA Patriot Act”) substantially broadened the scope of United States anti-money laundering laws and regulations by imposing significant new compliance and due diligence obligations, creating new crimes and penalties and expanding the extra-territorial jurisdiction of the United States. The U.S. Treasury Department has issued a number of regulations that apply various requirements of the USA Patriot Act to financial institutions such as the Bank. These regulations impose obligations on financial institutions to maintain appropriate policies, procedures and controls to detect, prevent and report money laundering and terrorist financing and to verify the identity of their customers. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal and reputational consequences for the institution.

Depositor Preference Statute. In the "liquidation or other resolution" of an institution by any receiver, U.S. federal legislation provides that deposits and certain claims for administrative expenses and employee compensation against the insured depository institution would be afforded a priority over general unsecured claims against that institution, including federal funds and letters of credit.

Government Monetary Policy. The earnings of the Company are affected primarily by general economic conditions and to a lesser extent by the fiscal and monetary policies of the federal government and its agencies, particularly the Federal Reserve. Its policies influence, to some degree, the volume of bank loans and deposits, and interest rates charged and paid thereon, and thus have an effect on the earnings of the Company's subsidiary Bank.

Dodd-Frank Wall Street Reform and Consumer Protection Act. The Dodd-Frank Act was signed into law on July 21, 2010. The Dodd-Frank Act represents the most sweeping financial services industry reform since the 1930s. Generally, the Dodd-Frank Act is effective the day after it was signed into law, but different effective dates apply to specific sections of the Dodd-Frank Act. The Dodd-Frank Act was expected to be fully phased in over several years. Among other things, the Dodd-Frank Act may result in added costs of doing business and regulatory compliance burdens and affect competition among financial services entities. Uncertainty exists as to the ultimate impact of many provisions of the Dodd-Frank Act, which could have a material adverse impact on the financial services industry as a whole and on the Company’s business, results of operations and financial condition. Additional information, including a summary of certain provisions of the Dodd-Frank Act, is available on the Federal Deposit Insurance Corporation website at www.fdic.gov/regulations/reform/dfa_selections.html.