PROSPERITY BANCSHARES INC

The supervision and regulation of bank holding companies and their subsidiaries is intended primarily for the protection of depositors, the Deposit Insurance Fund (“DIF”) of the Federal Deposit Insurance Corporation (“FDIC”) and the banking system as a whole, and not for the protection of the bank holding company’s shareholders or creditors. The banking agencies have broad enforcement power over bank holding companies and banks including the power to impose substantial fines and other penalties for violations of laws and regulations.

The following description summarizes some of the laws to which the Company and the Bank are subject. References in this Annual Report on Form 10-K to applicable statutes and regulations are brief summaries thereof, do not purport to be complete, and are qualified in their entirety by reference to such statutes and regulations.

The Company

The Company is a financial holding company pursuant to the Gramm-Leach-Bliley Act and a bank holding company registered under the Bank Holding Company Act of 1956, as amended (“BHCA”). Accordingly, the Company is subject to primary supervision, regulation and examination by the Board of Governors of the Federal Reserve System (“Federal Reserve Board”). The Gramm-Leach-Bliley Act, the BHCA and other federal laws subject financial and bank holding companies to particular restrictions on the types of activities in which they may engage, and to a range of supervisory requirements and activities, including regulatory enforcement actions for violations of laws and regulations. Further, as a public company, the Company also files reports with the U.S. Securities and Exchange Commission (“SEC”) and is subject to its regulatory authority, including the disclosure and regulatory requirements of the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended, with respect to the Company’s securities, financial reporting and certain governance matters. Because the Company’s securities are listed on the New York Stock Exchange (“NYSE”), the Company is subject to NYSE's rules for listed companies, including rules relating to corporate governance.

Regulatory Restrictions on Dividends and Repurchases. The Company is regarded as a legal entity separate and distinct from the Bank. The principal source of the Company’s revenues is dividends received from the Bank. As described in more detail below, federal and state law places limitations on the amount that banks may pay in dividends, which the Bank must adhere to when paying dividends to the Company. It is the policy of the Federal Reserve Board that bank holding companies should pay cash dividends on common stock only out of income available over the past year and only if the prospective rate of earnings retention is consistent with the organization’s expected capital needs and financial condition. The Federal Reserve Board’s policy provides that bank holding companies should not maintain a level of cash dividends that undermines the bank holding company’s ability to serve as a source of strength to its banking subsidiaries. The Federal Reserve Board is authorized to limit or prohibit the payment of dividends if, in the Federal Reserve Board’s opinion, the payment of dividends would constitute an unsafe or unsound practice in light of a bank holding company’s financial condition. Federal Reserve Board policy also provides that a bank holding company should inform the Federal Reserve Board reasonably in advance of declaring or paying a dividend that exceeds earnings for the period for which the dividend is being paid or that could result in a material adverse change to the bank holding company's capital structure.

In July 2019, the federal bank regulators adopted final rules that, among other things, eliminated the standalone prior approval requirement in the Basel III Capital Rules for any repurchase of common stock. In certain circumstances, the Company’s repurchases of its common stock may be subject to a prior approval or notice requirement under other regulations, policies or supervisory expectations of the Federal Reserve Board. Any redemption or repurchase of preferred stock or subordinated debt remains subject to the prior approval of the Federal Reserve Board.

In August 2022, the Inflation Reduction Act of 2022 (the “IRA”) was enacted. Among other things, the IRA imposes a new 1% excise tax on the fair market value of stock repurchased after December 31, 2022 by publicly traded U.S. corporations. With certain exceptions, the value of stock repurchased is determined net of stock issued in the year, including shares issued pursuant to compensatory arrangements.

Source of Strength. Federal Reserve Board policy and federal law require a bank holding company to act as a source of financial strength to each of its banking subsidiaries. Under this requirement, the Company is expected to commit resources to support the Bank, including support at times when the Company may not be in a financial position to provide such resources. Any capital loans by a bank holding company to any of its subsidiary banks are subordinate in right of payment to deposits and to certain other indebtedness of such subsidiary banks. As discussed below, a bank holding company, in certain circumstances, could be required to guarantee the capital plan of an undercapitalized banking subsidiary.

In the event of a bank holding company’s bankruptcy under Chapter 11 of the U.S. Bankruptcy Code, the trustee will be deemed to have assumed and is required to cure immediately any deficit under any commitment by the debtor holding company to any of the federal banking agencies to maintain the capital of an insured depository institution. Any claim for breach of such obligation will generally have priority over most other unsecured claims.

Scope of Permissible Activities. Under the BHCA, bank holding companies generally may not acquire a direct or indirect interest in or control of more than 5% of the voting shares of any company that is not a bank or bank holding company and may not engage in activities other than those of banking, managing or controlling banks or furnishing services to or performing services for its subsidiaries, except that it may engage in, directly or indirectly, certain activities that the Federal Reserve Board has determined to be so closely related to banking or managing and controlling banks as to be a proper incident thereto. In approving acquisitions or the addition of activities, the Federal Reserve Board considers, among other things, whether the acquisition or the additional activities can reasonably be expected to produce benefits to the public, such as greater convenience, increased competition, or gains in efficiency, that outweigh such possible adverse effects as undue concentration of resources, decreased or unfair competition, conflicts of interest or unsound banking practices.

Notwithstanding the foregoing, the Gramm-Leach-Bliley Act eliminated the barriers to affiliations among banks, securities firms, insurance companies and other financial service providers and permits bank holding companies to become financial holding companies and thereby affiliate with securities firms and insurance companies and engage in other activities that are financial in nature. The Gramm-Leach-Bliley Act defines “financial in nature” to include securities underwriting, dealing and market making; sponsoring mutual funds and investment companies; insurance underwriting and agency; merchant banking activities; and activities that the Federal Reserve Board has determined to be closely related to banking. Generally, no regulatory approval will be required for a financial holding company, such as the Company, to acquire a company, other than a bank or savings association, engaged in activities that are financial in nature or incidental to activities that are financial in nature as determined by the Federal Reserve Board.

The Company’s financial holding company status depends upon it maintaining its status as “well capitalized” and “well managed” under applicable Federal Reserve Board regulations. If a financial holding company ceases to meet these requirements, the Federal Reserve Board may impose corrective capital and/or managerial requirements on the financial holding company and place limitations on its ability to conduct the broader financial activities permissible for financial holding companies. Until the financial holding company returns to compliance, it may not acquire a company engaged in such financial activities without prior approval of the Federal Reserve Board. In addition, the Federal Reserve Board may require divestiture of the holding company’s depository institutions and/or its non-bank subsidiaries if the deficiencies persist.

While the Federal Reserve Board is the “umbrella” regulator for financial holding companies and has the power to examine banking organizations engaged in new activities, regulation and supervision of activities which are financial in nature or determined to be incidental to such financial activities will be handled along functional lines. Accordingly, activities of subsidiaries of a financial holding company will be regulated by the agency or authorities with the most experience regulating that activity as it is conducted in a financial holding company.

Safe and Sound Banking Practices. Bank holding companies are not permitted to engage in unsafe and unsound banking practices. The Federal Reserve Board’s Regulation Y, for example, generally requires a holding company to give the Federal Reserve Board prior notice of any redemption or repurchase of its own equity securities if the consideration to be paid, together with the consideration paid for any repurchases or redemptions in the preceding year, is equal to 10% or more of the company’s consolidated net worth. The Federal Reserve Board may oppose the transaction if it believes that the transaction would constitute an unsafe or unsound practice or would violate any law or regulation. Depending upon the circumstances, the Federal Reserve Board could take the position that paying a dividend would constitute an unsafe or unsound banking practice.

The Federal Reserve Board has broad authority to prohibit activities of bank holding companies and their nonbanking subsidiaries which represent unsafe and unsound banking practices or which constitute violations of laws or regulations, and can assess civil money penalties for certain activities conducted on a knowing and reckless basis if those activities caused a substantial loss to a depository institution. The penalties can be in excess of $1.0 million for each day the activity continues.

Anti-Tying Restrictions. Bank holding companies and their affiliates are prohibited from tying the provision of certain services, such as extensions of credit, to other services offered by a holding company or its affiliates.

Basel III Capital Adequacy Requirements. The Company and the Bank are required to comply with applicable capital adequacy standards adopted by the Federal Reserve Board and the FDIC (the “Basel III Capital Rules”). The Basel III Capital Rules define the components of capital and address other issues affecting the numerator in banking institutions’ regulatory capital ratio calculations and also address risk weights and other issues affecting the denominator.

The Basel III Capital Rules require the Company to maintain a capital conservation buffer of Common Equity Tier 1 (“CET1”) of 2.5%, effectively resulting in minimum ratios of (1) CET1 to risk-weighted assets of 7.0%, (2) Tier 1 capital to risk-weighted assets of 8.5%, (3) total capital (that is, Tier 1 plus Tier 2) to risk-weighted assets of 10.5% and (4) Tier 1 capital to average quarterly assets as reported on consolidated financial statements (known as the “leverage ratio”) of 4.0%. As of December 31, 2023, the Company’s ratio of CET1 to risk-weighted assets was 15.54%, Tier 1 capital to risk-weighted assets was 15.54%, total capital to risk-weighted assets was 16.56% and Tier 1 capital to average quarterly assets was 10.39%.

Banking institutions that fail to meet the effective minimum ratios once the capital conservation buffer is taken into account, as detailed above, will be subject to constraints on capital distributions, including dividends and share repurchases, and certain discretionary executive compensation. The severity of the constraints depends on the amount of the shortfall and the institution’s “eligible retained income” (that is, four quarter trailing net income, net of distributions and tax effects not reflected in net income).

With respect to the Bank, the Basel III Capital Rules also revised the “prompt corrective action” regulations as discussed below under “The Bank—Corrective Measures for Capital Deficiencies.”

In response to the novel strain of coronavirus disease (“COVID-19”) pandemic, in March 2020 the joint federal bank regulatory agencies issued an interim final rule that allowed banking organizations that implemented ASU 2016-13, “Financial Instruments-Credit Losses (Topic 326) – Measurement of Credit Losses on Financial Instruments” (“CECL”) in 2020 to mitigate the effects of the CECL accounting standard in their regulatory capital for two years. This two-year delay is in addition to the three-year transition period that the agencies had already made available. The Company adopted the option provided by the interim final rule, which delayed the effects of CECL on its regulatory capital through 2021, after which the effects will be phased in over a three-year period from January 1, 2022 through December 31, 2024. Under the interim final rule, the amount of adjustments to regulatory capital deferred until the phase-in period include both the initial impact of the Company’s adoption of CECL on January 1, 2020 and 25% of subsequent changes in the Company’s allowance for credit losses during each quarter of the two-year period ending December 31, 2021. The cumulative amount of the transition adjustments is being phased in over the three-year transition period that began on January 1, 2022, with 75% recognized in 2022, 50% recognized in 2023, and 25% recognized in 2024.

The Basel III Capital Rules prescribe a standardized approach for risk weightings that expands the risk-weighting categories from the general risk-based capital rules to a larger and more risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0% for U.S. government and agency securities, to 600% for certain equity exposures, and resulting in higher risk weights for a variety of asset categories.

In July 2023, the federal banking regulators proposed revisions to the Basel III capital rules to implement the Basel Committee’s 2017 standards and make other changes to the Basel III capital rules. The proposal introduces revised credit risk, equity risk, operational risk, credit evaluation risk, and market risk requirements, among other changes. However, the revised capital requirements of the proposed rule would not apply to the Company or the Bank because they each have less than $100 billion in total consolidated assets and trading assets and liabilities below the threshold for the market risk requirements.

The federal banking agencies’ risk-based and leverage capital ratios are minimum supervisory ratios generally applicable to banking organizations that meet certain specified criteria. Banking organizations not meeting these criteria are expected to operate with capital positions well above the minimum ratios. The federal bank regulatory agencies may set capital requirements for a particular banking organization that are higher than the minimum ratios when circumstances warrant. Federal Reserve Board guidelines also provide that banking organizations experiencing internal growth or making acquisitions will be expected to maintain strong capital positions substantially above the minimum supervisory levels, without significant reliance on intangible assets.

Liquidity Requirements. The Basel III liquidity framework requires some banks and bank holding companies to measure their liquidity against specific liquidity tests. One test, referred to as the liquidity coverage ratio (“LCR”), is designed to ensure that a banking entity maintains an adequate level of unencumbered high-quality liquid assets equal to the entity’s expected net cash outflow for a 30-day time horizon (or, if greater, 25% of its expected total cash outflow) under an acute liquidity stress scenario. The other test, referred to as the net stable funding ratio (“NSFR”), is designed to promote more medium- and long-term funding of the assets and activities of banking entities over a one-year time horizon. Neither the LCR rule nor the NSFR rule apply to the Company and the Bank.

Imposition of Liability for Undercapitalized Subsidiaries. Bank regulators are required to take “prompt corrective action” to resolve problems associated with insured depository institutions whose capital declines below certain levels. If an institution becomes “undercapitalized,” it must submit a capital restoration plan. The capital restoration plan will not be accepted by the regulators unless each company having control of the undercapitalized institution guarantees the subsidiary’s compliance with the capital restoration plan up to a certain specified amount. Any such guarantee from a depository institution’s holding company is entitled to a priority of payment in bankruptcy.

The aggregate liability of the holding company of an undercapitalized bank is limited to the lesser of 5% of the institution’s assets at the time it became undercapitalized or the amount necessary to cause the institution to be “adequately capitalized.” The bank regulators have greater power in situations where an institution becomes “significantly” or “critically” undercapitalized or fails to submit a capital restoration plan. For example, a bank holding company controlling such an institution can be required to obtain prior Federal Reserve Board approval of proposed dividends or might be required to consent to a consolidation or to divest the troubled institution or other affiliates.

Acquisitions by Bank Holding Companies. The BHCA requires every bank holding company to obtain the prior approval of the Federal Reserve Board before it may acquire all or substantially all of the assets of any bank, or ownership or control of any voting shares of any bank, if after such acquisition it would own or control, directly or indirectly, 5% or more of the voting shares of such bank. In approving bank acquisitions by bank holding companies, the Federal Reserve Board is required to consider, among other things, the financial and managerial resources and future prospects of the bank holding company and the banks concerned, the convenience and needs of the communities to be served and various competitive factors.

Control Acquisitions. The Change in Bank Control Act prohibits a person or group of persons from acquiring “control” of a bank holding company unless the Federal Reserve Board has been notified and has not objected to the transaction. Under a rebuttable presumption established by the Federal Reserve Board, the acquisition of 10% or more of a class of voting stock of a bank holding company with a class of securities registered under Section 12 of the Exchange Act, such as the Company, would, under the circumstances set forth in the presumption, constitute acquisition of control of the Company. In addition, a person may not acquire 25% (5% in the case of an acquiror that is a bank holding company) or more of a bank holding company’s or bank’s voting securities, or otherwise obtain control or a controlling influence over a bank holding company or bank without the approval of the Federal Reserve Board.

In January 2020, the Federal Reserve Board approved a final rule that clarifies the framework for when a company controls a bank holding company or bank under the BHCA. In particular, the final rule sets forth tiered presumptions of control in the Federal Reserve Board’s regulations. Under the BHCA, a company controls a bank holding company if it controls 25 percent or more of any class of voting securities of the bank holding company. A company that controls less than 5 percent of any class of voting securities of a bank holding company is presumed not to control the bank holding company. In instances in which a company owns at least 5 percent but less than 25 percent, the Federal Reserve Board considers the full facts and circumstances of the relationship between the company and the bank holding company to determine whether the company controls the bank holding company. As part of its determination as to control, the Federal Reserve Board considers, among other things, level of ownership of voting and non-voting securities, board representation, business relationships, senior management interlocks, contractual limits on major operational or policy decisions, proxies on issues, threats to dispose of securities, and management agreements. The rule also provides several additional examples of presumptions of control and noncontrol, along with various ancillary provisions such as definitions of terms used in the presumptions.

The Volcker Rule. The Volcker Rule under the Dodd-Frank Wall Street Reform and Consumer Protection Act ("Dodd-Frank Act") prohibits banks and their affiliates from engaging in proprietary trading and investing in and sponsoring certain hedge funds and private equity funds. Since neither the Company nor the Bank engages in the types of trading or investing covered by the Volcker Rule, the Volcker Rule does not currently have any effect on the operations of the Company or the Bank.

The Bank

The Bank is a Texas-chartered banking association, the deposits of which are insured by the DIF of the FDIC. The Bank is not a member of the Federal Reserve System; therefore, the Bank is subject to supervision and regulation by the FDIC and the Texas Department of Banking. Such supervision and regulation subject the Bank to special restrictions, requirements, potential enforcement actions and periodic examination by the FDIC and the Texas Department of Banking. Because the Federal Reserve Board regulates the Company, the Federal Reserve Board also has supervisory authority which affects the Bank. Further, because the Bank has total assets of over $10 billion, the Bank is also subject to supervision and regulation by the Consumer Financial Protection Bureau (“CFPB”). The CFPB regulates the offering and provision of consumer financial products and services under the federal consumer financial laws.

Equivalence to National Bank Powers. The Texas Constitution, as amended in 1986, provides that a Texas-chartered bank has the same rights and privileges that are or may be granted to national banks domiciled in Texas. To the extent that the Texas laws and regulations may have allowed state-chartered banks to engage in a broader range of activities than national banks, the Federal Deposit Insurance Corporation Improvement Act of 1991 (“FDICIA”) has operated to limit this authority. FDICIA provides that no state bank or subsidiary thereof may engage as principal in any activity not permitted for national banks, unless the institution complies with applicable capital requirements and the FDIC determines that the activity poses no significant risk to the DIF. In general, statutory restrictions on the activities of banks are aimed at protecting the safety and soundness of depository institutions.

Financial Modernization. Under the Gramm-Leach-Bliley Act, a national bank may establish a financial subsidiary and engage, subject to limitations on investment, in activities that are financial in nature other than insurance underwriting as principal, insurance company portfolio investment, real estate development, real estate investment, annuity issuance and merchant banking activities. To do so, a bank must be well capitalized, well managed and have a CRA rating of satisfactory or better. Subsidiary banks of a financial holding company or national banks with financial subsidiaries must remain well capitalized and well managed in order to continue to engage in activities that are financial in nature without regulatory actions or restrictions, which could include divestiture of the financial-in-nature subsidiary or subsidiaries. In addition, a financial holding company or a bank may not acquire a company that is engaged in activities that are financial in nature unless each of the subsidiary banks of the financial holding company or the bank has a CRA rating of satisfactory or better.

Although the powers of state chartered banks are not specifically addressed in the Gramm-Leach-Bliley Act, Texas-chartered banks such as the Bank, will have the same if not greater powers as national banks through the parity provision contained in the Texas Constitution.

Branching. Pursuant to the Dodd-Frank Act, banks are permitted to engage in de novo interstate branching if the laws of the state where the new branch is to be established would permit the establishment of the branch if it were chartered by such state, subject to applicable regulatory review and approval requirements. The Dodd-Frank Act also modified certain regulatory requirements for interstate mergers and acquisitions, including that the acquiring bank must be well capitalized and well managed. Texas law provides that a Texas-chartered bank can establish a branch anywhere in Texas or any other state, subject to federal law requirements, provided that the branch is approved in advance by the Texas Department of Banking. The branch must also be approved by the FDIC, which considers a number of factors, including financial history, capital adequacy, earnings prospects, character of management, needs of the community and consistency with corporate powers.

Restrictions on Transactions with Affiliates and Insiders. Transactions between the Bank and its nonbanking affiliates, including the Company, are subject to Section 23A and Section 23B of the Federal Reserve Act. In general, Section 23A imposes limits on the amount of such transactions to 10% of the Bank’s capital stock and surplus and requires that such transactions be secured by designated amounts of specified collateral. It also limits the amount of advances to third parties which are collateralized by the securities or obligations of the Company or its subsidiaries. Section 23B generally requires that certain transactions between the Bank and its affiliates be on terms substantially the same, or at least as favorable to the Bank, as those prevailing at the time for comparable transactions with or involving other nonaffiliated persons.

Loans to directors, executive officers, principal shareholders and their related interests (collectively referred to herein as “insiders”) are subject to restrictions contained in the Federal Reserve Act and Regulation O, which apply to all insured institutions and their subsidiaries and holding companies. Insiders are subject to enforcement actions for knowingly accepting loans in violation of applicable restrictions.

Restrictions on Distribution of Subsidiary Bank Dividends and Assets. Dividends paid by the Bank have provided a substantial part of the Company’s operating funds, and it is anticipated that dividends paid by the Bank to the Company will continue to be the Company’s principal source of operating funds. Capital adequacy requirements serve to limit the amount of dividends that may be paid by the Bank. Under federal law, the Bank cannot pay a dividend if, after paying the dividend, the Bank will be

“undercapitalized.” The FDIC may declare a dividend payment to be unsafe and unsound even though the Bank would continue to meet its capital requirements after the dividend. The Bank is also subject to limitations on the payment of dividends under Texas law. Because the Company is a legal entity separate and distinct from its subsidiaries, its right to participate in the distribution of assets of any subsidiary upon the subsidiary’s liquidation or reorganization will be subject to the prior claims of the subsidiary’s creditors. In the event of a liquidation or other resolution of an insured depository institution, the claims of depositors and other general or subordinated creditors are entitled to a priority of payment over the claims of holders of any obligation of the institution to its shareholders, including any depository institution holding company (such as the Company) or any shareholder or creditor thereof.

Consumer Financial Protection. The Bank is subject to a number of federal and state consumer protection laws that extensively govern its relationship with its customers. These laws include the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Truth in Lending Act, the Truth in Savings Act, the Electronic Fund Transfer Act, the Expedited Funds Availability Act, the Home Mortgage Disclosure Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Fair Debt Collection Practices Act, the Service Members Civil Relief Act and these laws’ respective state-law counterparts, as well as state usury laws and laws regarding unfair and deceptive acts and practices. These and other federal laws, among other things, require disclosures of the cost of credit and terms of deposit accounts, provide substantive consumer rights, prohibit discrimination in credit transactions, regulate the use of credit report information, provide financial privacy protections, prohibit unfair, deceptive and abusive practices, restrict the Bank’s ability to raise interest rates and subject the Bank to substantial regulatory oversight. Violations of applicable consumer protection laws can result in significant potential liability from litigation brought by customers, including actual damages, restitution and attorneys’ fees. Federal bank regulators, state attorneys general and state and local consumer protection agencies may also seek to enforce consumer protection requirements and obtain these and other remedies, including regulatory sanctions, customer rescission rights and civil money penalties in each jurisdiction in which the Bank operates. Failure to comply with consumer protection requirements may also result in the Bank’s failure to obtain any required regulatory approval for merger or other acquisition transactions the Bank may wish to pursue or its prohibition from engaging in such transactions even if approval is not required.

The Dodd-Frank Act established the CFPB, which has supervisory, examination and enforcement authority over depository institutions with total assets of $10 billion or greater and other providers of consumer financial products or services. The CFPB has broad rulemaking authority for a wide range of federal consumer financial laws, including, among other things, the authority to prohibit “unfair, deceptive or abusive” acts and practices. The CFPB can issue cease-and-desist orders against banks and other entities that violate federal consumer financial laws and may also institute a civil action against an entity in violation of federal consumer financial laws in order to impose a civil penalty or injunction.

In October 2023, the CFPB proposed a new rule that would require a provider of payment accounts or products, such as a bank, to make data available to consumers upon request regarding the products or services they obtain from the provider. Any such data provider would also have to make such data available to third parties, with the consumer’s express authorization and through an interface that satisfies formatting, performance and security standards, for the purpose of such third parties providing the consumer with financial products or services requested by the consumer. Data that would be required to be made available under the rule would include transaction information, account balance, account and routing numbers, terms and conditions, upcoming bill information, and certain account verification data. The proposed rule is intended to give consumers control over their financial data, including with whom it is shared, and encourage competition in the provision of consumer financial products or services. For banks with over $50 billion and less than $500 billion in total assets, compliance would be required approximately one year after adoption of the final rule.

Customer Information Security. The federal banking agencies have adopted guidelines for safeguarding confidential, personal, nonpublic customer information. These guidelines require each financial institution, under the supervision and ongoing oversight of its board of directors or an appropriate committee thereof, to create, implement and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazard to the security or integrity of such information and protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. The Bank has adopted a customer information security program to comply with these requirements.

Examinations. The FDIC periodically examines and evaluates state non-member banks, such as the Bank. The Texas Department of Banking also conducts examinations of Texas-chartered banks, but may accept the results of a federal examination in lieu of conducting an independent examination. Additionally, the FDIC and Texas Department of Banking may elect to conduct a joint examination. Because the Bank has total assets of over $10 billion, the CFPB also has examination authority with respect to the Bank’s compliance with federal consumer protection laws.

Capital Adequacy Requirements. The FDIC has adopted regulations establishing minimum requirements for the capital adequacy of insured institutions. The FDIC may establish higher minimum requirements if, for example, a bank has previously received special attention or has a high susceptibility to interest rate risk.

The FDIC’s risk-based capital guidelines generally require state banks to have minimum ratios of CET1 to risk-weighted assets of 4.5%, Tier 1 capital to total risk-weighted assets of 6.0% and total capital to total risk-weighted assets of 8.0%. The capital categories have the same definitions for the Bank as for the Company. As of December 31, 2023, the Bank’s ratio of CET1 to risk-weighted assets was 15.48%, Tier 1 capital to total risk-weighted assets was 15.48% and total capital to total risk-weighted assets was 16.50%.

The FDIC’s leverage guidelines require state banks to maintain Tier 1 capital of no less than 4.0% of average total assets. As of December 31, 2023, the Bank’s ratio of Tier 1 capital to average quarterly assets (leverage ratio) was 10.35%.

Corrective Measures for Capital Deficiencies. The federal banking regulators are required to take “prompt corrective action” with respect to capital-deficient institutions. Agency regulations define, for each capital category, the levels at which institutions are “well-capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” and “critically undercapitalized.”

•

A bank is “well capitalized” if it has a total risk-based capital ratio of 10.0% or higher; a CET1 capital ratio of 6.5% or higher; a Tier 1 risk-based capital ratio of 8.0% or higher; a leverage ratio of 5.0% or higher; and is not subject to any written agreement, order or directive requiring it to maintain a specific capital level for any capital measure.

•

A bank is “adequately capitalized” if it has a total risk-based capital ratio of 8.0% or higher; a CET1 capital ratio of 4.5% or higher; a Tier 1 risk-based capital ratio of 6.0% or higher; a leverage ratio of 4.0% or higher; and does not meet the criteria for a well capitalized bank.

•

A bank is “undercapitalized” if it has a total risk-based capital ratio of less than 8.0%; a CET1 capital ratio less than 4.5%; a Tier 1 risk-based capital ratio of less than 6.0% or a leverage ratio of less than 4.0%.

•

A bank is “significantly undercapitalized” if it has a total risk-based capital ratio of less than 6.0%; a CET1 capital ratio less than 3.0%; a Tier 1 risk-based capital ratio of less than 4.0% or a leverage ratio of less than 3.0%.

•

A bank is “critically undercapitalized” if it has a tangible equity ratio to total assets that is equal to or less than 2.0%.

At December 31, 2023, the Bank was classified as “well-capitalized” for purposes of the FDIC’s prompt corrective action regulations in effect as of such date.

In addition to requiring undercapitalized institutions to submit a capital restoration plan, agency regulations contain broad restrictions on certain activities of undercapitalized institutions including asset growth, acquisitions, branch establishment and expansion into new lines of business. With certain exceptions, an insured depository institution is prohibited from making capital distributions, including dividends, and is prohibited from paying management fees to control persons if the institution would be undercapitalized after any such distribution or payment.

As an institution’s capital decreases, the FDIC’s enforcement powers become more severe. A significantly undercapitalized institution is subject to mandated capital raising activities, restrictions on interest rates paid and transactions with affiliates, removal of management and other restrictions. The FDIC has only very limited discretion in dealing with a critically undercapitalized institution and is virtually required to appoint a receiver or conservator.

Banks with risk-based capital and leverage ratios below the required minimums may also be subject to certain administrative actions, including the termination of deposit insurance upon notice and hearing, or a temporary suspension of insurance without a hearing if the institution has no tangible capital.

In addition, the Federal Deposit Insurance Act prohibits an insured depository institution from accepting brokered deposits or offering interest rates on any deposits significantly higher than the prevailing rate in the bank’s normal market area or nationally (depending upon where the deposits are solicited), unless it is well capitalized or is adequately capitalized and receives a waiver from the FDIC.

Deposit Insurance Assessments. The deposits of the Bank are insured up to applicable limits by the DIF, and the Bank must pay deposit insurance assessments to the FDIC for such deposit insurance protection. A depository institution’s DIF assessment is calculated by multiplying its assessment rate by the assessment base, which is defined as the average consolidated total assets less the average tangible equity of the depository institution. The initial base assessment rate is based on its capital level and CAMELS ratings, certain financial measures to assess an institution’s ability to withstand asset related stress and funding related stress and, in some cases, additional discretionary adjustments by the FDIC to reflect additional risk factors.

On June 22, 2020, the FDIC issued a final rule that mitigates the deposit insurance assessment effects of participating in the Paycheck Protection Program (“PPP”). Pursuant to the final rule, the FDIC will generally remove the effect of PPP lending in calculating an institution’s deposit insurance assessment. The final rule also provides an offset to an institution's total assessment amount for the increase in its assessment base attributable to participation in the PPP and the Money Market Mutual Liquidity Fund.

On February 16, 2021, the FDIC adopted a final rule to address the temporary deposit insurance assessment effects resulting from the optional regulatory capital transition provisions related to the CECL implementation. The final rule removed the double counting of a portion of the CECL transition amounts in certain financial measures that are used to determine deposit insurance assessment rates for large or highly complex insured depository institutions.

In October 2022, the FDIC adopted a final rule to increase the initial base deposit insurance assessment rate schedules uniformly by 2 basis points beginning with the first quarterly assessment period of 2023. The increased assessment is intended to increase the likelihood that the DIF reserve ratio would reach the statutory minimum of 1.35% by the statutory deadline prescribed under the FDIC's amended restoration plan.

In November 2023, the FDIC adopted a final rule to implement a special assessment to recover the losses to the DIF associated with several bank failures that occurred during early 2023. The assessment base for the special assessment is equal to estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion, to be collected at a quarterly rate of approximately 3.36 basis points for an anticipated total of eight quarterly assessment periods, beginning in the first quarter of 2024. As a result, the Company accrued a special assessment of $19.9 million, or $0.17 per diluted common share net of tax in the fourth quarter of 2023. Under the final rule, the estimated loss pursuant to the systemic risk determination will be periodically adjusted, and the FDIC has retained the ability to cease collection early, extend the special assessment collection period and impose a final shortfall special assessment on a one-time basis. The extent to which any additional future assessments will impact our future deposit insurance expense is currently uncertain.

Interchange Fees. Under the Durbin Amendment to the Dodd-Frank Act, the Federal Reserve Board adopted rules establishing standards for assessing whether the interchange fees that may be charged with respect to certain electronic debit transactions are “reasonable and proportional” to the costs incurred by issuers for processing such transactions. Interchange fees, or “swipe” fees, are charges that merchants pay to the Bank and other card-issuing banks for processing electronic payment transactions. Federal Reserve Board rules applicable to financial institutions that have assets of $10 billion or more provide that the maximum permissible interchange fee for an electronic debit transaction is the sum of 21 cents per transaction and 5 basis points multiplied by the value of the transaction. An upward adjustment of no more than 1 cent to an issuer’s debit card interchange fee is allowed if the card issuer develops and implements policies and procedures reasonably designed to achieve certain fraud-prevention standards. The Federal Reserve Board also has rules governing routing and exclusivity that require issuers to offer at least two unaffiliated networks for routing transactions on each debit or prepaid product. On October 25, 2023, the Federal Reserve Board issued a proposal under which the maximum permissible interchange fee for an electronic debit transaction would be the sum of 14.4 cents per transaction and 4 basis points multiplied by the value of the transaction. Furthermore, the fraud-prevention adjustment would increase from a maximum of 1 cent to 1.3 cents. The proposal would adopt an approach for future adjustments to the interchange fee cap, which would occur every other year based on issuer cost data gathered by the Federal Reserve from large debit card issuers.

Concentrated Commercial Real Estate Lending. The federal banking agencies, including the FDIC, have promulgated guidance governing financial institutions with concentrations in commercial real estate lending. The guidance provides that a bank has a concentration in commercial real estate lending if (1) total reported loans for construction, land development and other land represent 100% or more of total capital or (2) total reported loans secured by multifamily and non-farm residential properties and loans for construction, land development and other land represent 300% or more of total capital and the bank’s commercial real estate loan portfolio has increased 50% or more during the prior 36 months. Owner occupied loans are excluded from this second category. If a concentration is present, management must employ heightened risk management practices that address the following key elements: board and management oversight and strategic planning, portfolio management, development of underwriting standards, risk assessment and monitoring through market analysis and stress testing, and maintenance of increased capital levels as needed to support the level of commercial real estate lending.

Community Reinvestment Act. The Community Reinvestment Act of 1977 (“CRA”) and the regulations issued thereunder are intended to encourage banks to help meet the credit needs of their communities, including low and moderate income neighborhoods, consistent with the safe and sound operations of the banks. These regulations also provide for regulatory assessment of a bank’s CRA record when considering applications to establish branches, merger applications and applications to acquire the assets and assume the liabilities of another bank. The Financial Institutions Reform, Recovery, and Enforcement Act (“FIRREA”) requires federal banking agencies to make public a rating of a bank’s performance under the CRA. In the case of a financial holding company or a bank holding company, the CRA performance records of the banks involved in the transaction are reviewed in connection with the filing of an application to acquire ownership or control of shares or assets of a bank or to merge with any other bank holding company. An unsatisfactory record can substantially delay or block the transaction.

On October 24, 2023, the Office of the Comptroller of the Currency (“OCC”), Federal Reserve Board, and FDIC issued a final rule to modernize their respective CRA regulations. The revised rules substantially alter the methodology for assessing compliance with the CRA, with material aspects taking effect January 1, 2026, and revised data reporting requirements taking effect January 1, 2027. Among other things, the revised rules evaluate lending outside traditional assessment areas generated by the growth of non-branch delivery systems, such as online and mobile banking, apply a metrics-based benchmarking approach to assessment, and clarify eligible CRA activities.

Anti-Money Laundering and Anti-Terrorism Legislation. A major focus of governmental policy on financial institutions in recent years has been aimed at combating money laundering and terrorist financing. The USA PATRIOT Act of 2001 (the “USA Patriot Act”) substantially broadened the scope of United States anti-money laundering laws and regulations by imposing significant new compliance and due diligence obligations, creating new crimes and penalties and expanding the extra-territorial jurisdiction of the United States. The United States Treasury Department has issued, and in some cases proposed, a number of regulations that apply various requirements of the USA Patriot Act to financial institutions. These regulations impose obligations on financial institutions to maintain appropriate policies, procedures and controls to detect, prevent and report money laundering and terrorist financing and to verify the identity of their customers. The regulations also impose specific due diligence requirements on financial institutions that maintain correspondent or private banking relationships with non-U.S. financial institutions or persons. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious financial, legal and reputational consequences for the institution and could block or substantially delay a merger or other acquisition transaction.

The Anti-Money Laundering Act of 2020 (“AMLA”), which amends the Bank Secrecy Act of 1970 (“BSA”), was enacted in January 2021. The AMLA is intended to be a comprehensive reform and modernization to U.S. bank secrecy and anti-money laundering laws. Among other things, it codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the U.S. Department of the Treasury to promulgate priorities for anti-money laundering and countering the financing of terrorism policy; requires the development of standards for evaluating technology and internal processes for BSA compliance; expands enforcement- and investigation-related authority, including increasing available sanctions for certain BSA violations and expands BSA whistleblower incentives and protections. Many of the statutory provisions in the AMLA will require additional rulemakings, reports and other measures, and the impact of the AMLA will depend on, among other things, rulemaking and implementation guidance. In June 2021, the Financial Crimes Enforcement Network, a bureau of the U.S. Department of the Treasury, issued the priorities for anti-money laundering and countering the financing of terrorism policy required under the AMLA. The priorities include: corruption, cybercrime, terrorist financing, fraud, transnational crime, drug trafficking, human trafficking and proliferation financing.

Office of Foreign Assets Control Regulation. The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others. These are typically known as the “OFAC” rules based on their administration by the U.S. Treasury Department Office of Foreign Assets Control (“OFAC”). The OFAC-administered sanctions targeting countries take many different forms. Generally, however, they contain one or more of the following elements: (1) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments in, or providing investment-related advice or assistance to, a sanctioned country; and (2) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious financial, legal and reputational consequences, including substantial delay or blocking of a merger or other acquisition transaction.

Incentive Compensation. In June 2010, the Federal Reserve Board, OCC and FDIC issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (1) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (2) be compatible with effective internal controls and risk management and (3) be supported by strong corporate governance, including active and effective oversight by the organization’s Board of Directors. As of December 31, 2023, these proposed rules have not been adopted.

These three principles are incorporated into the proposed revised rules on incentive-based payment arrangements at specified covered institutions released in May 2016 by a number of federal agencies, including the Federal Reserve Board, FDIC and SEC. The proposed revised rules would establish general qualitative requirements applicable to all covered institutions, including the Company and the Bank, that have at least $1 billion in total assets, which would include (1) prohibiting incentive arrangements that encourage inappropriate risks by providing excessive compensation; (2) prohibiting incentive arrangements that encourage inappropriate risks that could lead to a material financial loss; (3) establishing requirements for performance measures to appropriately balance risk and reward; (4) requiring Board of Director oversight of incentive arrangements; and (5) mandating appropriate record-keeping. Under the proposed rule, larger financial institutions with total consolidated assets of at least $50 billion would also be subject to additional requirements.

The Federal Reserve Board and FDIC review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Company, that are not “large, complex banking organizations.” These reviews are tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of this supervisory initiative will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

In October 2022, the SEC adopted a final rule directing national securities exchanges and associations, including the NYSE, to implement listing standards that require listed companies to adopt policies mandating the recovery or “clawback” of excess incentive-based compensation earned by a current or former executive officer during the three fiscal years preceding the date the listed company is required to prepare an accounting restatement, including to correct an error that would result in a material misstatement if the error were corrected in the current period or left uncorrected in the current period. The NYSE’s listing standards pursuant to the SEC’s rule became effective on October 2, 2023. The Company adopted a compensation recovery policy pursuant to the NYSE listing standards on November 13, 2023. The Policy is included as Exhibit 97.1 to this Form 10-K.

Cybersecurity. In February 2018, the SEC published interpretive guidance to assist public companies in preparing disclosures about cybersecurity risks and incidents. These SEC guidelines, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations. In addition, in March 2022, the SEC proposed rules that would require disclosure of material cybersecurity incidents as well as cybersecurity risk management, strategy and governance.

The federal banking regulators regularly issue new guidance and standards, and update existing guidance and standards, regarding cybersecurity intended to enhance cyber risk management among financial institutions. Financial institutions are expected to comply with such guidance and standards and to accordingly develop appropriate security controls and risk management processes. If the Company fails to observe such regulatory guidance or standards, the Company could be subject to various regulatory sanctions, including financial penalties.

In November 2021, the federal banking agencies adopted a final rule that requires banking organizations to notify their primary banking regulator within 36 hours of determining that a “computer-security incident” has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss, or its operations that would impact the stability of the United States. In 2023, the SEC issued a final rule that requires disclosure of material cybersecurity incidents, as well as cybersecurity risk management, strategy, and governance. Under this rule, banking organizations that are SEC registrants must generally disclose information about a material cybersecurity incident within four business days of determining it is material, with periodic updates as to the status of the incident in subsequent filings as necessary.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs, and many states, including Texas, have also recently implemented or modified their data breach notification, information security and data privacy requirements. The Company expects this trend of state-level activity in those areas to continue and are continually monitoring developments in the states in which its customers are located.

Risks and exposures related to cybersecurity attacks, including litigation and enforcement risks, are expected to be elevated for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by the Company and its customers.

Legislative and Regulatory Initiatives

From time to time, various legislative and regulatory initiatives are introduced in Congress and state legislatures, as well as by regulatory agencies. Such initiatives may include proposals to expand or contract the powers of bank holding companies and depository institutions or proposals to substantially change the financial institution regulatory system. Such legislation could change banking statutes and the operating environment of the Company in substantial and unpredictable ways. If enacted, such legislation could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance among banks, savings associations, credit unions, and other financial institutions. The Company cannot predict whether any such legislation will be enacted, and, if enacted, the effect that it, or any implementing regulations, would have on the financial condition or results of operations of the Company. A change in statutes, regulations or regulatory policies applicable to the Company or the Bank could have a material effect on the Company’s business, financial condition and results of operations.

Effect on Economic Environment

The policies of regulatory authorities, including the monetary policy of the Federal Reserve Board, have a significant effect on the operating results of bank holding companies and their subsidiaries. Among the means available to the Federal Reserve Board to affect the money supply are open market operations in U.S. government securities, changes in the discount rate on member bank borrowings and changes in reserve requirements against member bank deposits. These means are used in varying combinations to influence overall growth and distribution of bank loans, investments and deposits; and their use may affect interest rates charged on loans or paid for deposits.

Federal Reserve Board monetary policies have materially affected the operating results of commercial banks in the past and are expected to continue to do so in the future. The nature of future monetary policies and the effect of such policies on the business and earnings of the Company and its subsidiaries cannot be predicted.