First Bancorp Inc ME

Overview

The First Bancorp, Inc. (the "Company") was incorporated under the laws of the State of Maine on January 15, 1985, for the purpose of becoming the parent holding company of The First National Bank of Damariscotta, which was chartered as a national bank under the laws of the United States on May 30, 1864. At the Company's Annual Meeting of Shareholders on April 30, 2008, the Company's name was changed from First National Lincoln Corporation to The First Bancorp, Inc.

On January 14, 2005, the acquisition of FNB Bankshares ("FNB") of Bar Harbor, Maine, was completed, adding seven banking offices and one investment management office in Hancock and Washington counties of Maine. FNB's subsidiary, The First National Bank of Bar Harbor, was merged into The First National Bank of Damariscotta at closing, and from January 31, 2005 until January 28, 2016, the combined banks operated under the name: The First, N.A. On January 28, 2016, the Board of Directors voted to change the name of The First, N.A. to First National Bank (the "Bank").

On December 11, 2020, the Bank completed the purchase of a branch at 1B Belmont Avenue in Belfast, Maine, from Bangor Savings Bank ("Bangor Savings"). The branch is one of six branches Bangor Savings acquired from Damariscotta Bank & Trust Company ("DB&T"), and this branch was divested by Bangor Savings to resolve competitive concerns in that market raised by the U.S. Department of Justice's Antitrust Division. As part of the transaction, the Bank acquired approximately $23 million in loans and assumed approximately $19 million in deposits. The transaction value was approximately $25.2 million consisting of the loans, building, equipment, core deposit intangible, and goodwill.

On January 31, 2022 the Bank opened a de novo branch office in Brewer, Maine. The Brewer office raised the Bank's branch location count to eighteen, and became its second branch in Penobscot County.

As of December 31, 2023, the Company's securities consisted of one class of common stock. At that date, there were 11,098,057 shares of common stock outstanding.

The common stock of the Bank is the principal asset of the Company, which has no other subsidiaries. The Bank's capital stock consists of one class of common stock, of which 290,069 shares, par value $2.50 per share, are issued and outstanding. All of the Bank's common stock is owned by the Company.

First National Bank: The Bank emphasizes personal service, and its customers are primarily small businesses and individuals to whom the Bank offers a wide variety of services, including deposit accounts and consumer, commercial and mortgage loans. The Bank continually evolves its processes and adapts to new technologies, but has not made any material changes in its mode of conducting business during the past five years. The banking business in the Bank's Mid-Coast and Eastern Maine market area is subject to modest seasonal fluctuations typically consisting of lower deposits in the winter and spring and higher deposits in the summer and fall. This fluctuation is predictable and has not had a materially adverse effect on the Bank.

In addition to traditional banking services, the Company provides investment management and private banking services through First National Wealth Management, which is an operating division of the Bank. First National Wealth Management offers a comprehensive array of private banking, financial planning, investment management and trust services to individuals, businesses, non-profit organizations and municipalities of varying asset size, and to provide the highest level of personal service. The staff includes investment and trust professionals with extensive experience. In 2019, the Bank introduced First National Investment Services. Through a partnership with a third party provider, First National Investment Services offers additional products such as brokerage, annuity products and certain types of insurance.

Competition: The financial services landscape has continued to evolve over the past five years. Within the Bank's primary market area, Maine-based community banks are the primary competitors for wallet share. Large out-of-state banks continue to be a presence; adoption rates for online and mobile banking increased during the COVID-19 pandemic and further opened the market to new forms of competition. Credit unions have continued to expand their membership and the scope of banking services offered. Non-banking entities such as brokerage houses, mortgage companies and insurance companies are offering very competitive products. Many of these entities and institutions have resources substantially greater than those available to the Bank and in some cases are not subject to the same regulatory restrictions as are the Company and the Bank.

The Company believes that there will continue to be a need for a bank in the Bank's primary market area with local management having decision-making power and emphasizing loans to small and medium-sized businesses and to individuals. The Bank has concentrated on extending business loans to such customers in the Bank's primary market area and to extending investment and trust services to clients with accounts of all sizes. Investment continues to be made in enhancing the Bank’s online and mobile offerings to both enhance service delivery and provide additional channels for customers to conduct business with the Bank. Additional investment has been made in new software platforms for commercial and residential lending. Management also makes decisions based upon, among other things, the knowledge of the Bank's employees regarding the communities and customers in the Bank's primary market area. The individuals employed by the Bank, to a large extent, reside near the branch offices and thus are generally familiar with their communities and customers. This is important in local decision-making and allows the Bank to respond to customer questions and concerns on a timely basis and fosters quality customer service.

The Bank has worked and will continue to work to position itself to be competitive in its market area. The Bank's ability to make decisions close to the marketplace, Management's commitment to providing quality banking products, the caliber of the

The First Bancorp - 2023 Form 10-K - Page 1 professional staff, and the community involvement of the Bank's employees are all factors affecting the Bank's ability to be competitive.

Investor Relations: The Company maintains a website accessed via https://investors.thefirst.com where it makes available, free of charge, its annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended, as well as all Section 16 reports on Forms 3, 4, and 5, as soon as reasonably practicable after such reports are electronically filed with, or furnished to, the SEC. The Company's reports filed with, or furnished to, the SEC are also available at the SEC's website at www.sec.gov. Information contained on the Company's website does not constitute a part of this report. Beginning with the third quarter of 2018, the Company adopted inline XBRL. Interactive reports for our 10-K and 10-Q filings are available in iXBRL format at www.sec.gov.

Customer Information Security: The FDIC, the OCC and other bank regulatory agencies have published guidelines (the "Guidelines") establishing standards for safeguarding nonpublic personal information about customers that implement provisions of the Gramm-Leach-Bliley Act (the "GLBA"). Among other things, the Guidelines require each financial institution, under the supervision and ongoing oversight of its Board of Directors or an appropriate committee thereof, to develop, implement and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information, to protect against any anticipated threats or hazards to the security or integrity of such information, and to protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer.

Protecting the privacy of our customers’ information as well as the security of the Bank’s systems and networks has long been and will continue to be a priority. The Board is committed to maintaining strong and meaningful privacy and security protections for our customers’ information. For additional information, see Item 1C. "Cybersecurity" for a discussion of our cybersecurity risk management and strategy, and oversight of risks from cybersecurity threats.

Human Capital

At December 31, 2023, the Company had 275 employees and full-time equivalency of 271 employees. Most employees live and work in the State of Maine, with a limited number of employees working remotely outside of Maine.

Talent Acquisition: To effectively operate, the Company requires employees with a variety of skill sets including customer service delivery, analytical ability, leadership, sales acumen and technical expertise. To attract new employees, the Company considers qualified applicants from all sources. Additionally, to both attract and retain employees the Company offers a combination of competitive pay and benefits. Eligible full-time employees and part-time employees who are scheduled to work at least 30 hours per week are provided a flexible benefit plan which includes group life, health, short and long-term disability insurance. Other benefits include paid vacation, paid sick and personal time and a 401(k) defined contribution plan for eligible employees. The Company participates in annual salary surveys to ensure wages are competitive in the local market, and since 1994 has offered a comprehensive, annual incentive compensation plan to all employees.

Diversity and Inclusion: The Company believes that our people are our most valuable asset. The collective sum of the individual differences, life experiences, knowledge, inventiveness, innovation, self-expression, unique capabilities, and talent that our employees invest in their work represents a significant part of not only our culture, but our reputation and the Company's achievement as well. We are committed to fostering, cultivating, and preserving a culture of diversity, equity and inclusion, both in our employee base and on our Board of Directors. Valuing diversity and inclusiveness enables us to achieve our corporate mission and creates value for our customers, employees, business partners and shareholders.

Discrimination on the grounds of race, color, religion, sex, sexual orientation, gender identity, age, national origin, physical or mental disability, or other legally protected status is prohibited. This policy of non-discrimination applies to all terms, conditions and privileges of employment including, but not limited to, hiring, employment training, placement, employee development, promotion, transfer, compensation and benefits. This policy also applies to such areas as educational assistance, employee layoff and recall, social and recreational programs, employee facilities and employee termination.

The Bank has in place a written Affirmative Action program to achieve full utilization of minorities, the handicapped, disabled veterans, Vietnam era veterans, and women at all levels of employment and in all segments of the work force. Through the ongoing development of this plan, we not only comply with appropriate government regulations but also strive to make the best personnel decisions for our Company and our communities.

Professional Development: Employee development is emphasized and extensive training and development opportunities are provided. Opportunities made available to employees may include participation in industry seminars, industry certificate programs, and advanced industry education at regional or national banking schools. The Company has also developed an in-

The First Bancorp - 2023 Form 10-K - Page 2 house program targeted to the development of future leaders. Managers conduct periodic coaching meetings with all employees to review progress towards annual goals, and identify areas of opportunity or performance improvement. Formal performance evaluations are conducted semi-annually. Our Education & Training department includes a Development Associate position whose role is to ensure all employees are provided with development plans that meet their current and future career needs.

Employee Engagement: The Company recognizes that employees who are involved in, enthusiastic about and committed to their work and workplace contribute meaningfully to the success of the Company. The Company solicits employee feedback through a confidential web portal and periodically surveys employees on various topics of interest. We maintain human resources and other policies, including a harassment policy, to promote a workplace that is safe for all and provide a mechanism where our employees feel they can report incidents that run counter to our policies and the positive culture we endeavor to maintain. In addition, we have a confidential whistleblower program that forwards complaints to the Chair of the Audit Committee of the Board of Directors, and we work to take necessary action as quickly as possible should a complaint be received. A confidential survey designed to measure employee engagement was conducted on the Company's behalf by a third party provider in the fourth quarter of 2023. Results indicated an above average level of engagement amongst the employee base.

Succession Planning: The Company views succession planning as a priority and incorporates it into the strategic planning process. Succession plans are updated annually for all management roles, and leverages the Company's various development programs to clearly identify both short and long-term successors for each position.

Supervision and Regulation

The Company is a financial holding company within the meaning of the Bank Holding Company Act of 1956, as amended (the "BHC Act"), and section 225.82 of Regulation Y issued by the Board of Governors of the Federal Reserve System (the "Federal Reserve Board" or "FRB"), and is required to file with the Federal Reserve Board an annual report and other information required pursuant to the BHC Act. The Company is subject to examination by the Federal Reserve Board. Virtually all of the Company's cash revenues are generally derived from dividends paid to the Company by the Bank. These dividends are subject to various legal and regulatory restrictions which are summarized in Note 18 to the accompanying financial statements. The Bank is regulated by the Office of the Comptroller of the Currency (the "OCC") and is subject to the provisions of the National Bank Act. As a result, it must meet certain liquidity and capital requirements, which are discussed in the following sections.

General: As a financial holding company, the Company is subject to regulation under the BHC Act and to inspection, examination and supervision by its primary regulator, the FRB. The Company is also subject to the disclosure and regulatory requirements of the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended, both as administered by the Securities and Exchange Commission (the "SEC"). As a company with securities listed on the NASDAQ, the Company is subject to the rules of the NASDAQ for listed companies. The Bank is subject to regulation and examination primarily by the OCC and is subject to the regulations of the Federal Deposit Insurance Corporation (the "FDIC").

Bank Holding Company Activities: As a bank holding company ("BHC") that has elected to become a financial holding company pursuant to the BHC Act, we may affiliate with securities firms and insurance companies and engage in other activities that are financial in nature or incidental or complementary to activities that are financial in nature. "Financial in nature" activities include securities underwriting, dealing and market making; sponsoring mutual funds and investment companies; insurance underwriting and agency; merchant banking; and activities that the FRB, in consultation with the Secretary of the U.S. Treasury, determines to be financial in nature or incidental to such financial activity. "Complementary activities" are activities that the FRB determines upon application to be complementary to a financial activity and do not pose a safety and soundness risk.

FRB approval is not generally required for us to acquire a company (other than a bank holding company, bank or savings association) engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the FRB. Prior FRB approval is required before we may acquire the beneficial ownership or control of more than 5% of the voting shares or substantially all of the assets of a bank holding company, bank or savings association.

Because we are a financial holding company, if the Bank receives a rating under the Community Reinvestment Act of 1977, as amended (the "CRA"), of less than satisfactory, the Bank and/or the Company will be prohibited, until the rating is raised to satisfactory or better, from engaging in new activities or acquiring companies other than bank holding companies, banks or savings associations, except that we could engage in new activities, or acquire companies engaged in activities, that are closely related to banking under the BHC Act. On October 24, 2023 the OCC, the FRB, and the FDIC issued a joint final rule to strengthen and modernize regulations implementing the CRA which had last had major revisions in 1995. The new rule becomes effective on April 1, 2024 with compliance required starting January 1, 2026. The Bank is actively reviewing the final rule in anticipation of the compliance date. In addition, if the FRB finds that the Bank is not well capitalized or well managed, we would be required to enter into an agreement with the FRB to comply with all applicable capital and management requirements and which may contain additional limitations or conditions. Until corrected, we could be prohibited from

The First Bancorp - 2023 Form 10-K - Page 3 engaging in any new activity or acquiring companies engaged in activities that are not closely related to banking under the BHC Act without prior FRB approval. If we fail to correct any such condition within a prescribed period, the FRB could order us to divest our banking subsidiaries or, in the alternative, to cease engaging in activities other than those closely related to banking under the BHC Act.

In determining whether to approve a proposed bank acquisition, federal bank regulators will consider, among other factors, the effect of the acquisition on competition, financial condition, and future prospects including current and projected capital ratios and levels, the competence, experience, and integrity of management and record of compliance with laws and regulations, the convenience and needs of the communities to be served, including the acquiring institution's record of compliance under the CRA, the effectiveness of the acquiring institution in combating money laundering activities and the risk to the stability of the United States banking system.

The Company is a legal entity separate and distinct from the Bank. The primary source of funds to pay dividends on our common stock is dividends from the Bank. Various federal and state statutory provisions and regulations limit the amount of dividends the Bank may pay without regulatory approval. Federal bank regulatory agencies have the authority to prohibit the Bank from engaging in unsafe or unsound practices in conducting its business. The payment of dividends, depending on the financial condition of the Bank, could be deemed an unsafe or unsound practice. The ability of the Bank to pay dividends in the future is currently, and could be further, influenced by bank regulatory policies and capital guidelines.

The Bank is subject to restrictions under federal law that limit the transfer of funds or other items of value from a subsidiary to the Company and any nonbank subsidiaries (including affiliates) in so-called "covered transactions." In general, covered transactions include loans and other extensions of credit, investments and asset purchases, as well as certain other transactions involving the transfer of value from a subsidiary bank to an affiliate or for the benefit of an affiliate. Unless an exemption applies, covered transactions by a subsidiary bank with a single affiliate are limited to 10% of the subsidiary bank's capital and surplus and, with respect to all covered transactions with affiliates in the aggregate, to 20% of the subsidiary bank's capital and surplus. Also, loans and extensions of credit to affiliates generally are required to be secured by qualifying collateral. A bank's transactions with its nonbank affiliates are also generally required to be on arm's-length terms.

The FRB has a policy that a BHC is expected to act as a source of financial and managerial strength to each of its subsidiary banks and, under appropriate circumstances, to commit resources to support each such subsidiary bank. This support may be required at times when the BHC may not have the resources to provide the support. The OCC may order an assessment of the BHC if the capital of one of its national bank subsidiaries were to become impaired. If the BHC failed to pay the assessment within three months, the OCC could order the sale of the BHC's holdings of stock in the national bank to cover the deficiency.

In the event of the "liquidation or other resolution" of an insured depository institution, the claims of depositors payable in the United States (including the claims of the FDIC as subrogee of insured depositors) and certain claims for administrative expenses of the FDIC as a receiver will have priority over other general unsecured claims against the institution. If an insured depository institution fails, claims of insured and uninsured U.S. depositors, along with claims of the FDIC, will have priority in payment ahead of unsecured creditors, including the BHC, and depositors whose deposits are solely payable at such insured depository institution's non-U.S. offices.

Capital Requirements: The Company and the Bank are subject to risk-based capital requirements and rules issued by the FRB, the OCC and the FDIC (the “Capital Rules”) that are based on the Basel Committee on Banking Supervision’s (“Basel Committee”) framework for strengthening capital and liquidity regulation (referred to as Basel III). If a banking organization's capital levels fall below the minimum requirements established by the Capital Rules, a bank or BHC will be expected to develop and implement a plan acceptable to its regulators to achieve adequate levels of capital within a reasonable period, and may be denied approval to acquire or establish additional banks or non-bank businesses, merge with other institutions or open branch facilities until such capital levels are achieved. Federal regulations require federal bank regulators to take "prompt corrective action" with respect to insured depository institutions that fail to satisfy minimum capital requirements, and to impose significant restrictions on such institutions. See "Prompt Corrective Action" below.

Leverage Capital Ratio: The regulations of the OCC require national banks to maintain a minimum "Leverage Capital Ratio" or ratio of "Tier 1 Capital" (as defined in the Risk-Based Capital Guidelines discussed in the following paragraphs) to Total Assets of 4.0%. Any bank experiencing or anticipating significant growth is expected to maintain capital well above the minimum levels. The Federal Reserve Board's guidelines impose substantially similar leverage capital requirements on BHCs on a consolidated basis. It is possible that banking regulators may increase minimum capital requirements for banks should economic conditions worsen.

Risk-Based Capital Requirements: OCC regulations also require national banks to maintain minimum capital levels as a percentage of a bank's risk-adjusted assets. A bank's qualifying total capital ("Total Capital") for this purpose may include two components: "Core" (Tier 1) Capital and "Supplementary" (Tier 2) Capital; Tier 1 Capital is further broken down in the Capital Rules to Common Equity Tier 1 (CET1) and Additional Tier 1 Capital (AT1). Core Capital consists primarily of common stockholders' equity, which generally includes common stock, related surplus and retained earnings, certain non-cumulative perpetual preferred stock and related surplus, and minority interests in the equity accounts of consolidated subsidiaries, and

The First Bancorp - 2023 Form 10-K - Page 4

(subject to certain limitations) mortgage servicing rights and purchased credit card relationships, less all other intangible assets (primarily goodwill). Neither the Company nor the Bank carries any capital items that would be considered AT1, thus CET1 and Tier 1 Capital for the Company and the Bank are equal. Supplementary Capital elements include, subject to certain limitations, a portion of the allowance for credit losses, perpetual preferred stock that does not qualify for inclusion in Tier 1 capital, long-term preferred stock with an original maturity of at least 20 years and related surplus, certain forms of perpetual debt and mandatory convertible securities, and certain forms of subordinated debt and intermediate-term preferred stock.

The risk-based capital rules assign the majority of a bank's balance sheet assets and the credit equivalent amounts of the bank's off-balance sheet obligations to one of four risk categories, weighted at 0%, 20%, 50% or 100%, as applicable. A small amount of assets and off-balance sheet obligations are assigned a risk weight above 100%. Applying these risk-weights to each category of the bank's balance sheet assets and to the credit equivalent amounts of the bank's off-balance sheet obligations and summing the totals results in the amount of the bank's total Risk-Weighted Assets (RWAs) for purposes of the risk-based capital requirements. RWAs for institutions such as the Bank will generally be less than reported balance sheet assets because its retail banking activities include proportionally more residential mortgage loans, many of its investment securities have a low risk weighting and there is a relatively small volume of off-balance sheet obligations.

The risk-based capital regulations require all banks to maintain a minimum ratio of CET1 to RWAs of 4.5%, CET1 plus AT1 to RWAs of 6.0%, and Total Capital to Risk-Weighted Assets of 8.0%, of which at least one-half (4.0%) must be Core (Tier 1) Capital. For the purpose of calculating these ratios: (i) a banking organization's Supplementary Capital eligible for inclusion in Total Capital is limited to no more than 100% of Core Capital; and (ii) the aggregate amount of certain types of Supplementary Capital eligible for inclusion in Total Capital is further limited. For example, the regulations limit the portion of the allowance for credit losses eligible for inclusion in Total Capital to 1.25% of Risk-Weighted Assets. The Federal Reserve Board has established substantially identical risk-based capital requirements, which are applied to BHCs on a consolidated basis. The risk-based capital regulations explicitly provide for the consideration of interest rate risk in the overall evaluation of a bank's capital adequacy to ensure that banks effectively measure and monitor their interest rate risk, and that they maintain capital adequate for that risk. A bank deemed by its federal banking regulator to have excessive interest rate risk exposure may be required to maintain additional capital (that is, capital in excess of the minimum ratios discussed above). The Bank believes, based on its level of interest rate risk exposure, that this provision will not have a material adverse effect on it.

Additionally, the Capital Rules require an institution to establish a capital conservation buffer of CET1 capital in an amount above the minimum risk-based capital requirements for “adequately capitalized” institutions equal to 2.5% of total RWA, resulting in a requirement for the Company and the Bank effectively to maintain CET1, Tier 1 and total capital ratios of 7%, 8.5% and 10.5%, respectively. Banking institutions with a ratio of CET1 capital to RWA above the minimum requirement but below the capital conservation buffer face restrictions on the ability to pay dividends, pay discretionary bonuses, and to engage in share repurchases based on the amount of the shortfall and the institution’s “eligible retained income” (the greater of (i) net income for the preceding four quarters, net of distributions and associated tax effects not reflected in net income and (ii) average net income over the preceding four quarters).

On December 31, 2023, the Company's consolidated Total Capital Ratio was 13.66%, its CET1 and Tier 1 ratios were 12.42%, and its Leverage Capital Ratio was 8.61%. Based on the above figures and accompanying discussion, the Company exceeds all regulatory capital requirements and is considered well capitalized.

Prompt Corrective Action: The Federal Deposit Insurance Corporation Improvement Act of 1991 ("FDICIA") requires, among other things, that federal banking regulators take "prompt corrective action" with respect to, and impose significant restrictions on, any bank that fails to satisfy its applicable minimum capital requirements. FDICIA establishes five capital categories consisting of "well capitalized," "adequately capitalized," "undercapitalized," "significantly undercapitalized" and "critically undercapitalized." Under applicable regulations, a bank that has a Total Risk-Based Capital Ratio of 10.0% or greater, a Tier 1 Risk-Based Capital Ratio of 8.0% or greater, a CET1 ratio of 6.5% or greater, and a Leverage Capital Ratio of 5.0% or greater, and is not subject to any written agreement, order, capital directive or prompt corrective action directive to meet and maintain a specific capital level for any capital measure, is deemed to be "well capitalized." A bank that has a Total Risk-Based Capital Ratio of 8.0% or greater, a Tier 1 Risk-Based Capital Ratio of 6.0%, a CET1 ratio of 4.5%, or greater and a Leverage Capital Ratio of 4.0% or greater and does not meet the definition of a well-capitalized bank is considered to be "adequately capitalized." A bank that has a Total Risk-Based Capital Ratio of less than 8.0%, or has a Tier 1 Risk-Based Capital Ratio that is less than 6.0%, or a CET1 ratio of less than 4.5%, or a Leverage Capital Ratio of less than 4.0% is considered "undercapitalized." A bank that has a Total Risk-Based Capital Ratio of less than 8.0%, or a Tier 1 Risk-Based Capital Ratio that is less than 4.0%, or a CET1 ratio of less than 3.0%, or a Leverage Capital Ratio that is less than 3.0% is considered to be "significantly undercapitalized," and a bank that has a ratio of tangible equity to total assets equal to or less than 2% is deemed to be "critically undercapitalized." A bank may be deemed to be in a capital category lower than is indicated by its actual capital position if it is determined to be in an unsafe or unsound condition or receives an unsatisfactory examination rating. FDICIA generally prohibits a bank from making capital distributions (including payment of dividends) or paying management fees to controlling stockholders or their affiliates if, after such payment, the bank would be undercapitalized.

Under FDICIA and the applicable implementing regulations, an undercapitalized bank will be (i) subject to increased monitoring by its primary federal banking regulator; (ii) required to submit to its primary federal banking regulator an acceptable capital restoration plan (guaranteed, subject to certain limits, by the bank's holding company) within 45 days of

The First Bancorp - 2023 Form 10-K - Page 5 being classified as undercapitalized; (iii) subject to strict asset growth limitations; and (iv) required to obtain prior regulatory approval for certain acquisitions, transactions not in the ordinary course of business, and entries into new lines of business. In addition to the foregoing, the primary federal banking regulator may issue a "prompt corrective action directive" to any undercapitalized institution. Such a directive may (i) require sale or re-capitalization of the bank; (ii) impose additional restrictions on transactions between the bank and its affiliates; (iii) limit interest rates paid by the bank on deposits; (iv) limit asset growth and other activities; (v) require divestiture of subsidiaries; (vi) require replacement of directors and officers; and (vii) restrict capital distributions by the bank's parent holding company. In addition to the foregoing, a significantly undercapitalized institution may not award bonuses or increases in compensation to its senior executive officers until it has submitted an acceptable capital restoration plan and received approval from its primary federal banking regulator.

No later than 90 days after an institution becomes critically undercapitalized, the primary federal banking regulator for the institution must appoint a receiver or, with the concurrence of the FDIC, a conservator, unless the agency, with the concurrence of the FDIC, determines that the purpose of the prompt corrective action provisions would be better served by another course of action. FDICIA requires that any alternative determination be "documented" and reassessed on a periodic basis. Notwithstanding the foregoing, a receiver must be appointed after 270 days unless the appropriate federal banking agency and the FDIC certify that the institution is viable and not expected to fail.

Cyber-Security Incident Disclosure: In November 2021, the U.S. bank regulatory agencies adopted a joint final rule regarding notification requirements for banking organizations related to significant computer security incidents. Under the final rule, bank holding companies and national banks, such as the Company and the Bank, are required to notify the FRB or OCC, respectively, within 36 hours of incidents that have materially disrupted or degraded, or are reasonably likely to materially disrupt or degrade the banking organization’s ability to deliver services to a material portion of its customer base, or jeopardize the viability of key operations of the banking organization. In July 2023, the SEC adopted a final rule requiring registrants, like the Company, to disclose material cybersecurity incidents they experience via a Current Report on Form 8-K. Disclosure is required within four business days of a cybersecurity incident being determined to be material. For additional information, see Item 1C. "Cybersecurity" for a discussion of our cybersecurity risk management and strategy and oversight of risks from cybersecurity threats.

Other

Dodd-Frank Wall Street Reform and Consumer Protection Act: The Dodd-Frank Act, enacted on July 21, 2010, resulted in broad changes to the U.S. financial system and was the most significant financial reform legislation enacted since the 1930s. The Dodd-Frank Act has affected, and we expect it will continue to affect, most of our business in some way, either directly through regulation of specific activities or indirectly through regulation of concentration risks, capital and liquidity. A number of reforms to the Dodd-Frank Act were included in S.2155, passed in May 2018, however most were targeted for financial institutions smaller than the Company.

The Dodd-Frank Act established the Consumer Financial Protection Bureau (the “CFPB”) to ensure consumers receive clear and accurate disclosures regarding financial products and to protect consumers from hidden fees and unfair or abusive practices. The CFPB concentrated much of its initial rule-making efforts on mortgage lending related topics required under the Act, including ability-to-repay, qualified mortgage standards, mortgage servicing standards, loan originator compensation, high-cost mortgage requirements and appraisal and escrow requirements for higher priced mortgage loans.

Deposit Insurance Assessments: The Bank is a member of the Deposit Insurance Fund ("DIF") maintained by the FDIC. Through the DIF, the FDIC insures the deposits of the Bank up to prescribed limits for each depositor. The DIF was formed March 31, 2006, upon the merger of the Bank Insurance Fund and the Savings Insurance Fund in accordance with the Federal Deposit Insurance Reform Act of 2005 (the "FDIR Act"). The FDIC may terminate a depository institution's deposit insurance upon a finding that the institution's financial condition is unsafe or unsound or that the institution has engaged in unsafe or unsound practices or has violated any applicable rule, regulation, order or condition enacted or imposed by the institution's regulatory agency. The termination of deposit insurance for the Bank could have a material adverse effect on our earnings.

The Bank is subject to deposit insurance assessments to maintain the DIF; these assessments are based on its assets. To determine its deposit insurance assessment base, the Bank computes the base amount of its average consolidated assets less its average tangible equity (defined as the amount of Tier I capital) and the applicable assessment rate. On May 20, 2016, the FDIC’s Board of Directors adopted a final rule that changed the manner in which deposit insurance assessment rates are calculated for established small banks (generally those banks with less than $10 billion of assets that have been insured for at least five years). The rule takes a risk based approach, utilizing the CAMELS rating system, which is a supervisory rating system designed to take into account and reflect financial and operational risks that a bank may face, as one component of the assessment calculation along with seven additional metrics including capital adequacy, asset quality, earnings, brokered deposit reliance, and assets growth rate. Each of the seven metrics and a weighted average of CAMELS component ratings is multiplied by a corresponding pricing multiplier. The sum of these products is added to a uniform amount, with the resulting sum being an institution’s initial base assessment rate (subject to minimum or maximum assessment rates based on a bank’s CAMELS composite rating). Assessments for established small banks range from 1.5 to 30 basis points, after adjustments.

The First Bancorp - 2023 Form 10-K - Page 6

Assessment rates specific to the Bank are calculated quarterly based upon its balance sheet and performance metrics as of the prior quarter end. The FDIC has the power to adjust deposit insurance assessment rates at any time, and the Company is not able to predict the amount or timing of any adjustment. In October 2022 the FDIC announced a uniform deposit insurance premium increase of 2 basis points effective in the first quarter of 2023.

Brokered Deposits and Pass-Through Deposit Insurance Limitations: Under FDICIA, a bank cannot accept brokered deposits unless it either (i) is "Well Capitalized" or (ii) is "Adequately Capitalized" and has received a written waiver from its primary federal banking regulator. For this purpose, "Well Capitalized" and "Adequately Capitalized" have the same definitions as in the Prompt Corrective Action regulations. See "Prompt Corrective Action" above. Banks that are not in the "Well Capitalized" category are subject to certain limits on the rates of interest they may offer on any deposits (whether or not obtained through a third-party deposit broker). Pass-through insurance coverage is not available in banks that do not satisfy the requirements for acceptance of brokered deposits, except that pass-through insurance coverage will be provided for employee benefit plan deposits in institutions which at the time of acceptance of the deposit meet all applicable regulatory capital requirements and send written notice to their depositors that their funds are eligible for pass-through deposit insurance. Industry regulators published changes to the definition of brokered deposits that became effective April 1, 2021; the new standards have had no impact upon the Company's business. The Bank currently accepts brokered deposits.

Real Estate Lending Standards: FDICIA requires the federal bank regulatory agencies to adopt uniform real estate lending standards. The FDIC and the OCC have adopted regulations which establish supervisory limitations on Loan-to-Value ("LTV") ratios in real estate loans by FDIC-insured banks, including national banks. The regulations require banks to establish LTV ratio limitations within or below the prescribed uniform range of supervisory limits. The CFPB amended Regulation Z effective January 10, 2014 to implement Ability to Repay and Qualified Mortgage Standards for residential mortgage lending. The Bank has elected to follow large bank treatment under the rule. The Bank follows the Ability to Repay rule by making a good faith determination of an applicant’s ability to repay under the terms of the transaction; loans meeting the outlined standards for Qualified Mortgages are identified as such in the Bank’s records. The CFPB further amended Regulation Z along with amending Regulation X to combine certain disclosures consumers receive when applying for and closing on a mortgage loan under the Truth in Lending Act and Real Estate Settlement Procedures Act. These amendments became effective October 3, 2015. In 2018, new rules went into effect for the Home Mortgage Disclosure Act ("HMDA"), expanding its scope and data reporting requirements.

Standards for Safety and Soundness: Pursuant to FDICIA the federal bank regulatory agencies have prescribed, by regulation, standards and guidelines for all insured depository institutions and depository institution holding companies relating to: (i) internal controls, information systems and internal audit systems; (ii) loan documentation; (iii) credit underwriting; (iv) interest rate risk exposure; (v) asset growth; and (vi) compensation, fees and benefits. The compensation standards prohibit employment contracts, compensation or benefit arrangements, stock option plans, fee arrangements or other compensatory arrangements that would provide "excessive" compensation, fees or benefits, or that could lead to material financial loss. In addition, the federal bank regulatory agencies are required by FDICIA to prescribe standards specifying: (i) maximum classified assets to capital ratios; (ii) minimum earnings sufficient to absorb losses without impairing capital; and (iii) to the extent feasible, a minimum ratio of market value to book value for publicly-traded shares of depository institutions and depository institution holding companies.

Privacy: The FDIC, the OCC and other regulatory agencies have published privacy rules pursuant to provisions of the GLBA ("Privacy Rules"). The Privacy Rules, which govern the treatment of nonpublic personal information about consumers by financial institutions, require a financial institution to provide notice to customers (and other consumers in some circumstances) about its privacy policies and practices, describe the conditions under which a financial institution may disclose nonpublic personal information to non-affiliated third parties, and provide a method for consumers to prevent a financial institution from disclosing that information to most non-affiliated third parties by "opting-out" of that disclosure, subject to certain exceptions.

USA Patriot Act: The USA Patriot Act of 2001, designed to deny terrorists and others the ability to obtain anonymous access to the U.S. financial system, has significant implications for depository institutions, broker-dealers and other businesses involved in the transfer of money. The USA Patriot Act, together with the implementing regulations of various federal regulatory agencies, have caused financial institutions, including the Bank, to adopt and implement additional, or to amend existing, policies and procedures with respect to, among other things, anti-money laundering compliance, suspicious activity and currency transaction reporting, customer identity verification and customer risk analysis. The statute and its underlying regulations also permit information sharing for counter-terrorist purposes between federal law enforcement agencies and financial institutions, as well as among financial institutions, subject to certain conditions, and require the Federal Reserve Board (and other federal banking regulatory agencies) to evaluate the effectiveness of an applicant in combating money laundering activities when considering applications filed under Section 3 of the BHC Act or under the Bank Merger Act.

The First Bancorp - 2023 Form 10-K - Page 7

The Bank Secrecy Act: The Bank Secrecy Act (the "BSA") requires all financial institutions, including banks and securities broker-dealers, to, among other things, establish a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. It includes a variety of recordkeeping and reporting requirements (such as cash and suspicious activity reporting) as well as due diligence/know-your-customer documentation requirements. In January 2021, the Anti-Money Laundering Act of 2020 (“AMLA”), which amends the BSA, was enacted. The AMLA codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the development of standards by the U.S. Department of the Treasury for evaluating technology and internal processes for BSA compliance; and expands enforcement- and investigation-related authority, including a significant expansion in the available sanctions for certain BSA violations. The Bank has established an anti-money laundering program to comply with the BSA requirements.

The Sarbanes-Oxley Act: The Sarbanes-Oxley Act of 2002 ("SOX") implemented a broad range of corporate governance and accounting measures for public companies (including publicly-held bank holding companies such as the Company) designed to promote honesty and transparency in corporate America and better protect investors from corporate wrongdoings. SOX's principal provisions, many of which have been implemented through regulations released and policies and rules adopted by the securities exchanges in 2003 and 2004, provide for and include, among other things:

•The creation of an independent accounting oversight board;

•Auditor independence provisions which restrict non-audit services that accountants may provide to clients;

•Additional corporate governance and responsibility measures, including the requirement that the chief executive officer and chief financial officer of a public company certify financial statements;

•The forfeiture of bonuses or other incentive-based compensation and profits from the sale of an issuer's securities by directors and senior officers in the twelve-month period following initial publication of any financial statements that later require restatement;

•An increase in the oversight of, and enhancement of certain requirements relating to, audit committees of public companies and how they interact with the public company's independent auditors;

•Requirements that audit committee members must be independent and are barred from accepting consulting, advisory or other compensatory fees from the issuer;

•Requirements that companies disclose whether at least one member of the audit committee is a 'financial expert' (as such term is defined by the SEC), and if not, why not;

•Expanded disclosure requirements for corporate insiders, including accelerated reporting of stock transactions by insiders and a prohibition on insider trading during certain blackout periods;

•A prohibition on personal loans to directors and officers, except certain loans made by insured financial institutions, such as the Bank, on non-preferential terms and in compliance with bank regulatory requirements;

•Disclosure of a code of ethics and filing a Form 8-K in the event of a change or waiver of such code; and

•A range of enhanced penalties for fraud and other violations.

The Company complies with the provisions of SOX and its underlying regulations. Management believes that such compliance efforts have strengthened the Company's overall corporate governance structure, and does not believe that such compliance has had, or will in the future have, a material impact on the Company's results of operations or financial condition.

Consumer Protection Provisions: FDICIA also includes provisions requiring advance notice to regulators and customers for any proposed branch closing and authorizing (subject to future appropriation of the necessary funds) reduced insurance assessments for institutions offering "lifeline" banking accounts or engaged in lending in distressed communities. FDICIA also includes provisions requiring depository institutions to make additional and uniform disclosures to depositors with respect to the rates of interest, fees and other terms applicable to consumer deposit accounts.

FDIC Waiver of Certain Regulatory Requirements: The FDIC issued a rule, effective on September 22, 2003, that includes a waiver provision which grants the FDIC Board of Directors extremely broad discretionary authority to waive FDIC regulatory provisions that are not specifically mandated by statute or by a separate regulation.

Impact of Monetary Policy: Our business and earnings are affected significantly by the fiscal and monetary policies of the federal government and its agencies. We are particularly affected by the policies of the FRB, which regulates the supply of money and credit in the United States. Among the instruments of monetary policy available to the FRB are (a) conducting open market operations in United States government securities, (b) changing the discount rates of borrowings of depository institutions, (c) imposing or changing reserve requirements against depository institutions' deposits, and (d) imposing or changing reserve requirements against certain borrowings by banks and their affiliates. These methods are used in varying degrees and combinations to directly affect the availability of bank loans and deposits, as well as the interest rates charged on loans and paid on deposits. The policies of the FRB may have a material effect on our business, results of operations and financial condition. The nature of future monetary policies and the effect of such policies on the future business and earnings of the Company and the Bank cannot be predicted. See Item 7 - Management's Discussion and Analysis of Financial Condition

The First Bancorp - 2023 Form 10-K - Page 8 and Results of Operations and Item 1A - Risk Factors, regarding the Bank's net interest margin and the effect of interest rate volatility on future earnings.