PROSPERITY BANCSHARES INC

The Company is extensively regulated under federal and state law. In addition, proposals to change the laws and regulations governing the banking industry are frequently raised at both the state and federal levels. The likelihood and timing of any changes in these laws and regulations, and the impact such changes may have on the Company and the Bank, are difficult to predict. Regulatory agencies may issue enforcement actions, policy statements, interpretive letters, and similar written guidance applicable to the Company or to the Bank. Changes in applicable laws, regulations, or regulatory guidance, or their interpretation by regulatory agencies or courts may have a material adverse effect on the Company’s and the Bank’s business, operations, and earnings.

The Company and the Bank must undergo regular examinations by the appropriate regulatory agency, which will examine for adherence to a range of legal and regulatory compliance responsibilities. A bank regulator conducting an examination has complete access to the books and records of the examined institution. The results of the examination are confidential.

The supervision and regulation of bank holding companies and their subsidiaries is intended primarily for the protection of depositors, the Deposit Insurance Fund (“DIF”) of the Federal Deposit Insurance Corporation (“FDIC”) and the banking system as a whole, and not for the protection of the bank holding company’s shareholders or creditors. The banking agencies have broad enforcement power over bank holding companies and banks including the power to impose substantial fines and other penalties for violations of laws and regulations.

The following description summarizes some of the laws to which the Company and the Bank are subject. References in this Annual Report on Form 10-K to applicable statutes and regulations are brief summaries thereof, do not purport to be complete, and are qualified in their entirety by reference to such statutes and regulations.

The Company

The Company is a financial holding company pursuant to the Gramm-Leach-Bliley Act and a bank holding company registered under the Bank Holding Company Act of 1956, as amended (“BHCA”). Accordingly, the Company is subject to primary supervision, regulation and examination by the Board of Governors of the Federal Reserve System (“Federal Reserve Board”). The Gramm-Leach-Bliley Act, the BHCA and other federal laws subject financial and bank holding companies to particular restrictions on the types of activities in which they may engage, and to a range of supervisory requirements and activities, including regulatory enforcement actions for violations of laws and regulations. Further, as a public company, the Company also files reports with the U.S. Securities and Exchange Commission (“SEC”) and is subject to its regulatory authority, including the disclosure and regulatory requirements of the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended, with respect to the Company’s securities, financial reporting and certain governance matters. Because the Company’s securities are listed on the New York Stock Exchange (“NYSE”) under the ticker symbol “PB,” the Company is subject to NYSE’s rules for listed companies, including rules relating to corporate governance.

Regulatory Restrictions on Dividends and Share Repurchases. The Company is regarded as a legal entity separate and distinct from the Bank. The principal source of the Company’s revenues is dividends received from the Bank. As described in more detail below, federal and state law places limitations on the amount that banks may pay in dividends, which the Bank must adhere to when paying dividends to the Company. It is the policy of the Federal Reserve Board that bank holding companies should pay cash dividends on common stock only out of income available over the past year and only if the prospective rate of earnings retention is consistent with the organization’s expected capital needs and financial condition. The Federal Reserve Board’s policy provides that bank holding companies should not maintain a level of cash dividends that undermines the bank holding company’s ability to serve as a source of strength to its banking subsidiaries. The Federal Reserve Board is authorized to limit or prohibit the payment of dividends if, in the Federal Reserve Board’s opinion, the payment of dividends would constitute an unsafe or unsound practice in light of a bank holding company’s financial condition. Federal Reserve Board policy also provides that a bank holding company should inform the Federal Reserve Board reasonably in advance of declaring or paying a dividend that exceeds earnings for the period for which the dividend is being paid or that could result in a material adverse change to the bank holding company's capital structure.

The Federal Reserve Board generally requires prior notice of any redemption or repurchase of a bank holding company’s own equity securities if the consideration to be paid, together with the net consideration paid for any repurchases or redemptions in the preceding 12 months, is equal to 10% or more of the company’s consolidated net worth. Further, the Federal Reserve Board may oppose a dividend or repurchase transaction if it would constitute an unsafe or unsound practice or would violate any law or regulation.

In July 2019, the federal bank regulators adopted final rules that, among other things, eliminated the standalone prior approval requirement in the Basel III Capital Rules for any repurchase of common stock. In certain circumstances, the Company’s repurchases of its common stock may be subject to a prior approval or notice requirement under other regulations, policies or supervisory expectations of the Federal Reserve Board. Any redemption or repurchase of preferred stock or subordinated debt remains subject to the prior approval of the Federal Reserve Board.

In August 2022, the Inflation Reduction Act of 2022 (the “IRA”) was enacted. Among other things, the IRA imposes a new 1% excise tax on the fair market value of stock repurchased after December 31, 2022 by publicly traded U.S. corporations. With certain exceptions, the value of stock repurchased is determined net of stock issued in the year, including shares issued pursuant to compensatory arrangements.

Source of Strength. Federal Reserve Board policy and federal law require a bank holding company to act as a source of financial and managerial strength to each of its banking subsidiaries. Under this requirement, the Company is expected to commit resources to support the Bank, including support at times when the Company may not be in a financial position to provide such resources. Any capital loans by a bank holding company to any of its subsidiary banks are subordinate in right of payment to deposits and to certain other indebtedness of such subsidiary banks. As discussed below, a bank holding company, in certain circumstances, could be required to guarantee the capital plan of an undercapitalized banking subsidiary. The FDIC may require reports from the Company to assess the Company’s ability to serve as a source of strength and to enforce compliance with the source of strength requirements by requiring the Company to provide financial assistance to the Bank in the event of the Bank’s financial distress.

If the Company were to enter bankruptcy or become subject to the orderly liquidation process established by the Dodd-Frank Act, any commitment by the Company to a federal bank regulatory agency to maintain the capital of the Bank would be assumed by the bankruptcy trustee or the FDIC, as appropriate, and entitled to a priority of payment.

Scope of Permissible Activities. As a financial holding company, the Company is permitted to engage directly or indirectly in a broader range of activities than those permitted for a bank holding company that has not elected to be a financial holding company. Bank holding companies are generally restricted to engaging in the business of banking, managing or controlling banks and certain other activities determined by the Federal Reserve Board to be closely related to banking. Financial holding companies may also engage in activities that are considered to be financial in nature, as well as those incidental or, if determined by the Federal Reserve Board, complementary to financial activities. If the Bank ceases to be “well capitalized” or “well managed” under applicable regulatory standards, or if the Bank receives a rating of less than satisfactory under the Community Reinvestment Act of 1977 (“CRA”), the Federal Reserve Board may, among other things, place limitations on the Company’s ability to conduct these broader financial activities or, if the deficiencies persist, require the Company to divest the banking subsidiary or the businesses engaged in activities permissible only for financial holding companies.

In addition, the Federal Reserve Board has the power to order a bank holding company or its subsidiaries to terminate any nonbanking activity or terminate its ownership or control of any nonbank subsidiary when it has reasonable cause to believe that continuation of such activity or such ownership or control constitutes a serious risk to the financial safety, soundness, or stability of any bank subsidiary of that bank holding company.

Safe and Sound Banking Practices. Bank holding companies are not permitted to engage in unsafe and unsound banking practices. Violations of laws and regulations, or other unsafe and unsound practices, may result in regulatory agencies imposing fines or penalties, cease and desist orders, or taking other enforcement actions. Under certain circumstances, these agencies may enforce these remedies directly against officers, directors, employees, and other parties participating in the affairs of a bank or bank holding company. Under federal and state laws and regulations pertaining to the safety and soundness of insured depository institutions, state banking regulators, the Federal Reserve Board, and separately the FDIC as the insurer of bank deposits have the authority to compel or restrict certain actions by the Company if they determine that the Company has insufficient capital or other resources, or is otherwise operating in a manner that may be deemed to be inconsistent with safe and sound banking practices. Under this authority, the Company’s regulators can require the Company or its subsidiaries to enter into informal or formal supervisory agreements, including board resolutions, memoranda of understanding, confidential agreements, and consent or cease and desist orders pursuant to which the Company would be required to take identified corrective actions to address cited concerns and to refrain from taking certain actions.

If the Company is unable to comply with the terms of any then applicable regulatory actions or directives, supervisory agreements or orders, then the Company could become subject to additional, heightened supervisory actions and orders, possibly including prompt corrective action restrictions and/or other regulatory actions, including prohibitions on the payment of dividends on the Company’s common stock and preferred stock, if any. If such supervisory actions were to occur, the Company could, among other things, become subject to significant restrictions on the Company’s ability to develop any new business, as well as restrictions on the Company’s existing business, and the Company could be required to raise additional capital, dispose of certain assets and liabilities within a prescribed period of time, or both. The terms of any such action could have a material negative effect on the Company’s business, reputation, operating flexibility, financial condition, and the value of the Company’s securities.

The Federal Reserve Board has broad authority to prohibit activities of bank holding companies and their nonbanking subsidiaries which represent unsafe and unsound banking practices or which constitute violations of laws or regulations, and can assess civil money penalties for certain activities conducted on a knowing and reckless basis if those activities caused a substantial loss to a depository institution. The penalties can be in excess of $1.0 million for each day the activity continues.

Anti-Tying Restrictions. In general, a bank may not extend credit, lease, sell property, or furnish any services or fix or vary the consideration for them on the condition that (1) the client obtain or provide some additional credit, property, or services from or to the bank or bank holding company or their subsidiaries or (2) the client not obtain some other credit, property, or services from a competitor, except to the extent reasonable conditions are imposed to assure the soundness of the credit extended. A bank may, however, offer combined-balance products and may otherwise offer more favorable terms if a client obtains two or more traditional bank products. The law also expressly permits banks to engage in other forms of tying and authorizes the Federal Reserve Board to grant additional exceptions by regulation or order.

Acquisitions by Bank Holding Companies. The BHCA permits acquisitions of banks by bank holding companies, such that the Company and any other bank holding company, whether located in Texas or elsewhere, may acquire a bank located in any other state, subject to certain deposit-percentage, age of bank charter requirements, and other restrictions. The BHCA requires that a bank holding company obtain the prior approval of the Federal Reserve Board before (1) acquiring direct or indirect ownership or control of 5% or more of the voting shares of any additional bank or bank holding company, (2) taking any action that causes an additional bank or bank holding company to become a subsidiary of the bank holding company, or (3) merging or consolidating with any other bank holding company. The Federal Reserve Board may not approve any such transaction that would result in a monopoly or would be in furtherance of any combination or conspiracy to monopolize or attempt to monopolize the business of banking in any section of the United States, or the effect of which may be substantially to lessen competition or to tend to create a monopoly in any section of the country, or that in any other manner would be in restraint of trade unless the anticompetitive effects of the proposed transaction are clearly outweighed in the public interest by the probable effect of the transaction in meeting the convenience and needs of the community to be served. The Federal Reserve Board is also required to consider: (1) the financial and managerial resources of the companies involved, including pro forma capital ratios; (2) the risk to the stability of the United States banking or financial system; (3) the convenience and needs of the communities to be served, including performance under the CRA; and (4) the effectiveness of the company in combating money laundering.

Control Acquisitions. Federal law restricts the amount of voting stock of a bank holding company or a bank that a person may acquire without the prior approval of banking regulators. Under the Change in Bank Control Act and the regulations thereunder, a person or group must give advance notice to the Federal Reserve Board before acquiring control of any bank holding company, such as the Company, or before acquiring control of any FDIC-insured bank, such as the Bank. Upon receipt of such notice, the Federal Reserve Board may approve or disapprove the acquisition. The Change in Bank Control Act creates a rebuttable presumption of control if a person or group acquires the power to vote 10% or more of the Company’s outstanding common stock. The overall effect of such laws is to make it more difficult to acquire a bank holding company and a bank by tender offer or similar means than it might be to acquire control of another type of corporation. Consequently, shareholders of the Company may be less likely to benefit from the rapid increases in stock prices that may result from tender offers or similar efforts to acquire control of other companies. Investors should be aware of these requirements when acquiring shares of the Company’s stock.

The Volcker Rule. Section 13 of the BHCA, commonly referred to as the “Volcker Rule,” generally prohibits the Company and the Company’s subsidiaries from (1) engaging in certain proprietary trading, and (2) acquiring or retaining an ownership interest in or sponsoring a “covered fund,” all subject to certain exceptions. Since neither the Company nor the Bank engages in the types of trading or investing covered by the Volcker Rule, the Volcker Rule does not currently have any effect on the operations of the Company or the Bank.

Incentive Compensation. The Dodd-Frank Act required the federal banking agencies and the SEC to establish joint rules or guidelines for financial institutions with more than $1 billion in assets, such as the Company and the Bank, which prohibit incentive compensation arrangements that the agencies determine to encourage inappropriate risks by the institution. The federal banking agencies issued proposed rules in 2011 and previously issued guidance on sound incentive compensation policies. In 2016, the federal banking agencies and the SEC proposed rules that would, depending upon the assets of the institution, directly regulate incentive compensation arrangements and would require enhanced oversight and recordkeeping. As of December 31, 2025, these rules have not been implemented.

In October 2022, the SEC adopted a final rule directing national securities exchanges and associations, including the NYSE, to implement listing standards that require listed companies to adopt policies mandating the recovery or “clawback” of excess incentive-based compensation earned by a current or former executive officer during the three fiscal years preceding the date the listed company is required to prepare an accounting restatement, including to correct an error that would result in a material misstatement if the error were corrected in the current period or left uncorrected in the current period. The NYSE’s listing standards pursuant to the SEC’s rule became effective on October 2, 2023. The Company adopted a compensation recovery policy pursuant to the NYSE listing standards on November 13, 2023.

Capital Requirements

The Company and the Bank are required under federal law to maintain certain minimum capital levels based on ratios of capital to total assets and capital to risk-weighted assets. The required capital ratios are minimums, and the banking regulators may determine that a banking organization based on its size, complexity, or risk profile must maintain a higher level of capital in order to operate in a safe and sound manner. Risks such as concentration of credit risks and the risk arising from non-traditional activities, as well as the institution’s exposure to a decline in the economic value of its capital due to changes in interest rates, and an institution’s ability to manage those risks, are important factors that are to be taken into account in assessing an institution’s overall capital adequacy. The following is a brief description of the relevant provisions of these capital rules and their potential impact on the Company’s capital levels.

The Company and the Bank are subject to the following risk-based capital ratios: a common equity tier 1 (“CET1”) risk-based capital ratio, a Tier 1 risk-based capital ratio, which includes CET1 and additional Tier 1 capital, and a total risk-based capital ratio, which includes Tier 1 and Tier 2 capital. CET1 is primarily comprised of the sum of common stock instruments and related surplus net of treasury stock plus retained earnings less certain adjustments and deductions, including with respect to goodwill, intangible assets, mortgage servicing assets, and deferred tax assets subject to temporary timing differences. Additional Tier 1 capital is primarily comprised of noncumulative perpetual preferred stock. Tier 2 capital consists of instruments disqualified from Tier 1 capital, including qualifying subordinated debt and a limited amount of loan loss reserves up to a maximum of 1.25% of risk-weighted assets, subject to certain eligibility criteria. The capital rules also define the risk-weights assigned to assets and off-balance sheet items to determine the risk-weighted asset components of the risk-based capital rules, including, for example, certain “high volatility” commercial real estate, past due assets, structured securities, and equity holdings.

The leverage capital ratio, which serves as a minimum capital standard, is the ratio of Tier 1 capital to quarterly average total consolidated assets net of goodwill, certain other intangible assets, and certain required deduction items. The required minimum leverage ratio for all banks and bank holding companies is 4%.

In addition, effective January 1, 2019, the capital rules required a capital conservation buffer of 2.5% above each of the minimum risk-based capital ratio requirements (CET1, Tier 1, and total capital), which is designed to cover expected losses during periods of economic stress. These buffer requirements must be met for a bank or bank holding company to be able to pay dividends, engage in share buybacks, or make discretionary bonus payments to executive management without restriction.

The Federal Deposit Insurance Corporation Improvement Act of 1991 (“FDICIA”), among other things, requires the federal bank regulatory agencies to take “prompt corrective action” regarding depository institutions that do not meet minimum capital requirements. FDICIA establishes five regulatory capital tiers: “well capitalized”, “adequately capitalized”, “undercapitalized”, “significantly undercapitalized”, and “critically undercapitalized”. A depository institution’s capital tier will depend upon how its capital levels compare to various relevant capital measures and certain other factors, as established by regulation. FDICIA generally prohibits a depository institution from making any capital distribution (including payment of a dividend) or paying any management fee to its holding company if the depository institution would thereafter be undercapitalized. FDICIA imposes progressively more restrictive restraints on operations, management, and capital distributions depending on the category in which an institution is classified. Undercapitalized depository institutions are subject to restrictions on borrowing from the Federal Reserve System. In addition, undercapitalized depository institutions may not accept brokered deposits absent a waiver from the FDIC, are subject to growth limitations, and are required to submit capital restoration plans for regulatory approval. A depository institution's holding company must guarantee any required capital restoration plan up to an amount equal to the lesser of 5% of the depository institution's assets at the time it becomes undercapitalized or the amount of the capital deficiency when the institution fails to comply with the plan. Federal banking agencies may not accept a capital plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the depository institution’s capital. If a depository institution fails to submit an acceptable plan, it is treated as if it is significantly undercapitalized.

To be well-capitalized, the Bank must maintain at least the following capital ratios:

•

6.5% CET1 to risk-weighted assets;

•

8.0% Tier 1 capital to risk-weighted assets;

•

10.0% Total capital to risk-weighted assets; and

•

5.0% leverage ratio.

The Federal Reserve Board has not yet revised the well-capitalized standard for bank holding companies to reflect the higher capital requirements imposed under the current capital rules applicable to banks. For purposes of the Federal Reserve Board’s Regulation Y, including determining whether a bank holding company meets the requirements to be a financial holding company, bank holding companies, such as the Company, must maintain a Tier 1 risk-based capital ratio of 6.0% or greater and a total risk-based capital ratio of 10.0% or greater to be well-capitalized. Also, the Federal Reserve Board may require bank holding companies, including the Company, to maintain capital ratios substantially in excess of mandated minimum levels depending upon general economic conditions and a bank holding company’s particular condition, risk profile, and growth plans.

Failure to be well-capitalized or to meet minimum capital requirements could result in certain mandatory and possible additional discretionary actions by regulators that, if undertaken, could have an adverse material effect on the Company’s operations or financial condition. Failure to meet minimum capital requirements could also result in restrictions on the Company’s or the Bank’s ability to pay dividends or otherwise distribute capital or to receive regulatory approval of applications or other restrictions on its growth.

In 2025, the Company’s and the Bank’s regulatory capital ratios were above the applicable well-capitalized standards and met the capital conservation buffer. As of December 31, 2025, the Company’s ratio of CET1 to risk-weighted assets was 17.55%, Tier 1 capital to risk-weighted assets was 17.55%, total capital to risk-weighted assets was 18.80% and Tier 1 capital to average quarterly assets (leverage ratio) was 11.93%.

In response to the novel strain of coronavirus disease (“COVID-19”) pandemic, in March 2020 the joint federal bank regulatory agencies issued an interim final rule that allowed banking organizations that implemented ASU 2016-13, “Financial Instruments-Credit Losses (Topic 326) – Measurement of Credit Losses on Financial Instruments” (“CECL”) in 2020 to mitigate the effects of the CECL accounting standard in their regulatory capital for two years. This two-year delay is in addition to the three-year transition period that the agencies had already made available. The Company adopted the option provided by the interim final rule, which delayed the effects of CECL on its regulatory capital through 2021, after which the effects were phased in over a three-year period from January 1, 2022 through December 31, 2024. Under the interim final rule, the amount of adjustments to regulatory capital deferred until the phase-in period include both the initial impact of the Company’s adoption of CECL on January 1, 2020 and 25% of subsequent changes in the Company’s allowance for credit losses during each quarter of the two-year period ended December 31, 2021. The cumulative amount of the transition adjustments was phased in over a three-year transition period that began on January 1, 2022, was 75% recognized in 2022, 50% recognized in 2023, and 25% recognized in 2024.

The Bank

The Bank is a Texas-chartered banking association, the deposits of which are insured by the DIF of the FDIC. The Bank is not a member of the Federal Reserve System; therefore, the Bank is subject to supervision and regulation by the FDIC and the Texas Department of Banking. Such supervision and regulation subject the Bank to special restrictions, requirements, potential enforcement actions and periodic examination by the FDIC and the Texas Department of Banking. Because the Federal Reserve Board regulates the Company, the Federal Reserve Board also has supervisory authority which affects the Bank. Further, because the Bank has total assets of over $10 billion, the Bank is also subject to supervision and regulation by the Consumer Financial Protection Bureau (“CFPB”). The CFPB regulates the offering and provision of consumer financial products and services under the federal consumer financial laws.

Equivalence to National Bank Powers. The Texas Constitution, as amended in 1986, provides that a Texas-chartered bank has the same rights and privileges that are or may be granted to national banks domiciled in Texas. To the extent that the Texas laws and regulations may have allowed state-chartered banks to engage in a broader range of activities than national banks, FDICIA has operated to limit this authority. FDICIA provides that no state bank or subsidiary thereof may engage as principal in any activity not permitted for national banks, unless the institution complies with applicable capital requirements and the FDIC determines that the activity poses no significant risk to the DIF. In general, statutory restrictions on the activities of banks are aimed at protecting the safety and soundness of depository institutions.

Standards for Safety and Soundness. The Federal Deposit Insurance Act requires the federal bank regulatory agencies to prescribe, by regulation or guideline, operational and managerial standards for all insured depository institutions relating to: (1) internal controls; (2) information systems and audit systems; (3) loan documentation; (4) credit underwriting; (5) interest rate risk exposure; and (6) asset quality. The federal banking agencies have adopted regulations and Interagency Guidelines Establishing Standards for Safety and Soundness to implement these required standards. These guidelines set forth the safety and soundness standards used to identify and address problems at insured depository institutions before capital becomes impaired. Under the regulations, if a regulator determines that a bank fails to meet any standards prescribed by the guidelines, the regulator may require the bank to submit an acceptable plan to achieve compliance, consistent with deadlines for the submission and review of such safety and soundness compliance plans.

Branching. Pursuant to the Dodd-Frank Act, banks are permitted to engage in de novo interstate branching if the laws of the state where the new branch is to be established would permit the establishment of the branch if it were chartered by such state, subject to applicable regulatory review and approval requirements. The Dodd-Frank Act also modified certain regulatory requirements for interstate mergers and acquisitions, including that the acquiring bank must be well capitalized and well managed. Texas law provides that a Texas-chartered bank can establish a branch anywhere in Texas or any other state, subject to federal law requirements, provided that the branch is approved in advance by the Texas Department of Banking. The branch must also be approved by the FDIC, which considers a number of factors, including financial history, capital adequacy, earnings prospects, character of management, needs of the community and consistency with corporate powers.

Restrictions on Transactions with Affiliates and Insiders. The Bank is subject to restrictions on extensions of credit and certain other transactions between the Bank and the Company or any nonbank affiliate. Generally, these covered transactions with either the Company or any affiliate are limited to 10% of the Bank’s capital and surplus, and all such transactions between the Bank and the Company and all of its nonbank affiliates combined are limited to 20% of the Bank’s capital and surplus. Loans and other extensions of credit from the Bank to the Company or any affiliate generally are required to be secured by eligible collateral in specified amounts. In addition, any transaction between the Bank and the Company or any affiliate are required to be on an arm’s length basis. Federal banking laws also place similar restrictions on certain extensions of credit by insured banks, such as the Bank, to their directors, executive officers, and principal shareholders and their related interests.

Restrictions on Distribution of Subsidiary Bank Dividends and Assets. Dividends paid by the Bank have provided a substantial part of the Company’s operating funds, and it is anticipated that dividends paid by the Bank to the Company will continue to be the Company’s principal source of operating funds. Capital adequacy requirements serve to limit the amount of dividends that may be paid by the Bank. Under federal law, the Bank cannot pay a dividend if, after paying the dividend, the Bank will be “undercapitalized.” The FDIC may declare a dividend payment to be unsafe and unsound even though the Bank would continue to meet its capital requirements after the dividend. The Bank is also subject to limitations on the payment of dividends under Texas law. Because the Company is a legal entity separate and distinct from its subsidiaries, its right to participate in the distribution of assets of any subsidiary upon the subsidiary’s liquidation or reorganization will be subject to the prior claims of the subsidiary’s creditors. In the event of a liquidation or other resolution of an insured depository institution, the claims of depositors and other general or subordinated creditors are entitled to a priority of payment over the claims of holders of any obligation of the institution to its shareholders, including any depository institution holding company (such as the Company) or any shareholder or creditor thereof.

Consumer Financial Protection. The Bank is subject to a number of federal and state consumer protection laws that extensively govern its relationship with its customers. These laws include the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Truth in Lending Act, the Truth in Savings Act, the Electronic Fund Transfer Act, the Expedited Funds Availability Act, the Home Mortgage Disclosure Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Fair Debt Collection Practices Act, the Service Members Civil Relief Act and these laws’ respective state-law counterparts, as well as state usury laws and laws regarding unfair and deceptive acts and practices. These and other federal laws, among other things, require disclosures of the cost of credit and terms of deposit accounts, provide substantive consumer rights, prohibit discrimination in credit transactions, regulate the use of credit report information, provide financial privacy protections, prohibit unfair, deceptive and abusive practices, restrict the Bank’s ability to raise interest rates and subject the Bank to substantial regulatory oversight. Violations of applicable consumer protection laws can result in significant potential liability from litigation brought by customers, including actual damages, restitution and attorneys’ fees. Federal bank regulators, the CFPB, state attorneys general and state and local consumer protection agencies may also seek to enforce consumer protection requirements and obtain these and other remedies, including regulatory sanctions, customer rescission rights and civil money penalties in each jurisdiction in which the Bank operates. Failure to comply with consumer protection requirements may also result in the Bank’s failure to obtain any required regulatory approval for merger or other acquisition transactions the Bank may wish to pursue or its prohibition from engaging in such transactions even if approval is not required.

The Dodd-Frank Act established the CFPB, which has supervisory, examination and enforcement authority over depository institutions with total assets of $10 billion or greater and other providers of consumer financial products or services such as the Bank. The CFPB has broad rulemaking authority for a wide range of federal consumer financial laws, including, among other things, the authority to prohibit “unfair, deceptive or abusive” acts and practices. The CFPB can issue cease-and-desist orders against banks and other entities that violate federal consumer financial laws and may also institute a civil action against an entity in violation of federal consumer financial laws in order to impose a civil penalty or injunction.

In October 2024, the CFPB issued a final rule that requires a provider of payment accounts or products, such as a bank, to make data available to consumers free upon request regarding the products or services they obtain from the provider. Any such data provider is also required to make such data available to third parties, with the consumer’s express authorization and through an interface that satisfies formatting, performance and security standards, for the purpose of such third parties providing the consumer with financial products or services requested by the consumer. The CFPB is revisiting this rule after legal challenges and new leadership, pausing the original 2024 rule’s implementation and launching a new rulemaking process focusing on key issues like data security, fee structures for data access, consumer representation, and data privacy.

Customer Information Security. The federal banking agencies have adopted guidelines for safeguarding confidential, personal, nonpublic customer information. These guidelines require each financial institution, under the supervision and ongoing oversight of its board of directors or an appropriate committee thereof, to create, implement and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazard to the security or integrity of such information and protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. The Bank has adopted a customer information security program to comply with these requirements.

Deposit Insurance Assessments. The deposits of the Bank are insured up to applicable limits by the DIF, and the Bank must pay deposit insurance assessments to the FDIC for such deposit insurance protection. A depository institution’s DIF assessment is calculated by multiplying its assessment rate by the assessment base, which is defined as the average consolidated total assets less the average tangible equity of the depository institution. The initial base assessment rate is based on its capital level and CAMELS ratings, certain financial measures to assess an institution’s ability to withstand asset related stress and funding related stress and, in some cases, additional discretionary adjustments by the FDIC to reflect additional risk factors.

In October 2022, the FDIC adopted a final rule to increase the initial base deposit insurance assessment rate schedules uniformly by 2 basis points beginning with the first quarterly assessment period of 2023. The increased assessment is intended to increase the likelihood that the DIF reserve ratio would reach the statutory minimum of 1.35% by the statutory deadline prescribed under the FDIC’s amended restoration plan.

In November 2023, the FDIC adopted a final rule to implement a special assessment to recover the losses to the DIF associated with several bank failures that occurred during early 2023. The assessment base for the special assessment was equal to estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion, to be collected at a quarterly rate of approximately 3.36 basis points for an anticipated total of eight quarterly assessment periods, beginning in the first quarter of 2024. Under the final rule, the estimated loss pursuant to the systemic risk determination will be periodically adjusted, and the FDIC has retained the ability to cease collection early, extend the special assessment collection period and impose a final shortfall special assessment on a one-time basis. The extent to which any additional future assessments will impact the Company’s future deposit insurance expense is currently uncertain.

Interchange Fees. Under the Durbin Amendment to the Dodd-Frank Act, the Federal Reserve Board adopted rules establishing standards for assessing whether the interchange fees that may be charged with respect to certain electronic debit transactions are “reasonable and proportional” to the costs incurred by issuers for processing such transactions. Interchange fees, or “swipe” fees, are charges that merchants pay to the Bank and other card-issuing banks for processing electronic payment transactions. Federal Reserve Board rules applicable to financial institutions that have assets of $10 billion or more provide that the maximum permissible interchange fee for an electronic debit transaction is the sum of 21 cents per transaction and 5 basis points multiplied by the value of the transaction. An upward adjustment of no more than 1 cent to an issuer’s debit card interchange fee is allowed if the card issuer develops and implements policies and procedures reasonably designed to achieve certain fraud-prevention standards. The Federal Reserve Board also has rules governing routing and exclusivity that require issuers to offer at least two unaffiliated networks for routing transactions on each debit or prepaid product. On October 25, 2023, the Federal Reserve Board issued a proposal under which the maximum permissible interchange fee for an electronic debit transaction would be the sum of 14.4 cents per transaction and 4 basis points multiplied by the value of the transaction. Furthermore, the fraud-prevention adjustment would increase from a maximum of 1 cent to 1.3 cents per debit card transaction. The proposal would adopt an approach for future adjustments to the interchange fee cap, which would occur every other year based on issuer cost data gathered by the Federal Reserve Board from large debit card issuers. The extent to which any such proposed changes in permissible interchange fees will impact the Company’s future revenue is uncertain.

Concentrated Commercial Real Estate Lending. The federal banking agencies, including the FDIC, have promulgated guidance governing financial institutions with concentrations in commercial real estate lending. The guidance provides that a bank has a concentration in commercial real estate lending if (1) total reported loans for construction, land development and other land represent 100% or more of total capital or (2) total reported loans secured by multifamily and non-farm residential properties and loans for construction, land development and other land represent 300% or more of total capital and the bank’s commercial real estate loan portfolio has increased 50% or more during the prior 36 months. Owner occupied loans are excluded from this second category. If a concentration is present, management must employ heightened risk management practices that address the following key elements: board and management oversight and strategic planning, portfolio management, development of underwriting standards, risk assessment and monitoring through market analysis and stress testing, and maintenance of increased capital levels as needed to support the level of commercial real estate lending.

Community Reinvestment Act. The Community Reinvestment Act of 1977 (“CRA”) and the regulations issued thereunder are intended to encourage banks to help meet the credit needs of their communities, including low and moderate income neighborhoods, consistent with the safe and sound operations of the banks. These regulations also provide for regulatory assessment of a bank’s CRA record when considering applications to establish branches, merger applications and applications to acquire the assets and assume the liabilities of another bank. The Financial Institutions Reform, Recovery, and Enforcement Act (“FIRREA”) requires federal banking agencies to make public a rating of a bank’s performance under the CRA. In the case of a financial holding company or a bank holding company, the CRA performance records of the banks involved in the transaction are reviewed in connection with the filing of an application to acquire ownership or control of shares or assets of a bank or to merge with any other bank holding company. An unsatisfactory record can substantially delay or block the transaction.

In 2023 the OCC, FRB and FDIC issued a final rule to modernize their respective CRA regulations. The revised rules would substantially alter the methodology for assessing compliance with the CRA, with material aspects taking effect January 1, 2026 and revised data reporting requirements taking effect January 1, 2027. The revised CRA regulations have been subject to an injunction since March 29, 2024. On July 16, 2025, the OCC, FRB, and FDIC issued a joint proposal to rescind the 2023 modernization rule. The agencies continue to apply the CRA rules as they existed before the 2023 modernization, considering the injunction and pending finalization of the rescission of the modernization rule.

Anti-Money Laundering and Anti-Terrorism Legislation. A major focus of governmental policy on financial institutions has been aimed at combating money laundering and terrorist financing. The U.S. Bank Secrecy Act (“BSA”) and the USA PATRIOT Act of 2001 (the “USA Patriot Act”) require financial institutions to develop programs to prevent them from being used for, and to detect and deter, money laundering, terrorist financing, and other illegal activities. The USA Patriot Act substantially broadened the scope of United States anti-money laundering laws and regulations by imposing significant new compliance and due diligence obligations, creating new crimes and penalties and expanding the extra-territorial jurisdiction of the United States. The United States Treasury Department has issued, and in some cases proposed, a number of regulations that apply various requirements of the USA Patriot Act to financial institutions. These regulations impose obligations on financial institutions to maintain appropriate policies, procedures and controls to detect, prevent and report money laundering and terrorist financing and to verify the identity of their customers. The regulations also impose specific due diligence requirements on financial institutions that maintain correspondent or private banking relationships with non-U.S. financial institutions or persons. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious financial, legal and reputational consequences for the institution and could block or substantially delay a merger or other acquisition transaction.

Office of Foreign Assets Control Regulation. The United States has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others. These are typically known as the “OFAC” rules based on their administration by the U.S. Treasury Department Office of Foreign Assets Control (“OFAC”). The OFAC-administered sanctions targeting countries take many different forms. Generally, however, they contain one or more of the following elements: (1) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments in, or providing investment-related advice or assistance to, a sanctioned country; and (2) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious financial, legal and reputational consequences, including substantial delay or blocking of a merger or other acquisition transaction.

Cybersecurity. The federal banking regulators regularly issue new guidance and standards, and update existing guidance and standards, regarding cybersecurity intended to enhance cyber risk management among financial institutions. Financial institutions are expected to comply with such guidance and standards and to accordingly develop appropriate security controls and risk management processes. If the Company fails to observe such regulatory guidance or standards, the Company could be subject to various regulatory sanctions, including financial penalties.

Banking organizations are required to notify their primary banking regulator within 36 hours of determining that a “computer-security incident” has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss, or its operations that would impact the stability of the United States.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs, and many states, including Texas, have also recently implemented or modified their data breach notification, information security and data privacy requirements. The Company expects this trend of state-level activity in those areas to continue and are continually monitoring developments in the states in which its customers are located.

Risks and exposures related to cybersecurity attacks, including litigation and enforcement risks, are expected to be elevated for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by the Company and its customers.

Legislative and Regulatory Initiatives

From time to time, various legislative and regulatory initiatives are introduced in Congress and state legislatures, as well as by regulatory agencies. Such initiatives may include proposals to expand or contract the powers of bank holding companies and depository institutions or proposals to substantially change the financial institution regulatory system. Such legislation could change banking statutes and the operating environment of the Company in substantial and unpredictable ways. If enacted, such legislation could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance among banks, savings associations, credit unions, and other financial institutions. The Company cannot predict whether any such legislation will be enacted, and, if enacted, the effect that it, or any implementing regulations, would have on the financial condition or results of operations of the Company. A change in statutes, regulations or regulatory policies applicable to the Company or the Bank could have a material effect on the Company’s business, financial condition and results of operations.

Effect on Economic Environment

The policies of regulatory authorities, including the monetary policy of the Federal Reserve Board, have a significant effect on the operating results of bank holding companies and their subsidiaries. Among the means available to the Federal Reserve Board to affect the money supply are open market operations in U.S. government securities, changes in the discount rate on member bank borrowings and changes in reserve requirements against member bank deposits. These means are used in varying combinations to influence overall growth and distribution of bank loans, investments and deposits; and their use may affect interest rates charged on loans or paid for deposits.

Federal Reserve Board monetary policies have materially affected the operating results of commercial banks in the past and are expected to continue to do so in the future. The nature of future monetary policies and the effect of such policies on the business and earnings of the Company and its subsidiaries cannot be predicted.