Carter Bankshares Inc

The federal banking agencies have also adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of a financial institution’s board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial products and services. The federal banking agencies expect financial institutions to establish lines of defense and ensure that their risk management processes also address the risk posed by compromised customer credentials, and also expect financial institutions to maintain sufficient business continuity planning processes to ensure rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack. If the

Company or the Bank fails to meet the expectations set forth in this regulatory guidance, the Company or the Bank could be subject to various regulatory actions and any remediation efforts may require significant resources of the Company or the Bank. In addition, all federal and state banking agencies continue to increase focus on cybersecurity programs and risks as part of regular supervisory exams.

On November 18, 2021, the federal bank regulatory agencies issued final rules to improve the sharing of information about cyber incidents that may affect the U.S. banking system. These rules require a banking organization to notify its primary federal regulator of any significant computer-security incident as soon as possible and no later than 36 hours after the banking organization determines that a cyber-incident has occurred. Notification is required for incidents that have materially affected or are reasonably likely to materially affect the viability of a banking organization’s operations, its ability to deliver banking products and services, or the stability of the financial sector. In addition, the rules require a bank service provider to notify affected banking organization customers as soon as possible when the provider determines that it has experienced a computer-security incident that has materially affected or is reasonably likely to materially affect banking organization customers for four or more hours. The rule became effective on May 1, 2022. The final rules did not have a material impact on the Company or the Bank’s operations.

Stress Testing

The federal banking agencies have implemented stress-testing requirements for certain large or risky financial institutions, including bank holding companies and state-chartered banks. Although these requirements do not apply to the Company and the Bank, the federal banking agencies emphasize that all banking organizations, regardless of size, should have the capacity to analyze the potential effect of adverse market conditions or outcomes on the organization’s financial condition. Based on existing regulatory guidance, the Company and the Bank will be expected to consider its interest rate risk management, commercial real estate loan concentrations and other credit-related information, and funding and liquidity management during this analysis of adverse market conditions or outcomes.

Volcker Rule

The Dodd-Frank Act prohibits bank holding companies and their subsidiary banks from engaging in proprietary trading except in limited circumstances, and places limits on ownership of equity investments in private equity and hedge funds (the “Volcker Rule”). The EGRRCPA and final rules adopted to implement the EGRRCPA exempt all banks with less than $10 billion in assets (including their holding companies and affiliates) from the Volcker Rule, provided that the institution has total trading assets and liabilities of 5% or less of total assets, subject to certain limited exceptions. The Company believes that its financial condition and its operations are not significantly affected by the Volcker Rule, amendments thereto, or its implementing regulations.

Call Reports and Examination Cycle

All institutions, regardless of size, submit a quarterly call report that includes data used by federal banking agencies to monitor the condition, performance, and risk profile of individual institutions and the industry as a whole. The EGRRCPA contained provisions expanding the number of regulated institutions eligible to use streamlined call report forms. In June 2019, the federal banking agencies issued a final rule to permit insured depository institutions with total assets of less than $5 billion that do not engage in certain complex or international activities to file the most streamlined version of the quarterly call report, and to reduce data reportable on certain streamlined call report submissions.

Effect of Governmental Monetary Policies

As with other financial institutions, the earnings of the Company and the Bank are affected by general economic conditions as well as by the monetary policies of the FRB. Such policies, which include regulating the national supply of bank reserves and bank credit, can have a major effect upon the source and cost of funds and the rates of return earned on loans and investments, and on levels of inflation in the United States. The FRB exerts a substantial influence on interest rates and credit conditions, primarily through establishing target rates for federal funds, open market operations in U.S. Government securities, varying the discount rate on member bank borrowings and setting cash reserve requirements against deposits. Changes in monetary policy, including changes in interest rates, will influence the origination of loans, the purchase of investments, the generation of deposits, and rates received on loans and investment securities and paid on deposits. Federal Reserve monetary policies have had a significant effect on the operating results of community banks, including us, in the past and are expected to do so in the future.

Application of Supervisory Guidance to the Company and the Bank

On March 31, 2021, the Federal Reserve issued a final rule outlining and confirming the use of supervisory guidance for regulated institutions, including bank holding companies like the Company. The rule generally codifies a statement issued by the federal banking agencies in September 2018 clarifying the differences between regulations and guidance, and provides that, unlike a law or regulation, supervisory guidance does not have the force and effect of law, and the agencies do not take enforcement actions based on supervisory guidance. Rather, guidance outlines expectations and priorities, or articulates views regarding appropriate practices for a specific subject. The rule became effective on April 30, 2021. The Company has not been materially impacted by the effectiveness of this rule.

Future Regulation

From time to time, various legislative and regulatory initiatives are introduced in Congress and state legislatures, as well as by regulatory agencies. Such initiatives may include proposals to expand or contract the powers of bank holding companies and depository institutions or to substantially change the financial institution regulatory system. Such legislation could change banking statutes and the operating environment of the Company and the Bank in substantial and unpredictable ways. If enacted, such legislation could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance among banks, savings associations, credit unions, and other financial institutions with which we compete. The Company cannot predict whether any such legislation will be enacted, and, if enacted, the effect that it, or any implementing regulations, would have on its financial condition or results of operations. A change in statutes, regulations or regulatory policies applicable to the Company and the Bank could have a material effect on our business.

Where You Can Find More Information

The Company files quarterly, annual and periodic reports, proxy statements and insider filings with the SEC. The Company’s SEC filings are available to the public over the Internet at the SEC’s web site at http://www.sec.gov. The Company’s SEC filings also are available through our website, www.CBTCares.com. Copies of documents may also be obtained free of charge by directing a request by telephone to (276) 656-1776 or mail to Investor Relations, Carter Bankshares, Inc., 1300 Kings Mountain Road, Martinsville, Virginia 24112.