Bancorp, Inc. [TBBK] Filings

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

________________

FORM 10-K

_______________

(Mark One)

For the fiscal year ended December 31, 2023

OR

For the transition period from ______ to ______

Commission File Number 000-51018

The Bancorp, Inc.

(Exact name of registrant as specified in its charter)

Registrant’s telephone number, including area code: (302) 385-5000

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act:

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.    Yes  o    No  x

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.    Yes  o    No  x

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.    Yes  x    No  o

Indicate by check mark whether the registrant has submitted electronically, every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes  x    No  o

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.    

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. o

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. x

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. o

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). o

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act).    Yes  o    No  x

The aggregate market value of the common shares of the registrant held by non-affiliates of the registrant, based upon the closing price of such shares on June 30, 2023 of $32.65 was approximately $1.72 billion.

As of February 26, 2024, 52,748,985 shares of common stock, par value $1.00 per share, of the registrant were outstanding.

Portions of the proxy statement for registrant’s 2024 Annual Meeting of Shareholders are incorporated by reference in Part III of this Form 10-K. 

FORWARD-LOOKING STATEMENTS

This Annual Report on Form 10-K contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995.

Words such as “anticipates,” “estimates,” “expects,” “projects,” “intends,” “plans,” “believes,” “should” and words and terms of similar substance used in connection with any discussion of future operating and financial performance identify these forward-looking statements. Unless we have indicated otherwise, or the context otherwise requires, references in this report to “we,” “us,” “our,” “the holding company” or similar terms, are to The Bancorp, Inc. and its subsidiaries.

Forward-looking statements are based upon the current beliefs and expectations of our management and are inherently subject to significant business, economic and competitive uncertainties and contingencies, many of which are difficult to predict and generally beyond our control. In addition, these forward-looking statements are subject to assumptions with respect to future business strategies and decisions that are subject to change. Actual results may differ materially from the anticipated results discussed in these forward-looking statements.

Factors that could cause results to differ from those expressed in these forward-looking statements include, but are not limited to, the risks and uncertainties described or referenced in Item 1A, “Risk Factors” herein and in our other public filings with the Securities and Exchange Commission (the “SEC”), as well as the following:

an inconsistent recovery from an extended period of unpredictable economic and growth conditions in the U.S. economy may adversely impact our assets and operating results and result in increases in payment defaults and other credit risks, decreases in the fair value of some assets and increases in our provision for credit losses;

weak economic and credit market conditions, either globally, nationally or regionally, may result in a reduction in our capital base, reducing our ability to maintain deposits at current levels;

changes in the interest rate environment, particularly in response to inflation, could adversely affect our revenue and expenses and the availability and cost of capital, cash flows and liquidity;

volatility in the banking sector (including perception of such conditions) and responsive actions taken by governmental agencies to stabilize the financial system could result in increased regulation or liquidity constraints;

operating costs may increase;

adverse legislation or governmental or regulatory policies may be promulgated;

we may fail to satisfy our regulators with respect to legislative and regulatory requirements;

management and other key personnel may leave or change roles without effective replacements;

increased competition may reduce our client base or cause us to lose market share;

the costs of our interest-bearing liabilities, principally deposits, may increase relative to the interest received on our interest-bearing assets, principally loans, thereby decreasing our net interest income;

loan and investment yields may decrease, resulting in a lower net interest margin;

geographic concentration could result in our loan portfolio being adversely affected by regional economic factors;

the market value of real estate that secures certain of our loans may be adversely affected by economic and market conditions and other conditions outside of our control such as lack of demand, natural disasters, changes in neighborhood values, competitive overbuilding, weather, casualty losses and occupancy rates;

cybersecurity risks, including data security breaches, ransomware, malware, “denial of service” attacks and identity theft, could result in disclosure of confidential information, operational interruptions and legal and financial exposure;   

natural disasters, pandemics, other public health crises, acts of terrorism, geopolitical conflict, including sanctions, war or armed conflict, such as the conflicts between Russia and Ukraine and Israel and Hamas and the possible expansion of such conflicts in surrounding areas, or other catastrophic events could disrupt the systems of us or third party service providers and negatively impact general economic conditions;

we may not be able to sustain our historical growth rates in our loan, prepaid and debit card and other lines of business;

our internal controls and procedures may fail or be circumvented, and our risk management policies may not be adequate; and

we may not be able to manage credit risk to desired levels, improve our net interest margin and monitor interest rate sensitivity, manage our real estate exposure to capital levels and maintain flexibility if we achieve asset growth.

We caution you not to place undue reliance on these forward-looking statements, which speak only as of the date of this report. All subsequent written and oral forward-looking statements attributable to us or any person acting on our behalf are expressly qualified in their entirety by the cautionary statements contained or referred to in this section. Except to the extent required by applicable law or regulation, we undertake no obligation to update these forward-looking statements to reflect events or circumstances after the date of this report or to reflect the occurrence of unanticipated events.

‎

PART I

ITEM 1. BUSINESS.

Overview

The Bancorp, Inc. (“the Company,” “we,” “us,” “our” or “the holding company”) is a Delaware financial holding company and our primary, wholly-owned subsidiary is The Bancorp Bank, National Association (“the “Bank”). The vast majority of our revenue and income is generated through the Bank. As described more fully below, our business strategy is focused on payments and deposit related activities. We expect our payments business to generate non-interest income and attract stable, lower cost deposits which we then seek to deploy into lower risk assets in specialized markets through our specialty lending activities.

Our national specialty lending segment includes institutional banking, commercial real estate bridge lending, small business lending and commercial fleet leasing. Our institutional banking business line offers securities-backed lines of credit (“SBLOC”) and insurance policy cash value-backed lines of credit (“IBLOC”) through affinity groups such as investment advisors. SBLOCs and IBLOCs are collateralized by marketable securities and the cash value of insurance policies, respectively, and are typically offered in conjunction with brokerage accounts. Our institutional banking business line also offers financing to investment advisors, made for purposes of debt refinance, acquisition of another firm or internal succession. Additionally, we offer commercial real estate bridge loans (sometimes referred to herein as “REBL” or “real estate bridge loans”), the vast majority of which are collateralized by apartment buildings. We also offer small business loans (“SBLs”) which are comprised primarily of Small Business Administration (“SBA”) loans and vehicle fleet leasing and, to a lesser extent, other equipment leasing (“direct lease financing”) to small- and medium-sized businesses. Vehicle fleet and equipment leases consist of commercial vehicles including trucks and special purpose vehicles and equipment.

At December 31, 2023, loan types and amounts were:

SBLOC and IBLOC –$1.63 billion, or approximately 29% of total loans and commercial loans, at fair value;

Investor advisor financing –$221.6 million, or approximately 4% of total loans and commercial loans, at fair value;

Direct lease financing –$685.7 million, or approximately 12% of total loans and commercial loans, at fair value;

Commercial real estate bridge loans, at fair value (excluding SBA, at fair value) –$213.5 million, or approximately 4% of total loans and commercial loans, at fair value;

REBL –$2.00 billion, or approximately 35% of total loans and commercial loans, at fair value; and

SBL (including SBA, at fair value) –$896.2 million (including SBA held at fair value), or approximately 16% of total loans and commercial loans, at fair value.

Commercial real estate loans, at fair value consist of REBL loans originated for securitization but which we now intend to hold on our balance sheet. Our investment portfolio amounted to $747.5 million at December 31, 2023, representing a decrease from the prior year.

The majority of our deposits and non-interest income are generated in our payments segment, or Fintech Solutions Group, which consists of consumer transaction accounts accessed by Bank-issued prepaid or debit cards and payment companies that process their clients’ corporate and consumer payments, automated clearing house (“ACH”) accounts, the collection of card payments on behalf of merchants and other payments through our Bank. The card-accessed deposit accounts are comprised of debit and prepaid card accounts that are generated by companies that market directly to end users. Our card-accessed deposit account types are diverse and include: consumer and business debit, general purpose reloadable prepaid, pre-tax medical spending benefit, payroll, gift, government, corporate incentive, reward, business payment accounts and others. Our ACH accounts facilitate bill payments and our acquiring accounts provide clearing and settlement services for payments made to merchants which must be settled through associations such as Visa or Mastercard. Consumer transaction account banking services are provided to organizations with a pre-existing customer base tailored to support or complement the services provided by these organizations to their customers, which we refer to as “affinity or private label banking.” These services include loan and deposit accounts for investment advisory companies through our Institutional Banking department. We typically provide these services under the name and through the facilities of each organization with whom we develop a relationship.

Our Strategies

Our principal strategies are to:

Fund our Loan and Investment Portfolio Growth with Stable Deposits and Generate Non-Interest Income from Prepaid and Debit Card Accounts and Other Payment Processing. Our principal focus is to grow our specialty lending operations and investment portfolio, and fund these loans and investments through a variety of sources that provide stable deposits, which are lower cost compared to certain other types of funding. Funding sources include prepaid and debit card accounts and balances generated through servicing companies providing various types of payment processing. We derive the largest component of our deposits and non-interest income from our prepaid, debit card and other payment related operations.   

Develop Relationships with Affinity Groups to Gain Sponsored Access to their Membership, Client or Customer Bases to Market our Services through Private Label Banking. We seek to continue to develop relationships with organizations with established membership, client or customer bases. Through these affinity group relationships, we gain access to an organization’s members, clients and customers under the organization’s sponsorship. We believe that by marketing targeted products and services to these constituencies through their pre-existing relationships with the organizations, we will continue to generate stable and lower cost deposits compared to certain other funding sources, generate fee income and, with respect to private label banking, lower our customer acquisition costs and build close customer relationships.

Offer Products Through Private Label Banking. Through our private label banking strategy, we provide our affinity group partners with banking services that have been customized to the needs of their respective customers. This allows these affinity groups to provide their members the affinity-branded banking services they desire. Affinity group websites identify the Bank as the provider of these banking services. We and the affinity group also may create products and services, or modify products and services already on our menu, that specifically relate to the needs and interests of the affinity group itself, or the affinity group’s members or customers. Our private label banking services have been developed to include both deposit and lending-related products and services.

We pay fees to certain affinity groups based upon deposits and loans they generate. These fees vary, and certain fees increase as market interest rates increase, while other fee rates may be fixed. Such fees comprise the majority of the interest expense on deposits in our consolidated statement of operations.

Service Companies which Provide Payment Services to Businesses and Individuals. We process payments through the banking system for payment companies which aggregate their clients’ payments using our infrastructure to transmit funds to the destination financial institutions of payees.

Use Our Existing Infrastructure as a Platform for Growth. We have made significant investments in our banking infrastructure to support our growth. We believe that this infrastructure can accommodate significant additional growth without proportionate increases in expense. We believe that this infrastructure enables us to maximize efficiencies through economies of scale as we grow without adversely affecting our relationships with our customers.

Specialty Finance: Lending Activities

Lending activities within our specialty lending segment include SBLOC, IBLOC and investment advisor loans, direct lease financing and SBLs.

SBLOC, IBLOC and Investment Advisor Financing. We make SBLOC loans to individuals, trusts and entities which are secured by a pledge of marketable securities maintained in one or more accounts with respect to which we obtain a securities account control agreement. The securities pledged may be either debt or equity securities or a combination thereof, but all such securities must be listed for trading on a national securities exchange or automated inter-dealer quotation system. SBLOCs are typically payable on demand. Most of our SBLOCs are drawn to meet a specific need of the borrower (such as for bridge financing of real estate) and are typically drawn for 12 to 18 months at a time. Maximum SBLOC line amounts are calculated by applying a standard “advance rate” calculation against the eligible security type depending on asset class: typically up to 50% for equity securities and mutual fund securities and 80% for investment grade (Standard & Poor’s rating of BBB- or higher, or Moody’s rating of Baa3 or higher) municipal or corporate debt securities. Borrowers generally must have a credit score of 660 or higher, although we may allow exceptions based upon a review of the borrower’s income, assets and other credit information. Substantially all SBLOCs have full recourse to the borrower. The underlying securities that act as collateral for our SBLOC commitments are monitored on a daily basis to confirm the

composition of the client portfolio and its daily market value. Although these accounts are closely monitored, severely falling markets or sudden drops in price with respect to individual pledged securities could result in the loan being under-collateralized and consequently in default and, upon sale of the collateral, could result in losses to the Bank. See Item 1A, “Risk Factors—The Bank may suffer losses in its loan portfolio despite its underwriting practices.”

We also make loans which are collateralized by the cash surrender value of eligible life insurance policies, or IBLOCs. Should a loan default, the primary risks for IBLOCs are if the insurance company issuing the policy were to become insolvent, or if that company would fail to recognize the Bank’s assignment of policy proceeds. To mitigate these risks, insurance company ratings are periodically evaluated for compliance with our standards. Additionally, the Bank utilizes assignments of cash surrender value.

The Bank also originates loans to investment advisors for purposes of debt refinance, acquisition of another firm or internal succession. Maximum loan amounts are limited to 70% of the estimated business enterprise value, based on a third-party valuation, but may be increased depending upon the debt service coverage ratio. Personal guarantees and blanket business liens are obtained as appropriate.

SBLOC and IBLOC loans are demand loans and generally reprice monthly, as the prime rate changes. Investment advisor loans generally have seven year terms with fixed rates.

Leases. We provide lease financing for commercial and government vehicle fleets, including trucks and other special purpose vehicles and, to a lesser extent, provide lease financing for other equipment. Our leases are either open-end or closed-end. An open-end lease is one in which, at the end of the lease term, the lessee must pay us the difference between the amount at which we sell the leased asset and the stated termination value. Termination value is a contractual value agreed to by the parties at the inception of a lease as to the value of the leased asset at the end of the lease term. A closed-end lease is one for which no such payment is due on lease termination. In a closed-end lease, the risk that the amount received on a sale of the leased asset will be less than the residual value is assumed by us, as lessor. We use a credit matrix which outlines the required financial information needed to evaluate credits over $150,000. For amounts less than $150,000 that meet a set criteria, we support our decisioning process by utilizing a scoring model. Terms for leases are generally 36 to 60 months.

SBLs. SBLs, or small business loans, consist primarily of SBA loans. We participate as an SBA Preferred Lender in two ongoing loan programs established by the SBA: the 7(a) Loan Guarantee Program (the “7(a) Program”) and the 504 Fixed Asset Financing Program (the “504 Program”). The 7(a) Program is designed to help small business borrowers start or expand their businesses by providing partial guarantees of loans made by banks and non-bank lending institutions for specific business purposes, including long- or short-term working capital; funds for the purchase of equipment, machinery, supplies and materials; funds for the purchase, construction or renovation of real estate; and funds to acquire, operate or expand an existing business or refinance existing debt, all under conditions established by the SBA. The terms of the loans must come within parameters set by the SBA, including borrower eligibility, loan maturity, and maximum loan amount. While 7(a) Program loans have historically had five to seven year average lives, they initially reprice between 90 days to 60 months, at which point rates are variable and adjust on a quarterly basis based on prime rate changes. 7(a) Program loan amounts are not limited to a percentage of estimated collateral value and are instead based on the business’s ability to repay the loan from its cash flow. 7(a) Program loans must be secured by all available business assets and personal real estate until the recovery value equals the loan amount or until all personal real estate of the borrower has been pledged. Personal guarantees are required from all owners of 20% or more of the equity of the business, although lenders may also require personal guarantees of owners of less than 20%. Loan guarantees can range up to 85% of loan principal for loans of up to $150,000 and 75% for loans in excess of that amount.

The SBA loan guaranty is typically paid to the lender after the liquidation of all collateral, but may be paid prior to liquidation of certain assets, mitigating the losses due to collateral deficiencies up to the percentage of the guarantee. To maintain the guarantee, we must comply with applicable SBA regulations, and we risk loss of the guarantee should we fail to comply. For further discussion of compliance risk and other risks associated with our SBA loans, see Item 1A, “Risk Factors— The success of our SBA lending program is dependent upon the continued availability of SBA loan programs, our status as a preferred lender under the SBA loan programs, our ability to comply with applicable SBA lending requirements and our ability to successfully manage related risks.”

The 504 Program is designed to provide small businesses with financing for the purchase of fixed assets, including real estate and buildings; the purchase of improvements to real estate; the construction of new facilities or modernizing, renovating or converting existing facilities; the purchase of long-term machinery and equipment; and debt refinancing. A 504 Program loan may not be used for working capital, trading asset purchases or investment in rental real estate. In a 504 Program financing, the borrower must supply 10% of the financing amount, we provide 50% of the financing amount and a Certified Development Company (“CDC”) provides 40% of

the financing amount. If the borrower has less than two years of operating history or if the assets being financed are considered “special purpose,” the funding percentages are 15%, 50% and 35%, respectively. If both conditions are met, the funding percentages are 20%, 50% and 30%, respectively. We receive a first lien on the assets being financed and the CDC receives a second lien. Personal guarantees of the principal owners of the business are required. The funds for the CDC loans are raised through a monthly auction of bonds that are guaranteed by the U.S. government and, accordingly, if the government guarantees are curtailed or terminated, our ability to make 504 Program loans would be curtailed or terminated. Certain basic loan terms, as with the 7(a) Program, are established by the SBA, including borrower eligibility, maximum loan amount, maximum maturity date, interest rates and loan fees. While real estate is appraised and values are established for other collateral, and the loan amount is limited to a percentage of cost of the assets being acquired by the borrower, such amounts may not be realized upon resale if the borrower defaults and the Bank forecloses on the collateral. 504 Program loans generally have rates which are variable after an initial five year period, at which point rates adjust every 90 days or 60 months based on prime rate changes.

SBA 7(a) Program and 504 Program loans may include construction advances which are subject to risk inherent to construction projects, including environmental risks, engineering defects, contractor risk and risk of project completion. Delays in construction may also compromise the owner’s business plan and result in additional stresses on cash flow required to service the loan. Higher than expected construction costs may also result, impacting repayment capability and collateral values.

Additionally, we make SBA loans to franchisees of various business concepts, including loans to multiple franchisees with the same concept. In making loans to franchisees, we consider franchisee failure rates for the specific franchise concept. However, factors adversely affecting a specific type of franchisor or franchise concept, including in particular risks that a franchise concept loses popularity with consumers or encounters negative publicity about its products or services, could harm the value not only of a particular franchisee’s business but also of multiple loans to other franchisees with the same concept.

Non-SBA Commercial Loans, at Fair Value and Real Estate Bridge Lending. Prior to 2020, we originated commercial real estate loans for sale into securitizations. In 2020, we decided to retain the loans which had not been sold on our balance sheet and continue to account for such loans at fair value. These loans are collateralized by various types of commercial real estate, primarily multi-family (apartment buildings) but also include legacy amounts of retail, hotel and office real estate, and do not have recourse to the borrower (except for carve-outs such as fraud) and, accordingly, generally depend on cash reserves and cash generated by the underlying properties for repayment. In the third quarter of 2021, we resumed the origination of apartment loans, which we also plan to retain and which are transitional commercial mortgage loans to improve and rehabilitate existing properties that already have cash flow. While these loans generally have three year terms, the vast majority are variable rate, with monthly rate adjustments and, as a result, higher market rates will result in higher payments and greater cash flow requirements, although such loans generally require an interest rate cap to mitigate that risk. Should cash flow and available cash reserves prove inadequate to cover debt service on these loans, repayment will primarily depend upon the sponsor’s ability to service the debt, or the value of the property in disposition. Low occupancy or rental rates may negatively impact loan repayment. Because these loans were previously originated for sale, or because we may decide to sell certain REBL loans in the future, the underwriting and other criteria used were those which buyers in the capital markets indicated were most crucial when determining whether to buy the loans. Such criteria include the loan-to-value ratio and debt yield (net operating income divided by first mortgage debt). However, property values may fall below appraised values and below the outstanding balance of the loan, which would reduce the price at which we could sell the loan.

Deposit Products and Services

We offer a range of deposit products and services deployed through our Fintech Solutions and Institutional Banking groups for the benefit of our affinity group clients and their customer bases. These products may be offered directly, or through our private label banking strategy. These include:

checking accounts;

savings accounts;

money market accounts;

commercial accounts; and

various types of prepaid and debit cards.

We also offer ACH bill payment and other payment services.

Payments Products and Services Offered Through Our Fintech Solutions Group

We provide a variety of checking and savings accounts and other banking services to fintech companies and other affinity groups, which may vary and which include fraud detection, anti-money laundering, consumer compliance and other regulatory functions, reconciliation, sponsorship in Visa or Mastercard associations, ACH processing, rapid funds transfer and other payment capabilities.

Card Issuing Services. We issue debit and prepaid cards to access diverse types of deposit accounts including: consumer and business debit, general purpose reloadable prepaid, pre-tax medical spending benefit, payroll, gift, government, corporate incentive, reward, business payment accounts and others. Our accounts are offered to end users throughout the United States through our relationships with fintech companies, benefits administrators, third-party administrators, insurers, corporate incentive companies, rebate fulfillment organizations, payroll administrators, large retail chains, consumer service organizations and others. Our cards are network-branded through our agreements with Visa, Mastercard, and Discover. The majority of fees that we earn result from contractual fees paid by third-party sponsors, computed on a per transaction basis, and monthly service fees. Additionally, we earn interchange fees paid through settlement associations such as Visa, which are also determined on a per transaction basis. These accounts have demonstrated a history of stability and lower cost compared to certain other types of funding.

Card Payment, Bill Payment and ACH Processing. We act as the depository institution for the processing of credit and debit card payments made to various businesses, which require collection through associations such as Visa and Mastercard. We also act as the bank sponsor and depository institution for independent service organizations that process such payments and for other companies, such as bill payment companies for which we process ACH payments enabling those organizations to more easily process electronic payments and to better manage their risk of loss. These accounts are a source of demand deposits and fee income.

Institutional Banking

We have developed strategic relationships with affinity-based clients such as limited-purpose trust companies, registered investment advisers, broker-dealers and other firms offering institutional banking services. In addition to the SBLOC, IBLOC and investment advisor loans discussed above, our Institutional Banking business also provides customized, private label deposit products such as demand and money market accounts to customers of these affinity-based clients.

Other Operations

Account Services. Depending upon the product, account holders may access our products through the website or app of their affinity group, or through our website. This access may allow account holders to apply for loans, review account activity, pay bills electronically, receive statements electronically and print statements.  

Third-Party Service Providers. To reduce operating costs and capitalize on the technical capabilities of selected vendors, we outsource certain bank operations and systems to third-party service providers, principally the following:

data processing services, check imaging, loan processing, electronic bill payment and statement rendering;

servicing of prepaid and debit card accounts;

call center customer support, including institutional banking for overflow and after-hours support;

access to automated teller machine (“ATM”) networks;

bank accounting and general ledger system;

data warehousing services; and

certain software development.

Because we outsource these operational functions to experienced third-party service providers with the capacity to process a high volume of transactions, we believe we can more readily and cost-effectively respond to growth than if we sought to develop these capabilities internally. Should any of our current relationships terminate, we believe we could maintain business continuity by securing the required services from an alternative source without material interruption of our operations.

Sales and Marketing

Affinity Group Banking Relationships. Our sales and marketing efforts to existing and potential affinity group organizations and fintech companies are national in scope. We use a personal sales/targeted media advertising approach to market to these clients and business partners. Under our direction, the affinity group organizations with which we have relationships perform additional sales and marketing functions to the ultimate individual customers. Our marketing program to affinity group organizations consists of:

print and digital advertising;

attending and creating presentations at trade shows and other events for targeted affinity organizations; and 

direct contact with potential affinity organizations by our marketing staff, with relationship managers focusing on particular regional markets.

Technology and Cybersecurity

Primary System Architecture. We provide financial products and services through a secure, tiered architecture using commercially available software and with third-party providers whom we believe to be industry leaders. We maintain a platform of web technologies, databases, firewalls, and licensed and proprietary financial services software to support our unique client base. User activity is distributed across our service offerings, with internally developed software and cloud services, as well as third-party platforms and processors. The goal of our systems design is to service our client requirements efficiently, which has been accomplished using data and service replication between data centers and cloud platforms for our critical applications. The system’s flexible architecture is designed to meet current capacity needs and allow expansion for future demands. In addition to built-in redundancies, we monitor our systems using automated internal tools, and use independent third parties to validate our controls.

Cybersecurity. We have an established Cybersecurity Program that is mapped to the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework, the Center for Internet Security® (“CIS”) Critical Security Controls, the Federal Financial Institutions Examination Council (“FFIEC”) Cybersecurity Assessment Tool and relevant ISO standards. The Bancorp obtains annual Payment Card Industry (“PCI”) certification. Highlights of the program include:

A security testing schedule, which includes internal/external penetration testing;

Regular vulnerability assessments;

Detailed vulnerability management;

Monitoring and reporting of systems and critical applications;

Data loss prevention controls;

File access and integrity monitoring and reporting;

Threat intelligence;

A training and compliance program for staff, including a detailed policy; and

Third-party vendor management.

Intellectual Property and Other Proprietary Rights

We use third-party providers for a significant portion of our core and internet banking systems and operations. Where applicable, we rely principally upon trade secret and trademark law to protect our intellectual property. We do not typically enter into intellectual property-related confidentiality agreements with our affinity group customers, because we maintain control over the software used for banking functions rather than licensing them for customers to use. Moreover, we believe that factors such as the relationships we develop with our affinity group and banking customers, the quality of our banking products, the level and reliability of the service we provide, and the customization of our products and services to meet the needs of our affinity groups are substantially more significant to our ability to succeed.

Competition

We compete with numerous banks and other financial institutions such as finance companies, leasing companies, credit unions, insurance companies, money market funds, investment firms and private lenders, as well as online lenders and other non-traditional competitors. Our primary competitors in each of our business lines differ significantly from those in our other business lines principally because few financial institutions compete against us in all business segments in which we operate. For prepaid and debit accounts, our largest source of funding and fee income, competitors include Pathward Financial and for SBLOC competitors include TriState Capital. For SBA loans, our competitors include Live Oak Bank, and for leasing our competitors include Enterprise. For REBL loans, competitors include companies such as Bridge Investment Group. Significant costs of entry include consumer protection compliance, and Bank Secrecy Act (“BSA”) and other regulatory compliance costs, which may impact competition for prepaid and debit card accounts. We believe that our ability to compete successfully depends on a number of factors, including:

our ability to expand our affinity group banking program;

competitors’ interest rates and service fees;

the scope of our products and services;

the relevance of our products and services to customer needs and the rate at which we and our competitors introduce them;

satisfaction of our customers with our customer service;

our perceived safety as a depository institution, including our size, credit rating, capital strength, earnings strength and regulatory posture;

ease of use of our banking websites and other customer interfaces; and

the capacity, reliability and security of our network infrastructure.

The risks associated with our competitors are more fully discussed in Item 1A, “Risk Factors.”

Human Capital Management

We believe that human capital management is an essential component of our continued growth and success. Key human capital resources and management strategies are described below. 

Employees. As of December 31, 2023, we had 757 full-time employees and believe our relationship with our employees to be good. None of our employees are covered by a collective bargaining agreement. Our workforce as of that date included approximately 50% women and 24% racial and ethnic minorities.

Oversight. The Company’s Chief Human Resources Officer reports directly to the President and Chief Executive Officer (“CEO”) and oversees most aspects of the employee experience, including talent acquisition, learning and development, talent management, employee relations, payroll, compensation and benefits. The Company’s Chief Diversity Officer (“CDO”) oversees diversity and inclusion efforts and, in 2023, reported directly to the President and CEO in that regard. The Company’s Board of Directors (the “Board”) and executive management receive regular updates on human capital management efforts, including diversity and inclusion initiatives.

Talent Acquisition and Development. We aim to attract, develop and retain high-performing, diverse talent who can further the Company’s strategic business objectives. To that end, we offer market-competitive compensation and strive to accelerate employees’ professional development through performance management and fostering a learning culture. Our employees work together with their managers to set business and professional development goals, supported by a variety of resources and tools developed to help employees enhance their leadership skills.

Total Rewards and Employee Well-Being. The Company is committed to providing competitive benefit programs designed with the everyday needs of our employees and their families in mind. Full-time employees are eligible for healthcare coverage, life and disability coverage, retirement benefits, paid and unpaid leave, employee assistance programs, and tuition reimbursement. These programs offer resources that promote employee well-being in various aspects, including mental, physical, and financial wellness.

Diversity and Inclusion. We strive to maintain a diverse and inclusive work culture in which individual differences and experiences are valued and all employees have the opportunity to contribute and thrive. We believe that leveraging our employees’ diverse perspectives and capabilities will enhance innovation, foster a collaborative work culture and enable us to better serve our customers and communities. With this vision in mind, the Company’s diversity and inclusion strategy focuses on five key pillars: Organizational Commitment, Workforce Practices, Community Engagement, Supplier Diversity and Transparency. Led by the CDO, the Company’s Internal Diversity & Inclusion Council implements initiatives that promote these core values at all levels of the Company, such as training, employee resource groups (“ERGs”), community service activities, and an annual Diversity & Inclusion Week. These efforts are supported by the Company’s employee resource groups (“ERGs”). In 2023, the Company launched an additional ERG, increasing its total number of ERGs from seven to eight: Black Professionals, Employees Who Serve, The Green Team, Health & Wellness, HOLA, PRIDE, Women’s Initiative Network, and Working Families. Open to all employees, our ERGs give employees the opportunity to connect with their colleagues and work to provide greater organizational awareness of the unique issues related to women, people of color, caregivers, community service, health and wellness, the environment and, with the addition of the eighth ERG (PRIDE), LGBTQ+ employees.

Employee Engagement. The Company strives to foster and maintain a workplace that offers a positive, inclusive culture for all employees and uses annual employee engagement surveys to gather employee feedback. These survey results are considered in the planning and implementation of employee programs, initiatives, and communications.

Regulation and Supervision

Overview

The Bancorp, Inc. is a Delaware corporation and a financial holding company registered with the Board of Governors of the Federal Reserve System (“Federal Reserve”). The Company maintains its headquarters in Sioux Falls, South Dakota. The Company’s subsidiary, The Bancorp Bank, National Association, is a nationally chartered and federally insured commercial bank supervised and examined by the Office of the Comptroller of the Currency (“OCC”) as its primary regulator, and the Federal Deposit Insurance Corporation (“FDIC”), the federal agency that administers the Deposit Insurance Fund (“DIF”). On September 15, 2022, the Bank converted from a state-chartered bank regulated by the FDIC and the Delaware Office of the State Bank Commissioner to a federally chartered bank regulated by the OCC. On February 1, 2023, the Bank relocated its main office from Wilmington, Delaware to Sioux Falls, South Dakota.

Both the Company and the Bank are subject to extensive regulation in connection with their respective activities and operations. The regulatory framework by which both the Company and Bank are supervised and examined is complex and dynamic and is designed to protect customers of and depositors in insured depository institutions, the DIF, and the U.S. banking system. This framework includes acts of the U.S. Congress (“Congress”), regulations, policy statements and guidance, and other interpretative materials that define the obligations and requirements for entities participating in the U.S. banking system. Moreover, regulation of holding companies and their subsidiaries is subject to continual revision, both through statutory changes and corresponding regulatory revisions as well as through evolving supervisory objectives of applicable banking agencies that supervise the Company and the Bank.

The requirements and restrictions under federal and state laws to which the Bank is subject include requirements to maintain reserves against deposits, restrictions on the types and amounts of loans that may be made and the interest that may be charged, and limitations on the types of investments that may be made and the types of services that may be offered. Various consumer laws and regulations also affect the Bank’s operations. Any change in the regulatory requirements and policies by the OCC, the Federal Reserve, other federal regulatory agencies, Congress, or the states in which we operate, or where our customers reside, could have a material adverse impact on the Company, the Bank, and our operations.

In addition to regulation and supervision by the Federal Reserve Bank (“FRB”), the Company is a reporting company under the Securities Exchange Act of 1934, as amended (“Exchange Act”), and is required to file reports with the Securities and Exchange Commission (“SEC”) and otherwise comply with federal securities laws.

Set forth below is a summary of certain regulatory requirements applicable to the Company and the Bank. Descriptions of statutes and regulations in this summary are not intended to be complete explanations of such statutes and regulations, or their effects on the Bank or the Company, and are qualified in their entirety by reference to the actual statutes and regulations. While we continue to have a compliance framework in place to comply with both existing and proposed rules and regulations, it is possible that the

existing regulatory framework may be amended, which amendments could have a positive or negative impact on our business, financial condition, results of operations and prospects.

Federal Regulation

As a financial holding company, the Company is subject to regular examination by the Federal Reserve and must file quarterly reports and provide any additional information the Federal Reserve may request. Under the Bank Holding Company Act of 1956, as amended (the “BHCA”), a financial holding company may not directly or indirectly acquire ownership or control of more than 5% of the voting shares or substantially all of the assets of any bank, or merge or consolidate with another financial holding company, without prior approval of the Federal Reserve.

Permitted Activities The BHCA generally limits the activities of a financial holding company and its subsidiaries to that of banking, managing or controlling banks, or any other activity that is determined to be so closely related to banking or to managing or controlling banks that an exception is allowed for those activities.

Change in Control Additionally, under the Change in Bank Control Act and the BHCA, a person or company that acquires control of a bank holding company or bank must obtain the non-objection or approval of the Federal Reserve in advance of the acquisition. For a publicly-traded bank holding company such as The Bancorp, Inc., control for purposes of the Change in Bank Control Act is presumed to exist if the acquirer will have 10% or more of any class of the company’s voting securities.

Limitations on Company Dividends It is the policy of the Federal Reserve that financial holding companies should pay cash dividends on common stock only out of income available over the past year and only if prospective earnings retention is consistent with the organization’s expected future needs and financial condition. The policy provides that financial holding companies should not maintain a level of cash dividends that undermines the financial holding company’s ability to serve as a source of strength to its banking subsidiaries. See “Holding Company Liability” below. Federal Reserve policies also affect the ability of a financial holding company to pay in-kind dividends.

Limitations on Bank Dividends Various federal provisions limit the amount of dividends that subsidiary banks can pay to their holding companies without regulatory approval. Without the prior approval of the OCC, a dividend may not be paid if the total of all dividends declared by a bank in any calendar year is in excess of the current year’s net income combined with the retained net income of the two preceding years. Additionally, a dividend may not be paid in excess of a bank’s retained earnings. Moreover, an insured depository institution may not pay a dividend if the payment would cause it to be less than “adequately capitalized” under the prompt corrective action framework or if the institution is in default in the payment of an assessment due to the FDIC. Similarly, under other regulatory capital rules, a banking organization that fails to satisfy the minimum capital conservation buffer requirement will be subject to certain limitations, which include restrictions on capital distributions. Additionally, regulators are authorized to prohibit a banking subsidiary or financial holding company from engaging in unsafe or unsound banking practices. Depending upon the circumstances, agencies could take the position that paying a dividend would constitute an unsafe or unsound banking practice.

Because the Company is a legal entity separate and distinct from the Bank, its rights to participate in the distribution of assets of the Bank, or any other subsidiary, upon the Bank’s or the subsidiary’s liquidation or reorganization will be subject to the prior claims of the Bank’s or subsidiary’s creditors. In the event of liquidation or other resolution of an insured depository institution, the claims of depositors and other general or subordinated creditors have priority of payment over the claims of holders of any obligation of the institution’s holding company or any of the holding company’s shareholders or creditors.

Holding Company Liability Under Federal Reserve policy as codified by the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”), a financial holding company is expected to act as a source of financial strength to each of its banking subsidiaries. Under this requirement, the Company is expected to commit resources to support the Bank, including at times when it may not be in a financial position to provide such resources. As discussed below under “Prompt Corrective Action” a financial holding company in certain circumstances could be required to guarantee the capital plan of an undercapitalized banking subsidiary.

Capital Adequacy The Federal Reserve and OCC have issued standards for measuring capital adequacy for financial holding companies and banks that are designed to provide risk-based capital guidelines and to incorporate a consistent framework. The risk-based guidelines are used by the agencies in their examination and supervisory process, as well as in the analysis of any bank regulatory applications. As discussed below under “Prompt Corrective Action” a failure to meet minimum capital requirements could

subject the Company or the Bank to a variety of enforcement remedies available to federal regulatory authorities, including, in the most severe cases, termination of deposit insurance by the FDIC and placing the Bank into conservatorship or receivership.

In general, these risk-related standards require banks and financial holding companies to maintain capital based on “risk-adjusted” assets so that the categories of assets with potentially higher credit risks will require more capital backing than categories with lower credit risk. In addition, banks and financial holding companies are required to maintain capital to support off-balance sheet activities such as loan commitments.

The risk-related standards classify capital into two tiers, referred to as Tier 1 and Tier 2. Together, these two categories of capital comprise a bank’s or financial holding company’s “qualifying total capital.” However, capital that qualifies as Tier 2 capital is limited in amount to 100% of Tier 1 capital in testing compliance with the total risk-based capital minimum standards. Banks and financial holding companies must have a minimum ratio of 8% of qualifying total capital to total risk-weighted assets, and a minimum ratio of 4% of qualifying Tier 1 capital to total risk-weighted assets. At December 31, 2023, the Company and the Bank had total capital to risk-adjusted assets ratios of 16.23% and 17.92%, respectively, and Tier 1 capital to risk-adjusted assets ratios of 15.66% and 17.35%, respectively.

In addition, the Federal Reserve and the OCC have established minimum leverage ratio guidelines to supplement the risk-based capital guidelines. The principal objective of these guidelines is to constrain the maximum degree to which a financial institution can leverage its equity capital base. These guidelines provide for a minimum ratio of Tier 1 capital to adjusted average total assets of 3% for financial holding companies that meet certain specified criteria, including those having the highest regulatory rating. Other financial institutions generally must maintain a leverage ratio of at least 3% plus 100 to 200 basis points. However, banks under $10 billion in assets typically maintain a Tier 1 capital to adjusted average total assets ratio exceeding 8%. Currently, the Bank’s internal guidelines suggest a ratio of 9%. The regulatory guidelines also provide that financial institutions experiencing internal growth or making acquisitions will be expected to maintain strong capital positions substantially above minimum supervisory levels, without significant reliance on intangible assets. Furthermore, the banking agencies have indicated that they may consider other indicia of capital strength in evaluating proposals for expansion or new activities. At December 31, 2023, the Company and the Bank had leverage ratios of 11.19% and 12.37%, respectively.

The federal banking agencies’ standards provide that concentration of credit risk and certain risks arising from non-traditional activities, as well as an institution’s ability to manage these risks, are important factors when assessing a financial institution’s overall capital adequacy. The risk-based capital standards also provide for the consideration of interest rate risk in the determination of a financial institution’s capital adequacy, which requires financial institutions to effectively measure and monitor their interest rate risk and to maintain capital adequate for that risk.

Dodd-Frank also includes provisions referred to as the “Collins Amendment,” which subject bank holding companies to the same capital requirements as their bank subsidiaries and eliminate or significantly reduce the use of hybrid capital instruments, especially trust preferred securities, as regulatory capital. Under the Collins Amendment, trust preferred securities issued by a company, such as our Company, with total consolidated assets of less than $15 billion before May 19, 2010 and treated as regulatory capital were grandfathered, but any such securities issued later are not eligible as regulatory capital. The Company’s $13.4 million of outstanding trust preferred securities qualified as Tier 1 capital under this grandfathering.

Basel III Capital Rules The federal banking agencies have adopted rules, referred to as the Basel III rules, which implement the Basel Committee on Banking Supervision’s December 2010 final capital framework for strengthening international capital standards. The Basel III rules, among other things, (i) introduced a new capital measure called “Common Equity Tier 1” (“CET1”) and related regulatory capital ratio of CET1 to risk-weighted assets; (ii) specified that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting certain revised requirements; (iii) mandated that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital; and (iv) expanded the scope of the deductions from and adjustments to capital as compared to existing regulations. Under the Basel III rules, for most banking organizations, the most common form of Additional Tier 1 capital is non-cumulative perpetual preferred stock and the most common form of Tier 2 capital is subordinated notes and a portion of the allocation for loan and lease losses, in each case, subject to the specific requirements of the Basel III rules.

Minimum capital ratios in effect at December 31, 2023 were as follows:

4.5% CET1 to risk-weighted assets;

6.0% Tier 1 capital (that is, CET1 plus Additional Tier 1 capital) to risk-weighted assets;

8.0% Total capital (that is, Tier 1 capital plus Tier 2 capital) to risk-weighted assets; and

4.0% Tier 1 capital to average consolidated assets as reported on consolidated financial statements (known as the “leverage ratio”).

The Basel III rules also introduced a new “capital conservation buffer,” composed entirely of CET1, on top of the minimum risk-weighted asset ratios. The capital conservation buffer was designed to absorb losses during periods of economic stress. Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the capital conservation buffer face constraints on dividends, equity repurchases, and compensation based on the amount of the shortfall. Thus, the Company and the Bank are required to maintain an additional capital conservation buffer of 2.5% of CET1, effectively resulting in minimum ratios of (i) CET1 to risk-weighted assets of at least 7%, (ii) Tier 1 capital to risk-weighted assets of at least 8.5%, and (iii) Total capital to risk-weighted assets of at least 10.5%.

The Basel III rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that deferred tax assets arising from temporary differences that could not be realized through net operating loss carrybacks and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% if CET1 or all such items, in the aggregate, exceed 15% of CET1.

With respect to the Bank, the Basel III rules revised the “prompt corrective action” (“PCA”) regulations adopted pursuant to Section 38 of the Federal Deposit Insurance Act (the “FDIA”), by: (i) introducing a CET1 ratio requirement at each PCA category (other than critically undercapitalized), with the required CET1 ratio being 6.5% for well-capitalized status; (ii) increasing the minimum Tier 1 capital ratio requirement for each category, with the minimum Tier 1 capital ratio for well-capitalized status being 8% (as compared to the current 6%); and (iii) eliminating the provision that a bank with a composite supervisory rating of 1 may have a 3% leverage ratio and still be adequately capitalized. The Basel III rules did not change the total risk-based capital requirement for any PCA category.

The Basel III rules prescribe a standardized approach for risk weightings that expanded the risk-weighting categories from four Basel I-derived categories (0%, 20%, 50% and 100%) to a larger and more risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0% for U.S. government and agency securities, to 600% for certain equity exposures resulting in higher risk weights for a variety of asset classes.

As of December 31, 2023, we were in compliance with the Basel III rules. We remain in compliance with such rules and believe the Company and the Bank will continue to be able to meet targeted capital ratios. Actual ratios as of December 31, 2023 are shown in the following paragraph.

Prompt Corrective Action Federal banking agencies must take prompt supervisory and regulatory actions against undercapitalized depository institutions pursuant to the PCA provisions of the FDIA. Depository institutions are assigned one of five capital categories – “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized” – and are subject to different regulation corresponding to the capital category within which the institution falls. Under certain circumstances, a well capitalized, adequately capitalized, or undercapitalized institution may be treated as if the institution were in the next lower capital category. As described in Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations –Capital Resources,” an institution is deemed well capitalized if it has a total risk-based capital ratio of at least 10.00%, a Tier 1 risk-based capital ratio of at least 6.50%, and a leverage ratio of at least 5.00%. An institution is adequately capitalized if it has a total risk-based capital ratio of at least 8.00%, a Tier 1 risk-based capital ratio of at least 4.50%, and a leverage ratio of at least 4.00%. At December 31, 2023, the Company’s total risk-based capital ratio was 16.23%, Tier 1 risk-based capital ratio was 15.66%, and leverage ratio was 11.19% while the Bank’s ratios were 17.92%, 17.35% and 12.37%, respectively and, accordingly, both the Company and the Bank were well capitalized within the meaning of the regulations. A depository institution is generally prohibited from making capital distributions (including paying dividends) or paying management fees to a holding company if the institution would thereafter be undercapitalized.

As a result of Dodd-Frank, our financial holding company status depends upon our maintaining our status as “well capitalized” and “well managed” under applicable Federal Reserve regulations. Should a financial holding company cease meeting these requirements, the Federal Reserve may impose corrective capital and managerial requirements on the financial holding company and place limitations on its ability to conduct the broader financial activities permissible for financial holding companies. In addition, the Federal Reserve may require divestiture of the holding company’s depository institution if the deficiencies persist.

Brokered Deposits A “brokered deposit” is any deposit that is obtained from or through the mediation or assistance of a deposit broker. Prior to June 30, 2021, the majority of the Bank’s deposits were classified as brokered, because related accounts, primarily prepaid and debit card deposit accounts, are obtained with the assistance of third parties. In December 2020, the FDIC issued a regulation which resulted in the reclassification of the majority of the Bank’s deposits from brokered to non-brokered, which generally resulted in a reduction of FDIC insurance expense rates. See “Insurance of Deposit Accounts” below. These designations are subject to the FDIC’s ongoing assessment and there can be no assurance that such classifications will be permanent.

Adequately capitalized institutions cannot accept, renew or roll over brokered deposits, except with a waiver from the FDIC, and are subject to restrictions on the interest rates that can be paid on such deposits. Undercapitalized institutions may not accept, renew, or roll over brokered deposits.

Insurance of Deposit Accounts The Bank’s deposits are insured to the maximum extent permitted by the DIF. Dodd-Frank permanently increased the maximum amount of deposit insurance to $250,000 per depositor, per insured institution for each account ownership category. FDIC insurance is backed by the full faith and credit of the United States government.

As the insurer, the FDIC is authorized to conduct examinations of, and to require reporting by, FDIC-insured institutions. The FDIC also may prohibit any FDIC-insured institution from engaging in any activity the FDIC determines by regulation or order to pose a serious threat to the DIF. The FDIC also has the authority to initiate enforcement actions against banks.

The FDIC has implemented a risk-based assessment system under which FDIC-insured depository institutions pay annual premiums at rates based on their risk classification. A bank’s risk classification is based on its capital levels and the level of supervisory concern the bank poses to the regulators. Institutions assigned to higher risk classifications pay assessments at higher rates than institutions that pose a lower risk. A decrease in the Bank’s capital ratios or the occurrence of events that have an adverse effect on the Bank’s asset quality, management, earnings, liquidity or sensitivity to market risk could result in a substantial increase in deposit insurance premiums paid by the Bank, which would adversely affect earnings. In addition, the FDIC can impose special assessments in certain instances. The range of assessments in the risk-based system is a function of the reserve ratio in the DIF. Each insured institution is assigned to one of four risk categories based on supervisory evaluations, regulatory capital levels and certain other factors and its assessment rate depends upon the category to which it is assigned. Unlike the other categories, Risk Category I contains further risk differentiation based on the FDIC’s analysis of financial ratios, examination component ratings and other information. Assessment rates are determined by the FDIC and, including potential adjustments to reflect an institution’s risk profile, currently range from five to nine basis points for the healthiest institutions (Risk Category I) to 35 basis points of assessable liabilities for the riskiest (Risk Category IV). Rates may be increased an additional ten basis points depending on the amount of brokered deposits utilized. The above-referenced rates apply to institutions with assets under $10 billion. Other rates apply for larger or “highly complex” institutions. The FDIC may adjust rates uniformly from one quarter to the next, except that no single adjustment can exceed three basis points. At December 31, 2023, the Bank’s DIF assessment rate was 5 basis points, subject to increase at any time in the future.

Pursuant to Dodd-Frank, the FDIC has established 2.0% as the designated reserve ratio (“DRR”), or the ratio of the DIF to insured deposits of the total industry. In 2022, the FDIC projected that the DRR was at risk of not reaching the statutory minimum of 1.35% by the statutory deadline of September 30, 2028 and, based on this update, increased the initial base deposit insurance assessment rate schedules applicable to all insured depository institutions uniformly by 2 basis points. The increase was effective as of January 1, 2023 and applicable to the first quarterly assessment period of 2023 (i.e., January 1 through March 31, 2023).

Loans-to-One Borrower Generally, a bank may not make a loan or extend credit to a single or related group of borrowers in excess of 15% of its unimpaired capital and surplus. At December 31, 2023, the Bank’s limit on loans to one borrower was $141.2 million. An additional amount may be lent, equal to 10% of unimpaired capital and surplus, if such loan is secured by marketable securities.

Transactions with Affiliates and other Related Parties There are various legal restrictions on the extent to which a financial holding company and its non-bank subsidiaries can borrow or otherwise obtain credit from banking subsidiaries or engage in other transactions with or involving those banking subsidiaries. The Bank’s authority to engage in transactions with related parties or “affiliates” (that is, any entity that controls, is controlled by or is under common control with an institution, including the Company and our non-bank subsidiaries) is limited by Sections 23A and 23B of the Federal Reserve Act (the “FRA”) and Regulation W promulgated thereunder. Section 23A restricts the aggregate amount of covered transactions with any individual affiliate to 10% of the Bank’s capital and surplus. At December 31, 2023, the Company was not indebted to the Bank. The aggregate amount of covered

transactions with all affiliates is limited to 20% of the Bank’s capital and surplus. Certain transactions with affiliates are required to be secured by collateral in an amount and of a type described in Section 23A and the purchase of low-quality assets from affiliates are generally prohibited. Section 23B generally provides that certain transactions with affiliates, including loans and asset purchases, must be on terms and under circumstances, including credit standards, that are substantially the same or at least as favorable to the institution as those prevailing at the time for comparable transactions with non-affiliated companies.

Dodd-Frank generally enhanced the restrictions on transactions with affiliates under Sections 23A and 23B of the FRA, including an expansion of the definition of “covered transactions” and an increase in the amount of time for which collateral requirements regarding covered credit transactions must be satisfied. Insider transaction limitations were expanded through the strengthening of loan restrictions to insiders and the expansion of the types of transactions subject to the various limits, including derivatives transactions, repurchase agreements, reverse repurchase agreements and securities lending or borrowing transactions. Restrictions were also placed on certain assets sales to and from an insider to an institution including requirements that such sales be on market terms and, in certain circumstances, approved by the institution’s board of directors.

The Bank’s authority to extend credit to its directors, executive officers and 10% shareholders, as well as to entities controlled by such persons, is governed by the requirements of Sections 22(g) and 22(h) of the FRA and Regulation O of the Federal Reserve. Among other things, these provisions require that extensions of credit to insiders (i) be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with unaffiliated persons and that do not involve more than the normal risk of repayment or present other unfavorable features; and (ii) not exceed certain limitations on the amount of credit extended to such persons, individually and in the aggregate, which limits are based, in part, on the amount of the Bank’s capital. In addition, extensions of credit in excess of certain limits must be approved by the Bank’s Board of Directors. At December 31, 2023 and 2022, loans to these related parties amounted to $5.7 million and $5.5 million respectively.

Standards for Safety and Soundness The FDIA requires each federal banking agency to prescribe for all insured depository institutions standards relating to, among other things, internal controls, information and audit systems, loan documentation, credit underwriting, interest rate risk exposure, asset growth, compensation, fees, benefits and such other operational and managerial standards as the agency deems appropriate. The federal banking agencies have adopted final regulations and interagency guidelines to implement these safety and soundness standards. The guidelines set forth the safety and soundness standards that the federal banking agencies use to identify and address problems at insured depository institutions before capital becomes impaired. If the appropriate federal banking agency determines an institution fails to meet any standard prescribed by the guidelines, the agency may require the institution to submit to the agency an acceptable plan to achieve compliance with the standard.

Privacy and Information Security Financial institutions are required to disclose their policies for collecting and protecting confidential information. Customers generally may prevent financial institutions from sharing nonpublic personal financial information with nonaffiliated third parties except under narrow circumstances, such as the processing of transactions requested by the consumer or when the financial institution is jointly sponsoring a product or service with a nonaffiliated third party. Additionally, financial institutions generally may not disclose consumer account numbers to any nonaffiliated third party for use in telemarketing, direct mail marketing or other marketing to consumers. The Bank has adopted privacy standards that we believe will satisfy regulatory scrutiny and communicates its privacy practices to its customers through privacy disclosures designed in a manner consistent with recommended model forms. The Gramm-Leach-Bliley Act (the “GLBA”) and other laws require us to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to provide for the security and confidentiality of customer records and information. As a result, we have implemented and continue to assess and improve our security and privacy policies and procedures to protect personal and confidential information.

Data privacy and data protection are areas of increasing regulatory focus, particularly at the state level. Following enactment of the California Consumer Protection Act of 2018 (as modified by the California Privacy Rights Act, the “CCPA”) which became effective in January 2020, we made operational adjustments in response to the law and its regulations. The CCPA gives California consumers each of the following rights: to request disclosure of information collected about them and be informed about whether such information has been sold or shared; to request deletion of personal information (subject to certain exceptions); to opt out of the sale of such consumer’s personal information; and to not be discriminated against for having exercised the foregoing rights. The CCPA contains several exemptions, including an exemption applicable to information that is collected, processed, sold or disclosed pursuant to GLBA. More states including, but not limited to, Colorado, Connecticut, Utah and Virginia, have implemented or are considering implementing similar legislation in the future. We believe that the Company is taking the necessary steps to comply with these evolving laws.

Fair and Accurate Credit Transactions Act of 2003 The Fair and Accurate Credit Transactions Act of 2003 (the “FACT Act”) provides consumers with the ability to restrict companies from using certain information obtained from affiliates to make marketing solicitations. In general, a person is prohibited from using information received from an affiliate to make a solicitation for marketing purposes to a consumer, unless the consumer is given notice and had a reasonable opportunity to opt out of such solicitations. The rule permits opt-out notices to be given by any affiliate that has a pre-existing business relationship with the consumer and permits a joint notice from two or more affiliates. Moreover, such notice would not be applicable if the company using the information has a pre-existing business relationship with the consumer. This notice may be combined with other required disclosures, including notices required under other applicable privacy provisions.

Section 315 of the FACT Act requires each financial institution or creditor to develop and implement a written Identity Theft Prevention Program to detect, prevent and mitigate identity theft in connection with the opening of certain accounts or certain existing accounts. In accordance with this rule, the Bank adopted such a program.

Cybersecurity The federal banking regulators regularly issue guidance regarding cybersecurity that is intended to enhance cyber risk management among financial institutions. A financial institution is expected to establish lines of defense and to ensure that its risk management processes address the risk posed by potential threats to the institution. A financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption, and maintenance of the institution’s operations after a cyberattack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations if the institution or its critical service providers fall victim to a cyberattack.

Pursuant to a joint final rule issued by the federal banking agencies that became effective in May 2022, a banking organization must notify its primary federal regulator of any significant computer-security incident as soon as possible and no later than 36 hours after the banking organization determines that a cyber incident has occurred. Notification is required for incidents that have materially affected—or are reasonably likely to materially affect—the viability of a banking organization's operations, its ability to deliver banking products and services, or the stability of the financial sector. The final rule also requires a bank service provider to notify affected banking organization customers as soon as possible when the provider determines that it has experienced a computer-security incident that has materially affected or is reasonably likely to materially affect banking organization customers for four or more hours. In addition, certain state laws could potentially impact the Bank’s operations, including those related to applicable notification requirements when computer-security incidents or unauthorized access to customers’ nonpublic personal information have occurred.

See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity and Item 1C. Cybersecurity for a further discussion of risk management strategies and governance processes related to cybersecurity.

Anti-Money Laundering, Sanctions, and Related Regulations The BSA requires the Bank to implement a risk-based compliance program in order to protect the Bank from being used as a conduit for financial or other illicit crimes including but not limited to money laundering and terrorist financing. These rules are administered by the Financial Crimes Enforcement Network, (“FinCEN”), a bureau of the U.S. Department of the Treasury. Under the law, the Bank must have a written BSA/Anti-Money Laundering (“AML”) program which has been approved by the board of directors and contains the following key requirements: (1) appointment of responsible persons to manage the program, including a BSA Officer; (2) ongoing training of all appropriate Bank staff and management on BSA-AML compliance; (3) development of a system of internal controls (including appropriate policies, procedures and processes); and (4) required independent testing to ensure effective implementation of the program and appropriate compliance. Under BSA regulations, the Bank is subject to various reporting requirements such as currency transaction reporting, monitoring of customer activity and transactions and filing a suspicious activity report when warranted. The BSA also contains numerous recordkeeping requirements.

USA PATRIOT Act The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (the “USA PATRIOT Act”) expanded provisions of the BSA, criminalized the financing of terrorism and augmented the existing BSA framework by strengthening customer identification procedures, requiring financial institutions to implement a written customer identification program, have due diligence procedures, including enhanced due diligence procedures and, most significantly, improving information sharing between financial institutions and the U.S. government. In January 2021, the Anti-Money Laundering Act of 2020 ("AMLA") was enacted, amending the Bank Secrecy Act ("BSA").The AMLA was intended to comprehensively reform and modernize U.S. bank secrecy and anti-money laundering laws, to include goals of preventing money laundering , terrorism financing, tax evasion and fraud. impacting our operations. Key provisions include the codification of a risk-based approach to anti-money laundering compliance, the requirement for the U.S. Department of the Treasury to establish priorities for anti-money laundering policies, and the development of standards for testing technology and internal processes related to BSA compliance.

Additionally, the AMLA imposed ultimate beneficial ownership reporting requirements via corporate transparency requirements, subject to multiple categories of exemptions. In June 2021, the Financial Crimes Enforcement Network ("FinCEN") issued priorities for anti-money laundering and countering the financing of terrorism policy as mandated by AMLA. These national priorities, including corruption, cybercrime, terrorist financing, fraud, transnational crime, drug trafficking, human trafficking, and proliferation financing, guide our compliance efforts. Certain statutory provisions in the AMLA are expected to require additional rulemakings, reports and other measures by FinCEN, and the impact of the AMLA will depend on, among other things, rulemaking and implementation guidance. The Company has implemented the required customer identification program and the other required elements of these laws and related regulations.

Under the USA PATRIOT Act, FinCEN can send bank regulatory agencies lists of the names of persons suspected of involvement in terrorist activities or money laundering. The Bank must search its records for any relationships or transactions with persons on those lists and, if it finds any such relationships or transactions, must report specific information to FinCEN and implement other internal compliance procedures in accordance with the Bank’s BSA/AML compliance procedures.

Office of Foreign Assets Control The Office of Foreign Assets Control (“OFAC”), a division of the U.S. Department of the Treasury, administers and enforces economic and trade sanctions based on U.S. foreign policy and national security goals against targeted foreign countries, terrorists, international narcotics traffickers, and those engaged in activities related to the proliferation of weapons of mass destruction. OFAC maintains lists of names of persons and organizations suspected of aiding, harboring or engaging in terrorist acts, as well as sanctions programs for certain countries. If the Bank finds a name on any transaction, account or wire transfer that is on an OFAC list or is otherwise asked to facilitate a transaction prohibited under a government sanctions program, the Bank must freeze or block such account or reject a transaction, and perform additional procedures as required by OFAC regulations. The Bank filters its customer base and transactional activity against OFAC-issued lists. The Bank performs these checks using purpose directed software, which is updated each time a modification is made to the lists provided by OFAC and other agencies.

Unfair or Deceptive or Abusive Acts or Practices Section 5 of the Federal Trade Commission Act prohibits all persons, including financial institutions, from engaging in any unfair or deceptive acts or practices in or affecting commerce. Dodd-Frank codified this prohibition and expanded it even further by prohibiting abusive practices. These prohibitions, commonly referred to as “UDAAP,” apply to all areas of the Bank’s operations, including its marketing and advertising practices, product features, account agreements terms and conditions, operational practices, and the conduct of third parties with whom the Bank may partner or on whom the Bank may rely in bringing Bank products and services to the marketplace.

Other Consumer Protection-Related Laws and Regulations The Bank is subject to a wide range of consumer protection laws and regulations which may have an enterprise-wide impact or may principally govern its lending or deposit operations. To the extent the Bank engages third-party service providers in any aspect of its products and services, the third parties may also be subject to compliance with applicable law and must therefore be subject to Bank oversight.

The Bank is subject to numerous federal consumer protection laws related to its lending activities, including but not limited to: (1) the Truth in Lending Act, governing disclosures of credit terms to consumer borrowers; (2) the Home Mortgage Disclosure Act of 1975, requiring financial institutions to provide information to enable the public and public officials to determine whether a financial institution is fulfilling its obligation to help meet the housing needs of the community it serves; (3) the Equal Credit Opportunity Act, prohibiting discrimination on the basis of race, creed or other prohibited factors in extending credit; (4) the Fair Credit Reporting Act of 1978, as amended by the Fair and Accurate Credit Transactions Act, governing the use and provision of information to credit reporting agencies, certain identity theft protections and certain credit and other disclosures; (5) the Fair Debt Collection Practices Act, governing the manner in which consumer debts may be collected by collection agencies; (6) the Home Ownership and Equity Protection Act prohibiting unfair, abusive or deceptive home mortgage lending practices, restricting mortgage lending activities and providing advertising and mortgage disclosure standards; (7) the Service Members Civil Relief Act, postponing or suspending some civil obligations of service members during periods of transition, deployment and other times; and (8) related rules and regulations of the various federal agencies charged with implementing these federal laws. In addition, interest and other charges collected or contracted for by the Bank will be subject to state usury laws and federal laws concerning interest rates.

Deposit-related activities of the Bank are also subject to various consumer protection laws, including but not limited to: (1) the Truth in Savings Act, which imposes disclosure obligations to enable consumers to make informed decisions about accounts at depository institutions; (2) the Right to Financial Privacy Act, which imposes a duty to maintain confidentiality of consumer financial records and prescribes procedures for complying with administrative subpoenas of financial records; (3) the Expedited Funds Availability Act, which establishes standards related to when financial institutions must make various deposit items available for withdrawal, and requires depository institutions to disclose their availability policies to their depositors; (4) the Electronic Fund

Transfer Act, which governs electronic fund transfers to and withdrawals from deposit accounts and customers’ rights and liabilities arising from the use of ATMs and other electronic banking services as well as the process for reporting and investigating errors; and (5) related rules and regulations of various federal agencies charged with implementing these federal laws.

Prepaid Account Rule Amending Regulation E and Regulation Z The Consumer Financial Protection Bureau (“CFPB”) has adopted amendments to Regulation E and Regulation Z to add protections for prepaid accounts (the “Prepaid Rule”). The Prepaid Rule includes a significant number of changes to the regulatory framework for prepaid products, some of which include: (1) establishment of a definition of “prepaid account” within Regulation E to include reloadable and non-reloadable physical cards, as well as codes or other devices; (2) modification of Regulation E to require prescribed disclosures be provided to the consumer; (3) extending to prepaid accounts the periodic transaction history and statement requirements of Regulation E applicable to payroll and federal government benefit accounts; (4) extending the error resolution and limited liability provisions of Regulation E applicable to payroll cards to registered network branded prepaid cards; (5) requiring financial institutions to post prepaid account agreements to the issuers’ websites and to submit them to the CFPB; (6) extending Regulation Z’s credit card rules and disclosure requirements to prepaid accounts providing overdraft protection and other credit features; (7) requiring a prepaid account holder’s consent prior to adding overdraft services or other credit features and prohibiting an issuer from adding such services or features for at least 30 calendar days after the consumer registers the prepaid account; and (8) prohibiting application of different terms and conditions, such as charging different fees, to a prepaid account depending on whether the consumer elects to link the prepaid account to overdraft services or other credit features. The Bank has evaluated the impact of the Prepaid Rule on its operations and its third-party relationships and established internal processes accordingly.

Community Reinvestment Act Under the Community Reinvestment Act of 1977 (“CRA”), a federally-insured institution has a continuing and affirmative obligation to help meet the credit needs of its community, including low-and moderate-income neighborhoods, consistent with the safe and sound operation of the institution. The CRA requires financial institutions to delineate one or more assessment areas within which the regulator evaluates the bank’s record of helping to meet the credit needs of its community. The CRA further requires that a record be kept of whether a financial institution meets its community’s credit needs, which record will be considered when evaluating applications for, among other things, domestic branches and mergers and acquisitions. The regulations promulgated pursuant to the CRA contain three tests which are part of the traditional CRA evaluation. As an alternative to the traditional evaluation tests, the CRA permits a financial institution to develop its own strategic plan with specific goals for CRA compliance and related performance ratings. If its strategic plan is approved by its regulator, the financial institution’s CRA ratings will be applied based on its performance under the strategic plan.

The Bank operates its CRA program under a strategic plan approved by its regulator. While operating as a state-chartered institution under the supervision of the FDIC, the Bank operated under an FDIC-approved strategic plan covering the period of January 1, 2021 through December 31, 2023. In 2022, after converting to a national bank under the supervision of the OCC, the Bank revised its strategic plan, which was approved by the OCC on December 15, 2022. The current strategic plan covers the period of January 1, 2023 through December 31, 2025. The Bank continues to closely monitor its performance in alignment with the strategic plan to meet the lending, service and investment requirements it contains. Additionally, the Bank was assigned a “Satisfactory” CRA rating in its most recent CRA performance evaluation, which was completed in February 2023.

On October 24, 2023, the OCC, FDIC and Federal Reserve issued a final rule to modernize CRA regulations. The rule encourages banks to expand access to credit, investment and banking services in low-income to moderate-income communities and adapts CRA regulations to changes in the banking industry, including internet and mobile banking. The changes are also intended to provide greater clarity and consistency in the application of CRA regulations while tailoring CRA evaluations and data collection to bank size and type. Most of the rule’s requirements will be applicable beginning January 1, 2026. The revised regulations permit banks to meet their CRA requirements within an individually tailored strategic plan. Accordingly, prior to the December 31, 2025 expiration of our current CRA strategic plan, we plan to submit a new strategic plan to the OCC for their approval.

Enforcement Under the FDIA, federal banking regulators have authority to bring actions against a bank and all affiliated parties, including stockholders, attorneys, appraisers and accountants, who knowingly or recklessly participate in wrongful actions likely to have an adverse effect on the bank. Formal enforcement action may range from the issuance of a capital directive or cease and desist order, to removal of officers and/or directors, to the institution of receivership or conservatorship proceedings, or termination of deposit insurance. Civil money penalties cover a wide range of violations and can amount to $27,500 per day, or even $1.1 million per day in especially egregious cases. Federal law also establishes criminal penalties for certain violations.

Reserve Requirements Federal Reserve regulations require banks to maintain reserves against their demand deposits, with lesser reserves on limited transaction accounts, after subtraction of exempted amounts. For 2023, the exemptions for demand deposits

and limited transaction accounts were, respectively, $36.1 million and $644.0 million. At December 31, 2023, the Bank had $1.03 billion in cash and balances at the Federal Reserve. While legal statutes require recalculation of these exemptions annually, the Federal Reserve, as a result of the COVID-19 pandemic, waived reserve requirements and has not reinstated them through December 31, 2023. We believe we have sufficient sources of liquidity to offset the impact of reserve requirements if or when they are reinstated.

Dodd-Frank Enacted in 2010, Dodd-Frank implemented far-reaching changes across the financial regulatory landscape in the United States. Since its enactment, banks and financial services firms have experienced enhanced regulation and oversight. Certain Dodd-Frank provisions directly impacting the Company or the Bank included: (1) creation of the CFPB which was given broad rulemaking, supervision and enforcement authority for a wide range of consumer protection laws applicable to all banks and certain others, and examination and enforcement powers with respect to any bank with more than $10 billion in assets; (2) restriction of the preemption of state consumer financial protection law by federal law, and disallowing subsidiaries and affiliates of national banks from availing themselves of such preemption; (3) requiring new capital rules and application of the same leverage and risk-based capital requirements that apply to insured depository institutions to most bank holding companies; changing the assessment base for federal deposit insurance from the amount of insured deposits to consolidated average assets less tangible capital, increasing the minimum DRR from 1.15% to 1.35%, and requiring the FDIC, in setting assessments, to offset the effect of the increase on institutions with assets of less than $10 billion; see “Capital Adequacy,” “Basel III Capital Rules,” and “Prompt Corrective Action” above; (4) requiring all bank holding companies to serve as a source of financial strength to their depository institution subsidiaries in the event such subsidiaries suffer from financial distress; see “Holding Company Liability,” “Capital Adequacy,” and “Prompt Corrective Action” above; (5) providing new disclosure and other requirements relating to executive compensation and corporate governance, including guidelines or regulations on incentive-based compensation and a prohibition on compensation arrangements that encourage inappropriate risks or that could provide excessive compensation; see “Federal Regulatory Guidance on Incentive Compensation” below for details; (6) repeal of the federal prohibitions on the payment of interest on demand deposits, thereby permitting depository institutions to pay interest on business transaction and other accounts; (7) provisions in what is known as the Durbin Amendment designed to restrict interchange fees for certain debit card issuers and limiting the ability of networks and issuers to restrict debit card transaction routing; see “Regulation II” below; (8) increasing the authority of the Federal Reserve to examine holding companies and their non-bank subsidiaries; and (9) restricting proprietary trading by banks, bank holding companies and others, and their acquisition and retention of ownership interests in and sponsorship of hedge funds and private equity funds. This restriction is commonly referred to as the “Volcker Rule.” See “Volcker Rule Adoption” below.

Federal Regulatory Guidance on Incentive Compensation The federal banking regulators have issued guidance on sound incentive compensation policies for banking organizations. This guidance, which covers all employees with the ability to materially affect the risk profile of an organization either individually or as a part of a group, is based upon key principles designed to ensure that incentive compensation practices are not structured in a manner to give employees incentives to take imprudent risks. Federal regulators actively monitor actions being taken by banking organizations with respect to incentive compensation arrangements and review and update their guidance as appropriate to incorporate emerging best practices.

The Federal Reserve reviews, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations such as ours that are not considered “large, complex banking organizations.” The reviews are tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements and any findings are included in reports of examination. Deficiencies are incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management controls or governance processes, pose a risk to the organization’s safety and soundness, and the organization is not taking prompt and effective measures to correct the deficiencies.

Dodd-Frank requires that the federal banking agencies, including the Federal Reserve and the OCC, issue a rule related to incentive-based compensation. No final rule implementing this provision of Dodd-Frank has, as of the date of the filing of this Annual Report on Form 10-K, been adopted, but a proposed rule was published in 2016 that expanded upon a prior proposed rule published in 2011. The proposed rule is intended to (i) prohibit incentive-based payment arrangements that the banking agencies determine could encourage certain financial institutions to take inappropriate risks by providing excessive compensation or that could lead to material financial loss, (ii) require the board of directors of those financial institutions to take certain oversight actions related to incentive-based compensation, and (iii) require those financial institutions to disclose information concerning incentive-based compensation arrangements to the appropriate federal regulator. Although a final rule has not been issued, the Company and the Bank have undertaken efforts to ensure that their incentive compensation plans do not encourage inappropriate risks, consistent with the principles identified above.

Regulation II The “Durbin Amendment” to Dodd-Frank and the Federal Reserve’s implementing Regulation II exempt from debit card interchange fee standards any issuing bank that, together with its affiliates, have assets of less than $10 billion. Because of our asset size, we are exempt from the debit card interchange fee standards but may lose the exemption if Regulation II is amended or if we, together with our subsidiaries, surpass $10 billion in assets. Regulation II also prohibits network exclusivity arrangements on debit card transactions and ensures merchants will have choices in debit card routing, and these provisions apply to us. Under the Durbin Amendment to Dodd-Frank and the Federal Reserve’s implementing regulations, the debit card interchange fee that the Bank charges merchants must be reasonable and proportional to the cost of clearing the transaction. The maximum permissible interchange fee is capped at the sum of $0.21 plus five basis points of the transaction value for many types of debit interchange transactions. The Bank may also recover $0.01 per transaction for fraud prevention purposes if it complies with certain fraud-related requirements. The Federal Reserve also has established rules governing routing and exclusivity that require debit card issuers to offer two unaffiliated networks for routing transactions on each debit or prepaid product.

Volcker Rule Under provisions of Dodd-Frank known as the “Volcker Rule” and implementing regulations, banking entities may not (1) engage in short-term proprietary trading for their own accounts or (2) have certain ownership interests in and relationships with hedge funds or private equity funds, referred to as “covered funds.” The Volcker Rule also requires each regulated entity to establish an internal compliance program consistent with the extent to which it engages in prohibited activities, which must include (for the largest entities) making regular reports about those activities to regulators. Smaller banks and community banks, including the Bank, are afforded some relief under the Volcker Rule. Smaller banks, including the Bank, that are engaged only in exempted proprietary trading, such as trading in U.S. government, agency, state and municipal obligations, are exempt from compliance program requirements. Moreover, even if a community or small bank engages in proprietary trading or covered fund activities under the Volcker Rule, they need only incorporate references to the Volcker Rule into their existing policies and procedures.

Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 In 2018, the Economic Growth, Regulatory Relief, and Consumer Protection Act (“EGRRCPA”) was signed into law, which amended provisions of Dodd-Frank and was intended to ease regulatory burdens, particularly with respect to smaller-sized banking institutions, e.g., those with less than $10 billion in assets, such as us. EGRRCPA’s highlights include: (i) exemption of banks with less than $10 billion in assets from the ability-to-repay requirements for certain qualified residential mortgage loans held in portfolio; (ii) clarification that, subject to various conditions, reciprocal deposits of another depository institution obtained using a deposit broker through a deposit placement network for purposes of obtaining maximum deposit insurance would not be considered brokered deposits subject to the FDIC’s brokered-deposit regulations; and (iii) simplification of capital calculations by requiring regulators to establish for institutions under $10 billion in assets a community bank leverage ratio (tangible equity to average consolidated assets) at a percentage not less than 8% and not greater than 10% that such institutions may elect to replace the general applicable risk-based capital requirements for determining well capitalized status.

Consumer Protections for Remittance Transfers In 2012, the CFPB published a final Remittance Transfer Rule (the “Remittance Rule”) to implement Section 1073 of Dodd-Frank. The Remittance Rule creates a comprehensive set of consumer protections, found in Regulation E, covering remittance transfers sent by consumers in the United States to parties in foreign countries. The Remittance Rule, among other things, mandates certain disclosures and consumer cancellation rights for foreign remittances covered by the rule.

Effect of Governmental Monetary Policies The commercial banking business is affected not only by general economic conditions but also by both U.S. fiscal policy and the monetary policies of the Federal Reserve. Some of the instruments of fiscal and monetary policy available to the Federal Reserve include changes in the discount rate on member bank borrowings, the fluctuating availability of borrowings at the “discount window,” open market operations, the imposition of and changes in reserve requirements against member banks’ deposits and assets of foreign branches, the imposition of and changes in reserve requirements against certain borrowings by banks and their affiliates, and the placing of limits on interest rates that member banks may pay on time and savings deposits. Such policies influence to a significant extent the overall growth of bank loans, investments, and deposits and the interest rates charged on loans or paid on time and savings deposits. See Item 7,“Management’s Discussion and Analysis of Financial Condition and Results of Operations.” We cannot predict the nature of the future fiscal and monetary policies and the effect of such policies on future business and our earnings.

OCC Supervisory Strategies Related to Banking Regulations. The OCC announced on September 28, 2023 that its supervisory strategies for 2024 will focus on: (a) asset and liability management; (b) credit risk management and allowance for credit losses (“ACL”); (c) cybersecurity; (d) operational resilience; (e) distributed ledger technology (“DLT”) related activities; (f) change management; (g) new products and services, including those related to payments and fintech/digital assets; (h) BSA/anti-money laundering and OFAC/sanctions programs compliance management; (i) consumer compliance and fair lending risk; (j) CRA

performance; and (k) climate-related financial risk management. The OCC’s 2024 supervisory plan provides the foundation for policy initiatives and for supervisory strategies as applied to national banks as well as their technology service providers. OCC staff members use the supervisory plan to guide their supervisory priorities, planning, and resource allocations. The OCC typically provides periodic updates about supervisory priorities through the Semiannual Risk Perspective process in the fall and spring of each year.

State Laws and Regulations Notwithstanding its federal charter, the Bank is governed by other state laws and regulations in connection with some of its business and operational practices. This includes, for example, complying with state laws governing abandoned or unclaimed property, state and local licensing requirements, and other state-based rules which direct how the Bank may conduct its activities, unless otherwise preempted by its federal charter.

Available Information

Our principal executive offices are located at 409 Silverside Road, Wilmington, Delaware 19809 and our telephone number is (302) 385-5000. The Bank headquarters are located at 345 North Reid Place Suite 700 Sioux Falls, South Dakota 57103. We make available free of charge on our website, www.thebancorp.com, our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and amendments to those reports filed or furnished pursuant to Section 13(a) or Section 15(d) of the Exchange Act as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC. Investors are encouraged to access these reports and other information about our business on our website. Information found on our website shall not be deemed incorporated by reference into, and does not form any part of, this Annual Report on Form 10-K. We also will provide copies of our Annual Report on Form 10-K, free of charge, upon written request to our Investor Relations Department at our address for our principal executive offices. Also posted on our website, and available in print upon request by any stockholder to our Investor Relations Department, are the charters of the standing committees of our Board and standards of conduct governing our directors, officers and employees.

ITEM 1A. RISK FACTORS.

Risk Factors Summary

Risks Relating to Our Business and Industry

Periods of weak economic and slow growth conditions in the U.S. economy have had, and may continue to have, significant adverse effects on our assets and operating results.

Recent developments in the banking industry related to specific problem banks could have a negative impact on the industry as a whole and may negatively impact stock prices and result in additional regulations that could increase our expenses and otherwise affect our operations.

We cannot assure you that we will be able to accomplish our strategic goals as necessary to meet our financial targets.

We may have difficulty managing our growth which may divert resources and limit our ability to expand our operations successfully.

Risk management processes and strategies must be effective, and concentration of risk increases the potential for losses.

We operate in highly competitive markets, and our affinity group marketing strategy has been adopted by other institutions with which we compete.

As a financial institution whose principal medium for delivery of banking services is the internet, we are subject to risks particular to that medium and other technological risks and costs.

Our operations may be interrupted if our network or computer systems, or those of our third-party service providers, fail.

We face cybersecurity risks, which could result in a loss of customers, cause disclosure of confidential information, adversely affect our operations, cause reputational damage and create significant legal and financial exposure.

Failure to comply with personal data protection and privacy laws can adversely affect our business.

We and the Bank are subject to and may be affected by extensive government regulation.

Any additional future FDIC insurance premium increases will adversely affect our earnings.

We are subject to extensive government supervision with respect to our compliance with numerous laws and regulations.

Our reputation and business could be damaged by our entry into any future enforcement matters with our regulators and other negative publicity.

We are subject to risks associated with the third parties to whom we outsource many essential services, including risks related to our agreements and oversight of their activities.

Legislative and regulatory actions taken now or in the future may increase our operating costs and impact our business, governance structure, financial condition or results of operations.

A downgrade of the U.S. credit rating could negatively impact our business, results of operations and financial condition.

New lines of business, and new products and services may result in exposure to new risks and the value and earnings related to existing lines of business are subject to market conditions.

Potential acquisitions may disrupt our business and dilute stockholder value.

Inflation could negatively and materially impact our business directly or indirectly by its impact on our borrowers.

The loss or transition of key members of our senior management team or key staff in the Bank's divisions, or our inability to attract and retain qualified personnel, could adversely affect our business.

Increased scrutiny with respect to environmental, social and governance (“ESG”) practices may impose additional costs on the Company or expose it to new risks.

Climate change or government action and societal responses to climate change could adversely affect our results of operations.

Risks Related to Our Specialty Lending Business Activities

Changes in interest rates and loan production could reduce our income, cash flows and asset values.

We are subject to lending risks.

The success of our SBA lending program is dependent upon the continued availability of SBA loan programs, our status as a Preferred Lender under the SBA loan programs, our ability to comply with applicable SBA lending requirements and our ability to successfully manage related risks.

The Bank’s allowance for credit losses may not be adequate to cover actual losses.

Our lending limit may adversely affect our competitiveness.

Revised accounting standards require current recognition of credit losses over the estimated remaining lives of loans.

The Bank may suffer losses in its loan portfolio despite its underwriting practices.

Environmental liability associated with lending activities could result in losses.

A prolonged U.S. government shutdown or default by the United States on government obligations could harm our results of operations.

Risks Relating to Our Payments Business Activities

Regulatory and legal requirements applicable to the prepaid and debit card industry are unique and frequently changing.

Changes in rules or standards set by the payment networks, or changes in debit network fees or products or interchange rates, could adversely affect our business, financial position and results of operations.The potential for fraud in the card payment industry is significant and could adversely affect our business and results of operations.

There is a significant concentration in prepaid and debit card fee income which is subject to various risks.

If our prepaid and debit card and other deposit accounts generated by third parties were no longer classified as non-brokered, our FDIC insurance expense might increase.

We may depend in part upon wholesale and brokered certificates of deposit to satisfy funding needs.

We derive a significant percentage of our deposits, total assets and income from deposit accounts generated by diverse independent companies, including those which provide card account marketing services, and investment advisory firms.

We face fund transfer and payments-related risks.

Unclaimed funds from deposit accounts or represented by unused value on prepaid cards present compliance and other risks.

Risks Relating to Taxes and Accounting

We are subject to tax audits, and challenges to our tax positions or adverse changes or interpretations of tax laws could result in tax liability.

The appraised fair value of the assets from our commercial loans, at fair value or collateral from other loan categories may be more than the amounts received upon sale or other disposition.

A failure to implement and maintain effective internal control over financial reporting could result in material misstatements in our financial statements which could require us to restate financial statements, cause investors to lose confidence in our reported financial information and have a negative effect on our stock price.

Risks Related to Ownership of Our Common Stock

The price of our common stock may decline or otherwise become volatile.

An investment in our common stock is not an insured deposit.

Future offerings of debt, which would be senior to our common stock upon liquidation, and/or preferred equity securities which may be senior to our common stock for purposes of dividend distributions or upon liquidation, may reduce the market price at which our common stock trades.

The Bank’s ability to pay dividends is subject to regulatory limitations which, to the extent we require such dividends in the future, may affect our ability to pay our obligations and pay dividends.

Anti-takeover provisions of our certificate of incorporation, bylaws and Delaware law may make it more difficult for holders of our common stock to receive a change in control premium.

Our Amended and Restated Bylaws provide that certain courts in the State of Delaware or the federal district courts of the United States will be the sole and exclusive forum for substantially all disputes between us and our stockholders, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers, or employees.

General Risks

Severe weather, natural disasters, geopolitical events, public health crises, acts of war or terrorism or other adverse external events could harm our business.

Investing in our common stock involves risk. The following risk factors should be read carefully in connection with evaluating our business and the forward-looking statements contained in this Annual Report on Form 10-K. Any of these risk factors could lead to material adverse effects on our business, operating results and financial condition. Additional risks and uncertainties not currently known to us or that we currently do not view as material may also become materially adverse our business in future periods or if circumstances change.

Risks Relating to Our Business and Industry

Periods of weak economic and slow growth conditions in the U.S. economy have had, and may continue to have, significant adverse effects on our assets and operating results.

In recent periods, the U.S. economy has been subject to low rates of growth in general and, in particular localities, recession-like conditions have occurred. As a result, the financial system in the United States, including credit markets and markets for real estate and real-estate related assets, has periodically been subject to weakness. These weaknesses have episodically resulted in declines in the availability of credit, reduction in the values of real estate and real estate-related assets, the reduction of markets for those assets and impairment of the ability of certain borrowers to repay their obligations. Weak economic conditions can also impact consumer spending and related fees in our payments businesses. A continuation of weak economic conditions could further harm our financial condition and results of operations.

Recent developments in the banking industry related to specific problem banks could have a negative impact on the industry as a whole and may negatively impact stock prices and result in additional regulations that could increase our expenses and otherwise affect our operations.

Recent high-profile bank failures have generated market volatility among publicly traded bank holding companies, unrelated to the Company, and industry commentary through social media and other outlets has negatively impacted confidence in depository institutions and created uncertainty with respect to the health of the U.S. banking system. If such levels of financial market volatility continue, or if rumored or actual events occur which further erode the actual or perceived stability of the banking system and financial markets, this could trigger additional regulatory scrutiny, increased FDIC insurance premiums or assessments, and new or amended regulations which may adversely affect the Company. While the underlying causes of these recent market events are not apparent within the Company or the Bank, these recent events and regulatory agency responses, including increased FDIC insurance premiums or assessments, could have a material impact on our business.

We cannot assure you that we will be able to accomplish our strategic goals as necessary to meet our financial targets.

Our future earnings will reflect our level of success in replacing and growing both our loans and deposits at targeted rates and yields, and the payments transactions from which we derive fee income. Our businesses differ from most banks in the nature of both our lending niches and our payments businesses, and changes in loan acquisition and repayment speeds. Loan, deposit and transaction growth rates and financial targets may also be impacted by other strategic goals and key considerations. Our key considerations for growth include whether we will be able to manage credit risk to desired levels, improve our net interest margin and monitor interest rate sensitivity, manage our real estate exposure to capital levels and maintain flexibility if we achieve asset growth. Our strategic goals which will also impact our ability to meet our performance goals also include maintaining a scalable infrastructure, continuing technology innovations, maintaining our compliance and risk function; non-interest expense management and others. There can be no assurance that we will maintain or increase loan and deposit balances or payment transactions at the required yields or volumes, or succeed in achieving these key considerations or other strategic goals, as necessary to achieve financial targets.

We may have difficulty managing our growth which may divert resources and limit our ability to expand our operations successfully.

Our future profitability will depend in part on our continued ability to grow; however, we may not be able to sustain our historical growth rate or be able to grow. Our future success will depend on the ability of our officers and key employees to continue to implement and improve our operational, financial and management controls, reporting systems and procedures and manage a growing number of customer relationships. We may not implement improvements to our management information and control systems in an efficient or timely manner and may discover deficiencies in existing systems and controls. Consequently, any future growth may place a strain on our administrative and operational infrastructure. Any such strain could increase our costs, reduce or eliminate our profitability and reduce the price at which our common stock trades.

Risk management processes and strategies must be effective, and concentration of risk increases the potential for losses.

Our risk management processes and strategies must be effective, otherwise losses may result. We manage asset quality, liquidity, market sensitivity, operational, regulatory, third-party vendor and partner relationship risks and other risks through various processes and strategies throughout the organization. However, our risk management measures may not be fully effective in identifying and mitigating risk exposure in all market environments or against all types of risk, including risks that are unidentified or unanticipated, even if the frameworks for assessing risk are properly designed and implemented. Some of our methods of managing risk are based upon the use of observed historical market behavior and management’s judgment. These methods may not accurately predict future exposures, which could be significantly greater than historical measures indicate. If our risk management judgments and strategies are not effective, or unanticipated risks arise, our income could be reduced or we could sustain losses.

We operate in highly competitive markets, and our affinity group marketing strategy has been adopted by other institutions with which we compete.

We face substantial competition in all phases of our operations from a variety of different competitors, including commercial banks and their holding companies, credit unions, leasing companies, consumer finance companies, factoring companies, insurance companies, money market mutual funds and card issuers, online lenders, financial technology companies and other non-traditional competitors. See Item 1, “Business—Competition.”

We face national and even global competition with respect to our other products and services, including payment acceptance products and services, private label banking, fleet leasing, government guaranteed lending and payment solutions. Our commercial partners and banking customers for these products and services are located throughout the United States, and the competition is strong in each category. We encounter competition from some of the largest financial institutions in the world as well as smaller specialized regional banks and financial service companies. Increased competition with any of these product or service offerings could result in reduced pricing and lower profit margins, fragmented market share and a failure to enjoy economies of scale, loss of customer and depositor base, and other risks that individually, or in the aggregate, could have a material adverse effect on our financial condition and results of operations. Further, some of the financial services organizations with which we compete are not subject to the same degree of regulation as federally-insured and regulated financial institutions such as ours. As a result, those competitors may be able to access funding and provide various services more easily or at less cost than we can.

Several online banking operations as well as the online banking programs of conventional banks have instituted affinity group marketing strategies similar to ours. As a consequence, we have encountered competition in this area and anticipate that we will

continue to do so in the future. This competition may increase our costs, reduce our revenues or revenue growth or, because we are a relatively small banking operation without the name recognition of other, more established banking operations, make it difficult for us to compete effectively in obtaining affinity group relationships.

As a financial institution whose principal medium for delivery of banking services is the internet, we are subject to risks particular to that medium and other technological risks and costs.

We utilize the internet and other automated electronic processing in our banking services without physical locations, as distinguished from the internet banking service of an established conventional bank. Independent internet banks often have found it difficult to achieve profitability and revenue growth. Several factors contribute to the unique problems that internet banks face. These include concerns for the security of personal information, the absence of personal relationships between bankers and customers, the absence of loyalty to a conventional hometown bank, the customer’s difficulty in understanding and assessing the substance and financial strength of an internet bank, a lack of confidence in the likelihood of success and permanence of internet banks and many individuals’ unwillingness to trust their personal assets to a relatively new technological medium such as the internet. As a result, many potential customers may be unwilling to establish a relationship with us.

Many conventional financial institutions offer the option of internet banking and financial services to their existing and prospective customers. The public may perceive conventional financial institutions as being safer, more responsive, more comfortable to deal with and more accountable as providers of their banking and financial services, including their internet banking services. We may not be able to offer internet banking and financial services and personal relationship characteristics that have sufficient advantages over the internet banking and financial services and other characteristics of established conventional financial institutions to enable us to compete successfully.

Moreover, both the internet and the financial services industry are undergoing rapid technological changes, with frequent introductions of new technology-driven products and services. In addition to improving the ability to serve customers, the effective use of technology increases efficiency and enables financial institutions to reduce costs. Our ability to compete will depend, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers. Such products may also prove costly to develop or acquire.

Our operations may be interrupted if our network or computer systems, or those of our third-party service providers, fail.

Because we deliver our products and services over the internet and outsource several critical functions to third parties, our operations depend on our ability, as well as that of our service providers, to protect computer systems and network infrastructure against interruptions in service due to damage from fire, power loss, telecommunications failure, software or hardware defects physical attacks, computer hacking or similar events. Our operations also depend upon our ability to replace a third-party provider if it experiences difficulties that interrupt our operations or if an operationally essential third-party service terminates. Any damage to, or failure of, or delay in our processes or systems generally, or those of our service providers, or an improper action by our employees, agents or third-party vendors, could result in interruptions in our service. Service interruptions impacting customers may adversely affect our ability to obtain or retain customers and could result in regulatory sanctions. Moreover, if a customer were unable to access their account or complete a financial transaction due to a service interruption, we could be subject to a claim by the customer for their loss. While our accounts and other agreements contain disclaimers of liability for these kinds of losses, we cannot predict the outcome of litigation if a customer were to make a claim against us. If we face system interruptions or failures, our business interruption insurance may not be adequate to cover the losses or damages that we incur. In addition, our insurance costs may also increase substantially in the future to cover the costs our insurance carriers may incur.

We face cybersecurity risks, which could result in a loss of customers, cause disclosure of confidential information, adversely affect our operations, cause reputational damage and create significant legal and financial exposure.

A significant barrier to online and other financial transactions is the secure transmission of confidential information over public networks and other mediums. The systems we use rely on encryption and authentication technology to provide secure transmission of confidential information. These systems, as well as those of third-party service providers, may be targeted in cyberattacks, such as denial of service attacks, hacking, malware or ransomware intrusion, data corruption attempts, terrorist activities,

or identity theft. Cyberattacks may expose security vulnerabilities in our systems or the systems of third parties that could result in the unauthorized gathering, monitoring, misuse, release, loss, or destruction of confidential, proprietary, or sensitive information. As cyber threats continue to evolve, we may be required to expend significant resources to modify or enhance protective measures or to investigate and remediate any information security vulnerabilities or incidents. Additionally, if we, or another provider of financial services through the internet, were to suffer damage from a security breach, public acceptance and use of the internet as a medium for financial transactions could suffer.

A successful penetration or circumvention of system security could cause serious negative consequences, including deterrence of potential customers or loss of existing customers, thereby impairing our ability to grow and maintain profitability and, possibly, our ability to continue delivering our products and services through the internet. A successful breach could also result in significant disruption to our operations and business; misappropriation, exposure or destruction of confidential information, intellectual property, funds and those of our clients; damage to the computers or systems of us, our clients or third party service providers; or a violation of applicable privacy laws and other laws. This could result in litigation exposure, regulatory fines, penalties, loss of confidence in our security measures, reputational damage, remediation, reimbursement or other compensatory costs, and additional compliance costs, which could adversely impact our results of operations and financial condition. In addition, we may not have adequate insurance coverage to compensate for losses from a cybersecurity event. Although we, with the help of third-party service providers, intend to continue to implement security technology and establish operational procedures to prevent security breaches, these measures may not be successful.

Failure to comply with personal data protection and privacy laws can adversely affect our business.

We are subject to a variety of continuously evolving and developing laws and regulations in numerous jurisdictions regarding personal data protection and privacy. These laws and regulations may be interpreted and applied differently from state to state, and can create inconsistent or conflicting requirements. Our efforts to comply with these laws and regulations, including the CCPA as well as comprehensive privacy legislation passed in Virginia, Colorado, Utah and Connecticut and other states, impose significant costs and challenges that are likely to continue to increase over time, particularly as additional jurisdictions continue to adopt similar regulations. Failure to comply with these laws and regulations or to otherwise protect personal data from unauthorized access, use or other processing, could in the future result in litigation, claims, legal or regulatory proceedings, inquiries or investigations, damage to our reputation, fines or penalties, all of which can adversely affect our business.

We and the Bank are subject to and may be affected by extensive government regulation.

We are subject to extensive federal and state regulation and supervision, which has increased in recent years as a result of stress to the financial system. Our subsidiary, the Bank, is a national bank that is also subject to broad federal regulation and oversight extending to all of its operations by its primary federal regulator, the OCC, and by its deposit insurer, the FDIC. Banking regulations are primarily intended to protect customers, depositors’ funds, the federal deposit insurance funds and the banking system as a whole, rather than our stockholders. These regulations affect the Bank’s lending practices, capital structure and requirements, investment activities, dividend policy, product offerings, expansionary strategies and growth, among other things. For example, under capital adequacy guidelines and the regulatory framework for prompt corrective action, we and the Bank must meet specific capital guidelines that involve quantitative measures of their assets, liabilities and certain off-balance sheet items as calculated under regulatory accounting practices. The capital amounts and classification of us and the Bank are also subject to qualitative judgments by regulators about components, risk weightings and other factors. Moreover, capital requirements may be modified based upon regulatory rules or by regulatory discretion at any time due to a variety of factors, including deterioration in asset quality. A failure by either the Bank or us to meet regulatory capital requirements will result in the imposition of limitations on our operations and could, if capital levels drop significantly, result in our being required to cease operations. Regulatory capital requirements must also be satisfied such that mandated capital ratios are maintained as the Bank grows, or growth may be required to be curtailed. Moreover, a failure by either the Bank or us to comply with regulatory requirements regarding lending practices, investment practices, customer relationships, anti-money laundering detection and prevention, and other operational practices, as discussed further under Item 1, “Business – Regulation Under Banking Law,” could result in regulatory sanctions and possibly third-party liabilities.

Additionally, failure to maintain a satisfactory CRA rating may result in business restrictions. Until September 15, 2022, the Bank operated its CRA program under an FDIC-approved CRA strategic plan and was assigned an “Outstanding” CRA rating. The Bank began operating under an OCC-approved strategic plan effective January 1, 2023. The Bank continues to closely monitor its performance in alignment with its CRA strategic plan to meet the specified lending, service and investment requirements contained

therein. There can be no assurance that we will maintain a satisfactory rating, and if not maintained, the Bank would be subject to certain business restrictions as required by the CRA and FDIC regulations.

The legal and regulatory landscape is frequently changing as Congress and regulatory agencies adopt or amend laws, or change interpretation of existing statutes, regulations or policies. These changes could affect us and the Bank in substantial and unpredictable ways and could have a material adverse effect on our financial condition and results of operations. For example, the Bank pays assessment fees both to the OCC and the FDIC, and the level of such assessments reflects the condition of the Bank. If the condition of the Bank were to deteriorate, the level of such assessments could increase significantly, having a material adverse effect on the Company’s financial condition and results of operations. Additionally, any change in regulators or policy changes within current regulators could result in modified regulatory requirements, which could adversely impact credit, capital, earnings, liquidity and other operations, and should they require modifications in our lines of business, could impact profitability.

Any additional future FDIC insurance premium increases will adversely affect our earnings.

The DIF maintained by the FDIC to resolve bank failures is funded by fees assessed on insured depository institutions. Any further assessments or special assessments that the FDIC levies will be recorded as an expense during the appropriate period and will decrease our earnings. The deposit insurance assessment base is set as average consolidated total assets minus average tangible equity, and the rate applied against that base reflects factors including loan performance, capital levels and supervisory examination classification. with increased rates for brokered deposits. For full year 2023, the FDIC increased the initial base deposit insurance assessment rate schedules applicable to all insured depository institutions by 2 basis points. Changes in the aforementioned factors or further increases in assessment rates will adversely affect our earnings.

We are subject to extensive government supervision with respect to our compliance with numerous laws and regulations.

We have policies and procedures designed to prevent violations of the extensive federal and state laws and regulations that we are subject to, however there can be no assurance that such violations will not occur. Failure to comply with these statutes, regulations or policies could result in a determination of an apparent violation of law, and could trigger formal or informal enforcement actions or other sanctions against us or the Bank by regulatory agencies, including entering into consent orders or other agreements, assessment of civil money penalties, criminal penalties, reputational damage, and a downgrade in the Company’s ratings or the Bank’s ratings for capital adequacy, asset quality, management, earnings, liquidity and market sensitivity, any of which alone or in combination could have a material adverse effect on our financial condition and results of operations. Further, we are at risk of the imposition of additional civil money penalties by our regulators, based on, among other things, repeat violations, or supervisory determinations of non-compliance with any consent order. Depending on the circumstances, the imposition and size of any such penalty is at the discretion of the regulator. While the Bank may be contractually indemnified for certain violations attributable to third parties, civil money penalties, if assessed against the Bank, are not recoverable from third parties.

Our reputation and business could be damaged by our entry into any future enforcement matters with our regulators and other negative publicity.

Reputational risk, or the risk to our business, earnings and capital from negative publicity, is inherent in our business. Negative publicity can result from actual or alleged conduct in a number of areas, including legal and regulatory compliance, lending practices, corporate governance, litigation, inadequate protection of customer data, ethical behavior of our employees, and from actions taken by regulators and others as a result of that conduct. Damage to our reputation, including as a result of negative publicity associated with any regulatory enforcement actions, could impact our ability to attract new and maintain existing loan and deposit customers, employees and business relationships, which could result in the imposition of additional regulatory requirements, operational restrictions, enhanced supervision and/or civil money penalties. Such damage could also adversely affect our ability to raise additional capital on acceptable terms.

We are subject to risks associated with the third parties to whom we outsource many essential services, including risks related to our agreements and oversight of their activities.

We obtain essential technological, marketing and customer services support for our systems from third-party providers. For example, we outsource our check processing, check imaging, transaction processing, electronic bill payment, statement rendering, and other services to third-party vendors. Our agreements with each service provider are generally cancelable without cause by either party upon specified notice periods. If one of our third-party service providers terminates its agreement with us and we are unable to replace

it with another service provider, our operations may be interrupted. Even a temporary disruption in services could result in our losing customers, incurring liability for any damages our customers may sustain, or losing revenues. Moreover, there can be no assurance that a replacement service provider will provide its services at the same or a lower cost than the service provider it replaces. Our agreements with such third parties may also indirectly subject us to credit risk, fraud and other risks, which could adversely impact our profitability.

Additionally, our regulators or auditors may require us to increase the level and manner of our oversight of these third parties. Although we have added significant compliance staff and have used outside consultants, our internal and external compliance examiners continually evaluate our practices and must be satisfied with the results of our third-party oversight activities. We cannot assure you that we will satisfy all related requirements. Not maintaining a compliance management system which is deemed adequate could result in sanctions against the Bank. Our ongoing review and analysis of our compliance management system and implementation of any changes resulting from that review and analysis would likely result in increased non-interest expense.

Legislative and regulatory actions taken now or in the future may increase our operating costs and impact our business, governance structure, financial condition or results of operations.

Federal and state regulatory agencies frequently adopt changes to their regulations or change the manner in which existing regulations are interpreted and applied. Changes to the laws and regulations applicable to the financial industry, if enacted or adopted, could expose us to additional costs, including increased compliance costs, require higher levels of capital and liquidity, negatively impact our business practices, including the ability to offer new products and services and attract and retain new customers and business partners who may do business with us based, in whole or in part, upon our corporate and governance structure, regulatory status, asset size and other factors tied to the legal and regulatory framework governing the financial industry. The passage of Dodd-Frank, and the rules and regulations emanating therefrom, have significantly changed, and will continue to change the bank regulatory structure, and affect the lending, deposit, investment and operating activities of financial institutions and their holding companies. A significant number of regulations have been promulgated to implement Dodd-Frank, including, for example, the Collins Amendment and the Durbin Amendment, the latter of which exempts banks with under $10 billion in assets from regulated limitations on interchange fees. To maintain such exemptions, management must manage the balance sheet to remain under that limit and failure to do so could adversely impact revenues. Future changes or interpretations to these rules and other bank regulations are uncertain and could negatively impact our business, thereby increasing our operating and compliance costs and obligations, and reducing or eliminating our ability to generate profits.

A downgrade of the U.S. credit rating could negatively impact our business, results of operations and financial condition.

In August 2011, Standard & Poor’s Ratings Services lowered its long-term sovereign credit rating on the U.S. from “AAA” to “AA+” and in August 2023, Fitch Ratings downgraded the U.S.’ long-term foreign-currency issuer default rating from “AAA” to “AA+”. If U.S. debt ceiling, budget deficit or debt concerns, domestic or international economic or political concerns, or other factors were to result in further downgrades to the U.S. government’s sovereign credit or long-term foreign-currency ratings or its perceived creditworthiness, it could adversely affect the U.S. and global financial markets and economic conditions. A downgrade of the U.S. government’s credit rating or any failure by the U.S. government to satisfy its debt obligations could create financial turmoil and uncertainty, which could weigh heavily on the global banking system. It is possible that any such impact could have a material adverse effect on our business, results of operations and financial condition.

New lines of business, and new products and services may result in exposure to new risks and the value and earnings related to existing lines of business are subject to market conditions.

The Bank has introduced, and in the future, may introduce new products and services to differing markets either alone or in conjunction with third parties. New lines of business, products or services could have a significant impact on the effectiveness of our system of internal controls or the controls of third parties and could reduce our revenues and potentially generate losses. There are material inherent risks and uncertainties associated with offering new products and services, especially when new markets are not fully developed, or when the laws and regulations regarding a new product are not mature. New products and services, or entrance into new markets, may require substantial time, resources and capital, and profitability targets may not be achieved. Factors outside of our control, such as developing laws and regulations, regulatory orders, competitive product offerings and changes in commercial and consumer demand for products or services may also materially impact the successful launch and implementation of new products or services. Failure to manage these risks, or failure of any product or service offerings to be successful and profitable, could have a material adverse effect on our financial condition and results of operations. Additionally, there are uncertainties regarding the market

values of existing lines of business, which are difficult to measure and are subject to market conditions which may change significantly. Significant amounts of loans are accounted for at fair market value, and a decrease in such value would reduce income.

Potential acquisitions may disrupt our business and dilute stockholder value.

Acquiring other banks or businesses involves various risks including, but not limited to:

potential exposure to unknown or contingent liabilities of the target entity;

exposure to potential asset quality issues of the target entity;

difficulty and expense of integrating the operations and personnel of the target entity;

potential disruption to our business;

potential diversion of our management’s time and attention;

the possible loss of key employees and customers of the target entity;

difficulty in estimating the value of the target entity;

potential changes in banking or tax laws or regulations that may affect the target entity; and 

difficulty navigating and integrating legal, operating cultural differences between the United States and the countries of the target entity’s operations.

From time to time, we evaluate merger and acquisition opportunities and conduct due diligence activities related to possible transactions with other financial institutions and financial services companies. As a result, merger or acquisition discussions and, in some cases, negotiations may take place and future mergers or acquisitions involving cash, debt or equity securities may occur at any time. Acquisitions typically involve the payment of a premium over book and market values, and, therefore, some dilution of our tangible book value and net income per common share may occur in connection with any future transaction. Furthermore, failure to realize the expected revenue increases, cost savings, increases in geographic or product presence, and/or other projected benefits from an acquisition could have a material adverse effect on our financial condition and results of operations.

Inflation could negatively and materially impact our business directly or indirectly by its impact on our borrowers.

Prolonged periods of inflation may impact our profitability should higher related borrowing costs stress borrower repayment or should our non-interest expense increases not be adequately offset by revenue increases. Increases in such expenses for borrowers could also negatively and materially impact loan performance and loan demand.

The loss or transition of key members of our senior management team or key staff in the Bank's divisions, or our inability to attract and retain qualified personnel, could adversely affect our business.

The universe of management and staff for certain of our niche lending and payments businesses is significantly smaller than that for most financial institutions’ lines of business, while our businesses may also be more complex to manage. Our ability to retain and attract new professional management with sufficient experience and expertise, and successfully execute our succession plans can significantly impact our performance.

Increased scrutiny with respect to environmental, social and governance (“ESG”) practices may impose additional costs on the Company or expose it to new risks.

There is an increased focus and scrutiny from certain government regulators, investors, customers and other stakeholders on ESG practices and disclosure related to climate risk, hiring practices, the diversity of the work force and diversity, equity and inclusion. Failure to adapt to or comply with governmental requirements or meet the expectations of , investors, customers or other stakeholders could negatively impact the Company’s reputation, ability to do business with certain partners and stock price. In addition, we could be criticized for the speed, or scope, of adoption of policies and practices in response to such expectations. As a result, we could suffer negative publicity and our reputation could be adversely impacted, which in turn could have a negative impact on investor perception and customer engagement. This may also impact our ability to attract and retain talent to compete in the marketplace. In addition, we could be criticized by ESG detractors for the scope or nature of our ESG-related activities. We could also be subjected to negative responses by governmental actors (such as anti-ESG legislation or retaliatory legislative treatment) or

customers (such as boycotts or negative publicity campaigns) that could adversely affect our reputation, results of operations and financial condition.

Climate change or government action and societal responses to climate change could adversely affect our results of operations.

Climate change can increase the likelihood of the occurrence and severity of natural disasters and can also result in longer-term shifts in climate patterns such as extreme heat, sea level rise and more frequent and prolonged drought. Such significant climate change effects may negatively impact the Company’s geographic markets, disrupting the operations of the Company, our customers or third parties on which we rely. Damages to real estate underlying mortgage loans or real estate collateral and declines in economic conditions in geographic markets in which the Company’s customers operate may impact our customers’ ability to repay loans or maintain deposits due to climate change effects, which could increase our delinquency rates and average credit loss.

Risks Related to Our Specialty Lending Business Activities

Changes in interest rates and loan production could reduce our income, cash flows and asset values.

A significant portion of our income and cash flows depends on the difference between the interest rates we earn on interest-earning assets, such as loans and investment securities, and the interest rates we pay on interest-bearing liabilities, such as deposits and borrowings. The value of our assets, and particularly loans with fixed or capped rates of interest, may also vary with interest rate changes. We discuss the effects of interest rate changes on the market value of our portfolio and net interest income in Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Asset and Liability Management.”

Interest rates are highly sensitive to factors which are beyond our control, including economic conditions and policies of governmental agencies, particularly the Federal Reserve. Changes in monetary policy, including changes in interest rates, will influence the interest we receive on our loans and securities and pay on deposits, and loan and deposit growth. If deposit rates increase more than rates on loans and securities, our net interest income could decline or we could sustain losses. Our earnings could also decline, or we could sustain losses, if the rates on our loans and securities decrease more than deposit rates. While the Bank is generally asset sensitive, which implies that significant increases in market rates would generally increase margins, while decreases in interest rates would generally decrease margins, we cannot assure you that increases or decreases in margins will follow such a pattern in the future. Our net interest income is also determined by our level of loan production to replace loan payoffs and grow our different loan portfolios. In particular, our SBLOC, non-SBA commercial loans, at fair value and real estate bridge lending portfolios have at times experienced accelerated prepayments, while the durations of those portfolios at inception are relatively short and generally under three years. Loan demand to replace these loans and grow portfolios may vary for economic and competitive reasons and we cannot assure you that historical rates of loan growth will continue or as to other loan production. Net interest income is difficult to project, and our models for making such projections are theoretical. While they may indicate the general direction of changes in net interest income, they do not indicate actual future results. As a result of Federal Reserve federal funds rate increases in 2022 and 2023, net interest income increased significantly as a result of the Bank’s asset sensitivity. While we may pursue strategies to increase fixed rate securities purchases to decrease asset sensitivity, and lower the decrease in net interest income resulting from Federal Reserve rate decreases, there can be no assurance that these can be implemented. Additionally, to the extent that fixed rate securities purchases are funded with higher rate short-term deposits, which occurs when yield curves are inverted, net interest income may also be decreased, at least in the short-term, prior to Federal Reserve rate reductions.

We are subject to lending risks.

There are risks inherent in making all loans. These risks include interest rate changes over the time period in which loans may be repaid and changes in economic conditions nationwide or in the localities in which our borrowers operate. Weak economic conditions have caused increases in our delinquent and defaulted loans in recent years. We cannot assure you that we will not experience further increases in delinquencies and defaults, or that any such increases will not be material. On a consolidated basis, an increase in non-performing loans could result in an increase in our provision for credit losses or in loan charge-offs and consequent reductions in our earnings. For our commercial fleet and equipment leasing business line, while we have access to underlying collateral, the value of such collateral can be impacted by many factors including age and condition, market prices and applicable economic conditions. For closed end leases, any deficiency between the residual value of the lease and net sales price results in a loss. For more information about the risks which are specific to the different types of loans we make and which could impact our allowance for credit losses, see Item 1, “Business –Lending Activities.”

The success of our SBA lending program is dependent upon the continued availability of SBA loan programs, our status as a Preferred Lender under the SBA loan programs, our ability to comply with applicable SBA lending requirements and our ability to successfully manage related risks.

Our specialty lending operations are subject to additional risks including, with respect to our SBA loans, the risk that the U.S. government’s partial guaranty on SBA loans is withdrawn due to noncompliance with regulations. Our SBA lending program is dependent upon the federal government. As an SBA Preferred Lender, we enable our clients to obtain SBA loans without being subject to the potentially lengthy SBA approval process necessary for lenders that are not SBA Preferred Lenders. The SBA periodically reviews the lending operations of participating lenders to assess, among other things, whether the lender exhibits prudent risk management. When weaknesses are identified, the SBA may request corrective actions or impose enforcement actions, including revocation of the lender’s Preferred Lender status. If we lose our status as an SBA Preferred Lender, we may lose some or all of our customers to lenders who are SBA Preferred Lenders, which could have a material adverse effect on our financial results. Also, in the event of a loss resulting from default and a determination by the SBA that there is a deficiency in the manner in which a loan was originated, funded or serviced by us, the SBA may require us to repurchase the previously sold portion of the loan, deny its liability under the guaranty, reduce the amount of the guaranty or, if it has already paid under the guaranty, seek recovery of the principal loss related to the deficiency from us.

Additionally, in order for a borrower to be eligible to receive an SBA loan, the lender must establish that the borrower would not be able to secure a bank loan without the credit enhancements provided by a guaranty under the SBA program. Accordingly, the SBA loans in our portfolio generally have weaker credit characteristics than the rest of our portfolio, and may be at greater risk of default in the event of deterioration in economic conditions or the borrower’s financial condition. For instance, in the case of 7(a) Program loans, if businesses to which we lend generate inadequate cash flow to repay principal and interest, and borrowers are otherwise unable to repay the loan, losses may result if related collateral is sold for less than the unguaranteed balance of the loan. Because these loans are generally at variable rates, higher rate environments will increase required payments from borrowers, with increased payment default risk. As a result of a wide variety of collateral with very specific uses, markets for resale of the collateral may be limited, which could adversely affect amounts realized upon sale and therefore our financial results.

Further, any changes to the SBA program, including changes to the level of guarantee provided by the federal government on SBA loans, may also have a material adverse effect on our business. The SBA program is funded through annual appropriations approved by Congress matching funding requirements for loans approved within the budget year. Should those appropriations be reduced or cease, our ability to make SBA loans will be curtailed or terminated.

The Bank’s allowance for credit losses may not be adequate to cover actual losses.

Like all financial institutions, the Bank maintains an ACL to provide for current and future expected losses inherent in its loan portfolio. At December 31, 2023, the ratios of the ACL to total loans and to non-performing loans were, respectively, 0.51% and 206.33%. The Bank’s allowance for credit losses may not be adequate to cover actual loan losses and future provisions for loan losses could materially and adversely affect the Bank’s operating results. The Bank’s allowance for credit losses is determined by management after analyzing historical loan losses, current trends in delinquencies and charge-offs, plans for problem loan resolution, changes in the size and composition of the loan portfolio, industry information, economic conditions and events and reasonable and supportable forecasts. The determination by management of the allowance for credit losses involves a high degree of subjectivity and requires management to estimate current and future credit risk based on both qualitative and quantitative factors, each of which is subject to significant change. The amount of future loan losses is susceptible to changes in economic, operating and other conditions, including changes in interest rates that may be beyond the Bank’s control, and these loan losses may exceed current estimates. Bank regulatory agencies, as an integral part of their examination process, review the Bank’s loans and allowance for credit losses. Although we believe that the Bank’s allowance for credit losses is appropriate and supportable in providing for current and future expected credit losses and that our methodology to determine the amount of both the allowance and provision is effective, we cannot assure you that we will not need to increase the Bank’s allowance for credit losses or change our methodology for determining our allowance and provision for credit losses, or that our regulators will not require us to increase this allowance. Any of these occurrences could materially reduce our earnings and profitability and result in losses. For more information about risks which are specific to the different types of loans we make and which could impact the allowance for credit losses, see Item 1,”Business –Lending Activities.”

Our lending limit may adversely affect our competitiveness.

Our regulatory lending limit as of December 31, 2023, to any one customer or related group of customers was $141.2 million, computed on the basis of 15% of capital as defined by our regulators. That limit may be increased to 25% of regulatory defined capital, if the excess over 15% is collateralized by marketable securities. Our lending limit is substantially smaller than that of many financial institutions with which we compete. While we believe that our lending limit is sufficient for our targeted market of small to mid-size businesses within our four specialty lending operations, as well as affinity group members, it may in the future affect our ability to attract or maintain customers or to compete with other financial institutions. Moreover, to the extent that we incur losses and do not obtain additional capital, our lending limit, which depends upon the amount of our capital, will decrease.

Revised accounting standards require current recognition of credit losses over the estimated remaining lives of loans.

In June 2016, the FASB, issued an update to ASU 2016-13, Financial Instruments – Credit Losses (Topic 326): Measurement of Credit Losses on Financial Instruments, which we adopted in 2020. The update changes the accounting for credit losses on loans and debt securities. For loans and held-to-maturity debt securities, the update requires a current expected credit loss (“CECL”) approach to determine the allowance for credit losses. CECL requires loss estimates for the remaining estimated life of the financial asset using historical experience, current conditions, and reasonable and supportable forecasts. Also, the update eliminates the existing guidance for purchased credit deteriorated loans and debt securities, but requires an allowance for purchased financial assets with more than insignificant deterioration since origination. In addition, the update modifies the other-than-temporary impairment model for available-for-sale debt securities to require an allowance for credit losses instead of a direct write-down, which allows for reversal of credit losses in future periods based on improvements in credit. The CECL model has and will materially impact how we determine our allowance for credit losses and may require us to significantly increase our allowance for credit losses. Furthermore, our allowance for credit losses may experience more fluctuations, some of which may be significant. If we determined that we would need to increase the allowance for credit losses to appropriately capture the credit risk that exists in our lending and investment portfolios, it may negatively impact our business, earnings, financial condition and results of operations.

The Bank may suffer losses in its loan portfolio despite its underwriting practices.

The Bank seeks to mitigate the risks inherent in its loan portfolio by adhering to specific underwriting practices. These practices vary depending on the facts and circumstances of each loan. For loans other than SBLOC and IBLOC loans, these practices may include analysis of a borrower’s prior credit history, financial statements, tax returns and cash flow projections, valuation of certain types of collateral based on reports of independent appraisers and verification of liquid assets. For SBLOC loans, a primary element of the credit decision is the market value of the borrower’s brokerage account, which is reduced by the varying collateral percentages against which we are willing to lend, resulting in excess collateral. For example, we typically lend against 50% of the value of equity securities. Rapid excessive movements in the market value of brokerage accounts may not be sufficiently offset by the excess collateral, and losses could result. For IBLOC, the credit decision is primarily based upon the cash value of eligible life insurance policies, which may ultimately depend upon the insurer for repayment. Although the Bank believes that its underwriting criteria are appropriate for the various kinds of loans it makes, the Bank may incur losses on loans that meet its underwriting criteria, and these losses may exceed the amounts set aside as reserves in the Bank’s allowance for credit losses. In addition, only certain SBA loans are 75% guaranteed by the U.S. government, and even for those, we still assume credit risk on the remaining 25%. These borrowers, which include new start-ups, may have a higher probability of failure, which may result in higher losses on such loans. The vast majority of commercial loans, at fair value and REBL loans are variable rate and, as a result, higher market rates will result in higher payments and greater cash flow requirements, although REBL loans generally require an interest rate cap to mitigate that risk. Should cash flow and available cash reserves prove inadequate to cover debt service on these loans, repayment will primarily depend upon the sponsor’s ability to service the debt, or the value of the property in disposition. Low occupancy or rental rates may negatively impact loan repayment. Because these loans were previously originated for sale, or because we may decide to sell certain REBL loans in the future, the underwriting and other criteria used were those which buyers in the capital markets indicated were most crucial when determining whether to buy the loans. Such criteria include the loan-to-value ratio and debt yield (net operating income divided by first mortgage debt). However, property values may fall below appraised values and below the outstanding balance of the loan, which could result in losses. Risks for SBA construction loans include engineering defects, contractor risk, and risks of delays and project completions. Higher than expected construction costs may also result, impacting repayment capability and collateral values.

Other real estate owned (“OREO”), which results upon foreclosure of real estate collateral for defaulted loans, may increase significantly, especially if larger REBL loans default. Maintenance expense for such properties can be significant and may not be offset by related revenues. If OREO or other non-performing assets increase, interest income will be reduced. National bank

regulations permit the holding of OREO for five years, with the possibility of an additional five year holding upon regulatory approval. Depending upon market conditions at the time of sale, there can be no assurance that the carrying value will be offset by the sales price, which would result in a loss. If we experience loan defaults in excess of amounts that we have included in our allowance for credit losses, we will have to further increase the provision for credit losses, which will reduce our income and might cause us to incur losses. For more information about the risks which are specific to the different types of loans we make and which could impact loan losses, see Item 1, “Business –Lending Activities.”

Environmental liability associated with lending activities could result in losses.

In the course of our business, we may foreclose on and take title to properties securing our loans. If hazardous substances were discovered on any of these properties, we may be liable to governmental entities or third parties for the costs of remediation of the hazard, as well as for personal injury and property damage. Many environmental laws can impose liability regardless of whether we knew of, or were responsible for, the contamination. In addition, if we arrange for the disposal of hazardous or toxic substances at another site, we may be liable for the costs of cleaning up and removing those substances from the site, even if we neither own nor operate the disposal site. Environmental laws may require us to incur substantial expenses and may materially limit use of properties we acquire through foreclosure, reduce their value or limit our ability to sell them in the event of a default on the loans they secure. In addition, future laws or more stringent interpretations or enforcement policies with respect to existing laws may increase our exposure to environmental liability.

A prolonged U.S. government shutdown or default by the United States on government obligations could harm our results of operations.

Our results of operations, including revenue, non-interest income, expenses and net interest income, could be adversely affected in the event of widespread financial and business disruption due to a default by the United States on U.S. government obligations or a prolonged failure to maintain significant U.S. government operations, particularly those pertaining to the SBA. Any such failure to maintain such U.S. government operations would impede our ability to originate SBA loans and our ability to sell such loans, which could in turn adversely impact our results of operations.

Risks Relating to Our Payments Business Activities

Regulatory and legal requirements applicable to the prepaid and debit card industry are unique and frequently changing.

Achieving and maintaining compliance with frequently changing legal and regulatory requirements applicable to prepaid and debit card products requires a significant investment in qualified personnel, hardware, software and other technology platforms, external legal counsel and consultants and other infrastructure components. These investments may not ensure compliance or otherwise mitigate risks involved in this business. Our failure to satisfy regulatory mandates applicable to prepaid financial products could result in actions against us by our regulators, legal proceedings being instituted against us by consumers, each of which could reduce our earnings or result in losses, make it more difficult to conduct our operations, or prohibit us from conducting specific operations. Other risks related to prepaid cards include competition for prepaid, debit and other payment mediums, possible changes in the rules of networks, such as Visa and Mastercard and others, in which the Bank operates, changes in network fees or interchange rates and state regulations related to prepaid cards, including those regarding escheatment. The enactment of Dodd-Frank required the Federal Reserve Board to implement regulations that have substantially limited interchange fees for many issuers. While interchange rates are exempt from the limitations imposed by Dodd-Frank for institutions with less than $10 billion in assets such as ourselves, new legislation could result in changes to the rates we are able to charge. There can be no assurance that such possible future legislation or changes by the payment networks will not substantially impact our revenues.

Changes in rules or standards set by the payment networks, or changes in debit network fees or products or interchange rates, could adversely affect our business, financial position and results of operations.

We are subject to network rules that could subject us to a variety of fines or penalties that may be levied by the card networks for acts or omissions by us or businesses that work with us, including card processors and Fintech Program Managers. Furthermore, a substantial portion of our operating revenues is derived directly or indirectly from interchange fees. The amount of prepaid, debit card and related fees that we earn is highly dependent on the interchange rates that the payment networks set and adjust from time to time.

The enactment of Dodd-Frank required the Federal Reserve Board to implement regulations that have substantially limited interchange fees for many issuers. While the interchange rates that may be earned by us are exempt from the limitations imposed by Dodd-Frank, federal legislators and regulatory authorities have become increasingly focused on interchange, and continue to propose new legislation that could result in significant adverse changes to the rates we are able to charge and there can be no assurance that future regulation or changes by the payment networks will not substantially impact our interchange revenues. If interchange rates decline, whether due to actions by the payment networks or future regulation, we would likely need to change our fee structure to offset the loss of interchange revenues. However, our ability to make these changes is limited by the terms of our contracts and other commercial factors, such as price competition. To the extent we increase the pricing of our products and services, we might find it more difficult to acquire consumers and to maintain or grow card usage and customer retention, and we could suffer reputational damage and become subject to greater regulatory scrutiny. We also might have to discontinue certain products or services. As a result, our total operating revenues, operating results, prospects for future growth and overall business could be materially and adversely affected.

The potential for fraud in the card payment industry is significant and could adversely affect our business and results of operations.

Issuers of prepaid and debit cards and other companies have suffered significant losses in recent years with respect to the theft of cardholder data that has been illegally exploited for personal gain. The theft of such information is regularly reported and affects individuals and businesses. Losses from various types of fraud have been substantial for certain card industry participants. We also rely upon third parties for transaction processing services, which subjects us and our customers to risks related to the vulnerabilities of those third parties. The Bank in many cases has indemnification agreements with third parties; however, such indemnifications may not fully cover losses. Fraudulent activity could also result in the imposition of regulatory sanctions, including significant monetary fines, which could adversely affect our business, results of operations and financial condition. Although fraud has not had a material impact on the profitability of the Bank, it is possible that such activity could adversely impact the Bank in the future.

There is a significant concentration in prepaid and debit card fee income which is subject to various risks.

A significant portion of our revenues are derived from prepaid, debit card and other related products, and prepaid and debit card account deposits also comprise the majority of the Bank’s deposits. Actions by government agencies relating to service charges, or increased regulatory compliance costs, could result in reductions in income which may not be offset by reductions in expense. Moreover, markets for fintech financial products and the related services from which we derive significant fees, are rapidly evolving. Our product mix includes prepaid card accounts for salary, medical spending, commercial, general purpose reloadable, corporate and other incentive, gift, government payments and transaction accounts accessed by debit cards. Our revenues could be impacted by the evolution of fintech products or changes within these product mixes. Related changes in volume including changes in client mix, or in pricing, can also result in variability of revenue between periods. Additionally, certain of our clients have significant volume, the loss of which would materially affect our revenues. In 2023, the top five largest contributors to prepaid, debit card and related fees, comprised approximately 54% of such income. Additionally, prepaid and debit card fee income may be subject to quarterly and longer term variances resulting from seasonality, changes in fee structures, product mix and other factors, which also make projecting income trends difficult.

If our prepaid and debit card and other deposit accounts generated by third parties were no longer classified as non-brokered, our FDIC insurance expense might increase.

In December 2014, the FDIC issued guidance classifying prepaid deposit accounts and other deposit accounts obtained in cooperation with third parties as brokered, resulting in the vast majority of the Bank’s deposits being classified as brokered. However, in December 2020, the FDIC adopted a regulation which resulted in the reclassification of the majority of the Bank’s deposits from brokered to non-brokered beginning June 30, 2021, and a decrease in FDIC insurance expense. Such reclassifications and the resulting FDIC insurance expense decrease are dependent upon ongoing consideration by regulators, including recertification requirements for certain accounts. Should the Bank’s capital ratios fall below well-capitalized levels, it would be prohibited from accepting, renewing or rolling over brokered deposits without the consent of the FDIC. Without such consent, the Bank could not operate its business lines as presently conducted.

We may depend in part upon wholesale and brokered certificates of deposit to satisfy funding needs.

We may rely, in part, on funds provided by wholesale deposits and brokered certificates of deposit to support the growth of our loan portfolio. Wholesale and brokered certificates of deposit are highly sensitive to changes in interest rates and, accordingly, can

be a more volatile source of funding. Use of wholesale and brokered deposits involves the risk that growth supported by such deposits would be halted, or the Bank’s total assets could contract, if the rates offered by the Bank were less than those offered by other institutions seeking such deposits, or if the depositors were to perceive a decline in the Bank’s safety and soundness, or both. In addition, if we were unable to match the maturities of the interest rates we pay for wholesale and brokered certificates of deposit to the maturities of the loans we make using those funds, increases in the interest rates we pay for such funds could decrease our consolidated net interest income. Moreover, if the Bank ceases to be categorized as “well capitalized” under banking regulations, it will be prohibited from accepting, renewing or rolling over brokered deposits without the consent of the FDIC.

We derive a significant percentage of our deposits, total assets and income from deposit accounts generated by diverse independent companies, including those which provide card account marketing services, and investment advisory firms.

Our funding is comprised primarily of millions of small transaction-based consumer balances, the vast majority of which are FDIC-insured. We have multi-year, contractual relationships with affinity groups which sponsor such accounts and with whom we have had long-term relationships (see Item 1, “Business—Our Strategies”). Those long-term relationships comprise the majority of our deposits while we continue to grow and add new client relationships. Of our deposits at year-end 2023, the top three affinity groups accounted for approximately $2.33 billion, the next three largest accounted for $1.46 billion, and the four subsequent largest accounted for $852.1 million. Of our deposits at year-end 2022, the top three affinity groups accounted for approximately $2.41 billion, the next three largest accounted for $1.20 billion, and the four subsequent largest accounted for $822.9 million. While certain of these relationships may have changed their ranking in the top ten of the affinity groups with which we have contractual relationships, the affinity groups themselves were identical in both years. We believe that payroll, debit, and government-based accounts such as child support are comparable to traditional consumer checking accounts. Such balances in the top ten relationships at year-end 2023 totaled $2.91 billion while balances related to consumer and business payment companies, including companies sponsoring incentive and gift card payments, amounted to $1.72 billion. Such balances in the top ten relationships at year-end 2022 totaled $3.08 billion while balances related to payment companies, including companies sponsoring incentive and gift card payments, amounted to $1.35 billion. We do not believe that the changes between these periods significantly impacted overall liquidity or cost of funds as a result of long-term relationships and a history of stability of small balance accounts which is further managed through multi-year contracts. We may exit relationships where our internal requirements are not met or be required by our regulators to exit such relationships. Also, an affinity group could terminate a relationship with us for many reasons, including being able to obtain better terms from another provider or dissatisfaction with the level or quality of our services. In 2021 and 2023, for instance, two of our affinity group clients transferred their operations to their newly chartered banks. In 2023, the top five largest contributors to prepaid, debit card and related fees comprised approximately 54% of such income. If other affinity group relationships were to be terminated in the future, it could materially reduce our deposits, assets and income. We cannot assure you that we could replace such relationships. If we cannot replace such relationships, we may be required to seek higher rate funding sources as compared to any exiting affinity group and interest expense might increase. We may also be required to sell securities or other assets to meet funding needs, which would reduce revenues or potentially generate losses.

We face fund transfer and payments-related risks.

As a financial institution, we bear fund transfer risks of different types, which result from large transaction volumes and large dollar amounts of incoming and outgoing money transfers. Loss exposure may result if money is transferred from the bank before it is received, or legal rights to reclaim monies transferred are asserted, including payments made to merchants for payment clearing, while customers have statutory periods to reverse their payments. Exposure also results from payments made prior to receipt of offsetting funds, as accommodations to customers. We are subject to unique settlement risks as our transfers may be larger than typical financial institutions of our size. Transfers could also be made in error or as a result of fraud. Additionally, as with other financial institutions, we may incur legal liability or reputational risk, if we unknowingly process payments for companies in violation of money laundering laws or other regulations or immoral activities.

Unclaimed funds from deposit accounts or represented by unused value on prepaid cards present compliance and other risks.

Unclaimed funds held in deposit accounts or represented by unused balances on prepaid cards may be subject to state escheatment laws where the Bank is the actual holder of the funds and when, after a period of time as set forth in applicable state law, the rightful owner of the funds cannot be readily located and/or identified. The Bank implements controls to comply with state unclaimed property laws and regulations, however these laws and regulations are often open to interpretation, particularly when being applied to unused balances on prepaid card products. State regulators may choose to initiate collection or other litigation action against the Bank for unreported abandoned property, and such actions may seek to assess fines and penalties.

Risks Relating to Taxes and Accounting

We are subject to tax audits, and challenges to our tax positions or adverse changes or interpretations of tax laws could result in tax liability.

We are subject to federal and applicable state income tax laws and regulations and related audits, and when tax matters arise, a number of years may elapse before such matters are audited and finally resolved. We are also periodically subject to state escheatment audits. Income tax and escheatment laws and regulations are often complex and require significant judgment in determining our effective tax rate and in evaluating our tax positions. Challenges of such determinations or legislative changes in applicable laws may adversely affect our effective tax rate, tax payments or financial condition.

The appraised fair value of the assets from our commercial loans, at fair value or collateral from other loan categories may be more than the amounts received upon sale or other disposition.

Various internal and external inputs were utilized to analyze the commercial loans, at fair value portfolio and other loan categories. Actual sales prices could be significantly less than estimates, which could materially affect our results of operations in future quarters.

A failure to implement and maintain effective internal control over financial reporting could result in material misstatements in our financial statements which could require us to restate financial statements, cause investors to lose confidence in our reported financial information and have a negative effect on our stock price.

Any failure to maintain or implement required new or improved internal and disclosure controls over financial reporting, or any difficulties we encounter in their implementation, could result in material weaknesses, cause us to fail to meet our periodic reporting obligations or result in material misstatements in our financial statements. Any such failure could also adversely affect the results of periodic management evaluations and annual auditor attestation reports regarding the effectiveness of our internal control over financial reporting required under Section 404 of the Sarbanes-Oxley Act of 2002 (“Section 404”) and the rules promulgated under Section 404. The existence of a material weakness could result in errors in our financial statements that could result in a restatement of financial statements, cause us to fail to meet our reporting obligations and cause investors or customers to lose confidence in our reported financial information, leading to a decline in our stock price or a loss of business, and could result in stockholder actions against us for damages.

Risks Related to Ownership of Our Common Stock

The price of our common stock may decline or otherwise become volatile.

Although our common stock is traded on the Nasdaq Global Select Market, its trading volume is less than that of many financial services companies. A public trading market having the desired characteristics of depth, liquidity and orderliness depends on the presence in the marketplace of willing buyers and sellers of our common stock at any given time, which relies on the individual decisions of investors and general economic and market conditions over which we have no control. Given the lower trading volume of our common stock, significant sales of our common stock, or the expectation of these sales, could cause our stock price to fall.

Additionally, we cannot predict whether future issuances of shares of our common stock or the availability of shares for resale in the open market will decrease the price of our common stock. We are not restricted from issuing additional shares of common stock, including any securities that are convertible into or exchangeable for, or that represent the right to receive shares of common stock. The exercise of any options granted to directors, executive officers and other employees under our stock compensation plans, the vesting of restricted stock grants, the issuance of shares of common stock in acquisitions and other issuances of our common stock could also have an adverse effect on the market price of the shares of our common stock. The existence of options, or shares of our common stock reserved for issuance as restricted shares of our common stock may materially adversely affect the terms upon which we may be able to obtain additional capital in the future through the sale of equity securities.

An investment in our common stock is not an insured deposit.

Our common stock is not a savings or deposit account or other obligation of any bank and, therefore, is not insured against loss by the FDIC, any other deposit insurance fund or by any other public or private entity. Investment in our common stock is

inherently risky and is subject to the same market forces that affect the price of common stock of any company. As a result, if you acquire our common stock, you may lose some or all of your investment.

Future offerings of debt, which would be senior to our common stock upon liquidation, and/or preferred equity securities which may be senior to our common stock for purposes of dividend distributions or upon liquidation, may reduce the market price at which our common stock trades.

In the future, we may attempt to increase our capital resources or, if the Bank’s capital ratios fall below the required minimums, we could be forced to raise additional capital by conducting additional offerings of debt or preferred equity securities, including medium-term notes, senior or subordinated notes or preferred stock. Upon liquidation, holders of our debt securities and shares of preferred stock and lenders with respect to other borrowings will receive distributions of our available assets prior to the holders of our common stock. Holders of our common stock are not entitled to preemptive rights or other protections against dilution.

The Bank’s ability to pay dividends is subject to regulatory limitations which, to the extent we require such dividends in the future, may affect our ability to pay our obligations and pay dividends.

As a holding company, we are a separate legal entity from the Bank and our other subsidiaries, and we do not have significant operations of our own. We have historically depended on the Bank’s cash and liquidity, as well as dividends, to pay our operating expenses. Various federal provisions limit the amount of dividends that subsidiary banks can pay to their holding companies without regulatory approval. Without the prior approval of the OCC, a dividend may not be paid if the total of all dividends declared by a bank in any calendar year is in excess of the current year’s net income combined with the retained net income of the two preceding years. Additionally, a dividend may not be paid in excess of a bank’s retained earnings. In addition to these explicit limitations, it is possible, depending upon the financial condition of the Bank and other factors, that regulatory agencies could take the position that payment of dividends by the Bank would constitute an unsafe or unsound banking practice and may, therefore, seek to prevent the Bank from paying such dividends. Although we believe we have sufficient existing liquidity for our needs for the foreseeable future, there is risk that we may not be able to service our obligations as they become due or to pay dividends on our common stock or trust preferred security obligations. Even if the Bank has the capacity to pay dividends, it is not obligated to pay the dividends, and its Board of Directors may determine, as it has in the past, to retain some or all of its earnings to support or increase its capital base.

Anti-takeover provisions of our certificate of incorporation, bylaws and Delaware law may make it more difficult for holders of our common stock to receive a change in control premium.

Certain provisions of our certificate of incorporation and bylaws could make a merger, tender offer or proxy contest more difficult, even if such events were perceived by many of our stockholders as beneficial to their interests. These provisions include, in particular, our ability to issue shares of our common stock and preferred stock with such provisions as our Board may approve without further shareholder approval. In addition, as a Delaware corporation, we are subject to Section 203 of the Delaware General Corporation Law which, in general, prevents an interested stockholder, defined generally as a person owning 15% or more of a corporation’s outstanding voting stock, from engaging in a business combination with our company for three years following the date that person became an interested stockholder unless certain specified conditions are satisfied.

Our Amended and Restated Bylaws provide that certain courts in the State of Delaware or the federal district courts of the United States will be the sole and exclusive forum for substantially all disputes between us and our stockholders, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers, or employees.

Our Amended and Restated Bylaws provide that, unless we consent in writing to the selection of an alternative forum, the Court of Chancery located within the State of Delaware will be the sole and exclusive forum for any derivative action or proceeding brought on our behalf, any action asserting a claim of breach of a fiduciary duty owed by any current or former director, officer, other employee or stockholder to us or our stockholders, any action asserting a claim arising pursuant to any provision of the General Corporation Law of the State of Delaware, our certificate of incorporation or our bylaws (as either may be amended or restated) or as to which the General Corporation Law of the State of Delaware confers jurisdiction on the Court of Chancery of the State of Delaware, or any action asserting a claim governed by the internal affairs doctrine of the law of the State of Delaware. However, if the Court of Chancery within the State of Delaware lacks jurisdiction over such action, the action may be brought in the United States District Court for the District of Delaware. Additionally, unless we consent in writing to the selection of an alternative forum, the federal district courts of the United States of America shall be the exclusive forum for the resolution of any complaint asserting a cause of action arising under the Securities Act of 1933, as amended (the “Securities Act”). The exclusive forum provisions will be

applicable to the fullest extent permitted by applicable law, subject to certain exceptions. Section 27 of the Exchange Act creates exclusive federal jurisdiction over all suits brought to enforce any duty or liability created by the Exchange Act or the rules and regulations thereunder. As a result, the exclusive forum provisions will not apply to suits brought to enforce any duty or liability created by the Exchange Act or any other claim for which the federal courts have exclusive jurisdiction. There is, however, uncertainty as to whether a court would enforce the exclusive forum provisions, and investors cannot waive compliance with the federal securities laws and the rules and regulations thereunder. Furthermore, Section 22 of the Securities Act creates concurrent jurisdiction for state and federal courts over all suits brought to enforce any duty or liability created by the Securities Act or the rules and regulations thereunder.

General Risks

We may also face residual risk related to our participation in the SBA Paycheck Protection Program (“PPP”) program established by the Coronavirus Aid, Relief, and Economic Security Act of 2020. Participation in the SBA PPP and any other programs or stimulus packages may give rise to claims, including by governments, regulators or customers or through class action lawsuits, or judgments against us that may result in the payment of damages or the imposition of fines, penalties or restrictions by regulatory authorities, or result in reputational harm. The occurrence of any of the foregoing could have an adverse effect on our results of operations and financial condition.

Severe weather, natural disasters, geopolitical events, public health crises, acts of war or terrorism or other adverse external events could harm our business.

Catastrophic events over which we have no control, including severe weather, natural disasters, geopolitical events, public health crises, acts of war or terrorism and other adverse external events could have a significant impact on our ability to conduct business. A public health crisis, such as the COVID-19 pandemic, could result in adverse consequences, including labor shortages, disruptions of global supply chains and inflationary pressures, which could adversely affect our business through, among other things, increased credit losses, workforce disruptions, increased liquidity demands, decreased collateral value, decreased stock price or third-party service provider disruptions. The nature and level of severe weather and/or natural disasters cannot be predicted and may be exacerbated by global climate change. Severe weather and natural disasters could harm our operations through interference with communications, including the interruption or loss of our computer systems, which could prevent or impede us from gathering deposits, originating loans, and processing and controlling the flow of business, or through the destruction of facilities and our operational, financial and management information systems. Additionally, the United States remains a target for potential acts of war or terrorism, and geopolitical conflict, such as the ongoing war in Ukraine and the conflict between Israel and Hamas, and the possible expansion of such conflicts in the surroundings areas, may continue to adversely impact general economic conditions and financial markets. Such catastrophic events could negatively impact our business operations or the stability of our deposit base, cause significant property damage, adversely impact the value of collateral securing our loans and/or interrupt our borrowers’ abilities to conduct their business in a manner that supports their debt obligations, which could result in losses and increased provisions for credit losses. There is no assurance that our business continuity and disaster recovery program can adequately mitigate the risks of such business disruptions and interruptions.

ITEM 1B. UNRESOLVED STAFF COMMENTS.

None.

ITEM 1C. CYBERSECURITY

Risk Management and Strategy

We recognize the increasing significance of cybersecurity in the financial industry and the potential risks associated with cyber threats. Our processes to identify, assess and monitor material risks from cybersecurity threats are part of our overall enterprise risk management program and are integrated into our operating procedures, internal controls and information systems. Our risk management program and processes are intended to maintain an effective and comprehensive Cybersecurity Program under the direction of a dedicated Chief Information Security Officer (“CISO”). Our established Cybersecurity Program is mapped to the NIST Cybersecurity framework (“NIST CSF”), Payment Card Industry Data Security Standards (“PCI DSS”), the Center for Internet Security (“CIS”) Critical Security Controls, the Federal Financial Institutions Examination Council (“FFIEC”) Cybersecurity Assessment Tool, and relevant International Organization for Standardization (“ISO”) standards to maintain the confidentiality, integrity, and availability of our information systems, networks, and corporate and customer data. Highlights of the program include the following processes:

A security testing schedule, which includes internal/external penetration testing;

Regular vulnerability assessments;

Detailed vulnerability management;

24/7 Security Operations Center

Monitoring and reporting of systems and critical applications;

Data loss prevention controls;

File access and integrity monitoring and reporting;

Threat intelligence;

A training and compliance program for staff, including a detailed policy; and

Third-party vendor management.

The Company’s Security Operations Center (“SOC”) functions as the central point for all cybersecurity events that occur on our information systems. The SOC provides end-to-end operations to monitor, detect, alert and respond to any unusual, suspicious or malicious activities. In 2023, we expanded the SOC’s operational hours to 24 hours a day, 7 days a week, utilizing both internal and third party resources for that full coverage. We conduct risk assessments and compliance audits against the above-referenced standards and regularly benchmark and evaluate program maturity with industry leaders. We also engage both internal and external auditors and third party information security experts to examine our cybersecurity processes. Additionally, the Company undergoes the PCI certification process and obtains the related certification on an annual basis.

Recognizing the interconnected nature of the financial industry, we evaluate and monitor the cybersecurity practices of our third party service providers and partners using a risk-based approach. Our Third Party Oversight Department evaluates new and existing relationships based upon due diligence requirements defined by our Cybersecurity Department to understand and mitigate material risks associated with third party service providers and partners. Risk assessments and audit results in connection with our Cybersecurity Program are reported to senior management and the Board of Directors. Risk owners from our Cybersecurity Program develop risk mitigation plans to resolve any cybersecurity risks identified in risk assessments or audits.

We recognize that a successful cybersecurity incident could lead to disruptions in operations, financial loss, reputational damage, and potential legal and regulatory consequences. The Company has a fully implemented incident response program, and internal forensics capabilities with third party forensic experts on retainer. We also maintain business continuity and disaster recovery plans so the Company can more effectively respond to cybersecurity incidents. It is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only partially mitigate and not fully eliminate risks. Events, when detected by security tools or third parties, may not always be immediately understood or acted upon.

Although we believe risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition during the fiscal year ended December 31, 2023, they may in the future, and we continue to closely monitor risks from cybersecurity threats. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have materially affected the Company, including our business strategy, results of operations, or financial condition, in the prior fiscal period. For additional information on the impact of cybersecurity matters on us, see Item 1A, “Risk Factors—We face cybersecurity risks, which could result in a loss of customers, cause disclosure of confidential information, adversely affect our operations, cause reputational damage and create significant legal and financial exposure.”

Governance

Management regularly evaluates and enhances its cybersecurity measures to mitigate cybersecurity risks. The Company’s CISO is responsible for all aspects of the Cybersecurity Program, including managing cybersecurity functions, ensuring that cybersecurity staff are adequately skilled and trained in the activities required for their respective job functions, and overseeing corporate cybersecurity initiatives. Under the direction of the CISO, the Cybersecurity Department regularly monitors for enterprise-wide compliance with Cybersecurity Program procedures and regulatory requirements. Our CISO, in collaboration with our Chief Information Officer (“CIO”), Chief Risk Officer (“CRO”), and senior management, drives awareness, ownership and alignment of cybersecurity protocol for effective cybersecurity risk management across all lines of business and corporate functions. The CISO and CIO are responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes to effectively prevent, detect, mitigate and remediate cybersecurity threats. Our CISO has expertise in cybersecurity, information security risk management, identity and access management, security architecture, application security, vulnerability management, threat intelligence, security operations and incident management and response through prior roles leading information security functions at financial institutions. The CISO holds multiple professional certifications, including Certified Chief Information Security Officer through the International Council of Electronic Commerce Consultants, also known as the EC-Council.

The CISO reports to management’s Enterprise Risk Management Committee and quarterly to the Board’s Risk Committee regarding the Company’s cyber risks and threats, the status of efforts to strengthen information security systems, assessments of the Company’s Cybersecurity Program, and the emerging threat landscape. In these meetings and on an ad hoc basis senior management receives periodic reporting from the Cybersecurity Department, Operations Department and Information Technology Department on operational risks and the steps taken to monitor and control cybersecurity exposure.

The Board of Directors recognizes the importance of cybersecurity to safeguard confidential information and sensitive data and receives periodic training on cybersecurity risk and best practices for related oversight. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics. For example, in 2023, the Board hosted an expert to discuss developments in the cybersecurity threat landscape and evaluate the Company’s cybersecurity program in the context of the global risk environment. 

The Board has delegated responsibility for more detailed oversight of the Company’s cybersecurity and information security framework to the Risk Committee of the Board. The CISO and CIO provide updates on the cybersecurity threat environment and the Company’s programs to address and mitigate the risks associated with the evolving cybersecurity threat environment to the Risk Committee quarterly and to the full Board at least annually and on an ad hoc basis. Additionally, the Risk Committee also reviews and approves the Cyber Risk Management Program Policy and Information Security Program Policy at least annually. Elevation to a full Board communication and/or interaction would occur upon the initiation of a cyber incident response, or a material compromise of business functionality, customer data or network integrity.

ITEM 2. PROPERTIES.

Our principal executive offices and an operations facility are located at 409 Silverside Road, Wilmington, Delaware. We maintain business development and administrative offices for SBL in Morrisville, North Carolina, Memphis, Tennessee, and Westmont, Illinois (suburban Chicago), primarily for SBA lending. Leasing offices are located in Crofton, Maryland, Kent, Washington, Smithfield, Utah, Orlando, Florida, Raritan, New Jersey and Norristown, Pennsylvania. We maintain a loan operations office in New York, New York. Prepaid and debit card offices and other executive offices are located in Sioux Falls, South Dakota. We own our property in Orlando, Florida, which houses our leasing operations, while the remainder of our properties are leased. Locations and certain additional information regarding our offices and other material properties at December 31, 2023 are listed below.