The Bank of N.T. Butterfield & Son Limited (NTB) 20-F2023 FY Annual report (foreign)

0001653242ntb:NotesDue2030Memberus-gaap:UsTreasuryUstInterestRateMemberus-gaap:SubordinatedDebtMember2020-06-112020-06-11

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

 

FORM 20-F

(Mark One)

 

Securities registered or to be registered pursuant to Section 12(b) of the Act.

period covered by the annual report.

As at December 31, 2023, there were 47,529,045 shares of the registrant's common stock outstanding.

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.

If this report is an annual or transition report, indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934.

Note – Checking the box above will not relieve any registrant required to file reports pursuant to Section 13 or 15(d) of the

Securities Exchange Act of 1934 from their obligations under those Sections.

If “Other” has been checked in response to the previous question, indicate by check mark which financial statement item the

registrant has elected to follow.

If this is an annual report, indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the

Exchange Act).

EXPLANATORY NOTE

In this report, unless the context indicates otherwise, the term:

This annual report contains forward-looking statements. Forward-looking statements are neither historical facts nor assurances of future performance. Instead, they are based on our current beliefs, expectations or assumptions regarding the future of our business, future plans and strategies, our operational results and other future conditions. Forward-looking statements can be identified by words such as "anticipate," "assume," "believe," "estimate," "expect," "indicate," "intend," "may," "plan," "point to," "predict," "project," "seek," "target," "potential," "will," "would," "could," "should," "continue," "contemplate" and other similar expressions, although not all forward-looking statements contain these identifying words. These forward-looking statements include all matters that are not historical facts. They appear in a number of places throughout this annual report and include statements regarding our intentions, beliefs or current expectation concerning, among other things, our results of operations, financial condition, capital and liquidity requirements, prospects, growth, strategies, share repurchases and the industry in which we operate.

There are important factors that could cause actual results to differ materially from those contemplated by such forward-looking statements. By their nature, forward-looking statements involve risks and uncertainties because they relate to events and depend on circumstances that may or may not occur in the future. We believe that these risks and uncertainties include, but are not limited to, those described in the section captioned "Risk Factors" that appear in Item 3.D. "Risk Factors" of this annual report. These factors should not be construed as exhaustive and should be read with the other cautionary statements in this annual report.

Although we base these forward-looking statements on assumptions that we believe are reasonable when made, we caution you that forward-looking statements are not guarantees of future performance and that our actual results of operations, financial condition and liquidity, and the development of the industry in which we operate may differ materially from those made in or suggested by the forward-looking statements contained in this report. In addition, even if our results of operations, financial condition and liquidity, and the development of the industry in which we operate, are consistent with the forward-looking statements contained in this report, those results or developments may not be indicative of results or developments in subsequent periods.

Given these risks and uncertainties, you are cautioned not to place undue reliance on these forward-looking statements. Any forward-looking statement that we make in this report speaks only as of the date of such statement. Except to the extent required by applicable law, we undertake no obligation to update any forward-looking statements or to publicly announce the results of any revisions to any of those statements to reflect future events or developments. Comparisons of results for current and any prior periods are not intended to express any future trends or indications of future performance, unless specifically expressed as such, and should only be viewed as historical data.

Not applicable

Unfavorable market conditions can result in a deterioration in the credit quality of our borrowers and the demand for our products and services, an increase in the number of loan delinquencies, defaults and charge-offs, additional provisions for loan losses, decreases in asset values, deterioration in investment performance and an overall material adverse effect on the quality of our loan portfolio.

Unlike banks that are more geographically diversified, our business is concentrated primarily in Bermuda, the Cayman Islands, and the Channel Islands and the UK, and we may be more affected by a downturn in these markets than more diversified competitors.

Macroeconomic factors, including regional conflicts, and other geopolitical events could disrupt our businesses and adversely affect our financial condition or results of operations.

Bermuda is among the largest reinsurance markets in the world. The Cayman Islands is a leader in fund domiciliation for global asset managers, with 13,008 regulated mutual funds as at December 31, 2023 according to CIMA. International financial services account for a significant portion of the economies of the Channel Islands. Many of our commercial customers are reinsurance, regulated fund service providers and financial intermediaries. As a result, a downturn in these key sectors, a change in laws or regulations (including the favorable tax treatment of entities in these jurisdictions), or a shift of business away from Bermuda, the Cayman Islands, or the Channel Islands, including as a result of the inclusion of any of these jurisdictions on the EU list of non-cooperative jurisdictions for tax purposes or the implementation of the global minimum tax regime proposed by the OECD in Bermuda or any of these jurisdictions, could result in a downturn in these key sectors, job losses and adversely impact the economies in these markets. Any downturn or further concentration in the reinsurance, investment and asset management and banking markets could also adversely affect our business, financial condition and results of operations.

Banks domiciled in Bermuda, including us, are not supported by a central bank from which to borrow funds, so if we are unable to maintain sufficient liquidity by continuously attracting deposits and other short-term funding, our financial condition, including our capital ratios, funding costs or results of operations could be adversely affected.

Unlike many other jurisdictions, there is no central bank or similar governmental agency in Bermuda from which we may borrow US or Bermuda Dollars if we experience liquidity shortages, which may leave us without a lender of last resort in the event that Bermuda suffers a severe economic downturn at the same time as a liquidity shortage. Similarly, there is no central bank in the Cayman Islands, Jersey or Guernsey to act as a lender of last resort. Accordingly, we may not have a lender of last resort in case of future liquidity shortages and we may be unable to sufficiently fund our liquidity needs. While there is no central bank or similar governmental agency in Bermuda, the Cayman Islands, Jersey or Guernsey that insures bank deposits, such as the Federal Deposit Insurance Corporation in the United States, the Government of Bermuda and the Government of the States of Jersey and Guernsey have each implemented a Deposit Insurance Scheme or Deposit Compensation Scheme. See Item 4.B. "Business Overview - Supervision and Regulation" and "- Certain jurisdictions in which we operate, including Bermuda, Guernsey and Jersey, have a Deposit Insurance Scheme or Deposit Compensation Scheme and we incur ongoing costs as a result.” The regulators in these jurisdictions have also required us to hold capital add-ons to compensate for the systemic importance of our bank to the economy in the absence of a central bank. Without a central bank from which we could borrow funds, liquidity management is critical to the management of our consolidated balance sheet, and an inability to obtain sufficient liquidity could adversely affect our financial condition.

Certain jurisdictions in which we operate, including Bermuda, Guernsey and Jersey, have a Deposit Insurance Scheme or Deposit Compensation Scheme and we incur ongoing costs as a result.

As a bank licensed by the Bermuda Monetary Authority ("BMA"), we are required to be a member of the DIS and pay contributions to the Deposit Insurance Fund. Currently, our premium contribution is calculated by the Bermuda Deposit Insurance Corporation as 0.25% per annum of the average total amount of our Bermuda Dollar deposits that are covered by the DIS guarantee over a rolling three-month period, payable every three months in arrears. The amount of the contribution we are liable to pay may change from time to time as the total level of our insured Bermuda Dollar deposits changes; in addition, there is no guarantee that the current rate of premium contributions charged by the Bermuda Deposit Insurance Corporation will stay the same and not increase or that the Bermuda Deposit Insurance Corporation will not require additional contributions in the event that the Deposit Insurance Fund is insufficient to pay compensation due to insured depositors in the case of an insured event. We may also not be able to recover our contributions to the Deposit Insurance Fund from any failed institution whose insured depositors receive payments from the Deposit Insurance Fund. Any contributions we are required to make as part of the DIS (and any associated costs) are a cost to our business, and such costs, including any future increases, may have an adverse effect on our business, financial condition or results of operations.

As a bank licensed by the Guernsey Financial Services Commission, we are required to pay contributions to the Guernsey DCS. Currently, we are required to pay an administration levy which is calculated by the Guernsey DCS Board. The amount of the contribution we are liable to pay may change from time to time and there is no guarantee that the current rate charged by the Guernsey DCS Board will stay the same and not increase. In the event of the failure of a Guernsey licensed bank, the Guernsey DCS Board will estimate the total level of compensation levy required and the Bank will be liable in equal shares with every other participant (i.e., every other licensed bank in Guernsey) for the first £10,000,000 and subject to certain caps for any one bank. If the total compensation levy exceeds £10,000,000, then the Bank will be liable on a pro-rata basis (calculated by reference to the total "value at risk" of our Guernsey deposits compared to the Guernsey market) with every other participant for the amount of such excess. We may also not be able to recover our contributions to the Guernsey DCS from any failed licensed bank whose insured depositors receive payments from the Guernsey DCS. Any contributions we are required to make as part of the Guernsey DCS (and any associated costs) are a cost to our business, and such costs, including any future increases, may have an adverse effect on our business, financial condition or results of operations.

The Jersey Bank DCS is funded primarily through an upfront loan from the States of Jersey. In the event of a bank failing, levies would be raised on Jersey banks, subject to certain caps for banking groups over a five-year period, based on the proportion of protected deposits each bank holds to repay the loan. In the event that the full £100 million liability of the Jersey DCS was called upon, banks would contribute approximately two-thirds of funding, with the States of Jersey contributing one-third.

We are not currently required to pay any contributions to the Jersey DCS. Any contributions we may be required in future to make as part of the Jersey DCS (and any associated costs) are a cost to our business, and such costs, including any future increases, may have an adverse effect on our business, financial condition or results of operations.

Severe weather, natural disasters and potential impacts of climate change could disrupt our businesses and adversely affect our financial condition or results of operations.

The key markets in which we operate including Bermuda and the Cayman Islands, as well as our and our customers' business, operations and financial conditions are subject to the risks associated with severe weather conditions (including tropical storms, hurricanes, tornadoes), earthquakes, rising sea levels and other natural disasters, including downed telephone lines, flooded facilities, power outages, fuel shortages, damaged or destroyed property and equipment, and work interruptions. Although hurricanes in the Caribbean and Bermuda during 2021, 2022 and 2023 did not negatively impact the Bank's operations or cause any insurable losses, such severe weather conditions and natural disasters have in the past and may, in the future, negatively impact us and our clients and their ability to meet their financial obligations to us, including the repayment of loans. Climate change may also aggravate the impact and increase the incidence of severe weather conditions and natural disasters, which may include altered distribution and intensity of rainfall, prolonged droughts or flooding, rising sea levels, and a rising heat index. Such events may, among other impacts, adversely affect borrowers (including those in the insurance and reinsurance industries), including resulting in an impairment of the value of property or other collateral used to secure the loans that we extend, as well as significantly impact the economies of the key markets in which we operate. The occurrence of any of these events could have a material adverse effect on our financial condition and results of operations.

regulatory requirements or taxes and additional counterparty or customer requirements, all of which could increase our expenses, expand our regulatory and operational risks

and impact our financial condition. Further, our reputation and client relationships may be damaged as a result of our actual or perceived practices related to climate change,

including our involvement, or our clients’ involvement, in certain industries or projects associated with causing or exacerbating climate change, as well as decisions we make in

response to considerations relating to climate change. We are also subject to risks relating to new or proposed climate change-related regulations or legislation as a result of

governmental efforts around the world to mitigate climate change impacts, which could impact the Bank and its customers.

A decline in tourism in Bermuda and the Cayman Islands could adversely affect our business, financial condition or results of operations.

Tourism is a major contributor to the economies of Bermuda and the Cayman Islands. A decline of this industry in Bermuda or the Cayman Islands could have adverse effects on the economic stability of these jurisdictions, and our business, financial condition or results of operations. In addition, a decline in tourism could lead to (i) decreases in the value of hotels and other commercial properties, which could adversely affect our commercial loan portfolio, and (ii) increases in unemployment, which could affect the ability of our residential borrowers to make payments on their loans.

The majority of the markets in which we operate do not have systemic credit bureau reports.

Unlike the US where the FCRA is designed to help ensure that credit bureaus furnish correct and complete information when evaluating loan applications, the majority of the markets in which we operate do not have systemic credit bureau reports. Therefore, we review each loan and we use a formal and documented tiered credit approval process that is administered through and governed by our risk management framework. Due to limitations in the availability of information, our assessment of credit risk associated with a particular customer may not be based on complete, accurate or reliable information. In addition, although we have made and continue to make improvements to our credit scoring systems to better assess borrowers' credit risk profiles, we cannot provide assurance that our credit scoring systems collect complete or accurate information reflecting the actual behavior of customers or that their credit risk can be assessed correctly. Without complete, accurate and reliable information, we have to rely on other publicly available resources and our internal resources, which may not be effective. As a result, our ability to effectively manage our credit risk and subsequently our impairment losses and allowance for credit losses may be materially adversely affected. In addition, because our credit approval process involves detailed analyses of the customer or credit risk, taking into account both quantitative and qualitative factors, it is subject to human or information technology systems errors. In exercising their judgment on current or future credit risk behavior of our customers, our employees may not always be able to assign an accurate credit rating, which may result in our exposure to higher credit risks than indicated by our risk rating system. In addition, we aim to continuously refine our credit policies and guidelines to address potential risks associated with particular industries or types of customers. However, we may not be able to timely detect all possible risks before they occur, or due to limited tools available to us, our employees may not be able to effectively implement them, which may increase our credit risk. Failure to effectively implement, consistently follow or continuously refine our credit risk management system may result in an increase in the level of nonperforming loans and a higher risk exposure for us, which could have a material adverse effect on us.

Risks Relating to Our Strategy, Brand, Portfolio and Other Aspects of Our Business

We rely on our reputation and the appeal of our brand to our customers. Any damage to our reputation and appeal could harm us and our business prospects.

The success of our strategy relies significantly on our reputation and the reputation of our senior management and the Board. In addition, our customers and key introducers must continue to associate our brand with meeting customer needs and delivering value to those customers. Adverse publicity (whether or not justified) relating to activities by our management, employees, agents or others with whom we do business, such as customer service mishaps or non-compliance with laws, could tarnish our reputation and reduce the value of our brand. With the increase in the use of social media outlets, adverse publicity can be disseminated quickly and broadly, making it increasingly difficult for us to effectively respond. Such unfavorable publicity could also require us to allocate significant resources to rebuild our reputation.

As a bank operating in Bermuda, the Cayman Islands, the Channel Islands and other international financial centers, we are subject to increasing scrutiny with respect to potential or alleged legal and regulatory breaches and unethical behavior and associated reputational risks, including with respect to the general perception and reputation of financial institutions in those jurisdictions, which may in turn be affected by factors including the EU list of non-cooperative jurisdictions for tax purposes, and policies on controversial industries such as gaming and cryptocurrencies, among others. See "Our business may be negatively impacted by the economic substance legislation and regulations in the jurisdictions in which we operate, including Bermuda, the Cayman Islands, and the Channel Islands." Any circumstance that causes real or perceived damage to our brand or reputation, or banking or wealth management generally in these jurisdictions, may negatively affect our relationships with our customers and key introducers, which would have an adverse effect on our business, financial condition or results of operations.

Potential reputational issues include, but are not limited to:

A failure to address the above or any other relevant issues appropriately could make customers unwilling to do business with us, which could have an adverse effect on our business, financial condition or results of operations and could damage our relationships with our employees and regulators.

The effects of inflation, and volatility in interest rates have and may continue to negatively impact our net interest margin and our profitability.

Net interest income is a significant component of our revenues and changes in prevailing interest rates, including the SOFR have and may continue to adversely affect our business, including the level of net interest income we earn, and for our banking business, the levels of deposits and the demand for loans. Interest rates are highly sensitive to many factors that are beyond our control, including general economic conditions and policies of various governmental and regulatory agencies and, in particular, the U.S. Federal Reserve and the Bank of England. Changes in monetary policy, including changes in interest rates, influence not only the interest we receive on loans and investments and the amount of interest we pay on deposits and borrowings, but such changes also affect our ability to originate loans and obtain deposits, the fair value of our financial assets and liabilities and the average duration of our mortgage portfolio and other interest-earning assets.

In 2022 and 2023, the strategy of central banks globally included the introduction of a series of interest rate increases. It is unknown if further rate hikes are expected and for how long interest rates will remain elevated. As interest rates increase, our net interest income would narrow if our cost of funding increased without a correlating increase in the interest we earn from loans, investments and other interest-earning assets. Because we rely extensively on deposits to fund our operations, our cost of funding would increase if there is an increase in the interest rate we are required to pay our customers to retain their deposits, as is currently being experienced in our businesses. This

could also occur, for instance, if we are faced with competitive or regulatory pressures to increase rates on deposits. In addition, our cost of funding increases if the interest rates we are required to pay for other sources of funding increase. Moreover, increases in interest rates have and may continue to decrease customer demand for loans as the higher cost of obtaining credit may deter customers from seeking increases in or new loans. Further, the effects of inflation and interest rate volatility may lead to liquidity issues for borrowers and debt covenant violations. An increase in interest rates may lead to the need for borrowers to amend the terms of existing debt agreements or obtain waivers if they no longer satisfy debt covenants. Changes to existing debt arrangements may represent restructuring, modification or extinguishment, which might lead to an increased number of delinquent loans and defaults, which would affect the value of our loans. Changes in interest rates may negatively affect the value of our assets and our ability to realize gains or avoid losses from the sale of those assets, all of which may also ultimately affect earnings and capital, as well as our regulatory solvency position.

While SOFR has been endorsed by the Alternative Reference Rate Committee as its preferred replacement for the LIBOR, it remains uncertain whether or when SOFR or other alternative reference rates will be widely accepted by lenders as the replacement for LIBOR. This may, in turn, impact the liquidity of the SOFR loan market, and SOFR itself, with the risk of increased volatility, which could result in higher borrowing costs for us. Further, as the use of SOFR-based rates is relatively new, there could be unanticipated difficulties, disruptions or methodological or other changes with the calculation and publication of SOFR based rates, which in turn could trigger another benchmark transition or otherwise cause a reliance on an alternate base rate. This could also result in increased borrowing costs for us and thereby have a material adverse effect on our business or financial condition.

Global economies, including the jurisdictions in which we operate, continue to experience elevated levels of inflation. The duration and severity of the current inflationary period is unknown and cannot be estimated with precision. Increased costs as a result of inflation could reduce our profit margins or could result in deposit outflows, which could also negatively impact our liquidity. Inflation may also result in reduced valuations on long duration financial assets and real estate and impact the value of collateral pledged for loans. Additionally, inflation has increased volatility and uncertainty in the business environment, which could adversely impact loan demand and our clients’ ability to repay indebtedness. A failure to accurately anticipate higher inflation may result in mispricing of our products. As a result, a sustained period of high inflation in our key markets could adversely affect our business, financial position or results of operations.

Our loan and investment portfolios are subject to risk of prepayment, which could have a material adverse effect on us.

The value of the securities in our investment portfolio may continue to decline in the future.

As at December 31, 2023, we owned $5.3 billion of investment securities consisting primarily of securities issued by the US government and US governmental agencies and recorded net unrealized losses in our AFS and HTM portfolios of $163.9 million and $484.4 million, respectively, due to changes in fair value of our investment securities as a result of rapidly rising long-term market interest rates. In 2023, our investment portfolio had an average yield of 2.10%.

We did not record any credit impairment losses on investments in the years ended December 31, 2023, 2022 and 2021. We may be required to recognize credit impairments in the future periods, which could have an adverse effect on our business, financial conditions or results of operations. See "- If we are unable to effectively manage our liquidity we may need to seek additional financing and our business, financial condition or results of operations could be adversely affected."

We also provide foreign exchange services to our clients, including trading on behalf of clients in all major currencies and providing hedging solutions to manage foreign exchange risk. Foreign currency volatility influences the level of client activity. Changes in client activity may result in reduced income from foreign exchange services.

In addition, the Bermuda Dollar and the Cayman Islands Dollar are pegged to the US Dollar at exchange rates of 1 Bermuda Dollar to 1 US Dollar and 1 Cayman Islands Dollar to 1.20 US Dollars, respectively. However, we cannot make assurances that these pegs will be maintained. In the event that the Bermuda Dollar or Cayman Islands Dollar is de-pegged or the current ratios are changed, including as a result of changes in laws, regulations or policies in these jurisdictions, the value of our financial position or results of operations could be adversely affected. Moreover, our US Dollar deposits are used to fund mortgages in Bermuda Dollars and Cayman Islands Dollars. As the Bermuda Dollar and the Cayman Islands Dollar are pegged to the US Dollar, we do not engage in hedging activities to counteract this currency risk. If the Bermuda Dollar or Cayman Islands Dollar ceased to be pegged to the US Dollar at the current ratios, however, we could be exposed to significant currency risks.

A decline in the residential real estate market, including in Bermuda, the Cayman Islands, the Channel Islands and the United Kingdom, could increase the risk of loans being impaired and could have an adverse effect on our business, financial condition or results of operations.

decline in the real estate market, in particular in Bermuda, the Cayman Islands, the Channel Islands and the UK, would mean that the collateral for our loans would hold less value. As a result, our ability to recover on defaulted loans by selling the underlying real estate would be diminished, and we would be more likely to suffer losses on the defaulted loans. Declines in the real estate market, including as a result of lower infrastructure spending in the markets in which we operate, could also adversely affect demand for new loans, further decreasing the interest revenue generated by our loan portfolio. In addition, if our estimate for our allowance for credit losses proves to be inadequate, we will have to increase the allowance accordingly and may have future charge-offs. This may lead to impairment charges on loans and other assets, higher costs and higher provisions for credit losses.

We could be negatively affected if the soundness of other financial institutions and counterparties deteriorates or if such counterparties, including clearing houses, are unwilling to do business with us, in particular in respect of US Dollar transactions.

Given the high level of interdependence between financial institutions, we are and will continue to be subject to the risk of actual or perceived deterioration in the commercial and financial soundness of other financial services institutions as evidenced by the collapse of multiple high profile regional banks such as Silicon Valley Bank, Signature Bank and First Republic Bank in 2023, which resulted in decreased confidence in banks among consumer and commercial depositors, other counterparties and investors, as well as significant disruption, volatility and reduced valuations of equity and other securities of banks in the capital markets. Within the financial services industry, the default by any one institution could lead to defaults by other institutions. Concerns about, or a default by, one institution could lead to significant liquidity problems, losses or defaults by other institutions, because the commercial and financial soundness of many financial institutions may be closely related as a result of their credit, trading, clearing or other relationships. Even the perceived lack of creditworthiness of, or questions about, a financial institution may lead to market-wide liquidity problems and losses or defaults by us or by other institutions. This risk is sometimes referred to as "systemic risk" or "contagion" and may adversely affect financial intermediaries, such as clearing agencies, clearing houses and banks with whom we interact on a daily basis. In particular, BNYM and Wells Fargo Bank, N.A. ("Wells Fargo") act as clearing houses for all our US Dollar transactions. If BNYM's or Wells Fargo's ability to act as our clearing houses becomes impaired or BNYM or Wells Fargo cease to act as our clearing houses for any other reason and other financial institutions are not willing to provide the services currently provided to us by BNYM and Wells Fargo, we could lose our ability to engage in US Dollar transactions, which could lead to severe disruptions in our operations and adversely impact our business, financial condition or results of operations.

Our strategy includes expansion of our business through acquisitions of, or investments in, other companies or new products and services, but we may not be able to achieve regulatory approval for such transactions or be able to achieve the anticipated cost savings, growth opportunities and other benefits anticipated from such transactions.

We seek to grow both organically and through acquisitions. In the past several years, we have made various acquisitions and investments intended to complement and expand our businesses, including our September 2022 agreement with Credit Suisse to acquire assets (i.e. client relationships) from its trust business in Singapore, Guernsey and The Bahamas, which was completed in December 2023. Our long-term growth strategy includes identifying and effecting selective acquisitions in our core geographies, but we cannot be sure that we will be able to continue to identify suitable acquisition targets or investment opportunities. Even if we identify suitable targets, there can be no assurance that we will be able to obtain the necessary funding on acceptable terms, if at all, to finance any of those potential acquisitions or investments.

We may also be required to obtain regulatory approval (including from the BMA) prior to any potential acquisition or investment depending on the transaction and the laws and regulations of the target’s country of incorporation. Regulators consider a number of factors when determining whether to approve a proposed transaction, and we may have difficulty obtaining the necessary regulatory approvals, government permits or licenses required for such acquisitions. We may fail to pursue, evaluate or complete strategic and competitively significant business opportunities as a result of our inability, or our perceived inability, to obtain any required regulatory approvals in a timely manner or at all.

Even where we are able to complete an acquisition or an investment, we cannot be sure that such acquired entity, business or asset or such investment will perform in line with our assumptions or expectations or otherwise complement our business or strategy due to a variety of factors, including lower revenues than expected, unforeseen operating difficulties and expenditures, customer loss and business disruption (including, without limitation, difficulties in maintaining relationships with employees, customers, clients or suppliers) and risks associated with the disruption of management’s attention from ongoing business operations due to acquisition and integration activities.

In addition, integrating an acquired company, business asset or technology possesses significant risks, including, among other things:

In addition, a significant portion of the purchase price of companies or assets that we may acquire may be allocated to goodwill and other intangible assets. Intangible assets are tested for impairment annually or when there is a triggering event requiring such testing; an intangible asset that is subject to amortization is periodically reviewed for impairment. Goodwill is tested for impairment on an annual basis. As at December 31, 2023, we had $24.1 million and $74.8 million of goodwill and intangible assets, respectively. In the future, if our acquisitions do not yield expected returns or there are changes in discount rates, we may be required to take additional charges to our earnings based on the impairment assessment process, which could harm our business, financial condition, results of operations and prospects.

If we are unable to effectively manage our liquidity we may need to seek additional financing and our business, financial condition or results of operations could be adversely affected.

We need liquidity to pay our operating expenses, to fund depositor withdrawals, interest on our debt and declared dividends on our common shares, and to replace certain maturing liabilities. Without sufficient liquidity, we will be forced to curtail our operations and our business will suffer materially and may not survive.

Our main source of funding is customer deposits. As at December 31, 2023, we had $12.0 billion in deposits (54% USD deposits, 21% USD-pegged deposits, 19% GBP deposits), with 37% of our deposits derived from our Bermuda segment, 33% from the Cayman segment, and 29% from the Channel Islands segment. In addition, we source funding from net income generated by the Bank, net of dividends paid, and to a lesser extent from other sources including the sale of securities to institutional counterparties under repurchase agreements and the sale of equity securities and AFS securities. Our deposit base includes both demand and term liabilities, with the significant majority of such deposits being demand deposits or are due within six months. Because we rely primarily on short-term deposits for funding, a sudden or unexpected shortage of funds in the banking systems in which we operate may prevent us from obtaining necessary funding at all or without incurring higher costs. Our deposit base includes deposits from commercial and institutional clients which may be more sensitive to financial strength rating changes. See also “ - We face competition in all aspects of our business, and may not be able to attract and retain wealth management, trust and banking clients at current levels.” A significant withdrawal of deposits in either of these markets could significantly affect our liquidity and our ability to meet our funding needs, in particular as the expanding use of Internet and mobile banking have significantly increased the speed with which customers can access deposits in response to real or perceived risks or otherwise. Any sudden liquidity crisis could lead to the Bank’s failure.

In addition, as a bank with subsidiaries located in various jurisdictions, the Bank’s access to inter-company funds can be restricted because our regulated banking subsidiaries are required to maintain certain liquidity ratios or minimum levels of capital in accordance with the laws of the jurisdictions in which they operate or otherwise. The necessity of maintaining these ratios or levels of capital or other liquidity considerations could restrict the ability of these subsidiaries to transfer funds to us, in the form of cash dividends, loans or advances.

In the event that our current resources do not satisfy our needs, we may need to seek additional financing. The availability of additional financing will depend on a variety of factors, such as market conditions, the general availability of credit, the volume of trading activities, the overall availability of credit to the financial services industry, our credit ratings and credit capacity, above average interest rates and supply/demand dynamics, as well as the possibility that customers or lenders could develop a negative perception of our long- or short-term financial prospects, including as a result of economic uncertainty or any downgrade in sovereign credit ratings in key markets in which we operate.

We rely on third parties to provide services that are integral to our ordinary operations, and their failure to perform in a satisfactory manner could negatively affect us.

We rely on third parties to provide services that are integral to our ordinary course operations, including providers of information technology, administrative or investment advisory services. These third party supported functions or operating systems may not function properly, become insufficient to support our evolving business needs or become defective or damaged as a result of a number of factors including events beyond our control. Enhancements and upgrades to third party supported infrastructure or operating systems entail significant time and costs, and create risks associated with implementing new systems and integrating them with existing ones. Due to the complexity of our systems, across multiple jurisdictions and product types, the process of enhancing our infrastructure and operating systems, including their security measures and controls, can create a risk of system disruptions and security issues. Similarly, we may not be able to timely recover critical business processes or operations that have been disrupted, which may further increase the associated costs and consequences of such disruptions. Although we have business continuity plans in place, cybersecurity and other safeguards in place to help provide operational resiliency, our business operations may be adversely affected by significant and prolonged disruption to our operating systems that support our businesses and customers. Furthermore, third parties on which we rely, could also introduce operational risk to us, including from information breaches or loss, breakdowns, cyber incidents, disruptions or failures of their own systems or infrastructure, or any deficiencies in the performance of their responsibilities. A material breach of customer data may negatively impact our business reputation and cause a loss of customer business; may result in increased expense to contain the event and/or require that we provide credit monitoring services for affected customers; may result in regulatory fines and sanctions; and/or may result in litigation. We rely on our outsourced service providers to implement and maintain prudent cybersecurity controls. We have procedures in place designed to assess a vendor's cybersecurity controls prior to establishing a contractual relationship and to periodically review assessments of those control systems; however, these procedures are not infallible and a vendor's system can be breached despite the procedures we employ. In addition, outsourcing is subject to regulatory controls in certain jurisdictions in which we operate and we may not always be able to obtain approval to outsource on terms available or sought by us, which could adversely affect our ability to enter into outsourcing arrangements.

In addition, BNYM and Wells Fargo act as clearing houses for all our US Dollar transactions and, if our relationships with BNYM and Wells Fargo are terminated, we could lose our ability to engage in US Dollar transactions. For more information see " - We could be negatively affected if the soundness of other financial institutions and counterparties deteriorates or if such counterparties, including clearing houses, are unwilling to do business with us, in particular in respect of US Dollar transactions."

We face competition in all aspects of our business, and may not be able to attract and retain wealth management, trust and banking clients at current levels.

We compete with a broad range of financial institutions. Many of our competitors are larger and have broader ranges of product and service offerings, increased access to capital, and greater efficiency and pricing power. We face competition from other lending institutions and from numerous other providers of financial services, including the following:

In our banking business, we face competition mainly from other local banks, such as Bermuda Commercial Bank and Clarien Bank in Bermuda and from Cayman National Corporation in the Cayman Islands, as well as from subsidiaries of international banks, being Royal Bank of Canada in the Cayman Islands and HSBC in Bermuda, whom we view as our most significant competitors. In our wealth management business line, we face competition from local competitors, as well as much larger financial institutions, including financial institutions that are not based in the markets in which we operate. Revenues from the trust and wealth management business depend in large part on the level of AUA. In addition, as higher-for-longer interest rates have developed as the most likely scenario in the near term, competition for deposits has increased across our island jurisdictions, particularly in the Channel Islands.

In our trust business, we face competition primarily from other specialized trust service providers. Many of our competitors in the international financial sector offer fund administration and corporate services work alongside private client fiduciary services.

Our ability to successfully attract and retain trust, wealth management and banking clients is dependent upon our ability to compete with competitors' investment products, retail products and services, level of investment performance, client services and marketing and distribution capabilities. If we are not successful, our business, financial condition or results of operations may be adversely affected.

The addition of new products and services, or modified products or services may subject us to implementation and reputational risk.

From time to time, we may introduce new activities or new technology through new products and services within business entities (e.g. in Guernsey and Jersey we have introduced retail products such as residential mortgages and credit cards). There may be substantial risks and uncertainties associated with these efforts. Insufficient planning may lead to an incomplete assessment and understanding of associated risks involved with new activities and may result in inadequate oversight and controls. New activities may increase strategic risk where not compatible with the bank’s risk appetite or strategic plan or do not provide an adequate return on investment; engagement of new activities without adequate due diligence and failure to provide adequate resources, expertise and experience to properly implement and oversee new activities. This can increase reputational risk and negative public opinion. Failure to successfully manage these risks in the development and implementation of new lines of business or new products or services could have a material adverse effect on our business, financial condition, and results of operations.

The Bank's credit strength ratings are an important component of its liquidity profile and competitive position. Ratings show each agency's view of our financial strength, operating performance and ability to meet debt obligations as they become due. NRSROs periodically review the financial performance and condition of banks and may downgrade or change the outlook on a bank's ratings due to, for example: a change in a bank's regulatory capital ratios; a change in an NRSRO's determination of the amount of capital cushion required to maintain a particular rating; an increase in the perceived risk of a bank's investment portfolio; reduced confidence in management; or other considerations that may or may not be under our control. The Bank has credit ratings from S&P, Moody's and KBRA. Each of the rating agencies reviews its ratings and rating methodologies on a recurring basis and may decide on a downgrade at any time. The Bank's ratings as at December 31, 2023 are shown in the table below:

Negative changes in the Bank's long-term credit ratings would also likely increase the cost of raising long-term funding in the capital markets or of borrowing funds. Even where we can access the capital markets, negative changes in our ratings could affect our share price and make any equity offerings more difficult and dilutive to current shareholders, further driving down the Bank's share price. Our ability to replace maturing or existing debt may be more difficult and expensive. In addition, our lenders and counterparties in derivative transactions are sensitive to the risk of a ratings downgrade. However, we may issue additional debt securities in the future which may increase the impact of a one-notch downgrade in credit ratings.

Management cannot predict what actions rating agencies may take, or what actions we may take in response to the actions of rating agencies that could adversely affect our business. As with other companies in the financial services industry, our ratings could be downgraded at any time and without any notice by any NRSRO, which could adversely affect our business, financial conditions or results of operations.

We could fail to attract, retain or motivate highly skilled and qualified personnel, including our senior management, other key employees or members of the Board, which could adversely affect our business.

Our ability to implement our strategic plan and our future success depends on our ability to continue to attract, retain and motivate highly skilled, diverse and qualified personnel, including our senior management and other key employees and directors, competitively with our peers. The marketplace for skilled personnel is competitive, which means the cost of hiring, incentivizing and retaining skilled personnel may continue to increase. For example, labor shortages and increased turnover in recent years has increased the cost of hiring, incentivizing and retaining skilled personnel. Increased turnover and the shortage of employees may put stress on internal control environments. While the Bank has experienced slightly higher turnover levels in 2022 and 2023 as compared to historical averages, we do not consider them to be material or systemic in nature. The failure to attract or retain, including as a result of an untimely death or illness of key personnel, or replace a sufficient number of appropriately skilled and key personnel could place us at a significant competitive disadvantage and prevent us from successfully implementing our strategy or effectively managing our risk framework and business operations. This could impair our ability to implement our strategic plan successfully, achieve our performance targets and otherwise have an adverse effect on our business, financial condition or results of operations.

In addition, governmental scrutiny with respect to matters relating to compensation and other business practices in the financial services industry has increased dramatically in the past several years and has resulted in more aggressive and intense regulatory supervision in certain markets in which we operate or are regulated. Future legislation or regulation or government views on compensation may result in us altering compensation practices in ways that could adversely affect our ability to attract and retain talented employees.

Our business is subject to risks related to litigation and regulatory actions.

We are, from time to time, involved in various legal and regulatory proceedings arising from our normal business activities. These claims and legal actions, including supervisory actions by our regulators or proceedings or investigations brought by other regulators, could involve large monetary claims and significant defense costs. The outcome of these cases is uncertain. Substantial legal liability or significant regulatory action against us could have material financial effects or cause significant reputational

harm to us, which in turn could seriously harm our business, financial condition, results of operations and prospects. We may be exposed to substantial uninsured liabilities, which could materially affect our results of operations and financial condition.

Requirements and expectations from our regulators and other stakeholders on sustainability, environmental, social and governance issues could significantly impact our business.

Risks Relating to Operations, Risk Oversight and Internal Controls

We rely heavily on communications and information systems to conduct business. In particular, we rely on technology to provide key components of our information system infrastructure, including loan, deposit and general ledger processing, risk management information collection and processing for internal control purposes, internet connections and network access. Any disruption in service of these key components, for example due to system errors, a natural catastrophe, or the termination of any third-party software licenses upon which any of these systems is based, could adversely affect our ability to effectively deliver products and services to clients, to detect, assess and manage risk and otherwise to conduct operations. See "- We rely on third parties to provide services that are integral to our ordinary operations, and their failure to perform in a satisfactory manner could negatively affect us.” Furthermore, any security breach, due to computer viruses, programming, malfeasance or human errors or other events or developments, of information systems or data, whether managed by us or third parties, could interrupt our business, harm our reputation or cause a decrease in the number of clients using our services. The financial services industry is continually undergoing rapid technological change with frequent introductions of new, and technology-driven products and services. We face the risk of having to establish and maintain further improved technological capabilities, and our future success depends, in part, on our ability to recognize and implement new technologies to address our operational and internal control needs, operational efficiencies and to meet the demands of our clients. See "- Cyber-attacks, distributed denial of service attacks and other cybersecurity matters, if successful, could have an adverse effect on our business, financial condition or results of operations.”

The widespread adoption of new technologies, including cryptocurrencies, blockchain, machine learning and artificial intelligence, have and could continue to require substantial expenditures to modify or adapt our existing products and services as we continue to grow our internet and mobile banking capabilities or other technological-based distribution channels. The persistence or acceleration of this shift in demand towards internet and mobile banking has and may continue to necessitate changes to our retail distribution strategy, which include restructuring our branches and work force. These actions could lead to losses on these assets and may lead to increased expenditures to reform our retail distribution channel.

Many of our competitors have substantially greater resources to invest in technological improvements than we do. We may not be able to effectively implement new, technology-driven products and services or be successful in marketing these products and services to our customers. In addition, the implementation of technological changes and upgrades to maintain current systems and integrate new ones may also cause service interruptions, transaction processing errors and system conversion delays and may cause us to fail to comply with applicable laws. Failure to successfully keep pace with technological change affecting the financial services industry and avoid interruptions, errors and delays could have an adverse effect on our business, financial condition, results of operations, or competitive position.

Cyber-attacks, distributed denial of service attacks and other cybersecurity matters, if successful, could have an adverse effect on our business, financial condition or results of operations.

In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and store sensitive, proprietary or confidential data. The secure processing, storage, maintenance and transmission of this data is critical to our operations and reputation. We are under continuous threat from cyber-attacks, especially as we continue to expand customer capabilities to utilize the internet and other remote channels to transact business. If any of our data were mishandled, misused, improperly accessed, lost or stolen, or if our operations were disrupted, we could suffer significant financial, reputational or other damages. Two of the most significant cyber-attack risks that we face are e-fraud and loss of sensitive customer data. These risks may be more likely where third party vendors have access to or process data on our behalf. While such attacks are infrequent, they could present significant reputational, legal and regulatory costs to us if successful. In addition, the nature of cyber-attacks is constantly and rapidly evolving, and the use of AI by cybercriminals may increase the frequency and severity of cybersecurity attacks against us or our third-party vendors and clients. Attempts to infiltrate our systems may not be recognized until launched against us and in some cases are designed not to be detected. Although we make significant efforts to maintain the security and integrity of our information systems, there can be no assurances that our security measures will be effective.

Third parties with whom we or our customers do business also present operational and information security risks to us, including security breaches or failures of their own systems. Cyber-attacks at third party service providers are also becoming increasingly common and, as a result, risks relating to cyber-attacks on our vendors have been increasing. We also face risks related to cyber-attacks and other security breaches in connection with credit card transactions that typically involve the transmission of sensitive information regarding our customers through various third parties, including merchant acquiring banks, payment processors, payment card networks (e.g., Visa or Mastercard), our processors, and clearing banks. Some of these parties have in the past been the target of security breaches and cyber-attacks, and because the transactions involve third parties and environments such as the point of sale that we do not control or secure, future security breaches or cyber-attacks affecting any of these third parties could impact us through no fault of our own, and in some cases we may have exposure and suffer losses for breaches or attacks relating to them, including from remediation costs, increased future protection costs, reputational harm, loss of customers and potential regulatory inquiries and/or civil litigation. We also rely on numerous other third-party service providers to conduct other aspects of our business operations and face similar risks relating to them.

Our increased use of cloud and other technologies heighten our exposure to security weaknesses that may increase our risks to data breaches, data loss, data leakage, account hijacking, insecure application programming interfaces and other potential cyber-risk events. Many of our employees (and staff of service providers) work remotely or from other sites. These working arrangements could potentially provide increased opportunities for cyber threat actors to exploit. We cannot provide assurances that the safeguards we have put in place or may implement in the future will prevent all unauthorized infiltration or breach, or that we will not suffer material losses related to a security breach in the future.

In recent years, U.S. regulators, including the FDIC, SEC, and the FINRA, have made statements concerning cybersecurity risk management, preparedness and resiliency for financial institutions such as us. These statements range from issues with respect to client account protections to business continuity, and represent the regulators’ expectations for financial institutions to have more robust cybersecurity risk management and a preparedness and resiliency program for themselves and their service providers. A financial institution is also expected to develop processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution, or its critical service providers, fall victim to this type of cyber-attack. Any cyber incidents, such as those of our third party vendors, could result, among other things, in increased regulatory scrutiny and adverse regulatory or civil litigation consequences.

The occurrence of a cyber-threat scenario could cause interruptions in our operations and result in the incurrence of significant costs, including those related to forensic analysis and legal counsel, each of which may be required to ascertain the extent of any potential harm to our customers, or employees, or damage to our information systems and any legal or regulatory obligations that may result therefrom. The SEC recently adopted rules that require us to publicly disclose information about a material cybersecurity incident, including the impact or reasonably likely impact. Disclosure may be required before the incident has been resolved or fully investigated. The occurrence of a cyber-threat may therefore have a material adverse effect on our reputation, financial condition and results of operations. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our clients.

Due to the increasing sophistication of such attacks, we may not be able to prevent denial-of-service or other cyber-attacks that could compromise our normal business operations or the normal business operations of our clients, or result in the unauthorized use or disclosure of clients’ confidential and proprietary information. The occurrence of any failure, interruption or security breach of network and computer systems resulting from denial-of-service or other cyber-attacks or security incidents could impact our ability to operate and serve our clients, damage our reputation, result in a loss of client business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability, any of which could adversely affect our business, results of operations or financial condition.

We maintain an enterprise risk management program that is designed to identify, quantify, monitor, report and control the risks we face. We also maintain a compliance program to identify, measure, assess and report on adherence to applicable laws, policies and procedures. Our approach to risk management requires senior management to make complex judgments, including decisions (based on assumptions about economic factors) about the level and types of risk that we are willing to accept in order to achieve our business objectives. These also include the maximum level of risks we can assume before breaching constraints determined by regulatory capital and liquidity needs and our regulatory and legal obligations including, among others, from a conduct and prudential perspective. Given these complexities, and the dynamic environment in which we operate, the decisions made by senior management may not be appropriate or yield the results expected. In addition, senior management may be unable to recognize emerging risks quickly enough for us to take appropriate action in a timely manner. There can be no assurances that our framework for risk management, compliance and related controls will effectively mitigate risk and limit financial losses for our operations.

We operate in a complex and changing regulatory environment and legal and regulatory changes or our failure to comply with laws and regulations could have a negative impact on our business, financial condition or results of operations.

levels of liquidity, and higher levels of, and better quality, capital and funding, as well as placing restrictions on the businesses we conduct (including limiting our ability to provide products and services to certain customers), requiring us to amend our corporate structure or requiring us to alter our product or service offerings. If a regulatory change has any such effect, it could adversely affect one or more of our businesses, restrict our flexibility, require us to incur substantial costs and impact the profitability of one or more of our business lines. Any such costs or restrictions could adversely affect our business, prospects, financial performance or financial condition.

The costs of complying with, or our failure to comply with, domestic and foreign laws related to privacy, data security and data protection, such as the EU General Data Protection Regulation, could adversely affect our financial condition, operating results and reputation.

Failure to comply with any applicable anti-corruption legislation could result in fines, criminal penalties and an adverse effect on our business, financial condition or results of operations.

The Financial Action Task Force may identify any of the jurisdictions in which we operate as a jurisdiction which has systemic anti-money laundering and/or anti-terrorist financing deficiencies, which could have an adverse effect on our business.

Our international business model exposes us to various and possibly conflicting regulatory regimes across multiple jurisdictions.

Our business may be negatively impacted by the economic substance legislation and regulations in the jurisdictions in which we operate, including Bermuda, the Cayman Islands, and the Channel Islands.

jurisdictions in March 2019, but removed from this list in May 2019 and added to the EU's list of cooperative tax jurisdictions in February 2020. EU Finance Ministers signaled their approval of the economic substance regulations by placing Jersey and Guernsey on the EU's list of cooperative tax jurisdictions in March 2019, and the OECD has endorsed Jersey and Guernsey’s domestic legal framework as being in line with the relevant standard. As the EU continues to monitor compliance by the jurisdictions in which we operate, further economic substance requirements imposed by these jurisdictions or a future addition of these jurisdictions to the EU's list of non-cooperative tax jurisdictions could have a material adverse effect on us.

We are required to obtain approval from our regulators before engaging in certain activities.

If we are considered to be a passive foreign investment company, such characterization could result in adverse US federal income tax consequences to shareholders that are US investors.

US withholding tax and information reporting requirements imposed under the Foreign Account Tax Compliance Act may apply.

We, like many financial institutions, remain under considerable regulatory scrutiny regarding our ability to prevent and detect financial crime. The financial crime threats we face have continued to evolve, often in tandem with broader geopolitical, socioeconomic and technological shifts in our markets, leading to challenges such as managing conflicting laws and approaches to legal and regulatory regimes.

Purchases of our common shares under our share repurchase program may result in the price of our common shares being higher than the price that otherwise might have existed in the open market.

We are a "foreign private issuer" under US securities law. Therefore, we are exempt from certain requirements applicable to US domestic registrants.

require specific approval by the Controller of Foreign Exchange. This could impact the liquidity of the market for our common shares, and the value of the common shares could be adversely affected.

Our common shares trade on more than one market and this may result in price variations; in addition, investors may not be able to easily move shares for trading between such markets.

The value of the common shares may fluctuate significantly.

The value of our common shares may fluctuate significantly as a result of a large number of factors, including, in part, changes in our actual or forecasted operating results and the inability to fulfill the profit expectations of securities analysts, as well as the high volatility in the securities markets generally, and more particularly in shares of financial institutions. The current market price of our common shares may not be indicative of future market prices.

Other factors, besides our financial results, that may impact the price of our common shares include, but are not limited to:

Holders of our common shares may not receive dividends.

General Risk Factors

Information provided to us about clients and counterparties may not be accurate or complete.

In deciding whether to extend credit or enter into other transactions with clients and counterparties, we rely on information furnished by or on behalf of clients and counterparties, including financial statements and other financial information. We also may rely on representations of clients and counterparties as to the accuracy and completeness of that information and, with respect to financial statements, on reports of independent auditors. Such information could turn out to be inaccurate, including as a result of fraud or misrepresentation on behalf of our clients, counterparties or other third parties, which would increase our credit risk and expose us to possible write-downs and losses and may also adversely affect our ability to comply with certain rules, regulations and standards.

We cannot be certain that our underwriting and operational controls will prevent or detect such fraud or that we will not experience fraud losses or incur costs or other losses related to such fraud. Our clients and counterparties may also experience fraud in their businesses which could adversely affect their ability to repay their loans or make use of our services.

During the periods reported in this annual report, we have not experienced any material losses, or had to write down collateral, as a result of fraud or misrepresentation, but we cannot be certain that the Bank will not experience any such losses or have to write down any such collateral in the future, which could have a material adverse impact on our results of operation and financial condition.

In considering whether to make a loan secured by real property, we generally require an appraisal of the property. However, an appraisal is only an estimate of the value of the property at the time the appraisal is made, and, as real estate values may change significantly in relatively short periods of time (especially in periods of heightened economic uncertainty and in rising interest rate environments), this estimate may not accurately describe the net value of the real property collateral after the loan is made. As a result, we may not be able to realize the full amount of any remaining indebtedness when we foreclose on and sell the relevant property. In addition, we rely on appraisals and other valuation techniques to establish the value of our OREO and to determine certain loan impairments. If any of these valuations are inaccurate, our consolidated financial statements may not reflect the correct value of our OREO, and our allowance for credit losses may not reflect accurate loan impairments. This could have an adverse effect on our business, financial condition or results of operations.

We may be alleged to have infringed upon intellectual property rights owned by others or may be unable to protect our own intellectual property.

Competitors or other third parties may allege that we, or consultants or other third parties retained or indemnified by us, infringe on their intellectual property rights. Even in instances where we believe that claims and allegations of intellectual property infringement against us are without merit, defending against such claims is time consuming and expensive and could result in the diversion of time and attention of our management and employees. In addition, although in some cases a third party may have agreed to indemnify us for such costs, such indemnifying party may refuse, or be unable, to uphold its contractual obligations.

Moreover, we rely on a variety of measures to protect our intellectual property and proprietary information, including copyrights, trademarks, and controls on access and distribution. These measures may not prevent misappropriation or infringement of our intellectual property or proprietary information and a resulting loss of competitive advantage. In any event, we may be required to litigate to protect our intellectual property and proprietary information from misappropriation or infringement by others, which is expensive and could cause a diversion of resources and may not be successful.

Our insurance coverage may not be adequate to cover all possible losses that we could suffer, and our insurance costs could increase in the future.

Our insurance policies do not cover all types of potential losses and liabilities and are subject to limits and deductibles. There can be no assurance that our insurance will be sufficient to cover the full extent of all losses or liabilities for which we are ultimately responsible, which could result in losses being incurred by the Bank. Additionally, we cannot guarantee that we will be able to renew our current insurance policies on favorable terms, or at all.

Changes in accounting policies and practices may be adopted by applicable regulatory agencies or other authoritative bodies, which could materially impact our financial statements.

ITEM 4. INFORMATION ON THE COMPANY

Corporate Information

We are a company incorporated under the laws of Bermuda, incorporated on October 22, 1904, pursuant to The N.T. Butterfield & Son Bank Act, 1904 (the "Butterfield Act"). We are registered with the Registrar of Companies in Bermuda under registration number 2106. Our registered office and principal executive offices are located at 65 Front Street, Hamilton, HM 12, Bermuda. Our agent for service of process in the United States is C T Corporation System, 28 Liberty Street, New York, New York 10005. Our telephone number is (441) 295 1111. We maintain a website at www.butterfieldgroup.com. Neither this website nor the information on or accessible through this website is included or incorporated in, or is a part of, this report.

The SEC maintains an internet site at https://www.sec.gov that contains reports, information statements, and other information regarding issuers that file electronically with the SEC.

Our History

The origin of The Bank of N.T. Butterfield & Son Limited dates back to the founding of the trading firm of Nathaniel Butterfield circa 1784. In 1858, our company was established as a bank in Bermuda and has been instrumental to the functioning of the local economy ever since. The Bank was later incorporated under a special act of the local Parliament in 1904. In the 1960s, as international businesses began contributing substantially to Bermuda's economy, we developed services to work to meet their needs. In 1967, we opened offices in the Cayman Islands and by the 1980s had expanded our operations to include retail banking, investment management, and fund administration. In 1973, we opened our Guernsey office in order to provide customers with access to the Pound Sterling currency after Bermuda's departure from the British Sterling zone. In addition to being Bermuda's first bank, we opened the first ATMs in Bermuda in the 1980s and launched Bermuda's first internet banking service in 2001. In 1971, we listed our common shares on the BSX under the ticker symbol "NTB.BH". In 2016, we listed our common shares on the NYSE under the ticker symbol "NTB".

In 2008 and 2009, as a result of the global financial crisis, we realized losses attributable primarily to US non-agency mortgage backed securities in our investment portfolio, as well as write-downs on local market hospitality loans. To raise capital to offset these losses, the Bank executed a $200 million preference share offering in June 2009. In 2009 and 2010, we implemented a comprehensive restructuring plan for the Company: we hired a new management team, de-risked our balance sheet, and raised $550 million of common equity from a group of investors as well as existing shareholders.

Since our restructuring, we have pursued a strategy to focus on our core business in banking and wealth management. We have executed upon our strategy by streamlining the Company's operations through exiting non-core markets, repositioning our balance sheet, investing in efficiency initiatives, and continuing to invest in our core business lines to grow both organically and through acquisitions. By following this strategy, we have improved our financial results and have been able to initiate a progressive capital return policy for investors. The following are the most recent key steps in executing our strategy:

Overview

We are a full service bank and wealth manager headquartered in Hamilton, Bermuda. We operate our business through three geographic segments: Bermuda, the Cayman Islands, and the Channel Islands and the UK (CI & UK). We offer banking services, comprising of retail, private and corporate banking, treasury services, and wealth management, which consists of investment management, advisory and brokerage services, trust, estate, and company management in both our Bermuda and Cayman Islands segments, as well as custody services in our Bermuda segment. The CI & UK segment includes the jurisdictions of Guernsey and Jersey (Channel Islands), and the UK. In the Channel Islands, a broad range of services are provided to individuals, private clients and trusts, and to financial intermediaries and funds including deposit services, mortgage lending, private and corporate banking, treasury services, wealth management and fiduciary services. In 2023, we began issuing credit cards to residents of Guernsey and Jersey. The UK jurisdiction provides mortgage lending for high-value residential properties. We also have operations in the jurisdictions of The Bahamas, Canada, Mauritius, Singapore and Switzerland, which we include in our Other segment.

For the year ended December 31, 2023, we generated $578.6 million in net revenue after provision for credit losses and other gains/losses ("net revenue"). Our total net revenue, before inter-segment eliminations, by each of our three geographic segments and our non-reportable "Other" segment for the years ended December 31, 2023, 2022 and 2021 are as follows:

In our Bermuda and Cayman segments, our bank provides a full range of retail and corporate banking services to individuals, local businesses, captive insurers, reinsurance companies, trust companies, and hedge funds. The key products we offer include personal and business deposit services, residential and commercial mortgages, small and medium-sized enterprise and corporate loans, credit and debit cards, merchant acquiring, mobile and internet banking, and cash management.

In our Channel Islands and UK segment, our bank provides a broad range of services to individuals, private clients and trusts, and to financial institutions and funds including deposit services, mortgage lending, private and corporate banking, treasury services, wealth management and fiduciary services. In 2023, the segment began issuing credit cards to local residents of Guernsey and Jersey. The UK jurisdiction provides mortgages for high-value residential properties.

In all of our segments, we offer wealth management to high net worth and ultra-high net worth individuals, family offices, and institutional and corporate clients. Our wealth management platform has three lines of business: trust, private banking, and asset management.

The trust business line, which utilizes specialists in each of our geographic areas, responds to client needs in estate and succession planning, administration of complex asset holdings, and efficient coordination of family affairs. In addition, the business provides pension and employee benefits services for multinational corporations, as well as services that involve administration of and fiduciary responsibility for customized trust structures holding a wide range of asset types including financial assets, property, business assets and art.

Our private banking business line offers access to a suite of services, targeted toward high net worth and ultra-high net worth individuals, trusts, and family offices, that can be customized to each client's needs and preferences and delivered as part of a coordinated strategy by a dedicated private banker. We provide clients in our Bermuda, Cayman, and Channel Islands and the UK segments with an integrated model that combines traditional wealth management with banking, lending, cash management, foreign exchange services, custody and access to asset management and trust professionals within Butterfield. We also provide our clients with access to their account information through the use of internet and mobile banking.

Our asset management business line provides a broad range of portfolio management services to institutional and private clients. Our target client base includes institutions such as pension funds and captive insurance companies with investable assets over $10 million and private clients such as high net worth and ultra-high net worth individuals, families, and trusts with investable assets over $1 million. Our principal services include discretionary investment management, managed portfolio services, money market, and mutual fund offerings. We also offer advisory and self-directed brokerage options. Over 90% of the business's discretionary investment mandates call for balanced growth to conservative allocations. We focus on delivery of reasonable appreciation with an emphasis on capital preservation. The Bank relies on third parties to provide research and investment management expertise, while our own services are concentrated on portfolio construction and managing client relationships. We also provide customized reporting to meet specific needs of our major clients.

__________________________

Our Markets

The charts below provide the geographic distribution of our Net Revenue for the year ended December 31, 2023.

The Bermuda and Cayman Islands banking markets have historically been characterized by a limited number of participants and significant barriers to entry. In addition, these markets provide us with access to several attractive customer bases: in retail banking, we serve local residents and businesses; in corporate banking, we serve captive insurers, hedge funds, middle-market reinsurers, and other corporates; and in wealth management, we serve private trust clients and high net worth and ultra-high net worth individuals and families.

The international trust market is primarily concentrated in select jurisdictions, including Bermuda, the Cayman Islands, Guernsey, Jersey, Hong Kong, Singapore, and Switzerland. The leading international trust law firms serve as key introducers of clients to Butterfield and are the primary source of new business. Trust clients often hold assets that are international in nature, and as a result, performance of trust businesses is expected to have limited correlation with the performance of the domestic economies where clients are served.

The private banking market in Bermuda, the Cayman Islands, and Guernsey is composed largely of resident high net worth and ultra-high net worth individuals meeting minimum deposit and/or loan thresholds. Clients are introduced to the private bank through Butterfield's retail banking operation upon reaching the appropriate deposit or loan threshold, Butterfield's trust and asset management arms, as well as through external introducers. Although locally based, private banking clients often hold international assets, and as a result, business performance is not necessarily correlated to the domestic economies where clients are served.

Our asset management business line operates in Bermuda, the Cayman Islands, and Guernsey. As at December 31, 2023, 68% of our AUM was in Bermuda, 17% was in the Cayman Islands, and 14% was in Guernsey. In Bermuda and the Cayman Islands, a majority of our institutional and private clients are domestic from a domicile perspective while a majority of our clients in Guernsey are tied to our trust business and are international in nature.

Our International Network and Group Structure

The following chart presents our corporate structure, indicating our principal regulated subsidiaries as at December 31, 2023. All of the subsidiaries listed below are wholly owned by the Bank.

The Bank itself is licensed in Bermuda to provide banking and custody services. Through Butterfield Asset Management Limited and Butterfield Securities (Bermuda) Limited, it is licensed and provides investment services and, through Butterfield Trust (Bermuda) Limited and Bermuda Trust Company Limited, it is licensed and provides corporate trustee, fiduciary and corporate administration services. Butterfield Securities (Bermuda) Limited also provides investment advisory and listing sponsor services.

Butterfield Trust (Bahamas) Limited provides trust and fiduciary services.

Butterfield Bank (Cayman) Limited provides banking services and Butterfield Trust (Cayman) Limited provides trustee, fiduciary and corporate administration services.

Butterfield Bank (Guernsey) Limited provides banking and custody services. Butterfield Trust (Guernsey) Limited provides trustee and fiduciary services.

Butterfield Mortgages Limited provides residential property lending services.

Butterfield Holdings (Switzerland) Limited provides investment services and Butterfield Trust (Switzerland) Limited provides trust and fiduciary services.

Butterfield Bank (Jersey) Limited provides banking and custody services.

Butterfield Trust (Asia) Limited provides trust and fiduciary services.

Competition

The financial services industry and each of the markets in which we operate are competitive. We face strong competition in gathering deposits, making loans and obtaining client assets for management. We compete, both domestically and internationally, with globally oriented asset managers, retail and commercial banks, investment banking firms, brokerage firms and other investment service firms. Due to the trend toward consolidation in the global financial services industry, our larger competitors tend to have broader ranges of product and service offerings, greater access to capital, and greater efficiency. Larger financial institutions may also have greater ability to leverage increasing regulatory requirements and investment in technology platforms. We also face competition from non-banking financial institutions. These institutions have the ability to offer services previously limited to commercial banks. In addition, non-banking financial institutions are not subject to the same regulatory restrictions as banks, and can often operate with greater flexibility and lower cost structures.

The Bermuda banking industry currently consists of four licensed and operating banks and one licensed and operating deposit-taking institution. These include one subsidiary of an international bank, HSBC, and three domestic institutions: Butterfield, Bermuda Commercial Bank and Clarien Bank. In the Cayman Islands, the Bank is one of six Class 'A' full service retail banks licensed to conduct business with domestic and international clients. There are also 3 non-retail Category 'A' banks and 76 limited service Category 'B' banks according to CIMA. In the Channel Islands, Guernsey has 20 licensed banks and Jersey has 19, the majority of which are subsidiaries of global banking groups and brands such as Barclays, RBS, Lloyds, JPMorgan Chase, Investec and Royal Bank of Canada. In certain interest rate environments, additional significant competition for deposits may be expected to arise from corporate and government debt securities and money market mutual funds. We view HSBC in Bermuda and Scotia Bank and CIBC FirstCaribbean in the Cayman Islands as our most significant competitors in those markets.

In our wealth management business line, we face competition from local competitors, as well as much larger financial institutions, including financial institutions that are not based in the markets in which we operate. Revenues from the trust and wealth management business depend in large part on the level of assets under management, and larger international banks may have higher levels of assets under management.

In our trust business line, we face competition primarily from other specialized trust service providers. There are many trust companies in the main international financial centers, and many of our competitors in this sector offer fund administration and corporate services alongside private client fiduciary services.

Competition for deposits is also affected by the ease with which customers can transfer deposits from one institution to another. Our cost of funds fluctuates with market interest rates and may be affected by higher rates being offered by other financial institutions. We believe that our most direct competition for deposits comes from international and domestic financial services firms that target the same customers as the Bank.

Deposits

Our deposits are generated principally by our banking business line, which offers retail and corporate checking, savings, and term deposits through our segments in Bermuda, Cayman and the Channel Islands. In addition, wealth management, through its private banking business line, also provides deposit services to high net worth and ultra-high net worth clients in those same geographic segments. As at December 31, 2023, our Bermuda, Cayman , and Channel Islands and the UK segments contributed $4.5 billion, $4.0 billion and $3.5 billion, respectively, to our total deposit base.

Total deposits as at December 31, 2023 were $12.0 billion, down 7.7% over total deposits as at December 31, 2022. Demand deposits, which include checking, savings and call accounts, totaled $8.3 billion, or 68.9% of our total deposits, as at December 31, 2023, compared to $9.9 billion, or 76.1%, as at December 31, 2022. Term deposits totaled $3.7 billion as at December 31, 2023 compared to $3.1 billion as at December 31, 2022. The cost of funds on total deposits increased from 34 basis points in 2022 to 140 basis points in 2023. Deposit balance declines were driven by clients across all banking jurisdictions activating their funds and seeking higher yielding products. Cost of funds increased primarily due to higher market interest rates.

Lending

We offer a broad set of lending products and services including residential mortgage lending, automobile lending, credit cards, consumer financing, and overdraft facilities to our retail customers, and commercial real estate lending, commercial and industrial loans, and overdraft facilities to our commercial and corporate customers. These offerings are provided to our retail, commercial, and private banking clients in our key jurisdictions of Bermuda and the Cayman Islands. We also offer residential mortgage lending through our banking business in the Channel Islands and to our high net worth and ultra-high net worth clients in the UK. Our loan portfolio, net of allowance for credit losses, stood at $4.7 billion as at December 31, 2023 compared to $5.1 billion as at December 31, 2022 driven primarily by scheduled paydowns in the portfolio as well as prepayments in the Cayman and Channel Islands and UK residential mortgage portfolios. The loan portfolio represented 35.5% of total assets as at December 31, 2023, and loans, net of allowance for credit losses, as a percentage of total deposits were 39.6%. The effective yield on total loans for the year ended December 31, 2023 was 6.46%, compared to 5.91% for the year ended December 31, 2022.

The residential mortgage portfolio comprises mortgages to clients with whom we are seeking to establish (or already have) a comprehensive financial services relationship. It includes mortgages to individuals and corporate loans secured by way of first ranking charges over the residential property to which each specific loan relates, generally on terms which allow for the repossession and sale of the property if the borrower fails to comply with the terms of the loan. As at December 31, 2023, residential

mortgages totaled $3.3 billion, accounting for approximately 69.2% of the Group's total gross loan portfolio with $38.4 million of residential mortgage non-accrual loans representing 62.9% of total non-accrual loans in the loan portfolio.

We provide loans, as part of our normal banking business, in respect of automobile financing, consumer financing, credit cards and overdraft facilities to retail and private banking clients in the jurisdictions in which we operate. As at December 31, 2023, non-residential loans to consumers totaled $191.7 million, accounting for approximately 4.0% of the Group's total gross loan portfolio and approximately 1.7% of total non-accrual loans in the Group's loan portfolio.

Commercial real estate loans are offered to real estate investors, developers and builders domiciled primarily in Bermuda, the Cayman Islands, Guernsey and the UK. To manage the Group's credit exposure on such loans, the principal collateral is real estate held for commercial purposes and is supported by a registered mortgage. Cash flows from the properties, primarily from rental income, are generally supported by long-term leases.

As at December 31, 2023, our commercial real estate loan portfolio totaled $607.7 million, accounting for approximately 12.7% of the Group's total gross loan portfolio with $3.1 million of commercial real estate non-accrual loans representing 5.1% of total non-accrual loans in the loan portfolio.

Our commercial real estate loan portfolio is broken down into two categories: commercial mortgage and construction. As at December 31, 2023, commercial mortgages totaled $596.7 million, and construction loans totaled $11.0 million, accounting for approximately 98.2% and 1.8% of our commercial real estate loan portfolio, respectively.

The commercial and industrial loan portfolio includes loans and overdraft facilities advanced primarily to corporations and small and medium-sized entities, which are generally not collateralized by real estate and where loan repayments are expected to flow from the operation of the underlying businesses. As at December 31, 2023, the Group's commercial loan portfolio, excluding loans to governments, totaled $397.0 million, accounting for approximately 8.3% of the Group's total gross loan portfolio and the Group's loans to governments totaled $274.9 million, accounting for approximately 5.8% of our total gross loan portfolio. There was $18.5 million of other commercial non-accrual loans representing approximately 30.3% of total non-accrual loans in the loan portfolio.

Investments

Given the large customer deposit base commanded in our Bermuda, Cayman Islands and Channel Islands operations, and the relatively low volume of lending demand from our customer base, our investment strategy is more important than may be the case for most financial institutions. In recognition of this, we maintain what we believe to be a conservative approach to investments, requiring the purchase of mainly fixed-rate investments in order to manage interest rate risk. Our investment portfolio comprises mainly securities issued or guaranteed by the US government or federal agencies. The securities in which we invest are limited generally to securities that are considered investment grade (i.e., "BBB" and higher by S&P's Financial Services LLC or an equivalent credit rating).

As at December 31, 2023, the Group held $5.3 billion in investments, representing approximately 39.6% of total assets.

Cash and Liquidity Management

We operate across multiple currency jurisdictions with multi-currency products. In our deposit taking jurisdictions—Bermuda, the Cayman Islands, Guernsey and Jersey—there are currently no dedicated central banks, and no pre-funded deposit insurance scheme infrastructures (such as the Federal Deposit Insurance Corporation in the United States), with the exception of Bermuda, where a pre-funded deposit insurance scheme has been implemented, and as described below in “- Supervision and Regulation” and Item 3.D. “Risk Factors - Risks Relating to the Markets in Which We Operate - Certain jurisdictions in which we operate, including Bermuda, Guernsey and Jersey, have a Deposit Insurance Scheme or Deposit Compensation Scheme and we incur ongoing costs as a result". In addition, we do not have access to borrowing or deposit facilities with the US Federal Reserve or the European Central Bank; therefore, we conservatively manage client deposit balances and the liquidity risk profile of our balance sheets. This involves the retention of significant cash or cash equivalent balances, management of intra-bank counterparty exposure and management of a significant short-dated Canadian, UK and US Treasury Bill portfolio. As at December 31, 2023, the cash and cash equivalents of $1.6 billion was composed primarily of $1.4 billion in interest earning cash equivalents, which are investments with a less than 90-day duration. The remaining amounts were comprised of non-interest bearing and interest bearing deposits of $0.1 billion and $0.2 billion, respectively.

Foreign Exchange Services

We provide foreign exchange services in the normal course of business in all banking jurisdictions. The major contributors to foreign exchange revenues are Bermuda and the Cayman Islands, accounting for 84% of our foreign exchange revenue for the year ended December 31, 2023. We do not maintain a proprietary trading book. Foreign exchange commission income is generated from client-driven transactions and totaled $46.1 million during the year ended December 31, 2023.

Administration Services

We provide custody administration and settlement services to a wide range of internal and external investment clients dealing in global markets. Our custody service currently offers custody settlement and safekeeping services in 39 markets globally, including major markets and smaller, less-developed markets, with principal markets covered being the United States, Canada, Europe and Asia.

Our custody service offers safekeeping services for physical and book-entry assets. Custody for listed securities is conducted through BNYM. Hedge funds, mutual funds and exchange traded funds are held by BBH. Trading in investment transactions is settled via our global sub-custodians, BNYM and BBH. Custody services are offered from our Bermuda, Cayman and Channel Islands segments and complement core wealth management services offered by other parts of the Group, and we currently anticipate this business to grow in line with our wealth management business. Clients of our custody service include a wide range of investment funds and other investment vehicles, corporations and trusts whose related banking requirements are provided by the Bank. As such, the custody client base, in addition to delivering a fee based income, also provides cash balances and foreign exchange transaction flows.

Custody fees are earned based on the value of Assets Under Custody, which are subject to a minimum levels for smaller, less complex portfolios. In addition to these fees, custody clients are charged banking transaction fees based on account activity.

Information Technology

We devote significant resources to maintaining stable, reliable, efficient and scalable information technology systems. We work with our third-party vendors to monitor and maximize the efficiency of our use of their applications. We use integrated systems to originate and process loans and deposit accounts, which reduces processing time, improves customer experience and reduces costs. Most customer records are maintained digitally.

Currently, our information technology is operationally divided into two platforms: (i) Bermuda and Cayman and (ii) Channel Islands and the UK. In 2023, our Bermuda and Cayman operations transitioned from a single outsourced banking technology platform to a multi-cloud, industry standard configuration, spreading operating risk among several large hosting providers, continuing the Group's ongoing cloud outsourcing strategy. In our Channel Islands and UK operations, core services and applications are hosted across both Guernsey and Jersey data centers.

Protecting our systems to ensure the safety of our customers' information is critical to our business. We use multiple layers of protection to control access and reduce risk, including conducting access testing and regular vulnerability scanning on our platforms, systems and applications to reduce the risk that any attacks are successful. To protect against disasters, we have a Business Continuity Management framework and IT Disaster Recovery plans. For more information, see Item 3.D. "Risk Factors - Risks Relating to Operations, Risk Oversight and Internal Controls" and Item 16K. "Cybersecurity".

Marketing

Through our Marketing & Communications department, we engage select advertising, branding and promotional companies on an as-needed basis and provide business development and sales support for businesses in all jurisdictions. In support of our banking businesses, we broadly market our products and services through print, broadcast, web and social media advertising in the major markets in which we operate. Trust and fiduciary services are marketed primarily to intermediaries through representative attendance at and sponsorship of industry conferences and through print advertising in international trade journals.

Intellectual Property

In the highly competitive banking industry in which we operate, intellectual property is important to the success of our business. We own a variety of trademarks, service marks, trade names and logos and spend time and resources maintaining this intellectual property portfolio. We control access to our intellectual property through license agreements, confidentiality procedures, non-disclosure agreements with third parties, employment agreements and other contractual rights to protect our intellectual property. For more information, see Item 3.D. "Risk Factors - Risks Relating to Our Strategy, Brand, Portfolio and Other Aspects of Our Business".

Supervision and Regulation

Bermuda

The Bank is subject to regulation and supervision by the Bermuda Monetary Authority (the "BMA") under:

The Bank is also subject to regulation by the Minister of Finance in Bermuda under the Companies Act 1981, the Banking (Special Resolution Regime) Act 2016 and the Economic Substance Act 2018 and regulations promulgated thereunder (including applicable guidance notes published by the Registrar of Companies from time to time). It is also subject to the Deposit Insurance Act 2011 and the Deposit Insurance Rules 2016.

Supervision and Monitoring by the BMA

Our activities are regulated by the BMA and our ability to engage in certain activities is subject to prior approval by the BMA. One of the principal objectives of the BMA is to supervise, regulate and inspect financial institutions which operate in or from within Bermuda and further to promote the financial stability and soundness of such financial institutions. The supervision is primarily for the benefit and protection of the Bank's clients and not for the benefit of our investors. The BMA is also responsible for managing and regulating transactions in foreign currency or gold.

In addition to conducting on-site reviews, the BMA utilizes a comprehensive quarterly statistical return system that enables off-site monitoring of institutions licensed under the BDCA. The statistical system, which follows the standards imposed on banks in the UK by the Financial Conduct Authority and is consistent with Basel Committee Standards, provides the BMA with a detailed breakdown of the Bank's balance sheet and profit-and-loss accounts on both a consolidated and unconsolidated basis. This information enables the BMA to monitor the soundness of the Bank's financial position and ensure that it meets certain capital requirements.

As the Bank's supervisory authority in Bermuda, the BMA is responsible for the consolidated supervision of our worldwide operations. There are also host regulatory bodies performing a similar function to that of the BMA in all major locations in which the Bank operates regulated activities. Many of these local authorities require detailed reporting on the activities of the Bank's subsidiaries located in their jurisdictions. As part of its oversight process, the BMA receives copies of each of these reports on a regular basis and liaises with the regulatory authorities in the respective locations.

From time to time, in the ordinary course of business, the Bank enters into agreements with the BMA under which the Bank agrees to achieve or maintain certain levels of capital and to obtain the BMA's prior approval or letter of no objection to take certain corporate actions. Certain actions that may not be taken without prior BMA approval include: (1) creating or increasing the authorized amount of, or issuing any class of shares; and (2) entering into a material acquisition.

Under the market disclosure requirements (referred to as Pillar III disclosures) applicable under the Basel III Accord ("Basel III"), the Bank is required to publish information about the risks to which it is exposed. Effective as of January 1, 2015, the BMA adopted capital and liquidity regulatory requirements consistent with Basel III, a framework released by the BCBS. Basel III aims to raise the quality, consistency and transparency of the capital base, limit the build-up of excess leverage and increase capital requirements for the banking sector.

The Bank is subject to the following requirements:

The minimum capital ratio requirements set forth above do not reflect additional Pillar II add-on requirements that the BMA may impose upon the Group as a prudential measure from time to time. As the Group's capital requirements remain under continuous review by the BMA pursuant to its prudential supervision, the Group cannot guarantee that the BMA will not seek higher total capital ratio requirements from time to time.

Effective February 29, 2020, the Bermuda Banking Association Code of Ethical Conduct was promulgated. This is a voluntary code that the Bank subscribes to. It sets out a number of guiding principles and commitments in the Bermuda banking industry for customers. The code complements the BDCA, and the code of conduct promulgated under the BDCA, in promoting best practice and encouraging higher standards for the benefit of customers through competition and market forces.

Bermuda Monetary Authority Act 1969

Banks and Deposit Companies Act 1999

In addition, the BMA has the power to do any or all of the following:

The Bank is required to report certain transactions to the BMA. These include any transaction or transactions relating to any one person as a result of which the Bank would be exposed to a risk of incurring losses in excess of 10% of the Bank's available capital resources, or where the Bank proposes to enter into a transaction or transactions relating to any one person, which, either alone or together with previous transactions entered into by the Bank in relation to the same person, would result in the Bank being

exposed to the risk of incurring losses in excess of 25% of its available capital resources. This also applies where the transaction relates to different persons if they are connected in such a way that the financial soundness of any of them may affect the financial soundness of the others or the same factors may affect the financial soundness of both or all of them. The BMA may extend the scope of this requirement to the Bank's subsidiaries even if these subsidiaries are not licensed under the BDCA as if the transactions and available capital resources of the Bank's subsidiaries were included in the Bank's available capital resources. For the purpose of the foregoing, the transactions which must be reported by the Bank to the BMA are those between the Bank and a person where:

The risk of loss attributable to the transaction is, in a case within paragraph (a) or (b), the risk of the person concerned defaulting on the obligation therein mentioned and, in a case within paragraph (c), the risk of the person concerned defaulting on the obligations therein mentioned or of a deterioration in such person's financial soundness. The Bank's available capital resources may be determined by the BMA, after consultation with it and in accordance with principles published by the BMA, which are currently the Basel III principles described above. It is an offense for the Bank to fail to make the required reports.

Under the BDCA, any person who becomes a significant shareholder of a deposit-taking institution, which is defined to include persons, either individually or with associates (within the meaning of the BDCA), who (i) hold 5% or more of the shares in the institution or another company of which it is a subsidiary company; or (ii) are entitled to exercise, or control the exercise of 5% or more of the voting power at any general meeting of the institution or of another company of which it is such a subsidiary, must notify the BMA in writing of that fact within seven days. Failure to provide the BMA with prompt and appropriate notice would constitute an offense that could result in a fine.

The BDCA prohibits a person from becoming a shareholder controller of any company licensed under the BDCA unless the person provides written notice to the BMA of his intent to do so and the BMA does not object. The definition of shareholder controller is set out in the BDCA but generally refers to a person who, among other things, either alone or with any associate or associates (i) holds 10% or more of the shares in the licensed institution or another company of which it is a subsidiary company; (ii) is entitled to exercise, or control the exercise of 10% or more of the voting power at any general meeting of the licensed institution or another company of which it is such a subsidiary; or (iii) is able to exercise a significant influence over the management of the institution or of another company of which it is a subsidiary by virtue of holding shares in or an entitlement to exercise or control the exercise of the voting power at any general meeting of either the institution or the other company concerned. The BDCA distinguishes between shareholder controllers of the following threshold descriptions: "10% shareholder controllers," "20% shareholder controllers," "30% shareholder controllers," "40% shareholder controllers," "50% shareholder controllers," "60% shareholder controllers" and "principal shareholder controllers" who have a 75% or greater interest. A person who intends to become a shareholder controller, or a shareholder controller who intends to increase his shareholding/control, meaning generally, ownership of shares or the ability to exercise or control the exercise of voting rights attached to shares, beyond his present threshold, must provide written notice to the BMA that he intends to do so. It is an offense not to give this notice. The BMA may object to a person's notice of intent to become a shareholder controller of any description or to an existing shareholder controller seeking to increase their control where it appears to the BMA that, among other things, such person is not or is no longer a fit and proper person to be such controller. If the BMA objects, the BMA will provide such person with written notice of its objection.

Prior to serving a notice of objection, the BMA shall serve the person seeking to become a shareholder controller of any description or existing shareholder controller seeking to increase their control with a preliminary written notice stating that the BMA is considering service on that person of a notice of objection, and that notice shall state among other things, the reasons for the BMA's proposed objection. The statement of the BMA's reasons for their proposed objection will, however, be subject to the BMA's determination that such statement would not involve the disclosure of confidential information, the disclosure of which would be prejudicial to a third party. A person served with a preliminary written notice may, within a period of 28 days beginning with the day on which the notice is served, make written representations to the BMA and the BMA shall take any such representations into account in deciding whether to serve a notice of objection.

If three months pass from the date of giving notice of intent to the BMA without the BMA serving a notice of objection, then the person may become a shareholder controller as requested in the notice of intent. In practice, the BMA's procedure is generally to respond to a shareholder controller notification of intent.

If a person becomes a shareholder controller or increases their shareholding/control in spite of the BMA's objection thereto, if a shareholder controller fails to comply with the foregoing notice requirements or if a shareholder controller continues as such after being given notice of objection to his or her being a shareholder controller, the BMA may take the actions specified in the BDCA, including revoking the relevant license where a 50%, 60% or principal shareholder controller is involved, or mandating that any specified shares become subject to one or more of the following restrictions:

A court in Bermuda may, on the application of the BMA, order the sale of any such shares. Any person may appeal to a tribunal constituted under the BDCA for a review of a notice of objection given by the BMA as described above. However, this right of appeal does not apply to a person in any case in which such person has failed to give a notice or has become or continued to be a controller in contravention of the BDCA. In addition, if a person has had its license revoked or has been subject to any of the restrictions set forth above, the tribunal may confirm or reverse the decision which is the subject of the appeal but shall not have power to vary it except:

In the event that the BMA imposes any of the restrictions listed above, the restrictions may apply to:

A company licensed under the BDCA must give written notice to the BMA in the event that any person has either become or ceased to be a director, controller or senior executive of such licensed company. The written notice is required to be given to the BMA within 14 days beginning with the day on which the licensed company becomes aware of the relevant change in director, controller or senior executive. The definition of "controller" is set out in the BDCA but generally refers to a shareholder controller, a managing

director or chief executive officer of the institution or of another company of which it is a subsidiary, or a person in accordance with whose directions or instructions the directors of the institution or of another company of which the institution is a subsidiary, or persons who are shareholder controllers (or any of them) are accustomed to act.

In August 2022, the BMA published a code of conduct issued pursuant to section 8A of the BDCA. The Bank is required to comply with this code of conduct, and the BMA has indicated that the Bank’s compliance with the BDCA code of conduct will be considered when determining whether the Bank’s business is being conducted in a prudential manner as required under the BDCA’s minimum criteria for licensing. The BDCA code of conduct seeks to ensure that, amongst other things, institutions licensed under the BDCA deal with their customers fairly and equitably. To this end, the BDCA code of conduct sets out principles the Bank is expected to observe in several key areas including compliance with laws, integrity and ethics, conflicts of interests, handling of customer information, internal management controls, publication and disclosure of license and cooperation with regulatory authorities.

Trusts (Regulation of Trust Business) Act 2001

The principal purpose of the Trusts (Regulation of Trust Business) Act 2001 (the "Trusts Business Act"), is to regulate "trust business," which is generally defined as providing the services of a trustee as a business, trade, profession or vocation. Under the Trusts Business Act, a license is required to conduct trust business in or from within Bermuda. Licenses are designated as either "unlimited" or "limited." Only bodies corporate are entitled to obtain unlimited licenses, which allow them to conduct trust business and solicit business from the public generally. Holding a license under the Trusts Business Act obliges the licensed undertaking to maintain a physical presence in Bermuda at which the licensed undertaking is directed and managed. A licensed undertaking is also required to hold all client funds separately from its own funds or funds held in respect of any other business and maintain such books of account and other records such that client funds may be readily identified at any time.

At present, the Bank and certain of its subsidiaries hold unlimited licenses issued by the BMA pursuant to the Trusts Business Act. Pursuant to Section 6 of the Trusts Business Act, the BMA has published a Statement of Principles, in accordance with which it is acting or purporting to act with respect to the exercise of its powers under the Trusts Business Act, including (without limitation) the BMA's minimum licensing criteria, the grounds for revocation of licenses, the power to grant, revoke or restrict a license and the power to obtain information or require the production of documents. As at December 31, 2019, the BMA amended the minimum licensing criteria under the Trusts Business Act, such that a licensed undertaking is not regarded as conducting its business in a prudent manner (which is a requirement for licensing) unless it maintains or will maintain adequate liquidity, having regard to the relationship between its assets and its actual and contingent liabilities, to the time at which those liabilities will or may fall due and its assets mature, and to other factors appearing to the BMA to be relevant. In addition, pursuant to Section 7 of the legislation, the BMA published a Code of Practice that provides guidance as to the duties, requirements, procedures, standards and principles to be observed by persons carrying on trust business under the Trusts Business Act.

The BMA's powers under the Trusts Business Act include (without limitation) the power to:

The Trusts Business Act prohibits a person from becoming a 10% shareholder controller or a majority shareholder controller of a licensed undertaking, unless such person provides written notice to the BMA of his intent to do so and the BMA does not object. It is an offense not to provide this notice. The definition of shareholder controller is set out in the Trusts Business Act, but generally refers to a person who, among other things, either alone or with any associate or associates (within the meaning of the Trusts Business Act): (i) holds 10% or more of the shares in the licensed undertaking or another company of which it is a subsidiary company; or (ii) is entitled to exercise, or control the exercise of 10% or more of the voting power at any general meeting of the licensed undertaking or another company of which it is such a subsidiary or (iii) is able to exercise a significant influence over the management of a licensed undertaking or of another company of which the licensed undertaking is a subsidiary by virtue of holding shares in or an entitlement to exercise or control the exercise of the voting power at any general meeting of either the licensed undertaking or the other company concerned. A "majority shareholder controller" is defined under the Trusts Business Act as a shareholder controller which, among other things, (i) holds 50% or more of the shares in the licensed undertaking or another company of which it is a subsidiary company; or (ii) is entitled to exercise, or control the exercise of 50% or more of the voting power at any general meeting of the licensed undertaking or another company of which it is such a subsidiary.

The BMA may object to a person's notice of intent to become a 10% shareholder controller or majority shareholder controller or may object to an existing shareholder controller of any description where it appears to the BMA that, among other things, such person is not or is no longer a fit and proper person to be such a controller of the licensed undertaking. If the BMA objects, the BMA will provide such person with a written notice of objection. Prior to serving any such notice of objection, the BMA shall serve the person seeking to become a shareholder controller or the existing shareholder controller with a preliminary written notice stating that the BMA is considering service on that person of a notice of objection, stating, among other things, the reasons for the BMA's proposed objection. The statement of the BMA's reasons for its proposed objection will, however, be subject to the BMA's determination that such statement would not involve the disclosure of confidential information, the disclosure of which would be prejudicial to a third party. A person served with a preliminary written notice may, within a period of 28 days beginning with the day on which the notice is served, make written representations to the BMA and the BMA shall take any such representations into account in deciding whether to serve a notice of objection.

If three months pass from the date of notifying the BMA of a new shareholder controller or an increased shareholding/control beyond a shareholder controller's then current threshold, without the BMA serving a notice of objection, then the person may become a shareholder controller as requested in the notice. In practice, the BMA's procedure is generally to respond to a person's shareholder controller notification.

If a person becomes a shareholder controller or increases their shareholding control, in spite of the BMA's objection thereto, if a shareholder controller fails to comply with the foregoing notice requirements or if a shareholder controller continues as such after being given notice of objection to his being a shareholder controller, the BMA may take certain actions, including revoking the relevant license where a shareholder controller holding 50% or more of the shares of the licensed undertaking is involved or mandating that any specified shares become subject to one or more of the following restrictions:

A court in Bermuda may, on the application of the BMA, order the sale of any such shares. Any person may appeal to a tribunal constituted under the Trusts Business Act for a review of a notice of objection given by the BMA as described above. However, this right of appeal does not apply to a person in any case in which such person has failed to give a notice or has become or continued to be a controller in contravention of the Trusts Business Act. In addition, if a person has had their license revoked or has been subject to any of the restrictions set forth above, the tribunal may confirm or reverse the decision which is the subject of the appeal but shall not have power to vary it except:

An undertaking licensed under the Trusts Business Act must give written notice to the BMA in the event that any person has either become or ceased to be a controller or officer of such licensed undertaking. The written notice is required to be given to the BMA within 14 days beginning with the day on which the licensed undertaking becomes aware of the change in controller or officer. The definition of "controller" is set out in the Trusts Business Act but generally refers to a shareholder controller, a managing director or chief executive officer of the undertaking or of another company of which it is a subsidiary, or a person in accordance with whose directions or instructions the directors of the undertaking or of another company of which the undertaking is a subsidiary, or persons who are shareholder controllers (or any of them) are accustomed to act. The definition of "officer" under the Trusts Business Act includes a director, secretary or any senior executive.

Investment Business Act 2003

The Investment Business Act 2003 (the "Investment Business Act") prohibits any person from carrying on, or purporting to carry on, an investment business in or from within Bermuda unless that person holds a license granted under the Investment Business Act, or is registered as a Class A registered person or a Class B registered person under the Investment Business Act (or is otherwise designated as non-registrable). A person is deemed to carry on investment business in or from Bermuda if it is incorporated or formed in Bermuda and carries on investment business, or is incorporated or formed outside of Bermuda and carries on investment business in or from Bermuda. The Investment Business Act defines "investment business" broadly as the business of dealing in investments, arranging deals in investments, managing or offering investments and giving advice on investments.

Under the Investment Business Act, the BMA is given the authority to grant licenses and to supervise license holders (which includes issuing codes of conduct or practice and making rules prescribing prudential and technical standards). The BMA will only grant a license if it is satisfied that the applicant complies with licensing criteria set out in the Investment Business Act, which include (without limitation) that controllers and senior executives of the applicant are fit and proper persons to carry on such business, the applicant company's business is effectively directed by at least two individuals (unless the BMA otherwise approves), the Board of the applicant has a number of non-executive directors considered appropriate by the BMA, the applicant's business is conducted in a prudent manner, the applicant maintains its principal place of business in Bermuda, the position of the applicant in the group does not obstruct effective consolidated supervision and the applicant will carry on the investment business with integrity and professional skill appropriate to the nature and scale of its activities.

At the present time, the Bank and its wholly owned subsidiaries Butterfield Trust (Bermuda) Limited, Butterfield Securities (Bermuda) Limited and Butterfield Asset Management Limited hold licenses under the Investment Business Act.

Under the Investment Business Act, the BMA may require an accountant's or auditor’s report on a license holder or the appointment of an inspector to carry out an investigation into the affairs of a license holder and/or demand the production of documents or information relating to the investment business of a license holder. The Investment Business Act also grants the BMA broad powers to enforce the provisions of the Investment Business Act, including (without limitation) powers to issue directions, to vary, restrict or cancel a license, to appoint a person to manage and administer an offending investment business, to give directions desirable to safeguard the interests of the investment provider’s clients, to levy fines and to seek from the court injunctions and restitution orders.

The Investment Business Act prohibits a person from becoming a 10% shareholder controller or a majority shareholder controller of an investment provider, unless such person provides written notice to the BMA of his intent to do so and the BMA does not object. It is an offense not to provide this notice. The definition of 10% shareholder controller is set out in the Investment Business Act, but generally refers to a person who, among other things, either alone or with any associate or associates (within the meaning of the Investment Business Act): (i) holds 10% or more of the shares in the investment provider or its parent undertaking; (ii) is entitled to exercise, or control the exercise of 10% or more of the voting power in the investment provider or in the parent undertaking; or (iii) is able to exercise a significant influence over the management of the investment provider or its parent undertaking by virtue of the voting power in the investment provider or its parent undertaking. A "majority shareholder controller" is defined under the Investment Business Act as a shareholder controller which (i) holds 50% or more of the issued and outstanding shares in the investment provider or its parent undertaking; or (ii) is entitled to exercise, or control the exercise of 50% or more of the voting power in the investment provider or in the parent undertaking.

The BMA may object to a person's notice of intent to become a 10% shareholder controller or majority shareholder controller or to an existing shareholder controller of any description where it appears to the BMA that, among other things, such person is not or is no longer a fit and proper person to be such controller of the licensed company. If the BMA objects, the BMA will provide such person with a written notice of objection. Prior to serving any such notice of objection, the BMA serves the person seeking to become a shareholder controller or will serve an existing shareholder controller with a preliminary written notice stating that the BMA is considering service on that person of a notice of objection, stating, among other things, the reasons for the BMA's proposed objection. The statement of the BMA's reasons for their proposed objection will, however, be subject to the BMA's determination that such statement would involve the disclosure of confidential information, the disclosure of which would be prejudicial to a third party. A person served with a preliminary written notice may, within a period of 28 days beginning with the day on which the notice is served, make written representations to the BMA and the BMA shall take any such representations into account in deciding whether to serve a notice of objection.

If ninety days pass from the date of notifying the BMA of a new shareholder controller or an increased shareholding/control beyond a shareholder controller's then current threshold, without the BMA serving a notice of objection, then the person may become a shareholder controller as requested in the notice. In practice, the BMA's procedure is generally to respond to a person's shareholder controller notification.

If a person becomes a shareholder controller or increases their shareholding/control in spite of the BMA's objection to his becoming a shareholder controller, or if a shareholder controller fails to comply with the foregoing notice requirements, or if a shareholder controller continues as such after being given notice of objection to his being a shareholder controller, the BMA may take certain actions, including revoking the relevant license where a shareholder controller holding 50% or more of the shares of the licensed company is involved or mandating that any specified shares become subject to one or more of the following restrictions:

A court in Bermuda may, on the application of the BMA, order the sale of any such shares. Any person may appeal to a tribunal constituted under the Investment Business Act for a review of a notice of objection given by the BMA as described above. However, this right of appeal does not apply to a person in any case in which such person has failed to give a notice or has become or continued to be a controller in contravention of the Investment Business Act. In addition, if a person has had its license revoked or has been subject to any of the restrictions set forth above, the tribunal may confirm or reverse the decision which is the subject of the appeal but shall not have power to vary it except:

In the event that the BMA imposes any of the restrictions listed above, the restrictions may apply to:

A company licensed under the Investment Business Act must give written notice to the BMA in the event that any person has either become or ceased to be a controller or officer of such investment provider. The written notice is required to be given to the BMA within 14 days beginning with the day on which the investment provider becomes aware of the change in controller or officer. The definition of "controller" is set out in the Investment Business Act but generally refers to a shareholder controller, a managing director or chief executive officer of the investment provider or of another company of which it is a subsidiary, or a person in accordance with whose directions or instructions the directors of the investment provider or of its parent undertaking or persons who are shareholder controllers (or any of them) are accustomed to act. The definition of "officer" under the Investment Business Act includes a director, secretary or any senior executive.

Corporate Service Provider Business Act 2012

The CSPB regulates persons carrying on a corporate service provider business in Bermuda. “Corporate service provider business” in this context means the provision of any of the following services for a profit: (a) acting as a company formation agent or agent for establishment of a partnership; (b) providing nominee services, including (among other things) providing nominee shareholders; (c) providing administrative and secretarial services to companies or partnerships (including, among other things, providing a registered office and maintaining the books and records of a company or partnership); (d) performing functions in the capacity as a resident representative under various Bermuda statutes; and (e) providing any other corporate or administrative services as may be specified in regulations made under the CSPB. Under the CSPB, the Bank or any of its subsidiaries is required to hold a corporate service provider license to lawfully provide corporate services to our customers in Bermuda. Licensing under the CSPB is administered by the BMA. Holding a license under the CSPB obliges the licensed undertaking to maintain a physical presence in Bermuda at which the licensed undertaking is directed and managed. A licensed undertaking is also required to hold all client funds separately from its own funds or funds held in respect of any other business and maintain such books of account and other records such that client funds may be readily identified at any time.

Pursuant to the provisions of the CSPB any person who, together with their associates (within the meaning of the CSPB), intends to become either a shareholder controller or a majority shareholder controller of a CSPB licensed entity, must first serve notice of their intent to do so on the BMA and either receive a notice of non-objection from the BMA, or wait for the expiration of a three month period starting from the date of the notice to the BMA without the BMA having served a written notice of objection. A “shareholder controller” under the CSPB is any person who, either alone or with any associate or associates, (i) holds 10% or more of shares of the licensed entity (if it is a company) or 10% or more of another company of which the licensed entity is a subsidiary; (ii) is entitled to control or control the exercise of 10% or more of the voting power at any general meeting of the licensed entity (if it is a company) or of another company of which the licensed entity is a subsidiary; or (iii) is able to exercise a significant influence over the management of a licensed entity or of another company of which the licensed entity is a subsidiary by virtue of holding shares in or an entitlement to exercise or control the exercise of the voting power at any general meeting of either the licensed entity (if it is a company) or its holding company. A “majority shareholder controller” under the CSPB has the same meaning as limbs (i) and (ii) in the preceding sentence, save that the relevant percentage threshold for ownership is 50% or more.

In addition to the requirement to notify and obtain BMA non-objection (whether express or deemed) of any change in shareholder controller or majority shareholder controller of a CSPB licensed entity, if at any time it appears to the BMA that a person who is a “controller” of any description of a CSPB licensed entity is not a fit and proper person for such role, the BMA may serve a written notice of objection to that controller; provided that, before serving such a notice, the BMA must serve that person with a preliminary written notice stating that the BMA is considering service on that person of a notice of objection, specifying the reasons for which it appears to the BMA why that person is not or is no longer a fit and proper person and advising as to the rights of that person to make written representations to the BMA within 28 days beginning on the day on which such notice is served, and that such written representations shall be taken into account by the BMA in deciding whether to serve a notice of objection. For these purposes a “controller” includes (i) a managing director of a licensed entity or the licensed entity’s holding company; (ii) the CEO of the licensed entity or the licensed entity’s holding company; and (iii) a person in accordance with whose directions or instruction the directors of the licensed entity (or its holding company) are accustomed to act. Upon determining that any individual is not a fit and proper person, the BMA may pass a prohibition order, thereby preventing that individual from exercising any functions in connection with any business requiring licensing under the CSPB. Furthermore, under the CSPB, a licensed entity is required to give written notice to the BMA of any person becoming or ceasing to be a controller or an “officer” (director, company secretary or senior executive) of the licensed entity.

Breaches of the CSPB are punishable by a range of criminal and civil penalties including fines, imprisonment and public censure; breaches can result in the licensed entity losing its license and therefore its ability to conduct corporate service provider business. The BMA is also empowered to restrict a controller’s ability to sell any shares (and exercise any rights in respect of such shares) held by the controller in a CSPB licensed entity if they continue to be or become a controller following a notice of objection from the BMA.

Companies Act 1981

As a local company incorporated in Bermuda, the Bank is subject to the Companies Act 1981 (the "Companies Act"). Under section 114 of the Companies Act, no local company may carry on business of any sort in Bermuda unless, among other things, (i) it complies with the control and ownership requirements set out in Part I of the Third Schedule of the Companies Act; (ii) it is licensed under section 114B of the Companies Act and is carrying on such business in accordance with the terms and conditions imposed in such license; or (iii) its shares are listed on a designated stock exchange and the company is engaged as a business in a material way in a prescribed industry pursuant to section 114(1)(e) of the Companies Act.

In December 2000, the Minister of Finance issued to the Bank a license pursuant to section 114B of the Companies Act allowing the Bank to carry on business in Bermuda without complying with certain provisions of the Third Schedule to the Companies Act. Effective June 10, 2016, the Bank relinquished its section 114B license and carries on business in Bermuda without complying with the provisions of the Third Schedule in reliance upon the exemption in section 114(1)(e) of the Companies Act. The Bank qualifies for this statutory exemption by virtue of (i) the listing of the Bank's shares on the BSX, which is a "designated stock exchange" for the purposes of the Companies Act and (ii) the Bank's material business of banking, which is a "prescribed industry" for the purposes of the Companies Act.

Exchange Control

The Bank is designated as resident in Bermuda for exchange control purposes.

The BMA has given its consent for the issue and free transferability of all of the common shares to and between non-residents of Bermuda for exchange control purposes, provided the Bank's shares remain listed on an appointed stock exchange, which includes the NYSE. Approvals or permissions given by the BMA do not constitute a guarantee by the BMA as to our performance or our creditworthiness. Accordingly, in giving such consent or permissions, the BMA shall not be liable for the financial soundness, performance or default of our business or for the correctness of any opinions or statements expressed in this report.

Financial Crime Regulation

    Bermuda has enacted a number of laws relating to combating money laundering and terrorist financing. These laws include the Proceeds of Crime Act 1997, the Anti-Terrorism (Financial and Other Measures) Act 2004, the Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Supervision and Enforcement) Act 2008 and the Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations 2008, the Financial Intelligence Agency Act 2007, and the Anti-Terrorism (Financial and Other Measures) (Businesses in Regulated Sector) Order 2008 each as amended from time to time.

Stamp Duty

Generally, if a stampable document has been executed in Bermuda or has been executed outside of Bermuda and then brought into Bermuda and stamp duty is not paid, the document is not valid for any purpose (including registration) in Bermuda, until such time as it is stamped. In addition, a stampable document which is not stamped (i) is not admissible in court proceedings in Bermuda, except in criminal proceedings or stamp duty violation prosecutions; and (ii) may not be acted upon, filed, or registered by any public official or by any company. For any instrument which is liable to stamp duty that is not duly stamped, every person who is specified in the Stamp Duties Act as liable for stamping commits an offense.

Limits on Shareholding

In addition, there are certain prior approval requirements pursuant to the BDCA, the Trusts Business Act, the CSPB and the Investment Business Act with respect to any person who seeks to become a "shareholder controller" (as defined in each of those Acts) of the Bank.

Deposit Insurance Scheme

Pursuant to the Deposit Insurance Act 2011 and the Deposit Insurance Rules 2016 of Bermuda, a DIS has come into effect in Bermuda. The DIS is administered by the Bermuda Deposit Insurance Corporation. The DIS is designed to protect the deposits of individuals, charities, unincorporated associations, partnerships, sole proprietors and small businesses by guaranteeing up to $25,000 of their aggregate Bermuda Dollar deposits in the event of a Bermuda deposit taking institution’s failure. The DIS is backed by a Deposit Insurance Fund which is in turn funded from premium contributions that are payable by all banks and credit unions licensed by the BMA . As a bank licensed by the BMA, we are required to be a member of the DIS and pay contributions to the Deposit Insurance Fund. Currently, our premium contribution is calculated by the Bermuda Deposit Insurance Corporation as 0.25% per annum of the average total amount of our Bermuda Dollar deposits that are covered by the DIS guarantee over a rolling three-month period based on information disclosed by us to the Bermuda Deposit Insurance Corporation. Each contribution to the Deposit Insurance Fund is payable every three months in arrears.

Personal Information Protection Act 2016

Bermuda’s principal data protection legislation is the PIPA. PIPA applies to every organization (which includes any individual, entity or public authority) that uses personal information in Bermuda where that personal information is used by automated or other means which form, or are intended to form, part of a structured filing system. For the purposes of PIPA, “personal information” means any information about an identified or identifiable individual (meaning a natural person), and “use” or “using” are very broadly defined and effectively include possessing or carrying out any operation on personal information. The Bank uses and holds individuals’ personal information in Bermuda, so must comply with the provisions of PIPA.

The majority of the operative provisions of PIPA, which include certain personal information privacy rights for individuals and specific obligations on organizations that control the processing of personal information, are not yet in force in Bermuda. The first Bermuda Privacy Commissioner was appointed with effect from January 20, 2020, and all remaining provisions for PIPA are expected to become effective on January 1, 2025.

The Cayman Islands

The Cayman Islands Monetary Authority

Our activities in the Cayman Islands are regulated by CIMA. CIMA is responsible for currency management, regulation and supervision of the Cayman Islands financial services sector (which includes securities and investments business, banking, insurance and fiduciary services), advice to the Cayman Islands government and cooperation with overseas regulatory authorities. CIMA's principal focus is to promote and maintain a sound financial system in the Cayman Islands and to promote and enhance market confidence, consumer protection and the reputation of the Cayman Islands as a financial center.

CIMA has broad statutory powers of enforcement. These powers are intended to permit CIMA to have access to information held or maintained by a licensee as necessary and to enable CIMA to take appropriate remedial action, including imposition of administrative fines, if a licensee is in default of its obligations under applicable laws.

Relevant Legislation/Regulations

The BATCA provides that it is an offense to conduct banking business or trust business without the appropriate license. Butterfield Bank (Cayman) Limited holds a category "A" banking license and a trust license, both issued by CIMA.

The BATCA is supplemented by certain regulations which, among other things, prescribe the fees that are payable by licensees and certain information that must be submitted to CIMA in connection with any license application.

Licensees must adhere to certain capital adequacy requirements and must file audited financial statements with CIMA within three months of their financial year-end. Prior written approval of CIMA is required in a number of circumstances including, but are not limited to, the issue, transfer or disposal of any shares, the appointment of a new director or senior officer or where the licensee wishes to conduct business that deviates from its business plan submitted at the time of its license application.

The SIBA (as amended) provides that a person shall not carry on, or purport to carry on, securities investment business in or from the Cayman Islands unless that person is for the time being licensed under SIBA or is exempted from the requirement to hold a license pursuant to SIBA. Butterfield Bank (Cayman) Limited holds a securities investment business license, issued by CIMA, to conduct its business.

SIBA is essentially designed to achieve the licensing and regulation of securities investment providers and applies to (i) any company, foreign company or partnership incorporated or registered in the Cayman Islands and carrying on "securities investment business" anywhere in the world, or (ii) any entity which has a "place of business" in the Cayman Islands through which "securities investment business" is carried on. The entity need not have a physical presence in the Cayman Islands in order for such entity to fall within the ambit of SIBA.

Certain categories of persons conducting activities that would otherwise fall within the definition of securities investment business are categorized as non-registrable persons under SIBA. Such persons include single family offices who do not advise third parties and managers of non-Cayman limited liability companies who carry on securities investment business only in that capacity. In addition, SIBA requires certain persons who are engaged in securities investment business with, among other things, sophisticated or high net worth persons (as such terms are defined in SIBA) to register as a registered person under SIBA. Upon such registration, a registered person is subject to CIMA regulation, however a number of requirements applicable to SIBA licensees do not apply to SIBA registered persons. For example, a SIBA registered person is not required to submit annual audited financial statements or business plans to CIMA.

CIMA regulates the insurance industry in the Cayman Islands pursuant to the IA (as amended). Such regulation includes licensing, ongoing supervision, and enforcement.

Pursuant to the IA, a company is required to hold a license in order to carry on insurance or reinsurance business or business as an insurance agent, insurance broker or insurance manager in or from the Cayman Islands. Butterfield Bank (Cayman) Limited (which is not itself an insurer) holds an insurance agent license, issued by CIMA, permitting it to solicit domestic business on behalf of not more than one general insurer and one long term insurer.

Butterfield Bank (Cayman) Limited is an ordinary resident company incorporated in the Cayman Islands, meaning that, subject to it being licensed under the BATCA, it can carry on business within the Cayman Islands. Butterfield Bank (Cayman) Limited is required to comply with the requirements of the Companies Act (2023 Revision), this being the principal statute governing the incorporation and ongoing operations of the Cayman Islands companies.

Anti-Money Laundering Regulations (2023 Revision); Proceeds of Crime Act (2020 Revision); and Terrorism Act (2018 Revision), the latter two as amended.

Butterfield Bank (Cayman) Limited is subject to the Anti-Money Laundering Regulations (2023 Revision) (the "Regulations") made pursuant to the PCL (as amended). The Regulations apply to anyone conducting "relevant financial business" in or from the Cayman Islands intending to form a business relationship or carry out a one-off transaction. The Regulations require a financial service provider to maintain certain anti-money laundering procedures including those for the purposes of verifying the identity and source of funds of an "applicant for business" except in certain circumstances, including where an entity is regulated by a recognized overseas regulatory authority and/or listed on a recognized stock exchange in an approved jurisdiction. In addition, if any person resident in the Cayman Islands knows or suspects, or has reasonable grounds for knowing or suspecting that another person is engaged in criminal conduct, or is involved with terrorism or terrorist property, and the information for that knowledge or suspicion came to their attention in the course of business in the regulated sector, or other trade, profession, business or employment, the person will be required to report such knowledge or suspicion to (i) the FRA, pursuant to the PCL, if the disclosure relates to criminal conduct or money laundering; or (ii) a police officer of the rank of constable or higher, or the FRA, pursuant to the Terrorism Act (2018 Revision) as amended, if the disclosure relates to involvement with terrorism or terrorist financing and property.

The Cayman Islands Data Protection Act, (2021 Revision)

The DPA (2021 Revision) came into force on September 30, 2019 and establishes a framework of rights and duties designed to safeguard individuals’ personal data, balanced against the need of public authorities, businesses and organizations to collect and use personal data for legitimate purposes. The DPA was developed in line with international best practices while ensuring that it reflects the specific needs of the Cayman Islands. It is based substantially on the Data Protection Act, 1998 of the United Kingdom. The DPA defines “personal data” very widely to include any data which enables a living individual to be identified.

In common with most businesses, Butterfield Bank (Cayman) Limited records information in respect of individuals, particularly those who are employees, clients or suppliers, and the obligations under the DPA require a detailed review or establishment of policies and procedures in order to achieve compliance. Non-compliance with the DPA may have serious ramifications.

The DPA is centered on eight data protection principles under which personal data must:

Under the DPA, individuals have the right to be informed how personal data is processed and Butterfield Bank (Cayman) Limited is required to provide individuals with a privacy notice in this regard. Individuals also have the right (i) to request access to their personal data, (ii) to request rectification or correction of personal data, (iii) to request that processing of personal data be stopped or restricted and (iv) to require Butterfield Bank (Cayman) Limited to cease processing personal data for direct marketing purposes.

Individuals who believe that their personal data has been handled incorrectly or are not satisfied with responses from Butterfield Bank (Cayman) Limited to any requests made regarding the use of their personal data have a right under the DPA to complain to the Cayman Islands’ Ombudsman.

The Bahamas

The Central Bank of The Bahamas

Butterfield Trust (Bahamas) Limited has been granted a license from the Central Bank of The Bahamas to conduct trust business from within The Bahamas. As the primary regulator of Butterfield Trust (Bahamas) Limited, the Central Bank of The Bahamas is responsible for the regulation and supervision of Butterfield Trust (Bahamas) Limited with respect to all of its operations, corporate governance issues, and compliance with applicable laws and regulations. The Central Bank of The Bahamas' regulations on capital adequacy and the regulatory framework within The Bahamas take into account the recommendations of the BCBS.

Relevant Legislation/Regulations

The Banks and Trust Companies Regulation Act and Regulations set forth the basic provisions relating to the licensing and operations of banks and trust companies in The Bahamas, as well as the powers of the Central Bank of The Bahamas to supervise and audit the activities of such entities. As it relates to the preservation of confidentiality, the Banks and Trust Companies Regulation Act makes it an offense for certain individuals to disclose without customer consent, inter alia, the identity, assets, liabilities, transactions or accounts of a customer of a licensee, save for in specified circumstances.

The Central Bank of The Bahamas Act provides general provisions relating to the structure and operation of the Central Bank of The Bahamas, the regulatory reporting required to be submitted to the Central Bank of The Bahamas by the licensees and the penalties that may be imposed for failure to comply with the orders of the Central Bank of The Bahamas. From time to time, the Central Bank issues regulations, guidelines and policies which are available on its website.

Financial Intelligence and Reporting

The Financial Intelligence Unit Act provides for the establishment of the financial intelligence unit organization in The Bahamas that is responsible for receiving, analyzing, obtaining and disseminating information which relates to or may relate to the proceeds of offenses under the Proceeds of Crime Act or the Anti-Terrorism Act.

The Financial Transactions Reporting (Amended) Act and Regulations provides the basic requirements applicable to financial institutions in The Bahamas with respect to verifying the identities of facility holders and bank customers, the obligation to report suspicious transactions to the financial intelligence unit, and minimum record retention policies and procedures.

Data Protection (Privacy of Personal Information) Act

This Data Protection (Privacy of Personal Information) Act makes provision for the protection of the privacy of the personal data of individuals and the regulation of its collection, processing, keeping, use and disclosure.

Other Relevant Legislation

Butterfield Trust (Bahamas) Limited is also subject to various other acts and regulations, including the Proceeds of Crime Act, which sets forth that it is a crime in The Bahamas for a person to conceal, transfer or deal with the proceeds of criminal conduct (such as money laundering) and the Anti-Terrorism Act, which sets forth that it is a crime in The Bahamas for a person to provide or collect funds or provide financial services or make such services available to persons with the intention that such funds or services are to be used in full or in part to carry out a terrorist act. In addition to the laws and regulations set forth above, Butterfield Trust (Bahamas) Limited is also obligated to comply with the guidelines released by the Central Bank of The Bahamas from time to time.

Guernsey

Guernsey Financial Services Commission

Our activities in Guernsey are monitored by the GFSC through its Probability Risk and Impact System. The primary objective of the GFSC is to regulate and supervise finance businesses in the Bailiwick of Guernsey ("Guernsey," or the "Bailiwick"). Almost all financial service activities in Guernsey are required to be licensed by the GFSC. Once licensed, the businesses are subject to the regulation, oversight, investigatory, information gathering and enforcement powers of the GFSC.

The various divisions of the GFSC perform regular visits with the purpose of understanding the business and reviewing the risk management and internal control environment (including monitoring and any outsourced functions). Such visits also monitor compliance with applicable law and regulation.

In addition to conducting on-site reviews, the GFSC has a continuing duty to determine whether entities it regulates and the persons who own or run them remain fit and proper. Licensees therefore have a statutory obligation to notify the GFSC of various changes, which are set out in comprehensive rules and regulations. The GFSC also requires financial services businesses to submit periodic returns for statistical analysis and inclusion in thematic studies.

The GFSC has wide powers of enforcement to address shortcomings and breaches by financial services businesses. These range from private warnings and reprimands to revocation and suspension of applicable licenses and consents, fines and referral for criminal prosecution, among others.

The Banking Supervision (Bailiwick of Guernsey) Law, 2020

The BSL provides that no person in the Bailiwick shall accept a deposit in the course of carrying on, whether in Guernsey or elsewhere, a deposit-taking business except under the authority of and in accordance with the conditions of a license granted by the GFSC. Butterfield Bank (Guernsey) Limited holds a license under the BSL. In order to be granted a license, a company's business must be carried on with prudence, integrity, professional skills and in a manner which will not tend to bring the Bailiwick into disrepute. The business must also be directed by at least two individuals who are resident in the Bailiwick of Guernsey with appropriate standing and experience and sufficiently independent of each other. Businesses must also adhere to codes, principles, rules and instructions issued from time to time.

Regulation of Fiduciaries, Administration Businesses and Company Directors, etc. (Bailiwick of Guernsey) Law 2020

The Regulation of Fiduciaries, Administration Businesses and Company Directors, etc. (Bailiwick of Guernsey) Law 2020 (the "Guernsey Fiduciaries Law") provides that only a person licensed by the GFSC under the Guernsey Fiduciaries Law can operate fiduciary businesses, which includes:

The GFSC can grant three different categories of license, including a primary or secondary fiduciary license, which can only be granted to a company or a partnership, and a personal fiduciary license. The primary fiduciary license covers any director, manager, partner or employee acting in the course of their employment.

The Protection of Investors (Bailiwick of Guernsey) Law, 2020

Under the POI (Bailiwick of Guernsey) Law, 2020 (the "POI Law"), a person shall not (subject to certain exemptions) carry on, or hold himself out as carrying on, any controlled investment business in or from within the Bailiwick, except under and in accordance with the terms of a license. For the purposes of the POI Law, a controlled investment includes collective investment schemes and general securities and derivatives. All Guernsey domiciled funds have to be authorized by or registered with the GFSC and be administered by a Guernsey licensed administrator. In addition, open-ended funds must also have a Guernsey-licensed custodian.

The Financial Services Commission (Bailiwick of Guernsey) Law, 1987

The Financial Services Commission (Bailiwick of Guernsey) Law, 1987 provides that the general functions of the GFSC are to supervise the finance business in the Bailiwick, to counter financial crime and the financing of terrorism and to maintain confidence in the Bailiwick's reputation as an international finance center.

The Criminal Justice (Proceeds of Crime) (Bailiwick of Guernsey) Law, 1999

The Criminal Justice (Proceeds of Crime) (Bailiwick of Guernsey) Law, 1999 established certain offenses in connection with the proceeds of criminal conduct including concealing or transferring the proceeds of crime, assisting another person to retain the proceeds of criminal conduct, acquisition, possession or use of proceeds of criminal conduct and tipping-off.

The Terrorism and Crime (Bailiwick of Guernsey) Regulations, 2007

The Terrorism and Crime (Bailiwick of Guernsey) Regulations, 2007 provides for a positive obligation on businesses to report internally any suspicions of money laundering. A money laundering reporting officer must be appointed to fulfil this function and to make disclosure to the relevant division of Guernsey's police unit.

Guernsey Banking Deposit Compensation Scheme (Bailiwick of Guernsey) Ordinance, 2008

Pursuant to the Banking Deposit Compensation Scheme (Bailiwick of Guernsey) Ordinance, 2008, a Guernsey DCS is in effect in Guernsey. The Guernsey DCS provides compensation of up to £50,000 per qualifying deposit in the event of the failure of a Guernsey-licensed bank. The maximum total amount of compensation is capped at £100 million in any 5 year period. If claims exceed this cap, compensation will be reduced pro rata. The cap also means that compensation in respect of any one bank cannot exceed £100 million. The Guernsey DCS is paid for by Guernsey banks through an annual administration levy and, in the event of a bank failure, a compensation levy.

Data Protection (Bailiwick of Guernsey) Law, 2017

The DPL 2017 came into force on May 25, 2018 to coincide with the enforcement of the EU's General Data Protection Regulation (EU) 2016/679. The DPL 2017 updated Guernsey's data protection framework to ensure that Guernsey retained its data protection "adequacy" status with the European Commission.

The DPL 2017 applies to the processing of personal data and provides rights to data subjects (i.e., individuals) and places obligations on data controllers and processors of personal data including, among other matters, in relation to subject access requests, transfers of personal data and notification of data breaches.

The Office of the Data Protection Authority is the independent regulatory authority responsible for the regulatory functions under the DPL 2017, including the ability to levy fines.

Lending, Credit and Finance (Bailiwick of Guernsey) Law, 2022

Jersey

and anti-money laundering/countering of terrorist financing/countering of proliferation financing, including by means of laws and codes of practice; on-site examinations and meetings; off-site supervision including the analysis of financial information; and international dialogue and liaison with other regulators involved in the supervision of the broader group.

Financial Services Commission (Jersey) Law 1998

Banking Business (Jersey) Law 1991

Financial Services (Jersey) Law 1998

Collective Investment Funds (Jersey) Law 1988

Bank (Recovery and Resolution) (Jersey) Law 2017

Proceeds of Crime (Jersey) Law 1999 and Terrorism (Jersey) Law 2002

Depositors Compensation Scheme, 2009

Pursuant to the Banking Business (Depositors Compensation) (Jersey) Regulations 2009, the Jersey Bank DCS ("Jersey DCS") is in effect in Jersey. The law covers all "eligible deposits" and, in the event of the failure of a Jersey bank, provides protection of up to £50,000 for deposits placed in Jersey per person, per banking group, for local and international depositors. The maximum liability of the Jersey DCS is capped at £100 million in any 5 year period.

Data Protection (Jersey) Law, 2018 / Data Protection Authority (Jersey) Law, 2018

The DPJL, and its companion statute the DPAJL, came into force on May 25, 2018 to coincide with implementation of the GDPR. The DPJL updated Jersey's data protection framework expressly to mirror the GDPR and ensure that Jersey retained its data protection "adequacy" status with the European Commission.

In outline, the DPJL governs the processing of personal data in Jersey or in relation to Jersey residents; it provides rights to data subjects (i.e. individuals) and places obligations on data controllers and processors of personal data including, among other matters, in relation to subject access requests, transfers of personal data and notification of data breaches. The DPAJL requires any organization which is "established" in Jersey to be registered with the JOIC and to pay an annual charge.

The JOIC is the independent authority responsible for the regulatory and enforcement functions of the DPJL and DPAJL, including the ability to levy fines.

United Kingdom

Regulatory Regime

Butterfield Mortgages Limited provides UK residential property lending services.

The primary legislation governing the provision of Butterfield Mortgages Limited's services is the FSMA and its secondary regulations. FSMA requires that in order to carry on mortgage and investment services in the UK, a firm must be authorized (or exempt) and have the necessary permissions. Butterfield Mortgages Limited is authorized and has permissions to enter into, advise on and administer regulated mortgage contracts.

Because its permissions are limited to mortgage activities, Butterfield Mortgages Limited is regulated by the FCA. The FCA has responsibility for both prudential and conduct of business regulation of Butterfield Mortgages Limited.

Butterfield Mortgages Limited must comply with the FCA handbook which contains detailed rules and guidance in respect of governance and conduct matters. The FCA's Principles for Business require, among other things, that Butterfield Mortgages Limited conducts its business with integrity and due skill, care and diligence and deal with its regulators in an open and cooperative way. In addition, certain persons occupying senior management functions and certifications at Butterfield Mortgages Limited are subject to statements of principle and a code of practice that describes behaviors expected of persons operating in the regulated sector. Butterfield Mortgages Limited is subject to and has implemented the FCA's Senior Management and Certification Regime, the purpose of which is to increase individual accountability of senior management under the UK regulatory system.

Control

Capital

Butterfield Mortgages Limited is subject to capital rules under the FCA's Prudential sourcebook for MIPRU. The MIPRU capital rules stipulate the minimum level and quality of capital that must be maintained to support the activities carried on.

AML and Financial Crime

Butterfield Mortgages Limited is subject to a range of legislation at a UK level requiring it to take steps to detect and prevent potential money laundering, financial crime or terrorist financing. The FCA and HM Treasury have investigatory powers in relation to suspected breaches.

Further, Butterfield Mortgages Limited must comply with its obligations under the Proceeds of Crime Act 2002, the Terrorism Act 2000, the Anti-terrorism, Crime and Security Act 2001, the Counter-Terrorism Act 2008 (Schedule 7), certain specific obligations under the Transfer of Funds (Information on the Payer) Regulations 2007 and certain specific obligations in FSMA (in particular with respect to market abuse and insider dealing) and the FCA Handbook. Together, this legislation requires regulated firms to create appropriate and risk-sensitive policies and procedures in relation to customer due diligence procedures and monitoring of transactions, to avoid financing terrorism or money laundering or facilitating either of these, to avoid dealing with certain persons specified by HM Treasury, and to disclose suspicious activity to the relevant regulatory authorities. In addition, Butterfield Mortgages Limited must adhere to the Bribery Act 2010 which has broad extra-territorial reach.

Butterfield Mortgages Limited must also comply with legislation of third countries to the extent that such legislation has extra-territorial effect and is applicable to it. Examples of this are the US PATRIOT Act of 2001 and The FATCA of 2010.

Data Protection Act, 2018

The DPA 2018 implements the GDPR. Butterfield Mortgages Limited is required to have in place compliant policies and procedures to meet the DPA obligations to deal with data appropriately. The DPA applies to any business or person using or holding personal data on individuals within the EU and UK. Breaches of the legislation are criminal offenses and can result in severe penalties. The Information Commissioner’s Office has regulatory and disciplinary powers and breach of the DPA can give rise to financial penalties based on a percentage of annual turnover.

Following the UK leaving the EU on January 31, 2020, the GDPR is incorporated into the UK’s domestic law under The European Union (Withdrawal Agreement) Act 2020 that makes legal provision for ratifying the Brexit Withdrawal Agreement of January 24, 2020 and implementing it into the domestic law of the United Kingdom.

Financial Institutions Act

The FinIA and the implementing ordinance to the FinIO entered into force on January 1, 2020. FinIA and FinIO set forth the basic provisions relating to the licensing in Switzerland of financial institutions, which includes trustees and (collective) asset managers but excludes banks and insurance companies as they are already subject to specific legislation. Pursuant to FinIA, Swiss trustees acting on a professional basis in Switzerland or from Switzerland, must obtain a license from the FINMA to carry on their trustee activities. A Swiss branch or a Swiss representative office of a foreign trustee must also obtain a license from FINMA.

FINMA is responsible for granting the license and for taking any enforcement actions. In order to obtain a license from FINMA, a trustee will first need to affiliate to a Supervisory Organization, which is licensed and supervised by FINMA. The Supervisory Organization will conduct the day-to-day supervision and perform regular audits of the affiliated trustees. In order to obtain a license, the applicant must further, inter alia, comply with minimum capital requirements, have an appropriate level of own funds, an appropriate organization, qualified executives and generally meet a "fit and proper" requirement.

In accordance with the obligations for existing trustees under FinIA, Butterfield Trust (Switzerland) Ltd complies with the licensing requirements as set forth under FinIA, is affiliated to a Supervisory Organization (see below under Swiss Anti-Money Laundering Act) and was granted a Trustee license by FINMA on January 15, 2024.

Swiss Anti-Money Laundering Act

The AMLA and the related implementing ordinances apply to financial intermediaries, which include trustees. It governs the combating of money laundering and terrorist financing. It ensures the exercise of due diligence by the financial institutions in the conduct of financial transactions. Pursuant to AMLA, financial institutions must affiliate to a recognized Self-Regulatory Organisation or a recognized Supervisory Organisation (see above under Financial Institutions Act) which shall supervise compliance by financial intermediaries of their duties set out in AMLA. Butterfield Trust (Switzerland) Ltd must comply with its obligations under AMLA and is currently affiliated to SO-FIT, a Supervisory Organisation licensed and supervised by FINMA.

Swiss Data Protection Act

Singapore

 

United States

Foreign Account Tax Compliance Act

Under FATCA, US federal tax legislation passed in 2010, a 30% withholding tax will be imposed on "withholdable payments" made to non-US financial institutions (including non-US investment funds and certain other non-US financial entities) that fail (or, in some cases, that have 50% affiliates which are also non-US financial institutions that fail) to provide certain information regarding their US accountholders and/or certain US investors (such US accountholders and US investors, "US accountholders") to the IRS. For non-US financial institutions that fail to comply, this withholding will generally apply without regard to whether the beneficial owner of a withholdable payment is a US person or would otherwise be entitled to an exemption from US federal withholding tax. "Withholdable payments" generally include, among other items, payments of US-source interest and dividends. Furthermore, FATCA may also impose withholding on non-US source payments by non-US financial institutions that comply with FATCA to non-US financial institutions that fail to comply with FATCA. However, under proposed Treasury regulations, such withholding will not apply to payments made before the date that is two years after the date on which final regulations defining the term "foreign pass thru payment" are published. In general, non-publicly traded debt and equity interests in investment vehicles will be treated as "accounts" and be subject to these reporting requirements. In addition, certain insurance policies and annuities are considered accounts for these purposes.

Some countries, including Bermuda, the Cayman Islands, Guernsey, Jersey, the UK, Singapore, Switzerland and The Bahamas, have entered into, and other countries are expected to enter into, intergovernmental agreements ("IGAs") with the United States to facilitate the type of information reporting required under FATCA. While the existence of IGAs will not eliminate the risk of the withholding described above, these agreements are expected to reduce that risk for financial institutions and investors in countries that have entered into IGAs. IGAs will often require financial institutions in those countries to report some information on their US accountholders to the taxing authorities of those countries, which will then pass the information to the IRS.

The Group closely monitors all present and new legislation that is or will be applicable for its organization, and is continuing to monitor all implications of FATCA and legislation of countries that have entered into intergovernmental agreements. While monitoring these implications, the Group is and will be in close contact with all of its stakeholders, including its peers and financial industry representative organizations.

The Group has taken all the steps it believes are necessary to comply with current FATCA regulations, including analysis of its group entities and conclusions as to their FATCA classifications, entering into agreements with the US tax authorities (as necessary), identification of reportable accounts, and timely and accurate filing of all required annual FATCA filings, all in accordance with the appropriate IGA. Certain payments to the Group may be subject to withholding under FATCA if, in the future, the Group cannot enter into such agreements or satisfy the requirements thereunder (including as a result of local laws in non-IGA countries prohibiting information-sharing with the IRS, as a result of contracts or local laws prohibiting withholding on certain payments to account holders, policyholders, annuitants or other investors, or as a result of the failure of account holders, policyholders, annuitants or other investors to provide requested information). The possibility of such withholding and the need for US account holders, policyholders, annuitants and investors to provide certain information may adversely affect the sales of certain of the Group's products. In addition, entering into agreements with the IRS and compliance with the terms of such agreements and with FATCA and any regulations or other guidance promulgated thereunder or any legislation promulgated under an IGA may substantially increase the Group's compliance costs.

Office of Foreign Assets Control Regulation

The US Treasury Department's Office of Foreign Assets Control ("OFAC"), administers and enforces economic and trade sanctions against targeted foreign countries and regimes, under authority of various laws, including designated foreign countries, nationals and others. OFAC publishes lists of specially designated targets and countries. OFAC sanctions apply to all transactions that take place in the United States. Transactions that take place outside the United States may become subject to the jurisdiction of the

United States and subject to compliance with OFAC sanctions if they involve US persons or payment in US dollars. Such payments typically are cleared through the US Dollar settlement system located in the United States and involve the intermediation of US financial institutions. Although we currently do not have any operations in the United States, our operations may involve transactions with US persons or in US Dollars and as a result, in order to comply with OFAC sanctions, we are responsible for, among other things, blocking any such transactions with designated targets and countries and reporting blocked transactions after their occurrence. Failure to comply with these sanctions could have serious legal and reputational consequences, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required.

Anti-Money Laundering and the USA PATRIOT Act

A major focus of worldwide governmental policy on financial institutions in recent years has been aimed at combating money laundering and terrorist financing. In particular, United States anti-money laundering laws and regulations including the USA PATRIOT Act of 2001, and the Anti-Money Laundering Act of 2020 ("2020 AMLA"), applicable to non-US banks with operations in the United States, including banks that engage in transactions outside the United States with US persons or in US Dollars, such as the Bank, impose significant compliance and due diligence obligations.

Under these laws and regulations, financial institutions are prohibited from entering into specified financial transactions and account relationships and must use enhanced due diligence procedures in their dealings with certain types of high-risk customers and implement a written customer identification program. Financial institutions must also take certain steps to assist government agencies in detecting and preventing money laundering and report certain types of suspicious transactions. Regulatory authorities routinely examine financial institutions for compliance with these obligations, and failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing, or to comply with all of the relevant laws or regulations, could have serious legal and reputational consequences for the institution, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required. Institutions that violate these obligations can be subject to cease and desist orders, civil money penalties and criminal sanctions.

Moreover, the 2020 AMLA requires the U.S. Treasury Department to issue National Anti-Money Laundering and Countering the Financing of Terrorism Priorities, conduct studies and issue regulations that may, over the next few years, significantly alter some of the due diligence, recordkeeping and reporting requirements that may be imposed on financial institutions. The 2020 AMLA also expands the US Department of Justice’s subpoena authority with respect to any foreign bank that maintains a correspondent account in the US, increases penalties for violations of US anti-money laundering laws and significantly expands a whistleblower award program, which could increase the prospect of regulatory enforcement. Many of the statutory provisions in the 2020 AMLA will require additional rulemakings, reports and other measures, and the impact of the 2020 AMLA will depend on, among other things, rulemaking and implementation guidance. In June 2021, the Financial Crimes Enforcement Network of the US Treasury Department issued the required priorities, which include: corruption, cybercrime, terrorist financing, fraud, transnational crime, drug trafficking, human trafficking and proliferation financing.

Future Legislation and Regulation

The above jurisdictions and the other jurisdictions in which we operate may enact legislation from time to time that affects the regulation of the financial services industry or that affect the regulation of financial institutions chartered by or operating in those jurisdictions. These governments and their regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. For example, see Item 3.D “Risk Factors – Regulatory and Tax-Related Risks – We operate in a complex and changing regulatory environment and legal and regulatory changes or our failure to comply with laws and regulations could have a negative impact on our business, financial condition or results of operations“ and Item 3.D “Risk Factors – Risks Relating to Our Strategy, Brand, Portfolio and Other Aspects of Our Business – Requirements and expectations from our regulators and other stakeholders on environmental, social and governance issues could significantly impact our business”. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of the proposed legislation could impact the regulatory structure under which we operate and may significantly increase our costs, impede the efficiency of our internal business processes, require us to increase our regulatory capital and modify our business strategy, and limit our ability to pursue business opportunities in an efficient manner. Our business, financial condition, results of operations or prospects may be adversely affected, perhaps materially, as a result.

Additional Information

Distribution of Assets, Liabilities and Shareholders' Equity; Interest Rates and Interest Differential

Average Balance Sheet and Interest Rates

The following table presents average consolidated balance sheets and net interest income for the years indicated:

______________________________

Analysis of Changes in Volume and Rate on Interest Income and Interest Expense

The following table presents the amount of changes in interest income and interest expense from December 31, 2022 to December 31, 2023 and from December 31, 2021 to December 31, 2022, due to changes in both average volume and average rate. Changes not solely due to volume or rate have been allocated to volume.

______________________________

Investment Portfolio

The following table presents an analysis of the weighted average yields for interest bearing debt securities as at December 31, 2023:

___________

Loan Portfolio

Maturity Profile of the Loan Portfolio

The following table presents certain items in our loan portfolio by contractual maturity as at December 31, 2023:

The following table presents our loan portfolio by maturity and type of interest as at December 31, 2023:

Credit Ratios

The following table presents our credit ratios for the years indicated:

Non-accrual loans to total loan outstanding ratio remained relatively flat at 1.3% in 2023 from 2022.

Allocation of the Allowance for Credit Losses

Deposits

The following table presents our deposits by category for the years indicated:

The following table presents the amount of uninsured deposits by reportable segment:

The following table presents the amount of uninsured time deposits by reportable segment and time to maturity as at December 31, 2023: