CapStar Financial (CSTR) 10-K2023 FY Annual report

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

(Mark One)

For the fiscal year ended December 31, 2023

OR

For the transition period from ________to________

Commission File Number 001-37886

CAPSTAR FINANCIAL HOLDINGS, INC.

(Exact name of Registrant as specified in its Charter)

Registrant’s telephone number, including area code (615) 732-6400

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act:

None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☐ No ☒

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or 15(d) of the Act. Yes ☐ No ☒

Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definition of “large accelerated filer,” “accelerated filer” “smaller reporting company” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☒

As of June 30, 2023 the last business day of the registrant’s most recently completed second fiscal quarter, the aggregate market value of the registrant’s voting and non-voting common equity held by non-affiliates of the registrant was $256,252,717 based on the closing sales price of $12.27 per share as reported on the Nasdaq Global Select Market.

Indicate the number of shares outstanding of each of the registrant’s classes of common stock, as of the latest practicable date.

Table of Contents

Cautionary Note Regarding Forward-looking statements

TERMINOLOGY

The terms “we,” “our,” “us,” “CapStar,” “the Company,” “CSTR” and “CapStar Financial” that appear in this Annual Report on Form 10-K (this “Report”) refer to CapStar Financial Holdings, Inc. and its wholly-owned subsidiary, CapStar Bank, which we sometimes refer to as “CapStar Bank,” “our bank subsidiary,” “the Bank” and “our Bank”. The term “Old National” refers to Old National Bancorp, an Indiana corporation.

CAUTIONARY NOTE REGARDING FORWARD-LOOKING STATEMENTS

This Report contains certain "forward-looking statements" within the meaning of Section 27A of the Securities Act of 1933, as amended (the "Securities Act"), and Section 21E of the Securities Exchange Act of 1934, as amended (the "Exchange Act"). These forward-looking statements reflect our current views with respect to, among other things, statements relating to the Company’s assets, business, cash flows, condition (financial or otherwise), credit quality, financial performance, liquidity, short and long-term performance goals, prospects, results of operations, strategic initiatives, the benefits, cost and synergies of completed acquisitions or dispositions, and the timing, benefits, costs and synergies of future acquisitions, disposition and other growth opportunities. These statements are often, but not always, made through the use of words or phrases such as “may,” “should,” “could,” “predict,” “potential,” “believe,” “will likely result,” “expect,” “continue,” “will,” “anticipate,” “seek,” “aspire,” “estimate,” “intend,” “plan,” “project,” “projection,” “forecast,” “roadmap,” “goal,” “target,” “would,” and “outlook,” or the negative version of those words or other comparable words of a future or forward-looking nature. Forward-looking statements express only management's beliefs regarding future results or events and are subject to inherent uncertainty, risks and changes in circumstances, many of which are outside of management's control. Uncertainty, risks, changes in circumstances and other factors could cause the Company's actual results to differ materially from those projected in the forward-looking statements. Factors that could cause actual results to differ from those discussed in such forward-looking statements include, but are not limited to: (1) difficulty attracting and retaining highly-effective employees; (2) our ability to successfully execute our business plan; (3) difficulty growing or sustaining deposit and loan balances; (4) changes in consumer preferences, spending and borrowing habits, and demand for our products and services; (5) negative economic and political conditions that adversely affect the general economy, especially in the communities and markets in which we conduct our business, the banking sector housing prices, the real estate market, the job market, consumer confidence, the financial condition of our borrowers and consumer spending habits, which may affect, among other things, the levels of non-performing assets, charge-offs and provision expense; (6) credit risk, including the risk that negative credit quality trends may lead to a deterioration of asset quality, risk that our allowance for credit losses may not be sufficient to absorb actual losses in our loan portfolio, and risk from concentrations within our loan portfolio; (7) market risk, including interest rate and liquidity risk; (8) operational risk, including cybersecurity risk and risk of fraud, data processing system failures, and network breaches; (9) increased competition, including competition from non-bank financial institutions; (10) changes in regulations, laws, taxes, government policies, monetary policies and accounting policies affecting bank holding companies and their subsidiaries; (11) regulatory enforcement actions and adverse legal actions; (12) the potential effects of events beyond our control that may have a destabilizing effect on financial markets and the economy, such as inflation or recession, terrorist activities, wars and other foreign conflicts, climate change, disruptions in our customers’ supply chains, disruptions in transportation, essential utility outages or trade disputes and related tariffs; (13) other economic, competitive, technological, operational, governmental, regulatory, and market factors affecting our operations; and (14) risks relating to our proposed acquisition by Old National Bancorp, including, without limitation, (i) the risk that the proposed merger may not be completed in a timely manner or at all; (ii) the occurrence of any event, change or other circumstance that could give rise to the termination of the merger agreement; (iii) effect of the announcement or pendency of the proposed merger on the Company’s business relationships, operating results and business generally; (iv) risks that the proposed transaction disrupts current plans and operations of the Company; (v) potential difficulties in retaining the Company’s customers and employees as a result of the proposed transaction; (vi) diversion of management’s attention from ongoing business operations and opportunities; (vii) certain restrictions during the pendency of the proposed transaction that may impact the Company’s ability to pursue certain business opportunities; and (vii) expected cost savings, synergies and other financial benefits from the merger not being realized within the expected time frames and costs or difficulties relating to integration matters being greater than expected. The foregoing factors should not be construed as exhaustive and should be read in conjunction with the section entitled “Risk Factors” included in this Report and in future reports and other documents that we file with the Securities and Exchange Commission. If one or more events related to these or other risks or uncertainties materialize, or if our underlying assumptions prove to be incorrect, actual results may differ materially from our forward-looking statements. Accordingly, you should not place undue reliance on any such forward-looking statements. Any forward-looking statement speaks only as of the date of this Report, and we do not undertake any obligation to publicly update or review any forward-looking statement, whether as a result of new information, future developments or otherwise, except as required by law. New risks and uncertainties may emerge from time to time, and it is not possible for us to predict their occurrence or how they will affect us.

PART I

ITEM 1. BUSINESS

OVERVIEW

We are a bank holding company that is headquartered in Nashville, Tennessee. We operate primarily through our wholly owned subsidiary, CapStar Bank. CapStar provides traditional banking and other financial services through its 31 bank locations and 360 associates. As of December 31, 2023, we had total assets of $3.1 billion, total deposits of $2.7 billion, total net loans of $2.2 billion, and shareholders’ equity of $361.6 million.

Proposed Acquisition by Old National

On October 26, 2023, Old National and the Company entered into a definitive merger agreement for Old National (the "Old National Merger Agreement") to acquire CapStar in an all-stock transaction with an aggregate value of approximately $344 million, or $16.64 per share of CapStar common stock, based on Old National’s 30-day volume weighted average closing stock price ending October 25, 2023 (the "Merger"). Under the terms of the Old National Merger Agreement, shareholders of the Company will receive, in respect of each share of common stock of the Company held by them, 1.155 shares of common stock of Old National. Following the Merger (on a date to be determined by Old National), CapStar Bank will merge with and into Old National Bank, a wholly-owned subsidiary of Old National, with Old National Bank as the surviving bank (the "Bank Merger"). On February 21, 2024, the Company disclosed that the Board of Governors of the Federal Reserve System approved the Merger and the Office of the Comptroller of the Currency approved the Bank Merger. On February 29, 2024, the Company's shareholders approved the Merger at a special meeting.

Business Highlights

The primary products and services provided by CapStar are:

Our strategy is to maintain broadly diversified loan and deposit portfolios in terms of the type of loan product, the type of client and the industries in which our business clients are engaged.

Commercial and industrial loans consist of loans to small to mid-sized businesses and other legal entities. Commercial and industrial loans are reliant on the ability of a borrower’s cash flow from operations to repay the loan. Most commercial and industrial loans are secured with the collateral securing these loans being inventory, receivables, and equipment. Lending products include commercial loans, business term loans, equipment financing and lines of credit to a diversified mix of small and medium sized businesses. As of December 31, 2023, commercial and industrial loans totaled $501.9 million or 22.1% of the Company’s loan portfolio.

Commercial real estate loans consist of owner-occupied and non-owner-occupied commercial real estate loans. Owner-occupied commercial real estate loans having many of the characteristics of commercial and industrial loans with the primary source of repayment reliant on the ability of the borrower’s cash flow to repay the loan. Non-owner occupied commercial real estate loans finance well-managed income producing properties supported by a history of profitable operations and cash flows, and proven operating stability. As of December 31, 2023, owner-occupied and non-owner-occupied commercial real estate loans totaled $281.2 million and $761.2 million or 12.4% and 33.5%, respectively, of the Company’s loan portfolio.

Residential real estate loans consist of loans to individuals secured by first priority liens for the purchase or refinance of a residence as well as first priority lien home equity loans which allow individuals to borrow against equity in their home. Residential mortgages primarily consist of three- and five-year adjustable-rate mortgages with amortization up to 30 years as well as longer-term fixed rate loans produced by our mortgage division with the intent to sell in the

secondary market. Home equity loans include lines of credit as well as amortizing term loans on which may be first or second liens. As of December 31, 2023, residential real estate loans totaled $423.3 million or 18.7% of the Company’s loan portfolio.

Construction and land development loans consist of loans where the repayment is dependent on the successful completion and operation and/or sale of the related real estate project. Construction and land development loans include 1-4 family construction projects and commercial construction endeavors such as warehouses, apartments, office and retail space and land acquisition and development. As of December 31, 2023, construction and land development loans totaled $212.5 million or 9.4% of the Company’s loan portfolio.

Consumer loans consist of loans secured by automobiles, boats, recreational vehicles, certificates of deposit, other personal property, or in a limited case may be unsecured. As of December 31, 2023, consumer loans totaled $48.8 million or 2.1% of the Company’s loan portfolio.

Other loans consists of all loans not included in the classes of loans above and leases. As of December 31, 2023, other loans totaled $40.8 million or 1.8% of the Company’s loan portfolio.

CapStar’s underwriting guidelines are reviewed regularly and approved annually by our Board of Directors. Our underwriting process includes:

Our underwriting processes collaboratively engage our bankers and credit underwriters in the analysis of each loan request. We manage our credit risks by analyzing metrics in order to maintain a conservative and well-diversified loan portfolio reflective of our assessment of various subsets within our market. Based upon our aggregate exposure to any given borrower relationship, we employ a tiered review of loan originations that may involve joint line and credit authorization, our bank’s Credit Committee or, ultimately, our full board of directors.

Our strategy for credit risk management includes the disciplined underwriting process described above and ongoing risk monitoring and review processes for all loan exposures. Our Chief Credit Officer provides bank-wide credit oversight and regularly reviews the loan portfolio to ensure that the underwriting and risk identification processes are functioning properly. We strive to identify potential problem loans early in an effort to aggressively seek resolution of these situations before the loans become delinquent or impaired, record any necessary charge-offs promptly and maintain adequate allowance levels for probable loan losses inherent in the loan portfolio. Annually, we submit ourselves to review by independent third parties to validate our internal oversight.

Market Area and Competition

CapStar operates in the community markets of Athens, Lawrenceburg/Waynesboro, and Manchester, Tennessee as well as the metropolitan markets of Asheville, North Carolina and Chattanooga, Knoxville, and Nashville, Tennessee which are included among the fastest growing nationally. The bank seeks business development and serves customers through a team of commercial relationship managers and its 23 banking locations. The financial services industry is highly competitive and each of these markets has a significant presence of other financial service providers. In particular, we estimate that, as of June 30, 2023, Tennessee included more than 83 financial institutions with over $117.6 billion in deposits. We compete directly with other bank and nonbank institutions located within our market area, internet-based banks, and out-of-market banks that advertise in or otherwise serve our market area, along with money market and mutual funds, brokerage houses, mortgage companies, and insurance companies or other commercial entities that offer financial services products. Competition involves efforts to retain current clients, obtain new loans and deposits, increase the scope and type of services offered, and offer competitive interest rates paid on deposits and charged on loans. Many of our competitors enjoy competitive advantages, including greater financial resources, a wider geographic presence, the ability to offer additional services, more favorable pricing alternatives,

and lower origination and operating costs. Some of our competitors have been in business for a long time and have an established client base and name recognition. We expect to continue to face increasing competition.

Human Capital

As of December 31, 2023, we had 360 total employees. As a service-oriented business, our long-term success depends on our people and we are committed to taking a multi-dimensional approach to talent and culture. Our people and culture are critical to the Company’s long-term success. The Company maintains a strong focus on engagement and performs an annual study using a third party consultant to access the Company's engagement. For 2023, the Company received a favorable ranking at 73rd percentile for engagement nationally based on an independent survey conducted by Gallup, Inc.

As such, our talent vision and strategy focus on:

SUPERVISION AND REGULATION

General

Insured banks, their holding companies and their affiliates are extensively regulated under federal and state law. As a result, our growth and earnings performance and that of our subsidiaries may be affected not only by management decisions and general economic conditions, but also by the requirements of federal and state statutes and by the regulations and policies of various bank regulatory agencies, including the Tennessee Department of Financial Institutions ("TDFI"), the Board of Governors of the Federal Reserve System (the “Federal Reserve”), the Federal Deposit Insurance Corporation (“FDIC”), the Office of the Comptroller of the Currency (“OCC”) and the Consumer Financial Protection Bureau (“CFPB”). Furthermore, tax laws administered by the Internal Revenue Service (“IRS”) and state taxing authorities, accounting rules developed by the Financial Accounting Standards Board (“FASB”), securities laws administered by the Securities and Exchange Commission (“SEC”) and state securities authorities, anti-money laundering laws enforced by the U.S. Department of the Treasury and mortgage related rules, including with respect to loan securitizations and servicing by the U.S. Department of Housing and Urban Development and agencies such as Ginnie Mae and Freddie Mac, have an impact on our business. The effect of these statutes, regulations, regulatory policies and rules are significant to our operations and results and those of our bank, and the nature and extent of future legislative, regulatory or other changes affecting financial institutions are impossible to predict with any certainty.

Federal and state banking laws impose a comprehensive system of supervision, regulation and enforcement on the operations of insured banks, their holding companies and affiliates that are intended primarily for the protection of the depositors of banks, rather than their shareholders. These federal and state laws, and the regulations of the bank regulatory agencies issued under them, affect, among other things, the scope of business, the kinds and amounts of investments banks may make, reserve requirements, capital levels relative to operations, the nature and amount of collateral for loans, the establishment of branches, the ability to merge, consolidate and enter into acquisitions with other companies, dealings with insiders and affiliates and the payment of dividends.

This supervisory and regulatory framework subjects banks and bank holding companies to regular examination by their respective primary federal regulators, which results in examination reports and ratings that, while not publicly available, can impact the conduct and growth of their businesses. These examinations consider not only compliance with applicable laws and regulations, but also capital levels, asset quality and risk, management ability and performance, earnings, liquidity, and various other factors. The regulatory agencies generally have broad discretion to impose restrictions and limitations on the operations of a regulated entity where the agencies determine, among

other things, that such operations are unsafe or unsound, fail to comply with applicable law or are otherwise inconsistent with laws and regulations or with the supervisory policies of these agencies.

The following is a summary of the material elements of the supervisory and regulatory framework applicable to us and our bank. It does not describe all of the statutes, regulations and regulatory policies that apply, nor does it restate all of the requirements of those that are described. The descriptions are qualified in their entirety by reference to the particular statutory and regulatory provision.

Bank Holding Company Regulation

Since we own all of the capital stock of our bank, we are a bank holding company under the Bank Holding Company Act of 1956, as amended (“BHC Act”). As a result, we are primarily subject to the supervision, examination and reporting requirements of the BHC Act and the regulations of the Federal Reserve.

Acquisition of Banks

The BHC Act requires every bank holding company to obtain the Federal Reserve’s prior approval before:

Additionally, the BHC Act provides that the Federal Reserve may not approve any of the above transactions if such transaction would result in or tend to create a monopoly or substantially lessen competition or otherwise function as a restraint of trade, unless the anti-competitive effects of the proposed transaction are clearly outweighed by the public interest in meeting the convenience and needs of the community to be served. The Federal Reserve is also required to consider the financial and managerial resources and future prospects of the bank holding companies and banks concerned and the convenience and needs of the community to be served. The Federal Reserve’s consideration of financial resources includes a focus on capital adequacy, which is discussed in the section titled “Item 1. Business—Regulation and Supervision—Capital Adequacy.” The Federal Reserve also considers the effectiveness of the institutions in combating money laundering, including a review of the anti-money laundering program of the acquiring bank holding company and the anti-money laundering compliance records of a bank to be acquired as part of the transaction. Finally, the Federal Reserve takes into consideration the extent to which the proposed transaction would result in greater or more concentrated risks to the stability of the U.S. banking or financial system.

Under the BHC Act, if well-capitalized and well-managed, we or any other bank holding company located in Tennessee may purchase a bank located outside of Tennessee without regard to whether such transaction is prohibited under state law. Conversely, a well-capitalized and well-managed bank holding company located outside of Tennessee may purchase a bank located inside Tennessee without regard to whether such transaction is prohibited under state law. In each case, however, state law may place restrictions on the acquisition of a bank that has only been in existence for a limited amount of time or will result in concentrations of deposits exceeding limits specified by statute. For example, Tennessee law currently prohibits a bank holding company from acquiring control of a Tennessee-based financial institution until the target financial institution has been in operation for at least three years.

Change in Bank Control

Subject to various exceptions, the BHC Act and the Change in Bank Control Act, together with related regulations, require Federal Reserve approval prior to any person or company acquiring “control” of a bank holding company. Under a rebuttable presumption established by the Federal Reserve pursuant to the Change in Bank Control Act, the acquisition of 10% or more of a class of voting stock of a bank holding company would constitute acquisition of “control” of the bank holding company if no other person will own, control, or hold the power to vote a greater percentage of that class of voting stock immediately after the transaction or the bank holding company has registered securities under the Exchange Act. In addition, any person or group of persons acting in concert must obtain the approval of the Federal Reserve under the BHC Act before acquiring 25% (or 5% in the case of an acquirer that is already a bank holding company) or more of the outstanding voting stock of a bank holding company, the right to control in any manner the election of a majority of the company’s directors, or otherwise obtaining control or a “controlling influence” over the bank holding company.

Permitted Activities

Under the BHC Act, a bank holding company is generally permitted to engage in or acquire direct or indirect control of the voting shares of any company engaged in the following activities:

Activities that the Federal Reserve has found to be so closely related to banking as to be a proper incident to the business of banking include:

The Federal Reserve may order a bank holding company or its subsidiaries to terminate any of these activities or to terminate its ownership or control of any subsidiary when it has reasonable cause to believe that the bank holding company’s continued ownership, activity or control constitutes a serious risk to the financial safety, soundness, or stability of it or any of its bank subsidiaries.

Support of Subsidiary Institutions

The Federal Deposit Insurance Act and Federal Reserve policy require a bank holding company to serve as a source of financial and managerial strength to its bank subsidiaries. As a result of a bank holding company’s source of strength obligation, a bank holding company may be required to provide funds to a bank subsidiary in the form of subordinate capital or other instruments which qualify as capital under bank regulatory rules. Any loans from the holding company to such subsidiary banks likely would be unsecured and subordinated to such bank’s depositors and perhaps to other creditors of the bank.

Repurchase or Redemption of Securities

A bank holding company is generally required to give the Federal Reserve prior written notice of any purchase or redemption of its own then outstanding equity securities if the gross consideration for the purchase or redemption, when combined with the net consideration paid for all such purchases or redemptions during the preceding 12 months, is equal to 10% or more of the company’s consolidated net worth. The Federal Reserve may disapprove such a purchase or redemption if it determines that the proposal would constitute an unsafe and unsound practice, or would violate any law, regulation, Federal Reserve order or directive, or any condition imposed by, or written agreement with, the Federal Reserve. The Federal Reserve has adopted an exception to this approval requirement for well-capitalized bank holding companies that meet certain conditions. The Federal Reserve also expects a bank holding company to inform the Federal Reserve prior to any repurchase or redemption that would result in a net reduction as

of the end of the quarter in the amount of such equity instruments outstanding compared with the beginning of the quarter in which the redemption or repurchase occurred.

Bank Regulation and Supervision

Our bank is subject to extensive federal and state banking laws and regulations that impose restrictions on and provide for general regulatory oversight of the operations of our bank. These laws and regulations are generally intended to protect the safety and soundness of our bank and our bank’s depositors, rather than our shareholders. The following discussion describes the material elements of the regulatory framework that applies to our bank.

Since our bank is a commercial bank chartered under the laws of the state of Tennessee and is a member of the Federal Reserve System, it is primarily subject to the supervision, examination and reporting requirements of the Federal Reserve and the TDFI. The Federal Reserve and the TDFI regularly examine our bank’s operations and have the authority to approve or disapprove mergers, the establishment of branches and similar corporate actions. Both regulatory agencies have the power to take enforcement action to prevent the development or continuance of unsafe or unsound banking practices or other violations of law. Our bank’s deposits are insured by the FDIC to the maximum extent provided by law. Our bank is also subject to numerous federal and state statutes and regulations that affect its business, activities and operations.

Branching

Under current Tennessee law, our bank may open branch offices throughout Tennessee with the prior approval of, or prior notice to, the TDFI and the Federal Reserve. In addition, with prior regulatory approval, our bank may acquire branches of existing banks located in Tennessee. Under federal law, our bank may establish branch offices with the prior approval of the Federal Reserve. While prior law imposed various limits on the ability of banks to establish new branches in states other than their home state, the Dodd-Frank Act allows a bank to branch into a new state by setting up a new branch if, under the laws of the state in which the branch is to be located, a state bank chartered by that state would be permitted to establish the branch. This makes it much simpler for banks to open de novo branches in other states.

FDIC Insurance and Other Assessments

The Bank pays deposit insurance assessments to the Deposit Insurance Fund, which is determined through a risk-based assessment system. The Bank’s deposit accounts are currently insured by the Deposit Insurance Fund, generally up to a maximum of $250,000 per separately insured depositor, per ownership category. The Bank pays assessments to the FDIC for such deposit insurance. Under the current assessment system, the assessment rate is determined by the risk category assigned to an institution based on the institution’s most recent supervisory and capital evaluations which are designed to measure risk, with riskier institutions paying a higher assessment rate. Under the Federal Deposit Insurance Act, the FDIC may terminate a bank’s deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order, agreement or condition imposed by the FDIC.

Community Reinvestment Act

The Community Reinvestment Act (“CRA”) requires that, in connection with examinations of financial institutions within their respective jurisdictions, the federal banking agencies will evaluate the record of each financial institution in meeting the needs of its local community, including low- and moderate-income neighborhoods. Our bank’s record of performance under the CRA is publicly available. A bank’s CRA performance is also considered in evaluating applications seeking approval for mergers, acquisitions, and new offices or facilities. Failure to adequately meet these criteria could result in additional requirements and limitations being imposed on the bank. Additionally, we must publicly disclose the terms of certain CRA-related agreements. As of December 31, 2023, the Bank had a CRA rating of “Satisfactory.”

Interest Rate Limitations

Interest and other charges collected or contracted for by our bank are subject to applicable state usury laws and federal laws concerning interest rates.

Federal Laws Applicable to Consumer Credit and Deposit Transactions

Our bank’s loan and deposit operations are subject to a number of federal consumer protection laws, including:

Capital Adequacy

Pursuant to the Dodd-Frank Act, under the adopted regulations, the Basel member central bank and federal bank regulators approved the Basel Capital Adequacy Accord, or Basel III. The U.S. Basel III rule’s minimum capital to risk-weighted assets, or RWA, requirements are as follows: (1) a common equity Tier 1 capital ratio of 4.5%, (2) a Tier 1 capital ratio of 6.0%, and (3) a total capital ratio of 8.0%. The minimum leverage ratio (Tier 1 capital to total assets) is 4.0%. The rule also changed the definition of capital, mainly by adopting stricter eligibility criteria for regulatory capital instruments, and new constraints on the inclusion of minority interests, mortgage-servicing assets, deferred tax assets, and certain investments in the capital of unconsolidated financial institutions. In addition, the U.S. Basel III rule requires that most regulatory capital deductions be made from common equity Tier 1 capital.

Under the U.S. Basel III rule, in order to avoid limitations on capital distributions, including dividend payments and certain discretionary bonus payments to executive officers, a banking organization must maintain a capital conservation buffer composed of common equity Tier 1 capital above its minimum risk-based capital requirements. The buffer is measured relative to RWA. Phase-in of the capital conservation buffer requirements began on January 1, 2016, and the requirements became fully phased in on January 1, 2019. A banking organization maintaining capital levels in excess of the fully phased-in capital conservation buffer of 2.5% would not be subject to limits on capital distributions or discretionary bonus payments; however, a banking organization with a buffer of less than 2.5% would be subject to increasingly stringent limitations as the buffer approaches zero. A banking organization also would be prohibited from making distributions or discretionary bonus payments during any quarter if its eligible retained income is negative in that quarter and its capital conservation buffer ratio was less than 2.5% at the beginning of the quarter. Effectively, the Basel III framework requires us to meet minimum risk-based capital ratios of (i) 7% for common equity Tier 1 capital, (ii) 8.5% Tier 1 capital, and (iii) 10.5% total capital. The eligible retained income of a banking organization is defined as its net income for the four calendar quarters preceding the current calendar quarter, based on the organization’s quarterly regulatory reports, net of any distributions and associated tax effects not already reflected in net income. With the capital conservation buffer fully phased in, the minimum capital requirements plus the capital conservation buffer will exceed the prompt corrective action, or PCA, well-capitalized thresholds.

Failure to meet statutorily mandated capital guidelines or more restrictive ratios separately established for a banking institution could subject the institution to a variety of enforcement remedies available to federal regulatory authorities, including issuance of a capital directive, the termination of deposit insurance by the FDIC, a prohibition on accepting or renewing brokered deposits, limitations on the rates of interest that the institution may pay on its deposits, and other restrictions on its business.

The Company's capital position is discussed in the Capital Adequacy section of "Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations" and in Note 16 to the "Notes to Consolidated Financial Statements."

Prompt Corrective Action

The Federal Deposit Insurance Corporation Improvement Act of 1991 (“FDICIA”) establishes a system of “prompt corrective action” (“PCA”) to resolve the problems of undercapitalized insured depository institutions. Under this system, the federal banking regulators have established five capital categories (well capitalized, adequately capitalized, undercapitalized, significantly undercapitalized and critically undercapitalized) into which all insured depository institutions are placed. The federal banking agencies have specified by regulation the relevant capital thresholds and other qualitative requirements for each of those categories. For an insured depository institution to be “well capitalized” under the PCA framework, it must have a common equity Tier 1 capital ratio of 6.5%, Tier 1 capital ratio of 8.0%, a total capital ratio of 10.0%, and a Tier 1 leverage ratio of 5.0%, and must not be subject to any written agreement, order or capital directive, or prompt corrective action directive issued by its primary federal regulator to meet and maintain a specific capital level for any capital measure. As of December 31, 2023, our bank qualified for the “well capitalized” category.

Federal banking regulators are required to take various mandatory supervisory actions and are authorized to take other discretionary actions with respect to institutions in the three undercapitalized categories. The severity of the action depends upon the capital category in which the institution is placed. For example, institutions in all three undercapitalized categories are automatically restricted from paying distributions and management fees, whereas only an institution that is significantly undercapitalized or critically undercapitalized is restricted in its compensation paid to senior executive officers. Generally, subject to a narrow exception, the banking regulator must appoint a receiver or conservator for an institution that is critically undercapitalized.

An institution that is categorized as undercapitalized, significantly undercapitalized, or critically undercapitalized is required to submit an acceptable capital restoration plan to its appropriate federal banking agency. A bank holding company must guarantee that a subsidiary depository institution meets its capital restoration plan, subject to various limitations. The controlling holding company’s obligation to fund a capital restoration plan is limited to the lesser of (i) 5% of an undercapitalized subsidiary’s assets at the time it became undercapitalized and (ii) the amount required to meet regulatory capital requirements. An undercapitalized institution is also generally prohibited from increasing its average total assets, making acquisitions, establishing any branches or engaging in any new markets or product offerings, except under an accepted capital restoration plan or with Federal Reserve approval.

The regulations also establish procedures for downgrading an institution to a lower capital category based on supervisory factors other than capital.

Liquidity

Financial institutions are subject to significant regulatory scrutiny regarding their liquidity positions. This scrutiny has increased following events of the first half of 2023, as the magnitude and speed of deposit outflows at a few financial institutions was unprecedented. Various bank regulatory publications, including the Addendum to the Interagency Policy Statement on Funding and Liquidity Risk Management: Importance of Contingency Funding Plans (July 28, 2023), Federal Reserve SR 10-6 (Funding and Liquidity Risk Management) and FDIC Financial Institution Letter FIL-84-2008 (Liquidity Risk Management), address the identification, measurement, monitoring and control of funding and liquidity risk by financial institutions.

The Company's liquidity is discussed in the Liquidity Risk section of "Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations."

Payment of Dividends

We are a legal entity separate and distinct from our bank. Our principal source of cash flow, including cash flow to pay dividends to our shareholders, is dividends our bank pays to us as our bank’s sole shareholder. Statutory and regulatory limitations apply to our bank’s payment of dividends to us as well as to our payment of dividends to our shareholders. The requirement that a bank holding company must serve as a source of strength to its subsidiary banks also results in the position of the Federal Reserve that a bank holding company should not maintain a level of cash dividends to its shareholders that places undue pressure on the capital of its bank subsidiaries or that can be funded only through additional borrowings or other arrangements that may undermine the bank holding company’s ability to serve as a source of strength. Our ability to pay dividends is also subject to the provisions of Tennessee corporate law which prevents payment of dividends if, after giving effect to such payment, we would not be able to pay our debts as they become due in the usual course of business or our total assets would be less than the sum of our total liabilities plus any amounts needed to satisfy any preferential rights if we were dissolving. In addition, in deciding whether or not to declare a dividend of any particular size, our board of directors must consider our and our bank’s current and prospective capital, liquidity, and other needs.

The TDFI also regulates our bank’s dividend payments. Under Tennessee law, a state-chartered bank may not pay a dividend without prior approval of the Commissioner of the TDFI if the total of all dividends declared by its board of directors in any calendar year will exceed (i) the total of its retained net income for that year, plus (ii) its retained net income for the preceding two years.

Our bank’s payment of dividends may also be affected or limited by other factors, such as the requirement to maintain adequate capital above regulatory guidelines. The federal banking agencies have indicated that paying dividends that deplete a depository institution’s capital base to an inadequate level would be an unsafe and unsound banking practice. Under FDICIA, a depository institution may not pay any dividends if payment would cause it to become undercapitalized or if it already is undercapitalized. Moreover, the federal agencies have issued policy statements providing that bank holding companies and insured banks should generally only pay dividends out of current operating earnings.

Information regarding the Company's dividends is provided in various sections including "Item 7.Management's Discussion and Analysis of Financial Condition and Results of Operations - Market and Liquidity Risk Management," "Item 8. Financial Statements and Supplementary Data" and Note 16 to the "Notes to Consolidated Financial Statements."

Restrictions on Transactions with Affiliates and Insiders

Our bank is subject to Section 23A of the Federal Reserve Act, which places limits on the amount of the bank’s transactions with its affiliates.

Subject to various exceptions, the total amount of the bank’s transactions with affiliates is limited in amount, as to any one affiliate, to 10% of a bank’s capital and surplus and, as to all affiliates combined, to 20% of a bank’s capital and surplus. In addition to the limitation on the amount of these transactions, transactions with affiliates also must meet specified collateral requirements and safety and soundness requirements. Our bank must also comply with provisions prohibiting the acquisition of low-quality assets from an affiliate.

Our bank is also subject to Section 23B of the Federal Reserve Act, which, among other things, prohibits a bank from engaging in transactions with affiliates, as well as other types of transactions set forth in Section 23B, unless the transactions are on terms substantially the same, or at least as favorable to the bank, as those prevailing at the time for comparable transactions with nonaffiliated companies.

Our bank is also subject to restrictions on extensions of credit to its executive officers, directors, principal shareholders and their related interests. These extensions of credit (i) must be made on substantially the same terms, including interest rates and collateral, as those prevailing at the time for comparable transactions between the bank and third parties, and (ii) must not involve more than the normal risk of repayment or present other unfavorable features. There are also individual and aggregate limitations on loans to insiders and their related interests. The aggregate amount of insider loans generally cannot exceed the institution’s total unimpaired capital and surplus. Insiders and banks are subject to enforcement actions for knowingly entering into insider loans in violation of applicable restrictions.

Single Borrower Credit Limits

Under Tennessee law, total loans and extensions of credit to a borrower may not exceed 15% of our bank’s capital, surplus and undivided profits. However, such loans may be in excess of that percentage, but not above 25%, if each loan in excess of 15% is first submitted to and approved in advance in writing by the board of directors and a record is kept of such written approval and reported to the board of directors quarterly.

Commercial Real Estate Concentration

In December 2006, the federal banking regulators issued guidance entitled “Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices” to address increased concentrations in commercial real estate, or CRE, loans. In addition, in December 2015, the federal banking agencies issued additional guidance entitled “Statement on Prudent Risk Management for Commercial Real Estate Lending.” Together, these guidelines describe the criteria the agencies will use as indicators to identify institutions potentially exposed to CRE concentration risk. An institution that has (i) experienced rapid growth in CRE lending, (ii) notable exposure to a specific type of CRE, (iii) total reported loans for construction, land development, and other land representing 100% or more of the institution’s capital, or (iv) total CRE loans representing 300% or more of the institution’s capital, and the outstanding balance of the institutions CRE portfolio has increased by 50% or more in the prior 36 months, may be identified for further supervisory analysis of the level and nature of its CRE concentration risk. As of December 31, 2023, our bank’s total CRE loans represented 243.05% of total capital.

Privacy

Financial institutions are required to disclose their policies for collecting and protecting non-public personal information of their clients. Clients generally may prevent financial institutions from sharing non-public personal information with nonaffiliated third parties except under certain circumstances, such as the processing of transactions requested by the consumer or when the financial institution is jointly offering a product or service with a nonaffiliated financial institution. Additionally, financial institutions generally are prohibited from disclosing consumer account numbers to any nonaffiliated third party for use in telemarketing, direct mail marketing or other marketing to consumers.

Consumer Credit Reporting

The Fair Credit Reporting Act (“FCRA”) imposes, among other things:

Anti-Terrorism and Money Laundering Legislation

Our bank is subject to the Bank Secrecy Act and USA Patriot Act. These statutes and related rules and regulations impose requirements and limitations on specified financial transactions and accounts and other relationships intended to guard against money laundering and terrorism financing. Our bank has established an anti-money laundering program pursuant to the Bank Secrecy Act and customer identification program pursuant to the USA Patriot Act. The bank also maintains records of cash purchases of negotiable instruments, files reports of certain cash transactions exceeding $10,000 (daily aggregate amount), and reports suspicious activity that might signify money laundering, tax evasion, or other criminal activities pursuant to the Bank Secrecy Act. Our bank otherwise has implemented policies and procedures to comply with the foregoing requirements.

Overdraft Fees

Federal Reserve Regulation E restricts banks’ abilities to charge overdraft fees. The rule prohibits financial institutions from charging fees for paying overdrafts on ATM and one-time debit card transactions, unless a consumer consents, or opts in, to the overdraft service for those types of transactions.

The Dodd-Frank Act

As final rules and regulations implementing the Dodd-Frank Act have been adopted, this law significantly changed and continues to significantly affect the bank regulatory framework and the lending, deposit, investment, trading and operating activities of banks and their holding companies. The Dodd-Frank Act requires various federal agencies to adopt a broad range of new implementing rules and regulations and to prepare numerous studies and reports for Congress. The federal agencies are given significant discretion in drafting the implementing rules and regulations, and consequently, many of the details and much of the impact of the Dodd-Frank Act will depend on the rules and regulations that implement it.

A number of the effects of the Dodd-Frank Act are described or otherwise accounted for in various parts of this “Supervision and Regulation” section. The following items provide a brief description of certain other provisions of the Dodd-Frank Act that may be relevant to us and our bank.

The Volcker Rule

On December 10, 2013, five U.S. financial regulators, including the Federal Reserve, adopted a final rule implementing the “Volcker Rule.” The Volcker Rule was created by Section 619 of the Dodd-Frank Act, which generally prohibits any “banking entity” from engaging in proprietary trading or retaining an ownership interest in, sponsoring, or having certain relationships with covered funds (i.e., hedge funds or private equity funds). In addition, the Volcker Rule requires each regulated entity to establish an internal compliance program that is consistent with the extent to which it engages in activities covered by the Volcker Rule.

On October 8, 2019, the agencies finalized revisions to the Volcker Rule that, among other things, simplified and streamlined compliance requirements for banking entities that do not have significant trading activities, while banking entities with significant trading activity would become subject to more stringent compliance requirements. Further, the revisions to the Volcker Rule implemented Section 203 of the Economic Growth, Regulatory Relief, and Consumer Protection Act (EGRRCPA), which amended the definition of “banking entity” to exclude certain community banks from the definition of insured depository institution, the general result of which was to exclude such banks and their affiliates and subsidiaries from the scope of the Volcker Rule. Under EGRRCPA, a community bank and its affiliates are generally excluded from the definition of “banking entity” if the bank and all companies that control the bank have total consolidated assets equal to $10 billion or less and trading assets and liabilities equal to five percent or less of total consolidated assets. Based on these criteria the Company is excluded from the definition of "banking entity" and thus is not impacted by the Volcker Rule. These revisions became effective on January 1, 2020, with a required compliance date of January 1, 2021.

Limitations on Incentive Compensation

In April 2016, the Federal Reserve and other federal financial agencies re-proposed restrictions on incentive-based compensation pursuant to Section 956 of the Dodd-Frank Act for financial institutions with $1 billion or more in total consolidated assets. For institutions with at least $1 billion but less than $50 billion in total consolidated assets, such as the Company and our bank, the proposal imposes principles-based restrictions that are broadly consistent with existing interagency guidance on incentive-based compensation. Such institutions are prohibited from entering into incentive compensation arrangements that encourage inappropriate risks by the institution (1) by providing an executive officer, employee, director, or principal shareholder with excessive compensation, fees, or benefits, or (2) that could lead to material financial loss to the institution. The proposal also imposes certain governance and recordkeeping requirements on institutions of the Company’s and our bank’s size. The Federal Reserve reserves the authority to impose more stringent requirements on institutions of the Company’s and our bank’s size.

Cybersecurity and the handling of personal information

Cybersecurity is a high-priority item for legislators and regulators at the federal and state levels, as well as internationally. State and federal banking regulators have issued various policy statements and, in some cases, regulations, emphasizing the importance of technology risk management and supervision. Such policy statements and regulations indicate that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. A financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyberattack involving destructive malware. A financial institution is expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyberattack. These requirements, including state regulatory rules such as the detailed and extensive cybersecurity rules issued in 2016 by the New York State Department of Financial Services, may cause us to incur significant additional compliance costs and in some cases may impact our growth prospects. Additionally, if we fail to observe federal or state regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.

In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and store sensitive data. We employ an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of our defensive measures, the threat from cyberattacks is severe, as attacks are sophisticated and increasing in volume and complexity, and attackers respond rapidly to changes in defensive measures. Our systems and those of our customers and third-party service providers are under constant threat, and it is possible that we or they could experience a significant event in the future that could adversely affect our business or operations. As cybersecurity threats continue to evolve, we may be required to expend

significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. Financial expenditures may also be required to meet regulatory changes in the information security and cybersecurity domains. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as the expanding use of internet banking, mobile banking and other technology-based products and services by us and our customers. See “Item 1A. – Risk Factors” and "Item 1C. - Cybersecurity" in this Annual Report for a further discussion of risks related to cybersecurity, how we manage those risks and our governance structure regarding cybersecurity.

Federal statutes and regulations, including the Gramm-Leach-Bliley Act (“GLBA”) and the Right to Financial Privacy Act of 1978, limit our ability to disclose non-public information about consumers, customers and employees to nonaffiliated third parties. Specifically, the GLBA requires us to disclose our privacy policies and practices relating to sharing non-public information and enables retail customers to opt out of our ability to share information with unaffiliated third parties under certain circumstances. The GLBA also requires us to implement a comprehensive information security program that includes administrative, technical and physical safeguards to ensure the security and confidentiality of customer records and information and, if applicable state law is more protective of customer privacy than the GLBA, financial institutions, including our bank, will be required to comply with such state law. Other laws and regulations impact our ability to share certain information with affiliates and non-affiliates for marketing and/or non-marketing purposes. These regulations affect how consumer information is transmitted through diversified financial companies and conveyed to outside vendors. In connection with the regulations governing the privacy of consumer financial information, the federal banking agencies, including the FDIC, have adopted guidelines for establishing information security standards and programs to protect such information.

Proposed or new legislation and regulations may also significantly increase our compliance cost and impede our ability to grow into specific markets. There are a number of proposals that have either recently been adopted or are currently pending before federal, state, and foreign legislative and regulatory bodies. For example, the European Union adopted the General Data Protection Regulation (the “GDPR”), which became effective on May 25, 2018. In addition, California passed the California Consumer Privacy Act of 2018 (the “CCPA”) on June 28, 2018. Both the GDPR and the CCPA impose additional obligations on companies regarding the handling of personal data and provide certain individual privacy rights to persons whose data is stored. In the event of a data breach, there are mandatory reporting requirements that may hamper the ability to fully assess an incident prior to external reporting. We must maintain awareness of additional legal and regulatory requirements that apply to existing and future subsets of the customer base for protection against legal, reputational, and financial risk due to compliance failures.

AVAILABLE INFORMATION

We file reports with the SEC including annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and proxy statements, as well as any amendments to those reports and statements. The SEC maintains an internet site that contains reports, proxy and information statements and other information regarding issuers that file electronically with the SEC at http://www.sec.gov. Our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, proxy statements and amendments to those reports and statements filed or furnished pursuant to section 13(a) or 15(d) of the Exchange Act are also accessible at no cost on our website at http://www.ir.capstarbank.com after they are electronically filed with the SEC. Reference to our website does not constitute incorporation by reference of the information contained on the website and should not be considered part of this Report.

We have also posted our Corporate Governance Guidelines, Code of Ethics and Conflicts of Interest Policy for directors, officers and employees, and the charters of our Audit Committee, Risk Committee, Nominating and Corporate Governance Committee, and Compensation and Human Resources Committee of our board of directors on the Corporate Governance section of our website at www.ir.capstarbank.com. We will make any legally required disclosures regarding amendments to, or waivers of, provisions of our Corporate Governance Guidelines, Code of Ethics and Conflicts of Interest Policy, or current committee charters on our website. We will also provide a copy of our Corporate Governance Guidelines, Code of Ethics and Conflicts of Interest Policy, and any committee charters without charge upon written request sent to 1201 Demonbreun Street, Suite 700, Nashville, Tennessee 37203, Attention: Investor Relations.

ITEM 1A. RISK FACTORS

This Item outlines specific risks that could affect the ability of our various businesses to compete, change our risk profile or materially affect our assets, business, cash flow, condition (financial or otherwise), liquidity, prospects and results of operations. Many of these risks are beyond our control, though efforts are made to manage those risks while optimizing financial and operational results, and our operating environment continues to evolve and new risks continue to emerge. This Item highlights risks that could affect us in material ways by causing future results to differ materially from past results, by causing future results to differ materially from current expectations, or by causing material changes in our financial condition. Some of these risks are interrelated and the occurrence of one or more of them may exacerbate the effect of others. You should carefully read and consider the following risks factors, together with the other information contained in or incorporated by reference into this Report before investing in shares of our common stock.

Risks Related To Our Business

Outbreaks of communicable diseases, (such as COVID-19 and its variants), have led to periods of significant volatility in financial, commodities (including oil and gas) and other markets, adversely affected our ability to conduct normal business, adversely affected our clients, and are likely to harm our businesses, financial condition and results of operations.

Pandemics and widespread outbreaks of communicable diseases (such as COVID-19) have caused and may continue to cause significant disruption in the international and United States economies and financial markets and have had an adverse effect on our business and results of operations. This has recently been accompanied by a surge in flu and other respiratory illnesses of varying seriousness and magnitude. The spread of these diseases, including COVID variants, has caused illness and death resulting in quarantines, cancellation of events and travel, business and school shutdowns, reduction in business activity and financial transactions, supply chain interruptions, and overall economic and financial market instability. In response to the COVID-19 pandemic, the governments of the states in which we have branches, and most other states, periodically took preventative or protective actions, such as imposing restrictions on travel and business operations, advising or requiring individuals to limit or forego their time outside of their homes, and ordering temporary closures of businesses that have been deemed to be non-essential. These restrictions and other consequences of public health issues resulted in significant adverse effects for many different types of businesses, including, among others, those in the hospitality (including hotels and lodging) and restaurant industries, and resulted in a significant number of layoffs and furloughs of employees nationwide and in the regions in which we operate.

As a business operating in the financial services industry, our business and operations may be adversely affected in numerous and complex ways by weak economic conditions.

Our business and operations, which primarily consist of lending money to clients in the form of loans, borrowing money from clients in the form of deposits and investing in securities, are sensitive to general business and economic conditions in the United States. If the U.S. economy weakens, our growth and profitability from our lending, deposit and investment operations could be constrained. Uncertainty about the federal fiscal policymaking process, the medium- and long-term fiscal outlook of the federal government, and future tax rates is a concern for businesses, consumers and investors in the United States. In addition, economic and other conditions in foreign countries could affect the stability of global financial markets, which could hinder United States economic growth.

Weak economic conditions may be characterized by numerous factors; such as deflation, fluctuations in debt and equity capital markets, a lack of liquidity and/or depressed prices in the secondary market for mortgage loans, increased delinquencies on mortgage, consumer and commercial loans, residential and commercial real estate price declines and lower home sales and commercial activity. All of these factors can individually or in the aggregate be detrimental to our business, and the interplay between these factors can be complex and unpredictable. Adverse economic conditions could have a material adverse effect on our assets, business, cash flow, condition (financial or otherwise), liquidity, prospects and results of operations.

Our business and operations are concentrated in our Target Market (References herein to our “Target Market” includes the state of Tennessee, Asheville, NC, and geographical areas within a 100-mile radius of any of our

banking locations), and we are more sensitive than our more geographically diversified competitors to adverse changes in the local economy.

Unlike with many of our larger competitors that maintain significant operations located outside our market area, substantially all of our clients are individuals and businesses located and doing business in our Target Market. As of December 31, 2023, approximately 90% of the loans in our loan portfolio (measured by dollar amount) were made to borrowers who live or conduct business in our Target Market. Therefore, our success will depend in large part upon the general economic conditions in this area, which we cannot predict with certainty. As a result, our operations and profitability may be more adversely affected by a local economic downturn in our Target Market than those of larger, more geographically diverse competitors. From time to time, our bank may provide financing to clients who own or have companies or properties located outside our Target Market. In such cases, we would face similar local market risk in those communities for these clients.

Competition from financial institutions and other financial service providers may adversely affect our profitability.

The banking business is highly competitive, and we experience competition in our market from many other financial institutions. We compete with commercial banks, credit unions, savings and loan associations, mortgage banking firms, internet banks, consumer finance companies, securities brokerage firms, insurance companies, money market funds, and other mutual funds, as well as other community banks and super-regional and national financial institutions that operate offices in our service area. These competitors have differing levels of marketing resources, capital, regulatory requirements, and funding.

We compete with these other financial institutions both in attracting deposits, in making loans, and in hiring staff. Our profitability depends upon our continued ability to successfully compete with an array of financial institutions in our service area.

We are dependent on the services of our management team and board of directors, and the unexpected loss of key personnel or directors may adversely affect our business and operations.

We are led by an experienced management team with substantial experience in the markets that we serve, and our operating strategy focuses on providing products and services through long-term relationship managers and ensuring that our largest clients have relationships with our senior management team. Accordingly, our success depends in large part on the performance of these key personnel, as well as on our ability to attract, motivate and retain highly qualified senior and middle management. Competition for employees is intense, and the process of locating key personnel with the combination of skills and attributes required to execute our business plan may be lengthy. If any of our executive officers, other key personnel, or directors leaves us or our bank, our operations may be adversely affected. Additionally, our directors’ community involvement and diverse and extensive local business relationships are important to our success.

Our reputation is critical to our business, and damage to it could have a material adverse effect on us.

The Company faces threats to its reputation from many sources, including adverse sentiment about financial institutions generally, unethical practices, employee misconduct, failure to deliver expected standards of service or quality, regulatory compliance deficiencies, and questionable or fraudulent activities of the Company’s employees and customers. Negative publicity may arise regarding the Company’s business, employees, or customers, with or without merit, and could result in the loss of customers, investors and employees, costly litigation, a decline in revenue, and increased regulatory oversight.

Credit and Interest Rate Risks

The Company is subject to lending risk, and the impacts of interest rate changes could adversely impact the Company.

There are inherent risks associated with the Company’s lending activities. These risks include, among other things, the impact of changes in interest rates and changes in the economic conditions in the markets where the Company operates. Increases in interest rates and/or weakening economic conditions could adversely impact the ability of borrowers to repay outstanding loans or the value of the collateral securing these loans. The Company is also subject to various laws and regulations that affect its lending activities. Failure to comply with applicable laws and regulations

could subject the Company to regulatory enforcement action that could result in restrictions of the Company's activities or the assessment of significant civil money penalties against the Company.

As of December 31, 2023, approximately 33.5% of our loan portfolio was composed of non-owner occupied commercial real estate loans, 12.4% of owner occupied commercial real estate loans, 18.7% consumer real estate loans, and 9.4% construction and land development loans. The Company's concentration of loans secured by real estate may subject the Company to additional risk, such as fluctuations in market value of collateral, environmental liability associated with hazardous or toxic substances found on, in or around the collateral, and difficulty monitoring income-producing property serving as a source of repayment and collateral. Additionally, non-owner occupied commercial real estate loans typically involve repayment dependent upon income generated, or expected to be generated, by the property securing the loan in amounts sufficient to cover operating expenses and debt service. Weak economic conditions or other market factors can result in increased vacancy rates for retail, office and industrial property. The adequacy of such income for repayment may be adversely affected by changes in the economy or local market conditions.

Additionally, we target small and medium sized businesses as loan clients. Because of their size, these borrowers may be less able to withstand competitive, economic or financial pressures than larger borrowers in periods of economic weakness. If loan losses occur at a level where the allowance for loan losses is not sufficient to cover actual loan losses, our earnings will decrease.

We may not be able to adequately assess and limit our credit risk, which could adversely affect our profitability.

A primary component of our business involves making loans to clients. The business of lending is inherently risky because the principal or interest on the loan may not be repaid timely or at all or the value of any collateral supporting the loan may be insufficient to cover our outstanding exposure. These risks may be affected by the strength of the borrower’s business sector and local, regional and national market and economic conditions. Our risk management practices, such as monitoring our loan applicants and the concentration of our loans and our credit approval practices, may not adequately assess credit risk, and our credit administration personnel, policies and procedures may not adequately adapt to changes in economic or any other conditions affecting clients and the quality of the loan portfolio. A failure to effectively assess and limit the credit risk associated with our loan portfolio could have a material adverse effect on our assets, business, cash flow, condition (financial or otherwise), liquidity, prospects and results of operations.

Our allowance for credit losses may prove to be insufficient to absorb losses inherent in our loan portfolio.

We maintain an allowance for credit losses that represents management’s best estimate of the credit losses and risks inherent in our loan portfolio. The level of the allowance reflects management’s continuing evaluation of concentrations, specific credit risks, loan loss experience, current loan portfolio quality, present economic, political and regulatory conditions and unidentified losses inherent in the current loan portfolio. The determination of the appropriate level of the allowance for credit losses is highly subjective and requires us to make significant estimates of current credit risks and future trends, all of which may undergo material changes in a relatively short time period. Inaccurate management assumptions, continuing deterioration of economic conditions affecting borrowers, new information regarding existing loans, identification of additional problem loans and other factors, both within and outside of our control, may require us to increase our allowance for loan losses. In addition, our regulators, as an integral part of their examination process, periodically review our loan portfolio and the adequacy of our allowance for credit losses and may require adjustments based upon judgments that are different than those of management. Further, if actual charge-offs in future periods exceed the amounts allocated to the allowance for credit losses, we may need to increase our provision for credit losses to restore the adequacy of our allowance for such losses. If we are required to materially increase our level of allowance for credit losses for any reason, our assets, business, cash flow, condition (financial or otherwise), liquidity, prospects and results of operations could be materially and adversely affected.

The value of real estate collateral may fluctuate significantly resulting in an under-collateralized loan portfolio.

The market value of real estate, particularly real estate held for investment, can fluctuate significantly in a short period of time as a result of market conditions in the geographic area in which the real estate is located. If the value of the real estate serving as collateral for the Company's loan portfolio were to decline materially, a significant part of the Company's loan portfolio could become under-collateralized. If the loans that are collateralized by real estate become troubled during a time when market conditions are declining or have declined, then, in the event of foreclosure, we may not be able to realize the amount of collateral that we anticipated at the time of originating the loan. This could

have a material adverse effect on the Company's provision for credit losses and the Company's operating results and financial condition.

We engage in lending secured by real estate and may be forced to foreclose on the collateral and own the underlying real estate, subjecting us to the costs and potential risks associated with the ownership of the real property.

Since we originate loans secured by real estate, we may have to foreclose on the collateral property to protect our investment and may thereafter own and operate such property, in which case we would be exposed to the risks inherent in the ownership of real estate. The amount that we, as a mortgagee, may realize after a default is dependent upon factors outside of our control, including, but not limited to general or local economic conditions, environmental cleanup liability, neighborhood assessments, interest rates, real estate tax rates, operating expenses of the mortgaged properties, supply of and demand for rental units or properties, ability to obtain and maintain adequate occupancy of the properties, zoning laws, governmental and regulatory rules, fiscal policies, and natural disasters. Our inability to manage the amount of costs or size of the risks associated with the ownership of real estate, or write-downs in the value of other real estate owned, could have a material adverse effect on our assets, business, cash flow, condition (financial or otherwise), liquidity, prospects and results of operations.

We have several large depositor relationships, the loss of which could force us to fund our business through more expensive and less stable sources.

As of December 31, 2023, our ten largest non-brokered depositors accounted for approximately 10% of our total deposits. Withdrawals of deposits by any one of our largest depositors could force us to rely more heavily on borrowings and other sources of funding for our business and withdrawal demands, adversely affecting our net interest margin and results of operations.

Liquidity risk could impair our ability to fund operations and meet our obligations as they become due, and our funding sources may be insufficient to fund our future growth.

Liquidity is essential to our business. An inability to raise funds, at competitive rates or at all, through deposits, borrowings, the sale of loans and other sources could have a substantial negative effect on our liquidity. Approximately 75.3% of our bank’s deposits as of December 31, 2023, were checking accounts and other liquid deposits, which are payable on demand or upon several days’ notice, while by comparison, 72.2% of the assets of our bank were loans at December 31, 2023, which cannot be called or sold in the same time frame. Our access to funding sources in amounts adequate to finance our activities or on terms that are acceptable to us could be impaired by factors that affect us specifically or the financial services industry or economy in general.

Factors that could negatively impact our access to liquidity sources include a decrease of our business activity as a result of a downturn in the markets in which our loans are concentrated, adverse regulatory action against us, or our inability to attract and retain deposits. Market conditions or other events could also negatively affect the level or cost of funding, affecting our ongoing ability to accommodate liability maturities and deposit withdrawals, meet contractual obligations and fund asset growth and new business transactions at a reasonable cost, in a timely manner and without adverse consequences.

Additionally, secondary market residential loans may require us to repurchase or substitute mortgage loans, or indemnify buyers against losses, in the event we breach representations or warranties to purchasers, guarantors and insurers, including government-sponsored entities, about the mortgage loans and the manner in which they were originated. In addition, we may be required to repurchase mortgage loans as a result of early payment default of the borrower on a mortgage loan. If repurchase and indemnity demands increase and such demands are valid claims and are in excess of our provision for potential losses, our liquidity, results of operations and financial condition may be adversely affected.

Any substantial, unexpected or prolonged change in the level or cost of liquidity could have a material adverse effect on our ability to meet deposit withdrawals and other client needs, which could have a material adverse effect on our asset growth, new business transactions, cash flow, condition (financial or otherwise), liquidity, prospects and results of operations.

Changes to interest rates could impact the financial outcomes of the Company.

Changes in monetary policy, including changes in interest rates, could influence not only the interest income the Company receives on loans and securities and the amount of interest it pays on deposits and borrowings, but such changes could also affect (i) the Company’s ability to originate loans and obtain deposits, (ii) the fair value of the Company’s financial assets and liabilities, and (iii) the average duration of the Company’s mortgage-backed securities portfolio. The Company’s earnings and cash flows are largely dependent upon its net interest income. Net interest income is the difference between interest income earned on interest-earning assets, such as loans and securities, and

interest expense paid on interest-bearing liabilities, such as deposits and borrowed funds. Interest rates are highly sensitive to many factors that are beyond the Company’s control, including general economic conditions and policies of various governmental and regulatory agencies and, in particular, the Board of Governors of the Federal Reserve System. If the interest rates paid on deposits and other borrowings increase at a faster rate than the interest rates received on loans and other investments, the Company’s net interest income, and therefore its earnings and net profit, could be adversely affected. Earnings also could be adversely affected if the interest rates received on loans and other investments fall more quickly than the interest rates paid on deposits and other borrowings. Changes in interest rates may also negatively affect the ability of the Company's borrowers to repay their loans, particularly as interest rates rise and adjustable-rate loans become more expensive.

Although management believes it has implemented effective asset and liability management strategies, including the use of derivatives as hedging instruments, to reduce the potential effects of changes in interest rates on the Company’s results of operations, any substantial, unexpected, prolonged change in market interest rates could have a material adverse effect on the Company’s financial condition and results of operations. Additionally, as indicated, many of our obligations, hedging transactions and portfolio loans have variable rate pricing that, following the transition from LIBOR, now are based upon other benchmark rates, such as SOFR - any uncertainties associated with these benchmark rates may affect our ability to effectively manage interest rate risk.

See the section Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations – Market and Liquidity Risk Management – Interest Rate Simulation Sensitivity Analysis" located elsewhere in this report for further discussion related to the Company’s management of interest rate risk.

The fair value of our investment securities could fluctuate because of factors outside of our control, which could have a material adverse effect on us.

Factors beyond our control could significantly affect the fair value of our investment securities. These factors include, but are not limited to, rating agency actions in respect of the securities, defaults by the issuer or with respect to the underlying securities, changes in market interest rates and instability in the capital markets. Any of these factors, among others, could cause realized and/or unrealized losses in future periods and declines in earnings and/or other comprehensive income (loss), which could materially and adversely affect our assets, business, cash flow, condition (financial or otherwise), liquidity, prospects and results of operations. The process for determining whether impairment of a security triggers a provision for credit losses usually requires complex, subjective judgments about the future financial performance and liquidity of the issuer, any collateral underlying the security as well as the Company’s intent and ability to hold the security for a sufficient period of time to allow for any anticipated recovery in fair value in order to assess the probability of receiving all contractual principal and interest payments on the security. Our failure to assess any impairments or losses with respect to our securities could have a material adverse effect on our assets, business, cash flow, condition (financial or otherwise), liquidity, prospects and results of operations.

Strategic Risks

Acquisition and other growth opportunities may present challenges

Any future acquisitions may result in unforeseen difficulties, which could require significant time and attention from the Company’s management that would otherwise be directed at developing its existing business and managing expenses. In addition, the Company could discover undisclosed liabilities resulting from any acquisitions for which it may become responsible. Further, the benefits that the Company anticipates from these acquisitions may not develop. We may experience difficulty integrating businesses acquired through mergers and acquisitions and may fail to realize the expected revenue increases, cost savings, increases in market presence, and other projected benefits from acquisition activity. Acquisitions utilizing the Company’s common stock as consideration may dilute the value of the Company’s common stock, which dilution may not be recouped or recovered for a significant amount of time after the acquisition, if ever.

Any merger or acquisition opportunity that we decide to pursue will ultimately be subject to regulatory approval and other closing conditions. We may expend significant time and resources pursing potential acquisitions that are never consummated due to lack of regulatory approval or other issues. Competition for acquisition candidates in the banking industry is intense. We may expend significant time and resources evaluating acquisition candidates and conducting due diligence that does not lead to an acquisition opportunity.

The Company may implement new lines of business, enter new market areas, or offer new products and services from time to time. There can be substantial risks and uncertainties associated with these efforts. The Company may invest

significant time and resources in developing and marketing new lines of business, but the benefits that the Company anticipates from these activities may not develop as expected. External factors, such as compliance with regulations, competitive alternatives, and shifting market preferences may impact the Company’s ability to successfully implement organic growth strategies. Failure to successfully manage these risks could have a material adverse effect on the Company’s financial condition and results of operations.

Our continued pace of growth may require us to raise additional capital in the future to fund such growth, and the unavailability of additional capital on terms acceptable to us could adversely affect us or our growth.

We believe that we have sufficient capital to meet our capital needs for our immediate growth plans. However, we will continue to need capital to support our longer-term growth plans. If capital is not available on favorable terms when we need it, we may have to either issue common stock or other securities on less than desirable terms or reduce our rate of growth until market conditions become more favorable. Either of such events could have a material adverse effect on our assets, business, cash flow, condition (financial or otherwise), liquidity, prospects and results of operations.

Operational Risks

Deterioration in the fiscal position of the U.S. federal government and downgrades in the U.S. Department of the Treasury and federal agency securities could adversely affect us and our banking operations.

In addition to causing economic and financial market disruptions, any future downgrade, failure to raise the U.S. statutory debt limit, or deterioration in the fiscal outlook of the U.S. federal government, could, among other things, materially adversely affect the market value of the U.S. and other government and governmental agency securities that we hold, the availability of those securities as collateral for borrowing, and our ability to access capital markets on favorable terms. In particular, such events could increase interest rates and disrupt payment systems, money markets, and long-term or short-term fixed income markets, adversely affecting the cost and availability of funding, which could negatively affect our profitability. Also, the adverse consequences of any downgrade could extend to those to whom we extend credit and could adversely affect their ability to repay their loans. Any of these developments could have a material adverse effect on our assets, business, cash flow, condition (financial or otherwise), liquidity, prospects and results of operations.

We are subject to losses resulting from fraudulent and negligent acts on the part of loan applicants, our borrowers, other third parties, and our employees.

When we originate loans, we rely heavily upon information supplied by third parties, including the information contained in the loan application, property appraisal, title information and employment and income documentation. If any of this information is intentionally or negligently misrepresented and such misrepresentation is not detected prior to loan funding, the fair value of the loan may be significantly lower than expected. Whether a misrepresentation is made by the loan applicant, the borrower, another third party or one of our employees, we generally bear the risk of loss associated with the misrepresentation. The persons and entities involved in such a misrepresentation are often difficult to locate, and we are often unable to collect any monetary losses that we have suffered from them.

We may bear costs associated with the proliferation of computer theft and cyber-crime.

We necessarily collect, use and hold sensitive data concerning individuals and businesses with whom we have a banking relationship. Threats to data security, including unauthorized access and cyber-attacks, rapidly emerge and change, exposing us to additional costs for protection or remediation and competing time constraints to secure our data in accordance with client expectations and statutory and regulatory requirements. Although we actively invest in the security of our technological infrastructure, it is not feasible to defend against every risk posed by rapid technological development and the increasing sophistication of cyber criminals. Patching and other measures to protect existing systems and servers could be inadequate, especially on systems that are being retired. Controls employed by our information technology department and third-party vendors could prove inadequate. We could also experience a breach by intentional or negligent conduct on the part of our employees or other internal sources, software bugs or other technical malfunctions, or other causes. As a result of any of these threats, our client accounts may become vulnerable to account takeover schemes or cyber-fraud. Our systems and those of our third-party vendors may also become vulnerable to damage or disruption due to circumstances beyond our or their control, such as from network failures, viruses and malware, power anomalies or outages, natural disasters and catastrophic events. Additionally, the use of artificial intelligence could exacerbate many of these risks.

A breach of our security or the security of our third-party vendors that results in unauthorized access to our data could expose us to a disruption or challenges relating to our daily operations as well as to data loss, litigation, damages, fines and penalties, client notification requirements, significant increases in compliance costs, and reputational damage, any of which could individually or in the aggregate have a material adverse effect on our assets, business, cash flow, condition (financial or otherwise), liquidity, prospects and results of operations.

Our risk management framework may not be effective in mitigating risks and/or losses to us.

Our risk management framework is comprised of various processes, systems and strategies and is designed to manage the types of risk to which we are subject, including, among others, credit, liquidity, capital, financial performance, asset/liability, operational, compliance and regulatory, Community Reinvestment Act, or CRA, strategic and reputational, information technology and legal. Our framework also includes financial or other modeling methodologies that involve management assumptions and judgment. Our risk management framework may not be effective under all circumstances, including if our management fails to follow our credit policies and procedures, and thus, it may not adequately mitigate any risk or loss to us. If our framework is not effective, we could suffer unexpected losses and our assets, business, cash flow, condition (financial or otherwise), liquidity, prospects and results of operations could be materially and adversely affected. We may also be subject to potentially adverse regulatory consequences.

We depend on our information technology and telecommunications systems, and any systems failures or interruptions could adversely affect our operations and financial condition.

We rely heavily on communications and information systems to conduct our business. Any failure or interruption in the operation of these systems could impair or prevent the effective operation of our client relationship management, general ledger, deposit, lending or other functions. While we have policies and procedures designed to prevent or limit the effect of a failure or interruption in the operation of our information systems, there can be no assurance that any such failures or interruptions will not occur or, if they do occur, that they will be adequately addressed. The occurrence of any failures or interruptions impacting our information systems could damage our reputation, result in a loss of clients, and expose us to additional regulatory scrutiny, civil litigation, and possible financial liability, any of which could have a material adverse effect on our financial condition and results of operations.

We are dependent upon outside third parties for the processing and handling of our records and data.

We rely on software developed by third-party vendors to process various transactions. In some cases, we have contracted with third parties to run their proprietary software on our behalf. These systems include, but are not limited to, general ledger, payroll, employee benefits, loan and deposit processing, and securities portfolio accounting. For example, one vendor provides our core banking system through a service bureau arrangement. While we perform a review of controls instituted by the applicable vendors over these programs in accordance with industry standards and perform our own testing of user controls, we rely on the continued maintenance of controls by these third-party vendors, including safeguards over the security of client data. We may incur a temporary disruption in our ability to conduct business or process transactions, or incur damage to our reputation, if the third-party vendor fails to adequately maintain internal controls or institute necessary changes to systems. We may need to switch third-party service providers from time-to-time, which could result in disruption to our business processes, damage to our reputation and

a breach of our data security measures. Such a disruption or breach of security may have a material adverse effect on our business. In addition, we may not be able to obtain or continue to obtain licenses and technologies from these third parties on reasonable terms or at all.

We encounter technological change continually and have fewer resources than certain of our competitors to invest in technological improvements.

The financial services industry is undergoing rapid technological changes, with frequent introductions of new technology-driven products and services. In addition to serving clients better, the effective use of technology increases efficiency and enables financial institutions to reduce costs. Our success will depend in part on our ability to address our clients’ needs by using technology to provide products and services that will satisfy client demands for convenience, as well as to create additional efficiencies in our operations. Certain of our competitors have substantially greater resources to invest in technological improvements than us, and in the future, we may not be able to implement new technology-driven products and services timely, effectively or at all or be successful in marketing these products and services to our clients. For example, companies which claim to offer applications and services based on artificial intelligence are beginning to compete much more directly with traditional financial services companies in areas involving personal advice, including high-margin services such as financial planning and wealth management. As these technologies are improved in the future, we may, in order to remain competitive, be required to make significant capital expenditures, which may increase our overall expenses and have a material adverse effect on our net income. There is also no guarantee that any such investment in these products and services will create additional efficiencies in our operations.

We may be adversely affected by the lack of soundness of other financial institutions.

Our ability to engage in routine funding transactions could be adversely affected by the actions and soundness of other financial institutions. Financial services companies are interrelated as a result of trading, clearing, counterparty, and other relationships. We have exposure to different industries and counterparties, and through transactions with counterparties in the financial services industry, including brokers and dealers, commercial banks, investment banks, and other institutional clients. Defaults by, or even rumors or questions about, one or more financial services companies, or the financial services industry generally, have led to market-wide liquidity problems in the past and could lead to losses or defaults by us or by other institutions in the future. These losses or defaults could have a material adverse effect on our assets, business, cash flow, condition (financial or otherwise), liquidity, prospects and results of operations.

By engaging in derivative transactions, we are exposed to additional credit and market risk.

We use interest rate swaps to help manage our interest rate risk from recorded financial assets and liabilities when they can be demonstrated to effectively hedge a designated asset or liability and the asset or liability exposes us to interest rate risk. Hedging interest rate risk is a complex process, requiring sophisticated models and routine monitoring, and is not a perfect science. As a result of interest rate fluctuations, hedged assets and liabilities will appreciate or depreciate in market value. The effect of this unrealized appreciation or depreciation will generally be offset by income or loss on the derivative instruments that are linked to the hedged assets and liabilities. We also have derivatives that result from a service we provide to certain qualifying clients approved through our credit process, and therefore, are not used to manage interest rate risk in our assets or liabilities. By engaging in derivative transactions, we are exposed to credit and market risk. If the counterparty fails to perform, credit risk exists to the extent of the uncollateralized fair value gain in the derivative. Market risk exists to the extent that interest rate changes cause the value of our derivatives to decline – though to the extent the derivatives are effective hedges, changes in the value of derivatives could be largely offset by changes in the fair value of the hedged item. The existence of credit and market risk associated with our derivative instruments could adversely affect our net interest income and, therefore, could have a material adverse effect on our assets, business, cash flow, condition (financial or otherwise), liquidity, prospects and results of operations.

The Company’s controls and procedures may fail or be circumvented.

Any failure or circumvention of the Company’s controls and procedures or failure to comply with regulations related to controls and procedures could have a material adverse effect on the Company’s business, results of operations and financial condition. Management regularly reviews and updates the Company’s internal controls, disclosure controls and procedures, and corporate governance policies and procedures. Any system of controls, no matter how well designed and operated, is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met.

Changes in tax law and accounting standards could materially affect the Company's operations.

Changes in tax laws, or changes in the interpretation of existing tax laws, could materially adversely affect the Company’s operations. Similarly, new accounting standards, changes to existing accounting standards, and changes to the methods of preparing financial statements could impact the Company’s reported financial condition and results of operations. These factors are outside the Company’s control and it is impossible to predict changes that may occur and the effect of such changes.

If our allowance for credit losses was required to be increased because it is not large enough to cover expected losses in our loan portfolio, our results of operations and financial condition could be materially and adversely affected.

We maintain an allowance for credit losses ("ACL"), which is a reserve established through a provision for credit losses charged to expense. After adopting ASC 326, the ACL reflects our assessment of the current expected losses over the life of the loan using historical experience, current conditions and reasonable and supportable forecasts. CECL has created more volatility in the level of our ACL because it relies on macroeconomic forecasts. It is possible that CECL may increase the cost of lending in the industry and result in slower loan growth and lower levels of net income. The level of the allowance reflects our continuing evaluation of factors including current economic forecasts, historical loss experience, the volume and types of loans, and specific credit risks. The determination of the appropriate level of the ACL inherently involves subjectivity in our modeling and requires us to make estimates of current credit risks and future trends, all of which may undergo material changes or vary from our historical experience. Deterioration in economic conditions affecting borrowers, changing economic forecasts, new information regarding existing loans, identification of additional problem loans and other factors, both within and outside of our control, may require an increase in the ACL. If we are required to materially increase our level of ACL for any reason, such increase could adversely affect our business, financial condition and results of operations.

In addition, bank regulatory agencies periodically review our ACL and may require an increase in the provision for credit losses or the recognition of further loan charge-offs, based on judgments different than those of management. Furthermore, if charge-offs in future periods exceed the ACL, we will need additional provisions to increase the ACL. Any increases in the ACL will result in a decrease in net income and, possibly, capital, and may have a material adverse effect on our business, financial condition and results of operations. See the section Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations" located elsewhere in this Report for further discussion related to our process for determining the appropriate level of the ACL.

Small Business Administration lending and other government guaranteed lending is an important part of our business. Our government guaranteed lending programs are dependent upon the U.S. federal government, and we face specific risks associated with originating SBA and other government guaranteed loans.

Our SBA lending program is dependent upon the U.S. federal government. As an approved participant in the SBA Preferred Lender’s Program (an “SBA Preferred Lender”), we enable our customers to obtain SBA loans without being subject to the potentially lengthy SBA approval process necessary for lenders that are not SBA Preferred Lenders. The SBA periodically reviews the lending operations of participating lenders to assess, among other things, whether the lender exhibits prudent risk management. When weaknesses are identified, the SBA may request corrective actions or impose enforcement actions, including revocation of the lender’s SBA Preferred Lender status. If we lose our status as an SBA Preferred Lender, we may lose some or all of our customers to lenders who are SBA Preferred Lenders, and as a result we could experience a material adverse effect to our financial results. Any changes to the SBA program, changes to program-specific rules impacting volume eligibility under the guaranty program, as well as changes to the program amounts authorized by Congress, may also have a material adverse effect on our business. In addition, any default by the U.S. government on its obligations or any prolonged government shutdown could impede our ability to originate SBA loans or other government guaranteed loans or sell such loans in the secondary market, which could materially adversely affect our business, results of operations, and financial condition.

Generally, we sell the guaranteed portion of our SBA 7(a) loans in the secondary market. These sales result in premium income for us at the time of sale and create a stream of future servicing income, as we retain the servicing rights to these loans. For the reasons described above, we may not be able to continue originating these loans or sell them in the secondary market. Furthermore, even if we are able to continue to originate and sell SBA 7(a) loans in the secondary market, we might not continue to realize premiums upon the sale of the guaranteed portion of these loans, or the premiums may decline due to economic and competitive factors. When we originate SBA loans, we incur credit

risk on the non-guaranteed portion of the loans, and if a customer defaults on a loan, we share any loss and recovery related to the loan pro-rata with the SBA. If the SBA establishes that a loss on an SBA guaranteed loan is attributable to significant technical deficiencies in the manner in which the loan was originated, funded, or serviced by us, the SBA may seek recovery of the principal loss related to the deficiency from us. Generally, we do not maintain reserves or loss allowances for such potential claims and any such claims could materially adversely affect our business, financial condition, or results of operations.

The laws, regulations and standard operating procedures that are applicable to government guaranteed loan products may change in the future. We cannot predict the effects of these changes on our business and profitability. Because government regulation greatly affects the business and financial results of all commercial banks and bank holding companies and especially our organization, changes in the laws, regulations and procedures applicable to government guaranteed loans could adversely affect our ability to operate profitably.

The recognition of gains on the sale of loans and servicing asset valuations reflect certain assumptions.

We continue to expect that gains on the sale of U.S. government guaranteed loans will continue to comprise a significant component of our revenue. The gain on such sales recognized for year ended December 31, 2023 was $3.3 million. The determination of these gains is based on assumptions regarding the value of unguaranteed loans retained, servicing rights retained and deferred fees and costs, and net premiums paid by purchasers of the guaranteed portions of U.S. government guaranteed loans. The value of retained unguaranteed loans and servicing rights are determined based on market-derived factors such as prepayment rates, current market conditions and recent loan sales. Deferred fees and costs are determined using internal analysis of the cost to originate loans. Significant errors in assumptions used to compute gains on sale of loans or servicing asset valuations could result in material revenue misstatements, which may have a material adverse effect on our business, results of operations and profitability. In addition, while we believe these valuations reflect fair value and such valuations are subject to validation by an independent third-party, if such valuations are not reflective of fair market value then our business, results of operations and financial condition may be materially and adversely affected.

Severe weather, natural disasters, nuclear fallout, acts of war or terrorism, and other external events could significantly impact the Company's business.

Severe weather, natural disasters, nuclear fallout, health emergencies, acts of war or terrorism, and other adverse external events, especially those that directly affect the Company’s market areas, could have a significant impact on the Company’s ability to conduct business. These events could adversely affect the ability of borrowers to repay outstanding loans, decrease the value of collateral securing loans, cause significant property and infrastructure damage, and affect the stability of the Company’s deposit base. The Company may experience decreased revenue, increased charge-offs, and other expenses.

Climate change and societal responses to climate change could adversely affect our business and results of operations, including indirectly through impact to our customers.

The current and anticipated effects of climate change are creating an increasing level of concern for the state of the global environment. As a result, political and social attention to the issue of climate change has increased. In recent years, governments across the world have entered into international agreements to attempt to reduce global temperatures, in part by limiting greenhouse gas emissions. The United States Congress, state legislatures and federal and state regulatory agencies have continued to propose and advance numerous legislative and regulatory initiatives seeking to mitigate the effects of climate change. These agreements and measures may result in the imposition of taxes and fees, the required purchase of emission credits and the implementation of significant operational changes, each of which may require businesses to expend significant capital and incur compliance, operating, maintenance and remediation costs. Consumers and businesses also may change their behavior on their own as a result of these concerns. It is not possible to predict how climate change may impact our financial condition and operations; however, we operate in areas where our business and the activities of our customers could be impacted by the effects of climate change. The effects of climate change may include increased frequency or severity of weather-related events, such as severe storms, hurricanes, flooding and droughts and rising sea levels. These effects can disrupt business operations, damage property, devalue assets and change customer and business preferences, which may adversely affect borrowers, increase credit risk and reduce demand for our products and services. The Company and our customers will need to respond to new laws and regulations as well as consumer and business preferences resulting from climate change concerns. As a result, the Company and our customers may face cost increases, asset value reductions, operating process changes and the like. The impact to our customers will likely vary depending on their specific

attributes, including reliance on or role in carbon intensive activities. In addition, we could face reductions in creditworthiness on the part of some customers or in the value of assets securing loans.

Regulatory, Compliance, and Legal Risks

We operate in an extensively regulated industry.

The Company operates in a highly regulated environment and industry which is subject to supervision and regulation by a number of governmental regulatory agencies, including the Federal Reserve Board, the OCC, the TDFI and the FDIC. Regulations adopted by these agencies, which are generally intended to provide protection for depositors and customers rather than for the benefit of shareholders, govern a comprehensive range of matters including but not limited to (i) ownership and control of the Company's equity, (ii) acquisition of other companies and businesses, (iii) permissible activities, (iv) maintenance of adequate capital levels and (v) other operational aspects. Compliance with banking regulations is costly and restricts certain of our activities, including the payment of dividends, mergers and acquisitions, investments, loan amounts and concentrations, interest rates, opening and closing branch locations, and other activities. The bank regulatory agencies also possess broad authority to prevent or remedy unsafe or unsound practices or violations of law. These agencies have significant discretion in their ability to enforce penalties and further limit the Company's activities if the Company fails to comply with applicable regulations.

The Dodd-Frank Act instituted major changes to the bank and financial institutions regulatory regimes, and additional changes continue to be proposed and implemented by various regulatory agencies. Other changes to statutes, regulations or regulatory policies, including changes in interpretation or implementation of statutes, regulations or policies, could affect the Company in substantial and unpredictable ways. Such changes could subject the Company to reduced revenues, additional costs, limit the types of financial services and products the Company may offer and/or increase the ability of non-banks to offer competing financial services and products, among other things. The burden and expenses associated with regulatory compliance have been increasing and may continue to increase. Failure to comply with laws, regulations or policies could result in sanctions by regulatory agencies, civil money penalties and/or reputation damage, which could have a material adverse effect on the Company's business, financial condition and results of operations. Proposals to change the laws and regulations governing financial institutions are frequently raised in Congress and before bank regulatory authorities. Changes in applicable laws or regulations could materially affect the Company’s business, and the likelihood of any major changes in the future and their effects are impossible to determine. Moreover, it is impossible to predict the ultimate form any proposed legislation might take or how it might affect the Company.

We are required to act as a source of financial and managerial strength for our bank in times of stress.

Under federal law and long-standing Federal Reserve policy, we are expected to act as a source of financial and managerial strength to our bank, and to commit resources to support our bank if necessary. We may be required to commit additional resources to our bank at times when we may not be in a financial position to provide such resources or when it may not be in our, or our shareholders’ or creditors,’ best interests to do so. A requirement to provide such support is more likely during times of financial stress for us and our bank, which may make any capital we are required to raise to provide such support more expensive than it might otherwise be. In addition, any capital loans we make to our bank are subordinate in right of repayment to deposit liabilities of our bank. In the event of our bankruptcy, any commitment by us to a federal banking regulator to maintain the capital of our bank will be assumed by the bankruptcy trustee and entitled to priority of payment over general unsecured creditor claims.

We are or may become involved from time to time in suits, legal proceedings, information-gathering requests, investigations and proceedings by governmental and self-regulatory agencies that may lead to adverse consequences.

Many aspects of our business involve substantial risk of legal liability. From time to time, we are, or may become, the subject of lawsuits and related legal proceedings, governmental and self-regulatory agency information-gathering requests, reviews, investigations and proceedings and other forms of regulatory inquiry, including by bank regulatory agencies, the Securities and Exchange Commission, or SEC, and law enforcement authorities. The results of such proceedings could lead to significant civil or criminal penalties, including monetary penalties, damages, adverse judgments, settlements, fines, injunctions, restrictions on the way in which we conduct our business, or reputational harm.

Although we establish accruals for legal proceedings when information related to the loss contingencies represented by those matters indicates both that a loss is probable and that the amount of loss can be reasonably estimated, we may not have accruals for all legal proceedings where we face a risk of loss. In addition, due to the inherent subjectivity of the assessments and unpredictability of the outcome of legal proceedings, amounts accrued may not represent the ultimate loss to us from the legal proceedings or government or other inquiries. Thus, our ultimate losses may be higher, and possibly materially so, than the amounts accrued for legal loss contingencies, which could adversely affect our financial condition and results of operations.

Risks Related to Our Common Stock

Even though our common stock is currently traded on the Nasdaq Stock Market's Global Select Market, it has less liquidity than many other stocks quoted on a national securities exchange.

The trading volume in our common stock on the Nasdaq Global Select Market has been relatively low when compared with larger companies listed on the Nasdaq Global Select Market or other stock exchanges. Because of this, it may be more difficult for shareholders to sell a substantial number of shares for the same price at which shareholders could sell a smaller number of shares.

We cannot predict the effect, if any, that future sales of our common stock in the market, or the availability of shares of common stock for sale in the market, will have on the market price of our common stock. We can give no assurance that sales of substantial amounts of common stock in the market, or the potential for large amounts of sales in the market, would not cause the price of our common stock to decline or impair our future ability to raise capital through sales of our common stock.

The market price of our common stock has fluctuated significantly, and may fluctuate in the future. These fluctuations may be unrelated to our performance. General market or industry price declines or overall market volatility in the future could adversely affect the price of our common stock, and the current market price may not be indicative of future market prices.

A future issuance or future issuances of stock could dilute the value of our common stock.

Our charter permits us to issue up to an aggregate of 25.0 million shares of common stock. As of December 31, 2023, 20,707,356 shares of our common stock were issued and outstanding, including 203,161 shares of restricted common stock that have yet to vest. Those shares outstanding do not include the potential issuance, as of December 31, 2023, of 92,865 shares of our common stock subject to issuance upon exercise of outstanding stock options under the Stock Incentive Plan, and 1,046,291 additional shares of our common stock that were reserved for issuance under the Stock Incentive Plan. A future issuance of any new shares of our common stock would, and equity-related securities could, cause further dilution in the value of our outstanding shares of common stock.

Significant sales of our common stock by certain shareholders could affect the market value of our common stock.

Certain shares owned by larger shareholders represent a significant number of our issued and outstanding shares of common stock, and, if sold in the market all at once or at about the same time, could depress the market price of our common stock and could further affect our ability to raise equity capital. Further, we cannot predict the size or the effect, if any, that sales of these shares, or the perception that such sales could occur, may have on the market price of our shares of common stock or our ability to raise additional capital through the sale of equity securities. Any significant sales of these shares could have a materially adverse impact on our affairs, assets, business, cash flows, condition (financial or otherwise), credit quality, financial performance, liquidity, short- and long-term performance goals, prospects and results of operations or the trading price of our common stock.

We have the ability to incur debt and pledge our assets, including our stock in our bank, to secure that debt.

We have the ability to incur debt and pledge our assets to secure that debt. Absent special and unusual circumstances, a holder of indebtedness for borrowed money has rights that are superior to those of holders of our common stock. For example, interest must be paid to a lender before dividends can be paid to our shareholders, and, in the case of liquidation, our borrowings must be repaid before we can distribute any assets to our shareholders. Furthermore, we would have to make principal and interest payments on our indebtedness, which could reduce our profitability or result in net losses on a consolidated basis even if our bank were profitable.

The rights of our common shareholders would likely be subordinate to the rights of the holders of any preferred stock that we may issue in the future.

Our charter authorizes our board of directors to issue an aggregate of up to five million shares of preferred stock without any further action on the part of our shareholders. Our board of directors also has the power, without shareholder approval, to set the terms of any series of preferred stock that may be issued, including voting rights, dividend rights, and preferences over our common stock with respect to dividends or in the event of a dissolution, liquidation or winding up and other terms. Accordingly, you should assume that any shares of preferred stock that we may issue in the future will also be senior to our common stock. In the event that we issue preferred stock in the future that has preference over our common stock with respect to payment of dividends or upon our liquidation, dissolution or winding up, or if we issue preferred stock with voting rights that dilute the voting power of our common stock, the rights of the holders of our common stock or the market price of our common stock could be adversely affected.

We and our bank are subject to capital and other legal and regulatory requirements which restrict our ability to pay dividends.

We are subject to certain restrictions on the payment of cash dividends as a result of banking laws, regulations and policies. In addition, because our bank is our only material asset, our ability to pay dividends to our shareholders depends on our receipt of dividends from the bank, which is also subject to restrictions on dividends as a result of banking laws, regulations and policies.

Risks Related to the Proposed Merger With Old National

Failure to complete the Merger could negatively impact the Company.

If the Merger is not completed for any reason, there may be various adverse consequences and the Company may experience negative reactions from the financial markets and from its customers and employees. For example, the Company’s business may have been impacted adversely by the failure to pursue other beneficial opportunities due to the focus of management on the Merger, without realizing any of the anticipated benefits of completing the Merger. Additionally, if the Old National Merger Agreement is terminated, the market price of the Company common stock could decline to the extent that current market prices reflect a market assumption that the Merger will be beneficial and will be completed. The Company also could be subject to litigation related to any failure to complete the Merger or to proceedings commenced against the Company to perform its obligations under the Old National Merger Agreement. If the Old National Merger Agreement is terminated under certain circumstances, the Company may be required to pay a termination fee of $11.25 million to Old National.

Additionally, the Company has incurred and will incur substantial expenses in connection with the negotiation and completion of the transactions contemplated by the Old National Merger Agreement, as well as the costs and expenses of preparing, filing, printing, and mailing the proxy statement/prospectus, and all filing and other fees paid in connection with the Merger. If the Merger is not completed, the Company would have to pay these expenses without realizing the expected benefits of the Merger.

The Company will be subject to business uncertainties and contractual restrictions while the Merger is pending.

Uncertainty about the effect of the Merger on employees and customers may have an adverse effect on the Company. These uncertainties may impair the Company’s ability to attract, retain and motivate key personnel until the Merger is completed, and could cause customers and others that deal with the Company to seek to change existing business relationships with the Company. In addition, due to certain restrictions in the Old National Merger Agreement on the conduct of business prior to completing the Merger, we may be unable, during the pendency of the Merger to pursue certain actions, even if such actions would prove beneficial, and we may have to forgo certain opportunities we might otherwise pursue.

The Old National Merger Agreement may be terminated in accordance with its terms and the Merger may not be completed.

The Old National Merger Agreement is subject to a number of conditions which must be fulfilled in order to complete the Merger. These conditions to the closing may not be fulfilled in a timely manner or at all, and, accordingly, the

Merger may not be completed. In addition, the parties can mutually decide to terminate the Old National Merger Agreement at any time or Old National or the Company may elect to terminate the Old National Merger Agreement in certain other circumstances.

Because the market price of Old National common stock may fluctuate, the Company shareholders cannot be certain of the market value of the Merger consideration they will receive.

In the Merger, each share of Company common stock issued and outstanding immediately prior to the effective time, will be converted into 1.155 shares of Old National common stock. This exchange ratio is fixed and will not be adjusted for changes in the market price of either Old National common stock or the Company common stock. Changes in the price of Old National common stock between now and the time of the Merger will affect the value that the Company shareholders will receive in the Merger. Neither Old National nor the Company is permitted to terminate the Old National Merger Agreement as a result of any increase or decrease in the market price of Old National common stock or the Company common stock.

Stock price changes may result from a variety of factors, including general market and economic conditions, changes in Old National’s and the Company’s businesses, operations and prospects, the volatility in the prices of securities in global financial markets, including market prices of Old National, the Company and other banking companies, the effects of regulatory considerations and tax laws, many of which are beyond Old National’s and the Company’s control. Therefore, the Company shareholders will not know the market value of the consideration that they will receive until the effective time.

ITEM 1B. UNRESOLVED STAFF COMMENTS

None.

ITEM 1C. CYBERSECURITY

Cybersecurity is a high-priority item for legislators and regulators at the federal and state levels, as well as internationally. State and federal banking regulators have issued various policy statements and, in some cases, regulations, emphasizing the importance of technology risk management and supervision. These policy statements and regulations indicate that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. For example, a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyberattack involving destructive malware. Additionally, financial institutions are expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to cyberattacks.

There are a number of state and federal laws and regulations that govern financial privacy and cybersecurity. At the federal level, this includes the privacy protection provisions of the Graham Leach Bliley Act (“GLBA”) and related regulations, including Regulation P, which govern the treatment of nonpublic personal information. Under these privacy protection provisions, we are limited in our ability to disclose non-public information about consumers to nonaffiliated third parties. These limitations require disclosure of privacy policies and notices to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a nonaffiliated third party. Consumers also must be notified in the event of a data breach under applicable state laws. On April 1, 2022, a final rule issued by federal financial regulatory agencies became effective – that rule imposes upon banking organizations and their service providers notification requirements for significant cybersecurity incidents. Specifically, the rule requires banking organizations to notify their primary federal regulator as soon as possible and no later than 36 hours after the discovery of a “computer-security incident” that rises to the level of a “notification incident” as those terms are defined in the rule. Banks’ service providers are required under that rule to notify any affected bank to or on behalf of which the service provider provides services “as soon as possible” after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank for as much as four hours.

Additionally, effective December 9, 2022, the FTC’s amendments to the GLBA’s Safeguards Rule went into effect. That rule requires financial institutions to: (i) appoint a qualified individual to oversee and implement their information security programs; (ii) implement additional criteria for information security risk assessments; (iii) implement safeguards identified by assessments, including access controls, data inventory, data disposal, change management, and monitoring, among other things; (iv) implement information system monitoring in the form of either “continuous monitoring” or “periodic penetration testing;” (v) implement additional controls including training for security personnel, periodic assessment of service providers, written incident response plans, and periodic reports from the qualified individual to the board of directors. Additionally, multiple states and Congress are considering laws or regulations which could create new individual privacy rights and impose increased obligations on companies handling personal data.

Risk management and strategy.

In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and store sensitive data. “Information systems” means electronic information resources that we own or use, including physical or virtual infrastructure controlled by these information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the information necessary to maintain or support our operations. Because cybersecurity threats continue to evolve, we have been required and may continue to be required to expend significant resources to continue to implement, modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. Financial expenditures may also be required to meet regulatory changes in the information security and cybersecurity domains. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as the expanding use of internet banking, mobile banking and other technology-based products and services by us and our customers. See “Item 1A. – Risk Factors” in this Report for a further discussion of risks related to cybersecurity.

To address cybersecurity threats (defined as potential unauthorized occurrences on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems or any information residing in those systems therein), we have implemented an incident response policy (“IRP”), which includes our cybersecurity policy, plan, and associated playbooks. The IRP is a component of our overall enterprise risk management and business continuity frameworks. We employ an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity relative to our information systems, as well as to report on any suspected advanced persistent threats. The IRP is designed to allow for the detection and timely and efficient recovery from cybersecurity incidents (defined as unauthorized occurrences, or a series of related unauthorized occurrences, on or conducted through our information systems that jeopardize the confidentiality, integrity, or availability of those systems or any information residing therein) and events by providing a well-defined, organized approach for handling any potential threats to the confidentiality, integrity, and/or availability of our information systems.

The IRP generally is overseen by our Incident Response Team (“IRT”), which has designated an Incident Response Team Coordinator (“IRTC”). The IRTC is responsible for maintaining the IRP as well as testing and reporting to the appropriate internal committees, and our Board and its designated committee. Our Information Security Officer is the primary IRTC, however, if necessary we may assign the specific IRTC duties to a different staff member (technical staff or outsourced vendor if appropriate) for specific matters.

We contract with a third-party vendor who monitors our information systems for suspicious activity, such as unauthorized intrusions. Suspected or confirmed threats, incidents, or events, however, also may be reported by bank employees, customers, intrusion detection systems, third-party servicers, or government entities. Once reported, cybersecurity incidents are to be brought to the attention of the IRTC.

After receiving notice of a cybersecurity incident, the IRTC is responsible for investigating the threat to determine whether an actual incident has occurred and, if so, whether a more thorough assessment by the entire IRT is appropriate. During these assessments, steps may be taken to isolate affected systems. Outside advisors may be employed regarding the cybersecurity threat, including to conduct of legal and forensic investigations and work with other third-parties who might be engaged to assist in any response and associated publicity.

During or at the conclusion of an assessment of a cybersecurity incident, we will respond to the incident. The response will vary based upon the severity of the incident or event. In determining the level of response, we have identified four general classification levels for incidents. Incident and risk event levels each vary from no (or low) risk to high risk. The determination of the incident and risk level will dictate the level of personnel that will be responsible for addressing the incident, controlling the effects of the incident and formulating the response to the incident. Responses may include, when appropriate and/or required, notification to regulatory agencies (e.g., FDIC, FinCEN, SEC), authorities (e.g., F.B.I., Department of Justice), customers, third parties or internal personnel.

The IRT is responsible for providing an orderly response to security incidents and risk events; preventing a serious loss of profits, public confidence, or information assets by providing an immediate, effective, and skillful response to any unexpected event which negatively impacts the confidentiality, integrity, and/or availability of our systems, network, or the non-public personal information of its customers, interruptions to customers’ experiences, or other anomalous situations; taking the steps it deems necessary to contain, mitigate, or resolve a security incident or risk event; and investigating suspected security incidents and risk events in a timely and cost effective manner, reporting findings to management, determining an appropriate course of action, and coordinating communications to customers, regulatory authorities, and law enforcement agencies as necessary. Investigations at the lowest level of risk are coordinated by the IRTC. The IRT has increasing levels of responsibility and involvement in the next three levels of risk.

Following a cybersecurity incident, and during its investigation and the formulation of a response, our processes also envision measures designed to contain and/or eradicate the incident and prevent further effects. Once it is determined that the incident has been resolved, we then work to establish appropriate controls (if applicable) to address similar future events and/or prevent another similar event from occurring in the future. To date, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

Governance.

As indicated above, reports of cybersecurity incidents initially are to be brought to the attention of the IRTC, who determined the extent of involvement of the IRT. The IRT is comprised of the following core members who are to be included in the investigation of all cybersecurity incidents:

Depending upon the type of incident or event, representatives from other areas of the Company (e.g., senior executives such as our Chief Financial Officer and Chief Executive Officer, Legal/Compliance, Corporate Security, Internal Audit, Human Resources, Directors of Banking and Mortgage, Corporate Communications) may be included on any of these teams from time to time for a particular investigation/response.

The principal management personnel that are responsible for the assessment and management of our cybersecurity risks include:

As part of its oversight responsibilities over the Company risks and controls, the Board ultimately is responsible for overseeing our cyber and information security risks, including our program for GLBA compliance. The Board has delegated this responsibility to its Risk Committee. The highest-level rated incidents are brought immediately to the attention of the Chair of the Board and/or the Chair of the Risk Committee. At each regular meeting of the Risk Committee, our ISO reports to the Risk Committee regarding any level one through three events (non-critical to medium) threats, as well as security testing, training, audits, key cybersecurity metrics, and our efforts to identify, prepare for, prevent, and respond to critical threats. The Risk Committee receives regular updates on the status of our information security program, penetration testing results, infrastructure assessments, threat environment, security operations, operational events, vendor and supply chain security, and application/data security.

ITEM 2. PROPERTIES

We lease our headquarters and main branch office, which are located at 1201 Demonbreun Street, Suites 700 and 103, respectively, Nashville, Tennessee 37203. The Company owns 22 and leases nine banking locations or other properties, respectively, and leases three locations utilized by the Bank's Southland Finance subsidiary.

ITEM 3. LEGAL PROCEEDINGS

We and our subsidiaries may be involved from time to time in various routine legal proceedings incidental to our respective businesses. Neither we nor any of our subsidiaries are currently engaged in any pending material legal proceedings. However, see Part II, Item 9.B of this Annual Report on Form 10-K.

ITEM 4. MINE SAFETY DISCLOSURES

Not applicable.

PART II

ITEM 5. MARKET FOR REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES

CapStar Financial’s common stock is traded on the Nasdaq Global Select Market under the symbol “CSTR” and has traded on that market since September 22, 2016. Prior to that time, there was no established public trading market for our stock.

As of January 22, 2024, there were approximately 452 holders of record of shares of our common stock.

Dividend Policy

The Company generally pays dividends on a quarterly basis. As a Tennessee corporation and bank holding company, dividend payments are subject to numerous limitations. For additional information, see “Item 1. Business—Supervision and Regulation—Bank Regulation and Supervision—Payment of Dividends”, "Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations - Market and Liquidity Risk Management," and Note 16 of Notes to Consolidated Financial Statements.

Stock Performance Graph

The following stock performance graphs compare total shareholders' return (assuming reinvestment of dividends) on our common stock for the five year period ended December 31, 2023, as well as the Russell 2000 Index and ABA Nasdaq Community Bank Index for the same period.

Issuer Purchases of Equity Securities

The following table shows information relating to the repurchase of shares of common stock by the Company during the three months ended December 31, 2023.

(1) On May 25, 2023 the board of directors approved an update to the Company’s share repurchase program which authorized the Company to repurchase up to $20 million of shares of common stock after the previous $10 million program was completed. Related to the merger agreement with Old National Bancorp (NASDAQ: ONB), the plan was terminated effective October 27, 2023. The Company had repurchased $3.5 million of our common stock under the plan through termination date.

ITEM 6. [RESERVED]

ITEM 7. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

The following is a discussion of our financial condition and our results of operations as of and for the years ended December 31, 2023 and 2022. The purpose of this discussion is to focus on information about our financial condition and results of operations which is not otherwise apparent from the Consolidated Financial Statements appearing under the caption “Part II., Item 8—Financial Statements and Supplementary Data” in this Report. The following discussion and analysis should be read together with our Consolidated Financial Statements, the notes to our Consolidated Financial Statements and the other financial information included elsewhere in this Report. In addition to historical information, this discussion and analysis contains forward-looking statements that involve risks, uncertainties, estimates and assumptions that could cause actual results to differ materially from our current expectations. Factors that could cause such differences are discussed in the sections entitled “Risk Factors” and “Cautionary Note Regarding Forward-Looking Statements” appearing elsewhere in this Report. We assume no obligation to update any of these forward-looking statements except to the extent required by applicable law.

The following discussion and analysis pertains to our historical results on a consolidated basis. However, because we conduct all of our material business operations through our wholly-owned subsidiary, CapStar Bank, the following discussion and analysis relates to activities primarily conducted at the subsidiary level.

All dollar amounts in the tables in this section are in thousands of dollars, except per share data or when otherwise specifically noted. Unless specifically noted in this Report, all references in this section to the fiscal years 2021, 2022 and 2023 mean our fiscal years ended December 31, 2021, 2022, and 2023, respectively.

Recent Events

On October 26, 2023, Old National and the Company entered into a definitive merger agreement for Old National (the "Old National Merger Agreement") to acquire CapStar in an all-stock transaction with an aggregate value of approximately $344 million, or $16.64 per share of CapStar common stock, based on Old National’s 30-day volume weighted average closing stock price ending October 25, 2023 (the "Merger"). Under the terms of the Old National Merger Agreement, shareholders of the Company will receive, in respect of each share of common stock of the Company held by them, 1.155 shares of common stock of Old National. Following the Merger (on a date to be determined by Old National), CapStar Bank will merge with and into Old National Bank, a wholly-owned subsidiary of Old National, with Old National Bank as the surviving bank (the "Bank Merger"). On February 21, 2024, the Company disclosed that the Board of Governors of the Federal Reserve System approved the Merger and the Office of the Comptroller of the Currency approved the Bank Merger. On February 29, 2024, the Company's shareholders approved the Merger at a special meeting.

Critical Accounting Estimates

Our accounting and reporting policies are in accordance with GAAP and conform to general practices within the banking industry. Application of these policies requires management to make numerous estimates, assumptions or judgments that affect the amounts reported in the financial statements and the accompanying notes. These estimates are based on information available as of the date of the financial statements; accordingly, as this information changes, it could materially and adversely affect our reported results and financial position for the current period or future periods. The use of estimates, assumptions, and judgments are necessary when financial assets and liabilities are required to be recorded at, or adjusted to reflect, fair value. Assets carried at fair value inherently result in more financial statement volatility. Fair values and information used to record valuation adjustments for certain assets and liabilities are either based on quoted market prices or are provided by other independent third-party sources, when available. When such information is not available, management estimates valuation adjustments based upon historical experience and on various other assumptions that we believe to be reasonable under the circumstances. Management evaluates our estimates and assumptions on an ongoing basis. Changes in underlying factors, assumptions or estimates in any of these areas could have a material impact on our future financial condition and results of operations.

Our Consolidated Financial Statements are prepared based on the application of certain accounting policies, the most significant of which are described in Note 1 to our Consolidated Financial Statements for the year ended December 31, 2023, which are contained elsewhere in this Report. Certain policies inherently have a greater reliance on the use of estimates, assumptions or judgments and as such, have a greater possibility of producing results that could be materially different than originally reported. We have identified the following accounting policies and estimates that, due to the difficult, subjective or complex judgments and assumptions inherent in those policies and estimates and the

potential sensitivity of our financial statements to those judgments and assumptions, are critical to an understanding of our financial condition and results of operations. We believe that the judgments, estimates and assumptions used in the preparation of our financial statements are reasonable and appropriate.

Allowance for Credit Losses ("ACL")

Since the adoption of CECL on January 1, 2023, the ACL represents management’s estimate of credit losses for the remaining estimated life of financial instruments, with particular applicability on our balance sheet to loans and unfunded loan commitments. Estimating the amount of the ACL requires significant judgment and the use of estimates related to historical experience, current conditions, reasonable and supportable forecasts, and the value of collateral on collateral-dependent loans. The loan portfolio also represents the largest asset type on our consolidated balance sheet. Loan losses are charged against the allowance, while recoveries of amounts previously charged off are credited to the allowance. A provision for credit losses is charged to operations based on management’s periodic evaluation of the factors previously mentioned, as well as other pertinent factors.

There are many factors affecting the ACL; some are quantitative while others require qualitative judgment. Although management believes its process for determining the allowance adequately considers all the potential factors that could potentially result in credit losses, the process includes subjective elements and is susceptible to significant change. To the extent actual outcomes differ from management estimates, additional provision for credit losses could be required that could adversely affect our earnings or financial position in future periods.

Note 1 to the consolidated financial statements includes additional information on accounting policies related to the ACL.

Income Taxes

Deferred income tax assets and liabilities are computed using the asset and liability method, which recognizes a liability or asset representing the tax effects, based on current tax law, of future deductible or taxable amounts attributable to events recognized in the financial statements. A valuation allowance may be established to the extent necessary to reduce the deferred tax asset to a level at which it is “more likely than not” that the tax asset or benefit will be realized. Realization of tax benefits depends on having sufficient taxable income, available tax loss carrybacks or credits, the reversal of taxable temporary differences and/or tax planning strategies within the reversal period, and that current tax law allows for the realization of recorded tax benefits.

Fair Valuation of Financial Instruments

Certain assets and liabilities are measured at fair value on a recurring basis, including securities and derivative instruments. Assets and liabilities carried at fair value inherently include subjectivity and may require the use of significant assumptions, adjustments and judgment including, among others, discount rates, rates of return on assets, cash flows, default rates, loss rates, terminal values and liquidation values. A significant change in assumptions may result in a significant change in fair value, which in turn, may result in a higher degree of financial statement volatility and could result in significant impact on our results of operations, financial condition or disclosures of fair value information.

The fair value hierarchy requires use of observable inputs first and subsequently unobservable inputs when observable inputs are not available. Our fair value measurements involve various valuation techniques and models, which involve inputs that are observable (Level 1 or Level 2 in fair value hierarchy), when available. The level of judgment required to determine fair value is dependent on the methods or techniques used in the process. Assets and liabilities that are measured at fair value using quoted prices in active markets (Level 1) do not require significant judgment while the valuation of assets and liabilities when quoted market prices are not available (Levels 2 and 3) may require significant judgment to assess whether observable or unobservable inputs for those assets and liabilities provide reasonable determination of fair value. See Note 22 to the Consolidated Financial Statements for additional information regarding the fair values measured at each level of the fair value hierarchy, additional discussion regarding fair value measurements, and a brief description of how fair value is determined for categories that have unobservable inputs.

Results of Operations

The following is a summary of our results of operations:

The following sections provide a more detailed analysis of significant factors affecting our operating results.

Net Interest Income

The largest component of our net income is net interest income – the difference between the interest income earned on loans, investment securities and other interest earning assets and interest expense on deposit accounts and other interest-bearing liabilities. Net interest income calculated on a tax-equivalent basis divided by total average interest-earning assets represents our net interest margin. The major factors that affect net interest income and net interest margin are changes in volumes, mix, the yield on interest-earning assets and the cost of interest-bearing liabilities. Our margin can also be affected by economic conditions, the competitive environment, loan demand and deposit flow. Our ability to respond to changes in these factors by using effective asset-liability management techniques is critical to maintaining the stability of the net interest margin and our net interest income.

The following table sets forth the average balances, interest income or interest expense for each category of interest-earning assets and interest-bearing liabilities and the average interest rate for interest-earning assets and interest-bearing liabilities, net interest spread and net interest margin for the years ended December 31, 2023, 2022 and 2021:

The following table reflects, for the periods indicated, the changes in our net interest income due to changes in the volume of interest-earning assets and interest-bearing liabilities and the associated rates earned or paid on these assets and liabilities.