CSB Bancorp Inc

In March 2015, federal regulators issued two related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish several lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing Internet-based services of the financial institution. The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption, and maintenance of the financial institution’s operations after a cyber-attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the financial institution or its critical service providers fall victim to this type of cyber-attack. If CSB fails to observe the regulatory guidance, it could be subject to various regulatory sanctions, including financial penalties.

In February 2018, the SEC published interpretive guidance to assist public companies in preparing disclosures about cybersecurity risks and incidents. These SEC guidelines, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations.

In November 2021, federal banking agencies issued a final rule that became effective in May 2022 requiring banking organizations that experience a cybersecurity incident to notify certain entities. A cybersecurity incident occurs when actual or potential harm to the confidentiality, integrity, or availability of information or an information system occurs, or there is a violation or imminent threat of a violation to banking security policies and procedures. The affected bank must notify its respective federal regulator of the cybersecurity incident as soon as possible and no later than 36 hours after the bank determines a cybersecurity incident that rises to the level of a notification incident has occurred. These notifications are intended to promote early awareness of threats to banking organizations and will help banks react to those threats before they manifest into larger incidents. This rule also requires bank service providers to notify their bank organization customers of a cybersecurity incident that has caused, or is reasonably likely to cause, a material service disruption or degradation for four or more hours.

Furthermore, once final rules are adopted, the Cyber Incident Reporting for Critical Infrastructure Act, enacted in March 2022, will require certain covered entities to report a covered cyber incident to the U.S. Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency (“CISA”) within 72 hours after it reasonably believes an incident has occurred. Separate reporting to CISA will also be required within 24 hours, if a ransom payment is made as a result of a ransomware attack.

On July 26, 2023, the SEC adopted final rules that require public companies to promptly disclose material cybersecurity incidents in a Current Report on Form 8-K and detailed information regarding their cybersecurity risk management, strategy, and governance on an annual basis in an Annual Report on Form 10-K. Companies are required to report on Form 8-K any cybersecurity incident they determine to be material within four business days of making that determination. See Item 1C “Cybersecurity” in Part I of this Form 10-K. These SEC rules, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. CSB expects this trend of state-level activity in those areas to continue and is continually monitoring developments in the states in which our customers are located.

Effect of Environmental Regulation

Compliance with federal, state, and local provisions regulating the discharge of materials into the environment, or otherwise relating to the protection of the environment, has not had a material effect upon the capital expenditures, earnings, or competitive position of CSB or its subsidiaries. CSB believes the nature of the operations of its subsidiaries has little, if any, environmental impact. CSB, therefore, anticipates no material capital expenditures for environmental control facilities for its current fiscal year or for the foreseeable future.

CSB believes its primary exposure to environmental risk is through the lending activities of the Bank. In cases where management believes environmental risk potentially exists, the Bank mitigates environmental risk exposure by requiring environmental site assessments at the time of loan origination to confirm collateral quality as to commercial real estate parcels posing higher than normal potential for environmental impact, as determined by reference to present and past uses of the subject property and adjacent sites.

Executive and Incentive Compensation

Following the adoption of additional listing requirements in 2023 to comply with the Dodd-Frank Act and rules adopted by the SEC in October 2022, public companies listed on the NYSE or Nasdaq are now required to adopt and implement “clawback” procedures policies for incentive compensation payments and to disclose the details of the procedures, which allow recovery of incentive compensation that was paid on the basis of erroneous financial information necessitating an accounting restatement due to material noncompliance with financial reporting requirements. This clawback policy is intended to apply to compensation paid within the three completed fiscal years immediately preceding the date the issuer is required to prepare a restatement a three-year look-back window of the restatement and would cover all executives (including former executives) who received incentive awards. CSB adopted a clawback policy effective December 1, 2023, though it is not required to do so.

Future Legislation

Various and significant legislation affecting financial institutions and the financial industry is from time to time adopted by the U.S. Congress and state legislatures, and regulatory agencies frequently adopt or amend regulations. Such legislation and regulation may continue to change banking laws and regulations and the operating environment of CSB and its subsidiaries in substantial and unpredictable ways and could significantly increase or decrease costs of doing business, limit or expand permissible activities, or affect the competitive balance among financial institutions. The nature and extent of future legislative and regulatory changes affecting financial institutions remains very unpredictable.

Statistical Disclosures

The following schedules present, for the periods indicated, certain financial and statistical information of the Company as required under the SEC’s “Subpart 1400 of regulation S-K”, as amended on September 11, 2020, or a specific reference as to the location of required disclosures in Item 7 Management’s Discussion and Analysis of Financial Condition and Results of Operations (“MD&A”) or Item 8 Financial Statements and Supplementary Data of this Annual Report on Form 10-K.

Distribution of Assets, Liabilities, and Stockholders’ Equity; Interest Rates and Interest Differential

The information set forth under the heading, “Average Balance Sheets and Net Interest Margin Analysis” located in the MD&A is incorporated by reference herein.

The information set forth under the heading, “Rate/Volume Analysis of Changes in Income and Expense” located in the MD&A is incorporated by reference herein.

Investment Portfolio

The following is a schedule of maturities for each category of debt securities and the related weighted average yield of such securities as of December 31, 2023:

The weighted average yields are calculated using amortized cost of investments and are based on coupon rates for securities purchased at par value, and on effective interest rates considering amortization or accretion if securities were purchased at a premium or discount. The weighted average yield on tax-exempt obligations is presented on a tax-equivalent basis based on the Company’s marginal federal income tax rate of 21%.

Loan Portfolio

The following is a schedule of maturities of loans based on contract terms and assuming no amortization or prepayments, as of December 31, 2023:

The following is a schedule of fixed rate and variable rate loans due after one year from December 31, 2023.

Summary of Loan Loss Experience

The following schedule presents an analysis of net charge-offs (recoveries) to average loans, and related ratios for the years ended:

The following schedule is a breakdown of the allowance for credit losses allocated by type of loan and related ratios. While management’s periodic analysis of the adequacy of the allowance for credit losses may allocate portions of the allowance for specific problem-loan situations, the entire allowance is available for any loan charge-offs that occur.

Deposits

The following is a schedule of average deposit amounts and average rates paid on each category for the periods indicated:

The Bank does not have any material deposits by foreign depositors. The total uninsured portion of all deposit accounts greater than $250 thousand was $254 million as of December 31, 2023, and $267 million as of December 31, 2022. The following is a schedule of maturities of time certificates of deposit in amounts greater than $250 thousand as of December 31, 2023: