First Financial Bankshares (FFIN) 10-K2023 FY Annual report

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

For the fiscal year ended December 31, 2023

or

For the transition period from to

Commission file number 0-07674

First Financial Bankshares, Inc.

(Exact name of registrant as specified in its charter)

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act:

None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit and post such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company or an emerging growth company. See the definitions of “large accelerated filer”, “accelerated file”, “smaller reporting company” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant's executive officers during the relevant recovery period pursuant to § 240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☒

As of June 30, 2023, the last business day of the registrant’s most recently completed second fiscal quarter, the aggregate market value of the registrant’s voting and non-voting common stock held by non-affiliates was $3.90 billion.

As of February 23, 2024, there were 142,751,867 shares of common stock outstanding.

Documents Incorporated by Reference

Certain information required by Part III is incorporated by reference to the proxy statement for our 2024 annual meeting of shareholders, which will be filed with the Securities and Exchange Commission not later than 120 days after December 31, 2023.

FIRST FINANCIAL BANKSHARES, INC.

FORM 10-K

For the Year Ended December 31, 2023

INDEX

PART I

CAUTIONARY STATEMENT REGARDING FORWARD-LOOKING STATEMENTS

This Form 10-K contains certain forward-looking statements within the meaning of Section 27A of the Securities Act of 1933 and Section 21E of the Securities Exchange Act of 1934. When used in this Form 10-K, words such as “anticipate,” “believe,” “estimate,” “expect,” “intend,” “predict,” “project,” “could,” “may,” or “would” and similar expressions, as they relate to us or our management, identify forward-looking statements. These forward-looking statements are based on information currently available to our management. Actual results could differ materially from those contemplated by the forward-looking statements as a result of certain factors, including, but not limited, to those listed in “Item 1A-Risk Factors” and the following:

In addition, financial markets and global supply chains may continue to be adversely affected by the current or anticipated impact of military conflict, including the current Russian invasion of Ukraine, the Israel-Palestine conflict and other world events, terrorism or other geopolitical events.

Such forward-looking statements reflect the current views of our management with respect to future events and are subject to these and other risks, uncertainties and assumptions relating to our operations, results of operations, growth strategies and liquidity. All subsequent written and oral forward-looking statements attributable to us or persons acting on our behalf are expressly qualified in their entirety by this paragraph. We undertake no obligation to publicly update or otherwise revise any forward-looking statements, whether as a result of new information, future events or otherwise (except as required by law).

General

First Financial Bankshares, Inc., a Texas corporation (the “Company”), is a financial holding company registered under the Bank Holding Company Act of 1956, as amended, or BHCA. As such, we are supervised by the Federal Reserve Board, as well as several other bank regulators. We were formed as a bank holding company in 1956 under the original name F & M Operating Company, but our banking operations date back to 1890, when Farmers and Merchants National Bank opened for business in Abilene, Texas. As of December 31, 2023, our wholly-owned subsidiaries, all of which are headquartered in Abilene, Texas, were:

Through our subsidiaries, we conduct a full-service commercial banking business. Our banking centers are located primarily in Central, North Central, Southeast and West Texas. As of December 31, 2023, we had 79 financial centers across Texas, with ten locations in Abilene, five locations in Bryan/College Station, three locations in Weatherford, two locations in Cleburne, Conroe, San Angelo, Stephenville, and Granbury, and one location each in Acton, Albany, Aledo, Alvarado, Beaumont, Boyd, Bridgeport, Brock, Burleson, Cisco, Clyde, Cut and Shoot, Decatur, Eastland, El Campo, Fort Worth, Franklin, Fulshear, Glen Rose, Grapevine, Hereford, Huntsville, Keller, Kingwood, Lumberton, Magnolia, Mauriceville, Merkel, Midlothian, Mineral Wells, Montgomery, Moran, New Waverly, Newton, Odessa, Orange, Palacios, Port Arthur, Ranger, Rising Star, Roby, Southlake, Spring, Sweetwater, Tomball, Trent, Trophy Club, Vidor, Waxahachie, Willis and Willow Park. Additionally, we operate mortgage loan offices in Austin and Addison, as well as Trust offices in Abilene, Beaumont, Bryan/College Station, Fort Worth, Houston, Odessa, San Angelo, Stephenville and Sweetwater.

Even though we operate in a growing number of Texas markets, we continue to believe that decisions are best made at the local level. Although we consolidated our bank charters into one charter in 2012, we continue to regionally manage our operations with local advisory boards of directors, local regional presidents and local decision-making processes. We have consolidated substantially all of the non-customer facing operations, such as investment securities, accounting, check processing, credit administration, risk management, treasury management, marketing, customer contact center, technology, training and human resources, which improved our efficiency and allows the regions to concentrate on serving the banking needs of their local communities.

We have chosen to keep our Company focused on the State of Texas, one of the nation’s largest, fastest-growing and most economically diverse states. With approximately 30.5 million residents as of December 31, 2022, Texas has more people than any other state except California. The population of Texas grew 16.94% from 2012-2022 according to the U.S. Census Bureau. Many of the communities in which we operate are also experiencing positive growth as shown below:

Population Growth 2012-2022 by City and County*

These economies include dynamic centers of higher education, agriculture, wind energy and natural resources, retail, military, technology, healthcare, tourism, retirement living, manufacturing and distribution.

We believe our community approach to doing business works best for us in small and mid-size markets, where we can play a prominent role in the economic, civic and cultural life of the community. Our goal is to serve these communities well and to experience growth as these markets continue to expand. In many instances, banking competition is less intense in smaller markets, making it easier for us to operate rationally and attract and retain high-caliber employees who prefer not only our community-bank concept but the high quality of life in smaller cities.

Over the years, we have grown in three ways: by growing organically, by opening new branch locations and by acquiring other banks. Since 1997, we have completed fourteen bank acquisitions and have increased our total assets from $1.57 billion to $13.11 billion as of December 31, 2023. Looking ahead, we intend to continue to grow organically by serving the needs of our customers and putting them first in all of our decisions. We continually look for better branch locations so we can provide more convenient service to our customers. We continue to evaluate opportunities to acquire high quality banks in the future.

When considering banks for acquisition, the subject bank generally needs to be well managed and profitable and align with our corporate culture. We have traditionally served rural and suburban communities and seek to enter growing communities consistent with our legacy markets. Generally we focus on non-metropolitan markets, either around Dallas/Fort Worth, Houston, San Antonio or Austin or along the Interstate 35, 45, 10 and 20 corridors in Texas as well as in East Texas and the Texas Hill Country area. Banks between $500 million and $3.0 billion in asset size fit our “sweet spot” for acquisition, but we would consider banks that are larger or that are in other areas of Texas if we believe they would be a cultural and financial fit for our Company.

Information on our financial condition and operating results appears in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” contained in Item 7 hereof.

First Financial Bankshares, Inc.

We provide management, technical resources and policy direction to our subsidiaries, which enable them to improve or expand their services while continuing their local activity and identity. Each of our subsidiaries operates under the day-to-day management of its own board of directors and officers. Our bank and subsidiaries have separate boards and the regions of the bank are guided by advisory boards of directors who are selected by the Company's board of directors.

In particular, we assist our subsidiaries with, among other things, decisions concerning major capital expenditures, insurance, finance and accounting, strategic planning, employee benefits, including retirement plans and group medical coverage, dividend policies, and appointment of officers and directors, including advisory directors, and their compensation. We also perform, through corporate staff groups or by outsourcing to third-parties, oversight of our subsidiaries. We provide advice and specialized services for our bank regions related to lending, investing, purchasing, advertising, public relations, and technology services.

We evaluate various potential financial institution acquisition opportunities and recommend approval to the board for potential locations for new branch offices by the bank. We anticipate that funding for any acquisitions or expansions would be provided from our existing cash balances, available dividends from our subsidiaries, utilization of available lines of credit, issuance of common stock to the acquired company’s shareholders and future debt or equity offerings.

Services Offered by Our Subsidiaries

Our subsidiary bank, First Financial Bank, N.A., is a separate legal entity that operates under the day-to-day management and oversight of its board of directors and officers. Our 12 banking regions, which operate under our subsidiary bank, each have separate regional advisory boards that make recommendations and provide assistance to regional management of the bank regions regarding the operations of their respective region. Each of our bank regions provides general commercial banking services, which include accepting and holding checking, savings and time deposits, making loans, offering automated teller machines (“ATMs”), drive-in and night deposit services, safe deposit facilities, remote deposit capture, internet banking, mobile banking, payroll cards, funds transfer, and performing other customary commercial banking services. In addition, we provide securities brokerage services through an arrangement with an unrelated third-party in our Abilene and San Angelo regions.

We also provide full-service trust and wealth management activities through our trust company, First Financial Trust & Asset Management Company, N.A. Our trust company has nine locations, which are all located in Texas in Abilene, Beaumont, Bryan/College Station, Fort Worth, Houston, Odessa, San Angelo, Stephenville and Sweetwater. Through our trust company, we offer personal trust services, which include wealth management, the administration of estates, oil and gas management, testamentary trusts, revocable and irrevocable trusts and agency accounts. We also administer all types of retirement and employee benefit accounts, which include 401(k) profit sharing plans and IRAs. The Company has been providing trust services since 1927.

Competition

Commercial banking in Texas is highly competitive, and because we hold less than 1% of the state’s deposits, we represent a smaller segment of the market share in Texas. To succeed in this industry, we believe that we must have the capability to compete effectively in the areas of interest rates paid or charged, scope of services offered, prices charged for such services, and personalized customer service delivered at the local level. Our bank regions compete in their respective service areas against highly competitive banks, thrifts, savings and loan associations,

small loan companies, credit unions, mortgage companies, insurance companies, Fintech, and brokerage firms, all of which are engaged in providing financial products and services and some of which are larger than us in terms of capital, resources and personnel.

Our business does not depend on any single customer or any few customers, and the loss of any one would not have a materially adverse effect upon our business. Although we have a broad base of customers that are not related to us, our customers also occasionally include our officers and directors, as well as other entities with which we are affiliated. Through our bank regions we may make loans to our officers and directors, and entities with which we are affiliated, in the ordinary course of business. We make these loans on substantially the same terms, including interest rates and collateral, as those prevailing at the time for comparable transactions with other persons. Loans to our directors, officers and their affiliates are also subject to numerous restrictions under federal banking laws, which we describe in greater detail below, under the heading “Supervision and Regulation – Loans to Directors, Executive Officers and Principal Shareholders.”

Human Capital

We operate as a community bank offering a wide range of commercial banking and related services to consumers, small businesses, corporations, non-profits, governmental entities, and others. A cornerstone of our operating model is based on personal relationships with our customers. Therefore, our model is heavily dependent on our personnel to execute our strategy within each region supported by our lines of business and operational support areas within the Company. Our executive leadership is critical to the success of our Company as each executive participates in developing our corporate strategy, policy setting, and oversight of each of their respective operating areas. The executive officers have significant banking experience and/or tenure with the Company, including our Chairman, CEO and President who has over forty-seven years with the Company. Our regional operating philosophy is heavily dependent on our Regional CEOs/Presidents who drive the daily execution of our strategy, customer service, and local decision-making, across our twelve regions. On average, our fourteen Regional or Divisional CEOs and Presidents have approximately twenty-seven years of banking experience and twelve years of service with the Company.

On December 31, 2023, the Company employed approximately 1,500 employees. Approximately 1,400 were full-time and 100 were part-time. All employees are located in the State of Texas. Our management believes that our employee relations have been and will continue to be good. None of our employees are represented by collective bargaining agreements.

We seek to attract the best bankers in the markets we serve as well as key managers and associates to serve and build relationships with our customers. On a day-to-day basis, these associates execute on our “Excellence in Customer Service” culture, including our 21 Non-Negotiables of Customer Service, which were developed by management with the assistance of Horst Schulze, the founder of The Ritz Carlton Hotel Company and an independent consultant to the Company for the last five years. Initially, each new associate attends New Employee Orientation to gain an understanding of our culture, including our customer service approach, our organization, and our operating and other policies. From there, associates also receive specific training for their applicable area of service.

We then provide a number of internally developed training programs and encourage associates to attend selected external programs. We require certain areas (lending, trust, risk, operations) to obtain certifications for their current and future roles in the organization (for example, most lenders are required to obtain the Credit Risk Certification from the Risk Management Association). For potential future management we require this group to attend a graduate school of banking, TBA Leadership course and FFIN University, which is our year long internal course which teaches how to manage a high performing bank. The Company also provides educational assistance for employees to further their professional development. In fact, six of our current Regional CEO/Presidents started their careers with the Company and progressed to their current levels over time.

We embrace and promote a culture of diversity, equity, and inclusion to attract, recruit, retain, develop, and promote employees who represent the diverse communities we serve. Our employees bring their own unique backgrounds, beliefs, cultures, and experiences to our organization. By promoting and fostering a workforce that we believe is reflective of our customers and communities, we seek to better understand the financial needs of our prospects and customers and provide them with relevant financial service products.

We celebrate our diverse and inclusive workplace as it brings new ideas, perspectives, and ways to enhance our overall customer and employee experience. Of our Regional and Divisional CEO/Presidents, four are women. Additionally, 1,058, or 71%, of our employees are female and 651, or 44%, of our employees are minorities, veterans and/or self-identify as disabled.

The Company provides, in addition to competitive salaries, either at the Company’s expense or through employee deductions, benefits to its associates to help protect their health and well-being, including athletic club membership, medical, dental, vision, employee assistance, short and long-term disability, life insurance, and paid time off (vacation, holidays and sick time). Additionally, through our 401(k) retirement benefits, and profit-sharing contributions (which also contains an employee stock ownership plan, or ESOP feature), the Company facilitates its associate’s future financial well-being. These benefits when combined with incentive compensation programs, both cash and equity based, serve as rewards for performance but also as a retention vehicle for our employee base. The Company has strong relationships with its employee base leading to an average tenure of approximately six years with the Company (including its predecessor banks). During 2023 and 2022, the Company incurred expenses totaling approximately $19.19 million and $22.42 million, respectively, for these benefits.

Understanding and supporting our communities has been a critical part of our Company’s success. We strive every day to improve the quality of life in every community that we serve. We support schools, cities, counties and churches with the latest in financial services, as well as our time and money. We provide leadership to our local nonprofits and churches by being on their boards, volunteering to raise money, as well as helping them provide services. In many cases, our employees chair their boards and give of their time freely. In addition to our continuous involvement, we perform an annual Company-wide day of service to help improve the communities in which we live and serve. In 2023, this amounted to approximately 7,400 hours of community service across our footprint.

Overall, the attraction, development and retention of our executives, regional presidents and associates are integral to the performance of our Company, which ultimately drives value to our shareholders in the form of dividends and price appreciation of our common stock. Accordingly, our Board of Directors participates in the oversight of our employment practices and policies, through the Compensation Committee. Our board sets the overall “tone at the top” and holds executive management accountable for embodying, maintaining, and communicating our culture to employees. Currently, our board is comprised of eleven members, including two females one of which is Hispanic, and one of which is an African-American male.

Supervision and Regulation

Both federal and state laws extensively regulate bank holding companies, financial holding companies and banks. These laws (and the regulations promulgated thereunder) are primarily intended to protect depositors and the deposit insurance fund (the “DIF”) of the Federal Deposit Insurance Corporation, (the "FDIC"). The following information describes particular laws and regulatory provisions relating to financial holding companies and banks. This discussion is qualified in its entirety by reference to the particular laws and regulatory provisions. A change in any of these laws or regulations may have a material effect on our business and the business of our subsidiaries. Political developments, including the change in administration of the United States federal government, have added additional uncertainty in the implementation, scope and timing of regulatory reforms.

Bank Holding Companies and Financial Holding Companies

Historically, the activities of bank holding companies were limited to the business of banking and activities closely related or incidental to banking. Bank holding companies were generally prohibited from acquiring control of any company that was not a bank and from engaging in any business other than the business of banking or managing and controlling banks. The Gramm-Leach-Bliley Act, which took effect on March 12, 2000, dismantled many Depression-era restrictions against affiliations between banking, securities and insurance firms by permitting bank holding companies to engage in a broader range of financial activities, so long as certain safeguards are observed. Specifically, bank holding companies may elect to become “financial holding companies” that may affiliate with securities firms and insurance companies and engage in other activities that are financial in nature or incidental to a financial activity. Thus, with the enactment of the Gramm-Leach-Bliley Act, banks, security firms and insurance companies find it easier to acquire or affiliate with each other and cross-sell financial products. The Gramm-Leach-Bliley Act permits a single financial services organization to offer a more complete array of financial products and services than historically was permitted.

A financial holding company is essentially a bank holding company with significantly expanded powers. Under the Gramm-Leach-Bliley Act, in addition to traditional lending activities, the following activities are among those that are deemed “financial in nature” for financial holding companies: securities underwriting, dealing in or making a market in securities, sponsoring mutual funds and investment companies, insurance underwriting and agency activities, activities which the Federal Reserve Board determines to be closely related to banking, and certain merchant banking activities.

We elected to become a financial holding company in September 2001. As a financial holding company, we have very broad discretion to affiliate with securities firms and insurance companies, provide merchant banking services, and engage in other activities that the Federal Reserve Board has deemed financial in nature. In order to continue as a financial holding company, our subsidiary bank must continue to be well-capitalized, well-managed and provide fair access to financial products and services. Depending on the types of financial activities that we may elect to engage in, under the Gramm-Leach-Bliley Act’s functional regulation principles, we may become subject to supervision by additional government agencies. The election to be treated as a financial holding company increases our ability to offer financial products and services that historically we were either unable to provide or were only able to provide on a limited basis. As a result, we will face increased competition in the markets for any new financial products and services that we may offer. Likewise, an increased amount of consolidation among banks and securities firms or banks and insurance firms could result in a growing number of large financial institutions that could compete aggressively with us.

Mergers and Acquisitions

We must obtain approval from the banking regulators before we can acquire other financial institutions. We may not engage in certain acquisitions if we are undercapitalized. Furthermore, the BHCA provides that the Federal Reserve Board cannot approve any acquisition, merger

or consolidation that may substantially lessen competition in the banking industry, create a monopoly in any section of the country, or be a restraint of trade. However, the Federal Reserve Board may approve such a transaction if the convenience and needs of the community clearly outweigh any anti-competitive effects. Specifically, the Federal Reserve Board would consider, among other factors, the expected benefits to the public (greater convenience, increased competition, greater efficiency, etc.) against the risks of possible adverse effects (undue concentration of resources, decreased or unfair competition, conflicts of interest, unsound banking practices, etc.).

Under the BHCA, the Company must obtain the prior approval of the Federal Reserve Board, or acting under delegated authority, the Federal Reserve Bank of Dallas before (1) acquiring direct or indirect ownership or control of any class of voting securities of any bank or bank holding company if, after the acquisition, the Company would directly or indirectly own or control 5% or more of the class, (2) acquiring all or substantially all of the assets of another bank or bank holding company, or (3) merging or consolidating with another bank holding company.

The Change in Bank Control Act of 1978, as amended, or the CIBCA, and the related regulations of the Federal Reserve Board require any person or groups of persons acting in concert (except for companies required to make application under the BHCA), to file a written notice with the Federal Reserve Board before the person or group acquires control of the Company. The CIBCA defines “control” as the direct or indirect power to vote 25% or more of any class of voting securities or to direct the management or policies of a bank holding company or an insured bank. A rebuttable presumption of control arises under the CIBCA where a person or group controls 10% or more, but less than 25%, of a class of the voting stock of a company or insured bank which is a reporting company under the Securities Exchange Act of 1934, as amended, such as the Company, or such ownership interest is greater than the ownership interest held by any other person or group.

Banks

Federal and state laws and regulations that govern banks have the effect of, among other things, regulating the scope of business, investments, cash reserves, the purpose and nature of loans, the maximum interest rate chargeable on loans, the amount of dividends declared, and required capitalization ratios.

Banks organized as national banking associations under the National Bank Act are subject to regulation and examination by the Office of the Comptroller of the Currency, or OCC. As a result, the OCC now supervises, regulates and regularly examines the following subsidiaries:

The OCC’s supervision and regulation of banks is primarily intended to protect the interests of depositors. The National Bank Act:

Deposit Insurance Coverage and Assessments

Our subsidiary bank is a member of the FDIC. Through the DIF, the FDIC provides deposit insurance protection that covers all deposit accounts in FDIC-insured depository institutions up to applicable limits (currently, $250 thousand per depositor).

Our subsidiary bank must pay deposit insurance assessments (or premiums) to the FDIC under a risk-based assessment system for this federal deposit insurance protection. FDIC-insured depository institutions pay insurance premiums at rates based on their risk classification. Institutions assigned to higher risk classifications (i.e., institutions that pose a greater risk of loss to the DIF) pay assessments at higher rates than institutions assigned to lower risk classifications. An institution’s risk classification is assigned based on its capital levels and the level of supervisory concern the institution poses to bank regulators. In addition, the FDIC can impose special assessments to cover shortages in the DIF and has imposed special assessments in the past. In the fourth quarter of 2023, the FDIC imposed a $1.75 million special assessment on the Bank in response to the FDIC-insured financial institutions that failed in March 2023.

The Dodd-Frank Act required the FDIC to offset the effect of increasing the reserve ratio on insured depository institutions with total consolidated assets of less than $10 billion. As a result of our subsidiary bank exceeding $10 billion in assets as of December 31, 2020, our subsidiary bank is no longer eligible to utilize future credits, if any, to offset its FDIC assessment.

Under the Dodd-Frank Act, for institutions with $10 billion or more in assets, the FDIC uses a performance score and a loss severity score that are used to calculate an initial assessment rate. In calculating these scores, the FDIC uses a bank's capital level and regulatory supervisory ratings and certain financial measures to assess an institution's ability to withstand asset-related stress and funding-related stress. The FDIC also has the ability to make discretionary adjustments to the total score based upon significant risk factors that are not adequately captured in the calculations.

Under the Financial Institutions Reform, Recovery, and Enforcement Act of 1989, or FIRREA, an FDIC-insured depository institution can be held liable for any losses incurred by the FDIC in connection with (1) the “default” of one of its FDIC-insured subsidiaries or (2) any assistance provided by the FDIC to one of its FDIC-receivers, and “in danger of default” is defined generally as the existence of certain conditions indicating that a default is likely to occur in the absence of regulatory assistance.

The FDIC is also empowered to regulate interest rates paid by insured banks. Approval by the FDIC is also required before an insured bank retires any part of its common or preferred stock, or any capital notes or debentures.

Payment of Dividends

We are a legal entity separate and distinct from our banking and other subsidiaries. We receive most of our revenue from dividends paid to us by our bank and trust company subsidiaries. Described below are some of the laws and regulations that apply when either we or our subsidiaries pay or paid dividends.

The Federal Reserve Board, the OCC and the FDIC have issued policy statements that recommend that bank holding companies and insured banks should generally only pay dividends to the extent net income is sufficient to cover both cash dividends and a rate of earnings retention consistent with capital needs, asset quality and overall financial condition. Further, the Federal Reserve Board’s policy provides that bank holding companies should not maintain a level of cash dividends that undermines the bank holding company’s ability to serve as a source of strength to its banking subsidiaries. In addition, the Federal Reserve Board has indicated that each bank holding company should carefully review its dividend policy, and has discouraged payment ratios that are at maximum allowable levels, which is the maximum dividend amount that may be issued and allow the company to still maintain its target Tier 1 capital ratio, unless both asset quality and capital are very strong.

To pay dividends, our subsidiaries must maintain adequate capital above regulatory guidelines. Under federal law, our subsidiary bank cannot pay a dividend if, after paying the dividend, the bank would be “undercapitalized.” Additionally, the maximum payout amount paid by our Company and subsidiary bank is restricted if regulatory capital ratios fall below capital conservation buffers. In addition, if the FDIC believes that a bank under its jurisdiction is engaged in, or is about to engage in, an unsafe or unsound practice (which, depending on the financial condition of the bank, could include the payment of dividends), the FDIC may require, after notice and hearing, that such bank cease and desist from the unsafe practice. The FDIC and the OCC have each indicated paying dividends that deplete a bank’s capital base to an inadequate level would be an unsafe and unsound banking practice.

National banks are required by federal law to obtain the prior approval of the OCC in order to declare and pay dividends if the total of all dividends declared in any calendar year would exceed the total of (1) such bank’s net profits (as defined and interpreted by regulation) for that year plus (2) its retained net profits (as defined and interpreted by regulation) for the preceding two calendar years, less any required transfers to surplus, or (3) its regulatory capital ratios fall below capital conservation buffers. In addition, these banks may only pay dividends to the extent that retained net profits (including the portion transferred to surplus) exceed bad debts (as defined by regulation).

Our subsidiaries paid aggregate dividends to us of $133.50 million in 2023 and $67.50 million in 2022. Under the dividend restrictions discussed above, as of December 31, 2023, our subsidiaries could have declared in the aggregate additional dividends of $387.33 million from retained net profits, without obtaining regulatory approvals.

Affiliate Transactions

The Federal Reserve Act, the Federal Deposit Insurance Act (“FDIA”) and the rules adopted under these statutes restrict the extent to which we can borrow or otherwise obtain credit from, or engage in certain other transactions with, our subsidiaries. These laws regulate “covered transactions” between insured depository institutions and their subsidiaries, on the one hand, and their non-depository affiliates, on the other hand. The Dodd-Frank Act expanded the definition of affiliate to make any investment fund, including a mutual fund, for which a depository institution or its affiliates serve as an investment advisor an affiliate of the depository institution. “Covered transactions” include a loan or

extension of credit to a non-depository affiliate, a purchase of securities issued by such an affiliate, a purchase of assets from such an affiliate (unless otherwise exempted by the Federal Reserve Board), an acceptance of securities issued by such an affiliate as collateral for a loan, and an issuance of a guarantee, acceptance, or letter of credit for the benefit of such an affiliate. The Dodd-Frank Act extended the limitations to derivative transactions, repurchase agreements and securities lending and borrowing transactions that create credit exposure to an affiliate or an insider. The “covered transactions” that an insured depository institution and its subsidiaries are permitted to engage in with their non-depository affiliates are limited to the following amounts: (1) in the case of any one such affiliate, the aggregate amount of “covered transactions” cannot exceed ten percent of the capital stock and the surplus of the insured depository institution; and (2) in the case of all affiliates, the aggregate amount of “covered transactions” cannot exceed twenty percent of the capital stock and surplus of the insured depository institution. In addition, extensions of credit that constitute “covered transactions” must be collateralized in prescribed amounts. Further, a bank holding company and its subsidiaries are prohibited from engaging in certain tie-in arrangements in connection with any extension of credit, lease or sale of property or furnishing of services. Finally, when we and our subsidiaries conduct transactions internally among us, we are required to do so at arm’s length.

Loans to Directors, Executive Officers and Principal Shareholders

The authority of our subsidiary bank to extend credit to our directors, executive officers and principal shareholders, including their immediate family members, corporations and other entities that they control, is subject to substantial restrictions and requirements under Sections 22(g) and 22(h) of the Federal Reserve Act and Regulation O promulgated thereunder, as well as the Sarbanes-Oxley Act of 2002. These statutes and regulations impose specific limits on the amount of loans our subsidiary bank may make to directors and other insiders, and specified approval procedures must be followed in making loans that exceed certain amounts. In addition, all loans our subsidiary bank makes to directors and other insiders must satisfy the following requirements:

Furthermore, our subsidiary bank must periodically report all loans made to directors and other insiders to the bank regulators, and these loans are closely scrutinized by the regulators for compliance with Sections 22(g) and 22(h) of the Federal Reserve Act and Regulation O. Each loan to directors or other insiders must be pre-approved by the bank’s board of directors with the interested director abstaining from voting.

Capital

We and our bank subsidiary are each required to comply with applicable capital adequacy standards established by the Federal Reserve Board and the OCC, respectively. The current risk-based capital standards applicable to us and our bank subsidiary are based on the December 2010 final capital framework for strengthening international capital standards of the Basel Committee on Banking Supervision (the “Basel III Rules”).

The Basel III Rules established three components of regulatory capital: (1) common equity tier 1 capital (“CET1”), (2) additional tier 1 capital, and (3) total capital. Tier 1 capital is the sum of CET1 and additional tier 1 capital instruments meeting certain revised requirements. Total capital is the sum of tier 1 capital and tier 2 capital elements. Under the Basel III Rules, for most banking organizations, the most common form of additional tier 1 capital is non-cumulative perpetual preferred stock, and the most common form of tier 2 capital is subordinated notes and a portion of the allocation for credit losses, in each case, subject to the Basel III Rules’ specific requirements. As of December 31, 2023, we do not have any non-cumulative perpetual preferred stock or subordinated notes. CET1, tier 1 capital, and total capital serve as the numerators for three prescribed regulatory capital ratios. Risk-weighted assets, calculated using the standardized approach in the Basel III Rules for us and our subsidiary bank, provide the denominator for such ratios. There is also a leverage capital ratio that compares tier 1 capital to average total assets.

Pursuant to the Basel III Rules, the effects of certain accumulated other comprehensive income or loss (“AOCI”) items are not excluded; however, “non-advanced approaches banking organizations,” including us and our subsidiary bank, were permitted to make a one-time permanent election to continue to exclude these items. The Company made its one-time, permanent election to continue to exclude AOCI from capital in its filing with the Federal Reserve Board and OCC for the quarter ended March 31, 2015. If the Company would not have made this election, unrealized gains and losses would have been included in the calculation of its regulatory capital. The Basel III Rules also preclude certain hybrid securities, such as trust preferred securities issued prior to May 19, 2010, from inclusion in our tier 1 capital, subject to grandfathering in the case of companies, such as us, that had less than $15 billion in total consolidated assets as of December 31, 2009.

Under the Basel III Rules, the minimum capital ratios are:

An institution that fails to meet the effective minimum ratios after taking into account the capital conservation buffer, as detailed above, will be subject to limitations on certain activities including payment of dividends, share repurchases and discretionary bonuses to executive officers if its capital level is below the buffer amount.

The Basel III Rules prescribed a standardized approach for risk weightings that expanded the risk-weighting categories from the general risk-based capital rules to a much larger and more risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0% for U.S. government and agency securities, to 600% for certain equity exposures, and resulting in higher risk weights for a variety of asset categories.

With respect to our bank subsidiary, the Basel III Rules also revised the “prompt corrective action” regulations pursuant to Section 38 of the FDIA, as discussed below under “Prompt Corrective Action.”

As of December 31, 2023, we had a total risk-based capital ratio of 19.62%, a tier 1 capital to risk-weighted asset ratio of 18.50%, a CET1 to risk-weighted assets ratio of 18.50% and a leverage ratio of 12.06%. These regulatory capital ratios were calculated under the Basel III Rules.

Prompt Corrective Action.

A banking organization’s capital plays an important role in connection with regulatory enforcement as well. Federal law provides the federal banking regulators with broad power to take prompt corrective action to resolve the problems of undercapitalized institutions. The extent of the regulators’ powers depends on whether the institution in question is “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” or “critically undercapitalized,” in each case as defined by regulation. Depending upon the capital category to which an institution is assigned, the regulators’ corrective powers include: (i) requiring the institution to submit a capital restoration plan; (ii) limiting the institution’s asset growth and restricting its activities; (iii) requiring the institution to issue additional capital stock (including additional voting stock) or to be acquired; (iv) restricting transactions between the institution and its affiliates; (v) restricting the interest rate that the institution may pay on deposits; (vi) ordering a new election of directors of the institution; (vii) requiring that senior executive officers or directors be dismissed; (viii) prohibiting the institution from accepting deposits from correspondent banks; (ix) requiring the institution to divest certain subsidiaries; (x) prohibiting the payment of principal or interest on subordinated debt; and (xi) ultimately, appointing a receiver for the institution.

Under current regulations, our subsidiary bank was “well capitalized” as of December 31, 2023.

Our Support of Our Subsidiaries

Under Federal Reserve Board policy, we are expected to commit resources to act as a source of strength to support each of our subsidiaries. The Dodd-Frank Act codified this policy as a statutory requirement. This support may be required at times when, absent such requirement, we would not otherwise be required to provide it. In addition, any loans we make to our subsidiaries would be subordinate in right of payment to deposits and to other indebtedness of our subsidiaries. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and be subject to a priority of payment.

Under the FDIA, in the event of a loss suffered or anticipated by the FDIC (either as a result of the default of a banking subsidiary or related to FDIC assistance provided to a subsidiary in danger of default) our other subsidiaries may be assessed for the FDIC’s loss.

Safe and Sound Banking Practices.

Bank holding companies are not permitted to engage in unsafe and unsound banking practices. The Federal Reserve Board’s Regulation Y, for example, generally requires a holding company to give the Federal Reserve Board prior notice of any redemption or repurchase of its own equity securities, if the consideration to be paid, together with the consideration paid for any repurchases or redemptions in the preceding year,

is equal to 10% or more of the bank holding company’s consolidated net worth. The Federal Reserve Board may oppose the transaction if it believes that the transaction would constitute an unsafe or unsound practice or would violate any law or regulation. Depending upon the circumstances, the Federal Reserve Board could take the position that paying a dividend would constitute an unsafe or unsound banking practice.

The Federal Reserve Board has broad authority to prohibit activities of bank holding companies and their nonbanking subsidiaries which represent unsafe and unsound banking practices or which constitute violations of laws or regulations, and can assess civil money penalties for certain activities conducted on a knowing and reckless basis, if those activities caused a substantial loss to a depository institution. The penalties can be as high as $1.0 million for each day the activity continues.

Interstate Banking and Branching

Effective June 1, 1997, the Riegle-Neal Interstate Banking and Branching Efficiency Act of 1994 amended the Federal Deposit Insurance Act and certain other statutes to permit state and national banks with different home states to merge across state lines, with approval of the appropriate federal banking agency, unless the home state of a participating bank had passed legislation prior to May 31, 1997 expressly prohibiting interstate mergers. Under the Riegle-Neal Act amendments, once a state or national bank has established branches in a state, that bank may establish and acquire additional branches at any location in the state at which any bank involved in the interstate merger transaction could have established or acquired branches under applicable federal or state law. If a state opted out of interstate branching within the specified time period, no bank in any other state may establish a branch in the state which has opted out, whether through an acquisition or de novo.

However, under the Dodd-Frank Act, the national branching requirements have been relaxed and national banks and state banks are able to establish branches in any state if that state would permit the establishment of the branch by a state bank chartered in that state.

The Federal Deposit Insurance Act, or FDIA, requires that the FDIC review (1) any merger or consolidation by or with an insured bank, or (2) any establishment of branches by an insured bank. Additionally, the Texas Department of Banking accepts applications for interstate merger and branching transactions, subject to certain limitations on ages of the banks to be acquired and the total amount of deposits within the state a bank or financial holding company may control. Since our primary service area is Texas, we do not expect that the ability to operate in other states will have any material impact on our growth strategy. We may, however, face increased competition from out-of-state banks that branch or make acquisitions in our primary markets in Texas.

Community Reinvestment Act of 1977

The Community Reinvestment Act of 1977, or CRA, subjects a bank to regulatory assessment to determine if the institution meets the credit needs of its entire community, including low-and moderate-income neighborhoods served by the bank, and to take that determination into account in its evaluation of any application made by such bank for, among other things, approval of the acquisition or establishment of a branch or other depository facility, an office relocation, a merger, or the acquisition of shares of capital stock of another financial institution. The regulatory authority prepares a written evaluation of an institution’s record of meeting the credit needs of its entire community and assigns a rating. These ratings are “Outstanding,” “Satisfactory,” “Needs Improvement” and “Substantial Noncompliance.” Institutions with ratings lower than “Satisfactory” may be restricted from engaging in the aforementioned activities. We believe our subsidiary bank meets the credit needs of the communities in which it operates. Our subsidiary bank received a “Satisfactory” rating in its most recent assessment of its performance under the CRA by the OCC.

Monitoring and Reporting Suspicious Activity

Under the Bank Secrecy Act, or BSA, we are required to monitor and report unusual or suspicious account activity that might signify money laundering, tax evasion or other criminal activities, as well as transactions involving the transfer or withdrawal of amounts in excess of prescribed limits. The BSA is sometimes referred to as an “anti-money laundering” law (“AML”). Several AML acts, including provisions in Title III of the USA PATRIOT Act of 2001, have been enacted up to the present to amend the BSA. Under the USA PATRIOT Act, financial institutions are subject to prohibitions against specified financial transactions and account relationships as well as enhanced due diligence and “know your customer” standards in their dealings with financial institutions and foreign customers. For example, the enhanced due diligence policies, procedures and controls generally require financial institutions to take reasonable steps:

Under the USA PATRIOT Act, financial institutions are also required to establish anti-money laundering programs. The USA PATRIOT Act sets forth minimum standards for these programs, including:

In addition, under the USA PATRIOT Act, the Secretary of the U.S. Department of the Treasury, or Treasury, has adopted rules addressing a number of related issues, including increasing the cooperation and information sharing between financial institutions, regulators, and law enforcement authorities regarding individuals, entities and organizations engaged in, or reasonably suspected based on credible evidence of engaging in, terrorist acts or money laundering activities. Any financial institution complying with these rules will not be deemed to violate the privacy provisions of the Gramm-Leach-Bliley Act that are discussed below. Finally, under the regulations of the Office of Foreign Asset Control, or OFAC, we are required to monitor and block transactions with certain “specially designated nationals” who OFAC has determined pose a risk to U.S. national security.

Incentive Compensation

In June 2010, the Federal Reserve Board, OCC and FDIC issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

The Federal Reserve Board will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Company, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

In addition, Section 956 of the Dodd-Frank Act required certain regulators (including the FDIC, Securities and Exchanges Commission (“SEC”) and Federal Reserve Board) to adopt requirements or guidelines prohibiting excessive compensation. In June 2016, the Federal Reserve Board, jointly with five other federal regulators, published a proposed rule in response to Section 956 of the Dodd-Frank Act, which requires implementation of regulations or guidelines to: (1) prohibit incentive-based payment arrangements that encourage inappropriate risks by certain financial institutions by providing excessive compensation or that could lead to material financial loss, and (2) require those financial institutions to disclose information concerning incentive-based compensation arrangements to the appropriate federal regulator.

The proposed rule identifies three categories of institutions that would be covered by these regulations based on average total consolidated assets, applying less prescriptive incentive-based compensation program requirements to the smallest covered institutions (Level 3) and progressively more rigorous requirements to the larger covered institutions (Level 1). Under the proposed rule, we would fall into the smallest category (Level 3), which applies to financial institutions with average total consolidated assets greater than $1.0 billion and less than $50 billion. The proposed rules would establish general qualitative requirements applicable to all covered entities, which would include (i) prohibiting incentive arrangements that encourage inappropriate risks by providing excessive compensation; (ii) prohibiting incentive arrangements that encourage inappropriate risks that could lead to a material financial loss; (iii) establishing requirements for performance measures to appropriately balance risk and reward; (iv) requiring board of director oversight of incentive arrangements; and (v) mandating appropriate recordkeeping. Under the proposed rule, larger financial institutions with total consolidated assets of at least $50 billion would also be subject to additional requirements applicable to such institutions’ “senior executive officers” and “significant risk-takers.” These additional requirements would not

be applicable to us because we currently have less than $50 billion in total consolidated assets. Comments on the proposed rule were due by July 22, 2016. As of the date of this document, the final rule has not yet been published by these regulators.

In addition, the Dodd-Frank Act requires publicly traded companies to give stockholders a non-binding vote on executive compensation at their first annual meeting taking place six months after the date of enactment and at least every three years thereafter and on so-called “golden parachute” payments in connection with approvals of mergers and acquisitions unless previously voted on by shareholders. The legislation also authorizes the SEC to promulgate rules that would allow stockholders to nominate their own candidates using a company’s proxy materials. Additionally, the Dodd-Frank Act directs the federal banking regulators to promulgate rules prohibiting excessive compensation paid to executives of depository institutions and their holding companies with assets in excess of $1.0 billion, regardless of whether the company is publicly traded or not. The Dodd-Frank Act gives the SEC authority to prohibit broker discretionary voting on elections of directors and executive compensation matters.

Consumer Laws and Regulations

We are also subject to certain federal and state consumer laws and regulations that are designed to protect consumers in transactions with banks. While the following list is not exhaustive, these laws and regulations include the Truth in Lending Act, the Truth in Savings Act, the Electronic Funds Transfer Act, the Expedited Funds Availability Act, the Equal Credit Opportunity Act, The Fair and Accurate Credit Transactions Act, the Real Estate Settlement Procedures Act and the Fair Housing Act, among others. These laws and regulations, among other things, prohibit discrimination on the basis of race, gender or other designated characteristics and mandate various disclosure requirements and regulate the manner in which financial institutions must deal with customers when taking deposits or making loans to such customers. These and other laws also limit finance charges or other fees or charges earned in our activities. We must comply with the applicable provisions of these consumer protection laws and regulations. Violations of consumer protection laws and regulations can result in significant potential liability, including actual damages, restitution and injunctive relief from litigation brought by customers, state attorney generals, the Department of Justice and other plaintiffs, as well as enforcement actions by banking regulators and reputational harm.

Consumer Financial Protection Bureau

The Dodd-Frank Act created a new, independent federal agency called the Consumer Financial Protection Bureau (“CFPB”), which is granted broad rulemaking, supervisory and enforcement powers under various federal consumer financial protection laws, including the Equal Credit Opportunity Act, Truth in Lending Act, Real Estate Settlement Procedures Act, Fair Credit Reporting Act, Fair Debt Collection Act, the Consumer Financial Privacy provisions of the Gramm-Leach-Bliley Act and certain other statutes. The CFPB has examination and primary enforcement authority with respect to depository institutions with $10 billion or more in assets. Given our subsidiary bank has exceeded $10 billion in assets, it is subject to regulation by the CFPB. The CFPB has authority to prevent unfair, deceptive or abusive acts or practices in connection with the offering of consumer financial products. The Dodd-Frank Act permits states to adopt consumer protection laws and standards that are more stringent than those adopted at the federal level and, in certain circumstances, permits the state attorney general to enforce compliance with both the state and federal laws and regulations.

Technology Risk Management and Consumer Privacy

State and federal banking regulators have issued various policy statements emphasizing the importance of technology risk management and supervision in evaluating the safety and soundness of depository institutions with respect to banks that contract with outside vendors to provide data processing and core banking functions. The use of technology-related products, services, delivery channels and processes exposes a bank to various risks, particularly operational, privacy, security, strategic, reputation and compliance risk. Banks are generally expected to prudently manage technology-related risks as part of their comprehensive risk management policies by identifying, measuring, monitoring and controlling risks associated with the use of technology.

Under Section 501 of the Gramm-Leach-Bliley Act, the federal banking agencies have established standards for financial institutions regarding the implementation of safeguards to ensure the security and confidentiality of consumer records and information, protection against any anticipated threats or hazards to the security or integrity of such records and protection against unauthorized access to or use of such records or information in a way that could result in substantial harm or inconvenience to a consumer. Among other matters, the rules require each bank to implement a comprehensive written information security program that includes administrative, technical and physical safeguards relating to customer information.

Under the Gramm-Leach-Bliley Act, a financial institution must also provide its customers with a notice of privacy policies and practices. Section 502 prohibits a financial institution from disclosing nonpublic personal information about a customer to nonaffiliated third parties unless the institution satisfies various notice and opt-out requirements and the customer has not elected to opt out of the disclosure. Under Section 504, the agencies are authorized to issue regulations as necessary to implement notice requirements and restrictions on a financial institution’s ability

to disclose nonpublic personal information about customers to nonaffiliated third parties. Under the final rule the regulators adopted, all banks must develop initial and annual privacy notices which describe in general terms the bank’s information sharing practices. Banks that share nonpublic personal information about customers with nonaffiliated third parties must also provide customers with an opt-out notice and a reasonable period of time for the customer to opt out of any such disclosure (with certain exceptions). Limitations are placed on the extent to which a bank can disclose an account number or access code for credit card, deposit or transaction accounts to any nonaffiliated third party for use in marketing.

Concentrated Commercial Real Estate Lending Regulations

The federal banking agencies have promulgated guidance governing financial institutions with concentrations in commercial real estate lending. The guidance provides that a bank has a concentration in commercial real estate lending if (i) total reported loans for construction, land development, and other land represent 100% or more of total capital or (ii) total reported loans secured by multifamily and non-farm residential properties and loans for construction, land development, and other land represent 300% or more of total capital and the bank’s commercial real estate loan portfolio has increased 50% or more during the prior 36 months. Owner occupied loans are excluded from this second category. If a concentration is present, management must employ heightened risk management practices that address the following key elements: including board and management oversight and strategic planning, portfolio management, development of underwriting standards, risk assessment and monitoring through market analysis and stress testing, and maintenance of increased capital levels as needed to support the level of commercial real estate lending.

UDAP and UDAAP

Banking regulatory agencies have increasingly used a general consumer protection statute to address “unethical” or otherwise “bad” business practices that may not necessarily fall directly under the purview of a specific banking or consumer finance law. The law of choice for enforcement against such business practices has been Section 5 of the Federal Trade Commission Act, referred to as the FTC Act, which is the primary federal law that prohibits unfair or deceptive acts or practices, referred to as UDAP, and unfair methods of competition in or affecting commerce. “Unjustified consumer injury” is the principal focus of the FTC Act. Prior to the Dodd-Frank Act, there was little formal guidance to provide insight to the parameters for compliance with UDAP laws and regulations. However, UDAP laws and regulations have been expanded under the Dodd-Frank Act to apply to “unfair, deceptive or abusive acts or practices,” referred to as UDAAP, which have been delegated to the CFPB for supervision. The CFPB has published its first Supervision and Examination Manual that addresses compliance with and the examination of UDAAP.

Monetary Policy

Banks are affected by the credit policies of monetary authorities, including the Federal Reserve Board, that affect the national supply of credit. The Federal Reserve Board regulates the supply of credit in order to influence general economic conditions, primarily through open market operations in United States government obligations, varying the discount rate on financial institution borrowings, varying reserve requirements against financial institution deposits, and restricting certain borrowings by financial institutions and their subsidiaries. The monetary policies of the Federal Reserve Board have had a significant effect on the operating results of banks in the past and are expected to continue to do so in the future.

Enforcement Powers of Federal Banking Agencies

The Federal Reserve Board and other federal banking agencies and regulators have broad enforcement powers, including the power to terminate deposit insurance, issue cease-and-desist orders, impose substantial fines and other civil and criminal penalties and appoint a conservator or receiver. Our failure to comply with applicable laws, regulations and other regulatory pronouncements could subject us, as well as our officers and directors, to administrative sanctions and potentially substantial civil penalties.

Regulatory Reform and Legislation

From time to time, various legislative and regulatory initiatives are introduced in Congress and state legislatures, as well as by regulatory agencies. Such initiatives may include proposals to expand or contract the powers of bank holding companies and depository institutions or proposals to substantially change the financial institution regulatory system. Such legislation could change banking statutes and the operating environment of the Company in substantial and unpredictable ways. If enacted, such legislation could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance among banks, savings associations, credit unions, and other financial institutions. The Company cannot predict whether any such legislation will be enacted, and, if enacted, the effect that it, or any implementing regulations, would have on the financial condition or results of operations of the Company. A change in statutes, regulations or

regulatory policies applicable to the Company or our subsidiaries could have a material effect on the Company’s business, financial condition and results of operations.

Dodd-Frank Wall Street Reform and Consumer Protection Act

The Dodd-Frank Act, which was enacted in July 2010, effected a fundamental restructuring of federal banking regulation. In addition to those provisions discussed above, among the Dodd-Frank Act provisions that have affected us are the following:

Several of the Dodd-Frank Act’s provisions are still subject to the final rulemaking by federal banking agencies, and the implication of the Dodd-Frank Act for the Company’s business will depend to a large extent on how such rules are adopted and implemented. The Company’s management continues to review actively the provisions of the Dodd–Frank Act and assess its probable impact on its business, financial condition, and results of operations.

Available Information

We file annual, quarterly and current reports, proxy statements and other information with the SEC. The SEC maintains a website that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC at www.sec.gov. You may obtain copies of our filings on the SEC website. Our website is https://www.ffin.com. You may also obtain copies of our annual, quarterly and special reports, proxy statements and certain other information filed with the SEC, as well as amendments thereto, free of charge from our website. These documents are posted to our web site after we have filed them with the SEC. Our corporate governance guidelines, including our code of conduct applicable to all our employees, officers and directors, as well as the charters of our audit, compensation, executive and nominating committees, are available at www.ffin.com. The foregoing information is also available in print to any shareholder who requests it. Except as explicitly provided, information on any web site is not incorporated into this Form 10-K or our other securities filings and is not a part of them.

Our business, financial condition, operating results and cash flows can be impacted by a number of factors, including but not limited to those set forth below, any one of which could cause our actual results to vary materially from recent results or from our anticipated future results and other forward-looking statements that we make from time to time in our news releases, annual reports and other written communications, as well as oral forward-looking statements, and other statements made from time to time by our representatives.

Risks Related to Our Business

Interest Rate Risk

We are subject to interest rate risk.

Our profitability is dependent to a large extent on our net interest income, which is the difference between interest income we earn as a result of interest paid to us on loans and investments and interest we pay to third-parties such as our depositors and those from which we borrow funds. Like most financial institutions, we are highly sensitive to many factors that are beyond our control, including general economic conditions and policies of various governmental and regulatory agencies and, in particular, the Federal Reserve Board. Changes in monetary policy, including changes in interest rates, could influence not only the interest we receive on loans and securities and the amount of interest we pay on deposits and borrowings, but such changes could also affect (i) our ability to originate loans and obtain deposits, (ii) the fair value of our financial assets and liabilities, (iii) the average duration of our securities portfolio, and (iv) the slope of the overall yield curve and its impact on the value of the investment portfolio and reinvestment income. If the interest rates paid on deposits and other borrowings increase at a faster rate than the interest rates received on loans and investments, our net interest income, and earnings, could be adversely affected. Earnings could also be adversely affected if the interest rates received on loans and investments fall more quickly than the interest rates paid on deposits and other borrowings.

The Federal Reserve Board increased rates 200 basis points through mid-2019 and as a response to the ongoing COVID pandemic decreased rates 75 basis points during the third and fourth quarters of 2019 and then an additional 150 basis points in the first quarter of 2020, resulting in a target rate range of zero to 25 basis points throughout the remainder of 2020 and 2021. The Federal Reserve Board began increasing interest rates by raising rates 25 basis points in March 2022, 50 basis points in May 2022, and 75 basis points in June, July, September and November 2022, respectively, 50 basis points in December 2022, and 25 basis points in February, March, May, and July 2023, respectively, resulting in a target rate range of 5.25% to 5.50% at December 31, 2023. Today, there continues to be uncertainty regarding future interest rates. Increases in interest rates can have negative impacts on our business, including reducing our customers’ desire to borrow money from us or adversely affecting their ability to repay their outstanding loans by increasing their debt obligations through the periodic reset of adjustable interest rate loans. If our borrowers’ ability to pay their loans is impaired by increasing interest payment obligations, our level of non-performing assets would increase, producing an adverse effect on operating results. Asset values, especially commercial real estate as collateral, securities or other fixed rate earning assets, can decline significantly with relatively minor changes in interest rates. Conversely, decreases in interest rates can affect the amount of interest we earn on our loans and investment securities, which could have a material adverse effect on the Company’s financial condition and results of operations. Although we have implemented strategies that we believe reduce the potential effects of adverse changes in interest rates on our results of operations, these strategies may not always be successful. Any of these events could adversely affect our results of operations, financial condition and liquidity.

Credit Risk

In our business, we must effectively manage our credit risk.

As a lender, we are exposed to the risk that our borrowers may not repay their loans according to the terms of these loans and the collateral securing the payment of these loans may be inadequately documented or may be insufficient to fully compensate us for the outstanding balance of the loan plus the costs to dispose of the collateral. We may experience significant loan losses, which could have a material adverse effect on our operating results and financial condition. Management makes various assumptions and judgments about the collectability of our loan portfolio, including the diversification by industry of our commercial loan portfolio, the amount of nonperforming loans and related collateral, the volume, growth and composition of our loan portfolio, the effects on the loan portfolio of current economic indicators and their probable impact on borrowers and the evaluation of our loan portfolio through our internal loan review process and other relevant factors.

We maintain an allowance for credit losses, which is an allowance established through a provision for credit losses charged to expense that represents management’s best estimate of probable losses inherent in our loan portfolio. Additional credit losses will occur in the future and may occur at a rate greater than we have experienced to date. In determining the amount of the allowance, we rely on an analysis of our loan portfolio, our experience and our evaluation of general economic conditions. If our assumptions prove to be incorrect, our current allowance may not be sufficient and adjustments may be necessary to allow for different economic conditions or adverse developments in our loan portfolio. Material additions to the allowance could materially decrease our net income.

In addition, banking regulators periodically review our allowance for credit losses and may require us to increase our provision for credit losses or recognize further charge-offs, based on judgments different than those of our management. Any increase in our allowance for credit losses or charge-offs as required by these regulatory agencies could have a material negative effect on our operating results and financial condition.

We are subject to environmental liability risk associated with lending activities.

A significant portion of our loan portfolio is secured by real property. During the ordinary course of business, we may foreclose on and take title to properties securing certain loans. In doing so, there is a risk that hazardous or toxic substances could be found on these properties. If

hazardous or toxic substances are found, we may be liable for remediation costs, as well as for personal injury and property damage. Environmental laws may require us to incur substantial expenses and may materially reduce the affected property’s value or limit our ability to use or sell the affected property. In addition, future laws or more stringent interpretations or enforcement policies with respect to existing laws may increase our exposure to environmental liability. To remediate these risks, often we will obtain a phase 1 and if deemed necessary, a phase 2 inspection report to evaluate potential environmental risks before making loans secured by real property and before considering foreclosing on these assets. Environmental reviews of real property before initiating foreclosure actions may not be sufficient to detect all potential environmental hazards. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on our business, financial condition and results of operations.

The value of real estate collateral may fluctuate significantly resulting in an under-collateralized loan portfolio.

The market value of real estate, particularly real estate held-for-investment (“HFI”), can fluctuate significantly in a short period of time as a result of market conditions in the geographic area in which the real estate is located. If the value of the real estate serving as collateral for our loan portfolio were to decline materially, a significant part of our loan portfolio could become under-collateralized. If the loans that are collateralized by real estate become troubled during a time when market conditions are declining or have declined, then, in the event of foreclosure, we may not be able to realize the amount of collateral that we anticipated at the time of originating the loan. This could have a material adverse effect on our provision for credit losses and our operating results and financial condition.

Liquidity Risk

We are subject to liquidity risk.

The Company requires liquidity to meet our deposit and other obligations as they come due. The Company’s access to funding sources in amounts adequate to finance its activities or on reasonable terms could be impaired by factors that affect it specifically or the financial services industry or the general economy. Factors that could reduce its access to liquidity sources include a downturn in the Texas market, difficult credit markets, depreciation in investment security values, or adverse regulatory actions against the Company. The Company’s access to deposits may also be affected by the liquidity needs of its depositors. In particular, a substantial majority of the Company’s liabilities are demand, savings, interest checking and money market deposits, which are payable on demand or upon several days’ notice, while by comparison, a substantial portion of its assets are loans, which cannot be called or sold in the same time frame. The Company may not be able to replace maturing deposits and advances as necessary in the future, especially if a large number of its depositors sought to withdraw their accounts, regardless of the reason.

On March 9, 2023, Silvergate Bank, La Jolla, California, announced its decision to voluntarily liquidate its assets and wind down operations. On March 10, 2023, Silicon Valley Bank, Santa Clara, California, was closed by the California Department of Financial Protection and Innovation (the “DFPI”), on March 12, 2023, Signature Bank, New York, New York, was closed by the New York State Department of Financial Services and on May 1, 2023, First Republic Bank, San Francisco, California, was closed by the DFPI, and in each case the FDIC was appointed receiver for the failed institution. These banks had elevated levels of uninsured deposits, which may be less likely to remain at the bank over time and less stable as a source of funding than insured deposits. These failures led to volatility and declines in the market for bank stocks and questions about depositor confidence in depository institutions.

These events have led to a greater focus by institutions, investors and regulators on the on-balance sheet liquidity of and funding sources for financial institutions, the composition of their deposits, including the amount of uninsured deposits, the amount of accumulated other comprehensive loss, capital levels and interest rate risk management.

If we are unable to adequately manage our liquidity, we may experience a material adverse effect on our financial condition and results of operations. We must maintain sufficient funds to respond to the needs of depositors and borrowers. Deposits have traditionally been our primary source of funds for use in lending and investment activities. We also receive funds from loan repayments, investment maturities and income on other interest-earning assets. While we emphasize the generation of low-cost core deposits as a source of funding, there is strong competition for such deposits in our market area. Additionally, deposit balances can decrease if customers perceive alternative investments as providing a better risk/return tradeoff. Accordingly, as a part of our liquidity management, we must use a number of funding sources in addition to deposits and repayments and maturities of loans and investments, which may include Federal Home Loan Bank of Dallas advances, federal funds purchased and brokered certificates of deposit. Adverse operating results or changes in industry conditions could lead to difficulty or an inability to access these additional funding sources.

Any decline in available funding could adversely impact our ability to originate loans, invest in securities, pay our expenses, or fulfill obligations such as repaying our borrowings or meeting deposit withdrawal demands, any of which could have a material adverse impact on our liquidity, business, financial condition and results of operations.

A lack of liquidity could also attract increased regulatory scrutiny and potential restraints imposed on us by regulators. Depending on the capitalization status and regulatory treatment of depository institutions, including whether an institution is subject to a supervisory prompt corrective action directive, certain additional regulatory restrictions and prohibitions may apply, including restrictions on growth, restrictions on interest rates paid on deposits, restrictions or prohibitions on payment of dividends and restrictions on the acceptance of brokered deposits.

Our financial flexibility would be severely constrained if we were unable to maintain our access to funding or if adequate financing were not available at acceptable interest rates. Further, if we were required to rely more heavily on more expensive funding sources to support liquidity, our revenues may not increase proportionately to cover our increased costs. In this case, our operating margins and profitability would be adversely affected. If alternative funding sources were no longer available to us, we may need to sell a portion of our investment and/or loan portfolio to raise funds, which, depending upon market conditions, could result in us realizing a loss on the sale of such assets. As of December 31, 2023, we had a net unrealized loss of $403.30 million on our available for-sale investment securities portfolio as a result of the rising interest rate environment. Our investment securities totaled $4.73 billion, or 36.11% of total assets, at December 31, 2023. The details of this portfolio are included in Note 2 to the consolidated financial statements.

Operational Risk

Our accounting estimates and risk management processes rely on analytical and forecasting models.

The processes we use to estimate our allowance for credit losses and to measure the fair value of financial instruments, as well as the processes used to estimate the effects of changing interest rates depends upon the use of analytical and forecasting models, including various inputs and assumptions (collectively, the "models"). In addition, these models are used to calculate the fair value of our assets and liabilities when we acquire other financial institutions. These models reflect assumptions that may not be accurate, particularly in times of market stress or other unforeseen circumstances. Even if these assumptions are adequate, the models may prove to be inadequate or inaccurate because of other flaws in their design or their implementation. If the models we use for interest rate risk and asset-liability management are inadequate, we may incur increased or unexpected losses upon changes in market interest rates or other market measures. If the models we use for determining our current expected credit losses are inadequate, the allowance for credit losses may not be sufficient to support future charge-offs. If the models we use to measure the fair value of financial instruments is inadequate, the fair value of such financial instruments may fluctuate unexpectedly or may not accurately reflect what we could realize upon sale or settlement of such financial instruments. Such failure in our analytical or forecasting models could have a material adverse effect on our business, financial condition and results of operations.

The value of our goodwill and other intangible assets may decline in the future.

As of December 31, 2023, we had $314.62 million of goodwill and other intangible assets. A significant decline in our financial condition, a significant adverse change in the business climate, slower growth rates or a significant and sustained decline in the price of our common stock may necessitate taking charges in the future related to the impairment of our goodwill and other intangible assets. If we were to conclude that a future write-down of goodwill and other intangible assets is necessary, we would record the appropriate charge, which could have a material adverse effect on our financial condition and results of operations.

Breakdowns in our internal controls and procedures could have an adverse effect on us.

We believe our internal control system as currently documented and functioning is adequate to provide reasonable assurance over our internal controls. Nevertheless, because of the inherent limitation in administering a cost effective control system, misstatements due to error or fraud may occur and not be detected. Breakdowns in our internal controls and procedures could occur in the future, and any such breakdowns could have an adverse effect on us. See “Item 9A – Controls and Procedures” for additional information.

New lines of business or new products and services may subject the Company to additional risks.

From time to time, the Company may implement new lines of business or offer new products and services within existing lines of business. There are substantial risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and/or products and services, the Company may invest significant time and resources. External factors, such as compliance with regulations, competitive alternatives, and shifting market preferences, may also impact the successful implementation of a new line of business or a new product or service. If we are unable to successfully manage these risks in the development and implementation of new lines of business or new products or services, it could have a material adverse effect on the Company’s business, financial condition and result of operations.

First Financial Bankshares, Inc. relies on dividends from its subsidiaries for most of its revenue.

First Financial Bankshares, Inc. is a separate and distinct legal entity from its subsidiaries. It receives substantially all of its revenue from dividends paid by its subsidiaries. These dividends are the principal source of funds to pay dividends on the Company’s common stock to shareholders and interest and principal on First Financial Bankshares, Inc. debt (to the extent we have balances outstanding). Various federal and/or state laws and regulations limit the amount of dividends that our bank and trust subsidiaries may pay to First Financial Bankshares, Inc. In the event our subsidiaries are unable to pay dividends to First Financial Bankshares, Inc., the Company may not be able to service debt, if any,

or pay dividends on the Company’s common stock. The inability to receive dividends from our subsidiaries could have a material adverse effect on the Company’s business, financial condition, results of operations and liquidity.

Hurricanes, extended drought conditions, severe weather and natural disasters could significantly impact the Company's business.

Hurricanes, extended drought conditions, severe weather and natural disasters and other adverse external events could have a significant impact on the Company's ability to conduct business. Such events affect the stability of the Company's deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of the collateral securing our loans, cause significant property damage, result in loss of revenue and/or cause the Company to incur additional expenses. The occurrence of any such events in the future could have a material adverse effect on the Company's business, which in turn, could have a material adverse effect on the Company's business, financial condition and result of operations.

We rely heavily on our management team, and the unexpected loss of key management or inability to recruit qualified personnel in the future may adversely impact our operations.

Our success to date has been strongly influenced by our ability to attract and retain senior management experienced in banking in the markets we serve. Our ability to retain executive officers and the current management teams will continue to be important to the successful implementation of our strategies. We do not have employment agreements with these key employees other than executive agreements in the event of a change of control and a confidential information, non-solicitation and non-competition agreement related to our stock options and restricted stock award, restricted stock unit and performance stock unit grants. The unexpected loss of services of any key management personnel, or the inability to recruit and retain qualified personnel in the future, could have an adverse effect on our business and financial results. In addition, the scope and content of U.S. banking regulators policies on incentive compensation, could adversely affect our ability to hire, retain and motivate our key employees.

World events such as the Russia-Ukraine conflict, the Israel-Palestine conflict and other world events, including health related events, may adversely impact our business and our financial results, and the ultimate impact will depend on future developments, which are highly uncertain and cannot be predicted.

The Russia-Ukraine conflict, the Israel-Palestine conflict and other world events, including health-related events, are creating extensive disruptions in the global economy and to the lives of individuals throughout the world. While the effects of COVID have reduced, the pandemic and related efforts to contain it have disrupted global economic activity, adversely affected the functioning of financial markets, impacted interest rates, increased economic and market uncertainty, employment and labor markets and disrupted trade and supply chains. In addition, financial markets and global supply chains may be adversely affected by the current or anticipated impact of military conflict, including the current Russian invasion of Ukraine, the Israel-Palestine conflict, terrorism or other geopolitical events. If these effects continue for a prolonged period or result in sustained economic stress or recession, many of the risk factors identified in our Form 10-K could be exacerbated and such effects could have a material adverse impact on us in a number of ways related to credit, collateral, customer demand, funding, operations, interest rate risk, human capital, and self-insurance, as previously described.

System failure or cybersecurity breaches of our network security could subject us to increased operating costs as well as litigation and other potential losses.

The computer systems and network infrastructure we use could be vulnerable to unforeseen hardware and cybersecurity issues, including “hacking” and “identity theft.” Our operations are dependent upon our ability to protect our computer equipment against damage from fire, power loss, telecommunications failure or a similar catastrophic event. Any damage or failure that causes an interruption in our operations could have an adverse effect on our financial condition and results of operations. In addition, our operations are dependent upon our ability to protect the computer systems and network infrastructure utilized by us, including our Internet banking activities, against damage from physical break-ins, cybersecurity breaches and other disruptive problems caused by the Internet or other users. Such computer break-ins and other disruptions would jeopardize the security of information stored in and transmitted through our computer systems and network infrastructure, which may result in significant liability to us, damage our reputation and inhibit current and potential customers from our Internet banking services. Each year, we add additional security measures to our computer systems and network infrastructure to mitigate the possibility of cybersecurity breaches including firewalls and penetration testing. We continue to investigate cost effective measures as well as insurance protection.

Furthermore, our customers could incorrectly blame the Company and terminate their accounts with the Company for a cyber-incident which occurred on their own system or to an unrelated third-party. In addition, a security breach could also subject us to additional regulatory scrutiny and expose us to civil litigation and possible financial liability.

Disruptions in our information technology systems or a compromise of security with respect to our systems could adversely affect our operating results by limiting our ability to effectively monitor and control our operations, adjust to changing market conditions, implement strategic initiatives, or support our customer transactions.

We rely on our information technology systems to be able to monitor and control our operations, adjust to changing market conditions, implement strategic initiatives, and support our online banking system. Any disruptions in these systems or the failure of these systems to operate as expected have in the past adversely affected, and could in the future adversely affect, our ability to access and use certain applications and could, depending on the nature and magnitude of the problem, adversely affect our operating results by limiting our ability to effectively monitor and control our operations, adjust to changing market conditions, implement strategic initiatives, and service customers. Although such disruptions and failures have not been material to date, we cannot guarantee that they will not be material in the future. In addition, the security measures we employ to protect our systems have in the past not detected or prevented, and may in the future not detect or prevent, all attempts to hack our systems, denial-of-service attacks, viruses, malicious software (malware), employee error or malfeasance, phishing attacks, security breaches, disruptions during the process of upgrading or replacing computer software or hardware or integrating systems of acquired businesses or assets or other attacks and similar disruptions that may jeopardize the security of information stored in or transmitted by the sites, networks, and systems that we otherwise maintain, which include cloud-based networks and data center storage.

We have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. We are continuously developing and enhancing our controls, processes and practices designed to protect our systems, computers, software, data and networks from attack, damage, or unauthorized access. This continued development and enhancement requires us to expend significant resources. However, we may not anticipate or combat all types of future attacks until after they have been launched. If any of these breaches of security occur or are anticipated in the future, we could be required to expend additional capital and other resources, including costs to deploy additional personnel and protection technologies, train employees and engage third-party experts and consultants. Our response to attacks, and our investments in our technology and our controls, processes, and practices, may not be sufficient to shield us from significant losses or liability. Further, given the increasing sophistication of bad actors and complexity of the techniques used to obtain unauthorized access or disable systems, a breach or attack could potentially persist for an extended period of time before being detected. As a result, we may not be able to anticipate the attack or respond adequately or timely, and the extent of a particular incident, and the steps that we may need to take to investigate the incident, may not be immediately clear. It could take a significant amount of time before an investigation can be completed and full, reliable information about the incident becomes known. During an investigation, it is possible we may not necessarily know the extent of the harm or how to remediate it, which could further adversely impact us, and new regulations could result in us being required to disclose information about a material cybersecurity incident before it has been mitigated or resolved, or even fully investigated. We also face cybersecurity risks due to our reliance on internet technology and hybrid work arrangements, which could strain our technology resources or create additional opportunities for cybercriminals to exploit vulnerabilities.

In addition, because our systems contain information about individuals and businesses, our failure to appropriately maintain the security of the data we hold, whether as a result of our own error or the malfeasance or errors could lead to unauthorized release of confidential or otherwise protected information or corruption of data. Our failure to appropriately maintain the security of the data we hold could also violate applicable privacy, data security and other laws and subject us to lawsuits, fines, and other means of regulatory enforcement.

Any compromise or breach of our systems could result in adverse publicity, harm our reputation, lead to claims against us and affect our relationships with our customers and employees, any of which could have a material adverse effect on our business. Although we maintain insurance coverage for various cybersecurity risks, there can be no guarantee that all costs or losses incurred will be fully insured.

We are subject to claims and litigation pertaining to intellectual property.

We rely on technology companies to provide information technology products and services necessary to support our day-to-day operations. Technology companies frequently enter into litigation based on allegations of patent infringement or other violations of intellectual property rights. In addition, patent holding companies seek to monetize patents they have purchased or otherwise obtained. Competitors of our vendors, or other individuals or companies, have from time to time claimed to hold intellectual property sold to us by its vendors. Such claims may increase in the future as the financial services sector becomes more reliant on information technology vendors. The plaintiffs in these actions frequently seek injunctions and substantial damages.

Regardless of the scope or validity of such patents or other intellectual property rights, or the merits of any claims by potential or actual litigants, we may have to engage in litigation that could be expensive, time-consuming, disruptive to our operations, and distracting to management. If we are found to infringe on one or more patents or other intellectual property rights, we may be required to pay substantial damages or royalties to a third-party. In certain cases, we may consider entering into licensing agreements for disputed intellectual property, although no assurance can be given that such licenses can be obtained on acceptable terms or that litigation will not occur. These licenses may also significantly increase our operating expenses. If legal matters related to intellectual property claims were resolved against us or settled, we could be required to make payments in amounts that could have a material adverse effect on our business, financial condition and results of operations.

We depend on the accuracy and completeness of information about customers and counterparties.

In deciding whether to extend credit or enter into other transactions, we must rely on information furnished by or on behalf of customers and counterparties, including financial statements, credit reports and other financial information. We also rely on representations of those customers, counterparties or other third-parties, such as independent auditors, as to the accuracy and completeness of that information. Reliance on inaccurate or misleading financial statements, credit reports or other financial information could have a material adverse impact on our business, financial condition and results of operations.

We do business with other financial institutions that could experience financial difficulty.

We do business through the purchase and sale of federal funds, check clearing and through the purchase and sale of loan participations with other financial institutions. Because these financial institutions have many risks, as do we, we could be adversely affected should one of these financial institutions experience significant financial difficulties or fail to comply with our agreements with them.

We are subject to possible claims and litigation pertaining to fiduciary responsibility.

From time to time, customers could make claims and take legal actions pertaining to our performance of our fiduciary responsibilities. Whether customer claims and legal actions related to our performance of our fiduciary responsibilities are founded or unfounded, if such claims and legal actions are not resolved in a manner favorable to us, they may result in significant financial liability and/or adversely affect our market perception of our products and services as well as impact customer demand for those products and services. Any financial liability or reputation damage could have a material adverse effect on our business, which, in turn, could have a material adverse effect on our financial condition and results of operations.

Our operations rely on certain external vendors.

We rely on certain external vendors to provide products and services necessary to maintain our day-to-day operations. Accordingly, our operations are exposed to risk that these vendors will not perform in accordance with the contracted agreements under service level agreements. The failure of an external vendor to perform in accordance with the contracted arrangements under service level agreements, because of changes in the vendor’s organizational structure, financial condition, support for existing products or services or strategic focus or for any other reason, could be disruptive to our operations, which could have a material adverse effect on our business and, in turn, our financial condition and results of operations. Security breaches at certain external vendors may expose our Company's or customers' data, which poses operational, compliance and reputation risks.

Certain of our investment advisory and wealth management contracts are subject to termination on short notice, and termination of a significant number of investment advisory contracts could have a material adverse impact on our revenue.

Certain of our investment advisory and wealth management clients can terminate, with little or no notice, their relationships with us, reduce their aggregate assets under management, or shift their funds to other types of accounts with different rate structures for any number of reasons, including investment performance, changes in prevailing interest rates, inflation, changes in investment preferences of clients, changes in our reputation in the marketplace, change in management or control of clients, loss of key investment management personnel and financial market performance. We cannot be certain that our trust company subsidiary will be able to retain all of its clients. If its clients terminate their investment advisory and wealth management contracts, our trust company subsidiary, and consequently we, could lose a substantial portion of our revenues.

The trust wealth management fees we receive may decrease as a result of poor investment performance, in either relative or absolute terms, which could decrease our revenues and net earnings.

Our trust company subsidiary derives its revenues primarily from investment management fees based on assets under management. Our ability to maintain or increase assets under management is subject to a number of factors, including investors’ perception of our past performance, in either relative or absolute terms, market and economic conditions, including changes in oil and gas prices, and competition from investment management companies. Financial markets are affected by many factors, all of which are beyond our control, including general economic conditions, changes in oil and gas prices; securities market conditions; the level and volatility of interest rates and equity prices; competitive conditions; liquidity of global markets; international and regional political conditions; regulatory and legislative developments; monetary and fiscal policy; investor sentiment; availability and cost of capital; technological changes and events; outcome of legal proceedings; changes in currency values; inflation; credit ratings; and the size, volume and timing of transactions. A decline in the fair value of the assets under management, caused by a decline in general economic conditions, would decrease our wealth management fee income.

Investment performance is one of the most important factors in retaining existing clients and competing for new wealth management clients. Poor investment performance could reduce our revenues and impair our growth in the following ways:

Even when market conditions are generally favorable, our investment performance may be adversely affected by the investment style of our wealth management and investment advisors and the particular investments that they make. To the extent our future investment performance is perceived to be poor in either relative or absolute terms, the revenues and profitability of our wealth management business will likely be reduced and our ability to attract new clients will likely be impaired. As such, fluctuations in the equity and debt markets can have a direct impact upon our net earnings. In addition, as approximately 15% of trust fees came from management of oil and gas properties in 2023, a decline in the prices of oil and gas could lead to a loss of material amounts of our trust income.

Our reputation and business could be damaged by negative publicity.

Reputation risk, or the risk to our earnings and capital by negative public opinion, is inherent in our business. Negative public opinion could adversely affect our ability to keep and attract customers and expose us to additional liquidity risk as well as adverse legal and regulatory consequences. Negative public opinion could result from our actual or alleged conduct in any number of activities, including lending practices, corporate governance, perception of our environmental, social and governance practices and disclosures, regulatory compliance or investigations, mergers and acquisitions, sharing or inadequate protection of customer information, and from actions taken by government regulators and community organizations in response to that conduct. Negative public opinion could also result from adverse news or publicity that impairs the reputation of the financial services industry. In addition, adverse publicity or negative information posted on social media, whether or not factually correct, may adversely impact our business prospects or financial results.

External and Market Related Risks

Our business faces unpredictable economic conditions, which could have an adverse effect on us.

General economic conditions impact the banking industry. The credit quality of our loan portfolio necessarily reflects, among other things, the general economic conditions in the areas in which we conduct our business. Our continued financial success depends somewhat on factors beyond our control, including:

Any substantial deterioration in any of the foregoing conditions could have a material adverse effect on our financial condition, results of operations and liquidity, which would likely have an adverse affect on the market price of our common stock.

Our business is concentrated in Texas and a downturn in the economy of Texas may adversely affect our business.

Our network of bank regions is concentrated in Texas, primarily in the Central, North Central, Southeast and Western regions of the state. Most of our customers and revenue are derived from these areas. These economies include dynamic centers of higher education, agriculture, energy and natural resources, retail, military, healthcare, tourism, retirement living, manufacturing and distribution. Because we generally do not derive revenue or customers from other parts of the state or nation, our business and operations are dependent on economic conditions in our Texas markets. Any significant decline in one or more segments of the local economies could adversely affect our business, revenue, operations and properties.

The volatility in oil and gas prices results in uncertainty about the Texas economy. While we consider our exposure to credits related to the oil and gas industry to not be significant, at approximately 2.79%, of total loans HFI as of December 31, 2023, should the price of oil and gas decline and/or remain at low prices for an extended period, the general economic conditions in our Texas markets could be negatively affected,

which could have a material adverse effect on our business, financial condition and results of operations. Additionally, the Company's trust revenues may be impacted by oil and gas prices which represented approximately 15% and 18% of total trust revenues in 2023 and 2022, respectively.

Our Company lends primarily to small to medium-sized businesses that may have fewer resources to weather a downturn in the economy, which could adversely impact the Company’s operating results.

The Company makes loans to privately-owned businesses, many of which are considered to be small to medium-sized businesses. Small to medium-sized businesses frequently have smaller market share than their competition, may be more vulnerable to economic downturns, often need additional capital to expand or compete and may experience more volatility in operating results. Any one or more of these factors may impair the borrower’s ability to repay a loan. In addition, the success of small to medium-sized businesses often depends on the management talents and efforts of a small group of persons, and the death, disability or resignation of one or more of these persons could have adverse impact on the business and its ability to repay our loans. Economic downturns, a sustained decline in commodity prices and other events that could negatively impact the businesses could cause the Company to incur credit losses that could negatively affect the Company’s results of operations and financial condition.

If we are unable to continue to originate residential real estate loans and sell them into the secondary market for a profit, our earnings could decrease.

We derive a portion of our noninterest income from the origination of residential real estate loans and the subsequent sale of such loans into the secondary market. If we are unable to continue to originate and sell residential real estate loans at historical or greater levels, our residential real estate loan volume would decrease, which could decrease our earnings. A rising interest rate environment, general economic conditions or other factors beyond our control could adversely affect our ability to originate residential real estate loans. We also are experiencing an increase in regulations and compliance requirements related to mortgage loan originations necessitating technology upgrades and other changes. If new regulations continue to increase and we are unable to make technology upgrades, our ability to originate mortgage loans will be reduced or eliminated. Additionally, we sell a large portion of our residential real estate loans to third-party investors, and rising interest rates could negatively affect our ability to generate suitable profits on the sale of such loans. If interest rates increase after we originate the loans, our ability to market those loans is impaired as the profitability on the loans decreases. These fluctuations can have an adverse effect on the revenue we generate from residential real estate loans and in certain instances, could result in a loss on the sale of the loans.

We originate the majority of our secondary market loans by issuing interest rate lock commitments ("IRLCs") to the customer based on prevailing rates in the market. We are exposed to changes in interest rates between the date of the IRLC and the closing of the loans. We hedge the price risk of the IRLCs based on various models and other factors using financial instruments which typically, but not always, correlate to the change in value to offset the risk. These hedges may not be equally correlated or effective and expose the Company to risk and loss of earnings.

Further, for the mortgage loans we sell in the secondary market, the mortgage loan sales contracts contain indemnification clauses should the loans default, generally in the first sixty to ninety days, or if documentation is determined not to be in compliance with regulations. While the Company’s historic losses as a result of these indemnities have been insignificant, we could be required to repurchase the mortgage loans or reimburse the purchaser of our loans for losses incurred. Both of these situations could have an adverse effect on the profitability of our mortgage loan activities and negatively impact our net income.

We compete in an industry that continually experiences technological change, and we may have fewer resources than many of our competitors to continue to invest in technological improvements.

The financial services industry is undergoing rapid technological changes, with frequent introductions of new technology-driven products and services and new Fintech companies. In addition to improving the ability to serve customers, the effective use of technology increases efficiency and enables financial institutions to reduce costs. Our future success will depend, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands for conveniences, as well as to create additional efficiencies in our operations. We may experience operational challenges in connection with the adoption of, or failure to adopt, new technology, such as artificial intelligence, which could result in unintended consequences or expenses as a result of the technology's limitations, our failure to use new technology effectively or at all, not fully realizing the anticipated benefits from such new technology, or the cost to implement or remedy any challenges associated with the adoption of new technology in a timely manner. Many of our larger competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers.

Difficult or changes in market conditions could adversely affect the financial services industry.

The financial markets have experienced volatility over the past several years. In some cases, the financial markets have produced downward pressure on stock prices and credit availability for certain companies without regard to those companies’ underlying financial strength. If financial market volatility worsens, or there are disruptions in these financial markets, including disruptions to the United States banking systems, there can be no assurance that we will not experience an adverse effect on our ability to access capital and our business, financial condition and result of operations could be adversely impacted.

Inflationary pressures and rising prices may affect our results of operations and financial conditions.

Inflation rose in 2022 at levels not seen for over 40 years, and such inflationary pressures continued into 2023. Inflation could lead to increased costs to our customers, making it more difficult for them to repay their loans or other obligations increasing our credit risk. In general, the impact of inflation on the banking industry differs significantly from that of other industries in which a large portion of total resources are invested in fixed assets such as property, plant and equipment. Assets and liabilities of financial institutions are primarily all monetary in nature, and therefore are principally impacted by interest rates rather than changing prices. While the general level of inflation underlies most interest rates, interest rates react more to changes in the expected rate of inflation and to changes in monetary and fiscal policy.

Sustained higher interest rates by the Federal Reserve Board may be needed to tame persistent inflationary price pressures, which could depress asset prices and weaken economic activity. A deterioration in economic conditions in the United States and our markets could result in an increase in loan delinquencies and non-performing assets, decreases in loan collateral values and a decrease in demand for our products and services, all of which, in turn, would adversely affect our business, financial condition and results of operations.

Our financial instruments expose us to certain market risks and may increase the volatility of earnings and AOCI.

We hold certain financial instruments measured at fair value. For those financial instruments measured at fair value, we are required to recognize the changes in the fair value of such instruments in earnings or accumulated other comprehensive income ("AOCI") each quarter. Therefore, any increases or decreases in the fair value of these financial instruments have a corresponding impact on reported earnings or AOCI. Fair value can be affected by a variety of factors, many of which are beyond our control, including our credit position, interest rate volatility, capital markets volatility, and other economic factors. Accordingly, we are subject to mark-to-market risk and the application of fair value accounting may cause our earnings and AOCI to be more volatile than would be suggested by our underlying performance.

We may need to raise additional capital and such funds may not be available when needed.

We may need to raise additional capital in the future to provide us with sufficient capital resources to meet our commitments and business needs, particularly if our asset quality or earnings were to deteriorate significantly. Our ability to raise additional capital, if needed, will depend on, among other things, conditions in the capital and financial markets at that time, which are outside of our control, and our financial performance. Economic conditions and the loss of confidence in financial institutions may increase our cost of funding and limit access to certain customary sources of capital, other financial institution borrowings and borrowings from the discount window of the Federal Reserve Board. Any occurrence that may limit our access to the capital markets, such as a decline in the confidence of other financial institutions, or counterparties participating in the capital markets, may adversely affect our costs and our ability to raise capital. An inability to raise additional capital on acceptable terms when needed could have a materially adverse effect on our financial condition and results of operations.

Climate change, and related legislative and regulatory initiatives, have the potential to disrupt our business and adversely impact the operations and creditworthiness of our customers.

Climate change may lead to more frequent and more extreme weather events, such as prolonged droughts or flooding, hurricanes, wildfires and extreme seasonal weather, which could disrupt operations at one or more of our locations and our ability to provide financial products and services to our customers. Such events could also have a negative effect on the financial status and creditworthiness of our customers, which may decrease revenues and business activities from those customers and increase the credit risk associated with loans and other credit exposures to such customers. In addition, weather disasters, shifts in local climates and other disruptions related to climate change may adversely affect the value of real properties securing our loans, which could diminish the value of our loan portfolio. Such events may also cause reductions in regional and local economic activity that may have an adverse effect on our customers, which could limit our ability to raise and invest capital in these areas and communities, each of which could have a material effect on our financial conditions and results of operations.

Political and social attention to the issue of climate change has increased. The federal and state legislatures and regulatory agencies have proposed legislative and regulatory initiatives seeking to mitigate the effects of climate change. These agreements and measures may result in the imposition of taxes and fees, the required purchase of emission credits, and the implementation of significant operational changes. In addition, the federal banking agencies may address climate-related issues in their agendas in various ways, including by increasing supervisory expectations with respect to banks' risk management practices, accounting for the effects of climate change in stress testing scenarios and systemic risk assessments, revising expectations for credit portfolio concentrations based on climate-related factors, and encouraging investment by banks in

climate-related initiatives and lending to communities disproportionately impacted by the effects of climate change. We may incur compliance, operating, maintenance and remediation costs.

Increasing scrutiny and evolving expectations from customers, regulators, investors, and other stakeholders with respect to our environmental, social and governance practices may impose additional costs on us or expose us to new or additional risks.

Companies are facing increasing scrutiny from customers, regulators, investors, and other stakeholders related to their environmental, social and governance ("ESG") practices and disclosure. Investor advocacy groups, investment funds and influential investors are also increasingly focused on these practices, especially as they relate to the environmental, health and safety, diversity, labor conditions and human risks. Increased ESG related compliance costs could result in increases to our overall operational costs. Failure to adapt to or comply with regulatory requirements or investor or stakeholder expectations and standards could negatively impact our reputation, ability to do business with certain partners, and our stock price. New government regulations could also result in new or more stringent forms of ESG oversight and expanding mandatory and voluntary reporting, diligence, and disclosure.

We compete with many larger financial institutions which have substantially greater financial resources than we have.

Competition among financial institutions in Texas is intense. We compete with other bank holding companies, state and national commercial banks, savings and loan associations, consumer financial companies, credit unions, securities brokers, insurance companies, mortgage banking companies, money market mutual funds, asset-based non-bank lenders and other non-bank financial institutions. Many of these competitors have substantially greater financial resources, larger lending limits, larger branch networks, enhanced technology and less regulatory oversight than we do, and are able to offer a broader range of products and services than we can. Failure to compete effectively for deposit, loan and other banking customers in our markets could cause us to lose market share, slow our growth rate and may have an adverse effect on our financial condition, results of operations and liquidity.

Compliance and Regulatory Risks

We may be subject to more stringent capital requirements which would adversely affect our net income and future growth.

The Federal Reserve Board adopted a final rule that implemented the Basel III Rule changes to the international regulatory capital framework and revised the U.S. risk-based and leverage capital requirements for U.S. banking organizations to strengthen identified areas of weakness in capital rules and to address relevant provisions of the Dodd-Frank Act.

The final rule established a stricter regulatory capital framework that requires banking organizations to hold more and higher-quality capital to act as a financial cushion to absorb losses and help banking organizations better withstand periods of financial stress. The final rule increased capital ratios for all banking organizations and introduced a “capital conservation buffer” which is in addition to each capital ratio. If a banking organization dips into its capital conservation buffer, it may be restricted in its ability to pay dividends and discretionary bonus payments to its executive officers. The final rule assigned a higher risk weight to loans that are more than 90 days past due or are on nonaccrual status and to certain commercial real estate facilities that finance the acquisition, development or construction of real property. The final rule also required unrealized gains and losses on certain available-for-sale ("AFS") securities holdings to be included for purposes of calculating regulatory capital requirements unless a one-time opt-out is exercised. We exercised this opt-out right in our March 31, 2015 quarterly financial filing. The final rule also included changes in what constitutes regulatory capital. In addition, Tier 2 capital is no longer limited to the amount of Tier 1 capital included in total capital. Mortgage servicing rights, certain deferred tax assets and investments in unconsolidated subsidiaries over designated percentages of common stock are required to be deducted from capital. The final rule became effective for us on January 1, 2015. As of December 31, 2023, we met all of these new requirements, including the full capital conservation buffer.

Although we currently cannot predict the specific impact and long-term effects that Basel III will have on our Company and the banking industry more generally, the Company may be required to maintain higher regulatory capital levels through the capital conservation buffer which could impact our operations, net income and ability to grow. Furthermore, the Company’s failure to comply with the minimum capital requirements could result in our regulators taking formal or informal actions against us which could restrict our future growth or operations. For example, climate change advocates might not be able to force a regulatory ban on lending to certain industries, but the regulators could increase risk weighting on oil and gas loans.

Legislative and regulatory actions taken now or in the future that impact the financial industry may materially adversely affect us by increasing our costs, adding complexity in doing business, impeding the efficiency of our internal business processes, negatively impacting the recoverability of certain of our recorded assets, requiring us to increase our regulatory capital, limiting our ability to pursue business opportunities, and otherwise resulting in a material adverse impact on our financial condition, results of operation, liquidity, or stock price.

Both the scope of the laws and regulations and the intensity of the supervision to which we are subject may increase in connection with legislative and regulatory developments to address perceived unfairness and abuses under current regulations. Regulatory enforcement and fines

have also increased across the banking and financial services sector. Compliance with these laws and regulations have resulted in and will continue to result in additional costs, which could be significant, and may have a material and adverse effect on our results of operations. In addition, if we do not appropriately comply with current or future legislation and regulations, especially those that apply to our consumer operations, which has been an area of heightened focus, we may be subject to fines, penalties or judgments, or material regulatory restrictions on our businesses, which could adversely affect operations and, in turn, financial results.

The CRA, the Equal Credit Opportunity Act, the Fair Housing Act and other fair lending laws and regulations impose nondiscriminatory lending requirements on financial institutions. The CFPB, OCC, the Department of Justice and other federal and state agencies are responsible for enforcing these laws and regulations. A successful challenge to an institution’s performance under the CRA or fair lending laws and regulations could result in a wide variety of direct and indirect negative consequence sanctions, including the required payment of damages and civil money penalties, injunctive relief, restrictions on mergers and acquisitions activity and restrictions on expansion activity. Private parties may also have the ability to challenge an institution’s performance under fair lending laws in private class action litigation. Such actions, or even the threat of such actions, could have a material adverse effect on the Company's business, financial condition or results of operations.

OFAC, the BSA and related FinCEN and FFIEC Guidelines and regulations could result in material implications.

Regulatory authorities routinely examine financial institutions for compliance with the USA PATRIOT ACT, OFAC, the BSA and related FinCEN and FFIEC Guidelines. Certain products we offer may expose us to enhanced risk in the event of noncompliance, including and not limited to providing our treasury management services to certain money transmitter and money services businesses. Failure to maintain and implement adequate programs as required by these obligations to combat terrorist financing, elder abuse, human trafficking, anti-money laundering and other suspicious activity and to fully comply with all of the relevant laws or regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required. Regulatory authorities have imposed cease and desist orders and significant civil money penalties against institutions found to be violating these regulations.

Our business is subject to significant government regulation.

We operate in a highly-regulated environment and are subject to supervision or regulation by a number of governmental regulatory agencies, including the Federal Reserve Board, the OCC, the FDIC and the CFPB. Regulations adopted by these agencies, which are generally intended to provide protection for depositors and customers rather than for the benefit of shareholders, govern a comprehensive range of matters relating to ownership and control of our shares, our acquisition of other companies and businesses, permissible activities for us to engage in, maintenance of adequate capital levels and other aspects of our operations. The bank regulatory agencies possess broad authority to prevent or remedy unsafe or unsound practices or violations of law.

We are subject to heightened regulatory requirements as our total assets exceed $10 billion.

Our total assets were approximately $13.11 billion as of December 31, 2023. The Dodd-Frank Act and its associated regulations impose various additional requirements on banks and bank holding companies with $10 billion or more in total assets, including a more frequent and enhanced regulatory examination regime. In addition, banks with $10 billion or more in total assets (including our bank) are primarily examined by the CFPB with respect to various federal consumer financial protection laws and regulations, with the Federal Reserve Board maintaining supervision over some consumer related regulations. In light of evolving priorities among government and agency leaders, there is some uncertainty as to how the CFPB examination and regulatory authorities might impact our business in the near and medium terms.

Debit card interchange fee restrictions set forth in the Dodd-Frank Act, which is known as the Durbin Amendment, as implemented by regulations of the Federal Reserve Board, cap the maximum debit interchange fee that a debit card issuer with $10 billion or more in total assets may receive per transaction at the sum of $0.21 plus five basis points of the transaction. A debit card issuer that adopts certain fraud prevention procedures may charge an additional $0.01 per transaction. In July 2022, the Company became subject to the Durbin Amendment which reduced our interchange income per transaction in 2022 and going forward.

Federal income tax reform could have unforeseen effects on our financial condition and results of operations.

The recent changes in the political makeup of the Senate and House of Representatives in the U.S. Congress could result also in the reversal of some or all of the effects of the Tax Cuts and Jobs Act, which may have an adverse effect on our business, financial conditions and results of operations.

Our FDIC deposit insurance assessments could increase substantially resulting in higher operating costs.

We have historically paid the lowest premium rate available due to our sound financial position. Should the number of bank failures increase or the FDIC insurance fund become depleted in others ways, FDIC premiums could increase or additional special assessments could be

imposed. These increased premiums would have an adverse effect on our net income and results of operations. In the fourth quarter of 2023, the FDIC imposed a $1.75 million special assessment on the Bank in response to the FDIC-insured financial institutions that failed in March 2023.

Risks Related to Acquisition Activities

To continue our growth, we are affected by our ability to identify and acquire other financial institutions.

We intend to continue our current growth strategy, including opening new branches and acquiring other banks. The market for acquisitions remains highly competitive, and we may be unable to find satisfactory acquisition candidates in the future that fit our acquisition and growth strategy. To the extent that we are unable to find suitable acquisition candidates, an important component of our growth strategy may be lost. Additionally, our completed acquisitions, or any future acquisitions, may not produce the revenue, earnings or synergies that we anticipated.

We may not be able to complete future acquisitions, may not be successful in realizing the benefits of any acquisitions that are completed, or may choose not to pursue acquisition opportunities we might find beneficial.

A substantial part of our historical growth has been a result of acquisitions of other financial institutions, and we may, from time to time, evaluate and engage in the acquisition of other financial institutions. We must generally satisfy a number of conditions prior to completing any such transaction, including certain bank regulatory approvals. Bank regulators consider a number of factors with regard to all institutions involved in the transaction when determining whether to approve a proposed transaction, including, among others, condition of the Company, its ratings and compliance history, anti-money laundering and BSA compliance history, CRA evaluation results, fair lending history and the effect of the proposed transaction on the financial stability of the institutions involved and the market as a whole.

The process for obtaining required regulatory approvals has become substantially more difficult, time-consuming and unpredictable. We may fail to pursue, evaluate or complete strategic and competitively significant business opportunities as a result of our inability, or our perceived inability, to obtain required regulatory approvals in a timely manner or at all.

Assuming we are able to successfully complete one or more transactions, we may not be able to successfully integrate and realize the expected synergies from any completed transaction in a timely manner or at all. In particular, we may be charged by federal and state regulators with regulatory and compliance failures at an acquired business prior to the date of the acquisition, and these failures by the acquired company may have negative consequences for us, including the imposition of formal or informal enforcement actions. Completion and integration of any transaction may also divert management’s attention from other matters, result in additional costs and expenses, or adversely affect our relationships with our customers and employees, any of which may adversely affect our business or results of operations. As a result, our financial condition may be affected, and we may become more susceptible to general economic conditions and competitive pressures.

Use of our common stock for future acquisitions or to raise capital may be dilutive to existing stockholders.

When we determine that appropriate strategic opportunities exist, we may acquire other financial institutions and related businesses, subject to applicable regulatory requirements. We may use our common stock for such acquisitions. We may also seek to raise capital through selling additional common stock, although we have not historically done so. It is possible that the issuance of additional common stock in such acquisition or capital transactions may be dilutive to the interests of our existing shareholders.

Risks Associated with our Common Stock

The trading volume in our common stock is less than other larger financial institutions.

Although the Company’s common stock is listed for trading on the Nasdaq Global Select Market, the trading volume in our common stock is less than that of other, larger financial services companies although such volume has increased in recent years. A public trading market having the desired characteristics of depth, liquidity and orderliness depends on the presence in the marketplace of willing buyers and sellers of the Company’s common stock at any given time. This presence depends on the individual decisions of investors and general economic and market conditions over which the Company has no control. Given the lower trading volume of the Company’s common stock, significant sales of the Company’s common stock, or the expectation of these sales, could cause the Company’s stock price to fall.

Our stock ownership has shifted to larger institutional shareholders.

Our ownership base has shifted over the past several years resulting in institutional investors and indexed funds holding approximately 56% of our shares as compared to shareholders located in our footprint and other retail individual investors. These institutional shareholders could decide to sell their holdings in our common stock and as such could result in lower market prices of our stock.

Certain banking laws may have an anti-takeover effect.

Provisions of federal banking laws, including regulatory approval requirements, could make it more difficult for a third-party to acquire us, even if doing so would be perceived to be beneficial to our shareholders. These provisions effectively inhibit a non-negotiated merger or other business combination, which, in turn, could adversely affect the market price of our common stock.

We may not continue to pay dividends on our common stock in the future.

Holders of our common stock are only entitled to receive such dividends as our board of directors may declare out of funds legally available for such payments. Although we have historically declared cash dividends on our common stock, we are not required to do so and may reduce or eliminate our common stock dividends in the future. This could adversely affect the market price of our common stock. Also, we are a bank holding company, and our ability to declare and pay dividends is dependent on certain federal regulatory considerations, including the guidelines of the Federal Reserve Board regarding capital adequacy and dividends.

The Company’s stock price can be volatile.

Stock price volatility may make it more difficult for our shareholders to resell their common stock when they want and at prices they find attractive. The Company’s stock price can fluctuate significantly in response to a variety of factors including, among other things:

General market fluctuations, industry factors and general economic and political conditions and events, such as economic slowdowns or recessions, interest rate changes or credit loss trends could also cause the Company’s stock price to decrease regardless of operational results.

An investment in our common stock is not an insured deposit.

Our common stock is not a bank deposit and, therefore, is not insured against loss by the FDIC, any other deposit insurance fund, or by any other public or private entity. Investment in our common stock is inherently risky for the reasons described in this “Risk Factors” section and elsewhere in this Report. As a result, if you acquire our common stock, you may lose some or all of your investment.

General Risk Factors

If we are unable to continue our historical levels of growth, we may not be able to maintain our historical earnings trends.

To achieve our past levels of growth, we have focused on both internal growth and acquisitions. We may not be able to sustain our historical rate of growth or may not be able to grow at all. Additionally, we may not be able to obtain the financing necessary to fund additional growth and may not be able to find suitable acquisition candidates. Various factors, such as economic conditions, competition and heightened regulatory scrutiny, may impede or prohibit the opening of new banking centers and the completion of acquisitions. Further, we may be unable to attract and retain experienced bankers, which could adversely affect our internal growth. If we are not able to continue our historical levels of growth, we may not be able to maintain our historical earnings trends.

ITEM 1B. UNRESOLVED STAFF COMMENTS

None.

ITEM 1C. CYBERSECURITY

Risk Management and Strategy

The Company’s Information Security Program (“Program”) uses a variety of safeguards to protect the confidentiality, integrity, and availability of information. The Program is designed to identify, prevent, or mitigate the risks from cybersecurity threats. The Program leverages recognized security frameworks, such as National Institute of Standards and Technology (NIST) and Federal Financial Institutions Examination Council (FFEIC), to organize, improve, and assess the program and to better manage and reduce cybersecurity risk. The Program is assessed and updated annually and as needed.

The Program is integrated into the Company’s enterprise risk management program. The Company regularly assesses the threats and vulnerabilities to its environment so it can update and maintain its systems and controls to effectively mitigate these risks. Layered security controls are designed to complement each other to protect customer information and transactions. The Company periodically engages third-party experts and consultants to conduct evaluations of our security controls, whether through penetration testing, audits, assessments, or consulting on best practices to address new challenges. Results are used to help drive priorities and initiatives to improve the Program. Additionally, as a regulated entity, bank regulators assess the quality of our information security program during their regular examinations of the Company and its compliance with federal regulations and requirements.

The Company’s third-party risk management program is designed to oversee and identify the cybersecurity threats associated with the use of third-party service providers. While the optics into a third-party’s operation are limited, the Company performs risk-based evaluations of third-party service providers. These evaluations including reviewing information including, but not limited to, security assessment questionnaires, security testing summaries, audit reports performed under the SSAE 18 Audit Standard, and information security policies.

We view security awareness as a continuous program. All Company employees receive cybersecurity and fraud training at required new employee orientation and subsequently receive information security tips via email each business day. Employees also receive monthly security awareness video training and are required to complete annual computer-based training. The Company also provides information security awareness training to business customers and individuals in our communities.

During the fiscal year of this Report, the Company has not identified risks from cybersecurity threats that individually or in the aggregate have materially affected or are reasonably anticipated to materially affect the organization. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving, and we continue to remain vigilant.

Governance

The Company’s system of internal controls also incorporates a protocol for the appropriate reporting and escalation of information and cyber security matters to management and the Board of Directors for resolution and, if necessary, disclosure of any material incidents. The Board of Directors is actively engaged in the oversight of the Company’s continuous efforts to reinforce and enhance its operational resilience and receives education to enhance their oversight efforts accommodate for the ever-evolving information and cyber security threat landscape. The Chief Information Security Officer (“CISO”) regularly updates these committees on the information and cyber security risks, threats, exposures, and mitigation measures. The Company’s incident response process is periodically tested and includes cybersecurity scenarios.

The Program is included in the Company’s enterprise risk management program. The CISO is responsible for developing and implementing our Program and reporting on cybersecurity matters to the Board. Our CISO has over 20 years of related experience, and others on our Corporate Information Security team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed.

The Program is overseen by the Company’s Risk Committee, First Technology Services Board of Directors, Technology Risk Committee, and Security Advisory Committee. Additionally, the First Financial Trust and Asset Management Board of Directors oversee the Program as it relates to the trust subsidiary. Operational committees that manage risks associated with cybersecurity are Change Control Committee and Patch Management Committee.

The Company’s Board of Directors and subsidiary technology and trust companies’ Boards of Directors monitor the Program including policies and practices. The Company’s Risk Committee and technology company’s Board of Directors oversees areas of operational risk such as information technology activities; risks associated with development, infrastructure, and cybersecurity; oversight of information security risk assessments, strategies, policies, and programs; and disaster recovery, business continuity, and incident response process. The CISO also provides periodic cybersecurity updates to the Audit Committee and the Audit Committee Chairman is member of the Risk Committee. The management-level Technology Risk Committee and Security Advisory Committee oversee management of the Program and related assessments. Operational committees that manage risks associated with cybersecurity are Change Control Committee and Patch Management Committee.

We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factor entitled “Disruptions in our information technology systems or a compromise of security with respect to our systems could adversely affect our operating results by limiting our ability to effectively monitor and control our operations, adjust to changing market conditions, implement strategic initiatives or support our customer transactions” and “Our business may be adversely affected by security breaches at third-parties.” in Item 1A- Risk Factors.

ITEM 2. PROPERTIES

Our principal office is located in the First Financial Bank Building at 400 Pine Street in downtown Abilene, Texas. We lease two spaces

in buildings owned by First Financial Bank, N.A. totaling approximately 10,155 square feet. As of December 31, 2023, our subsidiaries

collectively own 78 banking, trust and mortgage facilities, some of which are detached drive-ins, and also lease 12 banking facilities and 12 ATM locations. Our management considers all our existing locations to be well-suited for conducting the business of banking. We are in the process of constructing a new branch location in our existing market in Bryan, Texas.

ITEM 3. LEGAL PROCEEDINGS

From time to time, we and our subsidiaries are parties to lawsuits arising in the ordinary course of our banking business. However, there

are no material pending legal proceedings to which we, our subsidiaries or our other direct and indirect subsidiaries, or any of their properties,

are currently subject. Other than regular, routine examinations by state and federal banking authorities, there are no material proceedings pending or known to be contemplated by any governmental authorities.

ITEM 4. MINE SAFETY DISCLOSURES

Not applicable.

PART II

Market Information

Our common stock, par value $0.01 per share, is traded on the Nasdaq Global Select Market under the trading symbol "FFIN".

Record Holders

As of February 1, 2024, we had 874 registered shareholders of record with our stock transfer agent.

Dividends

See “Item 8—Financial Statements and Supplementary Data—Quarterly Results of Operations” for the frequency and amount of cash dividends paid by us. Also, see “Item 1 – Business – Supervision and Regulation – Payment of Dividends” and “Item 7 – Management’s Discussion and Analysis of the Financial Condition and Results of Operations – Capital and Liquidity – Dividends” for restrictions on our present or future ability to pay dividends, particularly those restrictions arising under federal and state banking laws.

Equity Compensation Plans

See “Item 12 – Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters”.

PERFORMANCE GRAPH

The following performance graph compares cumulative total shareholder returns for our common stock, the Russell 3000 Index, and the S&P U.S. BMI Banks Index, which is a banking index prepared by S&P Global Market Intelligence and is comprised of all U.S. domiciled banks, for a five-year period (December 31, 2018 to December 31, 2023). The performance graph assumes $100 invested in our common stock at its closing price on December 31, 2018, and in each of the Russell 3000 Index and the S&P U.S. BMI Banks Index on the same date. The performance graph also assumes the reinvestment of all dividends. The dates on the performance graph represent the last trading day of each year indicated. The amounts noted on the performance graph have been adjusted to give effect to all stock splits and stock dividends.

First Financial Bankshares, Inc

Source: S&P Global Market Intelligence

© 2024

The following discussion contains forward-looking statements that are subject to risks and uncertainties. Actual results may differ materially from those contemplated by the forward-looking statements as a result of certain factors, including but not limited to those listed in “Item 1A – Risk Factors” and in the “Cautionary Statement Regarding Forward-Looking Statements” notice on page 1.

Introduction

As a financial holding company, we generate most of our revenue from interest on loans and investments, trust fees, gain on sale of mortgage loans and service charges and fees on deposit accounts. Our primary source of funding for our loans and investments are deposits held by our bank subsidiary, First Financial Bank, N.A. Our largest expenses are salaries and related employee benefits. We measure our performance by calculating our return on average assets, return on average equity, regulatory capital ratios, net interest margin and efficiency ratio, which is calculated by dividing noninterest expense by the sum of net interest income on a tax equivalent basis and noninterest income.

The following discussion and analysis of the major elements of our consolidated balance sheets as of December 31, 2023 and 2022, and consolidated statements of earnings for the years 2021 through 2023 should be read in conjunction with our consolidated financial statements, accompanying notes, and selected financial data presented elsewhere in this Form 10-K.

Critical Accounting Policies

We prepare consolidated financial statements based on generally accepted accounting principles (“GAAP”) and customary practices in the banking industry. These policies, in certain areas, require us to make significant estimates and assumptions.

We deem a policy critical if (1) the accounting estimate required us to make assumptions about matters that are highly uncertain at the time we make the accounting estimate; and (2) different estimates that reasonably could have been used in the current period, or changes in the accounting estimate that are reasonably likely to occur from period to period, would have a material impact on the financial statements.

We deem our most critical accounting policies to be (1) our allowance for credit losses and our provision for credit losses and (2) our valuation of financial instruments. We have other significant accounting policies and continue to evaluate the materiality of their impact on our consolidated financial statements, but we believe these other policies either do not generally require us to make estimates and judgments that are difficult or subjective, or it is less likely they would have a material impact on our reported results for a given period. A discussion of (1) our allowance for credit losses and our provision for credit losses and (2) our valuation of financial instruments is included in Notes 1 and 10, respectively, to our Consolidated Financial Statements.

Stock Repurchase

On July 27, 2021, the Company’s Board of Directors authorized the repurchase of up to 5,000,000 common shares through July 31, 2023. On July 25, 2023, the Company's Board of Directors renewed the prior authorization through July 31, 2024.The stock repurchase plan authorizes management to repurchase and retire the stock at such time as repurchases are considered beneficial to the Company and its stockholders. Any repurchase of stock will be made through the open market, block trades or in privately negotiated transactions in accordance with applicable laws and regulations. Under the repurchase plan, there is no minimum number of shares that the Company is required to repurchase. Under the prior authorization, 244,559 shares were repurchased and retired (all during the months of June and July 2022) at an average price of $38.61 per share. Under the current authorization, the Company has repurchased and retired 101,337 shares (all during September 2023) at an average price of $26.99 per share.

Other Recently Issued and Effective Authoritative Accounting Guidance

ASU 2020-04, “Reference Rate Reform (Topic 848): Facilitation of the Effects of Reference Rate Reform on Financial Reporting.” ASU 2020-04 provides optional expedients and exceptions for accounting related to contracts, hedging relationships and other transactions affected by reference rate reform if certain criteria are met. ASU 2020-04 applies only to contracts, hedging relationships, and other transactions that reference the London Interbank Offered Rate (“LIBOR”) or another reference rate expected to be discontinued because of reference rate reform and do not apply to contract modifications made and hedging relationships entered into or evaluated after December 31, 2022, except for hedging relationships existing as of December 31, 2022, that an entity has elected certain optional expedients for and that are retained through the end of the hedging relationship. ASU 2020-04 was effective upon issuance and generally can be applied through December 31, 2022. The adoption of ASU 2020-04 did not have a significant impact on our financial statements.

ASU 2021-01, “Reference Rate Reform (Topic 848): Scope.” ASU 2021-01 clarifies that certain optional expedients and exceptions in ASC 848 for contract modifications and hedge accounting apply to derivatives that are affected by the discounting transition. ASU 2021-01 also

amends the expedients and exceptions in ASC 848 to capture the incremental consequences of the scope clarification and to tailor the existing guidance to derivative instruments affected by the discounting transition. ASU 2021-01 was effective upon issuance and generally can be applied through December 31, 2022. The adoption of ASU 2021-01 did not have a significant impact on our financial statements.

ASU 2022-02, "Financial Instruments - Credit Losses (Topic 326): Troubled Debt Restructurings and Vintage Disclosures." ASU 2022-02 eliminates the accounting guidance for troubled debt restructurings in ASC Subtopic 310-40, Receivables - Troubled Debt Restructurings by Creditors, while enhancing disclosure requirements for certain loan refinancing and restructurings by creditors when a borrower is experiencing financial difficulty. ASU 2022-02 will also require that an entity disclosure current-period gross charge-offs by year of origination for financial receivables and net investment leases within scope of ASC Subtopic 326-20, Financial Instruments - Credit Losses - Measured at Amortized Cost. ASU 2022-02 will become effected for fiscal years beginning after December 15, 2022, including interim periods within those fiscal years, though early adoption is permitted. The adoption of ASU 2022-02 is not expected to have a significant impact on our financial statements.

ASU 2022-06, "Reference Rate Reform (Topic 848): Deferral of the Sunset Date of Topic 848." ASU 2022-06 extends the period of time preparers can utilize the reference rate reform relief guidance provided by ASU 2020-04 and ASU 2021-01, which are discussed above. ASU 2022-06, which was effective upon issuance, defers the sunset date of this prior guidance from December 31, 2022 to December 31, 2024, after which entities will no longer be permitted to apply the relief guidance in Topic 848. The adoption of ASU 2022-06 did not have a significant impact on our financial statements.

ASU 2023-02, "Investments - Equity Method and Joint Ventures (Topic 323): Accounting for Investments in Tax Credit Structures Using the Proportional Amortization Method." ASU 2023-02 is intended to improve the accounting and disclosures for investments in tax credit structures. ASU 2023-02 allows entities to elect to account for qualifying tax equity investments using the proportional amortization method, regardless of the program giving rise to the related income tax credits. Previously, this method was only available for qualifying tax equity investments in low-income housing tax credit structures. ASU 2023-02 has been early adopted by the Company as it relates to the qualifying investments that are generating New Market Tax Credits. The adoption of ASU 2023-02 did not have a significant impact on our financial statements.

ASU 2023-09, “Income Taxes (Topic 740): Improvements to Income Tax Disclosures.” ASU 2023-09 requires entities to disclose more detailed information in their reconciliation of their statutory tax rate to their effective tax rate. Public business entities (PBEs) are required to provide this incremental detail in a numerical, tabular format. The ASU also requires entities to disclose more detailed information about income taxes paid, including by jurisdiction; pretax income (or loss) from continuing operations; and income tax expense (or benefit). PBEs will be required to adopt the new requirements in annual reporting periods beginning after December 15, 2024, and interim periods beginning after December 15, 2025.The adoption of ASU 2023-09 is not expected to have a significant impact on our financial statements.

Selected Financial Data

The selected financial data presented below as of and for the years ended December 31, 2023, 2022, 2021, 2020, and 2019, have been derived from our audited consolidated financial statements. The data set forth below may not be fully comparable from period to period due to an acquisition in 2020 and changes in accounting, including the allowance for credit losses in 2020 (see Notes 1 and 3 to the Notes to Consolidated Financial Statements for further information). The results of operations presented below are not necessarily indicative of the results of operations that may be achieved in the future.

Results of Operations

Performance Summary. Net earnings for 2023 were $198.98 million compared to net earnings of $234.48 million for 2022. Included in earnings for the year ended December 31, 2023, when compared to the year ended December 31, 2022, were (i) a decrease of $17.61 million in net interest income, (ii) a decrease in debit card revenues of $8.56 million, (iii) a decrease in mortgage revenues of $7.15 million, (iv) a $9.26 million decline in gains on sales of securities, and (v) an increase of $4.04 million in FDIC insurance premiums, which includes a $1.75 million special assessment. Offsetting these reductions to earnings were (i) a decline of $6.80 million in the provision for credit losses and (ii) a decline of $5.30 million in incentive and profit sharing expenses.

Net earnings for 2022 were $234.48 million compared to $227.56 million for 2021. The increase in net earnings for 2022 over 2021 was primarily attributable to the overall growth in net interest income from the growth in earning assets. Net earnings in 2022 also include a provision for credit losses of $17.43 million compared to a net reversal of provision for credit losses of $1.14 million in 2021. The increased provision for credit losses in 2022 over 2021 was driven by strong organic loan growth, increases in unfunded commitments and a slight decline in the projected economic forecast metrics post pandemic highs.

On a diluted net earnings per share basis, net earnings were $1.39 for 2023, as compared to $1.64 for 2022 and $1.59 for 2021. The return on average assets was 1.55% for 2023, as compared to 1.76% for 2022 and 1.89% for 2021. The return on average equity was 14.99% for 2023, as compared to 16.72% for 2022 and to 13.31% for 2021.

Net Interest Income. Net interest income is the difference between interest income on earning assets and interest expense on liabilities incurred to fund those assets. Our earning assets consist primarily of loans and investment securities. Our liabilities to fund those assets consist primarily of noninterest-bearing and interest-bearing deposits.

Tax-equivalent net interest income was $395.36 million in 2023, as compared to $416.84 million in 2022, and $385.05 million in 2021. Average earning assets were $12.00 billion in 2023, as compared to $12.46 billion in 2022 and $11.34 billion in 2021. The decrease in tax-equivalent net interest income in 2023 compared to 2022 was largely attributable to the increases in the rates paid on deposits and borrowings and a change in the mix of interest earning assets. The decrease of $461.72 million in average earning assets in 2023 when compared to 2022 was primarily a result of a decrease in taxable securities of $531.39 million and tax-exempt securities of $689.37 million offset by an increase in loans of $860.76 million when compared to 2022. The increase in tax-equivalent net interest income in 2022 compared to 2021 was largely attributable to increases in interest earning assets. The increase of $1.13 billion in average earning assets in 2022 when compared to 2021 was primarily a result of increases in taxable securities of $1.13 billion and loans of $582.26 million offset by a decrease in short-term investments of $372.77 million and tax-exempt securities of $216.64 million when compared to 2021. Average interest-bearing liabilities were $7.84 billion in 2023, as compared to $7.76 billion in 2022 and $6.78 billion in 2021. The yield on earning assets increased 90 basis points in 2023 when compared to 2022 while the rate paid on interest-bearing liabilities increased 143 basis points. The yield on earning assets increased 15 basis points in 2022 when compared to 2021 while the rate paid on interest-bearing liabilities increased 32 basis points.

The table below allocates the change in tax-equivalent net interest income between the amount of change attributable to volume and to rate.

Changes in Interest Income and Interest Expense (in thousands):

The net interest margin for 2023 was 3.29% which was a decrease of five basis points from 2022. The net interest margin in 2022 was 3.34%, a decrease of six basis points from 2021. We experienced downward pressure on our net interest margin the majority of 2023 compared to 2022 primarily due to (i) the effects of the Federal Reserve Board's accelerated rate of raising interest rates in 2022 and 2023, which was preceded by the extended period of historically low levels of short-term interest rates leading up to the first quarter of 2022, and (ii) the shift in the mix of interest-earning assets and interest-bearing deposits. The Federal Reserve Board began increasing interest rates by raising rates 25 basis points in March 2022, 50 basis points in May 2022, and 75 basis points in June, July, September and November 2022, respectively, 50 basis points in December 2022, and 25 basis points in February, March, May, and July 2023, respectively, resulting in a target rate range of 5.25% to 5.50% at December 31, 2023.

Loan rates on variable loans have increased as the majority of such loans are indexed to the applicable prime rate (8.50% at December 31, 2023), subject to underlying floors. With the latest increase in the federal funds rate, the majority of variable rate loans have increased (see additional discussion beginning on page 43).

During 2022, we increased rates on each of the primary depository products in response to the increasing federal funds rate. Additionally, we have approximately $985 million of municipal and related deposits which are indexed to short-term treasury rates which have continued to increase with the changes in the applicable rate index. Average municipal and related deposits totaled $1.46 billion and $1.48 billion for the years ended December 31, 2023 and 2022, respectively, with an average rate paid of 3.13% and 1.01%, for the respective years then ended.

The net interest margin, which measures tax-equivalent net interest income as a percentage of average earning assets, is illustrated in the table below for the years 2021 through 2023.

Average Balances and Average Yields and Rates (in thousands, except percentages):