HILLS BANCORPORATION

Index

The Company carried out an evaluation, under the supervision and with the participation of the Company’s management, including the Company’s Principal Executive Officer and Chief Financial Officer, of the effectiveness of the design and operation of the Company’s disclosure controls and procedures as defined in Rule 13a-15(e) under the Securities Exchange Act of 1934, as amended (the “Exchange Act”). Based upon that evaluation, the Company’s Principal Executive Officer and Chief Financial Officer concluded that as a result of the material weaknesses in internal control over financial reporting initially identified in “Management’s Report on Internal Control over Financial Reporting” for the year ended December 31, 2024, and described below, the Company's disclosure controls and procedures were not effective as of September 30, 2025. Material weaknesses in internal controls over financial reporting, which impacted managements' determination regarding the Company's disclosure controls and procedures, were identified in the following areas:

•management review and activity-level controls over the period-end financial reporting process;

•the segregation of duties, review, posting, and approval of manual journal entries; and

•the identification, prior approval, and disclosure of related party transactions.

Changes in Internal Control over Financial Reporting

Except as otherwise discussed above, there were no changes in our internal controls over financial reporting during the most recently completed fiscal quarter that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting, including any corrective actions with regard to the control deficiencies that led to the material weaknesses in the Company’s internal controls over financial reporting identified above.

The effectiveness of our disclosure controls and procedures and our internal control over financial reporting is subject to various inherent limitations, including cost limitations, judgments used in decision making, assumptions about the likelihood of future events, the soundness of our systems, the possibility of human error, and the risk of fraud. Moreover, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions and the risk that the degree of compliance with policies or procedures may deteriorate over time. Because of these limitations, any system of disclosure controls and procedures or internal controls over financial reporting may not be successful in preventing all errors or fraud or in making all material information known in a timely manner to the appropriate levels of management.

Remediation Plan

The Company has initiated certain remedial measures to strengthen its controls as a result of the material weaknesses noted above. These include continued review of the overall design of its internal control environment, as well as the design and implementation of additional internal controls over the specific areas where material weaknesses were identified as detailed above. The Company has engaged a third party consultant to assist in performing a gap analysis of the control environment and enhancing the design and operation of controls related to financial reporting. The actions the Company is taking under its remediation plan are subject to ongoing management review and are also subject to Audit Committee oversight.

Each material weakness identified above cannot be considered remediated until the applicable remedial controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively.

PART II - OTHER INFORMATION