QCR HOLDINGS INC

A****ppendix A

SUPERVISION AND REGULATION

General

FDIC-insured institutions, their holding companies and their affiliates are extensively regulated under federal and state law. As a result, the growth and earnings performance of the Company may be affected not only by management decisions and general economic conditions, but also by the requirements of federal and state statutes and by the regulations and policies of various bank regulatory agencies, including the Iowa Division of Banking, the Missouri Division of Finance, the Federal Reserve, the FDIC and the CFPB. Furthermore, taxation laws administered by the Internal Revenue Service and state taxing authorities, accounting rules developed by the Financial Accounting Standards Board, securities laws administered by the SEC and state securities authorities, and anti-money laundering laws enforced by the Treasury have an impact on the business of the Company. The effect of these statutes, regulations, regulatory policies and accounting rules are significant to the Company’s operations and results.

Federal and state banking laws impose a comprehensive system of supervision, regulation and enforcement on the operations of FDIC-insured institutions, their holding companies and affiliates that is intended primarily for the protection of the FDIC-insured deposits and depositors of banks, rather than stockholders. These laws, and the regulations of the bank regulatory agencies issued under them, affect, among other things, the scope of the Company’s business, the kinds and amounts of investments the Company and the Banks may make, required capital levels relative to assets, the nature and amount of collateral for loans, the establishment of branches, the ability to merge, consolidate and acquire, dealings with the Company’s and the Banks’ insiders and affiliates and the Company’s payment of dividends.

In reaction to the global financial crisis and particularly following the passage of the Dodd-Frank Act, the Company experienced heightened regulatory requirements and scrutiny. Although the reforms primarily targeted systemically important financial service providers, their influence filtered down in varying degrees to community banks over time and caused the Company’s compliance and risk management processes, and the costs thereof, to increase. The Economic Growth, Regulatory Relief and Consumer Protection Act of 2018 (“Regulatory Relief Act”) eliminated questions about the applicability of certain Dodd-Frank Act reforms to community bank systems, including relieving the Company of any requirement to engage in mandatory stress tests, maintain a risk committee or comply with the Volcker Rule’s complicated prohibitions on proprietary trading and ownership of private funds. These reforms have been favorable to the Company’s operations.

The supervisory framework for U.S. banking organizations subjects banks and bank holding companies to regular examination by their respective regulatory agencies, which results in examination reports and ratings that are not publicly available and that can impact the conduct and growth of their business. These examinations consider not only compliance with applicable laws and regulations, but also capital levels, asset quality and risk, management ability and performance, earnings, liquidity, and various other factors. The regulatory agencies generally have broad discretion to impose restrictions and limitations on the operations of a regulated entity where the agencies determine, among other things, that such operations are unsafe or unsound, fail to comply with applicable law or are otherwise inconsistent with laws and regulations.

The following is a summary of the material elements of the supervisory and regulatory framework applicable to the Company and the Banks. It does not describe all of the statutes, regulations and regulatory policies that apply, nor does it restate all of the requirements of those that are described. The descriptions are qualified in their entirety by reference to the particular statutory and regulatory provision.

The Role of Capital

Regulatory capital represents the net assets of a banking organization available to absorb losses. Because of the risks attendant to their business, FDIC-insured institutions generally are required to hold more capital than other businesses, which directly affects the Company’s earnings capabilities. Although capital has historically been one of the key measures of the financial health of both bank holding companies and banks, its role became fundamentally more important in the wake of the global financial crisis, as the banking regulators recognized that the amount and quality of capital held by banks prior to the crisis was insufficient to absorb losses during periods of severe stress.

Capital Levels. Banks have been required to hold minimum levels of capital based on guidelines established by the bank regulatory agencies since 1983. The minimums have been expressed in terms of ratios of “capital” divided by “total assets.” The capital guidelines for U.S. banks beginning in 1989 have been based upon international capital accords (known as “Basel” rules) adopted by the Basel Committee on Banking Supervision, a committee of central banks and bank supervisors that acts as the primary global standard-setter for prudential regulation, as implemented by the U.S. bank regulatory agencies on an interagency basis. The accords recognized that bank assets, for the purpose of the capital ratio calculations, needed to be risk weighted (the theory being that riskier assets should require more capital) and that off-balance sheet exposures needed to be factored in the calculations. Following the global financial crisis, the Group of Governors and Heads of Supervision, the oversight body of the Basel Committee on Banking Supervision, announced agreement on a strengthened set of capital requirements for banking organizations around the world, known as Basel III, to address deficiencies recognized in connection with the global financial crisis.

The Basel III Rule**.**The United States bank regulatory agencies adopted the Basel III regulatory capital reforms, and, at the same time, effected changes required by the Dodd-Frank Act, in regulations that were effective (with certain phase-ins) in 2015 (the “Basel III Rule”). Basel III established capital standards for banks and bank holding companies that are meaningfully more stringent than those in place previously.

The Basel III Rule is applicable to all banking organizations that are subject to minimum capital requirements, including federal and state banks and savings and loan associations, as well as to most bank and savings and loan holding companies. The Company and the Banks are each subject to the Basel III Rule.

Risk-Weighting Assets. Three of the required Basel III capital ratios, as discussed immediately below, are calculated using a denominator of total “risk-weighted” assets. In the calculation of so-called “risk weights,” which was introduced in the first Basel accord, bank assets were divided into four basic risk-weighted categories of zero, 20, 50, and 100%. Basel III required a more complex, detailed and calibrated assessment of risk in the calculation of risk weightings. Although it uses the same technique introduced by Basel I in assigning assets to risk-weight categories, it significantly increases the categories and adds conditions. Risk weights were established as high as 250% for certain commercial real estate exposures, and higher for certain derivatives. The assignment of risk weights continues to be under review by the banking agencies, and has culminated in an initiative called “Basel III: Endgame,” which, as proposed, would only apply to banks with over $100 billion in assets or more and would not impact the Company.

Minimum Capital Ratios. Basel III also increased the required quantity and quality of capital. Not only did it increase most of the required minimum capital ratios in effect prior to January 1, 2015, but, in requiring that forms of capital be of higher quality to absorb loss, it introduced the concept of Common Equity Tier 1 Capital, which consists primarily of common stock, related surplus (net of Treasury stock), retained earnings, and Common Equity Tier 1 minority interests subject to certain regulatory adjustments. The Basel III Rule also changed the definition of capital by establishing more stringent criteria that instruments must meet to be considered Additional Tier 1 Capital (primarily non-cumulative perpetual preferred stock that meets certain requirements) and Tier 2 Capital (primarily other types of preferred stock and subordinated debt, subject to

limitations). The Basel III Rule also constrained the inclusion of minority interests, mortgage-servicing assets, and deferred tax assets in capital and required deductions from Common Equity Tier 1 Capital if such assets exceeded a percentage of a banking institution’s Common Equity Tier 1 Capital.

The Basel III Rule requiresminimum capital ratios as follows:

In addition, institutions that want to make capital distributions (including for dividends and repurchases of stock) and pay discretionary bonuses to executive officers without restriction also must maintain 2.5% in Common Equity Tier 1 Capital attributable to a capital conservation buffer. The purpose of the conservation buffer is to ensure that banking institutions maintain a buffer of capital that can be used to absorb losses during periods of financial and economic stress. Factoring in the conservation buffer increases the minimum ratios depicted above to 7% for Common Equity Tier 1 Capital, 8.5% for Tier 1 Capital and 10.5% for Total Capital.

Well-Capitalized Requirements**.**The ratios described above are minimum standards for banking organizations to be considered “adequately capitalized.” Bank regulatory agencies uniformly encourage banks to hold more capital and be “well-capitalized” and, to that end, federal law and regulations provide various incentives for banking organizations to maintain regulatory capital at levels in excess of minimum regulatory requirements. For example, a banking organization that is well-capitalized may: (i) qualify for exemptions from prior notice or application requirements otherwise applicable to certain types of activities; (ii) qualify for expedited processing of other required notices or applications; and (iii) accept, roll-over or renew brokered deposits. Higher capital levels also could be required if warranted by the particular circumstances or risk profiles of individual banking organizations. For example, the Federal Reserve’s capital guidelines contemplate that additional capital may be required to take adequate account of, among other things, interest rate risk, or the risks posed by concentrations of credit, nontraditional activities or securities trading activities. Further, any banking organization experiencing or anticipating significant growth would be expected to maintain capital ratios, including tangible capital positions (i.e., Tier 1 Capital less all intangible assets), well above the minimum levels.

Under the capital regulations of the Federal Reserve, in order to be well-capitalized, a banking organization must maintain:

It is possible under the Basel III Rule to be well-capitalized while remaining out of compliance with the capital conservation buffer discussed above.

As of December 31, 2023: (i) none of the Banks was subject to a directive from the Iowa Division of Banking, the Missouri Division of Finance, or the Federal Reserve, as applicable, to increase its capital; and (ii) the Banks were well-capitalized, as defined by Federal Reserve regulations. As of December 31, 2023, the Company had regulatory capital in excess of the Federal Reserve’s requirements and met the Basel III Rule requirements to be well-capitalized. The Company is in compliance with the capital conservation buffer.

Prompt Corrective Action**.The concept of an institution being “well-capitalized” is part of a regulatory enforcement regime that provides the federal banking regulators with broad power to take “prompt corrective action” to resolve the problems of depository institutions based on the capital level of each particular institution. **The extent of the regulators’ powers depends on whether the institution in question is “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” or “critically undercapitalized,” in each case as defined by regulation. Depending upon the capital category to which an institution is assigned, the regulators’ corrective powers include: (i) requiring the institution to submit a capital restoration plan; (ii) limiting the institution’s asset growth and restricting its activities; (iii) requiring the institution to issue additional capital stock (including additional voting stock) or to sell itself; (iv) restricting transactions between the institution and its affiliates; (v) restricting the interest rate that the institution may pay on deposits; (vi) ordering a new election of directors of the institution; (vii) requiring that senior executive officers or directors be dismissed; (viii) prohibiting the institution from accepting deposits from correspondent banks; (ix) requiring the institution to divest certain subsidiaries; (x) prohibiting the payment of principal or interest on subordinated debt; and (xi) ultimately, appointing a receiver for the institution.

Community Bank Capital Simplification**.**Community banks have long raised concerns with bank regulators about the regulatory burden, complexity, and costs associated with certain provisions of the Basel III Rule. In response, Congress provided an “off-ramp” for institutions, like the Company, with total consolidated assets of less than $10 billion. Section 201 of the Regulatory Relief Act instructed the federal banking regulators to establish a single “Community Bank Leverage Ratio” (“CBLR”) of between 8 and 10%. Under the final rule, a community banking organization is eligible to elect the new framework if it has: less than $10 billion in total consolidated assets, limited amounts of certain assets and off-balance sheet exposures, and a CBLR greater than 9%. The Company may elect the CBLR framework at any time, but has not currently determined to do so.

Supervision and Regulation of the Company

General. The Company, as the sole stockholder of the Banks, is a bank holding company. As a bank holding company, the Company is registered with, and is subject to regulation, supervision and enforcement by, the Federal Reserve under the BHCA. The Company is legally obligated to act as a source of financial strength to the Banks and to commit resources to support the Banks in circumstances where the Company might not otherwise do so. Under the BHCA, the Company is subject to periodic examination by the Federal Reserve. The Company is required to file with the Federal Reserve periodic reports of the Company’s operations and such additional information regarding the Company and its subsidiaries as the Federal Reserve may require.

Acquisitions, Activities and Financial Holding Company Election**.**The primary purpose of a bank holding company is to control and manage banks. The BHCA generally requires the prior approval of the Federal Reserve for any merger involving a bank holding company or any acquisition by a bank holding company of another bank or bank holding company. Subject to certain conditions (including deposit concentration limits established by the BHCA), the Federal Reserve may allow a bank holding company to acquire banks located in any state of the United States. In approving interstate acquisitions, the Federal Reserve is required to give effect to applicable state law limitations on the aggregate amount of deposits that may be held by the acquiring bank holding company and its FDIC-insured institution affiliates in the state in which the target bank is located (provided that those limits do not discriminate against out-of-state institutions or their holding companies) and state laws that require that the target bank have been in existence for a minimum period

of time (not to exceed five years) before being acquired by an out-of-state bank holding company. Furthermore, in accordance with the Dodd-Frank Act, bank holding companies must be well-capitalized and well-managed in order to effect interstate mergers or acquisitions. For a discussion of the capital requirements, see “—The Role of Capital” above.

The BHCA generally prohibits the Company from acquiring direct or indirect ownership or control of more than 5% of the voting shares of any company that is not a bank, and from engaging in any business other than that of banking, managing and controlling banks or furnishing services to banks and their subsidiaries. This general prohibition is subject to a number of exceptions. The principal exception allows bank holding companies to engage in, and to own shares of companies engaged in, certain businesses found by the Federal Reserve prior to November 11, 1999 to be “so closely related to banking ... as to be a proper incident thereto.” This authority permits the Company to engage in a variety of banking-related businesses, including the ownership and operation of a savings association, or any entity engaged in consumer finance, equipment leasing, the operation of a computer service bureau (including software development) and mortgage banking and brokerage services. The BHCA does not place territorial restrictions on the domestic activities of nonbank subsidiaries of bank holding companies.

Additionally, bank holding companies that meet certain eligibility requirements prescribed by the BHCA and elect to operate as financial holding companies may engage in, or own shares in companies engaged in, a wider range of nonbanking activities, including securities and insurance underwriting and sales, merchant banking and any other activity that the Federal Reserve, in consultation with the Secretary of the Treasury, determines by regulation or order is financial in nature or incidental to any such financial activity or that the Federal Reserve determines by order to be complementary to any such financial activity, as long as the activity does not pose a substantial risk to the safety or soundness of FDIC-insured institutions or the financial system generally. The Company has elected to operate as a financial holding company.

In order to maintain its status as a financial holding company, the Company and the Banks must be well-capitalized, well-managed, and the Banks must have a least a satisfactory Community Reinvestment Act (“CRA”) rating. If the Federal Reserve determines that a financial holding company is not well-capitalized or well-managed, the Federal Reserve will provide a period of time in which to achieve compliance, but, during the period of noncompliance, the Federal Reserve may place any limitations on the Company that it deems appropriate. Furthermore, if the Federal Reserve determines that a financial holding company’s subsidiary bank has not received a satisfactory CRA rating, that company will not be able to commence any new financial activities or acquire a company that engages in such activities.

Change in Control. Federal law prohibits any person or company from acquiring “control” of an FDIC-insured depository institution or its holding company without prior notice to the appropriate federal bank regulator. “Control” is conclusively presumed to exist upon the acquisition of 25% or more of the outstanding voting securities of a bank or bank holding company, but may arise under certain circumstances between 10% and 24.99% ownership.

Capital Requirements. Bank holding companies are required to maintain capital in accordance with Federal Reserve capital adequacy requirements. For a discussion of capital requirements, see “—The Role of Capital” above.

Dividend Payments. The Company’s ability to pay dividends to its stockholders may be affected by both general corporate law considerations and policies of the Federal Reserve applicable to bank holding companies*.*As a Delaware corporation, the Company is subject to the limitations of the DGCL, which allow the Company to pay dividends only out of its surplus (as defined and computed in accordance with the provisions of the DGCL) or if the Company has no such surplus, out of its net profits for the fiscal year in which the dividend is declared and/or the preceding fiscal year.

As a general matter, the Federal Reserve has indicated that the board of directors of a bank holding company should eliminate, defer or significantly reduce dividends to stockholders if: (i) the company’s net income available to stockholders for the past four quarters, net of dividends previously paid during that period, is not sufficient to fully fund the dividends; (ii) the prospective rate of earnings retention is inconsistent with the company’s capital needs and overall current and prospective financial condition; or (iii) the company will not meet, or is in danger of not meeting, its minimum regulatory capital adequacy ratios. The Federal Reserve also possesses enforcement powers over bank holding companies and their nonbank subsidiaries to prevent or remedy actions that represent unsafe or unsound practices or violations of applicable statutes and regulations. Among these powers is the ability to proscribe the payment of dividends by banks and bank holding companies. In addition, under the Basel III Rule, institutions that seek the freedom to pay dividends have to maintain 2.5% in Common Equity Tier 1 Capital attributable to the capital conservation buffer. See “—The Role of Capital” above.

Incentive Compensation. There have been a number of developments in recent years focused on incentive compensation plans sponsored by bank holding companies and banks, reflecting recognition by the bank regulatory agencies and Congress that flawed incentive compensation practices in the financial industry were one of many factors contributing to the global financial crisis. The result is interagency guidance on sound incentive compensation practices.

The interagency guidance recognized three core principles. Effective incentive plans should: (i) provide employees incentives that appropriately balance risk and reward; (ii) be compatible with effective controls and risk-management; and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors. Much of the guidance addresses large banking organizations and, because of the size and complexity of their operations, the regulators expect those organizations to maintain systematic and formalized policies, procedures, and systems for ensuring that the incentive compensation arrangements for all executive and non-executive employees covered by this guidance are identified and reviewed, and appropriately balance risks and rewards. Smaller banking organizations, like the Company, that use incentive compensation arrangements are expected to be less extensive, formalized, and detailed than those of the larger banks.

Monetary Policy. The monetary policy of the Federal Reserve has a significant effect on the operating results of financial or bank holding companies and their subsidiaries. Among the tools available to the Federal Reserve to affect the money supply are open market transactions in U.S. government securities and changes in the discount rate on bank borrowings. These means are used in varying combinations to influence overall growth and distribution of bank loans, investments and deposits, and their use may affect interest rates charged on loans or paid on deposits.

Federal Securities Regulation. The Company’s common stock is registered with the SEC under the Securities Act of 1933, as amended, and the Exchange Act. Consequently, the Company is subject to the information, proxy solicitation, insider trading and other restrictions and requirements of the SEC under the Exchange Act.

Corporate Governance**.**The Dodd-Frank Act addressed many investor protection, corporate governance and executive compensation matters that will affect most U.S. publicly traded companies. It increased stockholder influence over boards of directors by requiring companies to give stockholders a nonbinding vote on executive compensation and so-called “golden parachute” payments, and authorizing the SEC to promulgate rules that would allow stockholders to nominate and solicit voters for their own candidates using a company’s proxy materials. The legislation also directed the Federal Reserve to promulgate rules prohibiting excessive compensation paid to executives of bank holding companies, regardless of whether such companies are publicly traded.

Supervision and Regulation of the Banks

General. The Company owns four subsidiary banks: QCBT, CRBT and CSB are chartered under Iowa law (collectively, the “Iowa Banks”) and GB is chartered under Missouri law. The deposit accounts of the Banks are insured by the FDIC’s DIF to the maximum extent provided under federal law and FDIC regulations, currently $250,000 per insured depositor category. All four of the Company’s subsidiary banks are members of the Federal Reserve System (“member banks”). QCBT owns QCIA, a registered investment adviser, as a wholly-owned subsidiary.

As Iowa-chartered, FDIC-insured banks, the Iowa Banks are subject to the examination, supervision, reporting and enforcement requirements of the Iowa Division of Banking, as the chartering authority for Iowa banks. As a Missouri-chartered, FDIC-insured bank, GB is subject to the examination, supervision, reporting and enforcement requirements of the Missouri Division of Finance, as the chartering authority for Missouri banks. All four of the Company’s subsidiary banks also are subject to the examination, reporting and enforcement requirements of the Federal Reserve, as the primary federal regulator of member banks. In addition, the FDIC, as administrator of the DIF, has regulatory authority over the Banks.

Deposit Insurance**.**As FDIC-insured institutions, the Banks are required to pay deposit insurance premium assessments to the FDIC. The FDIC has adopted a risk-based assessment system whereby FDIC-insured institutions pay insurance premiums at rates based on their risk classification. For institutions like the Banks that are not considered large and highly complex banking organizations, the risk classification is based on examination ratings and financial ratios. A bank’s assessment is then calculated by multiplying its assessment rate by its assessment base (average consolidated total assets minus its average tangible equity). The total base assessment rates currently range from 1.5 basis points to 30 basis points. However, the maximum rate is 18 basis points for financial institutions in the top two categories of examination composite ratings.

At least semi-annually, the FDIC updates its loss and income projections for the DIF and, if needed, increases or decreases the assessment rates, following notice and comment on proposed rulemaking. For this purpose, the reserve ratio is the DIF balance divided by estimated insured deposits. In response to the global financial crisis, the Dodd-Frank Act increased the minimum reserve ratio from 1.15% to 1.35% of the estimated amount of total insured deposits. In the semiannual update in June 2022, the FDIC projected that the reserve ratio was at risk of not reaching the statutory minimum of 1.35% by September 30, 2028, the statutory deadline. Based on this update, the FDIC approved an increase in initial base deposit insurance assessment rate schedules uniformly by 2 basis points, applicable to all insured depository institutions. The increase was effective on January, 1, 2023, applicable to the first quarterly assessment period of 2023 (January 1 through March 31, 2023).

In addition, because the total cost of the failures of Silicon Valley Bank and Signature Bank was approximately $16.3 billion, the FDIC adopted a special assessment for banks having deposits above $5 billion, at an annual rate of 13.4 basis points beginning with the first quarterly assessment period of 2024 (January 1 through March 31, 2024) with an invoice payment date of June 28, 2024, and will continue to collect special assessments for an anticipated total of eight quarterly assessment periods. The base for the special assessment is equal to an insured depository institution’s estimated uninsured deposits for the December 31, 2022 reporting period, adjusted to exclude the first $5 billion in estimated uninsured deposits.

Supervisory Assessments**.**Each of the Banks is required to pay supervisory assessments to its respective state banking regulator to fund the operations of that agency. The amount of the assessment payable by each Bank is calculated on the basis of that Bank’s total assets. During the year ended December 31, 2023,

the Iowa Banks paid supervisory assessments to the Iowa Division of Banking totaling $365 thousand and GB paid supervisory assessments to the Missouri Division of Finance totaling $103 thousand.

Capital Requirements. Banks are generally required to maintain capital levels in excess of other businesses. For a discussion of capital requirements, see “—The Role of Capital” above.

Liquidity Requirements. Liquidity is a measure of the ability and ease with which bank assets may be converted to meet financial obligations to pay deposits or other funding sources. Banks are required to implement liquidity risk management frameworks that ensure they maintain sufficient liquidity, including a cushion of unencumbered, high quality liquid assets, to withstand a range of stress events. The level and speed of deposit outflows contributing to the failures of Silicon Valley Bank, Signature Bank and First Republic Bank in the first half of 2023 was unprecedented and contributed to acute liquidity and funding strain. These events have further underscored the importance of liquidity risk management and contingency funding planning by insured depository institutions like the Banks.

The primary role of liquidity risk management is to: (i) prospectively assess the need for funds to meet obligations; and (ii) ensure the availability of cash or collateral to fulfill those needs at the appropriate time by coordinating the various sources of funds available to the institution under normal and stressed conditions. Basel III includes a liquidity framework that requires the largest insured institutions to measure their liquidity against specific liquidity tests. One test, referred to as the liquidity coverage ratio or LCR, is designed to ensure that the banking entity has an adequate stock of unencumbered high-quality liquid assets that can be converted easily and immediately in private markets into cash to meet liquidity needs for a 30-calendar day liquidity stress scenario. The other test, known as the net stable funding ratio or NSFR, is designed to promote more medium- and long-term funding of the assets and activities of FDIC-insured institutions over a one-year horizon. These tests provide an incentive for banks and holding companies to increase their holdings in Treasury securities and other sovereign debt as a component of assets, increase the use of long-term debt as a funding source and rely on stable funding like core deposits (in lieu of brokered deposits). Although these tests do not, and will not, apply to the Banks, their management teams continue to review their liquidity risk management framework in light of regulatory requirements and industry developments.

Liability of Commonly Controlled Institutions. Under federal law, institutions insured by the FDIC may be liable for any loss incurred by, or reasonably expected to be incurred by, the FDIC in connection with the default of commonly controlled FDIC-insured depository institutions or any assistance provided by the FDIC to commonly controlled FDIC-insured depository institutions in danger of default. Because the Company controls each of the Banks, the Banks are commonly-controlled for purposes of these provisions of federal law.

Dividend Payments. The primary source of funds for the Company is dividends from the Banks. In general, the Banks may only pay dividends either out of their historical net income after any required transfers to surplus or reserves have been made, or out of their retained earnings. The Federal Reserve Act also imposes limitations on the amount of dividends paid by state member banks, such as the Banks. Without Federal Reserve approval, a state member bank may not pay dividends in any calendar year that, in the aggregate, exceed that bank’s calendar year-to-date net income plus the bank’s retained income for the two preceding calendar years.

The payment of dividends by any FDIC-insured institution is affected by the requirement to maintain adequate capital pursuant to applicable capital adequacy guidelines and regulations, and an FDIC-insured institution generally is prohibited from paying any dividends if, following payment thereof, the institution would be undercapitalized. As described above, each of the Banks exceeded its minimum capital requirements under applicable guidelines as of December 31, 2023. Notwithstanding the availability of funds for dividends, however, the Federal Reserve, the FDIC, the Missouri Division of Finance or the Iowa Division of Banking, as applicable, may prohibit the payment of dividends by one of the Banks if it determines such payment would constitute an unsafe or unsound practice. In addition, under the Basel III Rule, institutions that want to pay

unrestricted dividends must maintain 2.5% in Common Equity Tier 1 Capital attributable to the capital conservation buffer. See “—The Role of Capital” above.

State Bank Investments and Activities. The Banks are permitted to make investments and engage in activities directly or through subsidiaries as authorized by Iowa or Missouri law, as applicable. However, under federal law and FDIC regulations, FDIC-insured state banks are prohibited, subject to certain exceptions, from making or retaining equity investments of a type, or in an amount, that are not permissible for a national bank. Federal law and FDIC regulations also prohibit FDIC-insured state banks and their subsidiaries, subject to certain exceptions, from engaging as principal in any activity that is not permitted for a national bank unless the bank meets, and continues to meet, its minimum regulatory capital requirements and the FDIC determines that the activity would not pose a significant risk to the DIF. These restrictions have not had, and are not currently expected to have, a material impact on the operations of the Banks.

Insider Transactions. The Banks are subject to certain restrictions imposed by federal law on “covered transactions” between each Bank and its “affiliates.” The Company is an affiliate of the Banks for purposes of these restrictions, and covered transactions subject to the restrictions include extensions of credit to the Company, investments in the stock or other securities of the Company and the acceptance of the stock or other securities of the Company as collateral for loans made by any of the Banks. The Dodd-Frank Act enhanced the requirements for certain transactions with affiliates, including an expansion of the definition of “covered transactions” and an increase in the amount of time for which collateral requirements regarding covered transactions must be maintained.

Certain limitations and reporting requirements are also placed on extensions of credit by each Bank to its directors and officers, to directors and officers of the Company and its subsidiaries, to principal stockholders of the Company and to “related interests” of such directors, officers and principal stockholders. In addition, federal law and regulations may affect the terms on which any person who is a director or officer of the Company or the Banks, or a principal stockholder of the Company, may obtain credit from banks with which any of the Banks maintains a correspondent relationship.

Safety and Soundness Standards/Risk Management. The federal banking agencies have adopted operational and managerial standards to promote the safety and soundness of FDIC-insured institutions. The standards apply to internal controls, information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, compensation, fees and benefits, asset quality and earnings.

In general, the safety and soundness standards prescribe the goals to be achieved in each area, and each institution is responsible for establishing its own procedures to achieve those goals. Although regulatory standards do not have the force of law, if an institution operates in an unsafe and unsound manner, the FDIC-insured institution’s primary federal regulator may require the institution to submit a plan for achieving and maintaining compliance. If an FDIC-insured institution fails to submit an acceptable compliance plan, or fails in any material respect to implement a compliance plan that has been accepted by its primary federal regulator, the regulator is required to issue an order directing the institution to cure the deficiency. Until the deficiency cited in the regulator’s order is cured, the regulator may restrict the FDIC-insured institution’s rate of growth, require the FDIC-insured institution to increase its capital, restrict the rates that the institution pays on deposits, or require the institution to take any action that the regulator deems appropriate under the circumstances. Noncompliance with safety and soundness also may constitute grounds for other enforcement action by the federal bank regulatory agencies, including cease and desist orders and civil money penalty assessments.

During the past decade, the bank regulatory agencies have increasingly emphasized the importance of sound risk management processes and strong internal controls when evaluating the activities of the FDIC-insured institutions that they supervise. Properly managing risks has been identified as critical to the conduct of safe and sound banking activities and has become even more important as new technologies, product

innovation, and the size and speed of financial transactions have changed the nature of banking markets. The agencies have identified a spectrum of risks facing a banking institution including, but not limited to, credit, market, liquidity, operational, legal and reputational risk. Each Bank is expected to have active board and senior management oversight; adequate policies, procedures and limits; adequate risk measurement, monitoring and management information systems; and comprehensive internal controls.

Privacy and Cybersecurity. The Banks are subject to many U.S. federal and state laws and regulations governing requirements for maintaining policies and procedures to protect non-public confidential information of their customers. These laws require each Bank to periodically disclose its privacy policies and practices relating to sharing such information, and permit consumers to opt out of their ability to share information with unaffiliated third parties under certain circumstances. They also impact each Bank’s ability to share certain information with affiliates and non-affiliates for marketing and/or non-marketing purposes, or to contact customers with marketing offers. In addition, each Bank is required to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all businesses and geographic locations.

Branching Authority**.**The Iowa Banks have the authority under Iowa law to establish branches anywhere in the State of Iowa, subject to receipt of all required regulatory approvals. Similarly, GB has the authority under Missouri law to establish branches anywhere in the State of Missouri, subject to receipt of all required regulatory approvals. The Dodd-Frank Act permits well-capitalized and well-managed banks to establish new interstate branches or acquire individual branches of a bank in another state (rather than the acquisition of an out-of-state bank in its entirety) without impediments. In addition, federal law permits state and national banks to merge with banks in other states subject to: (i) regulatory approval; (ii) federal and state deposit concentration limits; and (iii) state law limitations requiring the merging bank to have been in existence for a minimum period of time (not to exceed five years) prior to the merger.

Federal Home Loan Bank System. The Banks are each a member of a FHLB, which serves as a central credit facility for its members. The FHLB is funded primarily from proceeds from the sale of obligations of the FHLB system. It makes loans to member banks in the form of FHLB advances. All advances from the FHLB are required to be fully collateralized as determined by the FHLB.

Community Reinvestment Act Requirements. The CRA requires the Banks to have a continuing and affirmative obligation in a safe and sound manner to help meet the credit needs of the entire community, including low- and moderate-income neighborhoods. Federal regulators regularly assess each Bank’s record of meeting the credit needs of its communities in dedicated examinations. Applications for acquisitions are affected by the evaluation of each Bank’s effectiveness in meeting its CRA requirements.

On October 24, 2023, the bank regulatory agencies issued a final rule to strengthen and modernize the CRA regulations (the “CRA Rule”), some of which is effective on April 1, 2024. The CRA Rule is designed to update how CRA activities qualify for consideration, where CRA activities are considered, and how CRA activities are evaluated. More specifically, the bank regulatory agencies described the goals of the CRA Rule as follows: (i) to expand access to credit, investment, and basic banking services in low- and moderate-income communities; (ii) to adapt to changes in the banking industry, including mobile and internet banking by modernizing assessment areas while maintaining a focus on branch based areas; (iii) to provide greater clarity, consistency, and transparency in the application of the regulations through the use of standardized metrics as part of CRA evaluation and clarifying eligible CRA activities focused on low- and moderate-income communities and underserved rural communities; (iv) to tailor CRA rules and data collection to bank size and business model; and (v) to maintain a unified approach among the regulators. Management of the Banks are

assessing the impact of the CRA Rule on their CRA lending and investment activities in their respective markets.

Anti-Money Laundering/Countering the Financing of Terrorism. The** **Bank Secrecy Act (“BSA”) is the common name for a series of laws and regulations enacted in the United States to combat money laundering and the financing of terrorism. They are designed to deny terrorists and criminals the ability to obtain access to the U.S. financial system and have significant implications for FDIC-insured institutions and other businesses involved in the transfer of money. The so-called Anti-Money Laundering / Countering the Financing of Terrorism (“AML/CFT”) regime under the BSA provides a foundation to promote financial transparency and deter and detect those who seek to misuse the U.S. financial system to launder criminal proceeds, finance terrorist acts, or move funds for other illicit purposes. The laws mandate financial services companies to have policies and procedures with respect to measures designed to address: (i) customer identification programs; (ii) money laundering; (iii) terrorist financing; (iv) identifying and reporting suspicious activities and currency transactions; (v) currency crimes; and (vi) cooperation between FDIC-insured institutions and law enforcement authorities.

Concentrations in Commercial Real Estate. Concentration risk exists when FDIC-insured institutions deploy too many assets to any one industry or segment. A concentration in CRE is one example of regulatory concern. The interagency Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices guidance (“CRE Guidance”) provides supervisory criteria, including the following numerical indicators, to assist bank examiners in identifying banks with potentially significant commercial real estate loan concentrations that may warrant greater supervisory scrutiny: (i) CRE loans exceeding 300% of capital and increasing 50% or more in the preceding three years; or (ii) construction and land development loans exceeding 100% of capital. The CRE Guidance does not limit banks’ levels of CRE lending activities, but rather guides institutions in developing risk management practices and levels of capital that are commensurate with the level and nature of their CRE concentrations. On December 18, 2015, the federal banking agencies issued a statement to reinforce prudent risk-management practices related to CRE lending, having observed substantial growth in many CRE asset and lending markets, increased competitive pressures, rising CRE concentrations in banks, and an easing of CRE underwriting standards. The federal bank agencies reminded FDIC-insured institutions to maintain underwriting discipline and exercise prudent risk-management practices to identify, measure, monitor, and manage the risks arising from CRE lending. In addition, FDIC-insured institutions must maintain capital commensurate with the level and nature of their CRE concentration risk. As of December 31, 2023, QCBT, CRBT ,CSB and GB were in compliance with the 300% guideline for CRE loans.

Consumer Financial Services. The historical structure of federal consumer protection regulation applicable to all providers of consumer financial products and services changed significantly on July 21, 2011, when the CFPB commenced operations to supervise and enforce consumer protection laws. The CFPB has broad rulemaking authority for a wide range of consumer protection laws that apply to all providers of consumer products and services, including the Banks, as well as the authority to prohibit “unfair, deceptive or abusive” acts and practices. The CFPB has examination and enforcement authority over providers with more than $10 billion in assets. FDIC-insured institutions with $10 billion or less in assets, like the Banks, continue to be examined by their applicable bank regulators.

Because abuses in connection with residential mortgages were a significant factor contributing to the global financial crisis, many rules issued by the CFPB, as required by the Dodd-Frank Act, addressed mortgage and mortgage-related products, their underwriting, origination, servicing and sales. The Dodd-Frank Act significantly expanded underwriting requirements applicable to loans secured by 1-4 family residential real property and augmented federal law combating predatory lending practices. In addition to numerous disclosure requirements, the Dodd-Frank Act and the CFPB’s enabling rules imposed new standards for mortgage loan originations on all lenders, including banks and savings associations, in an effort to strongly encourage lenders

to verify a borrower’s ability to repay, while also establishing a presumption of compliance for certain “qualified mortgages.”

Over the last several years, the CFPB has taken a proactive, multi-front approach to protect consumers from excessive overdraft and non-sufficient funds (“NSF”) fees. This includes proposed rules, interpretive opinions and enforcement actions. In January 2024, this included a proposed rule that would prohibit NSF fees on transactions declined in real time (debit card purchases, ATM withdrawals and peer-to-peer payments) and a proposal to close a loophole in the law that exempts overdrafts on bank accounts from disclosure rules applicable to other kinds of credit. Although any action proposed or taken thus far by the CFPB has affected only financial institutions with more than $10 billion in assets, Bank management expects continued developments in this area that may impact its overdraft practices.

The CFPB’s rules have not had a significant impact on any Bank operations, except for higher compliance costs.

Regulation of QCIA

QCIA provides financial investment services as part of the wealth management operations of the Company. QCIA is an investment adviser registered with the SEC. The SEC has supervisory, examination and enforcement authority over its operations. The SEC’s focus is primarily for the protection of investors under the federal securities laws.** **