First Northwest Bancorp

Federal banking regulators issue new guidance and standards, and update existing guidance and standards, intended to enhance cyber risk management among financial institutions from time to time. Financial institutions are expected to comply with such guidance and standards and to accordingly develop appropriate security controls and risk management processes. If First Fed fails to observe such regulatory guidance or standards, it could be subject to various regulatory sanctions, including financial penalties.

Interagency rules require banks to notify their primary banking regulator within 36 hours of determining that a “computer-security incident” rising to the level of a "notification incident" has occurred. Among other types of computer-security incidents, a "notification incident" includes one that has materially disrupted or degraded the banking organization’s ability to carry out banking operations to a material portion of its customer base in the ordinary course of business.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and many states, including Washington, have also recently implemented or modified their data breach notification, information security and data privacy requirements. We expect this trend of state-level activity in those areas to continue, and are continually monitoring developments in the states in which our customers are located.

Risks and exposures related to cybersecurity attacks, including litigation and enforcement risks, are expected to be elevated for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as the expanding use of internet banking, mobile banking and other technology-based products and services by us and our customers. Cybersecurity concerns are further heightened by Russia's current invasion of Ukraine.

In addition to guidance and standards implemented by banking regulators, in July 2023, the SEC adopted final rules requiring an annual disclosure of registrants’ cybersecurity risk management strategy and governance. Additionally, registrants are required to disclose cybersecurity incidents, including the nature, scope, timing, and impact of the incident, within four business days of determining them to be material.

Taxation

Federal Taxation

General. First Northwest Bancorp and First Fed are subject to federal income taxation in the same general manner as other corporations, with some exceptions discussed below. The following discussion of federal taxation is intended only to summarize certain pertinent federal income tax matters and is not a comprehensive description of the tax rules applicable to First Northwest Bancorp or First Fed. First Fed is no longer subject to U.S. federal income tax examinations by tax authorities for years ended before December 31, 2021. See Note 10 of the Notes to Consolidated Financial Statements included in Item 8, "Financial Statements and Supplementary Data," of this Form 10-K.

First Northwest Bancorp will file a consolidated federal income tax return with First Fed. Accordingly, any cash distributions made by First Northwest Bancorp to its shareholders would be considered taxable dividends and not as a non-taxable return of capital to shareholders for federal and state tax purposes.

Method of Accounting. For federal income tax purposes, First Fed currently reports its income and expenses on the accrual method of accounting. Federal income tax returns are filed using a December 31 year end.

Corporate Dividends-Received Deduction. First Northwest Bancorp may eliminate from its income dividends received from First Fed as a wholly owned subsidiary of First Northwest Bancorp if it elects to file a consolidated return with First Fed. The corporate dividends-received deduction is 100%, or 65%, in the case of dividends received from corporations with which a corporate recipient does not file a consolidated tax return, depending on the level of stock ownership of the payor of the dividend. Corporations that own less than 20% of the stock of a corporation distributing a dividend may deduct 50% of dividends received or accrued on their behalf.

Washington Taxation

The Company and First Fed are subject to a business and occupation tax imposed under Washington law at the rate of 1.75% of gross receipts. Interest received on loans secured by mortgages or deeds of trust on residential properties and certain investment securities are exempt from this tax.