First Northwest Bancorp

Federal banking regulators issue new guidance and standards, and update existing guidance and standards, intended to enhance cyber risk management among financial institutions from time to time. Financial institutions are expected to comply with such guidance and standards and to accordingly develop appropriate security controls and risk management processes. If First Fed fails to observe such regulatory guidance or standards, it could be subject to various regulatory sanctions, including financial penalties.

Interagency rules require banks to notify their primary banking regulator within 36 hours of determining that a "computer-security incident" rising to the level of a "notification incident" has occurred. Among other types of computer-security incidents, a "notification incident" includes one that has materially disrupted or degraded the banking organization’s ability to carry out banking operations to a material portion of its customer base in the ordinary course of business.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and many states, including Washington, have also recently implemented or modified their data breach notification, information security and data privacy requirements. We expect this trend of state-level activity in those areas to continue, and are continually monitoring developments in the states in which our customers are located.

Risks and exposures related to cybersecurity attacks, including litigation and enforcement risks, are expected to be elevated for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as the expanding use of internet banking, mobile banking and other technology-based products and services by us and our customers. Cybersecurity concerns are further heightened by Russia's current invasion of Ukraine.

In addition to guidance and standards implemented by banking regulators, in July 2023, the SEC adopted final rules requiring an annual disclosure of registrants’ cybersecurity risk management strategy and governance. Additionally, registrants are required to disclose cybersecurity incidents, including the nature, scope, timing, and impact of the incident, within four business days of determining them to be material.

Taxation

Federal Taxation

General. First Northwest and First Fed are subject to federal income taxation in the same general manner as other corporations, with some exceptions discussed below. The following discussion of federal taxation is intended only to summarize certain pertinent federal income tax matters and is not a comprehensive description of the tax rules applicable to First Northwest or First Fed. First Fed is no longer subject to U.S. federal income tax examinations by tax authorities for years ended before December 31, 2022. See Note 10 of the Notes to Consolidated Financial Statements included in Item 8, "Financial Statements and Supplementary Data," of this Form 10-K.

Method of Accounting. For federal income tax purposes, we currently report income and expenses on the accrual method of accounting. Federal income tax returns are filed using a December 31 year end.

Intercompany Dividends-Received Deduction. First Northwest will file a consolidated federal income tax return with First Fed. Accordingly, any dividends First Northwest receives from First Fed will not be included as income to First Northwest.

Washington Taxation

First Northwest and First Fed are subject to a business and occupation tax imposed under Washington law at the rate of 2.10% of gross receipts, as well as personal property and sales tax. Interest received on loans secured by mortgages or deeds of trust on residential properties and certain investment securities are exempt from this tax.