Bank First Corp [BFC] Filings

Table of Contents

​

​

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

(Mark One)

☒   ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended December 31, 2023

OR

☐   TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from ____ to ____.

Commission file number 001-38676

BANK FIRST CORPORATION

(Exact name of registrant as specified in its charter)

​

​

​

​

Securities registered pursuant to Section 12(b) of the Act:

​

​

Securities registered pursuant to Section 12(g) of the Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☐ No ☒

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15 (d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit and post such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

​

​

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management's assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ⌧

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements.  ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes  ☐ No ☒

As of June 30, 2023, the last business day of the Registrant’s most recently completed second fiscal quarter, the aggregate market value of the Registrant’s common stock held by non-affiliates of the registrant was $815 million, based on the closing sales price of $83.20 per share as reported on the Nasdaq Capital Market.

As of February 29, 2024, 10,141,926 shares of common stock were outstanding.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the information required by Part III of this Annual Report are incorporated by reference from the Registrant’s definitive Proxy Statement for the 2024 annual meeting of shareholders to be filed with Securities and Exchange Commission pursuant to Regulation 14A not later than 120 days after the end of the fiscal year covered by this Annual Report.

Table of Contents

​

​

​

​

​

Table of Contents

BANK FIRST CORPORATION

TABLE OF CONTENTS

​

​

​

2

Table of Contents

In this Annual Report on Form 10-K (this “Annual Report”), references to “we,” “our,” “us,” “Bank First” or “the Company” refer to Bank First Corporation, a Wisconsin corporation, and our wholly-owned banking subsidiary, Bank First, N.A., a national banking association, unless otherwise indicated or the context otherwise requires. References to “Bank” refer to Bank First, N.A., our wholly-owned banking subsidiary.

Cautionary Note Regarding Forward-Looking Statements

Certain statements contained in this Annual Report are forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended (the “Securities Act”), and Section 21E of the Securities Exchange Act of 1934, as amended (the “Exchange Act”). These forward-looking statements include statements relating to our projected growth, anticipated future financial performance, financial condition, credit quality and management’s long-term performance goals, as well as statements relating to the anticipated effects on our business, financial condition and results of operations from expected developments or events, our business, growth and strategies. These statements, which are based on certain assumptions and estimates and describe our future plans, results, strategies and expectations, can generally be identified by the use of the words and phrases “may,” “will,” “should,” “could,” “would,” “goal,” “plan,” “potential,” “estimate,” “project,” “believe,” “intend,” “anticipate,” “expect,” “target,” “aim,” “predict,” “continue,” “seek,” “projection” and other variations of such words and phrases and similar expressions.

These forward-looking statements are not historical facts, and are based upon current expectations, estimates and projections about our industry, management’s beliefs and certain assumptions made by management, many of which, by their nature, are inherently uncertain and beyond our control. The inclusion of these forward-looking statements should not be regarded as a representation by us or any other person that such expectations, estimates and projections will be achieved. Accordingly, we caution you that any such forward-looking statements are not guarantees of future performance and are subject to risks, assumptions and uncertainties that are difficult to predict and that are beyond our control. Although we believe that the expectations reflected in these forward-looking statements are reasonable as of the date of this Annual Report, actual results may prove to be materially different from the results expressed or implied by the forward-looking statements. There are or will be important factors that could cause our actual results to differ materially from those indicated in these forward-looking statements, including, but not limited to, the following:

3

Table of Contents

4

Table of Contents

The foregoing factors should not be construed as exhaustive and should be read in conjunction with the sections entitled “Risk Factors” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations” included in this Annual Report. If one or more events related to these or other risks or uncertainties materialize, or if our underlying assumptions prove to be incorrect, actual results may differ materially from our forward-looking statements. Accordingly, you should not place undue reliance on any such forward-looking statements.  Any forward-looking statement speaks only as of the date of this Annual Report, and we do not undertake any obligation to publicly update or review any forward-looking statement, whether as a result of new information, future developments or otherwise, except as required by law. New risks and uncertainties may emerge from time to time, and it is not possible for us to predict their occurrence or how they will affect us.

​

​

5

Table of Contents

PART I

ITEM 1. BUSINESS

General Overview

Bank First Corporation is a Wisconsin corporation that was organized in April 1982 to serve as the holding company for Bank First, N.A., a national banking association founded in 1894. The Bank is a wholly-owned subsidiary of the Company. The Company and the Bank are headquartered in Manitowoc, Wisconsin, and the Bank is a member of the Board of Governors of the Federal Reserve System (the “Federal Reserve”) and regulated by the Office of the Comptroller of the Currency (the “OCC”). The Bank has twenty-six (26) offices, including its headquarters, in Brown, Columbia, Dane, Fond du Lac, Jefferson, Manitowoc, Monroe, Outagamie, Ozaukee, Shawano, Sheboygan, Waupaca, Waushara, and Winnebago counties in the State of Wisconsin. We serve businesses, professionals and consumers with a wide variety of financial services, including retail and commercial banking. Some of the products that we offer include checking accounts, savings accounts, money market accounts, cash management accounts, certificates of deposit, commercial and industrial loans, commercial real estate loans, construction and development loans, residential mortgages, consumer loans, credit cards, online banking, telephone banking and mobile banking.

The Bank has three subsidiaries: Bank First Investments, Inc., TVG Holdings, Inc. (“TVG”) and BFC Title, LLC. Bank First Investments, Inc. is a Wisconsin corporation organized in 2011, and is wholly-owned by the Bank. Bank First Investments, Inc.’s purpose is to provide investment and safekeeping services to the Bank. TVG is a Wisconsin corporation organized in 2009. It is a wholly-owned subsidiary of the Bank, and its purpose is to hold the Bank’s 40% ownership interest in Ansay & Associates, LLC (“Ansay”). Ansay is one of the nation’s largest independent insurance providers, and the Bank’s minority ownership of Ansay allows the Bank to provide diversified services to our customers without the risk and expense of an in-house insurance department. BFC Title, LLC is a Wisconsin limited liability company organized in 2020. It is a wholly-owned subsidiary of the Bank, and its purpose is to hold the Bank’s 5.88% ownership interest in Generations Title, LLC, a Wisconsin title company.

As of December 31, 2023, we had total consolidated assets of $4.22 billion, total loans of $3.34 billion, total deposits of $3.43 billion and total stockholders’ equity of $619.8 million. The Bank employed approximately 379 full-time equivalent employees (“FTE”), and had an average assets-to-FTE ratio of approximately $10.7 million for the year ended December 31, 2023. For more information, see the Bank’s website at www.bankfirst.com.

Recent acquisition

Hometown Bancorp, Ltd.

On February 10, 2023, the Company completed a merger with Hometown Bancorp, Ltd. ("Hometown"), a bank holding company headquartered in Fond du Lac, Wisconsin, pursuant to the Agreement and Plan of Bank Merger, dated as of July 25, 2022, by and between the Company and Hometown, whereby Hometown merged with and into the Company, and Hometown Bank, Hometown's wholly-owned banking subsidiary, merged with and into the Bank. Hometown's principal activity was the ownership and operation of Hometown Bank, a state-chartered banking institution that operated ten (10) branches in Wisconsin at the time of closing. The merger consideration totaled approximately $130.5 million.

Pursuant to the terms of the merger agreement, Hometown shareholders could elect to receive either 0.3962 of a share of the Company's common stock or $29.16 in cash for each outstanding share of Hometown common stock, subject to a maximum of 30% cash consideration in total, and cash in lieu of any remaining fractional share. Company stock issued totaled 1,450,272 shares valued at approximately $115.1 million, with cash of $15.4 million comprising the remainder of merger consideration.

The Company accounts for these transactions under the acquisition method of accounting, and thus, the financial position and results of operations of acquired institutions prior to the consummation date are not included in the accompanying consolidated financial statements. The acquisition method of accounting requires assets purchased and liabilities assumed to be recorded at their respective fair values at the date of acquisition. The Company determines the fair value of core

6

Table of Contents

deposit intangibles, securities, premises and equipment, loans, other assets and liabilities, deposits and borrowings with the assistance of third-party valuations, appraisals, and third-party advisors. The estimated fair values are subject to refinement for up to one year after deal consummation as additional information becomes available relative to the closing date fair values.

Strategic Plan

The Bank is a relationship-based community bank focused on providing innovative solutions that are value driven to the communities we serve. The Bank’s culture celebrates diversity, creativity, and responsiveness, with the highest ethical standards. Employees are supported and encouraged to develop their careers. They are empowered with the tools to be successful and are held accountable for the results they deliver to our customers and shareholders. We maintain a strong credit culture as a foundation of sound asset quality. The Bank’s vision is to sustain its independence by remaining a top-performing provider of financial services in Wisconsin. The Bank focuses on creating value for its customers and shareholders by forging strong relationships and offering personalized and innovative solutions. Bank First is focused on building a culture which encourages, supports and celebrates diversity and inclusion for our employees, customers and communities. This collaboration fuels a stronger foundation for innovation and connects us to our communities.

Our strategic priorities are organized around the CAMELS ratings, including Capital, Asset Quality, Management, Earnings, Liquidity, and Sensitivity to Market Risk. We have also added a sixth category to prioritize our strategic goals surrounding Information Technology. Under the heading of Capital, our priorities include (i) growing capital through strong earnings, and (ii) assessing and monitoring short and long-term capital goals. Under the heading of Asset Quality, our top priority is maintaining a strong credit culture. Under the heading of Management, our priorities are (i) to review and reassess our organizational structure, and (ii) to sustain and build upon employee engagement. Under the Earnings heading, our priorities include (i) growing and strengthening relationships, (ii) exploring and evaluating current and alternative revenue sources, and (iii) evaluating and pursuing prudent acquisitions. Under the Liquidity heading, our priorities are to (i) ensure that liquidity levels are adequate for anticipated needs, and (ii) maintain a relationship-centric customer portfolio. Under the heading of Sensitivity to Market Risk, our priorities include (i) minimizing optionality, and (ii) maintaining rate neutrality. Finally, under the heading of Information Technology, our strategic priorities include (i) advancing our digital strategy to match internal and external customer expectations, (ii) enhancing the flexibility in our core environment, (iii) monitoring the current cybersecurity environment, and (iii) training employees on cybersecurity risk and prudent responses.

Market Area

Bank First is a full-service community bank, offering business and retail products and services in communities throughout Wisconsin. Our branches are located in Brown, Jefferson, Manitowoc, Monroe, Outagamie, Ozaukee, Shawano, Sheboygan, Waupaca, and Winnebago counties. With the closing of the merger with Hometown on February 10, 2023, we also entered Columbia, Dane, Fond du Lac, and Waushara counties. Our main office is located at 402 N. 8th Street, Manitowoc, Wisconsin. Based on the deposit market share reports published by the FDIC on June 30, 2023, Bank First ranked in the top three of market share in six of the fourteen counties in which its branches are located.

The fourteen counties in which the Bank has offices have an estimated aggregate population of 1,894,606, based on 2020 U.S. Census data, and total deposits of approximately $60.4 billion as of June 30, 2023, according to the most recent data published by the FDIC.

Competition

The banking business is highly competitive, and we face competition in our market areas from many other local, regional, and national financial institutions. Competition among financial institutions is based on interest rates offered on deposit accounts, interest rates charged on loans, other credit and service charges relating to loans, the quality and scope of the services rendered, the convenience of banking facilities, and, in the case of loans to commercial borrowers, relative lending limits. We compete with commercial banks, credit unions, savings institutions, mortgage banking firms, consumer finance companies, securities brokerage firms, insurance companies, money market funds and other mutual funds, fintech companies, as well as regional and national financial institutions that operate offices in our market areas and elsewhere. The competing major commercial banks have greater resources that may provide them a competitive advantage by enabling

7

Table of Contents

them to maintain numerous branch offices, mount extensive advertising campaigns and invest in new technologies. The increasingly competitive environment is the result of changes in regulation, changes in technology and product delivery systems, additional financial service providers, and the accelerating pace of consolidation among financial services providers.

The financial services industry could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. Banks, securities firms and insurance companies can merge under the umbrella of a financial holding company, which can offer virtually any type of financial service, including banking, securities underwriting, insurance (both agency and underwriting) and merchant banking. Also, technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as automatic transfer and automatic payment systems.

Some of our non-banking competitors have fewer regulatory constraints and may have lower cost structures. In addition, some of our competitors have assets, capital and lending limits greater than that of the Bank, have greater access to capital markets and offer a broader range of products and services than the Bank. These institutions may have the ability to finance wide-ranging advertising campaigns and may also be able to offer lower rates on loans and higher rates on deposits than we can offer. Some of these institutions offer services, such as international banking, which we do not directly offer, except for a limited suite of services such as international wires and currency exchange.

We compete with these institutions by focusing on our position as an independent, community bank and rely upon local promotional activities, personal relationships established by our officers, directors, and employees with our customers, and specialized services tailored to meet the needs of the communities served.  We provide innovative products to our customers that are value-driven. We actively cultivate relationships with our customers that extend beyond a single loan to a full suite of products that serve the needs of our retail and commercial customers. Our goal is to develop long-standing connections with our customers and the communities that we serve. While our position varies by market, our management believes that it can compete effectively as a result of local market knowledge, local decision making, and awareness of customer needs.

Our Business

General

We emphasize a range of lending services, including commercial and residential real estate loans, construction and development loans, commercial and industrial loans, and consumer loans. Our customers are generally individuals, small to medium-sized businesses and professional firms that are located in or conduct a substantial portion of their business in our market areas. At December 31, 2023, we had total loans receivable of $3.34 billion, representing approximately 79.3% of our total assets. As of December 31, 2023, we had 26 nonaccrual loans totaling approximately $5.7 million, or 0.2% of total loans. For additional discussion related to nonperforming loans, see the “Management’s Discussion and Analysis of Financial Condition and Results of Operations” section as well as the notes to the consolidated financial statements.

Loan Approval

Certain credit risks are inherent in making loans. These include prepayment risks, risks resulting from uncertainties in the future value of collateral, risks resulting from changes in economic and industry conditions, and risks inherent in dealing with individual borrowers. We attempt to mitigate repayment risks by adhering to our comprehensive and robust internal credit policies and procedures. These policies and procedures include officer and customer lending limits, with approval process for larger loans, documentation examination, and follow-up procedures for any exceptions to credit policies. Our loan approval policies provide for various levels of officer lending authority. The Bank currently employs both a signature process through the line of business as well as credit administration and a committee process which involves the Bank’s board of directors each month. Both approvals and reviews of the credit actions are underwritten by an independent set of credit analysts who report to credit administration. For our loan commitments, a serial sign-off process is utilized up to $25,000,000, requiring multiple signatures for a loan approval. This process ensures that the necessary parties at all authority levels are aware of and approve the commitment. The Bank’s board of directors is involved in credits above this level after they have been through the serial sign-off process. We do not make any loans to any director, executive officer

8

Table of Contents

of the Bank, or the related interests of each, unless the loan is approved by the full board of directors of the Bank and is on terms not more favorable than would be available to a person not affiliated with the Bank.

Credit Administration and Loan Review

Our loan review consists of both commercial and retail review where loan files are reviewed and risk ratings are validated. Both are fully outsourced to a firm that specializes in file review and risk rating. Our policy for reviewing commercial credit files consisted of selecting a percentage of specific files on an annual basis as defined in our loan review plan, and reviewing them for risk rating and policy compliance. Our goal is to review every commercial relationship of $500,000 or more at least once in a five-year period. Our retail review consists of selecting a percentage of specific files on an annual basis, and reviewing them for policy compliance. Results of completed loan reviews are disclosed in writing, along with management responses, to the Directors Loan Committee.

Lending Limits

Our lending activities are subject to a variety of lending limits imposed by federal law. In general, the Bank is subject to a base legal limit on loans to a single borrower equal to 15% of the Bank’s capital and unimpaired surplus, plus an additional 10 percent of the Bank’s capital and surplus, if the amount that exceeds the 15 percent general limit is fully secured by readily marketable collateral. This legal lending limit will increase or decrease as the Bank’s level of capital increases or decreases. In addition to the legal lending, management and the board of directors have established a more conservative, internal lending limit. The Bank’s legal and internal lending limits are a safety and soundness measure intended to prevent one person or a relatively small and economically related group of persons from borrowing an unduly large amount of the Bank’s funds. It is also intended to safeguard the Bank’s depositors by diversifying the risk of credit losses among a relatively large number of creditworthy borrowers engaged in various types of businesses. Based upon the capitalization of the Bank at December 31, 2023, the Bank’s base legal lending limit was $66.9 million and the Bank’s internal lending limit was $53.6 million. Our board of directors will adjust the internal lending limit as deemed necessary to continue to mitigate risk and serve the Bank’s clients. We are also able to sell participations in our larger loans to other financial institutions, which allows us to manage the risk involved in these loans and to meet the lending needs of our clients requiring extensions of credit in excess of these limits.

Real Estate Loans

The principal component of our loan portfolio is loans secured by real estate. Real estate loans are subject to the same general risks as other loans and are particularly sensitive to fluctuations in the value of real estate. Fluctuations in the value of real estate and rising interest rates, as well as other factors arising after a loan has been made, could negatively affect a borrower’s cash flow, creditworthiness, and ability to repay the loan. We obtain a security interest in real estate whenever possible, in addition to any other available collateral, in order to increase the likelihood of the ultimate repayment of the loan.

As of December 31, 2023, loans secured by real estate made up approximately $2.59 billion, or 77.4%, of our loan portfolio. These loans generally will fall into one of two categories:

9

Table of Contents

​

Commercial and Industrial Loans

We have significant expertise in small to middle market commercial and industrial lending. Our success is the result of our product and market expertise, and our focus on delivering high-quality, customized and quick turnaround service for our clients due to our focus on maintaining an appropriate balance between prudent, disciplined underwriting, on the one hand, and flexibility in our decision making and responsiveness to our clients, on the other hand, which has allowed us to grow our commercial and industrial loan portfolio while maintaining strong asset quality. As of December 31, 2023, commercial and industrial loans made up approximately $487.9 million or 14.6% of our loan portfolio.

We provide a mix of variable and fixed rate commercial and industrial loans. The loans are typically made to small- and medium-sized businesses involved in professional services, accommodation and food services, health care, wholesale trade, financial institutions, manufacturing, distribution, retailing and non-profits. We extend commercial business loans for working capital, accounts receivable and inventory financing and other business purposes. Generally, short-term loans have maturities ranging from 3 months to 1 year, and “term loans” have maturities ranging from 3 to 20 years. Lines of credit are generally intended to finance current transactions and typically provide for periodic principal payments, with interest payable monthly. Term loans generally provide for floating and fixed interest rates, with monthly payments of both principal and interest.

Construction and Development Loans

We offer fixed and adjustable rate residential and commercial construction loan financing to builders and developers and to consumers who wish to build their own home. The term of construction and development loans generally is limited to 9 to 24 months, although payments may be structured on a longer amortization basis. Most loans will mature and require payment in full upon completion and either the sale of the property or refinance into a permanent loan. We believe that construction and development loans generally carry a higher degree of risk than long-term financing of stabilized, rented, and owner-occupied properties because repayment depends on the ultimate completion of the project and usually on the subsequent sale of the property. Specific risks include:

​

We attempt to reduce risk associated with construction and development loans by obtaining personal guaranties and by keeping the maximum loan-to-value ratio at or below 85% of the lesser of cost or appraised value, depending on the project type. Generally, we do not have interest reserves built into loan commitments but require periodic cash payments for interest

10

Table of Contents

from the borrower’s cash flow. As of December 31, 2023, construction and development loans made up approximately $200.8 million or 6.0% of our loan portfolio.

Consumer Loans

We make a variety of loans to individuals for personal and household purposes, including secured and unsecured installment loans and revolving lines of credit. Consumer loans are underwritten based on the borrower’s income, current debt level, past credit history, and the availability and value of collateral. Consumer rates are both fixed and variable, with negotiable terms. Our installment loans typically amortize over periods up to seven years. Although we typically require monthly principal and interest payments on our loan products, we will offer consumer loans at interest only with a single maturity date when a specific source of repayment is available. Consumer loans are generally considered to have greater risk than first or second mortgages on real estate because they may be unsecured, or, if they are secured, the value of the collateral may be difficult to assess and more likely to decrease in value than real estate.  As of December 31, 2023, consumer loans made up approximately $51.0 million or 1.5% of our loan portfolio.

Mortgage Banking Activities

Our mortgage banking operations include correspondent or secondary market lending, and in-house mortgage lending (included in residential mortgage and home equity loan totals above). We conduct secondary market lending through Fannie Mae, Federal Home Loan Bank of Chicago, U.S. Dept. of Agriculture, the Federal Housing Administration, and the Wisconsin Housing and Economic Development Authority. We also offer a number of in-house mortgage products, including adjustable rate mortgages at one, three, five, seven, ten, and fifteen years, and fixed rate mortgages at up to thirty years. We also offer an eleven-month construction loan, a construction to permanent loan, and a twelve-month bridge loan.

Deposit Products

We offer a full range of traditional deposit services through our branch network in our market areas that are typically available in most banks and savings institutions, including checking accounts, commercial accounts, savings accounts and other time deposits of various types, ranging from money market accounts to long-term certificates of deposit. Transaction accounts and time deposits are tailored to and offered at rates competitive to those offered in our primary market areas. We also offer retirement accounts and health savings accounts. Our customers include individuals, businesses, associations, organizations and governmental authorities. We believe that our branch infrastructure will assist us in obtaining deposits from local customers in the future. Our deposits are insured by the FDIC up to statutory limits.

Securities

We manage our securities portfolio and cash to maintain adequate liquidity and to ensure the safety and preservation of invested principal, with a secondary focus on yield and returns. Specific goals of our investment portfolio are as follows:

Our investment portfolio is comprised primarily of U.S. government securities, mortgage-backed securities backed by government-sponsored entities, and taxable and tax-exempt municipal securities.

Our investment policy is reviewed annually by our board of directors. Overall investment goals are established by our board, CEO, and members of our Asset Liability Management Committee (“ALCO”). Our board of directors has delegated the responsibility of monitoring our investment activities to our ALCO. Day-to-day activities pertaining to the securities portfolio

11

Table of Contents

are conducted under the supervision of our CEO and CFO. We actively monitor our investments on an ongoing basis to identify any material changes in the securities. We also review our securities for potential credit deterioration at least quarterly.

Human Capital Resources

​

Our Company culture emphasizes our longstanding dedication to being respectful to others and having a workforce that is representative of the communities we serve. Diversity, equity and inclusion (“DEI”) are fundamental to our culture. We believe in attracting, retaining and promoting quality talent and recognize that diversity makes us stronger as a Company. Our talent acquisition teams partner with hiring managers in sourcing and presenting a diverse slate of qualified candidates to strengthen our organization.

We believe employees to be our greatest asset and that our future success depends on our ability to attract, retain and develop employees. Professional development is a key priority, which is facilitated through our many corporate development initiatives including extensive training programs, corporate mentoring, leadership programs, and educational reimbursement.

As part of our effort to attract and retain employees, we offer a broad range of benefits, including health, dental and vision insurance, life and disability insurance, cell phone and health club reimbursement, an employee assistance program, educational tuition reimbursement, annual clothing allowance, an employee referral program, 401(k) retirement plan, profit sharing, a flex spending cafeteria plan, and generous paid time off. We believe our compensation package and benefits are competitive with others in our industry. For additional information regarding our employee benefit plans, see “Note 17 – Employee Benefit Plans” to our consolidated financial statements included in this report.

​

Bank First currently has approximately 379 FTEs. As of December 31, 2023, approximately 73% of our employees self-identified as female and approximately 5% self-identified as people of color. Twenty-seven percent (27%) of our Board members and 46% of our Senior Management team identify as female. One of our strategic goals is to increase the diversity of our Board in the coming year. None of our employees are represented by any collective bargaining unit or is a party to a collective bargaining agreement. We consider our relationship with our employees to be good and have not experienced interruptions of operations due to labor disagreements.

General Corporate Information

Our principal executive offices are located at 402 N. 8th Street, Manitowoc, Wisconsin 54220, and our telephone number at that address is (920) 652-3100. Additional information can be found on our website: www.bankfirst.com. The information contained on our website is not incorporated in this document by reference.

Public Information

Persons interested in obtaining information on the Company may read and copy any materials that we file with the U.S. Securities and Exchange Commission ("SEC"). The Commission maintains an Internet site that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC at www.sec.gov. We make available, free of charge, on or through our website, www.bankfirst.com, our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and other filings pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, and amendments to such filings, as soon as reasonably practicable after each is electronically filed with, or furnished to, the SEC.

12

Table of Contents

Supervision and Regulation

We are extensively regulated under federal and state law. The following is a brief summary that does not purport to be a complete description of all regulations that affect us or all aspects of those regulations. This discussion is qualified in its entirety by reference to the particular statutory and regulatory provisions described below and is not intended to be an exhaustive description of the statutes or regulations applicable to the Company’s and the Bank’s business. In addition, proposals to change the laws and regulations governing the banking industry are frequently raised at both the state and federal levels. The likelihood and timing of any changes in these laws and regulations, and the impact such changes may have on us and the Bank, are difficult to predict. In addition, bank regulatory agencies may issue enforcement actions, policy statements, interpretive letters and similar written guidance applicable to us or the Bank. Changes in applicable laws, regulations or regulatory guidance, or their interpretation by regulatory agencies or courts may have a material adverse effect on our and the Bank’s business, operations, and earnings. Supervision and regulation of banks, their holding companies and affiliates is intended primarily for the protection of depositors and customers, the Deposit Insurance Fund (“DIF”) of the FDIC, and the U.S. banking and financial system rather than holders of our capital stock.

Regulation of the Company

We are registered as a bank holding company with the Federal Reserve under the Bank Holding Company Act of 1956, as amended (the “BHC Act”). As such, we are subject to comprehensive supervision and regulation by the Federal Reserve and are subject to its regulatory reporting requirements. Federal law subjects bank holding companies, such as the Company, to particular restrictions on the types of activities in which they may engage, and to a range of supervisory requirements and activities, including regulatory enforcement actions for violations of laws and regulations. Violations of laws and regulations, or other unsafe and unsound practices, may result in regulatory agencies imposing fines or penalties, cease-and-desist orders, or taking other enforcement actions. Under certain circumstances, these agencies may enforce these remedies directly against officers, directors, employees and other parties participating in the affairs of a bank or bank holding company.

Activity Limitations.   Bank holding companies are generally restricted to engaging in the business of banking, managing or controlling banks and certain other activities determined by the Federal Reserve to be closely related to banking. In addition, the Federal Reserve has the power to order a bank holding company or its subsidiaries to terminate any nonbanking activity or terminate its ownership or control of any nonbank subsidiary, when it has reasonable cause to believe that continuation of such activity or such ownership or control constitutes a serious risk to the financial safety, soundness, or stability of any bank subsidiary of that bank holding company.

Source of Strength Obligations.   A bank holding company is required to act as a source of financial and managerial strength to its subsidiary bank and to maintain resources adequate to support its bank. The term “source of financial strength” means the ability of a company, such as us, that directly or indirectly owns or controls an insured depository institution, such as the Bank, to provide financial assistance to such insured depository institution in the event of financial distress. The appropriate federal banking agency for the depository institution (in the case of the Bank, this agency is the OCC) may require reports from us to assess our ability to serve as a source of strength and to enforce compliance with the source of strength requirements by requiring us to provide financial assistance to the Bank in the event of financial distress. If we were to enter bankruptcy or become subject to the orderly liquidation process established by the Dodd-Frank Act, any commitment by us to a federal bank regulatory agency to maintain the capital of the Bank would be assumed by the bankruptcy trustee or the FDIC, as appropriate, and entitled to a priority of payment.

13

Table of Contents

Acquisitions.   The BHC Act permits acquisitions of banks by bank holding companies, such that we and any other bank holding company, whether located in Wisconsin or elsewhere, may acquire a bank located in any other state, subject to certain deposit-percentage, age of bank charter requirements, and other restrictions. The BHC Act requires that a bank holding company obtain the prior approval of the Federal Reserve before (i) acquiring direct or indirect ownership or control of more than 5% of the voting shares of any additional bank or bank holding company, (ii) taking any action that causes an additional bank or bank holding company to become a subsidiary of the bank holding company, or (iii) merging or consolidating with any other bank holding company. The Federal Reserve may not approve any such transaction that would result in a monopoly or would be in furtherance of any combination or conspiracy to monopolize or attempt to monopolize the business of banking in any section of the United States, or the effect of which may be substantially to lessen competition or to tend to create a monopoly in any section of the country, or that in any other manner would be in restraint of trade, unless the anticompetitive effects of the proposed transaction are clearly outweighed by the public interest in meeting the convenience and needs of the community to be served. The Federal Reserve is also required to consider: (1) the financial and managerial resources of the companies involved, including pro forma capital ratios; (2) the risk to the stability of the United States banking or financial system; (3) the convenience and needs of the communities to be served, including performance under the Community Reinvestment Act ("CRA"); and (4) the effectiveness of the companies in combatting money laundering.

Change in Control.   Federal law restricts the amount of voting stock of a bank holding company or a bank that a person may acquire without the prior approval of banking regulators. Under the Change in Bank Control Act and the regulations thereunder, a person or group must give advance notice to the Federal Reserve before acquiring control of any bank holding company, such as the Company, and the OCC before acquiring control of any national bank, such as the Bank. Upon receipt of such notice, the bank regulatory agencies may approve or disapprove the acquisition. The Change in Bank Control Act creates a rebuttable presumption of control if a person or group acquires the power to vote 10% or more of our outstanding common stock. The overall effect of such laws is to make it more difficult to acquire a bank holding company and a bank by tender offer or similar means than it might be to acquire control of another type of corporation. Consequently, shareholders of the Company may be less likely to benefit from the rapid increases in stock prices that may result from tender offers or similar efforts to acquire control of other companies. Investors should be aware of these requirements when acquiring shares of our stock.

Governance and Financial Reporting Obligations. We are required to comply with various corporate governance and financial reporting requirements under the Sarbanes-Oxley Act of 2002, as well as rules and regulations adopted by the SEC, the Public Company Accounting Oversight Board (“PCAOB”), and Nasdaq. In particular, we are required to include management and independent registered public accounting firm reports on internal controls as part of our Annual Report on Form 10- K in order to comply with Section 404 of the Sarbanes-Oxley Act. We have evaluated our controls, including compliance with the SEC rules on internal controls, and have and expect to continue to spend significant amounts of time and money on compliance with these rules. Our failure to comply with these internal control rules may materially adversely affect our reputation, ability to obtain the necessary certifications to financial statements, and the values of our securities. The assessments of our financial reporting controls as of December 31, 2023 are included in this report under “Item 9A. Controls and Procedures.”

Corporate Governance.   The Dodd-Frank Act addresses many investor protections, corporate governance, and executive compensation matters that will affect most U.S. publicly traded companies. The Dodd-Frank Act (1) grants shareholders of U.S. publicly traded companies an advisory vote on executive compensation; (2) enhances independence requirements for Compensation Committee members; and (3) requires companies listed on national securities exchanges to adopt incentive-based compensation claw-back policies for executive officers.

14

Table of Contents

Incentive Compensation.   The Dodd-Frank Act required the banking agencies and the SEC to establish joint rules or guidelines for financial institutions with more than $1 billion in assets, such as us and the Bank, which prohibit incentive compensation arrangements that the agencies determine to encourage inappropriate risks by the institution. The banking agencies issued proposed rules in 2011 and previously issued guidance on sound incentive compensation policies. In 2016, the Federal Reserve and the OCC also proposed rules that would, depending upon the assets of the institution, directly regulate incentive compensation arrangements and would require enhanced oversight and recordkeeping. As of December 31, 2023, these rules have not been implemented. We and the Bank have undertaken efforts to ensure that our incentive compensation plans do not encourage inappropriate risks, consistent with three key principles— that incentive compensation arrangements should appropriately balance risk and financial rewards, be compatible with effective controls and risk management, and be supported by strong corporate governance.

Shareholder Say-On-Pay Votes.  The Dodd-Frank Act requires public companies to take shareholders’ votes on proposals addressing compensation (known as say-on-pay), the frequency of a say-on-pay vote, and the golden parachutes available to executives in connection with change-in-control transactions. Public companies must give shareholders the opportunity to vote on the compensation at least every three years and the opportunity to vote on frequency at least every six years, indicating whether the say-on-pay vote should be held annually, biennially, or triennially. The say-on-pay, the say-on-parachute and the say-on-frequency votes are explicitly nonbinding and cannot override a decision of our board of directors.

Other Regulatory Matters.   We and our subsidiaries are subject to oversight by the SEC, the Financial Industry Regulatory Authority, (“FINRA”), the PCAOB, Nasdaq and various state securities regulators. We and our subsidiaries have from time to time received requests for information from regulatory authorities in various states, including state attorneys general, securities regulators and other regulatory authorities, concerning our business practices. Such requests are considered incidental to the normal conduct of business.

Capital Requirements

The Company and Bank are required under federal law to maintain certain minimum capital levels based on ratios of capital to total assets and capital to risk-weighted assets. The required capital ratios are minimums, and the federal banking agencies may determine that a banking organization, based on its size, complexity or risk profile, must maintain a higher level of capital in order to operate in a safe and sound manner. Risks such as concentration of credit risks and the risks arising from non-traditional activities, as well as the institution’s exposure to a decline in the economic value of its capital due to changes in interest rates, and an institution’s ability to manage those risks are important factors that are to be taken into account by the federal banking agencies in assessing an institution’s overall capital adequacy. The following is a brief description of the relevant provisions of these capital rules and their potential impact on our capital levels.

The Company and Bank are subject to the following risk-based capital ratios: a common equity Tier 1 (“CET1”) risk-based capital ratio, a Tier 1 risk-based capital ratio, which includes CET1 and additional Tier 1 capital, and a total capital ratio, which includes Tier 1 and Tier 2 capital. CET1 is primarily comprised of the sum of common stock instruments and related surplus net of treasury stock, retained earnings, and certain qualifying minority interests, less certain adjustments and deductions, including with respect to goodwill, intangible assets, mortgage servicing assets and deferred tax assets subject to temporary timing differences. Additional Tier 1 capital is primarily comprised of noncumulative perpetual preferred stock, tier 1 minority interests and grandfathered trust preferred securities. Tier 2 capital consists of instruments disqualified from Tier 1 capital, including qualifying subordinated debt, other preferred stock and certain hybrid capital instruments, and a limited amount of loan loss reserves up to a maximum of 1.25% of risk-weighted assets, subject to certain eligibility criteria. The capital rules also define the risk-weights assigned to assets and off-balance sheet items to determine the risk-weighted asset components of the risk-based capital rules, including, for example, certain “high volatility” commercial real estate, past due assets, structured securities and equity holdings.

The leverage capital ratio, which serves as a minimum capital standard, is the ratio of Tier 1 capital to quarterly average assets net of goodwill, certain other intangible assets, and certain required deduction items. The required minimum leverage ratio for all banks is 4.0%.

15

Table of Contents

In addition, the capital rules require a capital conservation buffer of CET1 of 2.5% above each of the minimum capital ratio requirements (CET1, Tier 1, and total risk-based capital), which is designed to absorb losses during periods of economic stress. These buffer requirements must be met for a bank to be able to pay dividends, engage in share buybacks or make discretionary bonus payments to executive management without restriction.

The Federal Deposit Insurance Corporation Improvement Act of 1991 (“FDICIA”), among other things, requires the federal bank regulatory agencies to take “prompt corrective action” regarding depository institutions that do not meet minimum capital requirements. FDICIA establishes five regulatory capital tiers: “well capitalized”, “adequately capitalized”, “undercapitalized”, “significantly undercapitalized”, and “critically undercapitalized”. A depository institution’s capital tier will depend upon how its capital levels compare to various relevant capital measures and certain other factors, as established by regulation. FDICIA generally prohibits a depository institution from making any capital distribution (including payment of a dividend) or paying any management fee to its holding company if the depository institution would thereafter be undercapitalized.

To be well-capitalized, the Company and Bank must maintain at least the following capital ratios:

Failure to be well-capitalized or to meet minimum capital requirements could result in certain mandatory and possible additional discretionary actions by regulators that, if undertaken, could have an adverse material effect on our operations or financial condition. For example, only a well-capitalized depository institution may accept brokered deposits without prior regulatory approval. Failure to be well-capitalized or to meet minimum capital requirements could also result in restrictions on the Bank’s ability to pay dividends or otherwise distribute capital or to receive regulatory approval of applications or other restrictions on its growth. The Bank was well capitalized at December 31, 2023, and brokered deposits are not restricted.

In 2023, the Company and Bank’s regulatory capital ratios were above the applicable well-capitalized standards and met the then-applicable capital conservation buffer. Based on current estimates, we believe that the Company and Bank will continue to exceed all applicable well-capitalized regulatory capital requirements and the capital conservation buffer in 2024.

The Economic Growth, Regulatory Relief, and Consumer Protection Act (the “Economic Growth Act”) signed into law in May 2018 scaled back certain requirements of the Dodd-Frank Act and provided other regulatory relief. Among the provisions of the Economic Growth Act was a requirement that the Federal Reserve raise the asset threshold for those bank holding companies subject to the Federal Reserve’s Small Bank Holding Company Policy Statement (“Policy Statement”) to $3 billion. As a result, as of the effective date of that change in 2018, the Company was no longer required to comply with the risk-based capital rules applicable to the Bank. The Company crossed above the $3 billion threshold during the third quarter of 2022 and is now required to adhere to these capital rules.

As a result of the Economic Growth Act, the federal banking agencies were also required to develop a “Community Bank Leverage Ratio” (the ratio of a bank’s Tier 1 capital to average total consolidated assets) for financial institutions with assets of less than $10 billion. A “qualifying community bank” that exceeds this ratio will be deemed to be in compliance with all other capital and leverage requirements, including the capital requirements to be considered “well capitalized” under prompt corrective action statutes. The federal banking agencies may consider a financial institutions risk profile when evaluation whether it qualifies as a community bank for purposes of the capital ratio requirement. The federal banking agencies set the minimum capital for the new Community Bank Leverage Ratio at 9%. The Bank does not intend to opt into the Community Bank Leverage Ratio Framework.

On December 21, 2018, federal banking agencies issued a joint final rule to revise their regulatory capital rules to (i) address the upcoming implementation of the “current expected credit losses” (“CECL”) accounting standard under GAAP; (ii) provide

16

Table of Contents

an optional three-year phase-in period for the day-one adverse regulatory capital effects that banking organizations are expected to experience upon adopting CECL; and (iii) require the use of CECL in stress tests beginning with the 2020 capital planning and stress testing cycle for certain banking organizations. For more information regarding Accounting Standards Update No. 2016-13, which introduced CECL as the methodology to replace the current “incurred loss” methodology for financial assets measured at amortized cost, and changed the approaches for recognizing and recording credit losses on available-for-sale debt securities and purchased credit impaired financial assets, including the required implementation date for the Company, see the notes to the Company’s consolidated financial statements for the year ended December 31, 2023.

Payment of Dividends

We are a legal entity separate and distinct from the Bank and our other subsidiaries. Our primary source of cash, other than securities offerings, is dividends from the Bank. The prior approval of the OCC is required if the total of all dividends declared by a national bank (such as the Bank) in any calendar year will exceed the sum of such bank’s net profits for that year and its retained net profits for the preceding two calendar years, less any required transfers to surplus. Federal law also prohibits any national bank from paying dividends that would be greater than such bank’s undivided profits after deducting statutory bad debts in excess of such bank’s allowance for possible credit losses.

In addition, we and the Bank are subject to various general regulatory policies and requirements relating to the payment of dividends, including requirements to maintain adequate capital above regulatory minimums. The appropriate federal bank regulatory authority may prohibit the payment of dividends where it has determined that the payment of dividends would be an unsafe or unsound practice and to prohibit payment thereof. The OCC and the Federal Reserve have indicated that paying dividends that deplete a bank’s capital base to an inadequate level would be an unsound and unsafe banking practice. The OCC and the Federal Reserve have each indicated that depository institutions and their holding companies should generally pay dividends only out of current operating earnings.

Under a Federal Reserve policy adopted in 2009, the board of directors of a bank holding company must consider different factors to ensure that its dividend level is prudent relative to maintaining a strong financial position, and is not based on overly optimistic earnings scenarios, such as potential events that could affect its ability to pay, while still maintaining a strong financial position. As a general matter, the Federal Reserve has indicated that the board of directors of a bank holding company should consult with the Federal Reserve and eliminate, defer or significantly reduce the bank holding company’s dividends if:

Prior approval by the OCC is required if the total of all dividends declared by a national bank in any calendar year exceeds the bank’s profits for that year combined with its retained net profits for the preceding two calendar years.

Regulation of the Bank

As a national bank, our primary bank subsidiary, Bank First, N.A., is subject to comprehensive supervision and regulation by the OCC and is subject to its regulatory reporting requirements. The deposits of the Bank are insured by the FDIC up to applicable limits and, accordingly, the Bank is also subject to certain FDIC regulations and the FDIC has backup examination authority and some enforcement powers over the Bank. The Bank also is subject to certain Federal Reserve regulations.

In addition, as discussed in more detail below, the Bank and any other of our subsidiaries that offer consumer financial products and services are subject to regulation and potential supervision by the Consumer Financial Protection Bureau (“CFPB”). Authority to supervise and examine the Company and the Bank for compliance with federal consumer laws

17

Table of Contents

remains largely with the Federal Reserve and the OCC, respectively. However, the CFPB may participate in examinations on a “sampling basis” and may refer potential enforcement actions against such institutions to their primary regulators. The CFPB also may participate in examinations of our other direct or indirect subsidiaries that offer consumer financial products or services. In addition, the Dodd-Frank Act permits states to adopt consumer protection laws and regulations that are stricter than those regulations promulgated by the CFPB, and state attorneys general are permitted to enforce certain federal consumer financial protection rules adopted by the CFPB. As the Company and the Bank each had less than $10 billion in consolidated assets in 2023, they are not subject to the routine supervision of the CFPB, but this may change in the future as the Company and the Bank grow.

Broadly, regulations applicable to the Bank include limitations on loans to a single borrower and to its directors, officers and employees; restrictions on the opening and closing of branch offices; the maintenance of required capital and liquidity ratios; the granting of credit under equal and fair conditions; the disclosure of the costs and terms of such credit; requirements to maintain reserves against deposits and loans; limitations on the types of investment that may be made by the Bank; and requirements governing risk management practices. The Bank is permitted under federal law to branch on a de novo basis across state lines where the laws of that state would permit a bank chartered by that state to open a de novo branch.

Transactions with Affiliates and Insiders. The Bank is subject to restrictions on extensions of credit and certain other transactions between the Bank and the Company or any nonbank affiliate. Generally, these covered transactions with either the Company or any affiliate are limited to 10% of the Bank’s capital and surplus, and all such transactions between the Bank and the Company and all of its nonbank affiliates combined are limited to 20% of the Bank’s capital and surplus. Loans and other extensions of credit from the Bank to the Company or any affiliate generally are required to be secured by eligible collateral in specified amounts. In addition, any transaction between the Bank and the Company or any affiliate are required to be on an arm’s length basis. Federal banking laws also place similar restrictions on certain extensions of credit by insured banks, such as the Bank, to their directors, executive officers and principal shareholders.

Reserves.   Historically, Federal Reserve rules required depository institutions, such as the Bank, to maintain reserves against their transaction accounts, primarily interest bearing and noninterest-bearing checking accounts. The Federal Reserve announced that reserve requirement ratios were reduced to zero percent effective March 26, 2020. This action eliminated reserve requirements for all depository institutions.

FDIC Insurance Assessments and Depositor Preference.   The Bank’s deposits are insured by the FDIC’s DIF up to the limits under applicable law, which currently are set at $250,000 per depositor, per insured bank, for each account ownership category. The Bank is subject to FDIC assessments for its deposit insurance. The FDIC calculates quarterly deposit insurance assessments based on an institution’s average total consolidated assets less its average tangible equity, and applies one of four risk categories determined by reference to its capital levels, supervisory ratings, and certain other factors. The assessment rate schedule can change from time to time, at the discretion of the FDIC, subject to certain limits.

Insurance of deposits may be terminated by the FDIC upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by a bank’s federal regulatory agency. In addition, the Federal Deposit Insurance Act provides that, in the event of the liquidation or other resolution of an insured depository institution, the claims of depositors of the institution, including the claims of the FDIC as subrogee of insured depositors, and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution, including those of the parent bank holding company.

In October of 2022, the FDIC adopted a final rule to increase the initial base deposit insurance assessment rate by 2 basis points, applicable to all insured depository institutions, which began with the first quarterly assessment period in 2023 and will remain in effect until the level of the DIF reserve ratios to insured deposits meets the FDIC's long-term goals.

Standards for Safety and Soundness.   The Federal Deposit Insurance Act requires the federal bank regulatory agencies to prescribe, by regulation or guideline, operational and managerial standards for all insured depository institutions relating to: (1) internal controls; (2) information systems and audit systems; (3) loan documentation; (4) credit underwriting; (5) interest rate risk exposure; and (6) asset quality. The federal banking agencies have adopted regulations and Interagency Guidelines Establishing Standards for Safety and Soundness to implement these required standards. These guidelines set

18

Table of Contents

forth the safety and soundness standards used to identify and address problems at insured depository institutions before capital becomes impaired. Under the regulations, if a regulator determines that a bank fails to meet any standards prescribed by the guidelines, the regulator may require the bank to submit an acceptable plan to achieve compliance, consistent with deadlines for the submission and review of such safety and soundness compliance plans.

Anti-Money Laundering. A continued focus of governmental policy relating to financial institutions in recent years has been combating money laundering and terrorist financing. The USA PATRIOT Act broadened the application of anti-money laundering regulations to apply to additional types of financial institutions such as broker-dealers, investment advisors and insurance companies, and strengthened the ability of the U.S. government to help prevent, detect and prosecute international money laundering and the financing of terrorism. The principal provisions of Title III of the USA PATRIOT Act require that regulated financial institutions: (i) establish an anti-money laundering program that includes training and audit components; (ii) comply with regulations regarding the verification of the identity of any person seeking to open an account; (iii) take additional required precautions with non-U.S. owned accounts; and (iv) perform certain verification and certification of money laundering risk for their foreign correspondent banking relationships. Failure of a financial institution to comply with the USA PATRIOT Act's requirements could have serious legal and reputational consequences for the institution. The Bank has augmented its systems and procedures to meet the requirements of these regulations and will continue to revise and update its policies, procedures and controls to reflect changes required by law.

FinCEN has adopted rules that require financial institutions to obtain beneficial ownership information with respect to legal entities with which such institutions conduct business, subject to certain exclusions and exemptions. Bank regulators are focusing their examinations on anti-money laundering compliance, and we continue to monitor and augment, where necessary, our anti-money laundering compliance programs.

Banking regulators will consider compliance with the Act's money laundering provisions in acting upon merger and acquisition proposals.

Bank regulators routinely examine institutions for compliance with these anti-money laundering obligations and recently have been active in imposing “cease-and-desist” and other regulatory orders and money penalty sanctions against institutions found to be in violation of these requirements. Sanctions for violations of the Act can be imposed in an amount equal to twice the sum involved in the violating transaction, up to $1 million. On January 1, 2021, Congress passed federal legislation that made sweeping changes to federal anti-money laundering laws, subject to pending implementation by regulatory rulemaking. Most recently, on June 30, 2021, FinCEN published the first set of “national AML priorities,” as required by the Bank Secrecy Act, which include, but are not limited to, cybercrime, terrorist financing, fraud, and drug/human trafficking.  FinCEN is required to implement regulations to specify how covered financial institutions, such as the Company, should incorporate these national priorities into their AML programs.  As of December 31, 2023, no such regulations have been proposed.

Economic Sanctions. The Office of Foreign Assets Control (“OFAC”) is responsible for helping to ensure that U.S. entities do not engage in transactions with certain prohibited parties, as defined by various Executive Orders and acts of Congress. OFAC publishes, and routinely updates, lists of names of persons and organizations suspected of aiding, harboring or engaging in terrorist acts, including the Specially Designated Nationals and Blocked Persons List. If we find a name on any transaction, account or wire transfer that is on an OFAC list, we must undertake certain specified activities, which could include blocking or freezing the account or transaction requested, and we must notify the appropriate authorities.

Concentrations in Lending.  During 2006, the federal bank regulatory agencies released guidance on “Concentrations in Commercial Real Estate Lending” (the “Guidance”) and advised financial institutions of the risks posed by commercial real estate (“CRE”) lending concentrations. The Guidance requires that appropriate processes be in place to identify, monitor and control risks associated with real estate lending concentrations. Higher allowances for credit losses and capital levels may also be required. The Guidance is triggered when CRE loan concentrations exceed either:

19

Table of Contents

The Guidance also applies when a bank has a sharp increase in CRE loans or has significant concentrations of CRE secured by a particular property type. See Item 1A. Risk Factors -- We are subject to lending concentration risk, which could cause our regulators to restrict our ability to grow  – for a discussion of our risks regarding CRE exposure.

Community Reinvestment Act. The Bank is subject to the provisions of the CRA, which imposes a continuing and affirmative obligation, consistent with their safe and sound operation, to help meet the credit needs of entire communities where the Bank accepts deposits, including low- and moderate-income neighborhoods. The OCC’s assessment of the Bank’s CRA record is made available to the public. Further, a less than satisfactory CRA rating will slow, if not preclude, expansion of banking activities. Following the enactment of the Gramm-Leach-Bliley Act (“GLB”), CRA agreements with private parties must be disclosed and annual CRA reports must be made to a bank’s primary federal regulator. Federal CRA regulations require, among other things, that evidence of discrimination against applicants on a prohibited basis, and illegal or abusive lending practices be considered in the CRA evaluation. In May 2020, the OCC issued new final regulations meant to strengthen and modernize the CRA regulations, with an effective date of October 1, 2020. However, on December 14, 2021, the OCC issued a final rule rescinding its 2020 CRA Rule and replacing it with a rule based largely on the prior rules adopted jointly by the federal banking agencies in 1995. The Bank had a rating of “Outstanding” in its most recent CRA evaluation.

On May 5, 2022, the OCC, FRB, and FDIC issued a notice of proposed rulemaking to provide for a coordinated approach to modernize their respective CRA regulations, such that all banks will be subject to the same set of CRA rules. Key elements are expected to include (i) expanding access to credit, investment, and basic banking services in low- and moderate-income communities; (ii) updating CRA assessment areas by including activities associated with online and mobile banking, branchless banking, and hybrid models; and (iii) better tailoring CRA evaluations and data collection requirements by bank size and type. The final rule was released on October 24, 2023, and will take effect on April 1, 2024, with staggered compliance dates of January 1, 2026 and January 1, 2027.

Privacy and Data Security.   The GLB generally prohibits disclosure of consumer information to non-affiliated third parties unless the consumer has been given the opportunity to object and has not objected to such disclosure. Financial institutions are further required to disclose their privacy policies to customers annually. Financial institutions, however, will be required to comply with state law if it is more protective of consumer privacy than the GLB. The GLB also directed federal regulators, including the FDIC and the OCC, to prescribe standards for the security of consumer information. The Bank is subject to such standards, as well as standards for notifying customers in the event of a security breach. Under federal law, the Bank must disclose its privacy policy to consumers, permit customers to opt out of having nonpublic customer information disclosed to third parties in certain circumstances, and allow customers to opt out of receiving marketing solicitations based on information about the customer received from another subsidiary. States may adopt more extensive privacy protections. We are similarly required to have an information security program to safeguard the confidentiality and security of customer information and to ensure proper disposal. Customers must be notified when unauthorized disclosure involves sensitive customer information that may be misused. On November 18, 2021, the federal banking agencies issued a new rule effective in 2022 that requires banks to notify their regulators within 36 hours of a “computer-security incident” that rises to the level of a “notification incident.” On July 26, 2023 the SEC adopted rules requiring registrants such as the Bank to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy and governance. See Item 1C for further discussion of the Bank’s processes for assessing, identifying and managing materials risks from cybersecurity threats.

Furthermore, the federal banking regulators regularly issue guidance regarding cybersecurity intended to enhance cyber risk management. A financial institution is expected to implement multiple lines of defense against cyberattacks and ensure that their risk management procedures address the risk posed by potential cyber threats. A financial institution is further expected to maintain procedures to effectively respond to a cyberattack and resume operations following any such attack. The Company has adopted and implemented an Information Security Program to comply with the regulatory cybersecurity guidance.

Consumer Regulation. Activities of the Bank are subject to a variety of statutes and regulations designed to protect consumers. These laws and regulations include, among numerous other things, provisions that:

20

Table of Contents

Mortgage Regulation.  The CFPB adopted a rule that implements the ability-to-repay and qualified mortgage provisions of the Dodd-Frank Act (the “ATR/QM rule”), which requires lenders to consider, among other things, income, employment status, assets, payment amounts, and credit history before approving a mortgage, and provides a compliance “safe harbor” for lenders that issue certain “qualified mortgages.” The ATR/QM rule defines a “qualified mortgage” to have certain specified characteristics, and generally prohibit loans with negative amortization, interest-only payments, balloon payments, or terms exceeding 30 years from being qualified mortgages. The rule also establishes general underwriting criteria for qualified mortgages, including that monthly payments be calculated based on the highest payment that will apply in the first five years of the loan and that the borrower has a total debt-to-income ratio that is less than or equal to 43%. While “qualified mortgages” will generally be afforded safe harbor status, a rebuttable presumption of compliance with the ability-to-repay requirements will attach to “qualified mortgages” that are “higher priced mortgages” (which are generally subprime loans). In addition, the securitizer of asset-backed securities must retain not less than 5 percent of the credit risk of the assets collateralizing the asset-backed securities, unless subject to an exemption for asset-backed securities that are collateralized exclusively by residential mortgages that qualify as “qualified residential mortgages.”

The CFPB has also issued rules to implement requirements of the Dodd-Frank Act pertaining to mortgage loan origination (including with respect to loan originator compensation and loan originator qualifications) as well as integrated mortgage disclosure rules. In addition, the CFPB has issued rules that require servicers to comply with new standards and practices with regard to: error correction; information disclosure; force-placement of insurance; information management policies and procedures; requiring information about mortgage loss mitigation options be provided to delinquent borrowers; providing delinquent borrowers access to servicer personnel with continuity of contact about the borrower’s mortgage loan account; and evaluating borrowers’ applications for available loss mitigation options. These rules also address initial rate adjustment notices for adjustable-rate mortgages (ARMs), periodic statements for residential mortgage loans, and prompt crediting of mortgage payments and response to requests for payoff amounts.

In 2020, the CARES Act granted certain forbearance rights and protection against foreclosure to borrowers with a "federally backed mortgage loan," including certain first or subordinate lien loans designed principally for the occupancy of one to four families. These consumer protections under the CARES Act continued during the COVID 19 pandemic emergency, and while most of these protections expired in 2022, on January 18, 2023, in its revised Mortgage Servicing Examination Procedures, the CFPB stated it expected servicers to continue to utilize these safeguards, regardless of their expiration.

Non-Discrimination Policies.   The Bank is also subject to, among other things, the provisions of the Equal Credit Opportunity Act (“ECOA”) and the Fair Housing Act (“FHA”), both of which prohibit discrimination based on race or color, religion, national origin, sex, and familial status in any aspect of a consumer or commercial credit or residential real estate transaction. The Department of Justice (“DOJ”), and the federal bank regulatory agencies have issued an Interagency Policy Statement on Discrimination in Lending that provides guidance to financial institutions in determining whether discrimination exists, how the agencies will respond to lending discrimination, and what steps lenders might take to prevent discriminatory lending practices. The DOJ has increased its efforts to prosecute what it regards as violations of the ECOA and FHA.

​

LIBOR: On March 15, 2022, Congress enacted the Adjustable Interest Rate (LIBOR) Act (the “LIBOR Act”) to address references to LIBOR in contracts that (i) are governed by U.S. law; (ii) will not mature before June 30, 2023; and (iii) lack fallback provisions providing for a clearly defined and practicable replacement for LIBOR. On December 16, 2022, the FRB adopted a final rule to implement the LIBOR Act by identifying benchmark rates based on SOFR (Secured Overnight Financing

21

Table of Contents

Rate) that replaced LIBOR in certain financial contracts after June 30, 2023.  The final rule identifies replacement benchmark rates based on SOFR to replace overnight, one-month, three-month, six-month, and 12-month LIBOR in contracts subject to the LIBOR Act.

​

​

​

ITEM 1A. RISK FACTORS

In addition to the other information contained in this Form 10-K, you should carefully consider the risks described below, as well as the risk factors and uncertainties discussed in our other public filings with the SEC under the caption "Risk Factors" in evaluating us and our business and making or continuing an investment in our stock. Our operations and financial results are subject to various risks and uncertainties, including, but not limited, to the material risks described below. Many of these risks are beyond our control although efforts are made to manage those risks while simultaneously optimizing operational and financial results. The occurrence of any of the following risks, as well as risks of which we are currently unaware or currently deem immaterial, could materially and adversely affect our assets, business, cash flows, condition (financial or otherwise), liquidity, prospects, results of operations and the trading price of our common stock. It is impossible to predict or identify all such factors and, as a result, you should not consider the following factors to be a complete discussion of the risks, uncertainties and assumptions that could materially and adversely affect our assets, business, cash flows, condition (financial or otherwise), liquidity, prospects, results of operations and the trading price of our common stock.

In addition, certain statements in the following risk factors constitute forward-looking statements. Please refer to the section entitled “Cautionary Note Regarding Forward-Looking Statements” beginning on page 1 of this Annual Report on Form 10- K.

Risks related to our business

Difficult or volatile conditions in the national financial markets, and the U.S. economy generally, may adversely affect our lending activity or other businesses, as well as our financial condition.

We are operating in an uncertain economic environment. Our business and financial performance are vulnerable to weak economic conditions in the financial markets generally and specifically in the state of Wisconsin, the principal market in which we conduct business. A deterioration in economic conditions in the global and financial markets as well as our primary market areas caused by inflation, recession, pandemics, outbreaks of hostilities or other international or domestic occurrences, unemployment, plant or business closings or downsizing, changes in securities markets or other factors could result in the following consequences, any of which could materially and adversely affect our business: increased loan delinquencies; problem assets and foreclosures; significant write-downs of asset values; lower demand for our products and services; reduced low cost or noninterest-bearing deposits; intangible asset impairment; and collateral for loans made by us, especially real estate, may decline in value, in turn reducing our customers’ ability to repay outstanding loans, and reducing the value of assets and collateral associated with our existing loans. In addition, regulatory scrutiny of the industry has increased and could continue to increase, leading to increased regulation of the industry that could lead to a higher cost of compliance, limit our ability to pursue business opportunities and increase our exposure to litigation or fines.

Additionally, we conduct our banking operations primarily in Wisconsin. As of December 31, 2023, approximately 95.74% of our loans and approximately 97.81% of our deposits were made to borrowers or received from depositors who live and/or primarily conduct business in Wisconsin. Therefore, our success will depend in large part upon the general economic conditions in this area, which we cannot predict with certainty. This geographic concentration imposes risks from lack of geographic diversification, as adverse economic developments in Wisconsin, among other things, could affect the volume of loan originations, increase the level of nonperforming assets, increase the rate of foreclosure losses on loans and reduce the value of our loans and loan servicing portfolio. Any regional or local economic downturn that affects Wisconsin or existing or prospective borrowers or property values in such areas may affect us and our profitability more significantly and adversely than our competitors whose operations are less geographically concentrated.

Moreover, the financial markets and the global economy may also be adversely affected by the current or anticipated impact of military conflict, including the current conflicts between Russia and Ukraine and between Israel and Hamas, which are

22

Table of Contents

increasing volatility in commodity and energy prices, creating supply chain issues and causing instability in financial markets. Sanctions imposed by the United States and other countries in response to such conflict could further adversely impact the financial markets and the global economy, and any economic countermeasures by the affected countries or others could exacerbate market and economic instability.

Changes in interest rates may have an adverse effect on our net interest income.

Net interest income, which is the difference between the interest income that we earn on interest-earning assets and the interest expense that we pay on interest-bearing liabilities, is a major component of our income and our primary source of revenue from our operations. Narrowing of interest rate spreads could adversely affect our earnings and financial condition. We cannot control or predict with certainty changes in interest rates. Regional and local economic conditions, competitive pressures, and the policies of regulatory authorities, including monetary policies of the Federal Reserve Board (“FRB”), affect interest income and interest expense.

​

Beginning in early 2022, in response to growing signs of inflation, the FRB increased interest rates rapidly and made a number of adjustments to monetary policy and liquidity, including quantitative tightening and other balance sheet actions. Further, the FRB has increased the benchmark rapidly and has announced an intention to take further actions to mitigate rising inflationary pressures. Rising interest rates can have a negative impact on our business by reducing the amount of money our clients borrow or by adversely affecting their ability to repay outstanding loan balances that may increase due to adjustments in their variable rates. In addition, as interest rates rise, we may have to offer more attractive interest rates to depositors to compete for deposits, or pursue other sources of liquidity, such as wholesale funds.

​

On the other hand, decreasing interest rates reduce our yield on our variable rate loans and on our new loans, which reduces our net interest income. In addition, lower interest rates may reduce our realized yields on investment securities which would reduce our net interest income and cause downward pressure on net interest margin in future periods. A significant reduction in our net interest income could have a material adverse impact on our capital, financial condition and results of operations.

Although the FRB increased the target federal funds rate in 2023 to combat inflationary trends, the FRB held the federal funds rate steady in December 2023 for the third consecutive quarter and indicated that the rate is likely to be decreased in 2024 and beyond.  We are unable to predict changes in interest rates, which are affected by factors beyond our control, including inflation, deflation, recession, unemployment, money supply, and other changes in financial markets. We have ongoing policies and procedures designed to manage the risks associated with changes in market interest rates and actively manage these risks through hedging and other risk mitigation strategies. However, if our assumptions are wrong or overall economic conditions are significantly different than anticipated, our risk mitigation techniques may be ineffective or costly.

Changes in interest rates may change the value of our mortgage servicing rights portfolio, which may increase the volatility of our earnings.

A mortgage servicing right is the right to service a mortgage loan - collect principal, interest and escrow amounts - for a fee. We measure and carry our residential mortgage servicing rights using the fair value measurement method. Fair value is determined as the present value of estimated future net servicing income, calculated based on a number of variables, including assumptions about the likelihood of prepayment by borrowers. The primary risk associated with mortgage servicing rights is that in a declining interest rate environment, they will likely lose a substantial portion of their value as a result of higher than anticipated prepayments. Moreover, if prepayments are greater than expected, the cash we receive over the life of the mortgage loans would be reduced. Conversely, these assets generally increase in value in a rising interest rate environment to the extent that prepayments are slower than previously estimated. An increase in the size of our mortgage servicing rights portfolio may increase our interest rate risk. Depending on the interest rate environment, it is possible that the fair value of our mortgage servicing rights may be reduced in the future. If such changes in fair value significantly reduce the carrying value of our mortgage servicing rights, our business, financial condition and results of operations could be adversely affected.

23

Table of Contents

Inflation could negatively impact our business, our profitability and our stock price.

Inflation continued rising in 2023, and inflationary pressures may remain elevated into 2024. Prolonged periods of inflation may impact our profitability by negatively impacting our fixed costs and expenses, including increasing funding costs and expense related to talent acquisition and retention, and negatively impacting the demand for our products and services. Additionally, inflation may lead to a decrease in consumer and clients’ purchasing power and negatively affect the need or demand for our products and services. If significant inflation continues, our business could be negatively affected by, among other things, increased default rates leading to credit losses which could decrease our appetite for new credit extensions. These inflationary pressures could result in missed earnings and budgetary projections causing our stock price to suffer.

Changes in the cost and availability of funding due to changes in the deposit market and credit market may adversely affect our capital resources, liquidity, and financial results.

In managing our consolidated balance sheets, we depend on access to a variety of sources of funding to provide us with sufficient capital resources and liquidity to meet our commitments and business needs, and to accommodate the transaction and cash management needs of our clients. In addition to core deposits, sources of funding available to us and upon which we rely as regular components of our liquidity and funding management strategy, include borrowings from the Federal Home Loan Bank (“FHLB”) and brokered deposits. In general, the amount, type, and cost of our funding, including from other financial institutions, the capital markets, and deposits, directly impacts our costs of operating our business and growing our assets and can therefore positively or negatively affect our financial results. A number of factors could make funding more difficult, more expensive, or unavailable on any terms, including, but not limited to, a downgrade in our credit ratings, financial results, changes within our organization, specific events that adversely impact our reputation, disruptions in the capital markets, specific events that adversely impact the financial services industry, counterparty availability, recently proposed changes to the FHLB system, changes affecting our assets, the corporate and regulatory structure, interest rate fluctuations, general economic conditions, and the legal, regulatory, accounting and tax environments governing our funding transactions. Also, we compete for funding with other banks and similar companies, many of which are substantially larger, and have more capital and other resources.

In addition to bank level liquidity management, we must manage liquidity at holding company for various needs including potential capital infusions into subsidiaries, the servicing of debt, the payment of dividends on our common stock, and share repurchases. The primary source of liquidity for us consists of dividends from the Bank which are governed by certain rules and regulations of our supervising agencies. Bank First’s ability to receive dividends from the Bank in future periods will depend on a number of factors, including, without limitation, the Bank's future profits, asset quality, liquidity, and overall condition. If Bank First does not receive dividends from the Bank as needed, its liquidity could be adversely affected, and it may not be able to continue to execute its current capital plan to return capital to its shareholders. In addition to dividends from the Bank, we have historically had access to a number of alternative sources of liquidity, including the capital markets, but there is no assurance that we will be able to obtain such liquidity on terms that are favorable to us, or at all. If our access to these traditional and alternative sources of liquidity is diminished or only available on unfavorable terms, then our overall liquidity and financial condition will be adversely affected.

If the Bank loses or is unable to grow and retain its deposits, it may be subject to liquidity risk and higher funding costs.

The total amount that we pay for funding costs is dependent, in part, on the Bank’s ability to grow and retain its deposits. If the Bank is unable to sufficiently grow and retain its deposits at competitive rates to meet liquidity needs, it may be subject to paying higher funding costs to meet these liquidity needs.

The Bank competes with banks and other financial services companies for deposits. As a result of monetary policy and the broader market for interest rates and funding, we were required to raise rates on our deposits to keep pace with our competition. Furthermore, if the Bank were to lose deposits, it must rely on more expensive sources of funding. This could result in a failure to maintain adequate liquidity and higher funding costs, reducing our net interest margin and net interest income. In addition, our access to deposits may be affected by the liquidity needs of our depositors. In particular, a substantial majority of our liabilities in 2023 were checking accounts and other liquid deposits, which are payable on demand or upon several days' notice, while by comparison, a substantial majority of our assets were loans, which cannot be called

24

Table of Contents

or sold in the same time frame. Moreover, our clients could withdraw their deposits in favor of alternative investments. While we have historically been able to replace maturing deposits and advances as necessary, we may not be able to replace such funds in the future, especially if a large number of our depositors seek to withdraw their accounts, regardless of the reason.

Our provision and allowance for credit losses may not be adequate to cover actual credit losses.

We make various assumptions and judgments about the collectability of our loan and lease portfolio and utilize these assumptions and judgments when determining the provision and allowance for credit losses. The determination of the appropriate level of the provision for credit losses inherently involves a high degree of subjectivity and requires us to make significant estimates of current credit risks and future trends, all of which may undergo material changes, as we have experienced. Deterioration in economic conditions affecting borrowers, new information regarding existing loans, identification of additional problem loans and other factors, both within and outside of our control, may require an increase in the amount reserved in the allowance for credit losses. Due to the declining economic conditions, our customers may not be able to repay their loans according to the original terms, and the collateral securing the payment of those loans may be insufficient to pay any remaining loan balance. While we maintain our allowance to provide for loan defaults and non-performance, losses may exceed the value of the collateral securing the loans and the allowance may not fully cover any excess loss. In addition, bank regulatory agencies periodically review our provision and the total allowance for credit losses and may require an increase in the allowance for credit losses or future provisions for credit losses, based on judgments different than those of management. Any increases in the provision or allowance for credit losses will result in a decrease in our net income and, potentially, capital, and may have a material adverse effect on our financial condition or results of operations. In addition, we expect that the allowance for credit losses under the CECL standard to be more volatile and as such could have an impact on our results of operations. For a discussion of changes in accounting standards and regulatory capital implications, see “Business—Supervision and Regulation—Capital Requirements.”

If we do not effectively manage our asset quality and credit risk, we could experience credit losses.

Making any loan involves various risks, including risks inherent in dealing with individual borrowers, risks of nonpayment, risks resulting from uncertainties as to the future value of collateral and cash flows available to service debt, and risks resulting from changes in economic and market conditions. Our credit risk approval and monitoring procedures may fail to identify or reduce these credit risks, as some of these risks are outside of our control, and they cannot completely eliminate all credit risks related to our loan portfolio. If the overall economic climate, including employment rates, real estate markets, interest rates and general economic growth, in the United States, generally, or Wisconsin, specifically, experiences material disruption, our borrowers may experience difficulties in repaying their loans, the collateral we hold may decrease in value or become illiquid, and the levels of nonperforming loans, charge-offs and delinquencies could rise and require additional provisions for credit losses, which would cause our net income and return on equity to decrease. The future effects of the continued elevated inflationary and interest rate environment on economic activity could negatively affect the collateral values associated with our existing loans, the ability to liquidate the real estate collateral securing our residential and commercial real estate loans, our ability to maintain loan origination volume and to obtain additional financing, the future demand for or profitability of our lending and services, and the financial condition and credit risk of our customers. Further, in the event of delinquencies, regulatory changes and policies designed to protect borrowers may slow or prevent us from making our business decisions or may result in a delay in our taking certain remediation actions, such as foreclosure. If borrowers fail to repay their loans, our financial condition and results of operations would be adversely affected.

We face strong competition from financial services companies and other companies that offer banking services.

We conduct our banking operations primarily in Wisconsin. Many of our competitors offer the same, or a wider variety of, banking services within our market areas, and we compete with them for the same customers. These competitors include banks with nationwide operations, regional banks and community banks. In many instances these national and regional banks have greater resources than we do, and the smaller community banks may have stronger ties in local markets than we do, which may put us at a competitive disadvantage. We also face competition from many other types of financial institutions, including fintech companies, thrift institutions, finance companies, brokerage firms, insurance companies, credit unions, mortgage banks and other financial intermediaries. In addition, a number of out-of-state financial institutions have opened offices and solicit deposits in our market areas. Increased competition in our markets may result in reduced loans

25

Table of Contents

and deposits, as well as reduced net interest margin and profitability. We compete with many forms of payments offered by both bank and non-bank providers, including a variety of new and evolving alternative payment mechanisms, systems and products, such as aggregators and web-based and wireless payment platforms or technologies, digital or “crypto” currencies, prepaid systems and payment services targeting users of social networks, communications platforms and online gaming. Our future success may depend, in part, on our ability to use technology competitively to offer products and services that provide convenience to customers and create additional efficiencies in our operations. If we are unable to attract and retain banking clients, we may be unable to continue to grow our loan and deposit portfolios, and our business, financial condition and results of operations may be adversely affected. Furthermore, the financial services industry could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation.

Because a significant portion of our loan portfolio is comprised of real estate loans, negative changes in the economy affecting real estate values and liquidity could impair the value of collateral securing our real estate loans and result in loan and other losses.

As of December 31, 2023, approximately 77.4% of our loan portfolio was comprised of loans with real estate as a primary or secondary component of collateral. This includes collateral consisting of income producing and residential construction properties, which properties tend to be more sensitive to general economic conditions and downturns in real estate markets. As a result, adverse developments affecting real estate values in our market areas could increase the credit risk associated with our real estate loan portfolio. The market value of real estate can fluctuate significantly in a short period of time as a result of market conditions in the area in which the real estate is located. Adverse changes affecting real estate values and the liquidity of real estate in one or more of our markets could increase the credit risk associated with our loan portfolio, and could result in losses that would adversely affect credit quality, financial condition, and results of operation. Negative changes in the economy affecting real estate values and liquidity in our market areas could significantly impair the value of property pledged as collateral on loans and affect our ability to sell the collateral upon foreclosure without a loss or additional losses. Collateral may have to be sold for less than the outstanding balance of the loan, which could result in losses on such loans. Such declines and losses could have a material adverse impact on our business, results of operations and growth prospects. If real estate values decline, it is also more likely that we would be required to increase our ACL-Loans, which could adversely affect our financial condition, results of operations and cash flows.

Our future success is largely dependent upon our ability to successfully execute our business strategy.

Our future success, including our ability to achieve our growth and profitability goals, is dependent on the ability of our management team to execute on our long-term business strategy, which requires them to, among other things:

maintain and enhance our reputation; attract and retain experienced and talented bankers in each of our markets; maintain adequate funding sources, including by continuing to attract stable, low-cost deposits; enhance our market penetration in our metropolitan markets and maintain our leadership position in our community markets; improve our operating efficiency; implement new technologies to enhance the client experience and keep pace with our competitors; identify attractive acquisition targets, close on such acquisitions on favorable terms and successfully integrate acquired businesses; attract and maintain commercial banking relationships with well-qualified businesses, real estate developers and investors with proven track records in our market areas; attract sufficient loans that meet prudent credit standards; originate conforming residential mortgage loans for resale into secondary market to provide mortgage banking income; maintain adequate liquidity and regulatory capital and comply with applicable federal and state banking regulations; manage our credit, interest rate and liquidity risks; develop new, and grow our existing, streams of noninterest income; oversee the performance of third-party service providers that provide material services to our business; and control expenses in line with current projections.

Failure to achieve these strategic goals could adversely affect our ability to successfully implement our business strategies and could negatively impact our business, growth prospects, financial condition and results of operations. Further, if we do not manage our growth effectively, our business, financial condition, results of operations and future prospects could be negatively affected, and we may not be able to continue to implement our business strategy and successfully conduct our operations. Furthermore, our strategic initiatives may result in an increase in expense, divert management attention, take away from other opportunities that may have proved more successful, negatively impact operational effectiveness or impact

26

Table of Contents

employee morale. Additionally, there can be no assurance that we will ultimately realize the anticipated benefits of these strategic initiatives, or that these strategic initiatives will positively impact our organization.

We depend on our executive officers and other key individuals to continue the implementation of our long-term business strategy and could be harmed by the loss of their services and our inability to make up for such loss with qualified replacements.

We believe that our continued growth and future success will depend in large part on the skills of our management team and our ability to motivate and retain these individuals and other key individuals. The loss of any of their service could reduce our ability to successfully implement our long-term business strategy, our business could suffer and the value of our common stock could be materially adversely affected.

The success of our operating model depends on our ability to attract and retain talented bankers and associates in each of our markets.

We strive to attract and retain these bankers in each of our markets by fostering an entrepreneurial environment, empowering them with local decision-making authority and providing them with sufficient infrastructure and resources to support their growth while also providing management with appropriate oversight. However, the competition for bankers in each of our markets is intense. We compete for talent with both smaller banks that may be able to offer bankers with more responsibility and autonomy and larger banks that may be able to offer bankers with higher compensation, resources and support. As a result, we may not be able to effectively compete for talent across our markets. Further, our bankers may leave us to work for our competitors and, in some instances, may take important banking and lending relationships with them to our competitors. If we are unable to attract and retain talented bankers in our markets, our business, growth prospects and financial results could be materially and adversely affected.

Acquisitions may disrupt our business and dilute stockholder value, and integrating acquired companies may be more difficult, costly, or time-consuming than we expect.

While we continue to focus on organic growth opportunities, we may pursue attractive bank or non-bank acquisition and consolidation opportunities that arise in our core markets and beyond. The number of financial institutions headquartered in Wisconsin, the Midwest United States, and across the country continues to decline through merger and other consolidation activity. In the event that attractive acquisition opportunities arise, we would likely face competition for such acquisitions from other banking and financial companies, many of which have significantly greater resources and may have more attractive valuations. This competition could either prevent us from being able to complete attractive acquisition opportunities or increase prices for potential acquisitions which could reduce our potential returns and reduce the attractiveness of these opportunities. Furthermore, our pursuit of acquisitions may disrupt our business, and any equity that we issue as merger consideration may have the effect of diluting the value of your investment. In addition, we may fail to realize some or all of the anticipated benefits of completed acquisitions. We anticipate that the integration of businesses that we may acquire in the future will be a time-consuming and expensive process, even if the integration process is effectively planned and implemented.

In addition, our acquisition activities could be material to our business and involve a number of significant risks, including the following:

incurring time and expense associated with identifying and evaluating potential acquisitions and negotiating potential transactions, resulting in our attention being diverted from the operating of our existing business; using inaccurate estimates and judgments to evaluate credit, operations, management, and market risks with respect to the target company or the assets and liabilities that we seek to acquire; exposure to potential asset quality issues of the target company; intense competition from other banking organizations and other potential acquirers, many of which have substantially greater resources than we do; potential exposure to unknown or contingent liabilities of banks and businesses we acquire, including, without limitation, liabilities for regulatory and compliance issues; inability to realize the expected revenue increases, cost savings, increases in geographic or product presence, and other projected benefits of the acquisition; incurring time and expense required to integrate the operations and personnel of the combined businesses; inconsistencies in standards, procedures, and policies that would adversely affect our ability to maintain relationships with customers and employees;

27

Table of Contents

experiencing higher operating expenses relative to operating income from the new operations; creating an adverse short-term effect on our results of operations; losing key employees and customers; significant problems related to the conversion of the financial and customer data of the entity; integration of acquired customers into our financial and customer product systems; potential changes in banking or tax laws or regulations that may affect the target company; or risks of impairment to goodwill or litigation risk.

If difficulties arise with respect to the integration process, the economic benefits expected to result from acquisitions might not occur. As with any merger of financial institutions, there also may be business disruptions that cause us to lose customers or cause customers to move their business to other financial institutions. Failure to successfully integrate businesses that we acquire could have an adverse effect on our profitability, return on equity, return on assets, or our ability to implement our strategy, any of which in turn could have a material adverse effect on our business, financial condition, and results of operations.

The fair value of our investment securities may decline.

As of December 31, 2023, the fair value of our available for sale securities portfolio was approximately $142.2 million. Factors beyond our control can significantly influence the fair value of our securities and can cause adverse changes to the fair value of these securities. These factors include rating agency actions, defaults by or other adverse events affecting the issuer, lack of liquidity, changes in market interest rates, and continued instability in the capital markets. A prolonged decline in the fair value of our securities could result in an established allowance for credit losses, which would affect our results of operations.

​

The financial services industry is undergoing rapid technological changes and we may not have the resources to implement new technology to stay current with these changes.

​

The financial services industry is undergoing rapid technological changes with frequent introductions of new technology-driven products and services (including those related to or involving artificial intelligence, machine learning, blockchain and other distributed ledger technologies) and a growing demand for mobile and other phone and computer banking applications. In addition to better serving clients, the effective use of technology increases efficiency and enables financial institutions to reduce costs. Our future success will depend in part upon our ability to address the needs of our clients by using technology to provide products and services that will satisfy client demands for convenience as well as to provide secure electronic environments and create additional efficiencies in our operations as we continue to grow and expand our market area. Many of our larger competitors have substantially greater resources to invest in technological improvements and have invested significantly more than us in technological improvements. As a result, they may be able to offer additional or more convenient products compared to those that we will be able to provide, which would put us at a competitive disadvantage. Some of these competitors consist of financial technology providers who are beginning to offer more traditional banking products and may either acquire a bank charter or obtain a bank-like charter, such as the Fintech charter provided by the OCC. Accordingly, we may not be able to effectively implement new technology-driven products and services or be successful in marketing such products and services to our clients, which could impair our growth and profitability. In addition, some of our competitors are subject to less regulation and/or more favorable tax treatment, which may put us at a competitive disadvantage.

​

We may not be able to successfully implement current or future information technology system enhancements and operational initiatives, which could adversely affect our business operations and profitability.

​

We continue to invest significant resources in our core information technology systems in order to provide functionality and security at an appropriate level, and to improve our operating efficiency and to streamline our client experience. These initiatives significantly increase the complexity of our relationships with third-party service providers and such relationships may be difficult to unwind. We may not be able to successfully implement and integrate such system enhancements and initiatives, which could adversely impact our ability to comply with a number of legal and regulatory requirements, which could result in sanctions from regulatory authorities. In addition, these projects could have higher than expected costs and/or result in operating inefficiencies, which could increase the costs associated with the implementation as well as ongoing operations. Failure to properly utilize system enhancements that are implemented in the future could result in impairment charges that adversely impact our financial condition and results of operations, could

28

Table of Contents

result in significant costs to remediate or replace the defective components, and could impact our ability to compete. In addition, we may incur significant training, licensing, maintenance, consulting, and amortization expense during and after implementation, and any such costs may continue for an extended period of time. As such, we cannot guarantee that the anticipated long-term benefits of these system enhancements and operational initiatives will be realized.

​

We rely extensively on information technology systems to operate our business and an interruption or security breach may disrupt our business operations, result in reputational harm, and have an adverse effect on our operations.

​

As a complex financial institution, we rely extensively on our information technology systems to operate our business, including to process, record, and monitor a large number of client transactions on a continuous basis. As client, public, and regulatory expectations regarding operational and information security have increased, our operational systems and infrastructure must continue to be safeguarded and monitored for potential failures, disruptions, and breakdowns. Our business, financial, accounting, data processing systems, or other operating systems and facilities may stop operating properly or become disabled or damaged as a result of a number of factors including events that are wholly or partially beyond our control. For example, there could be sudden increases in client transaction volume; electrical or telecommunications outages; natural disasters such as earthquakes, tornadoes, and hurricanes; disease pandemics; events arising from local or larger scale political or social matters, including terrorist acts; and, as described below, cyber-attacks. While we have policies, procedures, and systems designed to prevent or limit the effect of possible failures, interruptions, or breaches in security of information systems and business continuity programs designed to provide services in the case of such events, there is no guarantee that these safeguards or programs will address all of the threats that continue to evolve.

​

System failure or breaches of our network security, or the security of our third-party data processing partner, including as a result of cyberattacks or data security breaches, could subject us to increased operating costs as well as litigation and other liabilities.

The computer systems and network infrastructure we use may be vulnerable to physical theft, fire, power loss, telecommunications failure or a similar catastrophic event, as well as security breaches, denial of service attacks, viruses, worms and other disruptive problems caused by hackers. Any damage or failure that causes breakdowns or disruptions in our client relationship management, general ledger, deposit, loan and other systems could damage our reputation, result in a loss of client business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on us.

Computer break-ins, phishing and other disruptions could also jeopardize the security of information stored in and transmitted through our computer systems and network infrastructure. Information security risks have generally increased in recent years in part because of the proliferation of new technologies, the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, activists, and other external parties. Our operations rely on the secure processing, transmission and storage of confidential information in our computer systems and networks. Although we believe we have robust information security procedures and controls, our technologies, systems, networks, and our clients’ devices may become the target of cyberattacks or information security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of our or our clients’ confidential, proprietary and other information, or otherwise disrupt our or our clients’ business operations. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. In addition, as the regulatory environment related to information security, data collection and use, and privacy becomes increasingly rigorous, with new and constantly changing requirements applicable to our business, compliance with those requirements could also result in additional costs.

We are under continuous threat of loss due to hacking and cyberattacks especially as we continue to expand client capabilities to utilize internet and other remote channels to transact business. While we are not aware of any successful hacking or cyberattacks into our computer or other information technology systems, there can be no assurance that we will not be the victim of successful hacking or cyberattacks in the future that could cause us to suffer material losses. The occurrence of any cyberattack or information security breach could result in potential liability to clients, reputational damage,

29

Table of Contents

disclosure obligations, the disruption of our operations, and regulatory concerns, all of which could adversely affect our business, financial condition or results of operations.

We are subject to certain operational risks, including, but not limited to, client or employee fraud and data processing system failures and errors.

Employee errors and employee and client misconduct could subject us to financial losses or regulatory sanctions and seriously harm our reputation. Misconduct by our employees could include hiding unauthorized activities from us, improper or unauthorized activities on behalf of our clients or improper use of confidential information. It is not always possible to prevent employee errors and misconduct, and the precautions we take to prevent and detect this activity may not be effective in all cases. Employee errors could also subject us to financial claims for negligence. We maintain a system of internal controls and insurance coverage to mitigate against operational risks. If our internal controls fail to prevent or detect an occurrence, or if any resulting loss is not insured or exceeds applicable insurance limits, it could have a material adverse effect on our business, financial condition and results of operations.

In addition, we rely heavily upon information supplied by third parties, including the information contained in credit applications, property appraisals, title information, equipment pricing and valuation and employment and income documentation, in deciding which loans we will originate, as well as the terms of those loans. If any of the information upon which we rely is misrepresented, either fraudulently or inadvertently, and the misrepresentation is not detected prior to asset funding, the value of the asset may be significantly lower than expected, or we may fund a loan that we would not have funded or on terms we would not have extended.

Fraud is an increasing risk for us and for all banks, and as such, we may experience increased losses due to fraud.

In recent years, fraud risk increased significantly for us and for all banks. Deposit fraud (check kiting, wire fraud, etc.) and card fraud continue to be significant sources of fraud attempts and losses in our consumer banking business. Moreover, our commercial clients have experienced increased levels of financial fraud risk as well, often requiring our involvement and assistance because of our banking relationship with these clients. The methods used to perpetrate and combat fraud continue to evolve as technology changes and more tools for access to financial services emerge, such as real-time payments. In addition to cybersecurity risks, new techniques have made it easier for bad actors to obtain and use client personal information, mimic signatures, and otherwise create false documents that look genuine. Fraud schemes are broad and can include debit card/credit card fraud, check fraud, NSF fraud, mechanical devices attached to ATM machines, social engineering and phishing attacks to obtain personal information, impersonation of our clients through the use of falsified or stolen credentials, employee fraud, information fraud, and other malfeasance. Criminals are turning to new sources to steal personally identifiable information in order to impersonate our clients to commit fraud. Our anti-fraud actions are both preventative (anticipating lines of attack, educating employees and clients, making operational changes) and responsive (remediating actual attacks). We have established policies, processes, and procedures to identify, measure, monitor, mitigate, report, and analyze these risks. We continue to invest in systems, resources, and controls to detect and prevent fraud. There are inherent limitations, however, to our risk management strategies, systems, and controls as they may exist, or develop in the future. We may not appropriately anticipate, monitor, or identify these risks. If our risk management framework proves ineffective, we could suffer unexpected losses, we may have to expend resources detecting and correcting the failure in our systems, and we may be subject to potential claims from third parties and government agencies. We may also suffer reputational damage. Any of these consequences could adversely affect our business, financial condition, or results of operations.

Our regulators require us to report fraud promptly, and regulators often advise banks of new schemes to enable the entire industry to adapt as quickly as possible. However, some level of fraud loss is unavoidable, and the risk of loss cannot be eliminated.

If our enterprise risk management framework is not effective at mitigating risk and loss to us, we could suffer unexpected losses and our results of operations could be materially adversely affected.

Our enterprise risk management framework seeks to achieve an appropriate balance between risk and return, which is critical to optimizing shareholder value. We have established processes and procedures intended to identify, measure,

30

Table of Contents

monitor, report, and analyze the types of risk to which we are subject, including strategic, market, credit, liquidity, capital, cybersecurity, operational, regulatory compliance, litigation, and reputational. However, as with any risk management framework, there are inherent limitations to our risk management strategies as there may exist, or develop in the future, risks that we have not appropriately anticipated or identified. For example, the financial and credit crisis and resulting regulatory reform highlighted both the importance and some of the limitations of managing unanticipated risks. If our risk management framework proves ineffective, we could suffer unexpected losses and our business and results of operations could be materially adversely affected.

Our ability to maintain our reputation is critical to the success of our business, and the failure to do so may materially adversely affect our performance.

Our reputation is one of the most valuable components of our business. As such, we strive to conduct our business in a manner that enhances our reputation. This is done, in part, by recruiting, hiring, and retaining and providing growth opportunities for employees who share our core values of being an integral part of the communities we serve, delivering superior service to our clients, caring about our clients and employees, and investing in our information technology and other systems. If our reputation is negatively affected by the actions of our employees or otherwise, including as a result of operational errors, clerical or record-keeping errors, or those resulting from faulty or disabled computer or telecommunications systems or a successful cyberattack against us or other unauthorized release or loss of client information, our reputation, business, and our operating results may be materially adversely affected. Damage to our reputation could also negatively impact our credit ratings and impede our access to the capital markets.

We rely on other companies to provide key components of our business infrastructure.

Third parties provide key components of our business operations such as our core technology infrastructure, cloud-based operations, data processing, recording and monitoring transactions, online banking interfaces and services, internet connections, and network access. We have selected these third-party vendors carefully and have conducted the due diligence consistent with regulatory guidance and best practices. While we have ongoing programs to review third party vendors and assess risk, we do not control their actions. Any problems caused by these third parties, including those resulting from disruptions in communication services provided by a vendor, issues at a third-party vendor of a vendor, failure of a vendor to handle current or higher volumes, cyber-attacks and security breaches at a vendor, failure of a vendor to provide services for any reason, or poor performance of services, could adversely affect our ability to deliver products and services to our clients and otherwise conduct our business. Financial or operational difficulties of a third-party vendor could also hurt our operations if those difficulties interfere with the vendor's ability to serve us. Furthermore, our vendors could also be sources of operational and information security risk to us, including from breakdowns or failures of their own systems or capacity constraints. Replacing these third-party vendors could also create significant delay and expense. Accordingly, use of such third parties creates an unavoidable inherent risk to our business operations. Our digital services growth initiatives, core technology upgrades, and digital asset initiatives constitute specific increases in third-party risk as such initiatives are distinctly dependent on the performance of our third-party partners.

We may need to raise additional capital in the future.

We are required to meet certain regulatory capital requirements and maintain sufficient liquidity. We may need to raise additional capital in the future to provide us with sufficient capital resources and liquidity to meet our commitments and business needs, which could include the possibility of financing acquisitions. Our ability to raise additional capital depends on conditions in the capital markets, economic conditions and a number of other factors, including investor perceptions regarding the banking industry, market conditions and governmental activities, and on our financial condition and performance. Accordingly, we may be unable to raise additional capital if needed or on terms acceptable to us. Further, such additional capital could result in dilution to our existing shareholders. If we or the Bank fail to maintain capital to meet regulatory requirements, our financial condition, liquidity and results of operations, as well as our ability to maintain compliance with regulatory capital requirements, would be materially and adversely affected.

​

31

Table of Contents

The costs and effects of litigation, investigations or similar matters involving us or other financial institutions or counterparties, or related adverse facts and developments, could materially affect our business, operating results and financial condition.

We may be involved from time to time in a variety of litigation, investigations, inquiries, or similar matters arising out of our business. Furthermore, litigation against banks tend to increase during economic downturns and periods of credit deterioration, which may occur or worsen as a result of current economic uncertainty. Most recently there has been an increase in class action lawsuits filed claiming deceptive practices or violations of account terms in connection with non-sufficient fees or overdraft charges. We manage these risks through internal controls, personnel training, insurance, litigation management, our compliance and ethics processes, and other means. However, the commencement, outcome, and magnitude of litigation cannot be predicted or controlled with any certainty.

We establish reserves for legal claims when payments associated with the claims become probable and the losses can be reasonably estimated. However, our insurance may not cover all claims that may be asserted against us and indemnification rights to which we are entitled may not be honored, and any claims asserted against us, regardless of merit or eventual outcome, may harm our reputation. Should the ultimate judgments or settlements in any litigation or investigation significantly exceed our insurance coverage, they could have a material adverse effect on our business, financial condition, and results of operations. In addition, premiums for insurance covering the financial and banking sectors are rising. We may not be able to obtain appropriate types or levels of insurance in the future, nor may we be able to obtain adequate replacement policies with acceptable terms or at historic rates, if at all.

Changes in accounting standards could materially impact our financial statements.

From time to time, FASB or the SEC may change the financial accounting and reporting standards that govern the preparation of our financial statements. Such changes may result in us being subject to new or changing accounting and reporting standards. In addition, the bodies that interpret the accounting standards (such as banking regulators or outside auditors) may change their interpretations or positions on how these standards should be applied. These changes may be beyond our control, can be hard to predict and can materially impact how we record and report our financial condition and results of operations. In some cases, we could be required to apply a new or revised standard retrospectively, or apply an existing standard differently, also retrospectively, in each case resulting in our needing to revise or restate prior period financial statements.

Risks related to the business environment and our industry

The Company is subject to extensive government regulation and supervision, which may interfere with our ability to conduct our business and may negatively impact our financial results.

The Company, primarily through the Bank and certain non-bank subsidiaries, are subject to extensive federal and state regulation and supervision. Banking regulations are primarily intended to protect depositors’ funds and the safety and soundness of the banking system as a whole, and not shareholders. These regulations affect the Bank’s lending practices, capital structure, investment practices, dividend policy and growth, among other things. Congress and federal regulatory agencies continually review banking laws, regulations and policies for possible changes. Changes to statutes, regulations or regulatory policies, including changes in interpretation or implementation of statutes, regulations or policies, could affect the Company and/or the Bank in substantial and unpredictable ways. Such changes could subject the Company and/or the Bank to additional costs, limit the types of financial services and products the Company and/or the Bank may offer, and/or limit the pricing the Company and/or the Bank may charge on certain banking services, among other things. Compliance personnel and resources may increase our costs of operations and adversely impact our earnings.

Failure to comply with laws, regulations or policies could result in sanctions by regulatory agencies, civil money penalties and/or reputation damage, which could have a material adverse effect on our business, financial condition and results of operations. While the Company has policies and procedures designed to prevent any such violations, there can be no assurance that such violations will not occur. See “Business - Supervision and Regulation”.

​

32

Table of Contents

Federal regulatory agencies, including the Federal Reserve and the OCC, periodically conduct examinations of our business, including for compliance with laws and regulations, and our failure to comply with any supervisory actions to which we are or become subject as a result of such examinations may adversely affect our business.

Federal regulatory agencies, including the Federal Reserve and the OCC, periodically conduct examinations of our business, including our compliance with laws and regulations. If, as a result of an examination, an agency was to determine that the financial, capital resources, asset quality, earnings prospects, management, liquidity, or other aspects of any of our operations had become unsatisfactory, or violates any law or regulation, such agency may take certain remedial or enforcement actions it deems appropriate to correct any deficiency. Remedial or enforcement actions include the power to enjoin “unsafe or unsound” practices, to require affirmative actions to correct any conditions resulting from any violation or practice, to issue an administrative order that can be judicially enforced against a bank, to direct an increase in the bank’s capital, to restrict the bank’s growth, to assess civil monetary penalties against a bank’s officers or directors, and to remove officers and directors. The CFPB also has authority to take enforcement actions, including cease-and-desist orders or civil monetary penalties, if it finds that we offer consumer financial products and services in violation of federal consumer financial protection laws.

If we were unable to comply with future regulatory directives, or if we were unable to comply with the terms of any future supervisory requirements to which we may become subject, then we could become subject to a variety of supervisory actions and orders, including cease-and-desist orders, prompt corrective actions, memoranda of understanding and other regulatory enforcement actions. Such supervisory actions could, among other things, impose greater restrictions on our business, as well as our ability to develop any new business. We could also be required to raise additional capital, dispose of certain assets and liabilities within a prescribed time period, or both. Failure to implement remedial measures as required by financial regulatory agencies could result in additional orders or penalties from federal and state regulators, which could trigger one or more of the remedial actions described above. The terms of any supervisory action and associated consequences with any failure to comply with any supervisory action could have a material negative effect on our business, operating flexibility and overall financial condition.

Further, bank failures, such as the ones occurring in 2023, have and may in the future diminish public confidence in small and regional banks’ abilities to safeguard deposits in excess of federally insured limits, which could prompt customers to maintain their deposits with larger financial institutions. Concerns over rapid, large-scale deposit movement have and could in the future heighten regulatory scrutiny surrounding liquidity and increase competition for deposits and the resulting cost of funding, which could create pressure on net interest margin and results of operations. In addition, bank failures have and could in the future prompt the FDIC to increase deposit insurance costs. Increases in funding, deposit insurance or other costs as a result of these types of events have and could in the future materially adversely affect our financial condition and results of operations. Further, the disruption following these types of events have and could in the future generate significant market trading volatility among publicly traded bank holding companies and, in particular, regional banks like the Company.

We are subject to lending concentration risk, which could cause our regulators to restrict our ability to grow.

A substantial portion of our loan portfolio is secured by real estate. In weak economies, or in areas where real estate market conditions are distressed, we may experience a higher than normal level of nonperforming real estate loans. The collateral value of the portfolio and the revenue stream from those loans could come under stress, and additional provisions for the allowance for credit losses could be necessitated. Our ability to dispose of foreclosed real estate at prices at or above the respective carrying values could also be impaired, causing additional losses.

Commercial real estate (“CRE”) is cyclical and poses risks of loss to us due to our concentration levels and risk of the asset, especially during a difficult economy, including the current stressed economy. As of December 31, 2023, 50.8% of our loan portfolio was comprised of loans secured by commercial real estate. The banking regulators continue to give CRE lending greater scrutiny, and banks with higher levels of CRE loans are expected to implement improved underwriting, internal controls, risk management policies and portfolio stress testing, as well as higher levels of allowances for possible losses and capital levels as a result of CRE lending growth and exposures.

Although we are actively working to manage our CRE concentration and believe that our underwriting policies, management information systems, independent credit administration process, and monitoring of real estate loan concentrations are currently sufficient to address the CRE Concentration Guidance, the OCC or other federal regulators could become

33

Table of Contents

concerned about our CRE loan concentrations, and they could limit our ability to grow by, among other things, restricting their approvals for the establishment or acquisition of branches, or approvals of mergers or other acquisition opportunities. Our loan portfolio contains several industry and collateral concentrations including, but not limited to, commercial and residential real estate. Due to the exposure in these concentrations, disruptions in markets, economic conditions, changes in laws or regulations or other events could cause a significant impact on the ability of borrowers to repay and may have a material adverse effect on our business, financial condition and results of operations.

​

The Federal Reserve may require us to commit capital resources to support the Bank.

The Federal Reserve, which examines us and the Bank, requires a bank holding company to act as a source of financial and managerial strength to a subsidiary bank and to commit resources to support such subsidiary bank. Under the “source of strength” doctrine, the Federal Reserve may require a bank holding company to make capital injections into a troubled subsidiary bank and may charge the bank holding company with engaging in unsafe and unsound practices for failure to commit resources to such a subsidiary bank. In addition, the Dodd-Frank Act directs the federal bank regulators to require that all companies that directly or indirectly control an insured depository institution serve as a source of strength for the institution. Under these requirements, in the future, we could be required to provide financial assistance to the Bank if it experiences financial distress.

A capital injection may be required at times when we do not have the resources to provide it, and therefore we may be required to borrow the funds. In the event of a bank holding company’s bankruptcy, the bankruptcy trustee will assume any commitment by the holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank. Moreover, bankruptcy law provides that claims based on any such commitment will be entitled to a priority of payment over the claims of the holding company’s general unsecured creditors, including the holders of its note obligations. Thus, any borrowing that must be done by the holding company in order to make the required capital injection becomes more difficult and expensive and will adversely impact the holding company’s cash flows, financial condition, results of operations and prospects.

The Company may be subject to more stringent capital requirements.

The Bank is subject to capital adequacy guidelines and other regulatory requirements specifying minimum amounts and types of capital which the Bank must maintain. From time to time, the regulators implement changes to these regulatory capital adequacy guidelines. If the Bank fails to meet these minimum capital guidelines and other regulatory requirements, our financial condition would be materially and adversely affected. We may also be required to satisfy additional capital adequacy standards as determined by the Federal Reserve. These requirements, and any other new regulations, could adversely affect our ability to pay dividends, or could require us to reduce business levels or to raise capital, including in ways that may adversely affect our financial condition or results of operations.

Monetary policies and regulations of the Federal Reserve could adversely affect our business, financial condition and results of operations.

​

In addition to being affected by general economic conditions, our earnings and growth are affected by the policies of the Federal Reserve. An important function of the Federal Reserve is to regulate the money supply and credit conditions. Among the instruments used by the Federal Reserve to implement these objectives are open market operations in U.S. government securities, adjustments of the discount rate and changes in reserve requirements against bank deposits. These instruments are used in varying combinations to influence overall economic growth and the distribution of credit, bank loans, investments and deposits. Their use also affects interest rates charged on loans or paid on deposits. The monetary policies and regulations of the Federal Reserve have had a significant effect on the operating results of commercial banks in the past and are expected to continue to do so in the future. The effects of such policies upon our business, financial condition and results of operations cannot be predicted.

ESG risks could adversely affect our reputation and shareholder, employee, client and third-party relationships and may negatively affect our stock price.

34

Table of Contents

Our business faces increasing public scrutiny related to environmental, social and governance (“ESG”) activities. We risk damage to our brand and reputation if we fail to act responsibly in a number of areas, such as diversity, equity, inclusion, environmental stewardship, human capital management, support for our local communities, corporate governance and transparency, or fail to consider ESG factors in our business operations.

Furthermore, as a result of our diverse base of clients and business partners, we may face potential negative publicity based on the identity of our clients or business partners and the public’s (or certain segments of the public’s) view of those entities. Such publicity may arise from traditional media sources or from social media and may increase rapidly in size and scope. If our client or business partner relationships were to become intertwined in such negative publicity, our ability to attract and retain clients, business partners, and employees may be negatively impacted, and our stock price may also be negatively impacted. Additionally, we may face pressure to not do business in certain industries that are viewed as harmful to the environment or are otherwise negatively perceived, which could impact our growth. Additionally, investors and shareholder advocates are placing ever increasing emphasis on how corporations address ESG issues in their business strategy when making investment decisions and when developing their investment theses and proxy recommendations. We may incur meaningful costs with respect to our ESG efforts and if such efforts are negatively perceived, our reputation and stock price may suffer. In addition, ongoing legislative or regulatory uncertainties and changes regarding climate risk management and practices may result in higher regulatory, compliance, credit and reputational risks and costs.

Our deposit insurance premiums could be substantially higher in the future, which could have a material adverse effect on our future earnings.

The FDIC insures deposits at FDIC-insured depository institutions, such as the Bank, up to applicable limits. The amount of a particular institution’s deposit insurance assessment is based on that institution’s risk classification under an FDIC risk-based assessment system. An institution’s risk classification is assigned based on its capital levels and the level of supervisory concern the institution poses to its regulators. We are generally unable to control the amount of premiums that we are required to pay for FDIC insurance. Any future additional assessments, increases or required prepayments in FDIC insurance premiums could reduce our profitability, may limit our ability to pursue certain business opportunities or otherwise negatively impact our operations.

We are subject to federal and state fair lending laws, and failure to comply with these laws could lead to material penalties.

Federal and state fair lending laws and regulations, such as the Equal Credit Opportunity Act and the Fair Housing Act, impose nondiscriminatory lending requirements on financial institutions. The Department of Justice, CFPB and other federal and state agencies are responsible for enforcing these laws and regulations. Private parties may also have the ability to challenge an institution’s performance under fair lending laws in private class action litigation. A successful challenge to our performance under the fair lending laws and regulations could adversely impact our rating under the Community Reinvestment Act and result in a wide variety of sanctions, including the required payment of damages and civil money penalties, injunctive relief, imposition of restrictions on merger and acquisition activity and restrictions on expansion activity, which could negatively impact our reputation, business, financial condition and results of operations.

We could face a risk of noncompliance and enforcement action with the Bank Secrecy Act and other anti-money laundering statutes and regulations.

The Bank Secrecy Act of 1970, the USA PATRIOT Act and other laws and regulations require financial institutions, among other duties, to institute and maintain effective anti-money laundering programs and file suspicious activity and currency transaction reports as appropriate. FinCEN, established by the U.S. Department of the Treasury to administer the Bank Secrecy Act, is authorized to impose significant civil money penalties for violations of those requirements and engages in coordinated enforcement efforts with the individual federal banking regulators, as well as the U.S. Department of Justice, Drug Enforcement Administration and IRS. There is also increased scrutiny of compliance with the rules enforced by OFAC related to U.S. sanctions regimes. If our policies, procedures and systems are deemed deficient or the policies, procedures and systems of the financial institutions that we have already acquired or may acquire in the future are deficient, we would be subject to liability, including fines and regulatory actions such as restrictions on our ability to pay dividends and the necessity to obtain regulatory approvals to proceed with certain aspects of our business plan, including our acquisition

35

Table of Contents

plans, which would negatively impact our business, financial condition and results of operations. Failure to maintain and implement adequate programs to combat money laundering and terrorist financing could also have serious reputational consequences for us. See “Business-Supervision and Regulation.”

​

Recent negative developments affecting the banking industry, and resulting media coverage, have eroded customer confidence in the banking system.

​

The closures of Silicon Valley Bank and Signature Bank in March 2023 and First Republic Bank in May 2023, and concerns about similar future events, have generated significant market volatility among publicly traded bank holding companies and, in particular, regional banks like the Company. These market developments have negatively impacted customer confidence in the safety and soundness of regional banks. As a result, customers may choose to maintain deposits with larger financial institutions or invest in higher yielding short-term fixed income securities, all of which could materially adversely impact the Company’s liquidity, loan funding capacity, net interest margin, capital and results of operations. While the Department of the Treasury, the Federal Reserve, and the FDIC took action to ensure that depositors of these failed banks had access to their deposits, including uninsured deposit accounts, there is no guarantee that such actions will be successful in restoring customer confidence in regional banks and the banking system more broadly.

We also anticipate increased regulatory scrutiny – in the course of routine examinations and otherwise – and new regulations directed towards banks of similar size to the Bank, designed to address the recent negative developments in the banking industry, all of which may increase our costs of doing business and reduce our profitability. Among other things, there may be an increased focus by both regulators and investors on deposit composition, the level of uninsured deposits, the level of unrealized losses in either available-for-sale or held-to-maturity securities portfolios, contingent liquidity, CRE loan composition and concentration, capital position, and general oversight and internal control structures regarding the foregoing. This could impact our ability to achieve our strategic objectives and may result in changes to our balance sheet position which could, in turn, negatively impact our profitability.

​

Risks related to our common stock

Applicable laws and regulations restrict both the ability of the Bank to pay dividends to the Company and the ability of the Company to pay dividends to our shareholders.

Both the Company and the Bank are subject to various regulatory restrictions relating to the payment of dividends. In addition, the Federal Reserve has the authority to prohibit bank holding companies from engaging in unsafe or unsound practices in conducting their business. These federal and state laws, regulations and policies are described in greater detail in “Business— Supervision and Regulation—Payment of Dividends,” but generally look to factors such as previous results and net income, capital needs, asset quality, existence of enforcement or remediation proceedings, and overall financial condition.

For the foreseeable future, the majority, if not all, of the Company’s revenue will be from any dividends paid to the Company by the Bank. Accordingly, our ability to pay dividends also depends on the ability of the Bank to pay dividends to us. Furthermore, the present and future dividend policy of the Bank is subject to the discretion of its board of directors.

We cannot guarantee that the Company or the Bank will be permitted by financial condition or applicable regulatory restrictions to pay dividends, that the board of directors of the Bank will elect to pay dividends to us, nor can we guarantee the timing or amount of any dividend actually paid.

​

Our securities are not FDIC insured.

​

Securities that we issue, including our common stock, are not savings or deposit accounts or other obligations of any bank, insured by the FDIC, any other governmental agency or instrumentality, or any private insurer, and are subject to investment risk, including the possible loss of our shareholders’ investments.

36

Table of Contents

​

​

​

ITEM 1B. UNRESOLVED STAFF COMMENTS

None.

​

37

Table of Contents

ITEM 1C. CYBERSECURITY

Cybersecurity Risk Management and Strategy

Assessing, identifying and managing material risks from cybersecurity threats is critical for maintaining the security of the Company’s data and information systems, and is integrated into our enterprise risk management systems and processes. The Bank’s approach to cybersecurity risk management and strategy is based on the FFIEC Cybersecurity Assessment Tool (“CAT”), which provides a repeatable and measurable process for evaluating cybersecurity preparedness and assessing, identifying, and managing material risks from cybersecurity threats. The CAT incorporates cybersecurity-related principles from the FFIEC Information Technology Examination Handbook and regulatory guidance, and concepts from other industry standards, including the National Institute of Standards and Technology Cybersecurity Framework.

The CAT consists of two parts:  Cybersecurity Inherent Risk Profile and Cybersecurity Maturity. Completion of both parts of the CAT allow management and the Board to evaluate whether the Company’s cybersecurity risk and preparedness are aligned. The Cybersecurity Inherent Risk Profile is the level of risk posed to the Company by technologies and connection types, delivery channels, online/mobile products and technology services, organizational characteristics and external threats. Cybersecurity Maturity is designed to help management measure the Company’s level of risk and corresponding controls under the following five domains:  (i) Cyber Risk Management and Oversight; (ii) Threat Intelligence and Collaboration; (iii) Cybersecurity Controls; (iv) External Dependency Management; and (v) Cyber Incident Management and Resilience.

The Information Security Officer (“ISO”) and the Company’s Information Technology Committee conduct and review the CAT annually to identify changes to the Company’s inherent risk profile; when new threats arise or when considering changes to the business strategy, such as expanding operations, offering new products and services, or entering into new third-party relationships that support critical activities. Consequently, management can determine whether additional risk management practices or controls are needed to maintain or augment the Company’s cybersecurity maturity.

In an effort to continually share threat intelligence and increase awareness of cybersecurity trends, the Company has also implemented a Cybersecurity Education and Awareness Program. This program includes the following components:

To date, we have not experienced a cybersecurity incident that has materially impacted our business strategy, results of operations, or financial condition. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, result of operations or financial condition. Please see Part I, Item 1A. Risk Factors for further discussion of the risks associated with an interruption or breach in our information systems or infrastructure.

Board and Management Governance

The Company’s Board of Directors recognizes the importance of maintaining the trust and confidence of our customers, employees, and shareholders. The Board of Directors’ responsibilities for cybersecurity risk management and strategy include the following:

38

Table of Contents

The Company has also appointed an ISO, who reports directly to the Audit Committee and shares a co-sourced relationship with an outside consulting firm. The ISO has been with Bank First for over 10 years in various operational and administrative roles.  For the past four years, he has served as the Bank’s Enterprise Risk Manager, and as ISO for the past two years.  In 2022, he earned the Certified Banking Security Manager certification from SBS Cybersecurity. The ISO works closely with the head of Information Technology to ensure that the Bank’s cybersecurity controls are in line with established internal culture, Board expectations and risk appetite, and all regulatory requirements. The ISO’s responsibilities include the following:

​

​

​

39

Table of Contents

ITEM 2. PROPERTIES

Our main office is located at 402 North 8^th Street, Manitowoc, Wisconsin 54220. In addition, the Bank operates twenty-six (26) additional branches located in fourteen (14) counties in Wisconsin, which includes the branches that were acquired in connection with the Company’s recent acquisitions. The addresses of these offices are provided below. We believe these premises will be adequate for present and anticipated needs and that we have adequate insurance to cover our owned and leased premises. For each property that we lease, we believe that upon expiration of the lease we will be able to extend the lease on satisfactory terms or relocate to another acceptable location:

​