FS Bancorp, Inc.

The following is a brief description of certain laws and regulations applicable to FS Bancorp and 1st Security Bank. Descriptions of laws and regulations here and elsewhere in this Form 10–K do not purport to be complete and are qualified in their entirety by reference to the actual laws and regulations. Legislation is introduced from time to time in the United States Congress or in the Washington State Legislature that may affect the operations of FS Bancorp and 1st Security Bank. In addition, the regulations governing the Company and the Bank may be amended from time to time by the FDIC, DFI, Federal Reserve and the Consumer Financial Protection Bureau (“CFPB”). Any such legislation or regulatory changes in the future could adversely affect our operations and financial condition. We cannot predict whether any such changes may occur.

Regulation of 1st Security Bank

***General.***1st Security Bank, as a state-chartered savings bank, is subject to applicable provisions of Washington law and to regulations and examinations of the DFI. As an insured institution, it also is subject to examination and regulation by the FDIC, which insures the deposits of 1st Security Bank to the maximum amount permitted by law. During these state or federal regulatory examinations, the examiners may require 1st Security Bank to provide for higher general or specific loan loss reserves, which can impact capital and earnings. This regulation of 1st Security Bank is intended for the protection of depositors and the Deposit Insurance Fund (“DIF”) of the FDIC and not for the purpose of protecting shareholders of 1st Security Bank or FS Bancorp. 1st Security Bank is required to maintain minimum levels of regulatory capital and is subject to some limitations on the payment of dividends to FS Bancorp. See below “Capital Requirements” and “Regulation and Supervision of FS Bancorp - Restrictions on Dividends and Stock Repurchases.”

***Federal and State Enforcement Authority and Actions.***As part of its supervisory authority over Washington-chartered savings banks, the DFI may initiate enforcement proceedings to obtain a consent order to cease-and-desist against an institution believed to have engaged in unsafe and unsound practices or to have violated a law, regulation, or other regulatory limit, including a written agreement. The FDIC also has the authority to initiate enforcement actions against insured institutions under its jurisdiction for similar reasons and may terminate the deposit insurance if it determines that an institution has engaged in unsafe or unsound practices or is in an unsafe or unsound condition. Both these agencies may also utilize less formal supervisory tools to address their concerns about the condition, operations or compliance status of a savings bank.

***Regulation by the Washington State Department of Financial Institutions.***State law and regulations govern 1st Security Bank’s ability to take deposits and pay interest, to make loans on or invest in residential and other real estate, to make consumer loans, to invest in securities, to offer various banking services to its customers, and to establish branch offices. As a state savings bank, 1st Security Bank must pay semi-annual assessments, examination costs and certain other charges to the DFI.

Washington law generally provides the same powers for Washington savings banks as federally and other-state chartered savings institutions and banks with branches in Washington, subject to the approval of the DFI. Washington law allows Washington savings banks to charge the maximum interest rates on loans and other extensions of credit to Washington residents which are allowable for a national bank in another state if higher than Washington limits. In addition, the DFI may approve applications by Washington savings banks to engage in an otherwise unauthorized activity, if the DFI determines that the activity is closely related to banking, and 1st Security Bank is otherwise qualified under the statute. This additional authority, however, is subject to review and approval by the FDIC if the activity is not permissible for national banks.

***Insurance of Accounts and Regulation by the FDIC.***Through the DIF, the FDIC insures deposit accounts in 1st Security Bank up to $250,000 per separately insured deposit ownership right or category. As insurer, the FDIC imposes deposit insurance premiums and is authorized to conduct examinations of and to require reporting by FDIC-insured institutions.

The FDIC assesses deposit insurance premiums quarterly on each FDIC-insured institution applied to its deposit base, which is its average consolidated total assets minus its Tier 1 capital. No institution may pay a dividend if it is in default on its federal deposit insurance assessment. At December 31, 2024, total base assessment rates ranged from 2.5 to 32 basis points subject to certain adjustments.

The FDIC has authority to increase insurance assessments, and any significant increases may have an adverse effect on the operating expenses and results of operations of the Company. Management cannot predict what assessment rates will be in the future. In a banking industry emergency, the FDIC may also impose a special assessment. The Bank’s deposit insurance premiums for the year ended December 31, 2024, were $2.0 million.

The FDIC conducts examinations of and requires reporting by state non-member banks, such as 1st Security Bank. The FDIC also may prohibit any insured institution from engaging in any activity determined by regulation or order to pose a serious risk to the DIF. No institution may pay a dividend if it is in default on its federal deposit insurance assessment. Insurance of deposits may be terminated by the FDIC upon a finding that an institution has engaged in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC. Management is not aware of any existing circumstances which would result in termination of the Bank's deposit insurance.

Capital Requirements. 1st Security Bank is subject to capital regulations adopted by the FDIC, which establish a required ratio for common equity Tier 1 (“CET1”) capital, minimum leverage and Tier 1 capital ratios, risk-weightings of certain assets for purposes of the risk-based capital ratios, an additional capital conservation buffer over the minimum capital ratios and define what qualifies as capital for purposes of meeting the capital requirements. These regulations implement the regulatory capital reforms required by the Dodd Frank Act and the “Basel III” requirements.

Under the capital regulations, the minimum capital ratios are: (1) a CET1 capital ratio of 4.50% of risk-weighted assets; (2) a Tier 1 capital ratio of 6.00% of risk-weighted assets; (3) a total risk-based capital ratio of 8.00% of risk-weighted assets; and (4) a leverage ratio (the ratio of Tier 1 capital to average total adjusted assets) of 4.00%. CET1 generally consists of common stock; retained earnings; accumulated other comprehensive income (“AOCI”); and certain minority interests; all subject to applicable regulatory adjustments and deductions. Tier 1 capital generally consists of CET1 and noncumulative perpetual preferred stock. In addition, Tier 1 capital includes AOCI, which includes all unrealized gains and losses on available for sale debt and equity securities, unless an institution elects to opt out of such inclusion, if eligible to do so. We have elected to permanently opt-out of the inclusion of AOCI in our capital calculations. Tier 2 capital generally consists of other preferred stock and subordinated debt meeting certain conditions plus an amount of the ACL on loans up to 1.25% of assets. Total capital is the sum of Tier 1 and Tier 2 capital.

In addition to the minimum capital requirements, a capital conservation buffer must be maintained by 1st Security Bank which consists of additional CET1 capital greater than 2.5% of risk-weighted assets above the required minimum levels in order to avoid limitations on paying dividends, repurchasing shares, and paying discretionary bonuses.

To be considered "well capitalized", a depository institution must have a Tier 1 risk-based capital ratio of at least 8.00%, a total risk-based capital ratio of at least 10.00%, a CET1 capital ratio of at least 6.50% and a leverage ratio of at least 5.00% and not be subject to an individualized order, directive or agreement under which its primary federal banking regulator requires it to maintain a specific capital level.

At December 31, 2024, 1st Security Bank was categorized as “well capitalized” under the prompt corrective action regulations of the FDIC. Management monitors the capital levels of the Bank to provide for current and future business opportunities and to meet regulatory guidelines for "well capitalized" institutions. The Bank’s capital ratios at December 31, 2024 and December 31, 2023 are presented in the following tables:

At December 31, 2024, the Bank was categorized as “well capitalized” under the prompt corrective action regulations of the FDIC. For a complete description of the Bank’s required and actual capital levels on December 31, 2024, see “Note 15 – Regulatory Capital” of the Notes to Consolidated Financial Statements included in “Item 8. Financial Statements and Supplementary Data,” of this Form 10–K.

The FDIC also has authority to establish individual minimum capital requirements in appropriate cases upon a determination that an institution’s capital level is or may become inadequate in light of particular risks or circumstances. Management of 1st Security Bank believes that, under the current regulations, 1st Security Bank will continue to meet its minimum capital requirements in the foreseeable future.

***Prompt Corrective Action.***The FDIC Improvement Act established a system of prompt corrective action to resolve the problems of under-capitalized institutions. Federal statutes establish a supervisory framework for FDIC-insured institutions based on five capital categories: "well capitalized", adequately capitalized, undercapitalized, significantly undercapitalized and critically undercapitalized. An institution’s category generally depends upon where its capital levels are in relation to relevant capital measures, which include risk-based capital measures, a leverage ratio capital measure, and certain other factors. An institution that is not well capitalized is subject to certain restrictions on brokered deposits, including restrictions on the rates it can offer on its deposits generally. Any institution which is neither well capitalized nor adequately capitalized is considered undercapitalized. The previously referenced final rule establishing an elective “community bank leverage ratio” regulatory capital framework provides that a qualifying institution whose capital exceeds the community bank leverage ratio and opts to use that framework will be considered “well capitalized” for purposes of prompt corrective action.

Undercapitalized institutions are subject to certain prompt corrective action requirements, regulatory controls and restrictions which become more extensive as an institution becomes more severely undercapitalized. Failure by 1st Security Bank to comply with applicable capital requirements would, if unremedied, result in progressively more severe restrictions on its activities and lead to enforcement actions, including, but not limited to, the issuance of a capital directive to ensure the maintenance of required capital levels and, ultimately, the appointment of the FDIC as receiver or conservator. Banking regulators will take prompt corrective action with respect to depository institutions that do not meet minimum capital requirements. Additionally, approval of any regulatory application filed for their review may be dependent on compliance with capital requirements.

At December 31, 2024, 1st Security Bank was categorized as “well capitalized” under the prompt corrective action regulations of the FDIC. For additional information, see “Note 15 – Regulatory Capital” of the Notes to Consolidated Financial Statements included in “Item 8. Financial Statements and Supplementary Data,” of this Form 10–K.

***Standards for Safety and Soundness.***Each federal banking agency, including the FDIC, has adopted guidelines establishing general standards relating to internal controls, information and internal audit systems; loan documentation; credit underwriting; interest rate risk exposure; asset growth; asset quality; earnings; and compensation, fees and benefits. In general, the guidelines require, among other things, appropriate systems and practices to identify and manage the risks and exposures specified in the guidelines. The guidelines prohibit excessive compensation as an unsafe and unsound practice and describe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director, or principal shareholder. If the FDIC determines that an institution fails to meet any of these guidelines, it may require an institution to submit to the FDIC an acceptable plan to achieve compliance. Management of the Bank is not aware of any conditions relating to these safety and soundness standards which would require submission of a plan of compliance.

Federal Home Loan Bank System. The FHLB of Des Moines is one of 11 regional Federal Home Loan Banks that administer the home financing credit function of savings institutions. The Federal Home Loan Banks are subject to the oversight of the Federal Housing Finance Agency and each Federal Home Loan Bank serves as a reserve or central bank for its members within its assigned region. The Federal Home Loan Banks are funded primarily from proceeds derived from the sale of consolidated obligations of the Federal Home Loan Bank System and make loans or advances to members in accordance with policies and procedures established by the Board of Directors of the Federal Home Loan Bank, which are subject to the oversight of the Federal Housing Finance Agency. All advances are required to be fully secured by sufficient collateral as determined by the Federal Home Loan Bank. As a member, the Bank is required to purchase and maintain stock in the FHLB of Des Moines based on the Bank’s asset size and level of borrowings from the FHLB of Des Moines. See “Business – Deposit Activities and Other Sources of Funds – Debt.” At December 31, 2024, 1st Security Bank had $15.6 million in FHLB of Des Moines stock, which was in compliance with this requirement. The FHLB pays dividends quarterly, and 1st Security Bank received $658,000 in dividends during the year ended December 31, 2024.

The Federal Home Loan Banks continue to contribute to low- and moderately-priced housing programs through direct loans or interest subsidies on advances targeted for community investment and low- and moderate-income housing projects. These contributions have adversely affected the level of Federal Home Loan Bank dividends paid and could continue to do so in the future. These contributions could also have an adverse effect on the value of Federal Home Loan Bank stock in the future. A reduction in value of 1st Security Bank FHLB stock may result in a decrease in net income.

Commercial Real Estate Lending Concentrations.** **The federal banking agencies have issued guidance on sound risk management practices for concentrations in commercial real estate lending. The particular focus is on exposure to commercial real estate loans that are dependent on the cash flow from the real estate held as collateral and that are likely to be sensitive to conditions in the commercial real estate market (as opposed to real estate collateral held as a secondary source of repayment or as an abundance of caution). The purpose of the guidance is not to limit a bank’s commercial real estate lending but to guide banks in developing risk management practices and capital levels commensurate with the level and nature of real estate concentrations. The guidance directs the FDIC and other federal bank regulatory agencies to focus their supervisory resources on institutions that may have significant commercial real estate loan concentration risk. A bank that has experienced rapid growth in commercial real estate lending, has notable exposure to a specific type of commercial real estate loan, or is approaching or exceeding the following supervisory criteria may be identified for further supervisory analysis with respect to real estate concentration risk:

The guidance provides that the strength of an institution’s lending and risk management practices with respect to such concentrations will be taken into account in supervisory guidance on evaluation of capital adequacy. At December 31, 2024, 1st Security Bank's aggregate recorded loan balances for construction, land development and land loans were 89.8% of regulatory capital. In addition, at December 31, 2024, 1st Security Bank loans on all commercial real estate, including construction, owner and non-owner occupied commercial real estate, and multi-family lending, as defined by the FDIC, were 256.8% of regulatory capital.

***Activities and Investments of Insured State-Chartered Financial Institutions.***Federal law generally limits the activities and equity investments of FDIC insured, state-chartered banks to those that are permissible for national banks. An insured state bank is not prohibited from, among other things, (1) acquiring or retaining a majority interest in a subsidiary, (2) investing as a limited partner in a partnership the sole purpose of which is direct or indirect investment in the acquisition, rehabilitation or new construction of a qualified housing project, provided that such limited partnership investments may not exceed 2% of the bank’s total assets, (3) acquiring up to 10% of the voting stock of a company that solely provides or reinsures directors’ and officers’ liability insurance coverage or bankers’ blanket bond group insurance coverage for insured depository institutions, and (4) acquiring or retaining the voting shares of a depository institution if certain requirements are met.

***Dividends.***Dividends from 1st Security Bank constitute a major source of funds for dividends in future periods that may be paid by FS Bancorp to shareholders. The amount of dividends payable by 1st Security Bank to FS Bancorp depends upon the Bank’s earnings and capital position, and is limited by federal and state laws, regulations and policies. According to Washington law, 1st Security Bank may not declare or pay a cash dividend on its capital stock if it would cause its net worth to be reduced below (1) the amount required for liquidation accounts or (2) the net worth requirements, if any, imposed by the Director of the DFI. Dividends on 1st Security Bank’s capital stock may not be paid in an aggregate amount greater than the aggregate retained earnings of 1st Security Bank, without the approval of the Director of the DFI. The Bank paid $11.8 million in dividends to the holding company in 2024.

The amount of dividends actually paid during any one period will be affected by 1st Security Bank’s policy of maintaining a strong capital position. Federal law further limits and can prohibit dividends when an institution does not meet the capital conservation buffer requirement and provides that no insured depository institution may pay a cash dividend if it would cause the institution to be “undercapitalized,” as defined in the prompt corrective action regulations. Moreover, the federal bank regulatory agencies also have the general authority to limit the dividends paid by insured banks if such payments are deemed to constitute an unsafe and unsound practice.

***Affiliate Transactions.***FS Bancorp and 1st Security Bank are separate and distinct legal entities. FS Bancorp (and any non-bank subsidiary of FS Bancorp) is an affiliate of 1st Security Bank. Federal laws strictly limit the ability of banks to engage in certain transactions with their affiliates. Transactions deemed to be “covered transactions” under Section 23A of the Federal Reserve Act and between a bank and an affiliate are limited to 10% of the bank subsidiary’s capital and surplus and, with respect to all affiliates, to an aggregate of 20% of the bank’s capital and surplus. Further, covered transactions that are loans and extensions of credit generally are required to be secured by eligible collateral in specified amounts. Federal law also requires that covered transactions and certain other transactions listed in Section 23B of the Federal Reserve Act between a bank and its affiliates be on terms as favorable to the bank as transactions with non-affiliates.

***Community Reinvestment Act.***1st Security Bank is also subject to the provisions of the Community Reinvestment Act of 1977 (“CRA”), which requires the appropriate federal bank regulatory agency to assess a bank’s performance under the CRA in meeting the credit needs of the community serviced by the Bank, including low- and moderate-income neighborhoods. The regulatory agency’s assessment of a bank’s record is made available to the public. Further, a bank’s CRA performance rating must be considered in connection with a bank’s application to, among other things, establish a new branch office that will accept deposits, relocate an existing office or merge or consolidate with, or acquire the assets or assume the liabilities of, a federally regulated financial institution, and in connection with certain applications by a bank holding company, such as bank acquisitions. An unsatisfactory rating may be the basis for denial of certain applications. 1st Security Bank received a “satisfactory” rating during its most recent CRA examination.

On October 24, 2023, the federal banking agencies issued a final rule designed to strengthen and modernize regulations implementing the CRA. The changes are designed to encourage banks to expand access to credit, investment and banking service in low- and moderate-income communities, adapt to changes in the banking industry including mobile and internet banking, provide greater clarity and consistency in the application of the CRA regulations and tailor CRA evaluations and data collection to bank size and type. The majority of the changes to the provisions of the CRA regulations become applicable in January 2026 and additional requirements become applicable on January 1, 2027.

In February 2024, several trade groups filed a complaint in the U.S. District Court for the Northern District of Texas challenging the Federal Reserve Board, the Federal Deposit Insurance Corporation, and the Office of the Comptroller of the Currency’s final rule modernizing how they assess lenders’ compliance under the CRA. In their complaint, the trade groups asked the court to vacate the final rule and provide a preliminary injunction that would pause implementation of the final rule while the court decides the case. It is not known at this time what the final outcome of this litigation will be and how it will impact our CRA requirements.

***Privacy Standards and Cybersecurity.***The Gramm-Leach-Bliley Financial Services Modernization Act of 1999 modernized the financial services industry by establishing a comprehensive framework to permit affiliations among commercial banks, insurance companies, securities firms, and other financial service providers. Federal banking agencies, including the FDIC, have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of the board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services. These regulations require 1st Security Bank to disclose its privacy policy, including informing consumers of its information sharing practices and informing consumers of their rights to opt out of certain practices. In addition, other federal and state cybersecurity and data privacy laws and regulations may expose 1st Security Bank to risk and result in certain risk management costs.

The federal banking agencies recently adopted rules providing for new notification requirements for banking organizations and their service providers for significant cybersecurity incidents. Specifically, the new rule requires a banking organization to notify its primary federal regulator as soon as possible, and no later than 36 hours after the banking organization determines that a “computer-security incident” rising to the level of a “notification incident” has occurred. Notification is required for incidents that have materially affected or are reasonably likely to materially affect the viability of a banking organization’s operations, its ability to deliver banking products and services, or the stability of the financial sector. Service providers are required under the rule to notify affected banking organization customers as soon as possible when the provider determines that it has experienced a computer-security incident that has materially affected or is reasonably likely to materially affect the banking organization’s customers for four or more hours. Noncompliance with federal or similar state privacy and cybersecurity laws and regulations could lead to substantial regulatory imposed fines and penalties, damages from private causes of action and/or reputational harm.

In July 2023, the SEC adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The new rules require registrants to disclose on Form 8–K any cybersecurity incident they determine to be material and to describe the material aspects of the incident's nature, scope, and timing, as well as its material impact or reasonably likely material impact on the registrant. For information regarding the Company's cybersecurity risk management, strategy, and governance, see “Item 1C. Cybersecurity” in Part I of this Form 10–K.

***Environmental Issues Associated with Real Estate Lending.***The Comprehensive Environmental Response, Compensation and Liability Act (“CERCLA”) is a federal statute that generally imposes strict liability on, all prior and present “owners and operators” of sites containing hazardous waste. However, Congress asked to protect secured creditors by providing that the term “owner and operator” excludes a person whose ownership is limited to protecting its security interest in the site. Since the enactment of the CERCLA, this “secured creditor exemption” has been the subject of judicial interpretations which have left open the possibility that lenders could be liable for cleanup costs on contaminated property that they hold as collateral for a loan. To the extent that legal uncertainty exists in this area, all creditors, including 1st Security Bank, that have made loans secured by properties with potentially hazardous waste contamination (such as petroleum contamination) could be subject to liability for cleanup costs, which costs often substantially exceed the value of the collateral property.

***Federal Reserve System.***The Federal Reserve requires all depository institutions to maintain reserves at specified levels against their transaction accounts, primarily checking accounts. At December 31, 2024, the Bank was in compliance with the reserve requirements in place at the time.

Other Consumer Protection Laws and Regulations. The Dodd-Frank Act established the CFPB and empowered it to exercise broad regulatory, supervisory and enforcement authority with respect to both new and existing consumer financial protection laws. 1st Security Bank is subject to consumer protection regulations issued by the CFPB, but as a financial institution with assets of less than $10 billion, 1st Security Bank is generally subject to supervision and enforcement by the FDIC and the DFI with respect to compliance with federal and state consumer financial protection laws and regulations.

1st Security Bank is subject to a broad array of federal and state consumer protection laws and regulations that govern almost every aspect of its business relationships with consumers. While the list set forth below is not exhaustive, these include the Truth in Lending Act, the Truth in Savings Act, the Electronic Fund Transfer Act, the Expedited Funds Availability Act, the Equal Credit Opportunity Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Home Mortgage Disclosure Act, the Fair Credit Reporting Act, the Fair Debt Collection Practices Act, the Right to Financial Privacy Act, the Home Ownership and Equity Protection Act, the Consumer Leasing Act, the Fair Credit Billing Act, the Homeowners Protection Act, the Check Clearing for the 21st Century Act, laws governing flood insurance, laws governing consumer protections in connection with the sale of insurance, federal and state laws prohibiting unfair and deceptive business practices, and various regulations that implement the foregoing. These laws and regulations mandate certain disclosure requirements and regulate the manner in which financial institutions must deal with customers when taking deposits, making loans, collecting loans, and providing other services. In addition, The USA PATRIOT Act, requires banks to, among other things, establish broadened anti-money laundering compliance programs, and due diligence policies and controls to ensure the detection and reporting of money laundering. Such required compliance programs are intended to supplement existing compliance requirements that also apply to financial institutions under the Bank Secrecy Act and the Office of Foreign Assets Control regulations. Failure to comply with these laws and regulations can subject 1st Security Bank to various penalties, including but not limited to, enforcement actions, injunctions, fines, civil liability, criminal penalties, punitive damages, and the loss of certain contractual rights.

Regulation and Supervision of FS Bancorp

***General.***FS Bancorp is a bank holding company registered with the Federal Reserve and is the sole shareholder of 1st Security Bank. Bank holding companies are subject to comprehensive regulation by the Federal Reserve under the Bank Holding Company Act of 1956, as amended (“BHCA”), and the regulations promulgated there under. This regulation and oversight is generally intended to ensure that FS Bancorp limits its activities to those allowed by law and that it operates in a safe and sound manner without endangering the financial health of 1st Security Bank. As a bank holding company, FS Bancorp is required to file quarterly and annual reports with the Federal Reserve and any additional information required by the Federal Reserve and is subject to regular examinations by the Federal Reserve. The Federal Reserve also has extensive enforcement authority over bank holding companies, including the ability to assess civil money penalties, to issue cease and desist or removal orders, and to require that a holding company divest subsidiaries (including its bank subsidiaries). In general, enforcement actions may be initiated for violations of law and regulations and unsafe or unsound practices.

***The Bank Holding Company Act.***Under the BHCA, FS Bancorp is supervised by the Federal Reserve. The Federal Reserve has a policy that a bank holding company is required to serve as a source of financial and managerial strength to its subsidiary banks and may not conduct its operations in an unsafe or unsound manner. In addition, the Dodd-Frank Act provides that a bank holding company should serve as a source of strength to its subsidiary banks by having the ability to provide financial assistance to its subsidiary banks during periods of financial stress to the bank. A bank holding company’s failure to meet its obligation to serve as a source of strength to its subsidiary banks will generally be considered by the Federal Reserve to be an unsafe and unsound banking practice or a violation of the Federal Reserve’s regulations or both. FS Bancorp and any subsidiaries that it may control are considered “affiliates” of 1st Security Bank within the meaning of the Federal Reserve Act, and transactions between 1st Security Bank and its affiliates are subject to numerous restrictions. With some exceptions, FS Bancorp and its subsidiaries are prohibited from tying the provision of various services, such as extensions of credit, to other services offered by FS Bancorp or its subsidiaries.

***Acquisitions.***The BHCA prohibits a bank holding company, with certain exceptions, from acquiring ownership or control of more than 5% of the voting shares of any company that is not a bank or bank holding company and from engaging in activities other than those of banking, managing or controlling banks, or providing services for its subsidiaries. Under the BHCA, the Federal Reserve may approve the ownership of shares by a bank holding company in any company, the activities of which the Federal Reserve has determined to be so closely related to the business of banking or managing or controlling banks as to be a proper incident thereto. These activities include: operating a savings institution, mortgage company, finance company, credit card company or factoring company; performing certain data processing operations; providing certain investment and financial advice; underwriting and acting as an insurance agent for certain types of credit-related insurance; leasing property on a full-payout, non-operating basis; selling money orders, travelers’ checks, and U.S. Savings Bonds; real estate and personal property appraising; providing tax planning and preparation services; and, subject to certain limitations, providing securities brokerage services for customers. The Federal Reserve must approve the acquisition (or acquisition of control) of a bank or other FDIC-insured depository institution by a bank holding company, and the appropriate federal banking regulator must approve a bank’s acquisition (or acquisition of control) of another bank or other FDIC-insured institution.

Under the Change in Bank Control Act, no person may acquire control of a bank holding company such as the FS Bancorp unless the Federal Reserve has prior written notice and has not issued a notice disapproving the proposed acquisition. In evaluating such notices, the Federal Reserve takes into consideration such factors as the financial resources, competence, experience and integrity of the acquirer, the future prospects of the bank holding company involved and its subsidiary bank and the competitive effects of the acquisition. In January 2020, the Federal Reserve substantially revised its control regulations. Under the revised rule, control is conclusively presumed to exist if an individual or company acquires 25% or more of any class of voting securities of the bank holding company. Where an investor holds less than 25%, the Federal Reserve provides the following four-tiered approach to determining control: (1) less than 5%; (2) 5% -9.99%; (3) 10% - 14.99%; and (4) 15% - 24.99%. In addition to the four tiers, the Federal Reserve takes into account substantive activities, including director service, business relationships, business terms, officer/employee interlocks, contractual powers, and proxy contests for directors. The Federal Reserve Board may require the company to enter into passivity and, if other companies are making similar investments, anti-association commitments. Acquisition of more than 10% of any class of a bank holding company’s voting stock constitutes a rebuttable presumption of control under the regulations under certain circumstances including where, as will be the case with the FS Bancorp, the issuer has registered securities under Section 12 of the Securities Exchange Act of 1934.

***Regulatory Capital Requirements.***As discussed above, pursuant to the “Small Bank Holding Company” exception, effective August 30, 2018, bank holding companies with less than $3 billion in consolidated assets were generally no longer subject to the Federal Reserve’s capital regulations, which are generally the same as the capital regulations applicable to 1st Security Bank. At the time of this change, FS Bancorp was considered “well capitalized” (as defined for a bank holding company), and was not subject to an individualized order, directive or agreement under which the Federal Reserve requires it to maintain a specific capital level. A bank holding company that crosses the $3.0 billion total consolidated assets threshold as of June 30 of a particular year is no longer permitted to file reports as a small holding company beginning the following March. As the Company was under $3.0 billion in assets as of June 30, 2024, the Company was still considered a small holding company as of December 31, 2024 despite total assets exceeding $3.0 billion at year end. For additional information, see “Note 15 – Regulatory Capital” of the Notes to the Consolidated Financial Statements contained in “Item 8. Financial Statements and Supplementary Data” of this Form 10–K.

***Restrictions on Dividends and Stock Repurchases.*FS Bancorp’s ability to declare and pay dividends is subject to the Federal Reserve limits and Washington law and may depend on its ability to receive dividends from 1st Security Bank. Federal Reserve policy limits the payment of a cash dividend by a bank holding company if the holding company’s net income for the past year is not sufficient to cover both the cash dividend and a rate of earnings retention that is consistent with capital needs, asset quality and overall financial condition. A bank holding company that does not meet any applicable capital standard would not be able to pay any cash dividends under this policy. A bank holding company not subject to consolidated capital requirements is expected not to pay dividends unless its debt-to-equity ratio is less than 1:1, and it meets certain additional criteria. The Federal Reserve also has indicated that it would be inappropriate for a company experiencing serious financial problems to borrow funds to pay dividends. Except for a company that meets the applicable standard to be considered a well-capitalized and well-managed bank holding company and is not subject to any unresolved supervisory issues, a bank holding company is required to give the Federal Reserve prior written notice of any purchase or redemption of its outstanding equity securities if the gross consideration for the purchase or redemption, when combined with the net consideration paid for all such purchases or redemptions during the preceding 12 months, is equal to 10% or more of the company’s consolidated net worth. The Federal Reserve may disapprove such a purchase or redemption if it determines that the proposal would constitute an unsafe or unsound practice or would violate any law, regulation or regulatory order, condition, or written agreement. Under Washington corporate law, FS Bancorp generally may not pay dividends if after that payment it would not be able to pay its liabilities as they become due in the usual course of business, or its total assets would be less than the sum of its total liabilities.

***Federal Securities Law.***The stock of FS Bancorp is registered with the SEC under the Securities Exchange Act of 1934, as amended. As a result, FS Bancorp is subject to the information, proxy solicitation, insider trading restrictions, and other requirements under the Securities Exchange Act of 1934. FS Bancorp stock held by persons who are affiliates of FS Bancorp may not be resold without registration unless sold in accordance with certain resale restrictions. Affiliates are generally considered to be officers, directors, and principal shareholders. If FS Bancorp meets specified current public information requirements, each affiliate of FS Bancorp will be able to sell in the public market, without registration, a limited number of shares in any three-month period.