FIRST HAWAIIAN INC

General

First Hawaiian, Inc. (“FHI” or the “Parent”), a bank holding company, owns 100% of the outstanding common stock of First Hawaiian Bank (“FHB” or the “Bank”). References to “we,” “our,” “us,” or the “Company” refer to the Parent and its wholly-owned subsidiary, FHB, for purposes of discussion in this Annual Report on Form 10-K.

FHI is a bank holding company incorporated in the state of Delaware and headquartered in Honolulu, Hawaii. Our wholly-owned bank subsidiary, FHB, was founded in 1858 under the name Bishop & Company and was the first successful banking partnership in the Kingdom of Hawaii and the second oldest bank formed west of the Mississippi River. As of December 31, 2023, FHB is the largest full-service bank headquartered in Hawaii as measured by assets, loans, deposits and net income. As of December 31, 2023, we had $24.9 billion of assets, $14.4 billion of gross loans and leases, $21.3 billion of deposits and $2.5 billion of stockholders’ equity. We generated $235.0 million of net income or diluted earnings per share of $1.84 per share for the year ended December 31, 2023.

Through the Bank, we operate a network of 50 branches in Hawaii (45 branches), Guam (3 branches) and Saipan (2 branches). We provide a diversified range of banking services to consumer and commercial customers, including deposit products, lending services and wealth management and trust services. Through our distribution channels, we offer a variety of deposit products to our customers, including checking and savings accounts and other types of deposit accounts. We offer comprehensive commercial banking services to middle market and large Hawaii-based businesses with strong balance sheets and high-quality collateral. We provide commercial and industrial lending, including auto dealer flooring, commercial real estate and construction lending. We also offer comprehensive consumer lending services focused on residential real estate lending, indirect auto financing and other consumer loans to individuals and small businesses through our branch, online and mobile distribution channels. Our wealth management business provides an array of trust services, private banking and investment management services. We also offer consumer and commercial credit cards and merchant processing.

We seek to develop comprehensive, long-term banking relationships by offering a diverse array of products and services, cross-selling those products and services and delivering high quality customer service. Our service culture and emphasis on repeat positive customer experiences are integral to our banking strategy and exemplified by our longstanding customer relationships.

We operate our business through three operating segments: Retail Banking, Commercial Banking and Treasury and Other. See “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations (“MD&A”) – Analysis of Business Segments” and “Note 22. Reportable Operating Segments” in the notes to the consolidated financial statements included in Item 8. Financial Statements and Supplementary Data for more information.

Human Capital Resources

As of December 31, 2023, we had over 2,000 employees, which included full time employees, part time employees and temporary employees, primarily located in our key markets of Hawaii, Guam and Saipan. As of December 31, 2023, the average tenure of employees at our Company is 11.5 years.

The Company’s success depends, in large part, on its ability to attract, develop and retain skilled employees. The Company recognizes that supporting and engaging with its workforce is key to meeting evolving corporate and customer needs. Through ongoing employee development, fostering a diverse and inclusive workforce and a focus on health, safety and employee wellbeing, we strive to help our employees in all aspects of their lives. We believe our relationship with our employees to be generally good. None of our employees are parties to a collective bargaining agreement and we do not expect a significant change in the number of our employees in the near future.

Training and Development

Learning and development are foundational to our purpose as an institution. We invest in attracting, developing and retaining the best talent. Our innovative talent development and employee learning courses are woven into our strategy and corporate culture. As of the date of this report, we offer 12 leadership development programs in total and over 20,000 professional development courses for employees through an Online Learning Center.

Diversity and Inclusion

We believe that employing a diverse workforce enhances our ability to serve our customers and our communities. By promoting a workforce that we believe is reflective of our customers and communities, we believe that we may better understand the financial needs of our customers and provide them with relevant financial service products.

Our commitment to diversity and inclusion starts at the top with a diverse board. As of the date of this report, the FHI Board of Directors includes three women, representing 33% of directors, and six ethnically diverse individuals, representing 67% of directors. As of December 31, 2023, 63% of our employees were women, 54% of all management positions were held by women, and 86% of our workforce were ethnically diverse.

Health, Safety and Wellness

We recognize that each employee’s benefit needs may differ and have designed our benefits program to be flexible. We offer healthcare options for employees aimed at reducing out-of-pocket costs. Additionally, the Bank utilizes plexiglass barriers and provides hand-sanitizing stations within our facilities. The Company will continue to monitor and take measures that it considers to be appropriate to protect the safety and health of its employees.

Our Products and Services

The Bank is a full-service community bank focused on building relationships with our customers. We provide a variety of deposit accounts and lending services to commercial and consumer customers, as well as credit card products, wealth management services and merchant processing services. We offer a comprehensive range of commercial lending services including commercial and industrial lending, auto dealer flooring, commercial real estate lending and construction lending. Our primary consumer lending services are mortgage lending, auto finance, small business loans, personal installment loans and credit cards. Our wealth management business offers individuals investment and financial planning services, insurance protection, trust and estate services and private banking.

Competition

We operate in the highly competitive financial services industry and face significant competition for customers from financial institutions located both within and beyond our principal markets. We compete with commercial banks, savings banks, credit unions, non-bank financial services companies and other financial institutions operating within or near the areas we serve. Additionally, certain large banks headquartered on the U.S. mainland and large community banking institutions target the same customers we do. In addition, as customer preferences and expectations continue to evolve, technology has lowered barriers to entry and made it possible for banks to expand their geographic reach by providing services over the Internet and for non-banks, such as financial technology firms, to offer products and services traditionally provided by banks, such as automatic transfers and automatic payment systems, without the need of physical branches. In addition, the Company’s ability to continue to compete effectively also depends on its ability to attract new employees and retain and motivate existing employees, while managing compensation and other costs.

Organizational History and Structure

In August 2016, FHI completed our initial public offering (“IPO”), and shares of FHI’s common stock began trading on the NASDAQ Global Select Market (“NASDAQ”) under the ticker symbol “FHB”.

Prior to our IPO, we were an indirect wholly owned subsidiary of BNP Paribas (“BNPP”), a global financial institution based in France. On April 1, 2016, BNPP effected a series of reorganization transactions (“Reorganization Transactions”), as a part of which we amended our certificate of incorporation to change our name to First Hawaiian, Inc., with First Hawaiian Bank remaining our only direct wholly owned subsidiary.

In February 2019, BNPP fully exited its ownership position in FHI common stock.

Supervision and Regulation

We are subject to extensive regulation under federal and state banking laws that establish a comprehensive framework for our operations. This regulatory framework may materially impact our growth potential and financial performance and is intended primarily for the protection of the safety and soundness of financial institutions, maintenance of the federal deposit insurance system and the protection of consumers or classes of consumers, rather than the protection of stockholders or other investors. Statutes, regulations and policies applicable to banks or bank holding companies are continually under review by Congress and state legislatures and federal and state regulatory agencies.

Significant elements of the statutes, regulations and policies applicable to the Company are described below.

Regulatory Agencies

FHI is a bank holding company under the U.S. Bank Holding Company Act of 1956 (the “BHC Act”) and has elected to be treated as a financial holding company under the BHC Act. Consequently, FHI and its subsidiaries are subject to the supervision, regulation, examination and reporting requirements of the Board of Governors of the Federal Reserve System (the “Federal Reserve”). The BHC Act provides generally for “umbrella” regulation of bank holding companies by the Federal Reserve and functional regulation of holding company subsidiaries by applicable regulatory agencies. The BHC Act, however, authorizes the Federal Reserve to examine any subsidiary of a bank holding company, other than a depository institution, that is engaged in activities permissible for a depository institution. The Federal Reserve is also granted the authority, in certain circumstances, to require reports of, examine and adopt rules applicable to any holding company subsidiary.

In general, the BHC Act limits the activities permissible for bank holding companies. Bank holding companies electing to be treated as financial holding companies, however, may engage in additional activities under the BHC Act as described below under “— Permissible Activities under the BHC Act”. For a bank holding company to be eligible to elect financial holding company status, all of its subsidiary insured depository institutions must be well-capitalized and well-managed, as described below under “— Prompt Corrective Action Framework”, and must have received at least a “Satisfactory” rating on such institution’s most recent examination under the Community Reinvestment Act (the “CRA”), as described below under “—Community Reinvestment Act of 1977”. The bank holding company itself must also be well-capitalized and well-managed in order to be eligible to elect financial holding company status. If a financial holding company fails to continue to meet any of the well-capitalized and well-managed prerequisites for financial holding company status, the Federal Reserve may place limitations on the company’s ability to conduct the broader financial activities permissible for financial holding companies or impose limitations or conditions on the conduct or activities of the bank holding company or its affiliates. In addition, the bank holding company must enter into an agreement with the Federal Reserve to comply with all applicable capital and management requirements. If the company does not return to compliance within 180 days, the Federal Reserve may order the company to divest its subsidiary banks or the company may be required to discontinue or divest investments in companies engaged in activities permissible only for a bank holding company electing to be treated as a financial holding company. In addition, if any insured depository institution subsidiary of a financial holding company fails to maintain a CRA rating of at least “Satisfactory,” the financial holding company will be subject to restrictions on certain new activities and acquisitions.

FHB is a Federal Deposit Insurance Corporation (the “FDIC”) insured bank chartered under the laws of the State of Hawaii. FHB is not a member of the Federal Reserve System. Consequently, the FDIC and the Hawaii Department of Financial Institutions (the “Hawaii DFI”) are the primary regulators of FHB and also regulate its subsidiaries. FHB’s branch operations in Guam are also subject to regulation by the Banking and Insurance Commissioner of the Government of Guam Department of Revenue and Taxation (the “Guam Banking and Insurance Commissioner”). FHB’s branch operation in Saipan, which is one of the principal islands of the Commonwealth of the Northern Mariana Islands (“CNMI”), is subject to the regulatory jurisdiction of the Division of Banking of the CNMI Department of Commerce. In addition, as the owner of a Hawaii-chartered bank, FHI is registered as a financial institution holding company under the Hawaii Code of Financial Institutions (the “Hawaii Code”) and is subject to the registration, reporting and examination requirements of the Hawaii Code, as well as supervision and examination by the Hawaii DFI.

The Company offers certain insurance, investment and trust products through FHB and its subsidiary, Bishop Street Capital Management Corporation, a registered investment adviser with the SEC. Bishop Street Capital Management Corporation is subject to the disclosure and regulatory requirements of the Investment Advisers Act of 1940, as administered by the SEC. FHB is also registered as a municipal securities advisor with the Municipal Securities Rulemaking Board (“MSRB”) and the SEC and is subject to the disclosure and regulatory requirements of the MSRB and the SEC. FHB’s insurance brokerage activities in Hawaii are conducted under its insurance producer license by appointed agents (licensed insurance producers) and those licensees are subject to regulation by the Insurance Division of the State of Hawaii Department of Commerce and Consumer Affairs (the “DCCA Insurance Division”). FHB’s trust services in Hawaii are subject to regulation by the FDIC and the Hawaii DFI. FHB’s insurance activities in Guam are conducted under a general agent’s license issued by the Guam Banking and Insurance Commissioner and FHB is therefore subject to regulation by the insurance branch of the regulatory division of the Guam Department of Revenue and Taxation.

FHB and its affiliates are also subject to supervision, regulation, examination and enforcement by the Consumer Financial Protection Bureau (the “CFPB”), with respect to consumer protection laws and regulations. In addition, FHI is subject to the disclosure and regulatory requirements of the U.S. Securities and Exchange Act of 1934 (“Exchange Act”) administered by the SEC and the rules adopted by NASDAQ applicable to listed companies. The Company is subject to numerous other statutes and regulations that affect its business activities and operations.

Permissible Activities under the BHC Act

In general, the BHC Act limits the business of bank holding companies to banking, managing or controlling banks and other activities that the Federal Reserve has determined to be so closely related to banking as to be a proper incident thereto.

Bank holding companies that qualify and elect to be treated as “financial holding companies,” like us, may engage in, or acquire and retain the shares of a company engaged in, a broad range of additional activities that are (i) financial in nature, as determined by the Federal Reserve in consultation with the Secretary of the Treasury, or incidental to such financial activities or (ii) complementary to a financial activity and do not pose a substantial risk to the safety and soundness of depository institutions or the financial system generally. These activities include securities underwriting and dealing, insurance underwriting and brokerage and making merchant banking investments.

The BHC Act does not place territorial restrictions on permissible non-banking activities of bank holding companies. The Federal Reserve has the power to order any bank holding company or its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the Federal Reserve has reasonable grounds to believe that continuing such activity, ownership or control constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company.

Permissible Activities for Banks

As a Hawaii-chartered bank, FHB’s business is generally limited to activities permitted by Hawaii law and applicable federal laws. Under the Hawaii Code, the Bank may generally engage in all usual banking activities, including accepting deposits; extending loans and lines of credit; borrowing money; issuing, confirming and advising letters of credit; entering into repurchase agreements; buying and selling foreign currency and, subject to certain limitations, making investments. Subject to prior approval by the Commissioner of the Hawaii DFI and by the DCCA Insurance Division, the Bank may also permissibly engage in activities related to a trust business, activities relating to insurance and annuities and any activity permissible for a national banking association.

Hawaii law also imposes restrictions on the Bank’s activities and corporate governance requirements intended to ensure the safety and soundness of the Bank. For example, the Hawaii Code requires that at least one of the directors of the Bank, as well as the Chief Executive Officer of the Bank, be residents of the State of Hawaii. FHB is also restricted under the Hawaii Code to investing in certain types of investments and is generally limited in the amount of money it can lend to a single borrower or invest in securities issued by a single issuer (in each case, 20% of FHB’s common stock and additional paid-in capital).

Acquisitions by Bank Holding Companies

The BHC Act, the Bank Merger Act, the Hawaii Code and other federal and state statutes regulate acquisitions of bank holding companies, banks and other FDIC-insured depository institutions. The Company must obtain the prior approval of the Federal Reserve before (i) acquiring direct or indirect ownership or control of any voting shares of any bank or bank holding company, if after such acquisition, it will directly or indirectly own or control 5% or more of any class of voting shares of the institution, (ii) acquiring all or substantially all of the assets of any bank (other than directly through the Bank) or (iii) merging or consolidating with any other bank holding company. Under the Bank Merger Act, the prior approval of the FDIC is required for the Bank to merge with another bank or purchase all or substantially all of the assets or assume any of the deposits of another FDIC-insured depository institution. In reviewing applications seeking approval of merger and acquisition transactions, bank regulators consider, among other things, the competitive effect and public benefits of the transactions, the capital position and managerial resources of the combined organization, the risks to the stability of the U.S. banking or financial system, the applicant’s performance record under the CRA, the applicant’s compliance with applicable laws, including fair housing and other consumer protection laws and the effectiveness of all organizations involved in combating money laundering activities. In addition, failure to implement or maintain adequate compliance programs could cause bank regulators not to approve an acquisition where regulatory approval is required or to prohibit an acquisition even if approval is not required. In addition, the federal bank regulators will consider the extent to which a proposed transaction would result in greater or more concentrated risks to the stability of the U.S. banking or financial system. In addition, under applicable laws, the Company may not be permitted to acquire any bank in Hawaii because it controls more than 30% of the total amount of deposits in the Hawaii market. As a result, any further growth in the Hawaii market will most likely have to occur organically rather than by acquisition.

Dividends and Repurchases

FHI is a legal entity separate and distinct from the Bank and its subsidiaries. Virtually all of FHI’s income comes from dividends from the Bank, which is also the primary source of FHI’s liquidity and funds to pay dividends on its equity and, if FHI were to incur debt in the future, interest and principal on its debt. There are statutory and regulatory limitations on the payment of dividends by the Bank to FHI, as well as by FHI to its stockholders.

Federal bank regulators are authorized to determine, under certain circumstances relating to the financial condition of a bank holding company or a bank, that the payment of dividends would be an unsafe or unsound practice and to prohibit payment thereof. In particular, federal bank regulators have stated that paying dividends that deplete a banking organization’s capital base to an inadequate level would be an unsafe and unsound banking practice and that banking organizations should generally pay dividends only out of current operating earnings. In addition, the ability of banks and bank holding companies to pay dividends, and the contents of their respective dividend policies, could be affected by a range of regulatory changes.

Payment of Dividends by the Bank. In addition to the restrictions discussed above, the Bank is subject to limitations under Hawaii law regarding the amount of dividends that it may pay to the Parent. In general, under Hawaii law, dividends from a bank may not exceed the bank’s retained earnings provided that the bank will, after the dividend, have the minimum paid-in common stock and additional paid-in capital required under Hawaii law, which, for a bank which has trust operations, is $6.5 million. Hawaii law also effectively restricts a bank from paying a dividend, or the amount of the dividend, unless that bank’s common stock and additional paid-in capital is $6.5 million multiplied by 133%, or $8.6 million. This amount is not necessarily indicative of amounts that may be paid or available to be paid in future periods. Under Hawaii banking law, for example, paying “excessive dividends” in relation to a bank’s capital position, earnings capacity and asset quality could be deemed to be an unsafe and unsound banking practice. Under the Hawaii Business Corporation Act, a dividend or other distribution may not be made if a bank would not be able to pay its debts as they become due in the ordinary course of business or if its total assets would be less than the sum of its total liabilities and the amounts that would be needed to satisfy shareholders with preferential rights of distribution. In addition, under the Federal Deposit Insurance Act of 1950 (“FDIA”), an insured depository institution may not pay a dividend if payment would cause it to become undercapitalized or if it already is undercapitalized. See “— Prompt Corrective Action Framework” below.

Payment of Dividends and Common Stock Repurchases by FHI. As a bank holding company, FHI is subject to oversight by the Federal Reserve. In particular, the dividend policies and share repurchases of the Company are reviewed by the Federal Reserve and will be assessed against, among other things, the FHI’s ability to achieve the required capital ratios under applicable capital rules (including the applicable capital conservation buffer). See “— Regulatory Capital Requirements” below. In addition, the Federal Reserve has indicated generally that it may be an unsafe or unsound practice for bank holding companies to pay dividends unless a bank holding company’s net income is sufficient to fund the dividends and the expected rate of earnings retention is consistent with the organization’s capital needs, asset quality and overall financial condition. Federal Reserve guidance also directs bank holding companies to inform the Federal Reserve reasonably in advance of declaring or paying a dividend that exceeds earnings for the period for which the dividend is being paid.

In certain circumstances, FHI’s repurchases of its common stock may be subject to a prior approval or notice requirement under other regulations or policies of the Federal Reserve. Redemption or repurchase of preferred stock or subordinated debt is subject to the prior approval of the Federal Reserve.

Transactions with Affiliates and Insiders

Transactions between the Bank and its subsidiaries, on the one hand, and the Company or any other affiliate of the Bank, on the other hand, are regulated under federal banking law. The Federal Reserve Act generally requires those transactions to be on terms at least as favorable to the Bank as if the transaction were conducted with an unaffiliated third party and imposes quantitative limits, collateral requirements and qualitative requirements on “covered transactions” by the Bank with, or for the benefit of, its affiliates. “Covered transactions” are defined by statute to include a loan or extension of credit, as well as a purchase of securities issued by an affiliate, a purchase of assets (unless otherwise exempted by the Federal Reserve) from the affiliate, the acceptance of securities issued by the affiliate as collateral for a loan, the issuance of a guarantee, acceptance or letter of credit on behalf of an affiliate, and credit exposure arising under derivative transactions, repurchase and reverse repurchase agreements, and securities borrowing and lending transactions. In general, any such transaction by the Bank or its subsidiaries must be limited to certain thresholds on an individual and aggregate basis and, for credit transactions with any affiliate, must be secured by designated amounts of specified collateral.

Federal law also limits a bank’s authority to extend credit to its directors, executive officers, principal shareholders (generally defined as persons that beneficially own or control more than 10% of any class of the bank’s voting stock), as well as to entities owned or controlled by such persons. Among other things, extensions of credit to such insiders are required to be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with non-insiders. Also, the terms of such extensions of credit may not involve more than the normal risk of non-repayment or present other unfavorable features and may not exceed certain limitations on the amount of credit extended to such persons individually and in the aggregate. Certain extensions of credit also require the approval of the Bank’s board of directors.

Source of Strength

Federal law requires bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. Under this requirement, FHI is expected to commit resources to support the Bank, including at times when FHI may not be in a financial position to provide such resources, and it may not be in its, or its stockholders’ or creditors’, best interests to do so. In addition, any capital loans FHI makes to the Bank are subordinate in right of payment to depositors and to certain other indebtedness of the Bank. In the event of FHI’s bankruptcy, any commitment by FHI to a federal bank regulatory agency to maintain the capital of the Bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Regulatory Capital Requirements

Capital Requirements Applicable to Top-Tier Holding Companies in an Organizational Structure. The Federal Reserve monitors the capital adequacy of the Company, and the FDIC and the Hawaii DFI monitor the capital adequacy of the Bank. The bank regulators currently use a combination of risk-based ratios and a leverage ratio to evaluate capital adequacy. The Company and the Bank are subject to the federal bank regulators’ final rules implementing Basel III and various provisions of the Dodd-Frank Act (the “Capital Rules”).

The Capital Rules, among other things, impose a capital measure called “Common Equity Tier 1” (“CET1”), to which most deductions/adjustments to regulatory capital must be made. In addition, the Capital Rules specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting certain specified requirements.

Under the Capital Rules, the minimum capital ratios are as follows:

The Capital Rules also require a 2.5% capital conservation buffer designed to absorb losses during periods of economic stress. The capital conservation buffer is composed entirely of CET1, on top of these minimum risk-weighted asset ratios. Both the Company and the Bank are required to maintain such additional capital conservation buffer of 2.5% of CET1, effectively resulting in minimum ratios of (i) 7% CET1 to risk-weighted assets, (ii) 8.5% Tier 1 capital to risk-weighted assets, and (iii) 10.5% total capital to risk-weighted assets.

Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the capital conservation buffer face constraints on dividends, equity repurchases and certain discretionary compensation based on the amount of the shortfall and the institution’s “eligible retained income” (defined as the greater of (i) net income for the four preceding quarters, net of distributions and associated tax effects not reflected in net income; and (ii) the average of net income over the preceding four quarters), with progressively more stringent constraints as the Company approaches the minimum ratios.

The Capital Rules provide for a number of deductions from and adjustments to CET1. As a “non-advanced approaches” firm under the Capital Rules, the Company is subject to rules that provide for simplified capital requirements relating to the threshold deductions for mortgage servicing rights, deferred tax assets arising from temporary differences that a banking organization could not realize through net operating loss carry backs, and investments in the capital of non-consolidated financial institutions, as well as the inclusion of minority interests in regulatory capital.

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms. Among other things, these standards revise the Basel Committee’s standardized approach for credit risk (including recalibrating risk weights and introducing new capital requirements for certain “unconditionally cancellable commitments,” such as unused credit card and home equity lines of credit) and provide a new standardized approach for operational risk capital. Under the current U.S. Capital Rules, operational risk capital requirements and a capital floor apply only to advanced approaches institutions, and not to the Company or the Bank.

On July 27, 2023, the federal banking regulators proposed revisions to the Capital Rules to implement the Basel Committee’s 2017 standards and make other changes to the Capital Rules. The proposal introduces revised credit risk, equity risk, operational risk, credit valuation adjustment risk and market risk requirements, among other changes. However, the revised capital requirements of the proposed rule would not apply to FHI or the Bank because they have less than $100 billion in total consolidated assets and trading assets and liabilities below the threshold for market risk requirements.

Prompt Corrective Action Framework

The FDIA requires the federal bank regulators to take prompt corrective action in respect of depository institutions that fail to meet specified capital requirements. The FDIA establishes five capital categories (“well-capitalized”, “adequately capitalized”, “undercapitalized”, “significantly undercapitalized” and “critically undercapitalized”). The federal bank regulators are required to take certain mandatory supervisory actions, and are authorized to take other discretionary actions, with respect to institutions that are undercapitalized, significantly undercapitalized or critically undercapitalized, with supervisory actions progressively becoming more severe as the institution’s capital category declines.

To be “well capitalized” an insured depository institution must not be subject to any order or written agreement or directive requiring a specific capital level and must maintain the following minimum capital ratios:

•Total capital ratio of at least 10.0%,

•CET1 capital ratio of at least 6.5%,

•Tier 1 capital ratio of at least 8.0%, and

•Tier 1 leverage ratio of at least 5.0%.

A bank will be “adequately capitalized” if the institution has a total risk-based capital ratio of 8.0% or greater, a CET1 capital ratio of 4.5% or greater, a Tier 1 risk-based capital ratio of 6.0% or greater, and a leverage ratio of 4.0% or greater and is not “well capitalized.”

An institution may be downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios if it is determined to be in an unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters. A bank’s capital category is determined solely for the purpose of applying prompt corrective action regulations, and the capital category may not constitute an accurate representation of the bank’s overall financial condition or prospects for other purposes.

As of December 31, 2023, the Bank met all capital ratio requirements to be well-capitalized with both a CET1 capital ratio and a Tier 1 capital ratio of 12.30%, total capital ratio of 13.48% and Tier 1 leverage ratio of 8.57%, in each case calculated under the Capital Rules.

The FDIA’s prompt corrective action provisions apply only to depository institutions such as the Bank, and not to bank holding companies. Under the Federal Reserve’s regulations, a bank holding company, such as FHI, is considered “well capitalized” if the bank holding company (i) has a total risk based capital ratio of at least 10%, (ii) has a Tier 1 risk-based capital ratio of at least 6%, and (iii) is not subject to any written agreement order, capital directive or prompt corrective action directive to meet and maintain a specific capital level for any capital measure. The Company meets all capital ratio requirements to be well-capitalized under the Federal Reserve’s regulations, and, although the prompt corrective action provisions apply only to depository institutions and not to bank holding companies, if the provisions applied to bank holding companies, the Company would meet all capital ratio requirements to be well-capitalized. As of December 31, 2023, the Company’s CET1 capital ratio and Tier 1 capital ratio were each 12.39%, its total capital ratio was 13.57%, and its Tier 1 leverage ratio was 8.64%, in each case calculated under the Capital Rules. For more information on the Company’s and the Bank’s capital ratios, see “Item 7. Management’s Discussion and Analysis of Financial Condition — Capital” and “Note 12. Regulatory Capital Requirements” in the notes to the consolidated financial statements included in Item 8. Financial Statements and Supplementary Data.

An institution that is categorized as undercapitalized, significantly undercapitalized or critically undercapitalized is required to submit an acceptable capital restoration plan to its appropriate federal bank regulator. Under the FDIA, in order for the capital restoration plan to be accepted by the appropriate federal banking agency, a bank holding company must guarantee that a subsidiary depository institution will comply with its capital restoration plan, subject to certain limitations. The bank holding company must also provide appropriate assurances of performance. The obligation of a controlling bank holding company under the FDIA to fund a capital restoration plan is limited to the lesser of 5% of an undercapitalized subsidiary’s assets or the amount required to meet regulatory capital requirements. An undercapitalized institution is also generally prohibited from increasing its average total assets, making acquisitions, establishing any branches or engaging in any new line of business, except in accordance with an accepted capital restoration plan or with the approval of the FDIC. Institutions are also generally prohibited from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the institution is or would thereafter become undercapitalized. Institutions that are undercapitalized or significantly undercapitalized and either fail to submit an acceptable capital restoration plan or fail to implement an approved capital restoration plan may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become adequately capitalized, orders to elect new boards of directors, requirements to reduce total assets and cessation of receipt of deposits from correspondent banks. Critically undercapitalized institutions are generally subject to appointment of a receiver or conservator.

Brokered Deposits

The FDIA prohibits insured depository institutions from accepting brokered deposits, unless it is well capitalized or is adequately capitalized and receives a waiver from the FDIC. Under FDIC regulations governing brokered deposits and interest rate restrictions, a depository institution that is adequately capitalized and accepts brokered deposits under a waiver from the FDIC may not pay an interest rate on any such deposit that, at the time any such deposit is accepted, is (i) in excess of 75 basis points over certain national rates described in the FDIC’s regulations, or (ii) 90% of the highest interest rate paid on a particular deposit product in the depository institution’s local market area if the institution provides notice to the FDIC and evidence of such local interest rate. The FDIA imposes no such restrictions on a bank that is well capitalized.

Safety and Soundness Standards

The FDIA requires the federal bank regulators to prescribe standards, by regulations or guidelines, relating to internal controls, information systems and internal audit systems, loan documentation, credit underwriting, interest rate risk exposure, asset growth, asset quality, earnings, stock valuation and compensation, fees and benefits, and such other operational and managerial standards as the agencies deem appropriate. Guidelines adopted by the federal bank regulatory agencies establish general standards relating to internal controls and information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth and compensation, fees and benefits. In general, these guidelines require, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines. These guidelines also prohibit excessive compensation as an unsafe and unsound practice and describe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal stockholder. In addition, the agencies adopted regulations that authorize, but do not require, an agency to order an institution that has been given notice by an agency that it is not satisfying any of such safety and soundness standards to submit a compliance plan. If, after being so notified, an institution fails to submit an acceptable compliance plan or fails in any material respect to implement an acceptable compliance plan, the bank regulator must issue an order directing action to correct the deficiency and may issue an order directing other actions of the types to which an undercapitalized institution may be subject under the FDIA. See “— Prompt Corrective Action Framework” above. If an institution fails to comply with such an order, the bank regulator may seek to enforce such order in judicial proceedings and to impose civil money penalties.

Deposit Insurance

FDIC Insurance Assessments. As an FDIC-insured bank, FHB must pay deposit insurance assessments to the FDIC based on its average total assets minus its average tangible equity. For institutions with $10 billion or more in assets, such as FHB, the FDIC uses a performance score and a loss-severity score that are used to calculate an initial assessment rate. In calculating these scores, the FDIC uses a bank’s capital level and supervisory ratings and certain financial measures to assess an institution’s ability to withstand asset-related stress and funding-related stress. The FDIC also has the ability to make discretionary adjustments to the total score based upon significant risk factors that are not adequately captured in the calculations. In addition to ordinary assessments described above, the FDIC has the ability to impose special assessments in certain instances.

Under the FDIA, the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC. In addition, the FDIC is authorized to conduct examinations of and require reporting by FDIC-insured institutions.

On October 18, 2022, the FDIC adopted a final rule that increased initial base deposit insurance assessment rates by 2 basis points, beginning in the first quarterly assessment period of 2023. The FDIC, as required under the FDIA, established a plan in September 2020 to restore the reserve ratio of FDIC’s Deposit Insurance Fund (the “DIF”) to meet or exceed the statutory minimum of 1.35 percent within eight years. The increased assessment is intended to improve the likelihood that the DIF reserve ratio would reach the required minimum by the statutory deadline of September 30, 2028.

On November 16, 2023, the FDIC finalized a rule that imposes special assessments to recover the losses to the deposit insurance fund (“DIF”) resulting from the FDIC’s use, in March 2023, of the systemic risk exception to the least-cost resolution test under the Federal Deposit Insurance Act in connection with the receiverships of Silicon Valley Bank and Signature Bank. The FDIC estimated in approving the rule that those assessed losses total approximately $16.3 billion. The rule provides that this loss estimate will be periodically adjusted, which will affect the amount of the special assessment. Under the rule, the assessment base is the estimated uninsured deposits that an insured depository institution (“IDI”) reported in its December 31, 2022 Call Report, excluding the first $5 billion in estimated uninsured deposits. The special assessments will be collected at an annual rate of approximately 13.4 basis points per year (3.36 basis points per quarter) over eight quarters in 2024 and 2025, with the first assessment period beginning January 1, 2024. Because the estimated loss pursuant to the systemic risk determination will be periodically adjusted, the FDIC retains the ability to cease collection early, extend the special assessment collection period and impose a final shortfall special assessment on a one-time basis. The Company expects the special assessments to be tax deductible. The total of the assessments for the Bank is estimated at $16.3 million, and such amount was recorded as an expense in the quarter of adoption (the quarter ending December 31, 2023).

The Volcker Rule

The Dodd-Frank Act and the implementing regulations of the federal regulators generally prohibit banks and their affiliates from engaging in proprietary trading and investing in and sponsoring hedge funds and private equity funds (the “Volcker Rule”). The Volcker Rule has not had a material effect on the Company’s operations, as the Company does not have any significant engagement in the businesses prohibited by the Volcker Rule. The Company has incurred costs to adopt additional policies and systems to ensure compliance with the Volcker Rule, but such costs have not been material.

Depositor Preference

Under federal law, depositors (including the FDIC with respect to the subrogated claims of insured depositors) and certain claims for administrative expenses of the FDIC as receiver would be afforded a priority over other general unsecured claims against such an institution in the “liquidation or other resolution” of such an institution by any receiver.

Consumer Financial Protection

The Company is subject to a number of federal and state consumer protection laws that extensively govern the Company’s relationship with its customers. These laws include, but are not limited to, the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Truth in Lending Act, the Truth in Savings Act, the Electronic Fund Transfer Act, the Expedited Funds Availability Act, the Home Mortgage Disclosure Act, the Fair Housing Act, the Real Estate Settlement Procedures Act, the Service Members Civil Relief Act and these laws’ respective state-law counterparts, as well as state usury laws and laws regarding unfair and deceptive acts and practices. These and other federal and state laws require, among other things, disclosures of the cost of credit and terms of deposit accounts, provide substantive consumer rights, prohibit discrimination in credit transactions, regulate the use of credit report information, provide financial privacy protections, prohibit unfair, deceptive and abusive practices and subject the Company to substantial regulatory oversight. Violations of applicable consumer protection laws can result in significant potential liability from litigation brought by customers, including actual damages, restitution and attorneys’ fees. Federal bank regulators, state attorneys general and state and local consumer protection agencies may also seek to enforce consumer protection requirements and obtain these and other remedies, including regulatory sanctions, customer rescission rights, action by the state and local attorneys general in each jurisdiction in which the Company operates and civil money penalties. Failure to comply with consumer protection requirements may also result in significant reputational harm as well as failure to obtain any required bank regulatory approval for merger or acquisition transactions the Company may wish to pursue or the Company’s prohibition from engaging in such transactions even if approval is not required.

The CFPB is a federal agency with broad rulemaking, supervisory and enforcement powers under federal consumer financial protection laws and has examination and enforcement authority over banks with assets of $10 billion or more, as well as their affiliates. The CFPB’s authority includes the ability to require reimbursements and other payments to customers for alleged legal violations and to impose significant penalties, as well as injunctive relief that prohibits lenders from engaging in allegedly unlawful practices. The CFPB also has the authority to obtain cease and desist orders providing for affirmative relief or monetary penalties.

Under CFPB rules relating to residential mortgage loans, banks are required to: (i) develop and implement procedures to ensure compliance with a “reasonable ability to repay” test and identify whether a loan meets a new definition for a “qualified mortgage”, in which case a rebuttable presumption exists that the creditor extending the loan has satisfied the reasonable ability to repay test; (ii) implement disclosures, policies and procedures for originating and servicing mortgages including, but not limited to, integrated loans estimate and closing disclosures, pre-loan counseling, early intervention with delinquent borrowers and specific loss mitigation procedures for loans secured by a borrower’s principal residence; (iii) comply with additional restrictions on mortgage loan originator hiring and compensation; (iv) comply with disclosure requirements and standards for appraisals and certain financial products; and (v) maintain escrow accounts for higher-priced mortgage loans for a longer period of time.

On October 19, 2023, the CFPB proposed a new rule that would require a provider of payment accounts or products, such as a bank, to make data available to consumers upon request regarding the products or services they obtain from the provider. Any such data provider would also have to make such data available to third parties, with the consumer’s express authorization and through an interface that satisfies formatting, performance and security standards, for the purpose of such third parties providing the consumer with financial products or services requested by the consumer. Data that would be required to be made available under the rule would include transaction information, account balance, account and routing numbers, terms and conditions, upcoming bill information, and certain account verification data. The proposed rule is intended to give consumers control over their financial data, including with whom it is shared, and encourage competition in the provision of consumer financial products or services. For banks that hold between $850 million and $50 billion in total assets, compliance with the proposed rule’s requirements would be required approximately two and a half years after adoption of the final rule.

In October 2023, the Federal Reserve proposed amendments to its rules on interchange fees. Interchange fees, or “swipe” fees, are charges that merchants pay to card-issuing banks, such as FHB, for processing electronic payment transactions. The current interchange fee limitations establish a maximum possible fee for many types of debit interchange transactions that is equal to no more than 21 cents per transaction plus five basis points multiplied by the value of the transaction. The proposed changes would establish a maximum permissible interchange fee of no more than 14.4 cents per transaction plus four basis points multiplied by the value of the transaction. The current rules allow a debit card issuer to recover one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements. Under the proposed changes, the fraud prevention adjustment would be increased to 1.3 cents per transaction. The proposed rule would also establish an automatic update of the interchange fee cap every other year based on a survey of debit card issuers.

On January 17, 2024, the CFPB proposed significant reforms to the regulatory framework governing overdraft practices applicable to banks such as FHB that have more than $10 billion in assets. The proposed rule would modify or eliminate several long-standing exclusions from requirements generally applicable to consumer credit that previously exempted certain overdraft practices. The proposal would also generally require banks to restructure many overdraft fees, overdraft lines of credit, and other overdraft practices as separate consumer credit accounts that would be subject to those requirements. These changes to the regulatory framework could result in the Bank, among other things, facing higher compliance costs in charging overdraft fees, experiencing a decreased ability to recover amounts extended as overdraft protection, reducing the availability of overdraft protection, and/or charging lower overdraft fees.

The Dodd-Frank Act does not prevent states from adopting stricter consumer protection standards. State regulation of financial products and potential enforcement actions could also adversely affect the Company’s business, financial condition or results of operations.

Community Reinvestment Act of 1977

Under the CRA, the Bank has an obligation, consistent with safe and sound operations, to help meet the credit needs of the market areas where it operates, which include low- and moderate-income individuals and communities. In connection with its examination of the Bank, the FDIC is required to assess the Bank’s CRA performance in the areas of lending, investments and services. FHB’s CRA performance could, among other things, result in the denial or delay in certain corporate applications filed by the Parent or the Bank, including applications for branch openings or relocations and applications to acquire, merge or consolidate with another banking institution or holding company. FHB received a rating of “Outstanding” in its most recently completed CRA examination.

In October 2023, the OCC, the Federal Reserve and the FDIC jointly issued a final rule to modernize the federal bank regulators’ regulations implementing the CRA. The final rule introduces new tests under which the performance of banks with over $2 billion in assets will be assessed. The new rule also includes data collection and reporting requirements, some of which are applicable only to banks with over $10 billion in assets, such as the Bank. Most provisions of the final rule will become effective on January 1, 2026, and the data reporting requirements will become effective on January 1, 2027.

Financial Privacy and Cybersecurity

The federal bank regulators have adopted rules limiting the ability of banks and other financial institutions to disclose non-public information about consumers to unaffiliated third parties. These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to an unaffiliated third party. These regulations affect how consumer information is transmitted through diversified financial companies and conveyed to outside vendors. In addition, consumers may also prevent disclosure of certain information among affiliated companies that is assembled or used to determine eligibility for a product or service, such as that shown on consumer credit reports and asset and income information from applications. Consumers also have the option to direct banks and other financial institutions not to share information about transactions and experiences with affiliated companies for the purpose of marketing products or services.

Federal banking regulators regularly issue guidance regarding cybersecurity intended to enhance cyber risk management standards among financial institutions. A financial institution is expected to establish multiple lines of defense and to ensure their risk management processes address the risk posed by potential threats to the institution. A financial institution’s management is expected to maintain sufficient processes to effectively respond and recover the institution’s operations after a cyberattack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations if a critical service provider of the institution falls victim to this type of cyberattack. The Bank has adopted an information security program that has been approved by its board of directors and reviewed by its regulators.

In November 2021, the federal bank regulatory agencies issued a final rule regarding notification requirements for banking organizations related to significant computer security incidents. Under the final rule, a bank holding company, such as FHI, and an FDIC-supervised insured depository institution, such as FHB, would be required to notify the Federal Reserve or FDIC, respectively, within 36 hours of any incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or pose a threat to the financial stability of the United States.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. For example, the California Consumer Privacy Act became effective on January 1, 2020 and the Colorado Privacy Act and Virginia Consumer Data Protection Act were enacted in 2021. We expect this trend of state-level activity in those areas to continue and are continually monitoring developments in the states in which our customers are located.

Anti-Money Laundering and the USA PATRIOT Act

A major focus of governmental policy on financial institutions in recent years has been aimed at combating money laundering and terrorist financing. Anti-money laundering laws, including the Bank Secrecy Act (the “BSA”), as amended by the USA PATRIOT Act, impose compliance and due diligence obligations, and financial institutions must take certain steps to assist government agencies in detecting and preventing money laundering and report certain types of suspicious transactions. Financial institutions are also prohibited from entering into specified financial transactions and account relationships and must use enhanced due diligence procedures in their dealings with certain types of high-risk customers and implement a written customer identification program. Regulatory authorities routinely examine financial institutions for compliance with these requirements, and failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious financial, legal and reputational consequences for the institution, including the imposition of civil money penalties or causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required. Regulatory authorities have imposed cease and desist orders and civil money penalties against institutions found to be violating these requirements.

In January 2021, the Anti-Money Laundering Act of 2020 (“AMLA”), which amends the BSA, was enacted. The AMLA is intended to comprehensively reform and modernize U.S. anti-money laundering laws. Among other things, the AMLA codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the development of standards by the U.S. Department of the Treasury for evaluating technology and internal processes for BSA compliance; and expands enforcement- and investigation-related authority, including a significant expansion in the available sanctions for certain BSA violations and instituting BSA whistleblower incentives and protections. In June 2021, FinCEN issued the priorities for anti-money laundering and countering the financing of terrorism policy, as required under the AMLA. The priorities include corruption, cybercrime, terrorist financing, fraud, transnational crime, drug trafficking, human trafficking, and proliferation financing. Many of the statutory provisions in the AMLA will require additional rulemakings, reports and other measures, and the impact of the AMLA will depend on, among other things, rulemaking and implementation guidance.

Office of Foreign Assets Control (“OFAC”) Regulation

The U.S. Treasury Department’s OFAC administers and enforces economic and trade sanctions against targeted foreign countries and regimes, under authority of various laws, including designated foreign countries, nationals and others. OFAC publishes lists of specially designated targets and countries. The Company and the Bank are responsible for, among other things, blocking accounts of, and transactions with, such targets and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence. Failure to comply with these sanctions could have serious financial, legal and reputational consequences, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required. Regulatory authorities have imposed significant penalties, including cease and desist orders and civil money penalties against institutions found to be violating these sanctions.

Incentive Compensation

The Federal Reserve will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Company, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

Under Federal Reserve and FDIC guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, a banking organization’s incentive compensation arrangements should (i) provide incentives that appropriately balance risk and financial results in a manner that does not encourage employees to expose their organizations to imprudent risk, (ii) be compatible with effective internal controls and risk management and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors. These three principles are incorporated into the proposed joint compensation regulations under the Dodd-Frank Act, discussed below.

During 2016, the federal bank regulatory agencies and the SEC proposed revised rules on incentive-based payment arrangements at specified regulated entities having at least $1 billion of total assets. These proposed rules have not been finalized.

In October 2022, the SEC adopted a final rule directing national securities exchanges and associations, including NASDAQ, to require policies mandating the recovery or “clawback” of excess incentive-based compensation earned by a current or former executive officer during the three fiscal years preceding a required accounting restatement, including to correct an error that would result in a material misstatement if the error were corrected in the current period or left uncorrected in the current period. The excess compensation would be based on the amount the executive officer would have received had the incentive-based compensation been determined using the restated financials. NASDAQ’s listing standards pursuant to the SEC’s rule became effective October 2, 2023. The Company’s clawback policy adopted in accordance with these listing standards is included as Exhibit 97.1.

Climate-Related and Other ESG Developments

In recent years, federal, state and international lawmakers and regulators have increased their focus on financial institutions’ and other companies’ risk oversight, disclosures and practices in connection with climate change and other environmental, social and governance (“ESG”) matters. For example, on March 21, 2022, the SEC issued a proposed rule on the enhancement and standardization of climate-related disclosures for investors. The proposed rule would require public issuers, including the Company, to significantly expand the scope of climate-related disclosures in their SEC filings. The SEC has also announced plans to propose rules to require enhanced disclosure regarding human capital management and board diversity for public issuers.

Future Legislation and Regulation

Congress may enact, modify or repeal legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact, modify or repeal legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of proposed legislation, or modification or repeal of existing legislation, could impact the regulatory structure under which the Company operates and may significantly increase its costs, impede the efficiency of its internal business processes, require the Company to increase its regulatory capital and modify its business strategy, and limit its ability to pursue business opportunities in an efficient manner. The Company’s business, financial condition, results of operations or prospects may be adversely affected, perhaps materially, as a result.

Securities Exchange Act Reports and Additional Information

Our annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and all amendments to those reports can be found free of charge on our website at www.fhb.com, under Investor Relations, as soon as reasonably practicable after such material is electronically filed with or furnished to the U.S. Securities and Exchange Commission (“SEC”). These reports are also available free of charge on the SEC’s website at www.sec.gov.

Information on our Investor Relations website, our main website and other websites referred to in this report is not incorporated by reference into this report or any other report filed with or furnished to the SEC. We have included such website addresses only as inactive textual references and do not intend them to be active links.