BayFirst Financial Corp

BayFirst Financial Corp. is a bank holding company that operates through its wholly owned subsidiary, BayFirst National Bank (the “Bank”), together referred to as “the Company or “BayFirst”. BayFirst commenced its bank holding company operations on September 1, 2000, by acquiring all shares of the Bank. BayFirst’s primary source of income is from the Bank, which serves a broad spectrum of consumers and small businesses in the Tampa Bay region and is supported by a national government guaranteed lending business line. BayFirst utilizes this national business line to provide financial support for the delivery and expansion of traditional banking services, and to serve as a specialized lead product to introduce the Bank to new customers in the Tampa Bay region. BayFirst strives to be a progressive institution in its products and services, technology, design, and social responsibility. As of December 31, 2023, BayFirst had consolidated total assets of $1.12 billion, total loans held for investment of $915.7 million, total deposits of $985.1 million, and total shareholders’ equity of $100.7 million. BayFirst’s corporate office is located at the BayFirst Executive Center, 700 Central Avenue, St. Petersburg, Florida 33701.

BayFirst National Bank

The Bank commenced operations on February 12, 1999, as a Florida state-chartered commercial bank. In 2022, the Bank converted its charter to a national banking association. The Bank currently operates out of its main office and eleven additional banking centers located in the Tampa Bay/Sarasota area. The Bank’s main office is located at the BayFirst Executive Center. The Bank does not engage in any foreign business activities.

The Bank offers its products and services through its Community Banking Division and its separately branded loan origination platform, CreditBench. CreditBench is a government guaranteed lender with specific expertise in originating SBA 7(a) loans and USDA loans throughout the nation. During the second quarter of 2022, the Bank began the Bolt loan program, an SBA 7(a) loan product designed to expeditiously provide working capital loans of $150 thousand or less to businesses. The Bank has originated 3,408 Bolt loans totaling $441.8 million through December 31, 2023.

CreditBench also has an advanced technology platform for our SBA 7(a) Small Loan Program that enables the Bank to utilize and support technology-enabled banking products and services as well as various financial technology applications.

Community Banking

The Bank has structured its community banking services and charges for such services in a manner designed to attract consumers, small and medium sized businesses, and professionals located primarily in Pinellas, Hillsborough, Sarasota, Manatee, and Pasco Counties. The Bank focuses on customers that are seeking the flexibility and personalized relationships that a community bank can provide. The Bank offers specialized business and personal checking accounts, internet banking and online bill payment, remote capture and deposit, cash management, wire transfers, safety deposit boxes, courier services, retail investment services, and ACH originations, among other services. Retail investment services are facilitated through an independent broker-dealer through a relationship with a shared service organization.

The Bank also offers customary community bank deposit products, including interest-bearing and noninterest-bearing checking accounts, MMDAs, savings accounts, certificates of deposit and IRAs. The consumer product offering also includes unique programs, including, among others: 1) the Essential checking that assists customers in rebuilding their access to the banking system, 2) the TrendSetters Club which offers special benefits for those customers age 50+ years, and 3) the Cash Kids’ Club savings account that offers those age 12 and under special rates while teaching children basic financial skills through interactive and mobile application tools. The Bank’s business deposit products and related services include free checking accounts, interest-bearing checking accounts, savings accounts, MMDA, and access to business mobile and online banking, treasury management, cash management, merchant processing services, remote deposit capture, and night depository.

A wide range of loans are also offered, including commercial, consumer, and real estate loans. The commercial lending efforts are directed principally toward businesses and professionals who otherwise do business with us, and include commercial real estate mortgages, construction and development loans, working capital loans, and business expansion loans. In addition, the Bank has a minority lending program for women or minority business owners looking to take their business to the next level. BayFirst focuses itsgovernment guaranteed and commercial lending divisions on providing the customer quick turnaround, competitive rates, and an easy application process. The Bank offers personal lines of credit, auto, boat, and recreational vehicle loans, residential mortgages, and home equity lines of credit. The Bank has been particularly successful in penetrating the small business community. The Bank participates in interbank credit arrangements to permit the Bank to take part in corporate or other business entity loans for amounts which are greater than its lending limits.

As of December 31, 2023, the Community Banking Division operated from eleven banking centers in the Tampa Bay area: five in Pinellas County, two in Hillsborough County, one in Manatee County, and three in Sarasota County. Additionally, in February 2024, the Bank opened the twelfth banking center which is located in Sarasota.

CreditBench

The Bank, through its separately branded loan origination platform CreditBench, originates government guaranteed loans on a nationwide basis, with a particular emphasis on SBA 7(a) loans. Government guaranteed loans are designed to assist small businesses in obtaining financing. CreditBench’s loan origination efforts are targeted to a broad range of industries and geographies, with a focus on building relationships with borrowers. This diversification is intended to mitigate the Bank’s credit risk. Deposit products are also marketed to borrowers, particularly those borrowers in the Bank's primary market area.

CreditBench originates loans through two distinct channels. One is its team of government guaranteed lenders, known as the Core Government Guaranteed Loan Team. The other is for smaller loans that are processed through financial technology platforms, collectively known and branded as FlashCap. CreditBench’s Core Government Guaranteed Loan Team makes government guaranteed loans throughout the U.S., with a particular emphasis on business acquisition financing. Currently, the Core Government Guaranteed Loan Team is concentrated in the Tampa Bay area with an expanding national sales team. FlashCap employs an internal sales team and uses referral partners and financial technology companies to originate government guaranteed loans nationwide. Underwriting, quality control, and technology are centralized and scalable for potential increases in loan volume. During the second quarter of 2022, the Company launched Bolt, an SBA 7(a) loan product designed to expeditiously provide working capital loans of $150 thousand or less to businesses throughout the country. CreditBench also originates USDA B&I loans for businesses located in qualifying areas.

The federal government guarantees 75% to 90% of SBA loan balances and up to 80% of USDA B&I loan balances as an incentive for financial institutions to make loans to small businesses. Eligible uses of SBA and USDA B&I loans are for working capital, equipment financing, debt refinancing, purchase of inventory, new construction, building acquisitions, business acquisitions, and startup expenses. The program maximum limit for SBA loans is $5.0 million, and the program maximum limit for USDA loans is $25.0 million. Both can be priced competitively relative to conventional financing.

The Bank manages its government guaranteed lending program through a staff experienced in business development, loan documentation and monitoring, and accounting. Emphasis is placed on proper loan documentation to ensure full guarantee performance in the event of payment defaults.

The revenue generated from CreditBench’s loan originations is primarily derived from three sources: interest income, loan servicing, and premiums from the sale of loans. The Bank may elect to hold the government guaranteed portion of a loan on its balance sheet to increase interest income. Alternatively, the Bank may sell that portion to realize a premium on the sale.

In addition, the Bank may also sell a portion of the unguaranteed balance of certain government guaranteed loans, depending on a loan’s terms, the offer price, its liquidity and capital positions, and the perceived credit risk.

Residential Mortgage Division

In the third quarter of 2022, management decided to discontinue its nationwide residential lending business. Prior to those decisions, the Residential Mortgage Division operated from the banking centers in the Tampa Bay area andloan production offices nationwide. As a result of the discontinuance, the nationwide residential line of business was reclassified as a discontinued operation and reported in the financial statements as such. The Bank continues tooffer fixed and variable rate home mortgages for the purchase and refinance of residential properties through the community banking centers.

The Bank sells most of the residential mortgage loans which are originated into the secondary market through a broker arrangement. The Bank also originates loans to be held in its loan portfolio. The portfolio loans are generally high quality, adjustable rate, non-conforming mortgages located in the primary service area where there is a greater opportunity to cross- sell other Bank products and services. The ability to fund such non-conforming loans provides the Bank a competitive advantage compared to non-bank mortgage lenders.

The Bank’s residential mortgages are originated, processed, underwritten, and closed to secondary market standards or Bank policy. In connection with the origination of mortgage loans intended for sale, the Bank uses a broker to underwrite, close, and sell the loans. For loans held in its loan portfolio, the Bank underwrites and closes these loans in-house utilizing the brokers’ technology system. There are no free-standing derivatives associated with the current lending process.

The Bank engages a subservicer for residential mortgage loans that is currently servicing most portfolio residential mortgage loans.

Competition

All phases of the Bank’s operations are highly competitive. Many commercial banks and other competitors have assets, capital, lending limits, and name recognition that are materially larger than the Bank’s. The Bank competes with other financial service providers for loans and deposits. These competitors include:

•national, super-regional, and regional financial institutions that have well-established branches and significant market share in the communities the Bank serves;

•non-bank government guaranteed lenders;

•finance companies, investment banking and brokerage firms, and insurance companies that offer bank-like products;

•credit unions, which can offer highly competitive rates on loans and deposits because they receive tax advantages not available to commercial banks;

•other community banks that compete with the Bank for clients desiring a high level of service; and

•technology-based financial institutions, including large national, super-regional, and regional banks offering online deposit, bill payment and mortgage loan application services.

Some of the non-traditional financial institution competitors are not subject to the same degree of regulatory oversight to which the Bank is subject.

Among the advantages that the larger competitors have over the Bank are their ability to finance wide-ranging marketing campaigns and to allocate their investment assets to products with the highest yields and demands. Several of the competitors offer certain services, such as trust departments, that the Bank does not offer. By virtue of their greater total capital, these financial service providers have substantially higher loan-to-one borrower limits than the Bank (loans-to-one borrower limits apply to an individual customer’s total extension of credit as a percentage of a bank’s total capital). These competitors may intensify their advertising and other marketing activities to counter any efforts by the Bank to attract new business.

To compete with the financial institutions in its primary service area, the Bank capitalizes upon the flexibility that its independent status allows, including making decisions locally. This includes solicitation of business, professional, and personal accounts through the personal efforts of the Bank’s directors and officers. The Bank believes that a locally-based bank is often perceived by the local business community as possessing a clearer understanding of local commerce and the needs of the community. Consequently, its customers expect that the Bank will be able to make prudent lending decisions quicker and with a better understanding of the market than larger competitors. The Bank focuses on the smaller commercial customer because this segment offers the greatest concentration of potential business and historically has tended to demonstrate a higher degree of loyalty in their banking relationships. The Bank can respond quickly to changes in the interest rates paid on time and savings deposits and charged on loans, and to charges imposed on depository accounts, so as to remain competitive in the marketplace. If there are customers whose loan demands exceed the Bank’s loan limits, the Bank can arrange for such loans on a participation basis with other financial institutions.

Various legislative actions in recent years have led to increased competition among financial institutions. With the enactment of various laws and regulations affecting interstate banking expansion, it is easier for financial institutions located outside of Florida to enter the Florida market, including the Bank’s target markets. In addition, recent legislative and regulatory changes and technological advances have enabled customers to conduct banking activities without regard to geographic barriers, through internet and telephone-based banking and similar services. There can be no assurance that the

United States Congress, the Florida Legislature, or the applicable bank regulatory agencies will not enact legislation or promulgate regulations that may further increase competitive pressures on the Bank.

Lending Philosophy and Credit Risk Management

Historically, the Company believes they have made sound, high-quality loans while recognizing that lending involves a degree of risk. The Bank’s centralized credit approval process and loan policies are designed to assist management in managing this risk. The policies provide a general framework for loan origination, monitoring, and funding. The Bank’s loan approval process is characterized by centralized authority supported by a risk control environment that provides for prompt and thorough underwriting of loans. The loan approval process begins with obtaining detailed financial and other information from the Bank’s borrowers. The Bank also relies on its loan and executive officers’ in-depth knowledge of its markets and borrowers.

Regardless of the loan type or amount, no single individual has sole loan approval authority. The objective of the loan approval process is to provide a disciplined, consistent, predictable, and collaborative approach to larger credits, while maintaining responsiveness to client needs. Commercial loan decisions are documented as to the borrower’s business, loan purpose, the evaluation of the repayment source and associated risks, the evaluation of collateral, loan covenants, loan monitoring requirements, and the risk rating rationale. The Bank’s strategy for approving loans is to follow conservative loan policies and consistent underwriting practices which include:

•Granting credit on a sound basis with full knowledge of the purpose and source of repayment for such credit;

• Ensuring that primary and secondary sources of repayment are adequate in relation to the amount of the loan;

• Requiring documentation, including appraisals or valuations, sufficient to enable informed underwriting;

• Developing and adhering to desired levels of diversification for the loan portfolio as a whole and for loans within each category; and

• Ensuring that each loan is properly documented and that any insurance coverage requirements are satisfied.

The loan policies generally include other underwriting guidelines for loans collateralized by real estate. These underwriting standards are designed to determine the maximum loan amount that a borrower has the capacity to repay based, in part, upon the borrower’s cash flow and income. The loan policies include maximum amortization schedules and loan terms for each category of loans. In addition, the loan policies provide guidelines for personal guarantees, appraisals and valuations, loan-to-value ratios, environmental review, loans to employees, executive officers and directors, problem loan identification, maintenance of an adequate credit loss reserve, and other matters relating to lending practices.

The community banking centers originate residential mortgage, consumer and commercial loans. The Bank utilizes a broker arrangement to originate residential mortgage loans to be sold in the secondary market. These residential mortgage loans are underwritten to meet secondary market standards so that loans can be sold into the secondary market. Some residential mortgage loans are held for the Bank’s portfolio. Portfolio loans are primarily underwritten by the Bank on the borrowers’ financial strength and cash flow, with conservative loan-to-value requirements. Consumer loans include loans to individuals for automobiles, boats, and other major personal, family, or household purposes. They are underwritten on the credit quality of the individual borrower and may be secured or unsecured. Commercial lending products include a wide variety of credit facilities, such as owner occupied and non-owner occupied commercial real estate, multifamily real estate, construction, land acquisition, and commercial and industrial loans. In general, the Bank’s commercial lending strategy focuses on the financial strength and successful track record of commercial loan applicants more than the project or type of property that would serve as collateral for a loan. These loans are underwritten by an independent in-house Credit Underwriting Department in accordance with its credit policy.

CreditBench primarily originates loans through the SBA 7(a) program, and, to a lesser extent, through the USDA’s B&I program. Occasionally, CreditBench originates loans through the SBA’s 504 loan program, the International Trade Loan program, and the SBA Express Loan program. CreditBench originates two distinct types of loans: complex loans and non-complex loans. The non-complex loans are originated pursuant to the SBA 7(a) Small Loan Program up to $350,000 and are underwritten through a streamlined underwriting and packaging process. Although the SBA 7(a) Small Loan Program permits broader underwriting and loan purpose parameters, non-complex CreditBench loans are limited to those underwritten via historical cash flow and exclude start-up and business acquisition financing. Within the FlashCap program, we offer Bolt loans up to $150,000 for working capital purposes. Bolt loans are guaranteed up to 85% by the SBA and are primarily underwritten based upon predictive scores and character analysis of the business and its principals.

All CreditBench loans regardless of size which require projection-based underwriting or have other complex characteristics, such as business acquisition financing, are underwritten subject to SBA or USDA B&I guidelines and contain a thorough underwriting analysis based on the credit quality of any guarantor as well as the historical and projected debt service coverage.

Risk Management

The Company believes that effective risk management and control processes are critical to safety and soundness of the Bank, the ability to predict and manage the challenges that they face, and, ultimately, the long-term corporate success. Risk management refers to the activities by which the Company identifies, measures, monitors, evaluates, and manages the risks they face in the course of banking activities. These risks include liquidity, interest rate, credit, operational, compliance, regulatory, strategic, financial, and reputational risk exposures. The Board of Directors, both directly and through their committees, are responsible for overseeing the risk management processes, including quarterly enterprise risk management assessments and annual assessments in the following areas: (i) cyber; (ii) BSA/anti-money laundering; and (iii) third-party risk, with each of the committees of the Board of Directors assuming a different and important role in overseeing the management of the risks.

The Audit and Risk Management Committees of the Board of Directors are responsible for overseeing risks associated with financial matters (particularly financial reporting, accounting practices and policies, disclosure controls and procedures, and internal control over financial reporting) as well as other enterprise risks. The Compensation Committee of the Board of Directors has primary responsibility for risks and exposures associated with the compensation policies, plans, and practices regarding both executive compensation, Board compensation, and the compensation structure generally. The Compensation Committee, in conjunction with the Chief Executive Officer and other members of the management team, as appropriate, reviews the incentive compensation arrangements to ensure these programs are consistent with applicable laws and regulations, including safety and soundness requirements, and do not encourage imprudent or excessive risk-taking by the employees. The Nominating Committee of the Board of Directors oversees risks associated with the independence of the Board of Directors and potential conflicts of interest.

The senior management team is responsible for implementing the risk management processes by assessing and managing the risks we face, including strategic, operational, regulatory, investment, and execution risks, on a day-to-day basis, and reporting to the Board of Directors regarding the risk management processes. The senior management team is also responsible for creating and recommending to the Board of Directors for approval of appropriate risk appetite metrics reflecting the aggregate levels and types of risk they are willing to accept in connection with the operation of the business and pursuit of the business objectives.

The role of the Board of Directors in the Company’s risk oversight is consistent with the leadership structure, with the Chief Executive Officer and the other members of senior management having responsibility for assessing and managing the risk exposure, and the Board of Directors and their committees providing oversight in connection with those efforts. The Company believes this division of risk management responsibilities presents a consistent, systemic, and effective approach for identifying, managing, and mitigating risks throughout the Company’s operations.

Information Technology Systems

The Company has made, and continues to make, significant investments in its information technology systems and staff to support banking activities. The Company believes this investment will support continued growth and enable them to enhance the capabilities to offer new products, improve overall customer experience, improve profitability through efficiencies, maintain and improve cybersecurity, and provide scalability for future growth. The Company utilizes nationally recognized software vendors and their cloud/hosted models, which allow them to outsource the processing of data. The Company’s internal network and e-mail systems are administered by a managed service provider specializing in financial institutions, and they maintain production infrastructure in a data center facility near Tampa, Florida. This site provides for power and connectivity redundancy, and they maintain a disaster recovery program, including a cloud-based recovery environment.

The majority of the other systems, including electronic funds transfer, transaction processing, and online banking services are hosted by third-party service providers. The scalability of this infrastructure will support the Bank’s growth strategy. In addition, the tested capability of these vendors to automatically switch over to standby systems should allow the Bank to recover the systems and provide business continuity quickly in case of a disaster.

Privacy, Data Protection and Cybersecurity

The regulatory framework for data privacy and cybersecurity is rapidly evolving. Current federal law requires financial institutions to periodically disclose their privacy policies and practices related to sharing client information. Such laws allow consumer clients to opt out of having their information shared with unaffiliated third parties under certain circumstances. Other federal and state laws and regulations impact the ability to share certain information with affiliates and non-affiliates for marketing and/or non-marketing purposes, or to contact clients with marketing offers. Current federal law also requires financial institutions to implement a comprehensive information security program. Such programs must include administrative, procedural, and physical safeguards to ensure the security and confidentiality of client records and personal information. These security and privacy policies and procedures are in effect across the Bank.

Federal banking agencies pay close attention to the cybersecurity practices of banks. Such agencies review an institution’s information technology program and its ability to prevent cyberattacks. The FFIEC released its Architecture, Infrastructure, and Operations (AIO) Booklet in June 2021. The AIO Booklet calls for a layered security approach that incorporates administrative, procedural, and physical controls to include employee, vendor, and client awareness training. The Bank’s cybersecurity and information security practices incorporate preventative, detective, corrective, compensatory, and deterrent controls. Failing to have adequate cybersecurity safeguards in place, in accordance with AIO and other applicable regulations and laws, can result in supervisory criticism, monetary penalties and reputational harm.

In November 2021, the Federal Reserve, OCC, and FDIC adopted a new regulation for computer-security incident notification requirements for banking organizations and their bank service providers. Among other things, this regulation requires a bank to notify its primary federal regulator within 36 hours after identifying a "computer-security incident" that the bank believes in good faith could: (i) materially disrupt or degrade its business or operations in a manner that would threaten the viability of its operations and result in clients being unable to access their deposit and other accounts; (ii) result in a material loss of revenue, earnings or franchise value; or (iii) pose a threat to the financial stability of the United States.

Data privacy and data protection are also areas of increasing regulatory and legislative focus. The Bank is subject to rules and regulations issued by the Federal Trade Commission, which regulates unfair or deceptive acts or practices, including those related to data privacy and cybersecurity. Like other lenders, the Bank uses credit bureaus in its underwriting activities. Use of such data is regulated under the Fair Credit Reporting Act, which also regulates identity theft prevention programs, reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information between affiliates, and using affiliate data for marketing purposes. Federal law further requires financial institutions to explain their information-sharing practices to their clients and to protect sensitive client information.

Human Capital

Since opening in 1999, BayFirst has grown significantly without losing sight of its commitment to making an impact in the communities served and being Here for What’s Next® in the lives of the Company’s customers, communities, employees, and investors. As of December 31, 2023, BayFirst had 306 employees (304 full-time and 2 part-time) and recognizes that they are its greatest asset. Providing a work environment that is inclusive, transparent, and comfortable for all is foundational to the Bank’s core beliefs. The Company is an organization that values open communication and collaboration in a professional and challenging, yet informal atmosphere.

Total Rewards

The Bank’s competitive compensation and benefits package helps attract and retain top talent throughout the U.S. and demonstrates its belief that engaged and satisfied employees directly correlate to engaged and satisfied customers, generating long-term value for the Company’s stakeholders.

The Bank’s goal is to provide the most competitive compensation and benefit plans possible. In 2023, BayFirst established a living minimum wage of $20 per hour. The Bank has a generous 401(k) plan, plus a discretionary profit-sharing contributions to its Employee Stock Ownership Plan. Most employees are shareholders through their participation in the ESOP. Additionally, employees have the opportunity to grow their ownership through a discounted non-qualified Employee Stock Purchase Plan.

BayFirst offers a wide range of health and welfare plans designed to fit its diverse population. The Bank provides 100% employer-paid premiums for medical, dental, vision, disability, and life insurance for the employee. The Bank offers an employee wellness program designed to support the whole employee which encompasses physical, mental, social, and financial wellness.

BayFirst provides both paid maternity and paternity leave through the parental leave program. In addition, the Banks’ no-cost, short-term disability policy is administered in-house and provides up to 12 weeks of medical leave at 100% pay. The Bank recognizes the burdensome expense of dependent care and provides a company match to employees’ dependent care FSA accounts. The Bank provides paid volunteer time off to all employees building engagement and pride in the organization while encouraging teams to give back to their communities.

Training and Development

As part of the commitment to being a top employer in the industry and the premier community bank of Tampa Bay, BayFirst offers a growing internal Learning and Development Center where employees not only learn compliance and regulation, but also have the opportunity to strengthen core competencies for career growth and personal development.

The Bank offers both a tuition reimbursement and student loan assistance program to all eligible employees. The Bank offers these programs to nurture the professional development of the Bank’s colleagues and ease the financial burden associated with continuing education.

Social Governance: Diversity, Equity, and Inclusion

The Bank’s cultural foundation of being current and comfortable for all drives the Diversity, Equity, and Inclusion committee’s efforts throughout the entire organization. The diversity enhances its workforce, expands the markets and fosters a culture of belonging for its employees, customers and communities in which the Bank serves.

As of December 31, 2023, the Bank’s employee base was comprised of individuals from all walks of life, genders, ethnicities, races, ages and differing economic and social backgrounds. Females represented 59% of the Company’s employee base while minorities represented 32% of its population. The officer base was 50% female and 19% minority.

BayFirst has an active Diversity, Equity, and Inclusion council with a purpose ofensuring BayFirst reflects the values, respects the viewpoints, and acknowledges the differences of not only the community members it serves, but also the people it employs. Through its focus on these three core components, the council seeks to build an environment where everyone belongs, everyone is heard, everyone is aware of what’s next, and everyone is given the opportunity to succeed. The council actively advocates for the ongoing implementation and evaluation of internal and external programs, initiatives, and procedures to ensure the bank remains forward-thinking and aligned with the ever-evolving societal landscape. Through its focus on diversity, equity, and inclusion, the council works to fulfill its obligation to be the voice for all associated with BayFirst.

Employee Engagement

The Bank believes employee engagement is what sets the Bank apart from the competition. The Bank endeavors to recruit and retain some of the best and brightest talent across the U.S. When highly talented, skilled and driven individuals join the organization, they bring with them some of the best ideas, strategies, procedures and thoughts.

BayFirst understands that harnessing this level of engagement is critical to its success and has developed several channels to do so. The Bank’s Bright Ideas Submission Portal allows any employee to submit their ideas for improvement or change of policies, procedures, benefits or any other item they believe will improve the organization. To ensure employees understand the commitment of listening to feedback, each Bright Idea submission is reviewed by the CEO and executive team.

The CEO also hosts a quarterly CEO’s council where individuals from across the organization spend the day with the CEO and executive team, providing feedback and input on improvement opportunities. The Bank also completes periodic Officer’s Surveys where each officer is asked to provide feedback on specific areas of the organization and its strategy.

One of the greatest engagement and communication tools is the “What’s Next” call where ALL employees are invited to a weekly video conference where ideas are exchanged, updates are provided, and business and individual recognitions are communicated.

The Bank’s efforts were recognized through an anonymous employee survey which ranked BayFirst in the top 15 of the 2022 Best Places to Work in Tampa Bay.

Corporate Social Responsibility Policy

In 2021, BayFirst advanced its Corporate Social Responsibility initiatives by forming a Board of Directors’ level committee and developing a policy and policy statement. As a progressive institution, BayFirst is committed to the highest standards in all aspects of its operations. As both a Tampa Bay community bank and a nationwide lender, the Company believes it is their responsibility to take an important role in advancing the values they hold, including being an exemplary corporate citizen, providing fair and equitable access to the banking system, engaging with the communities, addressing climate change, providing full disclosure and transparency, providing a safe and secure banking experience, and offering the team the best possible workplace and opportunity for advancement. The main pillars of BayFirst’s Corporate Social Responsibility policy include 1) Fair and Equitable Access to Banking Services, 2) Environmental Sustainability, 3) Community Engagement, 4) Employee/Workforce Management and Well Being, and 5) Governance, Data Security, and Business Ethics.

Supervision and Regulation

General

As a bank holding company, the Company is subject to an extensive body of state and federal banking laws and regulations that impose specific requirements and restrictions on virtually all aspects of the Company’s operations. The Company is affected by government monetary policy and by regulatory measures affecting the banking industry in general.

The following is a summary of some of the statutes, rules, and regulations that affect the operations. This summary is qualified in its entirety by reference to the particular statutory and regulatory provision referred to below, and is not intended to be an exhaustive description of the applicable statutes or regulations. Any change in applicable laws or regulations may have a material adverse effect on the business.

BayFirst is a bank holding company within the meaning of the Bank Holding Company Act of 1956, as amended. As such, the Company is required to file annual reports and other information with the Federal Reserve regarding the Company’s business operations and those of the subsidiary. The Company is also subject to the supervision of, and to periodic inspections by, the Federal Reserve.

The BHCA generally requires every bank holding company to obtain approval from the Federal Reserve before:

•acquiring all or substantially all of the assets of a bank;

•acquiring direct or indirect ownership or control of 5% or more of the voting shares of any bank or bank holding company; or

•merging or consolidating with another bank holding company.

The BHCA and the Change in Bank Control Act, together with regulations promulgated by the Federal Reserve, require that, depending on the particular circumstances, either the Federal Reserve’s approval must be obtained or notice must be furnished to the Federal Reserve and not disapproved prior to any person or company, not a bank holding company, acquiring control of a bank holding company, subject to certain exemptions. Control is conclusively presumed to exist when an individual or company acquires 25% or more of any class of voting securities of a bank holding company. Control is rebuttably presumed to exist if a person acquires 10% or more, but less than 25%, of any class of voting securities and either the bank holding company has registered securities under Section 12 of the Exchange Act or no other person owns a greater percentage of that class of voting securities immediately after the transaction.

Additionally, the BHCA provides that the Federal Reserve may not approve any of these transactions if it would result in or tend to create a monopoly or substantially lessen competition or otherwise function as a restraint of trade, unless the anti-competitive effects of the proposed transaction are clearly outweighed by the public interest in meeting the convenience and needs of the community to be served. The Federal Reserve is also required to consider the financial and managerial resources and future prospects of the bank holding companies and banks concerned and the convenience and needs of the community to be served. The Federal Reserve’s consideration of financial resources generally focuses on capital adequacy, which is discussed below. As a result of the USA Patriot Act, the Federal Reserve is also required to consider the record of a bank holding company and its subsidiary bank(s) in combating money laundering activities in its evaluation of bank holding company merger or acquisition transactions.

Except as authorized by the BHCA and Federal Reserve regulations or order, a bank holding company is generally prohibited from engaging in, or acquiring direct or indirect control of 5% or more of the voting shares of any company engaged in any business other than the business of banking or managing and controlling banks. The primary exception allows the ownership of shares by a bank holding company in any company the activities of which the Federal Reserve has determined to be so closely related to banking or to managing or controlling banks that ownership of shares of that company is appropriate. Activities the Federal Reserve has determined by regulation to be proper incidents to the business of banking, and thus permissible for bank holding companies, include:

•making or servicing loans and certain types of leases;

•engaging in certain insurance and discount brokerage activities;

•performing certain data processing services;

•acting in certain circumstances as a fiduciary or investment or financial advisor;

•providing management consulting services;

•owning savings associations; and

•making investments in corporations or projects designed primarily to promote community welfare.

In accordance with Federal Reserve policy, a bank holding company is expected to act as a source of financial strength to its subsidiary banks. In adhering to the Federal Reserve’s policy, the Company may be required to provide financial support to the Bank at a time when, absent such Federal Reserve policy, it might not be deemed advisable to provide such assistance. Under the BHCA, the Federal Reserve may also require a bank holding company to terminate any activity or relinquish control of a nonbank subsidiary (other than a nonbank subsidiary of a bank) upon the Federal Reserve’s determination that the activity or control constitutes a serious risk to the financial soundness or stability of any subsidiary depository institution of the bank holding company. Further, federal bank regulatory authorities have additional discretion to require a bank holding company to divest itself of any bank or nonbank subsidiary if the agency determines that divestiture may aid the depository institution’s financial condition. The Dodd-Frank Act codified the Federal Reserve’s policy on serving as a source of financial strength. Such support may be required at times when, absent this Federal Reserve policy, a holding company may not be inclined to provide it. A bank holding company, in certain circumstances, could be required to guarantee the capital plan of an undercapitalized banking subsidiary.

The Federal Reserve also has authority to prohibit activities of bank holding companies and their nonbanking subsidiaries which represent unsafe and unsound banking practices, or which constitute violations of laws or regulations. The Federal Reserve may impose civil money penalties for activities conducted by a bank holding company, its nonbanking subsidiaries, and officials of either on a knowing and reckless basis, if those activities caused a substantial loss to a depository institution. The penalties can be as high as $1.0 million for each day the activity continues.

National Banks

National Banks are subject to regulation, periodic examination, enforcement authority and oversight by the OCC extending to all aspects of the bank’s operations. OCC regulations govern permissible activities, capital requirements, dividend limitations, investments, loans and other matters. Deposits are insured by the FDIC for a maximum of $250,000 per account ownership. For this protection, banks must pay a quarterly statutory assessment and comply with the rules and regulations of the FDIC. The assessment levied on a bank for deposit insurance varies, depending on the capital position of each bank, and other supervisory factors.

The FDIA provides that, in the event of the “liquidation or other resolution” of a bank, the claims of depositors of the bank, including the claims of the FDIC as subrogee of insured depositors, and certain claims for administrative expenses of the FDIC as a receiver will have priority over other general unsecured claims against the bank. If a bank fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors.

Areas regulated and monitored by the bank regulatory authorities include but are not limited to requirements concerning security devices and procedures, adequacy of capitalization and loss reserves, loans, investments, borrowings, deposits, mergers, issuances of securities, payment of dividends, establishment of branches, corporate reorganizations, transactions with affiliates, maintenance of books and records, and adequacy of staff training to carry out safe lending and deposit gathering practices.

Restrictions on Transactions with Affiliates and Loans to Insiders

Sections 23A and 23B of the Federal Reserve Act restrict transactions by banks with their affiliates. An affiliate of a bank is any company or entity which controls, is controlled by or is under common control with the bank. Generally, Sections 23A and 23B: (1) limit the extent to which a bank or its subsidiaries may engage in “covered transactions” with any one affiliate to an amount equal to 10% of that bank’s capital stock and surplus (i.e., tangible capital); and (2) require that all such transactions be on terms substantially the same, or at least as favorable to the bank or subsidiary, as those provided to a non-affiliate. The term “covered transaction” includes the making of loans, purchase of assets, issuance of a guarantee and other similar types of transactions.

Section 23A also covers investment funds managed by an institution as an affiliate, as well as other procedural and substantive matters. In addition, Sections 23A and 23B include coverage of transactions with insiders relative to credit exposure arising from derivative transactions. An insured depository institution is also prohibited from purchasing or selling an asset to an executive officer, director, or principal shareholder (or any related interest of such a person) unless the transaction is on market terms, and, if the transaction exceeds 10% of the institution’s capital, it is approved in advance by a majority of the disinterested directors.

A bank’s authority to extend credit to executive officers, directors and greater than 10% shareholders, as well as entities controlled by such persons, is subject to Sections 22(g) and 22(h) of the Federal Reserve Act and Regulation O promulgated thereunder by the Federal Reserve. Among other things, these loans must be made on terms substantially the same as those offered to unaffiliated individuals, the amount of loans a bank may make to these persons is based, in part, on the bank’s capital position, and specified approval procedures must be followed in making loans which exceed specified amounts.

Anti-tying Restrictions

Bank holding companies and affiliates are prohibited from tying the provision of services, such as extensions of credit, to other services offered by a holding company or its affiliates.

Capital Adequacy Requirements

Banks are subject to regulatory capital requirements imposed by the Federal Reserve and the FDIC. Until a bank holding company reaches $3 billion in assets, the risk-based capital and leverage guidelines issued by the Federal Reserve are applied to bank holding companies on a nonconsolidated basis, unless the bank holding company is engaged in nonbank activities involving significant leverage, or it has a significant amount of outstanding debt held by the general public. Instead, a bank holding company with less than $3 billion generally applies the risk-based capital and leverage capital guidelines on a bank only basis and must only meet a debt-to-equity ratio at the holding company level. The Federal Reserve risk-based capital guidelines apply directly to insured state banks, regardless of whether they are subsidiaries of a bank holding company. Both agencies’ requirements, which are substantially similar, establish minimum capital ratios in relation to assets, both on an aggregate basis as adjusted for credit risks and off-balance sheet exposures. The risk weights assigned to assets are based primarily on credit risks. Depending upon the riskiness of a particular asset, it is assigned to a risk category. Under the guidelines, capital is compared to the relative risk related to the balance sheet. To derive the risk included in the balance sheet, risk weights from 0% to 250% are applied to different balance sheet and off-balance sheet assets, primarily based on the relative credit risk of the counterparty. The capital amounts and classification are also subject to qualitative judgments by the regulators about components, risk weightings, and other factors.

Capital is then classified into three categories, Common Equity Tier 1, Additional Tier 1, and Tier 2. CET1 Capital is the sum of common stock instruments and related surplus net of treasury stock, retained earnings, AOCI and qualifying minority interests, less applicable regulatory adjustments and deductions that include AOCI (if an irrevocable option to neutralize AOCI is exercised). Mortgage-servicing assets, deferred tax assets, and investments in financial institutions are limited to an aggregate of 15% of CET1 and 10% of CET1 individually. Additional Tier 1 Capital includes noncumulative perpetual preferred stock, Tier 1 minority interests, grandfathered trust preferred securities, and Troubled Asset Relief Program instruments, less applicable regulatory adjustments and deductions. Tier 2 Capital includes subordinated debt and preferred stock not included in Additional Tier 1 Capital, total capital minority interests not included in Tier 1, and ACL not exceeding 1.25% percent of risk-weighted assets, less applicable regulatory adjustments and deductions.

Smaller banks are subject to the following capital level threshold requirements:

.

Community banks are subject to the following minimum capital requirements.

Federal banking regulators have adopted regulations revising the risk-based capital guidelines to further ensure that the guidelines take adequate account of interest rate risk. Interest rate risk is the adverse effect that changes in market interest rates may have on its financial condition and is inherent to the business of banking. Under the regulations, when evaluating a bank’s capital adequacy, the revised capital standards now explicitly include a bank’s exposure to declines in the economic value of its capital due to changes in interest rates. The exposure of a bank’s economic value generally represents the change in the present value of its assets, less the change in the value of its liabilities, plus the change in the value of its interest rate off-balance sheet contracts.

Federal bank regulatory agencies possess broad powers to take prompt corrective action as deemed appropriate for an insured depository institution and its holding company, based on the institution’s capital levels. The extent of these powers depends upon whether the institution in question is considered “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” or “critically undercapitalized.” Generally, as an institution is deemed to be less well capitalized, the scope and severity of the agencies’ powers increase, ultimately permitting the agency to appoint a receiver for the institution. Business activities may also be influenced by an institution’s capital classification. For instance, only a “well capitalized” depository institution may accept brokered deposits without prior regulatory approval and can engage in various expansion activities with prior notice, rather than prior regulatory approval. However, rapid growth, poor loan portfolio performance or poor earnings performance, or a combination of these factors, could change the capital position of the bank in a relatively short period of time. Failure to meet these capital requirements could subject the bank to prompt corrective action provisions of the FDIA, which may include filing with the appropriate bank regulatory authorities a plan describing the means and a schedule for achieving the minimum capital requirements. In addition, the Company would not be able to receive regulatory approval of any application that required consideration of capital adequacy, such as a branch or merger application, unless the Company could demonstrate a reasonable plan to meet the capital requirement within an acceptable period of time.

In 2019, the Federal banking regulatory agencies adopted a rule to simplify the methodology for measuring capital adequacy for smaller, uncomplicated banks. The CBLR is calculated as the ratio of tangible equity capital divided by average total consolidated assets. CBLR tangible equity is defined as total equity capital, prior to including minority interests, and excluding accumulated other comprehensive income, deferred tax assets arising from net operating loss and tax credit carryforwards, goodwill, and other intangible assets (other than mortgage servicing assets). Under the rule, a qualifying organization may elect to use the CBLR framework if its CBLR is greater than 9%.

Branching

National banks and state banks can establish branches in any state if that state would permit the establishment of the branch by a state bank chartered in that state.

Deposit Insurance Assessments

The deposits of a bank are insured by the FDIC up to the limits under applicable law, which currently is set at $250,000 for accounts under the same ownership. Banks are subject to deposit insurance premium assessments. The FDIC imposes a risk-based deposit premium assessment system. Under this system, the assessment rates for an insured depository institution vary according to the level of risk incurred in its activities. To arrive at an assessment rate for a banking institution, the FDIC places it in one of four risk categories determined by reference to its capital levels and supervisory ratings. In the case of those institutions in the lowest risk category, the FDIC further determines its assessment rate based on certain specified financial ratios or, if applicable, long-term debt ratings. The assessment rate schedule can change from time to time, at the discretion of the FDIC, subject to certain limits. Under the current system, premiums are assessed quarterly. The FDIC has published guidelines on the adjustment of assessment rates for certain institutions. The assessment base on which a bank’s deposit insurance premiums is paid to the FDIC is now calculated based on its average consolidated total assets less its average equity. Congressional bills and other proposals could result in additional significant changes to the financial services and banking system, including, but not limited to, provisions for limitations on deposit insurance coverage or changing the timing and method financial institutions use to pay for deposit insurance. As a consequence of the extensive regulation of commercial banking activities in the United States, the Bank’s business is particularly susceptible to being affected by federal legislation and regulations that may increase the costs of doing business or change the Corporation’s competitive landscape. Whether any future legislation will be enacted or additional regulations will be adopted, and how they might impact the Company, cannot be determined at this time.

Insurance of deposits may be terminated by the FDIC upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations or has violated any applicable law, regulation, rule, order or condition imposed by a bank’s federal regulatory agency. Deposits and certain claims for administrative expenses and employee compensation against insured depository institutions are afforded a priority over other general unsecured claims against the institution, including federal funds and letters of credit, in the liquidation or other resolution of that institution by any receiver appointed by federal authorities. These priority creditors include the FDIC.

Dividends

BayFirst’s ability to pay cash dividends may depend almost entirely upon the aggregate amount of dividends that the Bank is able to pay and that the Bank is permitted to pay, by statutes or regulations, to the Company. Additionally, the FBCA provides that the Company may only pay dividends if the dividend payment would not render BayFirst insolvent, or cause BayFirst to be unable to meet obligations as they come due. These provisions could have the effect of limiting the ability to pay dividends.

Banking regulations limit the amount of dividends that may be paid. Approval by regulatory authorities is required if the effect of dividends declared would cause the regulatory capital of the Bank to fall below specified minimum levels. Approval is also required if dividends declared exceed the net profits of the Bank for that year combined with the retained net profits for the preceding two years.

The Federal Reserve expects bank holding companies to serve as a source of strength to their subsidiary bank(s), which may require them to retain capital for investment in their subsidiary bank(s), rather than pay dividends to shareholders. As stated previously, the Bank may not pay dividends to BayFirst, if, after paying those dividends, the bank would fail to meet the required minimum levels under the risk-based capital guidelines and the minimum leverage ratio requirements. Payment of dividends by the Bank may be restricted at any time at the discretion of its applicable regulatory authorities if they deem such dividends to constitute an unsafe and/or unsound banking practice.

Fiscal and Monetary Policies

The business and earnings of a bank may be significantly affected by the fiscal and monetary policies of the federal government and its agencies. Banks are particularly affected by the policies of the Federal Reserve, which regulates the supply of money and credit in the United States. Among the instruments of monetary policy available to the Federal Reserve are: (i) conducting open market operations in United States government securities; (ii) changing the discount rates of borrowings of depository institutions; (iii) imposing or changing reserve requirements against depository institutions’ deposits; and (iv) imposing or changing reserve requirements against certain borrowing by banks and their affiliates. These methods are used in varying degrees and combinations to directly affect the availability of bank loans and deposits, as well as the interest rates charged on loans and paid on deposits. For that reason alone, the policies of the Federal Reserve have a material effect on the earnings of banks.

Other Laws

State usury and credit laws limit the amount of interest and other charges collected or contracted by a bank on loans. Bank loans are subject to federal laws applicable to credit transactions, such as the:

•Federal Truth-In-Lending Act, which governs disclosures of credit terms to consumer borrowers;

•Community Reinvestment Act, which requires financial institutions to meet their obligations to provide for the total credit needs of the communities they serve, including investing their assets in loans to low and moderate-income borrowers;

•Home Mortgage Disclosure Act requiring financial institutions to provide information to enable public officials to determine whether a financial institution is fulfilling its obligations to meet the housing needs of the community it serves;

•Equal Credit Opportunity Act prohibiting discrimination on the basis of race, creed, or other prohibitive factors in extending credit;

•Real Estate Settlement Procedures Act, which requires lenders to disclose certain information regarding the nature and cost of real estate settlements, and prohibits certain lending practices, as well as limits escrow account amounts in real estate transactions;

•Fair Credit Reporting Act governing the collection of consumer debts by collection agencies; and

•The rules and regulations of various federal agencies charged with the responsibility of implementing such federal laws.

Bank operations are also subject to the:

•Gramm-Leach-Bliley Act of 1999, which contains privacy provisions that requires the Bank to maintain privacy policies intended to safeguard consumer financial information, to disclose these policies to the customers, and allow customers to “opt out” of having their financial service providers disclose their confidential financial information to nonaffiliated third parties, subject to certain exceptions;

•Right to Financial Privacy Act, which imposes a duty to maintain confidentiality of consumer financial records and prescribes procedures for complying with administrative subpoenas of financial records; and

•Electronic Funds Transfer Act and Regulation E, which govern automatic deposits to, and withdrawals from, deposit accounts and customers’ rights and liabilities arising from the use of debit cards, automated teller machines, and other electronic banking services.

Anti-Money Laundering

Banks are subject to significant regulation and supervision relative to anti-money laundering:

•such regulation is broad and includes the extraterritorial jurisdiction of the United States;

•compliance and due diligence obligations are significant and may be costly;

•banks may be compelled to produce documents located both inside and outside the United States, including those of foreign institutions that have a correspondent relationship in the United States; and

•banks enjoy a safe harbor from civil liability to customers for banks’ activities under anti-money laundering laws and regulation.

The U.S. Treasury, in cooperation with the federal banking agencies, the SEC, the Commodity Futures Trading Commission, and the Department of Justice:

•requires customer identification and verification;

•imposes the money-laundering program requirement to the major financial services sectors, including insurance and unregistered investment companies, such as hedge funds; and

•facilitates and permits the sharing of information between law enforcement and financial institutions, as well as among financial institutions themselves.

Enforcement of the anti-money laundering laws and regulations is significant, on the part of both state and federal regulators.

Dodd-Frank Wall Street Reform and Consumer Protection Act

The Dodd-Frank Act has had a broad impact on the financial services industry, imposing significant regulatory and compliance changes, including the designation of certain financial companies as systemically significant, the imposition of increased capital, leverage, and liquidity requirements, and numerous other provisions designed to improve supervision and oversight of, and strengthen safety and soundness within, the financial services sector. Additionally, the Dodd-Frank Act established a framework of authority to conduct systemic risk oversight within the financial system to be distributed among federal regulatory agencies, including the Financial Stability Oversight council, the Federal Reserve, the OCC, and the FDIC. The following items provide a brief description of certain key provisions of the Dodd-Frank Act that affect banks:

•Limitation on debit card transaction fees. The amount a provider can charge for debit card transaction fees, commonly referred to as interchange fees, is now limited to $0.21 plus 0.05% of the price of the transaction (plus $0.01, if the provider has certain fraud prevention standards in place).

•Mortgage loan origination and risk retention. Additional regulatory requirements have been put in place that may affect the operations and result in increased compliance costs. For example, new standards have been created for mortgage loan originations on all lenders, including banks and thrifts, in an effort to require steps to verify a borrower’s ability to repay. In addition, the Dodd-Frank Act generally requires lenders or securitizers to retain an economic interest in the credit risk relating to loans the lender sells or mortgage and other asset-backed securities that the securitizer issues. These applicable rules generally require a sponsor of this type of transaction to retain an economic interest equal to at least 5% percent of the aggregate credit risk of the assets collateralizing an issuance.

•Expanded FDIC resolution authority. While insured depository institutions have long been subject to the FDIC’s resolution process, the Dodd-Frank Act created a new mechanism for the FDIC to conduct the orderly liquidation of certain “covered financial companies,” including bank and thrift holding companies and systemically significant nonbank financial companies.

•Consumer Financial Protection Bureau. An independent CFPB was created within the Federal Reserve. The CFPB is tasked with establishing and implementing rules and regulations under certain federal consumer protection laws with respect to the conduct of providers of certain consumer financial products and services. The CFPB has rulemaking authority over many of the statutes governing products and services offered to bank and thrift consumers.

•Transactions with affiliates and insiders. The Dodd-Frank Act generally enhanced the restrictions on transactions with affiliates under Section 23A and 23B of the Federal Reserve Act, including an expansion of the definition of “covered transactions.”

•Enhanced lending limits. The Dodd-Frank Act strengthened the limits on a depository institution’s credit exposure to one borrower.

Future Legislation

Various other legislative and regulatory initiatives, including proposals to overhaul the banking regulatory system are from time to time introduced in Congress and state legislatures, as well as regulatory agencies. The latest example was the passing of the Dodd-Frank Act. Future legislation regarding financial institutions may change banking statutes and the operating environment of the Company in substantial and unpredictable ways, and could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance depending upon whether any of this potential legislation will be enacted, and if enacted, the effect that it or any implementing regulations, would have on the financial condition or results of operations of the Company. The nature and extent of future legislative and regulatory changes affecting financial institutions is very unpredictable at this time.

Available Information

The Company’s annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and all amendments to those reports are available free of charge on the Company’s website at www.bayfirstfinancial.com as soon as reasonably practicable after such material is electronically filed with, or furnished to, the Securities and Exchange Commission. These documents are also available on the SEC’s website at www.sec.gov.