Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files).

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act).

The aggregate market value of the common stock held by non-affiliates of the Registrant was approximately $520.7$515.5 million based on the closing price of the common stock of $33.80$38.78 on June 30, 2022,2023, as reported by The Nasdaq Global Select Market. As of February 15, 2023,2024, the Registrant had 13,710,35313,649,223 shares outstanding of common stock.

Certain information required for Part III of this report is incorporated by reference to the Registrant’s Proxy Statement for the 20232024 Annual Meeting of Shareholders.

This report may contain or incorporate by reference forward-looking statements made pursuant to the safe harbor provisions of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended. Although we believe that, in making any such statements, our expectations are based on reasonable assumptions, forward-looking statements are not guarantees of future performance and involve risks, uncertainties, and other factors beyond our control, which may cause future performance to be materially different from expected performance summarized in the forward-looking statements. These risks, uncertainties and other factors are discussed in the section Part I, Item 1A, “Risk Factors.” We undertake no obligation to publicly update or revise any forward-looking statements to reflect changed assumptions, the occurrence of anticipated or unanticipated events, or changes to future results over time.

Cass Information Systems, Inc. (“Cass” or the “Company”) provides payment and information processing services to large manufacturing, distribution and retail enterprises across the United States. The Company’s services include freight invoice rating, payment processing, auditing, and the generation of accounting and transportation information. Cass also processes and pays facility-related invoices, which include electricity and gas as well as waste and telecommunications expenses, and is a provider of telecom expense management solutions. Cass solutions include integrated payments, a B2B payment platform for clients that require an agile fintech partner. Additionally, the Company offers a church management software solution and an on-line platform to provide generosity services for faith-based and non-profit organizations. The Company’s bank subsidiary, Cass Commercial Bank (the “Bank”), supports the Company’s payment operations. The Bank also provides banking services to its target markets, which include privately held businesses in the St. Louis metropolitan area and restaurant franchises and faith-based ministries within the United States.

Cass is an information services company with a primary focus on processing payables and payables-related transactions for large corporations located in the United States. Cass possesses four core competencies that encompass most of its processing services.

Cass’ core competencies allow it to perform the highest volumes of transaction processing in an integrated, efficient and systematic approach. Not only is Cass able to process the transaction, it is also able to collect the data defining the transaction and effect the financial payment governing its terms.

These core competencies, enhanced through shared business processes, drive Cass’ strategic business units. Building upon these foundations, Cass continues to explore new business opportunities that leverage these competencies and processes.

The Company, through its Transportation Information Services business unit, is one of the largest firms in the transportation bill processing and payment industry in the United States based on the total dollars of transportation bills paid and items processed. Competition consists of a few primary competitors and numerous small transportation bill audit firms located throughout the United States. While offering transportation payment services, few of these audit firms compete on a national basis. These competitors compete mainly on price, functionality and service levels. The Company, through its Utility Expense Management business unit, also competes with other companies located throughout the United States that pay energy and wasteutility bills and provide management reporting. Available data indicates that the Company is one of the largest providers of energyutility information processing and payment services. Cass is unique among these competitors in that it is not exclusively affiliated with any one energy service provider (“ESP”). Various ESPs market the Company’s services, adding value with their unique auditing, consulting and technological capabilities. Many of Cass’ services are customized for the ESPs, providing a full-featured solution without any development costs to the ESP. The Company, through its Telecom Information Services business unit, is a leader in the growing telecom expense management market and competes with other companies located throughout the United States in this market. The Company, through its Waste Expense Management business, is one of the largest providers of waste invoice management solutions and competes against small expense management companies along with large national account programs of major haulers. The CompanyCompany's TouchPoint division known as TouchPoint offers a church management software solution and an on-line platform to provide generosity services for faith-based and non-profit organizations, which is a complementary service offering to the Bank’s faith-based customers. Also, the Company, through its CassPay operation, competes with providers of corporate payment solutions.

The Bank is organized as a Missouri trust company with banking powers and was founded in 1906. The Company was originally classified as a bank holding corporation due to its ownership of a federally-insured commercial bank and was originally organized in 1982 as Cass Commercial Corporation under the laws of Missouri. Approval by the Board of Governors of the Federal Reserve System was received in February 1983. The Company changed its name to Cass Information Systems, Inc. in January 2001. In December 2011, the Federal Reserve Bank (“FRB”) of St. Louis approved the election of Cass Information Systems, Inc. to become a financial holding company. As a financial holding company, Cass may engage in activities that are financial in nature or incidental to a financial activity. The Bank encounters competition from numerous banks and financial institutions located throughout the St. Louis, Missouri metropolitan area and other areas in which the Bank competes. The Bank’s principal competitors, however, are large bank holding companies that are able to offer a wide range of banking and related services through extensive branch networks. The Bank targets its services to privately held businesses, restaurant franchises, and faith-based ministries located in St. Louis, Missouri and other selected cities located throughout the United States.

The Company holds several trademarks for the payment and rating services it provides. These include: FreightPay®, Transdata®, Ratemaker®, Best Rate®, Rate Exchange®, CassPort®, Cass Freight Index®, Cass Truckload Linehaul Index®, Cass Intermodal Price Index® Expense$mart®, ExpenseSmart®, TouchPoint®, Gyve®, Generosity Made Simple®, WasteVision™ and Direct2Carrier Payments™. The Company holds patents for methods and systems for managing employee-liable expenses and methods and systems for communicating expense management information.

The Company and its subsidiaries have a varied client base and are not dependent on any one customer or group of customers for a significant portion of its business.

The Company and its subsidiaries had 9401,061 full-time and 269255 part-time employees as of February 15, 2023.2024. Of these employees, the Bank had 7066 full-time and no part-time employees.

Cass has long been committed to comprehensive and competitive compensation and benefits programs to attract and retain talent in a competitive environment. Retention of skilled and highly trained employees is critical as the Company’s future operating results depend substantially upon the continued service of executive officers and key personnel. Furthering the philosophy to attract and retain a pool of talented and motivated employees who will continue to advance the Company’s purpose and contribute to overall success, compensation and benefits programs include: a noncontributory profit sharing program for most employees; a defined contribution 401(k) plan to provide retirement benefits to eligible employees; a performance-based equity compensation program for executive officers and key personnel; and incentive programs for loan and sales personnel. Cass also provides comprehensive health, dental, and vision plans to most employees, as well as free employee assistance programs to all employees and members of their families.

The Company invests in its employees’ futurefutures by assisting with tuition reimbursement for continued education throughout the Company’s employee ranks.education. Employees are also able to participate in educational seminars run by outside parties to maintain and expand professional knowledge.

In order to develop a workforce that aligns with the Company’s corporate values, regularly sponsored campaigns and events occur, such as charitable workplace campaigns, food drives to assist local food banks, and toy drives to support charities during the holidays. The Company offers paid time off for charitable endeavors. Additionally, the Company supports a number of organizations with annual financial contributions.

The Company recognizes the benefits of building a corporate culture that promotes diversity, equity and inclusion ("DEI") to foster unique ideas and ways of thinking. In pursuit of the Company's overall DEI mission, Cass focuses on: a) cultivating an environment that encourages collaboration, flexibility and fairness to enable all employees to contribute to their full potential; b) promoting diversity in our talent management and succession planning processes and employee development programs; and c) ensuring leadership commitment in facilitating the Company's DEI efforts.

In January 2022, the Company created a DEI Committee. The Company's DEI Committee was formed after a thorough process of determining a charter and is actively in the process of expandinglooks to expand the Company's DEI vision. The committee members are passionate about DEI efforts and represent the Company's various business divisions and corporate departments. The Company continues to promote DEI within its culture and make improvements to human resources programs to support related initiatives. As of December 31, 2022, 70%2023, 69% of the Company's U.S. employees were female, and 23% were ethnically diverse. Within the management group, 47%52% were female, and 16%13% were ethnically diverse. Over the past year, theThe Company has continuedcontinues to support and provide diversity training to all employees. The Company also continues its commitment to providing a workplace that is free of harassment and discrimination by taking proactive measures and providing all employees with non-discrimination and sexual harassment prevention training on an annual basis. The DEI initiatives will continue to beare supported and promoted to provide all employees a place where they feel welcomed, appreciated and valued.

Equal opportunities, anti-harassment, non-discrimination, the health and safety of employees and work-life balance are actively promoted as more fully described in the Company's Environmental, Social, and Governance ("ESG") report.

The Company and its bank subsidiary are extensively regulated under federal and state law. These laws and regulations are intended to primarily protect depositors, not shareholders. The Bank is subject to regulation and supervision by the Missouri Division of Finance, the FRB and the Federal Deposit Insurance Corporation (the “FDIC”). The Company is a financial holding company within the meaning of the Bank Holding Company Act of 1956, as amended (the “BHC Act”), and as such, it is subject to regulation, supervision and examination by the FRB. Significant elements of the laws and regulations applicable to the Company and the Bank are described below. The description is qualified in its entirety by reference to the full text of the statutes, regulations and policies that are described. Also, such statutes, regulations and policies are continually under review by Congress and state legislatures and federal and state regulatory agencies. A change in statutes, regulations or regulatory policies applicable to the Company and its subsidiaries could have a material effect on the business, financial condition and results of operations of the Company.

To maintain financial holding company status, a financial holding company and all of its depository institution subsidiaries must be “well capitalized” and “well managed.” A depository institution subsidiary is considered to be “well capitalized” if it satisfies the requirements for this status discussed in the section “Prompt Corrective Action” below. A depository institution subsidiary is considered “well managed” if it received a composite rating and management rating of at least “satisfactory” in its most recent examination. A financial holding company’s status will also depend upon it maintaining its status as “well capitalized” and “well managed’ under applicable FRB regulations. If a financial holding company ceases to meet these capital and management requirements, the FRB may impose limitations or conditions on the conduct of its

permissible for financial holding companies or acquire a company engaged in such financial activities without prior approval of the FRB. If the company does not return to compliance within 180 days, the FRB may require divestiture of the holding company’s depository institutions.

In order for a financial holding company to commence any new activity permitted by the BHC Act or to acquire a company engaged in any new activity permitted by the BHC Act, each insured depository institution subsidiary of the financial holding company must have received a rating of at least “satisfactory” in its most recent examination under the Community Reinvestment Act. See “Community Reinvestment Act” below.

The FRB has the power to order any bank holding company or its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the FRB has reasonable grounds to believe that continuation of such activity or such ownership or control constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company.

The BHC Act, the Bank Merger Act, and other federal and state statutes regulate acquisitions of banks and banking companies. The BHC Act requires the prior approval of the FRB for the direct or indirect acquisition by the Company of more than 5% of the voting shares or substantially all of the assets of a bank or bank holding company. Under the Bank Merger Act, the prior approval of the FRB or other appropriate bank regulatory authority is required for the Bank to merge with another bank or purchase the assets or assume the deposits of another bank. In reviewing acquisition applications, the bank regulatory authorities will consider, among other things, the competitive effect and public benefits of the transactions, the capital position of the combined organization, the risks to the stability of the U.S. banking or financial system, the applicant’s performance record under the Community Reinvestment Act and its compliance with fair housing laws.

From time to time, the Company's Board of Directors has authorized stock repurchase plans. Bank holding companies must consult with the Federal Reserve before redeeming any equity or other capital instrument included in tier 1 or tier 2 capital prior to stated maturity, if such redemption could have a material effect on the level or composition of the organization’s capital base. In addition, a bank holding company is unable to repurchase shares equal to 10% or more of its net worth if it would not be well-capitalized (as defined by the Federal Reserve) after giving effect to such repurchase. Bank holding companies experiencing financial weaknesses, or that are at significant risk of developing financial weaknesses, must consult with the Federal Reserve before redeeming or repurchasing common stock or other regulatory capital instruments.

In August 2022, the Inflation Reduction Act of 2022 (the “Inflation Reduction Act") was enacted. Among other things, the Inflation Reduction Act imposes a new 1% excise tax on the fair market value of stock repurchased after December 31,

2022 by publicly traded U.S. corporations. With certain exceptions, the value of stock repurchased is determined net of stock issued in the year, including shares issued pursuant to compensatory arrangements.

The Basel III Capital Rules require the Company and the Bank to maintain the following:

The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of common equity Tier 1 capital to risk-weighted assets above the minimum but below the conservation buffer will face limitations on the payment of dividends, common stock repurchases and discretionary cash payments to executive officers based on the amount of the shortfall.

Common equity Tier 1 capital is generally defined as common stockholders’ equity and retained earnings. Tier 1 capital is generally defined as common equity Tier 1 and Additional Tier 1 capital. Additional Tier 1 capital generally includes certain noncumulative perpetual preferred stock and related surplus and minority interests in equity accounts of consolidated subsidiaries. Total capital includes Tier 1 capital (common equity Tier 1 capital plus Additional Tier 1 capital) and Tier 2 capital. Tier 2 capital is comprised of capital instruments and related surplus meeting specified requirements. Also included in Tier 2 capital is the allowance for credit losses limited to a maximum of 1.25% of risk-weighted assets and, for non-advanced approaches institutions like Cass that have exercised a one-time opt-out election regarding the treatment of Accumulated Other Comprehensive Income (“AOCI”), up to 45% of net unrealized gains on available-for-sale equity securities with readily determinable fair market values.

The calculation of all types of regulatory capital is subject to deductions and adjustments specified in the regulations. For instance, the Basel III Capital Rules and the Capital Simplification Rulescapital simplification rules enacted in 2019 provide for a number of deductions from and adjustments to common equity Tier 1 capital. These include, for example, the requirement that certain deferred tax assets and significant investments in non-consolidated financial entities be deducted from Tier 1 capital to the extent that any one such category exceeds 25% of common equity Tier 1 capital.

In determining the amount of risk-weighted assets for purposes of calculating risk-based capital ratios, all assets, including certain off-balance sheet assets, are multiplied by a risk weight factor assigned by the regulations based on the risks believed inherent in the type of asset. Higher levels of capital are required for asset categories believed to present greater risk. For example, a risk weight of 0% is assigned to cash and U.S. government securities, a risk weight of 50% is generally assigned to prudently underwritten first lien one to four-family residential mortgages, a risk weight of 100% is assigned to commercial and consumer loans, a risk weight of 150% is assigned to certain past due loans, and a risk weight of between 0% to 600% is assigned to permissible equity interests, depending on certain specified factors.

The FRB has authority to establish individual minimum capital requirements in appropriate cases upon a determination that an institution’s capital level is or may become inadequate in light of the particular risks or circumstances. As of December 31, 2022,2023, the Company and the Bank met all capital adequacy requirements under the Basel III Capital Rules.

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms (commonly referred to as “Basel IV”). Among other things, these standards revise the Basel Committee's standardized approach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain “unconditionally cancellable commitments,” such as unused credit card lines of credit) and

provides a new standardized approach for operational risk capital. Under the Basel framework, these standards went into effect on January 1, 2023, with an aggregate output floor phasing in through January 1, 2027. Under the current U.S. capital rules, operational risk capital requirements and a capital floor apply only to advanced approaches institutions, and not to the Company or the Bank. The impact of Basel IV on the Company will depend on the manner in which it is implemented by the federal bank regulators.

The FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC.

A depository institution is deemed to be (i) “well-capitalized” if the institution has a total risk-based capital ratio of 10% or greater, a Tier 1 risk-based capital ratio of 8% or greater, a leverage ratio of 5% or greater, a common equity Tier 1 ratio of 6.5% or greater and is not subject to any regulatory order agreement or written directive to meet and maintain a specific capital level for any capital measure; (ii) “adequately capitalized” if the institution has a total risk-based capital ratio of 8% or greater, a Tier 1 risk-based capital ratio of 6% or greater, a leverage ratio of 4% or greater, a common equity Tier 1 ratio of 4.5% or greater and does not meet the definition of “well capitalized”; (iii) “undercapitalized” if the institution has a total risk-based capital ratio that is less than 8%, a Tier 1 risk-based capital ratio of less than 6%, a leverage ratio of less

than 4% or a common equity Tier 1 ratio of less than 4.5%; (iv) “significantly undercapitalized” if the institution has a total risk-based capital ratio of less than 6%, a Tier 1 risk-based capital ratio of less than 4%, a leverage ratio of less than 3% or a common equity Tier 1 ratio of less than 3%; and (v) “critically undercapitalized” if the institution has a ratio of tangible equity (as defined in the regulations) to total assets that is equal to or less than 2%. An institution may be deemed to be in a capital category that is lower than indicated by its capital ratios if it is determined to be in an unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters. A bank’s capital category is determined solely for the purpose of applying prompt corrective action regulations, and the capital category may not constitute an accurate representation of the bank’s overall financial condition or prospects for other purposes.

Subject to a narrow exception, a receiver or conservator is required to be appointed for an institution that is “critically undercapitalized” within specified time frames. The regulations also provide that a capital restoration plan must be filed with the FRB within 45 days of the date an institution is deemed to have received notice that it is “undercapitalized,” “significantly undercapitalized” or “critically undercapitalized.” Compliance with the plan must be guaranteed by any parent holding company up to the lesser of 5% of the institution’s total assets when it was deemed to be undercapitalized or the amount necessary to achieve compliance with applicable capital requirements. In addition, numerous mandatory supervisory actions become immediately applicable to an undercapitalized institution including, but not limited to, increased monitoring by regulators and restrictions on growth, capital distributions and expansion. The FRB could also take any one of a number of discretionary supervisory actions, including the issuance of a capital directive and the replacement of senior executive officers and directors. Significantly and critically undercapitalized institutions are subject to additional mandatory and discretionary measures.

As of December 31, 2022,2023, the most recent notification from the regulatory agencies categorized the Company and the Bank as well-capitalized. For further information regarding the capital ratios and leverage ratio of the Company and the Bank, see Item 8, Note 2 of this report.

company to commence any new activity permitted by the BHC Act, or to acquire any company engaged in any new activity permitted by the BHC Act, each insured depository institution subsidiary of the financial holding company must have received a rating of at least “satisfactory” in its most recent examination under the CRA. The Bank received a rating of “satisfactory” in its most recent CRA exam.

On May 5, 2022, federal banking regulators requested comment onIn October 2023, the OCC, together with the Federal Reserve and FDIC, issued a joint notice of proposed rulemaking intendedfinal rule to strengthen and modernize the CRA regulationsregulatory framework. The final rule is intended, among other things, to adapt to changes in the banking industry, including the expanded role of mobile and framework. Untilonline banking, and to tailor performance standards to account for differences in bank size and business models. The final rule introduces new tests under which the proposed rulemaking isperformance of banks with over $2 billion in assets will be assessed. The new rule also includes data collection and reporting requirements, some of which are applicable only to banks larger than the Bank and updates the definitions of community development and process by which banks can seek approval of qualifying projects. Most provisions of the final andrule will become effective the Companyon January 1, 2026, and the Bankdata reporting requirements will continue to operate under the CRA regulations currently in effect. At this time, it is uncertain what effect the impending CRA regulations will havebecome effective on the Company and the Bank with respect to their CRA activities.January 1, 2027.

The Bank is also subject to regulatory guidelines establishing standards for safeguarding customer information and maintaining information security programs. The standards set forth in the guidelines are intended to ensure the security and confidentiality of customer records and information, protect against any anticipated threats or hazards to the security or integrity of such records and protect against unauthorized access to or use of such records or information that could result in substantial harm or inconvenience to any customer.

Federal law also limits the Bank’s authority to extend credit to its directors, executive officers and 10% shareholders, as well as to entities controlled by such persons. Among other things, extensions of credit to insiders are required to be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than those prevailing for comparable transactions with unaffiliated persons. Also, the terms of such extensions of credit may not involve more than the normal risk of repayment or present other unfavorable features and may not exceed certain limitations on the amount of credit extended to such persons, individually and in the aggregate, which limits are based, in part, on the amount of the Bank’s capital.

Recently, the federal banking agencies adopted a final rule requiring banking organizations to notify their primary banking regulator within 36 hours of determining that a “computer-security incident” has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss, or its operations that would impact the stability of the United States. Banking organizations are also required to notify each affected customer as soon as possible in the event of an incident that results in actual or potential harm to the integrity or availability of information and systems or that violates or threatens to violate the organization’s security for four or more hours.

Risks and exposures related to cybersecurity attacks, including litigation and enforcement risks, are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of internet banking, mobile banking and other technology-based products and services by the Company and its customers. See Item 1A, “Risk Factors” for a further discussion of risks related to cybersecurity.

The USA PATRIOTAnti-Money Laundering Act gives federal agencies additional powersof 2020 (“AMLA”) amended the BSA and was intended to address terrorist threats through enhanced domestic security measures, expanded surveillance powers, increased information sharing,be a comprehensive reform and broadened AML requirements. The USA PATRIOT Act mandates thatmodernization to U.S. bank secrecy and anti-money laundering laws. Among other things, it codifies a risk-based approach to anti-money laundering compliance for financial service companies implement additional policies and procedures and take heightened measures designed to address any or allinstitutions; requires the U.S. Department of the following matters: customer identification programs, moneyTreasury to promulgate priorities for anti-money laundering terroristand countering the financing identifyingof terrorism policy; requires the development of standards for testing technology and reporting suspicious activitiesinternal processes for BSA compliance; expands enforcement- and currency transactions, currency crimes,investigation-related authority, including increasing available sanctions for certain BSA violations; and cooperation between financial institutionsexpands BSA whistleblower incentives and law enforcement authorities.protections. Many of the statutory provisions in the AMLA will require additional rulemakings, reports and other measures, and the impact of the AMLA will depend on, among other things, rulemaking and implementation guidance.

On January 1,In 2021, Congress enactedpassed the Corporate Transparency Act as part of the National Defense Authorization Act, which enacted the most significant overhaul of the BSA and related AML laws since the USA PATRIOT Act. Notable amendments include (i) significant changes to the collection of beneficial ownership information and the establishment of a beneficial ownership registry, which requires corporate entities (generally, any corporation, limited liability company or other similar entity with 20 or fewer employees and annual gross income of $5 million or less) to report beneficial ownership information to FinCEN (which information will be maintained by FinCEN and made available upon request to financial institutions); (ii) enhanced whistleblower provisions, which provide that one or more whistleblowers who voluntarily provide original information

In 2021, FinCENthe OCC issued proposed regulations that would implementprinciples for climate-related financial risk management for national banks with more than $100 billion in total assets. In 2022, the amendments regarding beneficial ownershipFDIC and FRB issued their own proposed principles for climate risk management by larger banking organizations. Although these risk management principles, if adopted as proposed.proposed, would not apply to the Bank directly based upon its current size, the regulators have indicated that all banks, regardless of their size, may have material exposures to climate-related financial and other risks that require prudent management. The federal banking agencies are expected to adopt a more formal climate risk management framework for larger banking organizations in the coming months. As climate-related supervisory guidance is considered and formalized for all banks and financial institutions, the Company may be required to expend significant capital and incur compliance, operating, maintenance and remediation costs in order to conform to such requirements.

Certain of these laws are consumer protection laws that extensively govern the Company’s relationship with its customers. Violations of applicable consumer protection laws can result in significant potential liability from litigation brought by customers, including actual damages, restitution and attorneys’ fees. Federal bank regulators, state attorneys general and state and local consumer protection agencies may also seek to enforce consumer protection requirements and obtain these and other remedies, including regulatory sanctions, customer rescission rights, action by the state and local attorneys general in each jurisdiction in which the Company operates and civil money penalties. Failure to comply with consumer protection requirements may also result in the Company’s inability to pursue merger or acquisition transactions.

Cass files annual, quarterly and current reports with the Securities and Exchange Commission (the “SEC”). Cass will, as soon as reasonably practicable after they are electronically filed with or furnished to the SEC, make available free of charge

on its website each of its Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, all amendments to those reports, and its definitive proxy statements. The address of Cass’ website is: www.cassinfo.com.

The reference to the Company’s website address does not constitute incorporation by reference of the information contained on the website and should not be considered part of this report.

For the statistical disclosure by bank holding companies, refer to Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations.”

This section highlights specific risks that could affect the Company’s business. Although this section attempts to highlight key factors, please be aware that other risks may prove to be important in the future. New risks may emerge at any time, and Cass cannot predict such risks or estimate the extent to which they may affect the Company’s financial performance. In addition to the factors discussed elsewhere or incorporated by reference in this report, the identified risks that could cause actual results to differ materially include the following:

Local, domestic, and international economic, political and industry-specific conditions and governmental monetary and fiscal policies affect the industries in which the Company competes, directly and indirectly. Conditions such as inflation, recession, unemployment, volatile interest rates, tight money supply, real estate values, international conflicts, global pandemics, natural disasters, risks related to climate change, and other factors outside of Cass’ control may adversely affect the Company. Economic downturns could result in the delinquency of outstanding loans, which could have a material adverse impact on Cass’ earnings.

Although the Company regularly reviews credit exposure related to its customers and various industry sectors in which it has business relationships, default risk may arise from events or circumstances that are difficult to detect or foresee. Under such circumstances, the Company could experience an increase in the level of provision for credit losses, delinquencies, nonperforming assets, net charge-offs and allowance for credit losses.

The operations of financial institutions such as the Company are dependent to a large degree on net interest income, which is the difference between interest income from loans and investments and interest expense on deposits and borrowings. Prevailing economic conditions, the fiscal and monetary policies of the federal government and the policies of various regulatory agencies all affect market rates of interest, which in turn significantly affect financial institutions’ net interest income. Fluctuations in interest rates affect Cass’ financial statements, as they do for all financial institutions. Volatility in interest rates can also result in disintermediation, which is the flow of funds away from financial institutions into direct investments, such as federal government and corporate securities and other investment vehicles, which, because of the absence of federal insurance premiums and reserve requirements, generally pay higher rates of return than financial institutions. Due in part to the recent increase in the Federal Funds rate, throughout 2022, the Company's net interest margin increased to 3.25% in 2023 from 2.74% in 2022, from 2.31% in 2021, therefore increasing net interest income. As discussed in greater detail in Item 7A, “Quantitative and Qualitative Disclosures about Market Risk,” a decline in market interest rates would be expected to have a negative impact on the Company’s net interest income.

As of December 31, 2022,2023, the Company had $21.4$20.7 million of goodwill and other intangible assets. A significant decline in the Company's expected future cash flows, a significant adverse change in the business climate, slower growth rates or a significant and sustained decline in the price of the Company's common stock may necessitate taking charges in the future related to the impairment of goodwill and other intangible assets which could have a material adverse effect on the Company's business, financial condition and results of operations.

Although the Company regularly reviews credit exposure related to its customers and various industry sectors in which it has business relationships, default risk may arise from events or circumstances that are difficult to detect or foresee. Under such circumstances, the Company could experience losses related to funds remitted for payment to freight carriers, utility companies and other such companies, prior to receiving funds from its customers.

Cass’ customer base consists, in part, of lending concentrations in several segments and geographical areas. If any of these segments or areas is significantly affected by weak economic conditions, the Company could experience increased credit losses, and its business could be adversely affected.

A decline in the cost of oil worldwide can have a negative effect on both the number of freight transactions processed and the dollar amount of invoices processed. For example, lower oil prices can cause a significant drop in drilling supplies being transported to fracking operations by domestic railroads and trucks. Lower oil prices can also result in lower gas and fuel prices, negatively affecting the dollar amounts of the invoices that Cass processes for its freight and shipping customers. A decline in oil prices could have an adverse effect on the Company’s revenues and could significantly impact its results of operations.

In the ordinary course of business, the Company depends on the reliable operation of its computer operations and network connections from its clients to its systems. Any failure, interruption, or breach in security of these systems would cause Cass to be unable to process transactions for its clients, resulting in decreased revenues. The Company also relies on electronic communications and information systems to store sensitive customer data. Any failure, interruption, breach in

security or loss of data, whatever the cause, could reduce client satisfaction with the Company’s products and services and harm Cass’ financial results. These types of threats may derive from human error, fraud or malice on the part of external or internal parties, or may result from accidental technological failure. Further, to access the Company’s products and services, Cass’ customers may use computers and mobile devices that are beyond the Company’s security control systems. The Company’s technologies, systems, networks and software, and those of other financial institutions have been, and are likely to continue to be, the target of cybersecurity threats and attacks, which may range from uncoordinated individual attempts to sophisticated and targeted measures directed at Cass. The risk of a security breach or disruption, particularly through cyber-attack or cyber intrusion, has increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. A material security problem affecting Cass could damage its reputation, deter prospects from purchasing its products and services, deter customers from using its products and services or result in liability to Cass.

Cloud technologies are also critical to the operation of the Company's systems, and reliance on cloud technologies is growing. Service disruptions in cloud technologies may lead to delays in accessing, or the loss of, data that is important to the Company's businesses and may hinder customers access to products and services.

Although the Company makes significant efforts to maintain the security and integrity of Cass’ information systems and have implemented various measures to manage the risk of a security breach or disruption, there can be no assurance that Cass’ security efforts and measures will be effective or that attempted security breaches or disruptions would not be successful or damaging. Even the most well protected information, networks, systems and facilities remain potentially vulnerable because attempted security breaches, particularly cyber-attacks and intrusions, or disruptions will occur in the future, and because the techniques used in such attempts are constantly evolving and generally are not recognized until launched against a target, and in some cases are designed not to be detected and, in fact, may not be detected. Accordingly, the Company may be unable to anticipate these techniques or to implement adequate security barriers or other preventative measures, and thus it is virtually impossible to entirely mitigate this risk. While specific “cyber” insurance coverage is maintained, which would apply in the event of various breach scenarios, the amount of coverage may not be adequate in any particular case. Furthermore, because cyber threat scenarios are inherently difficult to predict and can take many forms, some breaches may not be covered under Cass’ cyber insurance coverage. A security breach or other significant disruption of Cass’ information systems or those related to customers, merchants and third-party vendors, including as a result of cyber-attacks, could i) disrupt the proper functioning of Cass’ networks and systems and therefore operations and/or those of certain customers; ii) result in the unauthorized access to, and destruction, loss, theft, misappropriation or release of confidential, sensitive or otherwise valuable information of the Company or its customers; iii) result in a violation of applicable privacy, data breach and other laws, subjecting the Company to additional regulatory scrutiny and expose Cass to civil litigation, governmental fines and possible financial liability; iv) require significant management attention and resources to remedy the damages that result; or v) harm Cass’ reputation or cause a decrease in the number of customers that choose to do business with the Company. The occurrence of any of the foregoing could have a material adverse effect on Cass’ business, financial condition and results of operations.

If competitors introduce new products and services embodying new technologies, or if new industry standards and practices emerge, the Company’s existing product and service offerings, technology and systems may become obsolete. Further, if Cass fails to adopt or develop new technologies or to adapt its products and services to emerging industry standards, Cass may lose current and future customers. Finally, Cass’ ability to adopt these technologies can also be inhibited by intellectual property rights of third parties. Any of these could have a material adverse effect on its business, financial condition and results of operations. The payment processing and financial services industries are changing rapidly and in order to remain competitive, Cass must continue to enhance and improve the functionality and features of its products, services and technologies. These changes may be more difficult or expensive than the Company anticipates.

Instruments, systems and strategies used to hedge or otherwise manage exposure to various types of credit, interest rate, market and liquidity, operational, regulatory/compliance, business risks and enterprise-wide risks could be less effective than anticipated. As a result, the Company may not be able to effectively mitigate its risk exposures in particular market environments or against particular types of risk.

The Company uses a variety of financial tools, models and other methods to anticipate customer behavior as part of its strategic and financial planning and to meet certain regulatory requirements. Individual, economic, political and industry-specific conditions and other factors outside of Cass’ control could alter predicted customer borrowing, repayment, investment, deposit, and payable processing practices. Such a change in these practices could adversely affect Cass’ ability to anticipate business needs, including cash flow and its impact on liquidity, and to meet regulatory requirements.

The Company maintains an ACL, which is a reserve established through a provision for credit losses charged to expense. The ACL is a valuation account that is deducted from the amortized cost basis to present the net amount expected to be

The determination and application of the ACL accounting policy involves judgments, estimates, and uncertainties that are subject to change. Changes in these assumptions, estimates or the conditions surrounding them may have a material impact on the Company’s financial condition, liquidity or results of operations. Various regulatory agencies, as an integral part of the examination process, periodically review the ACL. Such agencies may require the Company to recognize additions to the ACL or reserve increases to adversely graded classified loans based on information available to them at the time of their examinations.

The application of the model used to determine the ACL could result in volatility in earnings. Additionally, if charge-offs in future periods exceed the ACL, the Company will need additional provisions to increase the ACL. Any increases in the ACL will result in a decrease in net income and, possibly, capital, and may have a material adverse effect on the Company’s business, financial condition and results of operations.

See Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Provision and Allowance for Credit Losses and Unfunded Commitments” and Item 8, “Financial Statements and Supplementary Data—Note 1” for additional information.

The Company operates in a very competitive environment, which is characterized by competition from a number of other vendors and financial institutions in each market in which it operates. The Company competes with large payment processors and national and regional financial institutions and also smaller auditing companies and banks in terms of products and pricing. If the Company is unable to compete effectively in products and pricing in its markets, business could decline.

The industries in which the Company operates are very competitive. The Company not only competes for business opportunities with new customers, but also competes to maintain and expand the relationships it has with its existing

customers. The Company continues to experience pressures to maintain these relationships as its competitors attempt to capture its customers.

The Company makes certain projections as a basis for developing plans and strategies for its payment processing and banking products. If the Company does not accurately determine demand for its products and services, it could result in the Company incurring significant expenses without the anticipated increases in revenue, which could result in an adverse effect on its earnings.

In addition, there are risks and uncertainties associated with the introduction of new products and services, including substantial investments of time and resources. The introduction and development of new products and services may not be achieved along expected timelines, or at all, and may not be successful as a result of factors beyond the Company’s control, including regulatory, competition and external market factors. Failure to successfully manage these risks in the development and implementation of new products or services, and failure to integrate such new products and services into our existing system of internal controls, could have a material adverse effect on our business, financial condition and results of operations.

The Company requires liquidity to meet deposit and accounts and drafts payable obligations as they come due. Access to funding sources in amounts adequate to finance the Company’s commitments and business activities or on terms that are acceptable or favorable to the Company could be impaired by risks and uncertainties that are beyond the Company’s control, including those described in this Item 1A, “Risk Factors” section.

The Company’s access to deposits and accounts and drafts payable for liquidity purposes may also be adversely affected by the needs of the Company’s depositors and customers. A failure to maintain adequate liquidity could have a material adverse effect on the Company’s business, financial condition and results of operations.

Cass’ future operating results depend substantially upon the continued service of Cass’ executive officers and key personnel. Cass’ future operating results also depend in significant part upon Cass’ ability to attract and retain qualified management, financial, technical, marketing, sales, and support personnel. Competition for qualified personnel is intense, and the Company cannot ensure success in attracting or retaining qualified personnel. There may be only a limited number of persons with the requisite skills to serve in these positions, and it may be increasingly difficult for the Company to hire personnel over time. Cass’ business, financial condition and results of operations could be materially adversely affected by the loss of any of its key employees, by the failure of any key employee to perform in his or her current position, or by Cass’ inability to attract and retain skilled employees.

The Company and the Bank are subject to extensive federal and state regulation and supervision, the primary focus of which is to protect customers, depositors, the deposit insurance fund and the safety and soundness of the banking system as a whole, and not shareholders. In addition, since the global financial crisis, financial institutions generally have been subject to increased scrutiny from regulatory authorities, with an increased focus on risk management and consumer compliance. This regulatory structure and heightened focus gives the regulatory authorities extensive discretion in connection with their supervisory and enforcement activities and examination policies, including policies with respect to capital levels, the timing and amount of dividend payments, the classification of assets and the establishment of adequate loan loss reserves for regulatory purposes. Failure to comply with applicable laws, regulations, policies or guidance could result in enforcement and other legal actions by federal and state authorities, including criminal and civil penalties, the loss of FDIC insurance, revocation of a banking charter, and other regulatory sanctions, as well as reputational damage, any of which could have a material adverse effect on the Company’s business, financial condition and results of operations.

Congress and federal regulatory agencies continually review banking laws, regulations and policies for possible changes. The substance and impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although any change could impact the regulatory structure under which the Company or its competitors operate and may significantly increase costs, impede the efficiency of internal business processes, require an increase in regulatory capital, require modifications to the Company’s business strategy, and/or limit its ability to pursue business opportunities in an efficient manner. A change in statutes, regulations or regulatory policies applicable to the Company or any of its subsidiaries could have a material, adverse effect on the Company’s business, financial condition and results of operations.

See Item 1, “Business—Supervision and Regulation,” and Item 8, Note 2 to the consolidated financial statements included elsewhere in this report for additional information.

Fully phased in, the Basel III Capital rules implemented stricter capital requirements and leverage limits and methods for calculating risk-weighted assets, meaning the Company is required to hold more capital against such assets. Complying with these more stringent capital requirements could result in management modifying its business strategy and could limit the Company’s ability to make distributions, including paying dividends, or buying back shares.

The Company may also need to raise additional capital in the future to provide it with sufficient capital resources and liquidity to meet commitments and business needs. The ability to raise additional capital, if needed, will depend on, among other things, conditions in the capital markets at that time and the Company’s financial condition, as well as the need for other financial institutions to raise capital at the same time. Economic conditions and the loss of confidence in financial institutions may increase the cost of funding and limit access to certain customary sources of capital, including inter-bank borrowings, repurchase agreements and borrowings from the discount window of the Federal Reserve.

An inability to raise additional capital on acceptable terms when needed could have a materially adverse effect on the Company’s business, financial condition and results of operations.

The Company is subject to various legal and regulatory proceedings. It is inherently difficult to assess the outcome of these matters, and there can be no assurance that the Company will prevail in any proceeding or litigation. Any such matter could result in substantial cost and diversion of Cass’ efforts, which by itself could have a material adverse effect on Cass’ financial condition and operating results. Further, adverse determinations in such matters could result in actions by Cass’ regulators that could materially adversely affect Cass’ business, financial condition or results of operations. Please refer to Item 3, “Legal Proceedings.”

The Company’s accounting policies and methods are fundamental to how Cass records and reports its financial condition and results of operations. Management must exercise judgment in selecting and applying many of these accounting policies and methods in order to ensure that they comply with generally accepted accounting principles and reflect management’s judgment as to the most appropriate manner in which to record and report Cass’ financial condition and results of operations. In some cases, management must select the accounting policy or method to apply from two or more alternatives, any of which might be reasonable under the circumstances yet might result in the Company reporting materially different amounts than would have been reported under a different alternative.

Cass has identified one accounting policy as being “critical” to the presentation of its financial condition and results of operations because it requires management to make particularly subjective and/or complex judgments about matters that are inherently uncertain and because of the likelihood that materially different amounts would be reported under different conditions or using different assumptions. More information on Cass’ critical accounting policies is contained in Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations.”

From time to time, the regulatory agencies, the Financial Accounting Standards Board (“FASB”), and other authoritative bodies change the financial accounting and reporting standards that govern the preparation of the Company’s financial statements. These changes can be hard to predict and can materially impact how management records and reports the Company’s financial condition and results of operations.

In the normal course of business, Cass and its affiliates are routinely subject to examinations and challenges from federal and state tax authorities regarding the amount of taxes due in connection with investments it has made and the businesses in

The Company’s stock price can fluctuate based on factors that can include actual or anticipated variations in Cass’ quarterly results; new technology or services by competitors; unanticipated losses or gains due to unexpected events, including losses or gains on securities held for investment purposes; significant acquisitions or business combinations, strategic partnerships, joint ventures or capital commitments by or involving the Company or its competitors; changes in

accounting policies or practices; failure to integrate acquisitions or realize anticipated benefits from acquisitions; or changes in government regulations.

General market fluctuations, industry factors and general economic and political conditions, such as economic slowdowns or recessions, governmental intervention, interest rate changes, credit loss trends, low trading volume or currency fluctuations also could cause Cass’ stock price to decrease regardless of the Company’s operating results.

Severe weather, natural disasters, acts of terrorism or other hostilities, and other adverse external events beyond the Company’s control, could have a significant impact on the Company’s ability to conduct business. Such events could disrupt Cass’ operations or those of its customers, affect the stability of the Bank’s deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue and/or cause the Company to incur additional expenses. The occurrence of any such event in the future could have a material adverse effect on the Company’s business, which, in turn, could have a material adverse effect on the Company’s financial condition and results of operations.

The Company's business, as well as the operations and activities of it clients, could be negatively impacted by climate change. Climate change presents both immediate and long-term risks to Cass and its clients and these risks are expected to increase over time. Climate changes presents multi-faceted risks, including (i) operational risk from the physical effects of climate events on facilities and other assets as well as those of clients; (ii) credit risk from borrowers with significant exposure to climate risk; and (iii) reputational risk from stakeholder concerns about practices related to climate change, carbon footprint and business relationships with clients who operate in carbon-intensive industries. The Company's business, reputation and ability to attract and retain employees may also be harmed if the response to climate change is perceived to be ineffective or insufficient.

Climate change exposes Cass to physical risk as its effects may lead to more frequent and more extreme weather events, such as prolonged droughts or flooding, tornados, hurricanes, wildfires and extreme seasonal weather; and longer-term shifts, such as increasing average temperatures, ozone depletion and rising sea levels. Such events and long-term shifts may damage, destroy or otherwise impact the value or productivity of the Company's properties and other assets; reduce the availability of insurance; and/or disrupt operations and other activities through prolonged outages. Such events and long-term shifts may also have a significant impact on Cass customers, which could amplify credit risk by diminishing borrowers’ repayment capacity or collateral values, and other businesses and counterparties with whom we transact, which could have a broader impact on the economy, supply chains and distribution networks.

Federal and state banking regulators and supervisory authorities, investors and other stakeholders have increasingly viewed financial institutions as important in helping to address the risks related to climate change both directly and with respect to their clients, which may result in financial institutions coming under increased pressure regarding the disclosure and management of their climate risks and related lending and investment activities. The OCC, FRB and the U.S. Treasury Department have emphasized that climate-related risks are faced by banking organizations of all types and sizes, specifically including physical and transition risks, and is in the process of enhancing supervisory expectations regarding banks’ risk management practices. These agencies have indicated increased expectations for larger financial institutions to measure, monitor and manage climate-related risk as part of their enterprise risk management processes. Although any initial policies may not apply to financial institutions of the Bank’s size, it is likely that regulators will expect all banks to enhance internal control and risk management programs and processes relating to climate change. To the extent that these

Given that climate change could impose systemic risks upon the financial sector, either via disruptions in economic activity resulting from the physical impacts of climate change or changes in policies as the economy transitions to a less carbon-intensive environment, the Company faces regulatory risk of increasing focus on the resilience to climate-related risks, including in the context of stress testing for various climate stress scenarios. Ongoingongoing legislative orand regulatory uncertainties and changes regarding climate risk management and practices that if adopted, may result in higher regulatory, compliance, credit and reputational risks and costs.

The Company is subject to a variety of risks arising from ESG matters. ESG matters include climate risk, hiring practices, the diversity of the work force, and racial and social justice issues involving the Company’s personnel, customers and third parties with whom it otherwise does business. Risks arising from ESG matters may adversely affect, among other things, reputation and the market price of the Company’s securities. Further, the Company may be exposed to negative publicity based on the identity and activities of those to whom it lends and with which it otherwise does business and the public’s view of the approach and performance of its customers and business partners with respect to ESG matters. Any such negative publicity could arise from adverse news coverage in traditional media and could also spread through the use of social media platforms. The Company’s relationships and reputation with its existing and prospective customers and third parties with which it does business could be damaged if it were to become the subject of any such negative publicity. This, in turn, could have an adverse effect on the Company’s ability to attract and retain customers and employees and could have a negative impact on the market price for securities. Investors have begun to consider the steps taken and resources allocated by financial institutions and other commercial organizations to address ESG matters when making investment and operational decisions. Certain investors are beginning to incorporate the business risks of climate change and the adequacy of companies’ responses to the risks posed by climate change and other ESG matters into their investment theses. These shifts in investing priorities may result in adverse effects on the market price of the Company’s securities to the extent that investors determine that the Company has not made sufficient progress on ESG matters.

The Company leases office space in St. Louis County, Missouri, to house the headquarters of the Company and the Bank. The Company’s headquarters occupy 7,549 square feet in an office center at 12444 Powerscourt Drive. The Bank’s headquarters occupy 16,572 square feet in the same center at 12412 Powerscourt Drive.

The Company owns approximately 61,500 square feet of office space at 13001 Hollenberg Drive in Bridgeton, Missouri where the Company’s transportation processing activities are performed.

The Company owns a production facility of approximately 48,300 square feet located at 2675 Corporate Exchange Drive, Columbus, Ohio. Additional facilities are located in Greenville, South Carolina, Wellington, Kansas, Jacksonville, Florida, and Brighton, Michigan. The Company has offices in Breda, Netherlands, Basingstoke, United Kingdom, and Singapore to service its multinational customers.

In addition, the Bank owns a banking facility near downtown St. Louis, Missouri, has an operating branch in the Bridgeton, Missouri location, and has an additional leased facility in Colorado Springs, Colorado.

The Company and its subsidiaries are not involved in any pending proceedings other than ordinary routine litigation incidental to their businesses. Management believes none of these proceedings, if determined adversely, would have a material effect on the business or financial conditions of the Company or its subsidiaries.

The Company’s common stock is quoted on The Nasdaq Global Select Market® under the symbol “CASS.” As of February 15, 2023,2024, there were approximately 5,4055,717 holders of record of the Company’s common stock.

The Company has continuously paid regularly scheduled cash dividends since 1934 and expects to continue to pay quarterly cash dividends in the future. However, future dividend payments will depend on the Company’s earnings, capital requirements, financial condition, applicable banking regulatory requirements and other factors considered relevant by the Company’s Board of Directors.

The Company maintains a treasury stock buyback program approved by the Board of Directors in October 20212023 pursuant to which, the Board of Directors has authorized the repurchase of up to 750,000500,000 shares of the Company’s common stock and has no expiration date. The Company has repurchased 409,29313,964 shares under this treasury stock buyback program and therefore has 340,707486,036 shares remaining for repurchase.

The Company repurchased a total of 150,541 shares at an aggregate cost of $5.8 million during the year ended December 31, 2023 and 130,374 shares at an aggregate cost of $5.3 million during the year ended December 31, 2022 and 713,857 shares at an aggregate cost of $31.0 million during the year ended December 31, 2021.2022. A portion of the repurchased shares may be used for the Company’s employee benefit plans and the balance will be available for other general corporate purposes. The pace of repurchase activity will depend on factors such as levels of regulatory capital, cash generation from operations, cash requirements for investments, repayment of debt, current stock price, business and market conditions, and other factors. The Company may repurchase shares from time to time on the open market or in private transactions, including structured transactions. The stock repurchase program may be modified or discontinued at any time.

During the three months ended December 31, 2022,2023, the Company did not repurchase anyrepurchased shares of its common stock as follows:

The following graph compares the cumulative total returns over the last five fiscal years of a hypothetical investment of $100 in shares of common stock of the Company with a hypothetical investment of $100 in The Nasdaq Stock Market (“Nasdaq”), the index of Nasdaq computer and data processing stocks, and the index of Nasdaq bank stocks. The graph assumes $100 was invested on December 31, 2017,2018, with dividends reinvested. Returns are based on period end prices.

The following Management's Discussion and Analysis of Financial Condition and Results of Operations ("MD&A") is intended to promote understanding of the results of operations and financial condition. MD&A is provided as a supplement to, and should be read in conjunction with, the consolidated financial statements and the accompanying Notes to Financial Statements (Part II, Item 8 of this Form 10-K). This section generally discusses the results of operations for 20222023 compared to 2021.2022. For discussion related to the results of operations and changes in financial condition for 20212022 compared to 20202021 refer to Part II, Item 7, "Management's Discussion and Analysis of Financial Condition and Results of Operations" in the Company's 20212022 Annual Report on Form 10-K filed with the SEC on February 28, 2022.2023.

The Company intends for the discussion of financial condition and results of operations that follows to provide information that will assist the reader in understanding the Consolidated Financial Statements, the changes in certain key items in those financial statements from year to year, and the primary factors that accounted for those changes, as well as how certain accounting principles, policies, and estimates affect the Consolidated Financial Statements. This discussion should be read in conjunction the Consolidated Financial Statements and the related notes that appear in Part II, Item 8 of this document.

The specific payment and information processing services provided to each customer are developed individually to meet each customer’s requirements, which can vary greatly. In addition, the degree of automation such as electronic data interchange, imaging, work flow, and web-based solutions varies greatly among customers and industries. These factors

combine so that pricing varies greatly among the customer base. In general, however, Cass is compensated for its processing services through service fees, transactional level payment services, and investment of account balances

Industry-wide factors that impact the Company include the willingness of large corporations to outsource key business functions such as freight, energy, telecommunication and environmental payment and audit. The benefits that can be achieved by outsourcing transaction processing, and the management information generated by Cass’ systems can be influenced by factors such as the competitive pressures within industries to improve profitability, the general level of transportation costs, deregulation of energy costs, and consolidation of telecommunication providers. Economic factors that impact the Company include the general level of economic activity that can affect the volume and size of invoices processed, the ability to hire and retain qualified staff, and the growth and quality of the loan portfolio. The general level of interest rates also has a significant effect on the revenue of the Company. As discussed in greater detail in Item 7A, “Quantitative and Qualitative Disclosures about Market Risk,” a decline in the general level of interest rates can have a negative impact on net interest income and conversely, a rise in the general level of interest rates can have a positive impact on net interest income. The cost of fuel is another factor that has a significant impact on the transportation sector. As the price of fuel goes up or down, the Company’s earnings increase or decrease with the dollar amount of transportation invoices.

Currently, management views Cass’ major opportunity as the continued expansion of its payment and information processing service offerings and customer base. Management intends to accomplish this by maintaining the Company’s leadership position in applied technology, which when combined with the security and processing controls of the Bank, makes Cass unique in the industry.

The Company has prepared the consolidated financial statements in this report in accordance with the FASB Accounting Standards Codification (“ASC”). In preparing the consolidated financial statements, management makes estimates and assumptions that affect the reported amount of assets and liabilities, disclosure of contingent assets and liabilities at the date of the financial statements, and the reported amounts of revenue and expenses during the reporting period. These estimates have been generally accurate in the past, have been consistent and have not required any material changes. There can be no assurances that actual results will not differ from those estimates. A summary of significant accounting policies and a summary of recent accounting pronouncements applicable to the Company's Consolidated Financial Statements are included in Item 8, "Financial Statements and Supplementary Data—Note 1.”

The accounting policy that requires significant management estimates and is deemed critical to the Company’s results of operations or financial position has been discussed with the Audit and Risk Committee of the Board of Directors and is described below.

The Company’s fee revenue is derived mainly from transportation and facility payment and processing fees. As the Company provides its processing and payment services, it is compensated by service fees which are typically calculated on a per-item basis, discounts received for services provided to carriers and by the accounts and drafts payable balances generated in the payment process which can be used to generate interest income. Processing volumes, average payments in advance of funding, fee revenue and other income were as follows:

Processing fees increased $1.9$3.1 million, or 2.5%4.0%, during 20222023 largely driven by a 3.9%6.7% increase in facility transaction volumes as well as an increase in fees received for ancillary processing services.

Financial fees increased $2.2 million, or 5.1%, in June 2022 and increased bank service fees due2023 primarily attributable to customer growth.the increase in short-term interest rates throughout 2023, partially offset by a decline in transportation dollar volumes of 14.4%. The decline in transportation dollar volumes had a direct effect on the 15.6% decrease in average payments in advance of funding, which is the primary generator of financial fees.

Net interest income is the difference between interest earned on loans, investments, and other earning assets and interest expense on deposits and other interest-bearing liabilities. Net interest income is a significant source of the Company’s revenues. The following table summarizes the changes in tax-equivalent net interest income and related factors:

The increase in net interest income in 20222023 compared to 20212022 is primarily due to the Federal Reserve’s actions toan increase in the Federal Funds rate throughout the year of 2022 and into 2023, positively affecting the net interest rate margin which increased to 2.74%3.25% as compared to 2.31%2.74% in the prior year. Additionally,This was partially offset by a 10.3% increasedecrease in average earning assets contributed to the increase in net interest income.of $128.8 million, or 5.8%. The yield on interest-earning assets increased 53114 basis points from 2.37% in 2021 to 2.90% in 2022 to 4.04% in 2023 while the cost of interest-bearing liabilities increased 38226 basis points from 0.20% in 2021 to 0.58% in 2022.2022 to 2.84% in 2023.

Average loans increased $104.3$63.7 million, or 11.8%6.4%, to $992.0 million.$1.06 billion. This increase was due to solid loan growth during the second half of 2022, specifically in the Company's franchise restaurants, faith-based and lease financing receivables portfolios. These

Average investment securities increased $291.2decreased $54.7 million, or 58.5%. The Company purchased6.9%, due to the sale and maturity of investment securities throughout 2021 and 2022 in an effort to deploy short-term investments into investment securities to enhance the yield on interest-earning assets.2023. The investment portfolio will expand and contract over time as the Company manages its liquidity and interest rate position. The average tax-equivalent yield on investment securities increased 33 basis point to 2.63% in 2022 was consistent with 2021 at 2.30%.2023 as a result of the increase in short and long-term interest rates. The average yield on tax-exempt investment securities declined 19 basis points to 2.69% driven by maturities of higher rate securities. These securities have longer term fixed rates and the Company has not purchased any such securities since interest rates began increasing.

Average short-term investments, consisting of interest-bearing deposits in other financial institutions and federal funds sold, decreased $189.3$137.8 million, or 30.8%32.4%. The decrease is primarily a result of the increase in the average balancesbalance of investment securities, loans, paymentscoupled with the decrease in advance ofaverage funding and bank owned life insurance,sources, partially offset by the increasedecrease in the average balances of deposits and accounts and drafts payable.investment securities. The average yield on short-term investments increased 139327 basis points to 1.51%4.78% in 20222023 primarily due to the increase in short-term market interest rates.rates that began in March 2022. The vast majority of these short-term investments are held at the Federal Reserve Bank.

The average balance of interest-bearing deposits decreased $32.2 million, or 5.3%. Average non-interest-bearing demand deposits decreased $75.5 million, or 12.8%. The Company experienced deposit attrition during the first six months of 2023 as larger commercial depository clients moved their funds to higher interest rate alternatives outside of the banking system. The Company also incurred a shift from non-interest bearing to interest-bearing deposits driven by the customer base. The average rate paid on interest-bearing deposits increased $11.2 million, or 1.9%, and average non-interest-bearing demand deposits increased $140.2 million, or 31.3%. These increases were largely due to organic growth within our customer base. The cost of interest-bearing deposits increased 38225 basis points to 0.58%2.83% in 2022 as a result2023 due to the increase in short-term interest rates.

Average accounts and drafts payable decreased $60.1 million, or 5.3%. The decrease in average accounts and drafts payable was primarily driven by the decrease in transportation dollar volumes of 14.4% due to the rising rate environment.

The following table contains condensed average balance sheets for each of the periods reported, the tax-equivalent interest income and expense on each category of interest-earning assets and interest-bearing liabilities, and the average yield on such categories of interest-earning assets and the average rates paid on such categories of interest-bearing liabilities for each of the periods reported:

The Company has no concentrations of loans exceeding 10% of total loans, which are not otherwise disclosed in the loan portfolio composition table and as are discussed in Item 8, Note 4, of this report. The Company's primary market niche for banking services is privately held businesses, franchise restaurants, and faith-based ministries.

Loans to commercial entities are generally secured by the business assets of the borrower, including accounts receivable, inventory, machinery and equipment, and the real estate from which the borrower operates. Operating lines of credit to these companies generally are secured by accounts receivable and inventory, with specific percentages of each determined on a customer-by-customer basis based on various factors including the type of business. Intermediate term credit for machinery and equipment is generally provided at some percentage of the value of the equipment purchased, depending on the type of machinery or equipment purchased by the entity. Loans secured exclusively by real estate to businesses and faith-based ministries are generally made with a maximum 80% loan to value ratio, depending upon the Company's estimate of the resale value and ability of the property to generate cash. The Company's loan policy requires an independent appraisal for all loans over $500,000 secured by real estate. Company management monitors the local economy in an attempt to determine whether it has had a significant deteriorating effect on such real estate loans. When problems are identified, appraised values are updated on a continual basis, either internally or through an updated external appraisal.

Loans increased $122.3decreased $68.6 million, or 12.7%6.3%, to $1.08$1.01 billion at December 31, 2022.2023. Lease finance receivables and franchise restaurant loans, which are both included in commercial and industrial loans, increased $80.4decreased $39.4 million, or 100.1%24.5%, and $34.3$8.6 million, or 18.1%3.9%, respectively, during 2022.2023. Commercial and industrial loans decreased $14.5 million, or 8.0%, during 2023. These increasesdecreases were due to organic growthbeing more selective in an effort to expand these loan types. Faith-based mortgages increased $31.7 million, or 8.9%,booking new loans as a result of the decline in deposits during 2022. These increases were partially offset by the decrease in PPP loans of $6.3 million at December 31, 2021 to $0 at December 31, 2022.year. Additional details regarding the types and maturities of loans in the loan portfolio are contained in the tables above and in Item 8, Note 4.

The Company recorded a provision forrelease of credit losses and off-balance sheet credit exposures of $550,000 in 2023 and a provision for credit losses of $1.4 million in 2022 and a release of credit losses of $130,000 in 2021.2022. The amount of the (release of) provision for (release of) credit losses was derived from the Company’s CECL model. The amount of the provision will fluctuate as determined by these analyses. The Company had net loan recoveries of $0 and $13,000 in 2023 and $27,000 in 2022, and 2021, respectively. The ACL was $13.1 million at December 31, 2023 compared to $13.5 million at December 31, 2022 compared to $12.0 million at December 31, 2021.2022. The ACL represented 1.29% and 1.25% of outstanding loans at bothDecember 31, 2023 and December 31, 2022, and December 31, 2021.respectively. The allowance for unfunded commitments was $132,000 at December 31, 2023 and $232,000 at December 31, 2022 and $367,0002022. There were no nonperforming loans outstanding at December 31, 2021. There was2023 and one nonperforming loan outstanding with an outstanding balance of $1.2 million, or 0.11% of total loans at December 31, 2022 and no nonperforming loans outstanding at December 31, 2021.2022. The single nonperforming loan at December 31, 2022 paid off in full during January 2023.

The ACL has been established and is maintained to estimate the lifetime credit losses expected in the loan portfolio. An ongoing assessment is performed to determine if the balance is adequate. Charges or credits are made to expense based on changes in the economic forecast, qualitative risk factors, loan volume, and individual loans. For loans that are individually

evaluated, the Company uses two impairment measurement methods: 1) the present value of expected future cash flows and 2) collateral values.

Federal and state regulatory agencies review the Company’s methodology for maintaining the ACL. These agencies may require the Company to adjust the ACL based on their judgments and interpretations about information available to them at the time of their examinations.

The following schedule summarizes activity in the ACL and the allocation of the allowance to the Company’s loan categories.

Nonperforming loans are defined as loans on non-accrual status and loans 90 days or more past due but still accruing. Nonperforming assets include nonperforming loans plus foreclosed real estate. Troubled debt restructuringsLoans with modifications to borrowers experiencing financial difficulty are not included in nonperforming loans unless they are on non-accrual status or past due 90 days or more.

It is the policy of the Company to continually monitor its loan portfolio and to discontinue the accrual of interest on any loan for which collection is not probable. Subsequent payments received on such loans are applied to principal if collection of principal is not probable; otherwise, these receipts are recorded as interest income. There was no interest income recognized on nonaccrual loans for the years ended 20222023 and 2021.2022.

There waswere no nonaccrual loans at December 31, 2023 and one nonaccrual loan of $1.2 million at December 31, 2022 and no nonaccrual loans at December 31, 2021.2022. There were no foreclosed assets at December 31, 20222023 or December 31, 2021.2022. The single nonperforming loan at December 31, 2022 paid off in full during January 2023.

The Company does not have any foreign loans. The Company's loan portfolio includes $212,000$157,000 of single family real estate mortgages, as the Company does not market its services to retail customers. Also, the Company had no sub-prime mortgage loans or residential development loans in its portfolio in any of the years presented.

The Company does not have any other interest-earning assets which would have been included in nonaccrual, past due or restructured loans if such assets were loans.