FIRST US BANCSHARES, INC.

First US Bancshares, Inc., a Delaware corporation (“Bancshares” and, together with its subsidiary, the “Company”), is a bank holding company formed in 1983 registered under the Bank Holding Company Act of 1956, as amended (the “BHCA”). Bancshares operates one wholly-owned banking subsidiary, First US Bank, an Alabama banking corporation (the “Bank”). Bancshares and the Bank are headquartered in Birmingham, Alabama. Previously, the Bank operated two additional wholly-owned subsidiaries, Acceptance Loan Company and FUSB Reinsurance, Inc., both of which were legally dissolved in 2023, and all remaining assets and liabilities of these entities were transferred to the Bank prior to December 31, 2023.

The Bank conducts a general commercial banking business and offers banking services such as demand, savings, individual retirement account and time deposits, personal and commercial loans, safe deposit box services and remote deposit capture. The Bank operates and serves its customers through 15 full-service banking offices located in Birmingham, Butler, Calera, Centreville, Gilbertown, Grove Hill, Harpersville, Jackson, Thomasville, Tuscaloosa and Woodstock, Alabama; Knoxville and Powell, Tennessee; and Rose Hill, Virginia; as well as loan production offices in Mobile, Alabama and the Chattanooga, Tennessee area. The Bank provides a wide range of commercial banking services to small- and medium-sized businesses, property managers, business executives, professionals and other individuals. The Bank also performs indirect lending through third-party retailers and currently conducts this lending in 17 states, including Alabama, Arkansas, Florida, Georgia, Indiana, Iowa, Kansas, Kentucky, Mississippi, Missouri, Nebraska, North Carolina, Oklahoma, South Carolina, Tennessee, Texas and Virginia. The Bank is the Company’s only reportable operating segment upon which management makes decisions regarding how to allocate resources and assess performance.

Strategy

Our strategy focuses on increasing franchise value by building and maintaining a strong and diversified balance sheet through continued loan and deposit growth that leverages our branch network, loan production offices, and digital market capabilities. We foster a culture that adheres to effective credit underwriting standards, pricing discipline, and expense control. Our longer-term growth strategy seeks to grow loan production offices to levels that support limited branching, expansion of our customer base through digital banking offerings, and consideration of acquisition opportunities to enter new markets.

Human Capital Resources

Bancshares has no employees, other than the executive officers discussed in the information incorporated by reference in Part III, Item 10 of this report. As of December 31, 2024, the Bank had 151 full-time equivalent employees. None of our employees are party to a collective bargaining agreement. Management believes that the Company’s employee relations are satisfactory.

To facilitate talent attraction and retention, we strive to make the Company an inclusive, safe and healthy workplace, with opportunities for our employees to grow and develop in their careers, supported by strong compensation, benefits, health and welfare programs. Our talent acquisition team uses internal and external resources to recruit highly skilled and talented workers across our markets, and we encourage employee referrals for open positions.

As part of our compensation philosophy, we believe that we must offer and maintain market competitive total rewards programs for our employees in order to attract and retain superior talent. In addition to healthy base wages, additional programs include bonus opportunities, Company matched 401(k) Plan, healthcare and insurance benefits, health savings and flexible spending accounts, vacation and paid time off, family and military leave, flexible work schedules and employee assistance programs.

The success of our business is fundamentally connected to the well-being of our people. Accordingly, we are committed to the health, safety and wellness of our employees. We provide our employees and their families with access to a variety of flexible and convenient health and welfare programs, including benefits that support their physical and mental health by providing tools and resources to help them improve or maintain their health status; and that offer choice where possible so they can customize their benefits to meet their needs and the needs of their families.

We strive to maintain an inclusive workplace and seek to foster an environment where all of our employees can thrive through active engagement in the ongoing success of our organization. It is essential to our business that we continually attract and retain a talented workforce, and our practices are designed to promote fairness in the hiring process. We encourage a customer-focused orientation that meets the diverse needs of consumers and businesses in the communities in which we serve.

Competition

We face strong competition in making loans, acquiring deposits and attracting customers for investment services. Competition among financial institutions is based on interest rates offered on deposit accounts, interest rates charged on loans, other credit and service charges relating to loans, the quality and scope of the services rendered, the convenience of banking facilities and, in the case of loans to commercial borrowers, relative lending limits. We compete with numerous other financial services providers, including commercial banks, online banks, credit unions, finance companies, mutual funds, insurance companies, investment banking companies, brokerage firms and other financial intermediaries operating in Alabama and elsewhere. Many of these competitors, some of which are affiliated with large bank holding companies, have substantially greater resources and lending limits than we do. In addition, many of our non-bank competitors are not subject to the same extensive federal regulations that govern bank holding companies and federally insured banks.

The financial services industry is likely to become more competitive as further technological advances enable more companies to provide financial services. These technological advances may diminish the importance of depository institutions and other financial intermediaries.

Supervision and Regulation

General

We are extensively regulated under both federal and state law. These laws restrict permissible activities and investments and require compliance with various consumer protection provisions applicable to lending, deposit, brokerage and fiduciary activities. They also impose capital adequacy requirements and condition Bancshares’ ability to repurchase stock or to receive dividends from the Bank. Bancshares is subject to comprehensive examination and supervision by the Board of Governors of the Federal Reserve System (the “Federal Reserve”), and the Bank and its subsidiaries are subject to comprehensive examination and supervision by the Alabama State Banking Department (the “ASBD”) and the Federal Deposit Insurance Corporation (the “FDIC”). These regulatory agencies generally have broad discretion to impose restrictions and limitations on our operations. This supervisory framework could materially impact the conduct and profitability of our activities. It is anticipated that the Trump administration and the current U.S. Congress likely will not increase the regulatory burden on community banking organizations and may seek to reduce and streamline certain prudential and regulatory requirements applicable to community banking organizations at a federal level based on statements made by relevant congressional leaders and the acting leaders of certain banking agencies. At this time, however, it is not possible to predict with any certainty the actual impact the Trump administration may have on the banking industry or our operations.

To the extent that the following information describes statutory and regulatory provisions, it is qualified in its entirety by reference to the text of such provisions. Proposals to change the laws and regulations governing the banking industry are frequently raised at both the state and federal level. The likelihood and timing of any changes in these laws and regulations, as well as the impact that such changes may have on us, are difficult to ascertain. A change in applicable laws and regulations, or in the manner in which such laws or regulations are interpreted by regulatory agencies or courts, may have a material effect on our business, operations and earnings.

Regulation of Bancshares

Bancshares is registered as a bank holding company and is subject to regulation and supervision by the Federal Reserve. The BHCA requires a bank holding company to secure the approval of the Federal Reserve before it owns or controls, directly or indirectly, more than five percent (5%) of the voting shares or substantially all of the assets of any bank or thrift, or merges or consolidates with another bank or thrift holding company. Further, under the BHCA, the activities of a bank holding company and any nonbank subsidiary are limited to: (1) those activities that the Federal Reserve determines to be so closely related to banking as to be a proper incident thereto and (2) investments in companies not engaged in activities closely related to banking, subject to quantitative limitations on the value of such investments. Prior approval of the Federal Reserve may be required before engaging in certain activities. In making such determinations, the Federal Reserve is required to weigh the expected benefits to the public, such as greater convenience, increased competition and gains in efficiency, against the possible adverse effects, such as undue concentration of resources, decreased or unfair competition, conflicts of interest, and unsound banking practices.

There are a number of restrictions imposed on us by law and regulatory policy that are designed to minimize potential losses to the depositors of the Bank and the Deposit Insurance Fund maintained by the FDIC (as discussed in more detail below) if the Bank should become insolvent. For example, the Federal Reserve requires bank holding companies to serve as a source of financial strength to their subsidiary depository institutions and to commit resources to support such institutions in circumstances in which they might not otherwise do so. The Federal Reserve also has the authority to require a bank holding company to terminate any activity or to relinquish control of a non-bank subsidiary upon the Federal Reserve’s determination that such activity or control constitutes a serious risk to the financial soundness and stability of any bank subsidiary of the bank holding company.

Any capital loan by Bancshares to the Bank is subordinate in right of payment to deposits and certain other indebtedness of the Bank. In addition, in the event of Bancshares’ bankruptcy, any commitment by Bancshares to a federal banking regulatory agency to maintain the capital of the Bank will be assumed by the bankruptcy trustee and entitled to a priority of payment.

The Federal Deposit Insurance Act provides that, in the event of the “liquidation or other resolution” of an insured depository institution, the claims of depositors of the institution (including the claims of the FDIC as a subrogee of insured depositors) and certain claims for administrative expenses of the FDIC as a receiver will have priority over other general unsecured claims against the institution. If an insured depository institution fails, then insured and uninsured depositors, along with the FDIC, will have priority of payment over unsecured, non-deposit creditors, including the institution’s holding company, with respect to any extensions of credit that they have made to such insured depository institution.

Regulation of the Bank

The operations and investments of the Bank are limited by federal and state statutes and regulations. The Bank is subject to supervision and regulation by the ASBD and the FDIC and to various requirements and restrictions under federal and state law, including requirements to maintain reserves against deposits, restrictions on the types, amount and terms and conditions of loans that it may originate, and limits on the types of other activities in which the Bank may engage and the investments it may make.

The Bank is subject to federal laws that limit the amount of transactions between the Bank and its nonbank affiliates, including Bancshares. Under these provisions, transactions by the Bank with nonbank affiliates (such as loans or investments) are generally limited to 10% of the Bank’s capital and surplus for all covered transactions with any one affiliate and 20% of capital and surplus for all covered transactions with all affiliates. Any extensions of credit to affiliates, with limited exceptions, must be secured by eligible collateral in specified amounts. The Bank is also prohibited from purchasing any “low quality” assets from an affiliate. The Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”) imposed additional requirements on transactions with affiliates, including an expansion of the definition of “covered transactions” and an increase in the length of time for which collateral requirements regarding covered transactions must be maintained.

In addition, the Dodd-Frank Act created the Consumer Financial Protection Bureau (the “CFPB”), an independent bureau with broad authority to regulate the consumer finance industry, including regulated financial institutions, non-banks and others involved in extending credit to consumers. The CFPB has authority through rulemaking, orders, policy statements, guidance and enforcement actions to administer and enforce federal consumer financial laws. Although the CFPB has the power to interpret, administer and enforce federal consumer financial laws, the Dodd-Frank Act provides that the federal banking regulatory agencies continue to have examination and enforcement powers over the financial institutions that they supervise relating to the matters within the jurisdiction of the CFPB if the supervised institutions have less than $10 billion in assets.

Over the last several years, the CFPB has taken an aggressive approach to the regulation (and supervision, where applicable) of providers of consumer financial products and services. For example, the CFPB has taken, or attempted to take, a proactive, multi-front approach to protect consumers from excessive overdraft and non-sufficient funds fees, including through proposed or final rules, interpretive opinions and enforcement actions. Given the increased number and expansive nature of its regulatory initiatives, the CFPB has been subject to lawsuits brought by the banking industry and other providers of consumer financial products and services. The CFPB’s approach may change under the Trump administration, but it remains unclear exactly what changes will occur or how quickly. In addition, certain rules that the Biden administration CFPB finalized may be subject to reversal by either the U.S. Congress or the new CFPB administration.

The Dodd-Frank Act requires the banking agencies and the SEC to establish joint rules or guidelines for financial institutions with more than $1 billion in assets which prohibit incentive compensation arrangements that the agencies determine to encourage inappropriate risks by the institution. The banking agencies issued proposed rules in 2011 and issued guidance on sound incentive compensation policies. In 2016, the Federal Reserve and the Office of Comptroller of the Currency also proposed rules that would, depending upon the assets of the institution, directly regulate incentive compensation arrangements and would require enhanced oversight and recordkeeping. As of December 31, 2024, these rules have not been implemented.

Lending Limits

Under Alabama law, the amount of loans that may be made by a bank in the aggregate to one person is limited. Alabama law provides that unsecured loans by a bank to one person may not exceed an amount equal to 10% of the capital and unimpaired surplus of the bank or 20% in the case of secured loans. For purposes of calculating these limits, loans to various business interests of the borrower, including companies in which a substantial portion of the stock is owned or partnerships in which a person is a partner, must be aggregated with those made to the borrower individually. Loans secured by certain readily marketable collateral are exempt from these limitations, as are loans secured by deposits and certain government securities.

Commercial Real Estate Concentration Limits

In December 2006, the U.S. bank regulatory agencies issued guidance entitled “Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices” to address increased concentrations in commercial real estate (“CRE”) loans. The guidance describes the criteria the agencies will use as indicators to identify institutions potentially exposed to CRE concentration risk. An institution that has (i) experienced rapid growth in CRE lending, (ii) notable exposure to a specific type of CRE, (iii) total reported loans for construction, land development, and other land representing 100% or more of the institution’s capital, or (iv) total CRE loans representing 300% or more of the institution’s capital, and the outstanding balance of the institution’s CRE portfolio has increased by 50% or more in the prior 36 months, may be identified for further supervisory analysis of the level and nature of its CRE concentration risk.

In December 2015, the U.S. bank regulatory agencies issued guidance titled “Statement on Prudent Risk Management for Commercial Real Estate Lending” to remind financial institutions of existing guidance on prudent risk management practices for CRE lending activity, including the 2006 guidance described above. In the 2015 guidance, the agencies noted their belief that financial institutions had eased CRE underwriting standards in recent years. The 2015 guidance went on to identify actions that financial institutions should take to protect themselves from CRE-related credit losses during difficult economic cycles. The 2015 guidance also indicated that the agencies would pay special attention in the future to potential risks associated with CRE lending.

In June 2023, in response to the increased risk relating to CRE loans, the federal banking agencies issued a final Interagency Policy Statement on Prudent Commercial Real Estate Loan Accommodations and Workouts. The new policy statement updates, expands on and supersedes existing guidance from 2009. Most notably, it (i) adds a new discussion of short-term loan accommodations, (ii) expands guidance regarding the evaluation and assessment of guarantors to also encompass loan sponsors, (iii) incorporates information about changes to accounting principles since 2009, and (iv) updates and expands the illustrative examples of CRE loan workouts. Furthermore, on December 18, 2023, the FDIC issued an advisory on Managing Commercial Real Estate Concentrations in a Challenging Economic Environment, which conveys certain key risk management practices for FDIC-supervised institutions to consider in managing CRE loan concentrations in the current economic environment.

Securities and Exchange Commission

Bancshares is under the jurisdiction of the Securities and Exchange Commission (“SEC”) for matters relating to the offer and sale of its securities and is subject to the SEC’s rules and regulations related to periodic reporting, reporting to shareholders, proxy solicitations and insider trading regulations.

Monetary Policy

Our earnings are and will be affected by domestic economic conditions and the monetary and fiscal policies of the United States government and its agencies. The monetary policies of the Federal Reserve have a substantial effect on the operating results of commercial banks, including the Bank. The Federal Reserve has a significant impact on the levels of bank loans, investments and deposits through its open market operations in United States government securities and through its regulation of, among other things, the discount rate on borrowings of member banks and the reserve requirements against member banks’ deposits. It is not possible to predict the nature and impact of future changes in monetary and fiscal policies.

Deposit Insurance

The Bank’s deposits are insured up to applicable limits by the Deposit Insurance Fund maintained by the FDIC. As a result, the Bank is required to pay periodic assessments to maintain insurance coverage for its deposits. Under the FDIC’s assessment system for banks with less than $10 billion in assets, the assessment rate is determined based on a number of factors, including the Bank’s CAMELS (supervisory) rating, leverage ratio, net income, non-performing loan ratios, other real estate owned (OREO) ratios, core deposit ratios, one-year organic asset growth and a loan mix index.

The FDIC has authority to increase insurance assessments. A significant increase in insurance assessments would likely have an adverse effect on our operating expense, results of operations, and cash flows. Management cannot predict what insurance assessment rates will be in the future. Furthermore, deposit insurance may be terminated by the FDIC upon a finding that the institution has engaged in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC.

Dividend Restrictions

Under Delaware law, dividends may be paid only out of the amount calculated as the present fair value of the total assets of the corporation, minus the present fair value of the total liabilities of the corporation, minus the capital of the corporation. In the event that there is no such amount, dividends may be paid out of the net profits of the corporation for the fiscal year in which the dividend is declared and/or the immediately preceding fiscal year. Dividends may not be paid, however, out of net profits of the corporation if the capital represented by the issued and outstanding stock of all classes having a preference on the distribution of assets is impaired. Further, the Federal Reserve permits bank holding companies to pay dividends only out of current earnings and only if future retained earnings would be consistent with the company’s capital, asset quality and financial condition.

Since it has no significant independent sources of income, Bancshares’ ability to pay dividends depends on its ability to receive dividends from the Bank. Under Alabama law, the Bank may not pay a dividend in excess of 90% of its net earnings unless its surplus is equal to at least 20% of capital. The Bank is also required by Alabama law to seek the approval of the Superintendent of the ASBD prior to the payment of dividends if the total of all dividends declared by the Bank in any calendar year will exceed the total of (1) the Bank’s net earnings for that year, plus (2) its retained net earnings for the preceding two years, less any required transfers to surplus. Alabama law defines net earnings as the remainder of all earnings from current operations plus actual recoveries on loans and investments and other assets, after deducting from the total thereof all current operating expenses, actual losses, accrued dividends on preferred stock, if any, and all federal, state and local taxes. The Bank must be able to satisfy the conditions described above in order to declare or pay a dividend to Bancshares without obtaining the prior approval of the Superintendent of the ASBD. In addition, the FDIC prohibits the payment of cash dividends if (1) as a result of such payment, the bank would be undercapitalized or (2) the bank is in default with respect to any assessment due to the FDIC, including a deposit insurance assessment. These restrictions could materially influence the Bank’s, and therefore Bancshares’, ability to pay dividends. The Federal Reserve, which has authority to prohibit a bank holding company from paying dividends or making other distributions, has issued a Supervisory Letter stating that a bank holding company should not pay cash dividends unless its net income available to common stockholders has been sufficient to fully fund the dividends, and the prospective rate of earnings retention appears to be consistent with the holding company’s capital needs, asset quality, and overall financial condition. The Dodd-Frank Act, Basel III (described below), and their respective implementing regulations impose additional restrictions on the ability of banking institutions to pay dividends.

Capital Adequacy

In July 2013, the federal banking regulatory agencies adopted regulations to implement the framework developed by the Basel Committee on Banking Supervision (“Basel Committee”) for strengthening international capital and liquidity, known as “Basel III” (the “Basel III Rule”). The Basel III Rule provides risk-based capital guidelines designed to make regulatory capital requirements more sensitive to differences in risk profiles among banks, to account for off-balance sheet exposures, and to minimize disincentives for holding liquid assets. Under these guidelines, assets and off-balance sheet items are assigned to broad risk categories, each with appropriate risk-weights. The net amount of assets remaining after applying the risk-weights to the gross asset values represents the institution’s total risk-weighted assets (“RWA”). An institution’s total RWA are used to calculate its regulatory capital ratios. The Basel III Rule establishes minimum capital and leverage ratios that supervised financial institutions are required to maintain, while also providing countercyclical capital requirements so that the required amount of capital increases in times of economic expansion and decreases in times of economic contraction, consistent with safety and soundness. Under the Basel III Rule, banks must maintain a specified capital conservation buffer above each of the required minimum capital levels in order to avoid limitations on paying dividends, engaging in share repurchases and paying certain discretionary bonuses.

In December 2017, the Basel Committee published the last version of the Basel III accord, generally referred to as “Basel IV.” The Basel Committee stated that a key objective of the revisions incorporated into the framework is to reduce excessive variability of risk-weighted assets, which will be accomplished by enhancing the robustness and risk sensitivity of the standardized approaches for credit risk and operational risk, which will facilitate the comparability of banks’ capital ratios; constraining the use of internally modeled approaches; and complementing the risk-weighted capital ratio with a finalized leverage ratio and a revised and robust capital floor. Leadership of the federal banking agencies who are tasked with implementing Basel IV has indicated that it is considering how to appropriately apply these revisions in the United States. Although it is uncertain at this time, some, if not all, of the Basel IV accord may be incorporated into the capital requirements framework applicable to Bancshares and the Bank.

Banking organizations must have appropriate capital planning processes, with proper oversight from the board of directors. Accordingly, pursuant to a separate, general supervisory letter from the Federal Reserve, bank holding companies are expected to conduct and document comprehensive capital adequacy analyses prior to the declaration of any dividends (on common stock, preferred stock, trust preferred securities or other Tier 1 capital instruments), capital redemptions or capital repurchases. Moreover, the federal banking agencies have adopted a joint agency policy statement, noting that the adequacy and effectiveness of a bank’s interest rate risk management process and the level of its interest rate exposures are critical factors in the evaluation of the bank’s capital adequacy.

In 2018, the U.S. Congress passed, and the President signed into law, the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 (the “Growth Act”) to modify or remove certain financial reform rules and regulations, including some of those implemented under the Dodd-Frank Act. While the Growth Act maintains most of the regulatory structure established by the Dodd-Frank Act, it amends certain aspects of the regulatory framework for small depository institutions with total assets of less than $10 billion and for large banks with total assets of more than $50 billion. The Growth Act, among other things, requires the federal banking agencies to issue regulations allowing community bank organizations with total assets of less than $10 billion and limited amounts of certain assets and off-balance sheet exposures to access a simpler capital regime focused on a bank’s Tier 1 leverage capital levels rather than risk-based capital levels that are the focus of the capital rules issued under the Dodd-Frank Act implementing Basel III.

Among other changes, the Growth Act expands the definition of qualified mortgages that may be held by a financial institution and simplifies the regulatory capital rules for financial institutions and their holding companies with total consolidated assets of less than $10 billion by instructing the federal banking regulators to establish a single “Community Bank Leverage Ratio” of between 8% and 10% to replace the leverage and risk-based regulatory capital ratios. The Growth Act also includes regulatory relief for community banks regarding regulatory examination cycles, call reports, the Volcker Rule (proprietary trading prohibitions), mortgage disclosures, and risk weights for certain high-risk commercial real estate loans.

Pursuant to the Growth Act, in October 2019, the federal banking agencies adopted regulations that exempt a qualifying community bank and its holding company that have Tier 1 leverage ratios of greater than 9% from the risk-based capital requirements of the capital rules issued under the Dodd-Frank Act. A qualifying community organization is a depository institution or its holding company that has less than $10 billion in average total consolidated assets; has off-balance-sheet exposures of 25% or less of total consolidated assets; has trading assets plus trading liabilities of 5% or less of total consolidated assets; and is not an advanced approaches banking organization. A qualifying community banking organization and its holding company that have chosen the proposed framework will not be required to calculate the existing risk-based and leverage capital requirements. A qualifying community banking organization will also be considered to have met the capital ratio requirements to be well capitalized for the agencies’ prompt corrective action rules provided it has a community bank leverage ratio greater than 9%. The new community bank leverage ratio framework first became available for banking organizations to use on March 31, 2020. A qualifying community banking organization may opt into and out of the framework by completing the associated reporting requirements on its call report. We presently do not anticipate opting into the framework.

In July 2023, the federal banking regulators proposed revisions to the Basel III Capital Rules to implement the Basel Committee’s 2017 standards and make other changes to the Basel III Capital Rules. In September 2024, the federal banking regulators announced a reproposal of the revisions with some modifications. The proposed rules introduce revised credit risk, equity risk, operational risk, credit valuation adjustment risk and market risk requirements, among other changes. However, the revised capital requirements of the proposed rule would not apply to the Company or the Bank because they have less than $100 billion in total consolidated assets and trading assets and liabilities below the threshold for market risk requirements.

Prompt Corrective Action

In addition to the required minimum capital levels described above, federal law establishes a system of “prompt corrective actions” that federal banking agencies are required to take, and certain actions that they have discretion to take, based on the capital category into which a federally regulated depository institution falls. Regulations set forth detailed procedures and criteria for implementing prompt corrective action in the case of any institution that is not adequately capitalized. Each institution is assigned to one of five categories based on its capital ratios: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” or “critically undercapitalized.” Institutions categorized as “undercapitalized” or worse become subject to increasing levels of regulatory oversight and restrictions, which may include, among other things, limitations on growth and activities and payment of dividends.

As of December 31, 2024, the Bank was “well-capitalized” under the prompt corrective action rules. This classification is primarily for the purpose of applying the federal prompt corrective action provisions and is not intended to be, and should not be, interpreted as a representation of our overall financial condition or prospects.

Community Reinvestment Act

The Community Reinvestment Act (the “CRA”) requires the federal banking regulatory agencies to assess all financial institutions that they regulate to determine whether these institutions are meeting the credit needs of the communities that they serve, including their assessment area(s) (as established for these purposes in accordance with applicable regulations based principally on the location of the institution’s branch offices). Under the CRA, institutions are assigned a rating of “outstanding,” “satisfactory,” “needs to improve” or “unsatisfactory.” An institution’s record in meeting the requirements of the CRA is made publicly available and is taken into consideration in connection with any applications that it files with federal regulators to engage in certain activities, including approval of branches or other deposit facilities, mergers and acquisitions, office relocations or expansions into non-banking activities. The Bank received a “satisfactory” rating in its most recent CRA evaluation.

On October 24, 2023, the FDIC, the Federal Reserve Board, and the Office of the Comptroller of the Currency (the “OCC”) issued a final rule to strengthen and modernize the CRA regulations. Under the final rule, banks with assets of at least $600 million as of December 31 in both of the prior two calendar years and less than $2 billion as of December 31 in either of the prior two calendar years will be an “intermediate bank,” and banks with assets of at least $2 billion as of December 31 in both of the prior two calendar years will be a “large bank.” The agencies will evaluate large banks under four performance tests: the Retail Lending Test, the Retail Services and Products Test, the Community Development Financing Test, and the Community Development Services Test. The agencies will evaluate intermediate banks under the Retail Lending Test and either the current community development test, referred to in the final rule as the Intermediate Bank Community Development Test, or, at the bank’s option, the Community Development Financing Test. The applicability date for the majority of the provisions in the CRA regulations is January 1, 2026, and additional requirements will be applicable on January 1, 2027. However, in March 2024, a federal district court issued a preliminary injunction of the regulations, and litigation addressing the constitutionality of the regulations is still pending.

Fair Access

On January 23, 2025, President Trump signed an Executive Order titled “Strengthening American Leadership in the Digital Financial Technology” (the “Order”). The primary focus of the Order is promoting U.S. developments in blockchain, digital assets and other emerging financial technologies, including cryptocurrency. The Order also states that one of the administration’s objectives is “protecting and promoting fair and open access to banking services for all law-abiding individual citizens and private-sector entities alike.” This objective appears to be related to a regulatory initiative in the first Trump administration that ultimately led to the OCC adopting a final rule on “Fair Access to Financial Services” (the “Fair Access Rule”) in the final days of that administration. The Fair Access Rule would require “covered banks” (generally, national banks with over $100 billion in assets) to:

•

Make each financial service it offers available to all persons in the geographic market served by the covered bank on proportionally equal terms;

•

Not deny any person a financial service the covered bank offers unless the denial is justified by such person’s quantified and documented failure to meet quantitative, impartial risk-based standards established in advance by the covered bank; and

•

Not deny, in coordination with others, any person a financial service the covered bank offers.

The Trump administration expressed concern, in particular, for banks denying access due to political or social concerns. The Biden administration paused implementation of the Fair Access Rule, and it never became effective. The new Trump administration may revive the Fair Access Rule or enact similar regulations. Any such rule could impose a regulatory burden on covered banks to document compliance. The Company is not a covered bank under the existing version of the Fair Access Rule, but additional rulemaking could broaden its scope to apply to the Company.

Third-Party Risk Management

On June 9, 2023, the OCC, Federal Reserve, and FDIC issued final interagency guidance on risk management of third-party relationships, including third-party lending relationships. The interagency guidance is based, in part, on the OCC’s previously existing third-party risk management guidance from 2013 and seeks to, among other things, promote consistency in third-party risk management and provide sound risk management guidance for third-party relationships commensurate with a bank’s risk profile and complexity as well as the criticality of the activity. The final interagency guidance replaces each agency’s existing guidance on this topic (including the OCC's 2020 Frequently Asked Questions on Third-Party Relationships) and is directed to all banking organizations supervised by the OCC, Federal Reserve, and FDIC. Additionally, third party relationship risk management and banking as a service arrangements (including with respect to deposit products and services) have been topics of focus for federal bank regulators in 2024 and further rulemaking activity or guidance may be forthcoming.

Anti-Money Laundering Laws

Under various federal laws, including the Currency and Foreign Transactions Reporting Act (also known as the “Bank Secrecy Act”), as amended by the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT) Act, financial institutions are subject to prohibitions against specified financial transactions and account relationships, as well as enhanced due diligence and “know your customer” standards in their dealings with foreign financial institutions and foreign customers. These laws also mandate that financial institutions establish anti-money laundering programs meeting certain standards and require the federal banking regulators to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions.

The Anti-Money Laundering Act of 2020 (“AMLA”), which amends the Bank Secrecy Act, was enacted in January 2021. The AMLA is intended to be a comprehensive reform and modernization to U.S. bank secrecy and anti-money laundering laws. Among other things, it codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the U.S. Department of the Treasury to promulgate priorities for anti-money laundering and countering the financing of terrorism policy; requires the development of standards for testing technology and internal processes for Bank Secrecy Act compliance; expands enforcement- and investigation-related authority, including increasing available sanctions for certain Bank Secrecy Act violations; and expands Bank Secrecy Act whistleblower incentives and protections. Many of the statutory provisions in the AMLA will require additional rulemakings, reports and other measures, and the impact of the AMLA will depend on, among other things, rulemaking and implementation guidance. In June 2021, the Financial Crimes Enforcement Network ("FinCEN"), a bureau of the U.S. Department of the Treasury, issued the priorities for anti-money laundering and countering the financing of terrorism policy required under the AMLA. The priorities include: corruption, cybercrime, terrorist financing, fraud, transnational crime, drug trafficking, human trafficking and proliferation financing.

The Corporate Transparency Act (the “CTA”) was adopted as Title LXIV of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021. FinCEN adopted a final regulation as 31 C.F.R. 101.380 on September 30, 2022 to implement the CTA. This became effective on January 1, 2024. These regulations require entities to report information about their beneficial owners and the individuals who created the entity (together, “beneficial ownership information” or “BOI”). FinCEN explained that the proposed rule would help protect the U.S. financial system from illicit use by making it more difficult for bad actors to conceal their financial activities through entities with opaque ownership structures. FinCEN also explained that the proposed reporting obligations would provide essential information to law enforcement and others to help prevent corrupt actors, terrorists, and proliferators from hiding money or other property in the United States. The new rules expand financial institutions’ obligations under the Customer Due Diligence Rule (the “CDD Rule”) to collect information and verify the beneficial ownership of legal entities. The constitutionality of the CTA has been challenged in federal court, and enforcement of the CTA is subject to an injunction pending the outcome of the related litigation. Although the Company and the Bank are exempt from the CTA’s requirements to report their respective beneficial owners, the new CTA reporting requirements, if they become effective, may increase the Bank’s anti-money laundering diligence activities and costs.

The United States has imposed various sanctions upon various foreign countries, such as China, Iran, North Korea, Russia and Venezuela, and certain of their government officials and persons. Banks are required to comply with these sanctions which require additional customer screening and transaction monitoring.

Russia’s February 2022 invasion of Ukraine has generated a significant number of new sanctions on Russia, Russian persons and suppliers of military or dual-purpose products to Russia. Federal bank regulators have issued alerts that Russia and others may step up cyber-attacks and data intrusions following the invasion. FinCEN has issued four alerts on potential Russian illicit financial activity since February 2022. On January 25, 2023 FinCEN issued an alert to financial institutions on potential investments in the U.S. commercial real estate sector by sanctioned Russian elites, oligarchs, their family members, and the entities through which they act. The alert listed potential red flags and typologies involving attempted sanctions evasion in the commercial real estate sector, and reminds financial institutions of their Bank Secrecy Act (BSA) reporting obligations.

Overdrafts

Federal bank regulators have updated their guidance several times on overdrafts, including overdrafts incurred at automated teller machines and point of sale terminals. Overdrafts also have been a CFPB concern, and in 2021, this entity began refocusing on this issue with a view to “insure that banks continue to evolve their businesses to reduce reliance on overdraft and not sufficient funds fees.” Among other things, federal regulators require banks to monitor accounts and to limit the use of overdrafts by customers as a form of short-term, high-cost credit, including, for example, giving customers who overdraw their accounts on more than six occasions where a fee is charged in a rolling 12 month period a reasonable opportunity to choose a less costly alternative and decide whether to continue with fee-based overdraft coverage. It also encourages placing daily limits on overdraft fees, and asks banks to consider eliminating overdraft fees for transactions that overdraw an account by a de minimis amount. Overdraft policies, processes, fees and disclosures are frequently the subject of litigation against banks in various jurisdictions. Federal bank regulators have been considering responsible small dollar lending, including overdrafts and related fee issues. In May 2020, they issued principals for offering small-dollar loans in a responsible manner.

CFPB Consumer Financial Protection Circular 2022-06 (Oct. 26, 2022) concluded that overdraft fee practices must comply with Regulation Z, Regulation E, and the prohibition against unfair, deceptive, and abusive acts or practices in Section 1036 of the Consumer Financial Protection Act. Further, overdraft fees assessed by financial institutions on transactions that a consumer would not reasonably anticipate are likely unfair even if these comply with these other consumer laws and regulations. The CFPB proposed on February 6, 2019 to rescind its mandatory underwriting standards for loans covered by its 2017 Payday, Vehicle Title and Certain High-Cost Installment Loans rule, and has separately proposed delaying the effectiveness of such 2017 rule.

The CFPB has a broad mandate to regulate consumer financial products and services, whether or not offered by banks or their affiliates. The CFPB has the authority to adopt regulations and enforce various laws, including fair lending laws, the Truth in Lending Act, the Electronic Funds Transfer Act, mortgage lending rules, the Truth in Savings Act, the Fair Credit Reporting Act and Privacy of Consumer Financial Information rules. Although the CFPB does not examine or supervise banks with less than $10 billion in assets, banks of all sizes are affected by the CFPB’s regulations, and the precedents set in CFPB enforcement actions and interpretations.

Brokered Deposits

The FDIC limits the ability to accept brokered deposits to those insured depository institutions that are well capitalized. Institutions that are less than well capitalized cannot accept, renew or roll over any brokered deposit unless they have applied for and been granted a waiver by the FDIC. The FDIC has defined the “national rate” for all interest-bearing deposits held by less-than-well-capitalized institutions as “a simple average of rates paid by all insured depository institutions and branches for which data are available” and has stated that its presumption is that this national rate is the prevailing rate in any market. As such, institutions that are less than well capitalized that are permitted to accept, renew or roll over brokered deposits via a FDIC waiver generally may not pay an interest rate in excess of the national rate plus 75 basis points on such brokered deposits. As of December 31, 2024, the Bank categorized $72.4 million, or 7.4% of its deposit liabilities, as brokered deposits.

On December 15, 2020, the FDIC issued a final rule establishing a new framework for analyzing whether bank deposits obtained through third-party arrangements are brokered deposits pursuant to Section 29 of the Federal Deposit Insurance Act. Generally, a person is a "deposit broker" if it is "engaged in the business of placing deposits, or facilitating the placement of deposits, of third parties with insured depository institutions or the business of placing deposits with insured depository institutions for the purpose of selling interests in those deposits to third parties." The final rule clarifies what it means to be in the business of placing deposits and facilitating the placement of deposits for purpose of the deposit broker definition.

Section 29 provides, in particular, that a person with an exclusive deposit placement arrangement with one insured depository institution will not be considered a deposit broker because it is not in the business of placing deposits or facilitating the placement of deposits.

The final rule also clarifies application of the “primary purpose exception” to Section 29 by identifying a number of common business relationships described as “designated exceptions” and meeting the primary purpose exception. Many of these designated exceptions are arrangements previously addressed in advisory opinions and include: certain investment-related deposits; property management service deposits; deposits for cross-border clearing services; deposits related to real estate and mortgage servicing activities; retirement and 529 deposits; deposits related to employee benefits programs; deposits held to secure credit card loans; and deposits placed by agencies to disburse government benefits. As a result of this final rule, the Company's deposits that were classified as brokered deposits reduced significantly beginning with the June 30, 2021 reporting period.

On July 30, 2024, the FDIC proposed a rule that would amend the current rules governing brokered deposits. The proposed rule as drafted would, among other things, (1) amend the definition of “deposit broker”; (2) eliminate the exclusive deposit placement arrangement exception; (3) eliminate the enabling transactions designated business exception; (4) revise the “25 percent test” designated business exception for a primary purpose exception to be available only to broker-dealers and investment advisers and only if less than 10 percent of the total assets that the broker-dealer or investment adviser has under management for its customers is placed at one or more insured depository institutions; (5) revise the interpretation of the primary purpose exception to consider the third party’s intent in placing customer funds at a particular insured depository institution; (6) allow only insured depository institutions to file notices and applications for primary purpose exceptions; and (7) clarify how an insured depository institution that loses its “agent institution” status regains that status. The Company is currently evaluating the effect of the proposed rule on the Company were it to be adopted as a final rule and monitoring the status of this rulemaking. Based on recent statements from the new Acting Chairman of the FDIC, the proposed rule is unlikely to be adopted as proposed due to the change in Presidential administration and the prospects and timing for any re-proposal or supervisory action in this area remain uncertain at this time.

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley”) comprehensively revised the laws affecting corporate governance, auditing, executive compensation and corporate reporting for entities with equity or debt securities registered under the Securities Exchange Act of 1934, as amended (the “Exchange Act”). Among other things, Sarbanes-Oxley and its implementing regulations established new membership requirements and additional responsibilities for audit committees, imposed restrictions on the relationships between public companies and their outside auditors (including restrictions on the types of non-audit services that auditors may provide), imposed additional responsibilities for public companies’ external financial statements on the chief executive officer and chief financial officer, and expanded the disclosure requirements for corporate insiders. The requirements are intended to allow stockholders to more easily and efficiently monitor the performance of companies and directors. We and our Board of Directors have, as appropriate, adopted or modified our policies and practices in order to comply with these regulatory requirements and to enhance our corporate governance practices.

As required by Sarbanes-Oxley, we have adopted a Code of Business Conduct and Ethics applicable to our Board, executives and employees. This Code of Business Conduct can be found on our website at http://www.fusb.com under the tabs “About – Investor Relations – FUSB Policies.”

Privacy of Customer Information

The Financial Services Modernization Act of 1999 (also known as the “Gramm-Leach-Bliley Act” or the “GLBA”) and the implementing regulations issued by federal banking regulatory agencies require financial institutions to adopt policies and procedures regarding the disclosure of nonpublic personal information about their customers to non-affiliated third parties. In general, financial institutions are required to explain to customers their policies and procedures regarding the disclosure of such nonpublic personal information, and, unless otherwise required or permitted by law, financial institutions are prohibited from disclosing such information except as provided in their policies and procedures. Specifically, the GLBA established certain information security guidelines that require each financial institution, under the supervision and ongoing oversight of its board of directors or an appropriate committee thereof, to develop, implement, and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information, to protect against anticipated threats or hazards to the security or integrity of such information, and to protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer.

The GLBA and related regulations require banks and their affiliated companies to adopt and disclose privacy policies, including policies regarding the sharing of personal information with third parties. The GLBA also permits bank subsidiaries to engage in financial activities, which are similar to those permitted to financial holding companies. In December 2015, Congress amended the GLBA as part of the Fixing America’s Surface Transportation Act. This amendment provided financial institutions, which meet certain conditions, an exemption from the requirement to deliver an annual privacy notice. On August 10, 2018, the CFPB announced that it had finalized conforming amendments to its implementing regulation, Regulation P.

On October 22, 2024, the CFPB issued a final rule to implement Section 1033 of the Dodd-Frank Act, which gives individuals the right to obtain data regarding consumer financial products and services they have obtained. The final rule requires certain entities, including the Bank, to comply with an established framework to govern consumer access to electronic financial data. Compliance with the rule will be phased in over several years with the Bank required to be in compliance by April 1, 2030. Following the issuance of this rule, two trade associations and a national bank headquartered in Kentucky filed a lawsuit challenging the rule in the United States District Court for the Eastern District of Kentucky. In this lawsuit, the plaintiffs alleged that the CFPB exceeded its statutory authority in adopting the rule.

A variety of federal and state privacy laws govern the collection, safeguarding, sharing and use of customer information, and require that financial institutions have policies regarding information privacy and security. Some state laws also protect the privacy of information of state residents and require adequate security of such data, and certain state laws may, in some circumstances, require us to notify affected individuals of security breaches of computer databases that contain their personal information. These laws may also require us to notify law enforcement, regulators or consumer reporting agencies in the event of a data breach, as well as businesses and governmental agencies that own data. In March 2021, Virginia adopted the Consumer Data Protection Act (the “VCDPA”), which imposes certain restrictions and requirements on businesses that collect consumer data for at least 100,000 consumers in Virginia. The Bank currently has fewer than 100,000 customers in Virginia but may become subject to the VCDPA if its customer base grows above that level. The Company could face enforcement actions by the Virginia Attorney General and penalties for noncompliance with the VCDPA.

Cybersecurity

The Cybersecurity Information Sharing Act of 2015 (“CISA”) was intended to improve cybersecurity in the United States by enhanced sharing of information about security threats among the U.S. government and private sector entities, including financial institutions. CISA also authorizes companies to monitor their own systems notwithstanding any other provision of law and allows companies to carry out cybersecurity defensive measures on their own systems. The law includes liability protections for companies that share cyber threat information with third parties so long as such sharing activity is conducted in accordance with CISA.

In October 2016, the federal bank regulatory agencies issued an Advance Notice of Proposed Rulemaking regarding enhanced cyber risk management standards which would apply to a wide range of large financial institutions and their third-party service providers, including Bancshares and the Bank. The proposed standards would expand existing cybersecurity regulations and guidance to focus on cyber risk governance and management, management of internal and external dependencies, and incident response, cyber resilience, and situational awareness. In addition, the proposal contemplates more stringent standards for institutions with systems that are critical to the financial sector.

The federal banking regulators regularly issue guidance regarding cybersecurity intended to enhance cyber risk management standards among financial institutions. A financial institution is expected to establish multiple lines of defense and to ensure its risk management processes address the risk posed by potential threats to the institution. A financial institution’s management is expected to maintain sufficient processes to effectively respond and recover the institution’s operations after a cyber-attack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations if a critical service provider of the institution falls victim to this type of cyber-attack.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually monitoring developments in the states in which our customers are located.

In November 2021, federal bank regulatory agencies adopted a rule regarding notification requirements for banking organizations related to significant computer security incidents. Under the final rule, a bank holding company, such as the Company, and an FDIC-supervised insured depository institution, such as the Bank, are required to notify the Federal Reserve or FDIC, respectively, within 36 hours of incidents that have materially disrupted or degraded, or are reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. Service providers are required under the rule to notify any affected bank client it provides services to as soon as possible when it determines it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided by that entity to the bank for four or more hours.

Furthermore, once administrative rules are adopted by the CISA, the Cyber Incident Reporting for Critical Infrastructure Act, enacted in March 2022, will require certain covered entities, including those in the financial services industry, to report a covered cyber incident to CISA within 72 hours once the covered entity reasonably believes an incident has occurred. Separate reporting to CISA will also be required within 24 hours if a ransom payment is made as a result of a ransomware attack.

In July 2023, the SEC adopted amendments to its rules to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance, and incident reporting by public companies that are subject to the reporting requirements of the Exchange Act. Specifically, the amendments require current reporting about material cybersecurity incidents, periodic disclosures about a registrant’s policies and procedures to identify and manage cybersecurity risk, management’s role in implementing cybersecurity policies and procedures, management's cybersecurity expertise, if any, and the board of directors oversight of cybersecurity risk. Additionally, the rules require registrants to provide updates about previously reported cybersecurity incidents in their periodic reports.

On October 19, 2023, the CFPB announced a proposed rule to adopt a regulation regarding personal financial data rights that is designed to promote “open banking.” If enacted as proposed, the regulation would require, among other things, that data providers, including any financial institution, make available to consumers and certain authorized third parties upon request certain covered transaction, account and payment information.

On October 30, 2023, the Biden administration issued an Executive Order on Safe, Secure and Trustworthy Development and Use of AI, emphasizing the need for transparency, accountability and fairness in the development and use of AI. The order seeks to balance innovation with addressing risks associated with AI by providing eight guiding principles and priorities, such as ensuring that consumers are protected from fraud, discrimination and privacy risks related to AI. The Executive Order also requires certain federal agencies, including the CFPB, to address potential discrimination in the housing and consumer financial markets relating to the use by financial institutions of AI technologies. Prior to the issuance of the Executive Order, the CFPB published a report addressing the use by financial institutions of AI chatbots in the provision of financial products and services, which report also highlighted the limitations and various risks posed by such activity. States have also started to regulate the use of AI technologies. For example, the California Privacy Protection Agency ("CCPA") is currently in the process of finalizing regulations under the CCPA regarding the use of automated decision making.

Regulation of Lending Practices

Our lending practices are subject to a number of federal and state laws, as supplemented by the rules and regulations of the various agencies charged with the responsibility of implementing these laws. These include, among others, the following:

•

Truth-In-Lending Act, governing disclosures of credit terms to consumer borrowers;

•

Home Mortgage Disclosure Act of 1975, requiring financial institutions to provide information to enable the public and public officials to determine whether a financial institution is fulfilling its obligation to help meet the housing needs of the communities that it serves;

•

Equal Credit Opportunity Act, prohibiting discrimination on the basis of race, creed or other specified factors in extending credit;

•

Fair Credit Reporting Act of 1978, as amended by the Fair and Accurate Credit Transactions Act, governing the use and provision of information to credit reporting agencies, certain identity theft protections and certain credit and other disclosures;

•

Fair Debt Collection Practices Act, governing the manner in which consumer debts may be collected by collection agencies;

•

Real Estate Settlement Procedures Act, requiring certain disclosures concerning loan closing costs and escrows, and governing transfers of loan servicing and the amounts of escrows in connection with loans secured by one-to-four family residential properties; and

•

Rules and regulations established by the National Flood Insurance Program.

The CFPB has adopted a number of rules that impact our lending practices, including, among other things, (1) requiring financial institutions to make a “reasonable and good faith determination” that a consumer has a “reasonable ability” to repay a residential mortgage loan before making such a loan, (2) requiring sponsors of asset-backed securities to retain at least 5% of the credit risk of the assets underlying the securities (and generally prohibiting sponsors from transferring or hedging that credit risk), and (3) imposing a number of new and enhanced requirements on the mortgage servicing industry, including rules regarding communications with borrowers, maintenance of customer account records, procedures for responding to written borrower requests and complaints of errors, servicing delinquent loans, and conducting foreclosure proceedings, among other measures.

Regulation of Deposit Operations

Our deposit operations are subject to federal laws applicable to depository accounts, including, among others, the following:

•

Right to Financial Privacy Act, which imposes a duty to maintain the confidentiality of consumer financial records and prescribes procedures for complying with administrative subpoenas of financial records;

•

Truth-In-Savings Act, requiring certain disclosures for consumer deposit accounts;

•

Electronic Fund Transfer Act and Regulation E, which govern automatic deposits to and withdrawals from deposit accounts and customers’ rights and liabilities arising from the use of automated teller machines and other electronic banking services; and

•

Rules and regulations of the various agencies charged with the responsibility of implementing these laws.

Federal Home Loan Bank Membership

The Bank is a member of the Federal Home Loan Bank of Atlanta (“FHLBA”). Each member of the FHLBA is required to maintain a minimum investment in the Class B stock of the FHLBA. The Board of Directors of the FHLBA can increase the minimum investment requirements if it concludes that additional capital is required to allow it to meet its own regulatory capital requirements. Any increase in the minimum investment requirements outside of specified ranges requires the approval of the Federal Housing Finance Agency. Because the extent of any obligation to increase the level of investment in the FHLBA depends entirely on the occurrence of a future event, we are unable to determine the extent of future required potential payments to the FHLBA at this time. Additionally, in the event that a member financial institution fails, the right of the FHLBA to seek repayment of funds loaned to that institution will take priority over the rights of all other creditors.

Climate-Related Regulation and Risk Management

In recent years, the federal banking agencies have increased their focus on climate-related risks impacting the operations of banks, the communities they serve and the broader financial system. Accordingly, the agencies have begun to enhance their supervisory expectations regarding the climate risk management practices of larger banking organizations, including by encouraging such banks to: ensure that management of climate-related risk exposures has been incorporated into existing governance structures; evaluate the potential impact of climate-related risks on the bank’s financial condition, operations and business objectives as part of its strategic planning process; account for the effects of climate change in stress testing scenarios and systemic risk assessments; revise expectations for credit portfolio concentrations based on climate-related factors; consider investments in climate-related initiatives and lending to communities disproportionately impacted by the effects of climate change; evaluate the impact of climate change on the bank’s borrowers and consider possible changes to underwriting criteria to account for climate-related risks to mortgaged properties; incorporate climate-related financial risk into the bank’s internal reporting, monitoring and escalation processes; and prepare for the transition risks to the bank associated with the adjustment to a low-carbon economy and related changes in laws, regulations, governmental policies, technology, and consumer behavior and expectations.

On October 21, 2021, the Financial Stability Oversight Council published a report identifying climate-related financial risks as an “emerging threat” to financial stability. On December 16, 2021, the Office of the Comptroller of the Currency (the “OCC”) issued proposed principles for climate-related financial risk management for national banks with more than $100 billion in total assets. Although these risk management principles, if adopted as proposed, would not apply to the Bank directly based upon our current size, the OCC has indicated that all banks, regardless of their size, may have material exposures to climate-related financial and other risks that require prudent management. The federal banking agencies, either independently or on an interagency basis, are expected to adopt a more formal climate risk management framework for larger banking organizations in the coming months. As climate-related supervisory guidance is formalized, and relevant risk areas and corresponding control expectations are further refined, we may be required to expend significant capital and incur compliance, operating, maintenance and remediation costs in order to conform to such requirements.

In March 2024, the SEC adopted final rules for "The Enhancement and Standardization of Climate-Related Disclosures for Investors,” which would have required issuers to provide climate-related disclosures. In April 2024, the SEC stayed the effectiveness of the final rules pending the outcome of certain legal challenges.

Website Information

The Bank’s website address is https://www.fusb.com. Bancshares does not maintain a separate website. Bancshares makes available free of charge on or through the Bank’s website, under the tabs “Investors – SEC filings,” its Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and all amendments to those reports filed or furnished pursuant to Section 13(a) of the Exchange Act as soon as reasonably practicable after such material is electronically filed with the SEC. These reports are also available on the SEC’s website, https://www.sec.gov. Bancshares will provide paper copies of these reports to shareholders free of charge upon written request. Bancshares is not including the information contained on or available through the Bank’s website as a part of, or incorporating such information into, this Annual Report on Form 10-K.