UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, D.C. 20549

FORM 10-K

☒ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

FOR THE FISCAL YEAR ENDED DECEMBERDecember 31 2020, 2023

OR

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

FOR THE TRANSITION PERIOD FROM TO .

Commission file number: 0-14549000-14549

FIRST US BANCSHARES, INC.

(Exact Name of Registrant as Specified in Its Charter)

(205) (205) 582-1200

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☐No☒

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐No☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☐

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b).☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☒

State the aggregate market value of the voting and non-voting common equity held by non-affiliates computed by reference to the price at which the common equity was last sold, or the average bid and asked price of such common equity, as of the last business day of the registrant's most recently completed second fiscal quarter: $40,043,138.$46,290,307.

As of March 12, 2021,6, 2024, the registrant had outstanding 6,213,6415,787,118 shares of common stock.

Auditor Firm PCAOB ID: 213 Auditor Name: Carr, Riggs & Ingram, LLC Auditor Location: Atlanta, Georgia, United States

First US Bancshares, Inc.

Annual Report on Form 10-K

for the fiscal year ended

December 31, 20202023

Table of Contents

* Portions of the definitive proxy statement for the registrant’s 2024 Annual Meeting of Shareholders to be held on April 25, 2024 are incorporated by reference into Part III of this Annual Report on Form 10-K.

FORWARD-LOOKING STATEMENTS

Statements contained in this Annual Report on Form 10-K that are not historical facts are forward-looking statements (as defined in the Private Securities Litigation Reform Act of 1995). In addition, First US Bancshares, Inc. (“Bancshares” and, together with its subsidiaries, the “Company”), through its senior management, from time to time makes forward-looking statements concerning our expected future operations and performance and other developments. The words “estimate,” “project,” “intend,” “anticipate,” “expect,” “believe,” “continues” and similar expressions are indicative of forward-looking statements. Such forward-looking statements are necessarily estimates reflecting the Company’s best judgment based on current information and involve a number of risks and uncertainties, and various factors could cause results to differ materially from those contemplated by such forward-looking statements. Such factors could include those identified from time to time in the Company’s Securities and Exchange Commission (“SEC”) filings and other public announcements, including the factors described in this Annual Report on Form 10-K for the year ended December 31, 2020. Specifically, with respect to statements relating to the sufficiency of the allowance for loan and lease losses, loan demand, cash flows, interest costs, growth and earnings potential, expansion and the Company’s positioning to handle the challenges presented by COVID-19, these2023. Such factors include, but are not limited to, risks related to the Company’s credit, including that if credit losses are greater than anticipated; increased risk from commercial real estate lending; the rate of growth (or lack thereof) in the economy generally and in the Bank’s and ALC’sCompany’s service areas; liquidity risks; market conditions and investment returns; strong competition in the bank industry; changes in interest rates; the impacteffects of a potential government shutdown; technological changes in the current COVID-19 pandemic onbanking and financial services industries; potential failures or interruptions in our information systems and those of our third-party service providers and cybersecurity and data privacy threats; the Company’s business,increasing and uncertain costs of complying with governmental regulations applicable to the Company’s customers, the communities that the Company serves and the United States economy, includingfinancial services industry; the impact of actions taken by governmental authorities to try to contain the virus or address the impact of the virus on the United States economy (including, without limitation, the Coronavirus Aid, Reliefclimate change and Economic Security (CARES) Actrelated legislative and subsequent federal legislation) and the resulting effect on the Company’s operations, liquidity and capital position and on the financial condition of the Company’s borrowers and other customers; the pending discontinuation of LIBOR as an interest rate benchmark; the availability of quality loans in the Bank’s and ALC’s service areas; the relative strength and weakness in the consumer and commercial credit sectors and in the real estate markets; collateral values; cybersecurity threats;regulatory initiatives; and risks related to acquisitions, including that the Paycheck Protection Program. strategic benefits may not materialize and unforeseen integration difficulties may arise. Forward-looking statements speak only as of the date they are made, and the Company undertakes no obligation to revise forward-looking statements to reflect circumstances or events that occur after the dates on which the forward-looking statements are made, except as required by law.

In addition, our business is subject to a number of general and market risks that could affect any forward-looking statements, including the risks discussed under Item 1A herein entitled “Risk Factors.”

PART I

Item 1. Business.

First US Bancshares, Inc., a Delaware corporation (“Bancshares” and, together with its subsidiaries, the “Company”), is a bank holding company formed in 1983 registered under the Bank Holding Company Act of 1956, as amended (the “BHCA”). Bancshares operates one banking subsidiary, First US Bank, an Alabama banking corporation (the “Bank”). Prior to its name change on October 11, 2016, Bancshares was known as United Security Bancshares, Inc.Inc. Bancshares and the Bank are headquartered in Birmingham, Alabama.

The Bank conducts a general commercial banking business and offers banking services such as demand, savings, individual retirement account and time deposits, personal and commercial loans, safe deposit box services and remote deposit capture. The Bank operates and serves its customers through 1915 full-service banking offices located in Birmingham, Bucksville, Butler, Calera, Centreville, Columbiana, Gilbertown, Grove Hill, Harpersville, Jackson, Thomasville, Tuscaloosa and Woodstock, Alabama; Knoxville and Powell, Tennessee; and Rose Hill, and Ewing, Virginia; as well as loan production offices in Mobile, Alabama and the Chattanooga, Tennessee area. In July 2020,area. The Bank provides a wide range of commercial banking services to small- and medium-sized businesses, property managers, business executives, professionals and other individuals. The Bank also performs indirect lending through third-party retailers and currently conducts this lending in 17 states, including Alabama, Arkansas, Florida, Georgia, Indiana, Iowa, Kansas, Kentucky, Mississippi, Missouri, Nebraska, North Carolina, Oklahoma, South Carolina, Tennessee, Texas and Virginia.

Previously, the Bank permanently closed one banking office in Thomasville, Alabama.

The Bank hashad two wholly owned subsidiaries: Acceptance Loan Company, Inc., an Alabama corporation (“ALC”), and FUSB Reinsurance, Inc., an Arizona corporation (“FUSB Reinsurance”). Both ALC and FUSB Reinsurance were dissolved in 2023, after all remaining assets and liabilities of these entities were transferred to the Bank. As used herein, unless the context suggests otherwise, references to the “Company,” “we,” “us” and “our” refer to Bancshares and the Bank, as well as the Bank, ALC and FUSB Reinsurance collectively.(for periods prior to their dissolution), collectively.

The Bank owns all of the stock of ALC. ALC iswas a finance company headquartered in Mobile, Alabama that performs both indirect lending and conventional consumer finance lending through a branch network. ALC’s branch network serves customers through 20 offices located in Alabama and southeast Mississippi.Alabama. The Bank serveswill continue to manage the remaining loans from ALC’s portfolio, which totaled $10.5 million as the primary funding source for ALC’s operations. ALC sold its branch in Scottsboro, Alabama during the third quarter of 2020.

Effective January 1, 2020, Bancshares transferred a total of $45.5 million of its indirect loan portfolio from ALC to the Bank. The loans transferred include indirect sales lending relationships originatedDecember 31, 2023, through prominent national or regional retailers that are managed by the Company on a centralized basis. The Company currently conducts this lending in 11 states, including Alabama, Florida, Georgia, Kentucky, Mississippi, Missouri, North Carolina, South Carolina, Tennessee, Texas and Virginia.

final resolution. FUSB Reinsurance underwrites credit life and credit accident and healthwas designed to reinsure certain insurance policies sold to the Bank’sBank's and ALC’sALC's consumer loan customers. FUSB Reinsurance is responsible for the first level of risk on these policies up to a specified maximum amount, and a primary third-party insurer retains the remaining risk. A third-party insurer and/or a third-party administrator are responsible for performing most of the administrative functions of FUSB Reinsurance on a contract basis.

Strategy

Our strategy focuses on increasing franchise value by building and maintaining a strong and diversified balance sheet through continued loan and deposit growth usingthat leverages our branch network, and loan production offices, maintainingand digital market capabilities. We foster a culture that adheres to effective credit quality andunderwriting standards, pricing discipline, and expense control,control. Our longer-term growth strategy seeks to grow loan production offices to levels that support limited branching, expansion of our customer base through digital banking offerings, and acquisitions whereconsideration of acquisition opportunities are identified. In the current environment of the COVID-19 pandemic, we also supported our customers and employees during the economic downturn, evaluated the impact on our earning assets, and repriced our deposits consistent with the lower interest rate environment.to enter new markets.

Human Capital Resources

Bancshares has no employees, other than the executive officers discussed in the information incorporated by reference in Part III, Item 10 of this report. As of December 31, 2020,2023, the Bank had 189153 full-time equivalent employees, and ALC had 81 full-time equivalent employees. FUSB Reinsurance has no employees. None of our employees are party to a collective bargaining agreement. Management believes that the Company’s employee relations are good.satisfactory.

To facilitate talent attraction and retention, we strive to make the Company an inclusive, safe and healthy workplace, with opportunities for our employees to grow and develop in their careers, supported by strong compensation, benefits, health and welfare programs. Our talent acquisition team uses internal and external resources to recruit highly skilled and talented workers across our markets, and we encourage employee referrals for open positions.

As part of our compensation philosophy, we believe that we must offer and maintain market competitive total rewards programs for our employees in order to attract and retain superior talent. In addition to healthy base wages, additional programs include bonus opportunities, Company matched 401(k) Plan, healthcare and insurance benefits, health savings and flexible spending accounts, vacation and paid time off, family and military leave, flexible work schedules and employee assistance programs.

The success of our business is fundamentally connected to the well-being of our people. Accordingly, we are committed to the health, safety and wellness of our employees. We provide our employees and their families with access to a variety of flexible and convenient health and welfare programs, including benefits that support their physical and mental health by providing tools and resources to help them improve or maintain their health status; and that offer choice where possible so they can customize their benefits to meet their needs and the needs of their families. In response

We strive to the COVID-19 pandemic, we implemented significant operating environment changes that we determined were in the best interest of our employees, as well as the communities in which we operate, and which comply with government regulations. This includes having a substantial percentage of our employees work from home, while implementing additional safety measures for employees continuing critical on-site work.

Our ongoing diversity and inclusion initiatives support our goal that everyone throughout the Company is engaged in creatingmaintain an inclusive workplace and we are focused on sourcing and hiring with fairness and equitable approaches, creatingseek to foster an environment where all of our employees can develop and thrive. We believe itthrive through active engagement in the ongoing success of our organization. It is crucialessential to our business that we continually attract and retain talent who desirea talented workforce, and our practices are designed to enable financial equality through delivery of capable solutions, thoughtful innovationpromote diversity and equitable consumer optionsfairness in the marketshiring process. We encourage a customer-focused orientation that meets the diverse needs of consumers and businesses in the communities in which we serve.

AtAs of December 31, 2020, 83%2023, 79% of our workforce was comprised of females, and 19% of our workforce was comprised of individuals who are racially or ethnically diverse. Our Board of Directors includes twothree females and one racially or ethnically diverse member (representing 25%36% of Directors). Women and individuals who are racially or ethnically diverse represent 27%21% of our senior management team, which includes our executive officers.

Competition

We face strong competition in making loans, acquiring deposits and attracting customers for investment services. Competition among financial institutions is based on interest rates offered on deposit accounts, interest rates charged on loans, other credit and service charges relating to loans, the quality and scope of the services rendered, the convenience of banking facilities and, in the case of loans to commercial borrowers, relative lending limits. We compete with numerous other financial services providers, including commercial banks, online banks, credit unions, finance companies, mutual funds, insurance companies, investment banking companies, brokerage firms and other financial intermediaries operating in Alabama and elsewhere. Many of these competitors, some of which are affiliated with large bank holding companies, have substantially greater resources and lending limits than we do. In addition, many of our non-bank competitors are not subject to the same extensive federal regulations that govern bank holding companies and federally insured banks.

The financial services industry is likely to become more competitive as further technological advances enable more companies to provide financial services. These technological advances may diminish the importance of depository institutions and other financial intermediaries.

Supervision and Regulation

General

We are extensively regulated under both federal and state law. These laws restrict permissible activities and investments and require compliance with various consumer protection provisions applicable to lending, deposit, brokerage and fiduciary activities. They also impose capital adequacy requirements and condition Bancshares’ ability to repurchase stock or to receive dividends from the Bank. Bancshares is subject to comprehensive examination and supervision by the Board of Governors of the Federal Reserve System (the “Federal Reserve”), and the Bank and its subsidiaries are subject to comprehensive examination and supervision by the Alabama State Banking Department (the “ASBD”) and the Federal Deposit Insurance Corporation (the “FDIC”). These regulatory agencies generally have broad discretion to impose restrictions and limitations on our operations. This supervisory framework could materially impact the conduct and profitability of our activities.

To the extent that the following information describes statutory and regulatory provisions, it is qualified in its entirety by reference to the text of such provisions. Proposals to change the laws and regulations governing the banking industry are frequently raised at both the state and federal level. The likelihood and timing of any changes in these laws and regulations, as well as the impact that such changes may have on us, are difficult to ascertain. A change in applicable laws and regulations, or in the manner in which such laws or regulations are interpreted by regulatory agencies or courts, may have a material effect on our business, operations and earnings.

Regulation of Bancshares

Bancshares is registered as a bank holding company and is subject to regulation and supervision by the Federal Reserve. The BHCA requires a bank holding company to secure the approval of the Federal Reserve before it owns or controls, directly or indirectly, more than five percent (5%) of the voting shares or substantially all of the assets of any bank or thrift, or merges or consolidates with another bank or thrift holding company. Further, under the BHCA, the activities of a bank holding company and any nonbank subsidiary are limited to: (1) those activities that the Federal Reserve determines to be so closely related to banking as to be a proper incident thereto and (2) investments in companies not engaged in activities closely related to banking, subject to quantitative limitations on the value of such investments. Prior approval of the Federal Reserve may be required before engaging in certain activities. In making such determinations, the Federal Reserve is required to weigh the expected benefits to the public, such as greater convenience, increased competition and gains in efficiency, against the possible adverse effects, such as undue concentration of resources, decreased or unfair competition, conflicts of interest, and unsound banking practices.

There are a number of restrictions imposed on us by law and regulatory policy that are designed to minimize potential losses to the depositors of the Bank and the Deposit Insurance Fund maintained by the FDIC (as discussed in more detail below) if the Bank should become insolvent. For example, the Federal Reserve requires bank holding companies to serve as a source of financial strength to their subsidiary depository institutions and to commit resources to support such institutions in circumstances in which they might not otherwise do so. The Federal Reserve also has the authority to require a bank holding company to terminate any activity or to relinquish control of a non-bank subsidiary upon the Federal Reserve’s determination that such activity or control constitutes a serious risk to the financial soundness and stability of any bank subsidiary of the bank holding company.

Any capital loan by Bancshares to the Bank is subordinate in right of payment to deposits and certain other indebtedness of the Bank. In addition, in the event of Bancshares’ bankruptcy, any commitment by Bancshares to a federal banking regulatory agency to maintain the capital of the Bank will be assumed by the bankruptcy trustee and entitled to a priority of payment.

The Federal Deposit Insurance Act provides that, in the event of the “liquidation or other resolution” of an insured depository institution, the claims of depositors of the institution (including the claims of the FDIC as a subrogee of insured depositors) and certain claims for administrative expenses of the FDIC as a receiver will have priority over other general unsecured claims against the institution. If an insured depository institution fails, then insured and uninsured depositors, along with the FDIC, will have priority of payment over unsecured, non-deposit creditors, including the institution’s holding company, with respect to any extensions of credit that they have made to such insured depository institution.

Regulation of the Bank

The operations and investments of the Bank are limited by federal and state statutes and regulations. The Bank is subject to supervision and regulation by the ASBD and the FDIC and to various requirements and restrictions under federal and state law, including requirements to maintain reserves against deposits, restrictions on the types, amount and terms and conditions of loans that it may originate, and limits on the types of other activities in which the Bank may engage and the investments it may make.

The Bank is subject to federal laws that limit the amount of transactions between the Bank and its nonbank affiliates, including Bancshares, but excluding operating subsidiaries, such as ALC. Under these provisions, transactions by the Bank with nonbank affiliates (such as loans or investments) are generally limited to 10% of the Bank’s capital and surplus for all covered transactions with any one affiliate and 20% of capital and surplus for all covered transactions with all affiliates. Any extensions of credit to affiliates, with limited exceptions, must be secured by eligible collateral in specified amounts. The Bank is also prohibited from purchasing any “low quality” assets from an affiliate. The Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”) imposed additional requirements on transactions with affiliates, including an expansion of the definition of “covered transactions” and an increase in the length of time for which collateral requirements regarding covered transactions must be maintained.

The Dodd-Frank Act requires the banking agencies and the SEC to establish joint rules or guidelines for financial institutions with more than $1 billion in assets which prohibit incentive compensation arrangements that the agencies determine to encourage inappropriate risks by the institution. The banking agencies issued proposed rules in 2011 and issued guidance on sound incentive compensation policies. In 2016, the Federal Reserve and the OCCOffice of Comptroller of the Currency also proposed rules that would, depending upon the assets of the institution, directly regulate incentive compensation arrangements and would require enhanced oversight and recordkeeping. As of December 31, 2020,2023, these rules have not been implemented. With assets of approximately $891 million, we currently would not be subject to the rules as presently proposed but would become subject to the rules if our assets increased to $1 billion.  

Lending Limits

Under Alabama law, the amount of loans that may be made by a bank in the aggregate to one person is limited. Alabama law provides that unsecured loans by a bank to one person may not exceed an amount equal to 10% of the capital and unimpaired surplus of the bank or 20% in the case of secured loans. For purposes of calculating these limits, loans to various business interests of the borrower, including companies in which a substantial portion of the stock is owned or partnerships in which a person is a partner, must be aggregated with those made to the borrower individually. Loans secured by certain readily marketable collateral are exempt from these limitations, as are loans secured by deposits and certain government securities.

Commercial Real Estate Concentration Limits

In December 2006, the U.S. bank regulatory agencies issued guidance entitled “Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices” to address increased concentrations in commercial real estate (“CRE”) loans. The guidance describes the criteria the agencies will use as indicators to identify institutions potentially exposed to CRE concentration risk. An institution that has (i) experienced rapid growth in CRE lending, (ii) notable exposure to a specific type of CRE, (iii) total reported loans for construction, land development, and other land representing 100% or more of the institution’s capital, or (iv) total CRE loans representing 300% or more of the institution’s capital, and the outstanding balance of the institution’s CRE portfolio has increased by 50% or more in the prior 36 months, may be identified for further supervisory analysis of the level and nature of its CRE concentration risk.

In December 2015, the U.S. bank regulatory agencies issued guidance titled “Statement on Prudent Risk Management for Commercial Real Estate Lending” to remind financial institutions of existing guidance on prudent risk management practices for CRE lending activity, including the 2006 guidance described above. In the 2015 guidance, the agencies noted their belief that financial institutions had eased CRE underwriting standards in recent years. The 2015 guidance went on to identify actions that financial institutions should take to protect themselves from CRE-related credit losses during difficult economic cycles. The 2015 guidance also indicated that the agencies would pay special attention in the future to potential risks associated with CRE lending.

In June 2023, in response to the increased risk relating to commercial real estate loans, the federal banking agencies issued a final Interagency Policy Statement on Prudent Commercial Real Estate Loan Accommodations and Workouts. The new policy statement updates, expands on and supersedes existing guidance from 2009. Most notably, it (i) adds a new discussion of short-term loan accommodations, (ii) expands guidance regarding the evaluation and assessment of guarantors to also encompass loan sponsors, (iii) incorporates information about changes to accounting principles since 2009, and (iv) updates and expands the illustrative examples of commercial real estate loan workouts. Furthermore, on December 18, 2023, the FDIC issued an advisory on Managing Commercial Real Estate Concentrations in a Challenging Economic Environment, which conveys certain key risk management practices for FDIC-supervised institutions to consider in managing commercial real estate loan concentrations in the current economic environment.

Securities and Exchange Commission

Bancshares is under the jurisdiction of the Securities and Exchange Commission (“SEC”) for matters relating to the offer and sale of its securities and is subject to the SEC’s rules and regulations related to periodic reporting, reporting to shareholders, proxy solicitations and insider trading regulations.regulations.

Monetary Policy

Our earnings are and will be affected by domestic economic conditions and the monetary and fiscal policies of the United States government and its agencies. The monetary policies of the Federal Reserve have a substantial effect on the operating results of commercial banks, including the Bank. The Federal Reserve has a significant impact on the levels of bank loans, investments and deposits through its open market operations in United States government securities and through its regulation of, among other things, the discount rate on borrowings of member banks and the reserve requirements against member banks’ deposits. It is not possible to predict the nature and impact of future changes in monetary and fiscal policies.policies.

Deposit Insurance

The Bank’s deposits are insured up to applicable limits by the Deposit Insurance Fund maintained by the FDIC. As a result, the Bank is required to pay periodic assessments to maintain insurance coverage for its deposits. Under the FDIC’s assessment system for banks with less than $10 billion in assets, the assessment rate is determined based on a number of factors, including the Bank’s CAMELS (supervisory) rating, leverage ratio, net income, non-performing loan ratios, Other Real Estate Owned (OREO) ratios, core deposit ratios, one-year organic asset growth and a loan mix index.

The FDIC has authority to increase insurance assessments. A significant increase in insurance assessments would likely have an adverse effect on our operating expense, results of operations, and cash flows. Management cannot predict what insurance assessment rates will be in the future. Furthermore, deposit insurance may be terminated by the FDIC upon a finding that the institution has engaged in unsafe or unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC.

Dividend Restrictions

Under Delaware law, dividends may be paid only out of the amount calculated as the present fair value of the total assets of the corporation, minus the present fair value of the total liabilities of the corporation, minus the capital of the corporation. In the event that there is no such amount, dividends may be paid out of the net profits of the corporation for the fiscal year in which the dividend is declared and/or the immediately preceding fiscal year. Dividends may not be paid, however, out of net profits of the corporation if the capital represented by the issued and outstanding stock of all classes having a preference on the distribution of assets is impaired. Further, the Federal Reserve permits bank holding companies to pay dividends only out of current earnings and only if future retained earnings would be consistent with the company’s capital, asset quality and financial condition.condition.

Since it has no significant independent sources of income, Bancshares’ ability to pay dividends depends on its ability to receive dividends from the Bank. Under Alabama law, the Bank may not pay a dividend in excess of 90% of its net earnings unless its surplus is equal to at least 20% of capital. The Bank is also required by Alabama law to seek the approval of the Superintendent of the ASBD prior to the payment of dividends if the total of all dividends declared by the Bank in any calendar year will exceed the total of (1) the Bank’s net earnings for that year, plus (2) its retained net earnings for the preceding two years, less any required transfers to surplus. Alabama law defines net earnings as the remainder of all earnings from current operations plus actual recoveries on loans and investments and other assets, after deducting from the total thereof all current operating expenses, actual losses, accrued dividends on preferred stock, if any, and all federal, state and local taxes. The Bank must be able to satisfy the conditions described above in order to declare or pay a dividend to Bancshares without obtaining the prior approval of the Superintendent of the ASBD. In addition, the FDIC prohibits the payment of cash dividends if (1) as a result of such payment, the bank would be undercapitalized or (2) the bank is in default with respect to any assessment due to the FDIC, including a deposit insurance assessment. These restrictions could materially influence the Bank’s, and therefore Bancshares’, ability to pay dividends.dividends.

Capital Adequacy

In July 2013, the federal banking regulatory agencies adopted regulations to implement the framework developed by the Basel Committee on Banking Supervision (“Basel Committee”) for strengthening international capital and liquidity, known as “Basel III” (the “Basel III Rule”). The Basel III Rule provides risk-based capital guidelines designed to make regulatory capital requirements more sensitive to differences in risk profiles among banks, to account for off-balance sheet exposures, and to minimize disincentives for holding liquid assets. Under these guidelines, assets and off-balance sheet items are assigned to broad risk categories, each with appropriate risk-weights. The net amount of assets remaining after applying the risk-weights to the gross asset values represents the institution’s total risk-weighted assets (“RWA”). An institution’s total RWA are used to calculate its regulatory capital ratios. The Basel III Rule establishes minimum capital and leverage ratios that supervised financial institutions are required to maintain, while also providing countercyclical capital requirements so that the required amount of capital increases in times of economic expansion and decreases in times of economic contraction, consistent with safety and soundness. Under the Basel III Rule, banks must maintain a specified capital conservation buffer above each of the required minimum capital levels in order to avoid limitations on paying dividends, engaging in share repurchases and paying certain discretionary bonuses.

In December 2017, the Basel Committee published the last version of the Basel III accord, generally referred to as “Basel IV.” The Basel Committee stated that a key objective of the revisions incorporated into the framework is to reduce excessive variability of risk-weighted assets, which will be accomplished by enhancing the robustness and risk sensitivity of the standardized approaches for credit risk and operational risk, which will facilitate the comparability of banks’ capital ratios; constraining the use of internally modeled approaches; and complementing the risk-weighted capital ratio with a finalized leverage ratio and a revised and robust capital floor. Leadership of the federal banking agencies who are tasked with implementing Basel IV has indicated that it is considering how to appropriately apply these revisions in the United States. Although it is uncertain at this time, some, if not all, of the Basel IV accord may be incorporated into the capital requirements framework applicable to Bancshares and the Bank.

Banking organizations must have appropriate capital planning processes, with proper oversight from the board of directors. Accordingly, pursuant to a separate, general supervisory letter from the Federal Reserve, bank holding companies are expected to conduct and document comprehensive capital adequacy analyses prior to the declaration of any dividends (on common stock, preferred stock, trust preferred securities or other Tier 1 capital instruments), capital redemptions or capital repurchases. Moreover, the federal banking agencies have adopted a joint agency policy statement, noting that the adequacy and effectiveness of a bank’s interest rate risk management process and the level of its interest rate exposures are critical factors in the evaluation of the bank’s capital adequacy.

In 2018, the U.S. Congress passed, and the President signed into law, the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 (the “Growth Act”) to modify or remove certain financial reform rules and regulations, including some of those implemented under the Dodd-Frank Act. While the Growth Act maintains most of the regulatory structure established by the Dodd-Frank Act, it amends certain aspects of the regulatory framework for small depository institutions with total assets of less than $10 billion and for large banks with total assets of more than $50 billion. The Growth Act, among other things, requires the federal banking agencies to issue regulations allowing community bank organizations with total assets of less than $10 billion and limited amounts of certain assets and off-balance sheet exposures to access a simpler capital regime focused on a bank’s Tier 1 leverage capital levels rather than risk-based capital levels that are the focus of the capital rules issued under the Dodd-Frank Act implementing Basel III.

Among other changes, the Growth Act expands the definition of qualified mortgages that may be held by a financial institution and simplifies the regulatory capital rules for financial institutions and their holding companies with total consolidated assets of less than $10 billion by instructing the federal banking regulators to establish a single “Community Bank Leverage Ratio” of between 8% and 10% to replace the leverage and risk-based regulatory capital ratios. The Growth Act also includes regulatory relief for community banks regarding regulatory examination cycles, call reports, the Volcker Rule (proprietary trading prohibitions), mortgage disclosures, and risk weights for certain high-risk commercial real estate loans. It is difficult

Pursuant to predict at this time when or how any new standards under the Growth Act, will ultimately be applied to us or what specific impact the Growth Act and the yet-to-be-written implementing rules and regulations will have on community banks.

Inin October 2019, the federal banking agencies adopted regulations that exempt a qualifying community bank and its holding company that have Tier 1 leverage ratios of greater than 9% from the risk-based capital requirements of the capital rules issued under the Dodd-Frank Act. A qualifying community organization is a depository institution or its holding company that has less than $10 billion in average total consolidated assets; has off-balance-sheet exposures of 25% or less of total consolidated assets; has trading assets plus trading liabilities of 5% or less of total consolidated assets; and is not an advanced approaches banking organization. A qualifying community banking organization and its holding company that have chosen the proposed framework will not be required to calculate the existing risk-based and leverage capital requirements. A qualifying community banking organization will also be considered to have met the capital ratio requirements to be well capitalized for the agencies’ prompt corrective action rules provided it has a community bank leverage ratio greater than 9%. The new community bank leverage ratio framework first became available for banking organizations to use on March 31, 2020.

The rules implementing these provisions A qualifying community banking organization may opt into and out of the Growth Act were recently adoptedframework by completing the associated reporting requirements on its call report. We presently do not anticipate opting into the framework.

In July 2023, the federal banking regulators proposed revisions to the Basel III Capital Rules to implement the Basel Committee’s 2017 standards and aremake other changes to the Basel III Capital Rules. The proposal introduces revised credit risk, equity risk, operational risk, credit valuation adjustment risk and market risk requirements, among other changes. However, the revised capital requirements of the proposed rule would not yet effective. Bancshares has not yet made a determination regarding whether it will seekapply to take advantage of these new capital rules under the Growth Act.Company or the Bank because they have less than $100 billion in total consolidated assets and trading assets and liabilities below the threshold for market risk requirements.

Prompt Corrective Action

In addition to the required minimum capital levels described above, federal law establishes a system of “prompt corrective actions” that federal banking agencies are required to take, and certain actions that they have discretion to take, based on the capital category into which a federally regulated depository institution falls. Regulations set forth detailed procedures and criteria for implementing prompt corrective action in the case of any institution that is not adequately capitalized. Each institution is assigned to one of five categories based on its capital ratios: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” or “critically undercapitalized.” Institutions categorized as “undercapitalized” or worse become subject to increasing levels of regulatory oversight and restrictions, which may include, among other things, limitations on growth and activities and payment of dividends.

As of December 31, 2020,2023, the Bank was “well-capitalized” under the prompt corrective action rules. This classification is primarily for the purpose of applying the federal prompt corrective action provisions and is not intended to be, and should not be, interpreted as a representation of our overall financial condition or prospects.

Legislative and Regulatory Responses to the COVID-19 Pandemic

The COVID-19 pandemic is creating extensive disruptions to the global economy, to businesses, and to the lives of individuals throughout the world. There have been a number of regulatory actions intended to help mitigate the adverse economic impact of the pandemic on borrowers, including several mandates from the bank regulatory agencies, requiring financial institutions to work constructively with borrowers affected by the pandemic. 

On March 27, 2020, the CARES Act was signed into law. Several provisions within the CARES Act led to action from the bank regulatory agencies and there were also separate provisions within the legislation that directly impacted financial institutions. Section 4022 of the CARES Act allowed, until the earlier of December 31, 2020 or the date the national emergency declared by the President terminates, borrowers with federally-backed one-to-four family mortgage loans experiencing a financial hardship due to the pandemic to request forbearance, regardless of delinquency status, for up to 360 days. Section 4022 also prohibited servicers of federally-backed mortgage loans from initiating foreclosures during the 60-day period beginning March 18, 2020. Further, on August 27, 2020, the FHFA announced that FNMA and FHLMC would extend their single-family moratorium on foreclosures and evictions through December 31, 2020. In addition, President Biden requested that the federal agencies discussed above continue to extend the moratorium on foreclosures on federally-guaranteed mortgages until at least March 31, 2021. In addition, under Section 4023 of the CARES Act, until the earlier of December 31, 2020 and the date the national emergency declared by the President terminates, borrowers with federally-backed multifamily mortgage loans whose payments were current as of February 1, 2020, but who have since experienced financial hardship due to COVID-19, may request a forbearance for up to 90 days. Borrowers receiving such forbearance may not evict or charge late fees to tenants for its duration. On December 23, 2020, the FHFA announced an extension of forbearance programs for qualifying multifamily properties through March 31, 2021. These regulatory and legislative actions may be expanded, extended and amended as the pandemic and its economic impact continue.

Further, on December 27, 2020, the Coronavirus Response and Relief Supplemental Appropriations Act of 2021 was signed into law, which also contains provisions that could directly impact financial institutions. The act directs financial regulators to support community development financial institutions and minority depository institutions and directs Congress to re-appropriate $429 billion in unobligated CARES Act funds.

The Paycheck Protection Program (“PPP”), originally established under the CARES Act and extended under the Coronavirus Response and Relief Supplemental Appropriations Act of 2021, authorizes financial institutions to make federally-guaranteed loans to qualifying small businesses and non-profit organizations. These loans carry an interest rate of 1% per annum and a maturity of 2 years for loans originated prior to June 5, 2020 and 5 years for loans originated on or after June 5, 2020. The PPP provides that such loans may be forgiven if the borrowers meet certain requirements with respect to maintaining employee headcount and payroll and the use of the loan proceeds after the loan is originated. The initial phase of the PPP, after being extended multiple times by Congress, expired on August 8, 2020. However, on January 11, 2021, the SBA reopened the PPP for First Draw PPP loans to small business and non-profit organizations that did not receive a loan through the initial PPP phase. Further, on January 13, 2021, the SBA reopened the PPP for Second Draw PPP loans to small businesses and non-profit organizations that did receive a loan through the initial PPP phase. At least $25 billion has been set aside for Second Draw PPP loans to eligible borrowers with a maximum of 10 employees or for loans of $250,000 or less to eligible borrowers in low- or moderate-income neighborhoods. Generally speaking, businesses with more than 300 employees and/or less than a 25 percent reduction in gross receipts between comparable quarters in 2019 and 2020 are not eligible for Second Draw PPP loans. Further, maximum loan amounts have been increased for accommodation and food service businesses.

In addition, the federal bank regulatory agencies issued several interim final rules throughout the course of 2020 to neutralize the regulatory capital and liquidity effects for banks that participate in the Federal Reserve liquidity facilities. The interim final rule issued on April 9, 2020, clarifies that a zero percent risk weight applies to loans covered by the PPP for capital purposes and the interim final rule issued on May 15, 2020, permits depository institutions to choose to exclude U.S. Treasury securities and deposits at Federal Reserve Banks from the calculation of the supplementary leverage ratio. These interim final rules were finalized on September 29, 2020.

Community Reinvestment Act

The Community Reinvestment Act (the “CRA”) requires the federal banking regulatory agencies to assess all financial institutions that they regulate to determine whether these institutions are meeting the credit needs of the communities that they serve, including their assessment area(s) (as established for these purposes in accordance with applicable regulations based principally on the location of the institution’s branch offices). Under the CRA, institutions are assigned a rating of “outstanding,” “satisfactory,” “needs to improve” or “unsatisfactory.” An institution’s record in meeting the requirements of the CRA is made publicly available and is taken into consideration in connection with any applications that it files with federal regulators to engage in certain activities, including approval of branches or other deposit facilities, mergers and acquisitions, office relocations or expansions into non-banking activities. The Bank received a “satisfactory” rating in its most recent CRA evaluation.

On October 24, 2023, the FDIC, the Federal Reserve Board, and the Office of the Comptroller of the Currency (the “OCC”) issued a final rule to strengthen and modernize the CRA regulations. Under the final rule, banks with assets of at least $600 million as of December 31 in both of the prior two calendar years and less than $2 billion as of December 31 in either of the prior two calendar years will be an “intermediate bank,” and banks with assets of at least $2 billion as of December 31 in both of the prior two calendar years will be a “large bank.” The agencies will evaluate large banks under four performance tests: the Retail Lending Test, the Retail Services and Products Test, the Community Development Financing Test, and the Community Development Services Test. The agencies will evaluate intermediate banks under the Retail Lending Test and either the current community development test, referred to in the final rule as the Intermediate Bank Community Development Test, or, at the bank’s option, the Community Development Financing Test. The applicability date for the majority of the provisions in the CRA regulations is January 1, 2026, and additional requirements will be applicable on January 1, 2027.

Anti-Money Laundering Laws

Under various federal laws, including the Currency and Foreign Transactions Reporting Act (also known as the “Bank Secrecy Act”), as amended by the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT) Act, financial institutions are subject to prohibitions against specified financial transactions and account relationships, as well as enhanced due diligence and “know your customer” standards in their dealings with foreign financial institutions and foreign customers. These laws also mandate that financial institutions establish anti-money laundering programs meeting certain standards and require the federal banking regulators to consider the effectiveness of a financial institution’s anti-money laundering activities when reviewing bank mergers and bank holding company acquisitions.

The Anti-Money Laundering Act of 2020 (“AMLA”), which amends the Bank Secrecy Act, was enacted in January 2021. The AMLA is intended to be a comprehensive reform and modernization to U.S. bank secrecy and anti-money laundering laws. Among other things, it codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the U.S. Department of the Treasury to promulgate priorities for anti-money laundering and countering the financing of terrorism policy; requires the development of standards for testing technology and internal processes for Bank Secrecy Act compliance; expands enforcement- and investigation-related authority, including increasing available sanctions for certain Bank Secrecy Act violations; and expands Bank Secrecy Act whistleblower incentives and protections. Many of the statutory provisions in the AMLA will require additional rulemakings, reports and other measures, and the impact of the AMLA will depend on, among other things, rulemaking and implementation guidance. In June 2021, the Financial Crimes Enforcement Network, a bureau of the U.S. Department of the Treasury, issued the priorities for anti-money laundering and countering the financing of terrorism policy required under the AMLA. The priorities include: corruption, cybercrime, terrorist financing, fraud, transnational crime, drug trafficking, human trafficking and proliferation financing.

Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley”) comprehensively revised the laws affecting corporate governance, auditing, executive compensation and corporate reporting for entities with equity or debt securities registered under the Securities Exchange Act of 1934, as amended (the “Exchange Act”). Among other things, Sarbanes-Oxley and its implementing regulations established new membership requirements and additional responsibilities for audit committees, imposed restrictions on the relationships between public companies and their outside auditors (including restrictions on the types of non-audit services that auditors may provide), imposed additional responsibilities for public companies’ external financial statements on the chief executive officer and chief financial officer, and expanded the disclosure requirements for corporate insiders. The requirements are intended to allow stockholders to more easily and efficiently monitor the performance of companies and directors. We and our Board of Directors have, as appropriate, adopted or modified our policies and practices in order to comply with these regulatory requirements and to enhance our corporate governance practices.

As required by Sarbanes-Oxley, we have adopted a Code of Business Conduct and Ethics applicable to our Board, executives and employees. This Code of Business Conduct can be found on our website at http://www.firstusbank.comwww.fusb.com under the tabs “About – Investor Relations – FUSB Policies.”

Privacy of Customer Information

The Financial Services Modernization Act of 1999 (also known as the “Gramm-Leach-Bliley Act” or the “GLBA”) and the implementing regulations issued by federal banking regulatory agencies require financial institutions to adopt policies and procedures regarding the disclosure of nonpublic personal information about their customers to non-affiliated third parties. In general, financial institutions are required to explain to customers their policies and procedures regarding the disclosure of such nonpublic personal information, and, unless otherwise required or permitted by law, financial institutions are prohibited from disclosing such information except as provided in their policies and procedures. Specifically, the GLBA established certain information security guidelines that require each financial institution, under the supervision and ongoing oversight of its board of directors or an appropriate committee thereof, to develop, implement, and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information, to protect against anticipated threats or hazards to the security or integrity of such information, and to protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer.

Cybersecurity

The Cybersecurity Information Sharing Act of 2015 (“CISA”) was intended to improve cybersecurity in the United States by enhanced sharing of information about security threats among the U.S. government and private sector entities, including financial institutions. CISA also authorizes companies to monitor their own systems notwithstanding any other provision of law and allows companies to carry out cybersecurity defensive measures on their own systems. The law includes liability protections for companies that share cyber threat information with third parties so long as such sharing activity is conducted in accordance with CISA.

In October 2016, the federal bank regulatory agencies issued an Advance Notice of Proposed Rulemaking regarding enhanced cyber risk management standards which would apply to a wide range of large financial institutions and their third-party service providers, including Bancshares and the Bank. The proposed standards would expand existing cybersecurity regulations and guidance to focus on cyber risk governance and management, management of internal and external dependencies, and incident response, cyber resilience, and situational awareness. In addition, the proposal contemplates more stringent standards for institutions with systems that are critical to the financial sector.

The federal banking regulators regularly issue guidance regarding cybersecurity intended to enhance cyber risk management standards among financial institutions. A financial institution is expected to establish multiple lines of defense and to ensure its risk management processes address the risk posed by potential threats to the institution. A financial institution’s management is expected to maintain sufficient processes to effectively respond and recover the institution’s operations after a cyber-attack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations if a critical service provider of the institution falls victim to this type of cyber-attack.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually monitoring developments in the states in which our customers are located.

In March 2021, Virginia adopted the Consumer Data Protection Act (the “VCDPA”), which imposes certain restrictions and requirements on businesses that collect consumer datafor at least 100,000 consumers in Virginia. The Bank currently has fewer than 100,000 customers in Virginia but may become subject to the VCDPA if its customer base grows above that level. The Company could face enforcement actions by the Virginia Attorney General and penalties for noncompliance with the VCDPA.

In November 2021, the U.S. federal bank regulatory agencies adopted a rule regarding notification requirements for banking organizations related to significant computer security incidents. Under the final rule, a bank holding company, such as the Company, and an FDIC-supervised insured depository institution, such as the Bank, are required to notify the Federal Reserve or FDIC, respectively, within 36 hours of incidents that have materially disrupted or degraded, or are reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. Service providers are required under the rule to notify any affected bank client it provides services to as soon as possible when it determines it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided by that entity to the bank for four or more hours.

In July 2023, the SEC adopted amendments to its rules to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance, and incident reporting by public companies that are subject to the reporting requirements of the Exchange Act. Specifically, the amendments require current reporting about material cybersecurity incidents, periodic disclosures

about a registrant’s policies and procedures to identify and manage cybersecurity risk, management’s role in implementing cybersecurity policies and procedures, management's cybersecurity expertise, if any, and the board of directors' oversight of cybersecurity risk. Additionally, the rules require registrants to provide updates about previously reported cybersecurity incidents in their periodic reports.

On October 19, 2023, the Consumer Financial Protection Bureau ("CFPB") announced a proposed rule to adopt a regulation regarding personal financial data rights that is designed to promote “open banking.” If enacted as proposed, the regulation would require, among other things, that data providers, including any financial institution, make available to consumers and certain authorized third parties upon request certain covered transaction, account and payment information.

On October 30, 2023, the current Presidential Administration issued an Executive Order on Safe, Secure and Trustworthy Development and Use of AI, emphasizing the need for transparency, accountability and fairness in the development and use of AI. The order seeks to balance innovation with addressing risks associated with AI by providing eight guiding principles and priorities, such as ensuring that consumers are protected from fraud, discrimination and privacy risks related to AI. The Executive Order also requires certain federal agencies, including the CFPB, to address potential discrimination in the housing and consumer financial markets relating to the use by financial institutions of AI technologies. Prior to the issuance of the Executive Order, the CFPB published a report addressing the use by financial institutions of AI chatbots in the provision of financial products and services, which report also highlighted the limitations and various risks posed by such activity. States have also started to regulate the use of AI technologies. For example, the California Privacy Protection Agency ("CCPA") is currently in the process of finalizing regulations under the CCPA regarding the use of automated decision making.

Regulation of Lending Practices

Our lending practices are subject to a number of federal and state laws, as supplemented by the rules and regulations of the various agencies charged with the responsibility of implementing these laws. These include, among others, the following:

In addition, the Dodd-Frank Act created the Consumer Financial Protection Bureau (the “CFPB”),CFPB, an independent bureau with broad authority to regulate the consumer finance industry, including regulated financial institutions, non-banks and others involved in extending credit to consumers. The CFPB has authority through rulemaking, orders, policy statements, guidance and enforcement actions to administer and enforce federal consumer financial laws. Although the CFPB has the power to interpret, administer and enforce federal consumer financial laws, the Dodd-Frank Act provides that the federal banking regulatory agencies continue to have examination and enforcement powers over the financial institutions that they supervise relating to the matters within the jurisdiction of the CFPB if the supervised institutions have less than $10 billion in assets. Even so, the CFPB has adopted a number of rules that impact our lending practices, including, among other things, (1) requiring financial institutions to make a “reasonable and good faith determination” that a consumer has a “reasonable ability” to repay a residential mortgage loan before making such a loan, (2) requiring sponsors of asset-backed securities to retain at least 5% of the credit risk of the assets underlying the securities (and generally prohibiting sponsors from transferring or hedging that credit risk), and (3) imposing a number of new and enhanced requirements on the mortgage servicing industry, including rules regarding communications with borrowers, maintenance of customer account records, procedures for responding to written borrower requests and complaints of errors, servicing delinquent loans, and conducting foreclosure proceedings, among other measures.

Regulation of Deposit Operations

Our deposit operations are subject to federal laws applicable to depository accounts, including, among others, the following:

Federal Home Loan Bank Membership

The Bank is a member of the Federal Home Loan Bank of Atlanta (“FHLBA”). Each member of the FHLBA is required to maintain a minimum investment in the Class B stock of the FHLBA. The Board of Directors of the FHLBA can increase the minimum investment requirements if it concludes that additional capital is required to allow it to meet its own regulatory capital requirements. Any increase in the minimum investment requirements outside of specified ranges requires the approval of the Federal Housing Finance Agency. Because the extent of any obligation to increase the level of investment in the FHLBA depends entirely on the occurrence of a future event, we are unable to determine the extent of future required potential payments to the FHLBA at this time. Additionally, in the event that a member financial institution fails, the right of the FHLBA to seek repayment of funds loaned to that institution will take priority over the rights of all other creditors.

Climate-Related Regulation and Risk Management

In recent years, the federal banking agencies have increased their focus on climate-related risks impacting the operations of banks, the communities they serve and the broader financial system. Accordingly, the agencies have begun to enhance their supervisory expectations regarding the climate risk management practices of larger banking organizations, including by encouraging such banks to: ensure that management of climate-related risk exposures has been incorporated into existing governance structures; evaluate the potential impact of climate-related risks on the bank’s financial condition, operations and business objectives as part of its strategic planning process; account for the effects of climate change in stress testing scenarios and systemic risk assessments; revise expectations for credit portfolio concentrations based on climate-related factors; consider investments in climate-related initiatives and lending to communities disproportionately impacted by the effects of climate change; evaluate the impact of climate change on the bank’s borrowers and consider possible changes to underwriting criteria to account for climate-related risks to mortgaged properties; incorporate climate-related financial risk into the bank’s internal reporting, monitoring and escalation processes; and prepare for the transition risks to the bank associated with the adjustment to a low-carbon economy and related changes in laws, regulations, governmental policies, technology, and consumer behavior and expectations.

On October 21, 2021, the Financial Stability Oversight Council published a report identifying climate-related financial risks as an “emerging threat” to financial stability. On December 16, 2021, the Office of the Comptroller of the Currency (the “OCC”) issued proposed principles for climate-related financial risk management for national banks with more than $100 billion in total assets. Although these risk management principles, if adopted as proposed, would not apply to the Bank directly based upon our current size, the OCC has indicated that all banks, regardless of their size, may have material exposures to climate-related financial and other risks that require prudent management. The federal banking agencies, either independently or on an interagency basis, are expected to adopt a more formal climate risk management framework for larger banking organizations in the coming months. As climate-related supervisory guidance is formalized, and relevant risk areas and corresponding control expectations are further refined, we may be required to expend significant capital and incur compliance, operating, maintenance and remediation costs in order to conform to such requirements.

Website Information

The Bank’s website address is http:https://www.firstusbank.com.www.fusb.com. Bancshares does not maintain a separate website. Bancshares makes available free of charge on or through the Bank’s website, under the tabs “About“Investors – Investor Relations,SEC filings,” its Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and all amendments to those reports filed or furnished pursuant to Section 13(a) of the Exchange Act as soon as reasonably practicable after such material is electronically filed with the SEC. These reports are also available on the SEC’s website, http:https://www.sec.gov. Bancshares will provide paper copies of these reports to shareholders free of charge upon written request. Bancshares is not including the information contained on or available through the Bank’s website as a part of, or incorporating such information into, this Annual Report on Form 10-K.10-K.

Item 1A. Risk Factors.

Making or continuing an investment in our common stock involves certain risks that you should carefully consider. The risks and uncertainties described below are not the only risks that may have a material adverse effect on us. Additional risks and uncertainties also could adversely affect our business, consolidated financial condition, results of operations and cash flows. If any of the following risks actually occurs, our business, financial condition or results of operations could be negatively affected, the market price of your common stock could decline, and you could lose all or a part of your investment. Further, to the extent that any of the information contained in this Annual Report on Form 10-K constitutes forward-looking statements, the risk factors set forth below also are cautionary statements identifying important factors that could cause our actual results to differ materially from those expressed in any forward-looking statements made by us or on our behalf.

Risks Related to the COVID-19 PandemicCredit and Liquidity

The novel coronavirus (COVID-19) global pandemic has adversely impacted our business, and the ultimate effect on our business, liquidity, results of operations and financial condition will depend on future developments that are highly uncertain, including the severity, scope and duration of the pandemic, its cumulative economic effects and actions taken by governmental authorities in response to the pandemic.

Beginning in 2020, the global pandemic related to COVID-19 began to impact the worldwide economy and our results of operations. Because of the size and breadth of this pandemic, all of the direct and indirect consequences of COVID-19 are not yet known and may not emerge for some time. The COVID-19 pandemic has resulted, and may for some time continue to result, in illness, increased unemployment, temporary closures of many businesses, disruption to trade, travel, employee productivity and other economic activities, and destabilization of financial markets and economic activity. In response to the COVID-19 pandemic, the governments of the states in which we operate, and of most other states, have taken preventative or protective actions, such as imposing restrictions on travel and business operations, advising or requiring individuals to limit or forego their time outside of their homes, and ordering temporary closures of businesses that have been deemed to be non-essential. The extent of the impact of COVID-19 on the Company’s operational and financial performance is currently uncertain, cannot be predicted and will depend on certain developments, including, among others, the severity, scope and duration of the pandemic, its impact on our customers, employees and vendors, and the continued governmental, regulatory and private sector responses, which may be precautionary, to the coronavirus.

Risks presented by the ongoing effects of the COVID-19 pandemic include the following:

As we sought to protect the health and safety of our employees and customers during the year ended December 31, 2020, we took numerous actions to modify our business operations, including restricting employee travel, directing a significant percentage of our employees that were able to do so to work from home, closing the lobbies of many of our branches, and, in some cases, the branch itself, and implementing our business continuity plans and protocols. If the Company is unable to recover from a business disruption on a timely basis, our business, financial condition and results of operations could be materially and adversely affected.

Any of the above events could cause, contribute to or exacerbate the other risks and uncertainties enumerated below in this Annual Report on Form 10-K or otherwise in this report, and could materially adversely affect our business, results of operations or financial condition. We have implemented our business contingency plan and taken other precautions with respect to the COVID-19 global pandemic. However, such measures may not adequately protect our business from the full impacts of the pandemic.

Since the Bank is a participating lender in the Small Business Administration (“SBA”) Paycheck Protection Program (“PPP”), the Company and the Bank are subject to additional risks of litigation from the Bank’s customers or other parties regarding the Bank’s processing of loans for the PPP and risks that the SBA may not fund some or all PPP loan guarantees.

On March 27, 2020, President Trump signed the CARES Act, which included a $349 billion loan program administered through the SBA referred to as the PPP. Under the PPP, small businesses and other entities and individuals can apply for loans from existing SBA lenders and other approved regulated lenders that enroll in the program, subject to numerous limitations and eligibility criteria. The Bank participated as a lender in the PPP. The PPP opened on April 3, 2020; however, because of the short timeframe between the passing of the CARES Act and the opening of the PPP, there was and is some ambiguity in the laws, rules and guidance regarding the operation of the PPP, which exposes the Company to risks relating to noncompliance with the PPP. Congress approved

approximately $310 billion of additional funding for the PPP on April 24, 2020. As of December 31, 2020, the remaining balance of PPP loans originated by the Company totaled $11.9 million.

In December 2020, President Trump signed an additional relief bill which provides for $284 billion in new funding for PPP loans. In January 2021, the SBA initiated a new program to allow SBA lenders to begin obtaining approval for new PPP loans. The Bank has begun processing new applications.

Since the opening of the PPP, several other larger banks have been subject to litigation regarding the process and procedures that such banks used in processing applications for the PPP. The Company and the Bank may be exposed to the risk of litigation, from both customers and non-customers that approached the Bank regarding PPP loans, regarding the process and procedures used in processing applications for the PPP. If any such litigation is filed against the Company or the Bank and is not resolved in a manner favorable to the Company or the Bank, it may result in significant financial liability or adversely affect the Company’s reputation. In addition, litigation can be costly, regardless of outcome. Any financial liability, litigation costs or reputational damage caused by PPP-related litigation could have a material adverse impact on our business, financial condition and results of operations. The Bank also has credit risk on PPP loans, if the SBA determines deficiencies in the manner in which PPP loans were originated, funded or serviced by the Bank, such as an issue with the eligibility of a borrower to receive a PPP loan, including those related to the ambiguity in the laws, rules and guidance regarding the PPP’s operation. In the event of a loss resulting from a default on a PPP loan and a determination by the SBA that there were deficiencies in the manner in which the PPP loan was originated, funded or serviced by the Company, the SBA may deny its liability under the PPP loan guaranty, reduce the amount of the guaranty, or, if it has already paid under the guaranty, seek recovery of any loss related to the deficiency from the Company. Similar issues may also result in the denial of forgiveness of PPP loans, which would adversely affect and could result in losses, including possible bankruptcies, which may expose us to further costs and potential losses.

Credit Risks

If loan losses are greater than anticipated, our earnings may be adversely affected.

As a lender, we are exposed to the risk that customers will be unable to repay their loans according to their terms and that any collateral securing the payment of their loans may not be sufficient to assure repayment. Credit losses are inherent in the business of making loans. Our credit risk with respect to our real estate and construction loan portfolio relates principally to the creditworthiness of individuals and the value of the real estate serving as security for the repayment of loans, and the credit risk with respect to our commercial and consumer loan portfolio relates principally to the general creditworthiness of businesses and individuals within the local markets in which we operate. We make various assumptions and judgments about the collectability of our loan portfolio and provide an allowance for potential loancredit losses based on a number of factors. We believe that our allowance for loancredit losses is adequate. However, if estimates, assumptions or judgments used in calculating this allowance are incorrect, the allowance for loancredit losses may not be sufficient to cover our actual loan losses. Deterioration of economic conditions affecting borrowers, new information regarding existing loans, inaccurate management assumptions, identification of additional problem loans and other factors, both within and outside of our control, may result in higher levels of nonperforming assets and charge-offs and loan losses in excess of our current allowance for loancredit losses, requiring us to make material additions to our allowance for loancredit losses, which could have a material adverse effect on our business, consolidated financial condition, results of operations and cash flows. The actual amount of future provisions for loancredit losses cannot be determined at this time and may vary from the amounts of past provisions. In addition, banking regulators periodically review our allowance for loancredit losses and may require us to increase our provision for loancredit losses or recognize further charge-offs if the regulators’ judgments are different than those of our management. Material additions to the allowance could materially decrease our net income.

CRE lending may expose us to increased lending risks.

In accordance with section 4013Our policy generally has been to originate CRE loans primarily in the states in which the Bank operates. At December 31, 2023, CRE loans, including owner occupied, investor, and real estate construction loans, totaled $301.7 million or 36.7%, of our total loan portfolio. As a result of our growth in this portfolio over the past several years and planned future growth, these loans require more ongoing evaluation and monitoring and we are implementing enhanced risk management policies, procedures and controls. CRE loans generally involve a greater degree of credit risk than residential mortgage loans because they typically have larger balances and are more affected by adverse conditions in the economy. Because payments on loans secured by CRE often depend upon the successful operation and management of the Coronavirus Aid, Reliefproperties and Economic Security (CARES) Act,the businesses which operate from within them, repayment of such loans may be affected by factors outside the borrower’s control, such as adverse conditions in the real estate market or the economy or changes in government regulation. In recent years, CRE markets have been experiencing substantial growth, and increased competitive pressures have contributed significantly to historically low capitalization rates and rising property values. However, CRE markets have been facing downward pressure since 2022 due in large part to increasing interest rates and declining property values. Accordingly, the federal banking agencies have expressed concerns about weaknesses in the current CRE market and have applied increased regulatory scrutiny to institutions with CRE loan portfolios that are fast growing or large relative to the institutions' total capital. To address supervisory expectations with respect to financial institutions' handling of CRE borrowers who are experiencing financial difficulty, in June of 2023, the federal banking agencies, including the OCC, issued an interagency policy statement addressing prudent CRE loan accommodations and workouts. Our failure to adequately implement enhanced risk management policies, procedures and controls could adversely affect our ability to increase this portfolio going forward and could result in an increased rate of delinquencies in, and increased losses from, this portfolio. At December 31, 2023, nonaccrual CRE loans totaled $1.3 million, or less than 1% of our total portfolio of CRE loans.

Our business is subject to liquidity risk, which could disrupt our ability to meet financial obligations.

Liquidity risk refers to the ability of the Company implemented initiatives to provideensure that sufficient cash flow and liquid assets are available to satisfy current and future financial obligations, including demand for loans and deposit withdrawals, funding operating costs and other corporate purposes. Liquidity risk arises whenever the maturities of financial instruments included in assets and liabilities differ or when assets cannot be liquidated at fair market value as needed. The Company obtains funding through deposits and various short-term payment relief to borrowers who have been negatively impacted by COVID-19. Over 1,900and long-term wholesale borrowings, including federal funds purchased and securities sold under repurchase agreements, the Federal Reserve Discount Window and Federal Home Loan Bank (FHLB) advances. Any restriction or disruption of the Company’s borrowers requested and were granted pandemic-related deferments by the Company during the year ended December 31, 2020. Although the interpretive guidance defines short-term as six months, the majority of deferments granted by the Company were for terms of 90 daysability to obtain funding from these or less. As of December 31, 2020, 110 borrowers with an aggregate principal balance totaling approximately $8.1 million had active loan payment deferments. The defermentsother sources could contribute to higher credit losses.

We may be required to increase our allowance for loan losses ashave a result of a recent change to an accounting standard.

The measure of our allowance for loan losses depends in partnegative effect on the adoptionCompany’s ability to satisfy its current and interpretation of accounting standards. The Financial Accounting Standards Board, or FASB, recently issued Accounting Standards Update (“ASU”) 2016-13, Financial Instruments - Credit Losses. This ASU provides a new credit impairment model,future financial obligations, which could materially affect the Current Expected Credit Loss, or CECL model, which, as a result of a delay in implementation for smaller reporting companies announced by the FASB during the fourth quarter of 2019, will apply to us in fiscal years beginning after December 15, 2022. CECL will require financial institutions to estimate and develop a provision for credit losses at origination for the lifetime of the loan, as opposed to reserving for incurred or probable losses up to the balance sheet date. Under the CECL model, credit deterioration would be reflected in the income statement in the period of origination or acquisition of the loan, with changes in expected credit losses due to further credit deterioration or improvement reflected in the periods in which the expectation changes. Accordingly, implementation of the CECL model will change our current method of providing allowances for loan losses, which would likely require us to increase our allowance for loan losses. Moreover, the CECL model likely would create more volatility in our level of allowance for loan losses. We expect to recognize a one-time cumulative effect adjustment to the allowance for loan and lease losses as of the beginning of the first quarter of 2023, equal to the difference between the amount of our allowance under the incurred loss methodology and under CECL. However, we cannot yet

determine the magnitude of any such one-time cumulative adjustment or of the overall impact of the new standard on our financialCompany’s condition or results of operations. A material increase in our level of allowance for loan losses

Liquidity risks could adversely affect our business, consolidatedoperations and jeopardize our financial condition.

Liquidity is essential to our business. An inability to raise funds through deposits, borrowings, the repayment or sale of loans and other sources could have a substantial negative effect on our liquidity. Our funding sources include federal funds, purchased securities sold under repurchase agreements, core and non-core deposits, and short- and long-term debt. We maintain a portfolio of securities that can be used as a source of liquidity. Other sources of liquidity are available should they be needed, such as through our acquisition of additional non-core deposits. Bancshares may be able, depending on market conditions, to issue and sell debt securities and preferred or common equity securities in public or private transactions. Our access to funding sources in amounts adequate to finance or capitalize our activities or on acceptable terms could be impaired by factors that affect us specifically or the financial services industry or economy in general, such as further disruption in the financial markets, negative views and expectations about the prospects for the financial services industry, deterioration within the credit markets, or the financial condition, resultsliquidity or profitability of operations and cash flows.the financial institutions with which we transact.

Risks Related to Our Market and Industry Risks

Our business and operations may be materially adversely affected by national and local market economic conditions.

Our business and operations, which primarily consist of banking activities, including lending money to customers in the form of loans and borrowing money from customers in the form of deposits, are sensitive to general business and economic conditions in the United States generally, and in our local markets in particular. If economic conditions in the United States or any of our local markets weaken, our growth and profitability from our operations could be constrained. The current economic environment is characterized by high inflation levels and interest rates near historically low levels, which impactsrates. These conditions impact our ability to attract deposits and to generate attractive earnings through our loan and investment portfolios. All of these factors can individually or in the aggregate be detrimental to our business, and the interplay between these factors can be complex and unpredictable. Unfavorable market conditions can result in a deterioration in the credit quality of our borrowers and the demand for our products and services, an increase in the number of delinquencies, defaults and charge-offs, additional provisions for loan losses, a decline in the value of our collateral, and an overall material adverse effect on

the quality of our loan portfolio. Additionally, national financial markets may be adversely affected by sustained high levels of inflation, the current or anticipated impact of military conflict, including the current conflicts in the Middle East and Ukraine, terrorism, and other geopolitical events.

The economic conditions in our local markets may be different from the economic conditions in the United States as a whole. Our success depends to a certain extent on the general economic conditions of the geographic markets that we serve in Alabama, Mississippi, Tennessee and Virginia. Local economic conditions in these areas have a significant impact on our commercial, real estate and construction loans, the ability of borrowers to repay these loans and the value of the collateral securing these loans. Adverse changes in the economic conditions of the southeastern United States in general or any one or more of these local markets could negatively impact the financial results of our banking operations and have a negative effect on our profitability. For example, significant unemployment in the timber industry could cause widespread economic distress in many of the areas that we serve. Similar trends in other industries or sectors that we serve could have a significant negative effect on our profitability.

For a discussion of the impact of and the ongoing risks to our business associated with the COVID-19 pandemic, see “Risks Related to the COVID-19 Pandemic” above.

The banking industry is highly competitive, which could result in loss of market share and adversely affect our business.

We encounter strong competition in making loans, acquiring deposits and attracting customers for investment services. We compete with commercial banks, online banks, credit unions, finance companies, mutual funds, insurance companies, investment banking companies, brokerage firms and other financial intermediaries operating in our markets and elsewhere in various segments of the financial services market. Many of these competitors, some of which are affiliated with large bank holding companies, have substantially greater resources and lending limits than we do. In addition, many of our non-bank competitors are not subject to the same extensive federal regulations that govern bank holding companies and federally insured banks, and, as a result, may be able to offer certain products and services at a lower cost than we are able to offer, which could adversely affect our business.

Rapid and significant changes in market interest rates may adversely affect our performance.

Most of our assets and liabilities are monetary in nature and are therefore subject to significant risks from changes in interest rates. Our profitability depends to a large extent on net interest income, and changes in interest rates can impact our net interest income as well as the valuation of our assets and liabilities. Our consolidated results of operations are affected by changes in interest rates and our ability to manage interest rate risks. Changes in market interest rates, changes in the relationships between short-term and long-term market interest rates and changes in the relationships between different interest rate indices can affect the interest rates charged on interest-earning assets differently than the interest rates paid on interest-bearing liabilities. These differences could result in an increase in interest expense relative to interest income or a decrease in our interest rate spread. For a more detailed discussion of these risks and our management strategies for these risks, see “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations.” Our net interest margin depends on many factors that are partly or completely out of our control, including competition, federal economic monetary and fiscal policies and general economic conditions. Despite the implementation of strategies to manage interest rate risks, changes in interest rates may have a material adverse impact on our profitability.

The performance of our investment portfolio is subject to fluctuations due to changes in interest rates and market conditions.

Changes in interest rates can negatively affect the performance of most of our investments. Interest rate volatility can reduce gains or create losses in our investment portfolios. Interest rates are highly sensitive to many factors, including governmental monetary policies, domestic and international economic and political conditions and other factors beyond our control. Fluctuations in interest rates affect returns on, and the market value of, investment securities. The fair market value of the securities in our portfolio and the investment income from these securities also fluctuate depending on general economic and market conditions. In addition, actual net investment income and/or cash flows from investments that carry prepayment risk, such as mortgage-backed and other

asset-backed securities, may differ from those anticipated at the time of investment as a result of interest rate fluctuations. The potential effect of these factors is heightened due to the current conditions in the financial markets and economic conditions generally.

Fiscal challenges facing the U.S. government could negatively impact financial markets which in turn could have an adverse effect on our financial position or results of operations.

Federal budget deficit concerns and the potential for political conflict over legislation to fund U.S. government operations and raise the U.S. government’s debt limit may increase the possibility of a default by the U.S. government on its debt obligations, related credit-rating downgrades, or an economic recession in the United States. Many of our investment securities are issued by the U.S. government and government agencies and sponsored entities. As a result of uncertain domestic political conditions, including potential future federal government shutdowns, the possibility of the federal government defaulting on its obligations for a period of time due to debt ceiling limitations or other unresolved political issues, investments in financial instruments issued or guaranteed by the federal government pose liquidity risks. In connection with prior political disputes over U.S. fiscal and budgetary issues leading to the U.S. government shutdown in 2011, S&P lowered its long-term sovereign credit rating on the U.S. from AAA to AA+. In 2023, Congress narrowly averted two separate government shutdowns by passing continuing resolutions. In part due to repeated debt-limit political standoffs and last-minute resolutions, in 2023 a rating agency downgraded the U.S. long-term foreign-currency issuer default rating to AA+ from AAA. A further downgrade, or a downgrade by other rating agencies, as well as sovereign debt issues facing the governments of other countries, could have a material adverse impact on financial markets and economic conditions in the U.S. and worldwide.

Changes in the policies of monetary authorities and other government action could adversely affect our profitability.

Our consolidated results of operations are affected by credit policies of monetary authorities, particularly the Federal Reserve. The instruments of monetary policy employed by the Federal Reserve include open market operations in United States government securities, changes in the discount rate or the federal funds rate on bank borrowings and changes in reserve requirements against bank deposits. In view of changing conditions in the national economy and in the money markets, we cannot predict future changes in interest rates, deposit levels, loan demand or our business and earnings. Furthermore, the actions of the United States government and other governments in responding to such conditions may result in currency fluctuations, exchange controls, market disruption and other adverse effects.

Uncertainty relating to the LIBOR calculation process and potential phasing out of LIBOR may adversely affect our results of operations.

On July 27, 2017, the Chief Executive of the United Kingdom Financial Conduct Authority, which regulates LIBOR, announced that it intends to stop persuading or compelling banks to submit rates for the calibration of LIBOR to the administrator of LIBOR after 2021. The announcement indicates that the continuation of LIBOR on the current basis cannot and will not be guaranteed after 2021. It is impossible to predict whether and to what extent banks will continue to provide LIBOR submissions to the administrator of LIBOR or whether any additional reforms to LIBOR may be enacted in the United Kingdom or elsewhere. While there is no consensus on what rate or rates may become accepted alternatives to LIBOR, a group of large banks, the Alternative Reference Rate Committee (ARRC), selected, and the Federal Reserve Bank of New York started in April 2018 to publish, the Secured Overnight Finance Rate, or SOFR, as an alternative to LIBOR. SOFR is a broad measure of the cost of borrowing cash overnight collateralized by Treasury securities, given the depth and robustness of the U.S. Treasury repurchase market.  Furthermore, the Bank of England has commenced publication of a reformed Sterling Overnight Index Average (SONIA), comprised of a broader set of overnight Sterling money market transactions, as of April 23, 2018. The SONIA has been recommended as the alternative to Sterling LIBOR by the Working Group on Sterling Risk-Free Reference Rates.

While we expect LIBOR to continue to be available in substantially its current form until the end of 2021 or shortly before that, it is possible that LIBOR quotes will become unavailable prior to that point. This could result, for example, if sufficient banks decline to make submissions to the LIBOR administrator. In that case, the risks associated with the transition to an alternative reference rate will be accelerated and magnified. These risks may also be increased due to the shorter time for preparing for the transition. On March 5, 2021, ICE Benchmark Administration (“IBA”), the administrator of LIBOR, released the much-anticipated feedback statement (“Cessation Statement”) reporting the results of its December 2020 Consultation on potential Cessation. Pursuant to the Cessation Statement, IBA intends to cease publication of (i) the 1 Week and 2 Month USD LIBOR settings immediately following the LIBOR publication on December 31, 2021, and (ii) the Overnight and 1, 3, 6 and 12 Month USD LIBOR settings immediately following the LIBOR publication on June 30, 2023, subject to any rights of the UK Financial Conduct Authority (“FCA”), the regulatory supervisor of IBA, to compel IBA to continue publication using a changed methodology. The outcome of these actions and their impact on LIBOR could materially affect the economics as well as the timing of the transition away from LIBOR.

At this time, it is impossible to predict whether SOFR and SONIA will become accepted alternatives to LIBOR or the effect of any such alternatives on the value of LIBOR-based securities and variable rate loans, subordinated debentures, or other securities or financial arrangements, given LIBOR’s role in determining market interest rates globally. Uncertainty as to the nature of alternative reference rates and as to potential changes or other reforms to LIBOR may adversely affect LIBOR rates and the value of LIBOR-based loans and securities in our portfolio and may impact the availability and cost of hedging instruments and borrowings. If LIBOR rates are no longer available, and we are required to implement substitute indices for the calculation of interest rates under our loan agreements with our borrowers, we may incur significant expenses in effecting the transition, and may be subject to disputes or litigation with customers over the appropriateness or comparability to LIBOR of the substitute indices, which could have an adverse effect on our results of operations.

Risks Related to Privacy and Technology

Technological changes in the banking and financial services industries may negatively impact our results of operations and our ability to compete.

The banking and financial services industries are undergoing rapid changes, with frequent introductions of new technology-driven products and services. In addition to enhancing the level of service provided to customers, the effective use of technology increases efficiency and enables financial institutions to reduce costs. To remain competitive, financial institutions must continuously evaluate changing customer preferences with respect to emerging technologies and develop plans to address such changes in the most cost-effective manner possible. Our future success will depend, in part, on our ability to use technology to offer products and services that provide convenience to customers and create additional efficiencies in operations, and our failure to do so could negatively impact our business. Additionally, our competitors may have greater resources to invest in technological

improvements than we do, and we may not be able to effectively implement new technology-driven products and services, which could reduce our ability to effectively compete.

Our information systems may experience a failure or interruption.

We rely heavily on communications and information systems to conduct our business. Any failure or interruption in the operation of these systems could impair or prevent the effective operation of our customer relationship management, general ledger, deposit, lending or other functions. While we have policies and procedures designed to prevent or limit the effect of a failure or interruption in the operation of our information systems, there can be no assurance that any such failures or interruptions will not occur or, if they do occur, that they will be adequately addressed. The occurrence of any failures or interruptions impacting our information systems could damage our reputation, result in a loss of customer business, and expose us to additional regulatory scrutiny, civil litigation and possible financial liability, any of which could have a material adverse effect on our business, consolidated financial condition, results of operations and cash flows.

We use information technology in our operations and offer online banking services to our customers, and unauthorized access to our customers’ confidential or proprietary information as a result of a cyber-attack or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers.

Information security risks for financial institutions have generally increased in recent years, in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, activists and other external parties. We are under continuous threat

of loss due to hacking and cyber-attacks, especially as we continue to expand customer capabilities to utilize the internet and other remote channels to transact business. Our risk and exposure to these matters remains heightened because of the evolving nature and complexity of these threats from cybercriminals and hackers, our plans to continue to provide internet banking channels, and our plans to develop additional remote connectivity solutions to serve our customers. Therefore, the secure processing, transmission and storage of information in connection with our online banking services are critical elements of our operations. However, our network could be vulnerable to unauthorized access, computer viruses and other malware, phishing schemes or other security failures. In addition, our customers may use personal smartphones, tablet PCs or other mobile devices that are beyond our control systems in order to access our products and services. Our technologies, systems and networks, and our customers’ devices, may become the target of cyber-attacks, electronic fraud or information security breaches that could result in the unauthorized release, gathering, monitoring, use, loss or destruction of our or our customers’ confidential, proprietary and other information, or otherwise disrupt our or our customers’ or other third parties’ business operations. As cyber threats continue to evolve, we may be required to spend significant capital and other resources to protect against these threats or to alleviate or investigate problems caused by such threats. To the extent that our activities or the activities of our customers involve the processing, storage or transmission of confidential customer information, any breaches or unauthorized access to such information could present significant regulatory costs and expose us to litigation and other possible liabilities. Any inability to prevent these types of security threats could also cause existing customers to lose confidence in our systems and could adversely affect our reputation and ability to generate deposits. In addition, we may not have adequate insurance coverage to compensate for losses from a cyber threat event. While we have not experienced any material losses relating to cyber-attacks or other information security breaches to date, we may suffer such losses in the future. The occurrence of any cyber-attack or information security breach could result in potential legal liability, reputational harm, damage to our competitive position, additional compliance costs, and the disruption of our operations, all of which could adversely affect our business, consolidated financial condition, results of operations and cash flows.

We depend on outside third parties for the processing and handling of our records and data, which exposes us to additional risk for cybersecurity breaches and regulatory action.

We rely on software and internet-based platforms developed by third-party vendors to process various transactions. In some cases, we have contracted with third parties to run their proprietary software on our behalf. These systems include, but are not limited to, general ledger, payroll, employee benefits, loan and deposit processing and securities portfolio accounting. If these third-party service providers experience difficulties, are subject to cybersecurity breaches or terminate their services, and we are unable to replace them with other service providers on a timely basis, our operations could be interrupted. If an interruption were to continue for a significant period of time, our business, consolidated financial condition and results of operations could be adversely affected. While we perform a review of controls instituted by the applicable vendors over these programs in accordance with industry standards and perform our own testing of user controls, we must rely on the continued maintenance of controls by these third-party vendors, including safeguards over the security of customer data. In addition, we maintain, or contract with third parties to maintain, daily backups of key processing outputs in the event of a failure on the part of any of these systems. Nonetheless, we may incur a temporary disruption in our ability to conduct business or process transactions, or damage to our reputation, if the third-party vendor fails to adequately maintain internal controls or institute necessary changes to systems. Such a disruption or breach of security could have a material adverse effect on our business.

In addition, federal regulators have issued guidance outlining their expectations for third-party service provider oversight and monitoring by financial institutions. Any failure to adequately oversee the actions of our third-party service providers could result in

regulatory actions against us, which could adversely affect our business, consolidated financial condition, results of operations and cash flows.

Risks Related to Legal, Reputational and Compliance Matters

We are subject to extensive governmental regulation, and the costs of complying with such regulation could have an adverse impact on our operations.

The financial services industry is extensively regulated and supervised under both federal and state law. We are subject to the supervision and regulation of the Federal Reserve, the FDIC and the ASBD. These regulations are intended primarily to protect depositors, the public and the FDIC’s Deposit Insurance Fund, rather than shareholders. Additionally, we are subject to supervision, regulation and examination by other regulatory authorities, such as the SEC and state securities and insurance regulators. If, as a result of an examination, the Federal Reserve, the FDIC or the ASBD were to determine that our financial condition, capital resources, asset quality, earnings prospects, management, liquidity or other aspects of any of our operations had become unsatisfactory, or that we were in violation of any law or regulation, they may take a number of different remedial actions as they deem appropriate. These actions include the power to require us to remediate any such adverse examination findings. We are also subject to changes in federal and state laws, as well as regulations and governmental policies, income tax laws and accounting principles. Regulations affecting banks and other financial institutions are undergoing continuous change, and the ultimate effect of such changes cannot be predicted. Regulations and laws may be modified at any time, and new legislation may be enacted that could affect us. We cannot assure you that any changes in regulations or new laws will not adversely affect our performance or consolidated results of operations. Our regulatory framework is discussed in greater detail under “Item 1. Business – Supervision and Regulation.”

We are subject to laws regarding the privacy, information security and protection of personal information, and any violation of these laws or unauthorized disclosure of such information could damage our reputation and otherwise adversely affect our operations and financial condition.

Our business requires the collection and retention of large volumes of customer data, including personally identifiable information in various information systems that we maintain and in those maintained by third parties with whom we contract to provide data services. We also maintain important internal data, such as personally identifiable information about our employees and information relating to our operations. We are subject to complex and evolving laws and regulations governing the privacy and protection of personal information of individuals (including customers, employees, suppliers and other third parties). For example, our business is subject to the Gramm-Leach-Bliley Act, which, among other things: (1) imposes certain limitations on our ability to share nonpublic personal information about our customers with nonaffiliated third parties; (2) requires us to provide certain disclosures to customers about our information collection, sharing and security practices and to afford customers the right to “opt out” of any information sharing by us with nonaffiliated third parties (with certain exceptions); and (3) requires us to develop, implement and maintain a written comprehensive information security program containing appropriate safeguards based on our size and complexity, the nature and scope of our activities, and the sensitivity of customer information we process, as well as plans for responding to data security breaches. Various state and federal banking regulators and state legislatures have also enacted data security breach notification requirements with varying levels of individual, consumer, regulatory or law enforcement notification in the event of a security breach. Ensuring that our collection, use, transfer and storage of personal information complies with all applicable laws and regulations can increase our costs. Furthermore, we may not be able to ensure that all of our clients, suppliers, counterparties and other third parties have appropriate controls in place to protect the confidentiality of the information that they exchange with us, particularly where such information is transmitted by electronic means. If personal, confidential or proprietary information of customers or others were to be mishandled or misused (in situations where, for example, such information was erroneously provided to unauthorized persons, or where such information was intercepted or otherwise compromised by third parties), we could be exposed to litigation or regulatory sanctions under applicable laws and regulations. Concerns about the effectiveness of our measures to safeguard personal information could cause us to lose customers or potential customers for our products and services and thereby reduce our revenues. Accordingly, any failure or perceived failure to comply with applicable privacy or data protection laws and regulations may subject us to inquiries, examinations and investigations that could result in requirements to modify or cease certain operations or practices or in significant liabilities, fines or penalties, and could damage our reputation and otherwise adversely affect our business, consolidated financial condition, results of operations and cash flows.

Our FDIC deposit insurance premiums and assessments may increase and thereby adversely affect our financial results.

The Bank’s deposits are insured by the FDIC up to legal limits, and, accordingly, the Bank is subject to periodic insurance assessments by the FDIC. The Bank’s regular assessments are determined by its risk classification, which is based on its regulatory capital levels and the level of supervisory concern that it poses. Numerous bank failures during the financial crisis and increases in the statutory deposit insurance limits increased resolution costs to the FDIC and put significant pressure on the Deposit Insurance Fund. The FDIC has authority to increase insurance assessments, and any significant increase in insurance assessments would likely have an adverse effect on us.

We face a risk of noncompliance and enforcement action under the Bank Secrecy Act and other anti-money laundering statutes and regulations.

The Bank Secrecy Act of 1970, the USA PATRIOT Act and other laws and regulations require financial institutions, among other duties, to institute and maintain an effective anti-money laundering program and to file reports such as suspicious activity reports and currency transaction reports. We are required to comply with these and other anti-money laundering requirements. Our federal and state banking regulators, the Financial Crimes Enforcement Network and other government agencies are authorized to impose significant civil money penalties for violations of anti-money laundering requirements. We are also subject to increased scrutiny with respect to our compliance with the regulations issued and enforced by the Office of Foreign Assets Control. If our program is deemed deficient, we could be subject to liability, including fines, civil money penalties and other regulatory actions, which may include restrictions on our business operations and our ability to pay dividends, restrictions on mergers and acquisitions activity, restrictions on expansion, and restrictions on entering new business lines. Failure to maintain and implement adequate programs to combat money laundering and terrorist financing could also have significant reputational consequences for us. Any of these circumstances could have a material adverse effect on our business, consolidated financial condition, results of operations and cash flows.

Bancshares’ liquidity is subject to various regulatory restrictions applicable to its subsidiaries.

There are various regulatory restrictions on the ability of Bancshares’ subsidiaries to pay dividends or to make other payments to Bancshares. In addition, Bancshares’ right to participate in any distribution of assets of any of its subsidiaries upon a subsidiary’s liquidation or otherwise will be subject to the prior claims of creditors of that subsidiary, except to the extent that any of Bancshares’ claims as a creditor of such subsidiary may be recognized.

The internal controls that we have implemented to mitigate risks inherent to the business of banking might fail or be circumvented.

Management regularly reviews and updates our internal controls and procedures that are designed to manage the various risks in our business, including credit risk, operational risk, financial risk, compliance risk and interest rate risk. No system of controls, however well-designed and operated, can provide absolute assurance that the objectives of the system will be met. If such a system fails or is circumvented, there could be a material adverse effect on our business, consolidated financial condition, results of operations and cash flows.

Changes in tax laws and interpretations and tax challenges may adversely affect our financial results.

The enactment of federal tax reform has had, and is expected to continue to have, far reaching and significant effects on us, our customers and the United States economy. Further, the income tax treatment of corporations may at any time be clarified and/or modified through legislation, administration or judicial changes or interpretations. These changes or interpretations could adversely affect us, either directly or as a result of the effects on our customers.

In the course of our business, we are sometimes subject to challenges from taxing authorities, including the Internal Revenue Service, individual states and municipalities, regarding amounts due. These challenges may result in adjustments to the timing or amount of taxable income or deductions or allocation of income among tax jurisdictions, all of which may require a greater provisioning for taxes or otherwise negatively affect our financial results.

Climate change and related legislative and regulatory initiatives may result in operational changes and expenditures that could significantly impact the Company’s business.

Political and social attention to the issue of climate change has increased in recent years. Federal and state legislatures and regulatory agencies have continued to propose and advance numerous legislative and regulatory initiatives seeking to mitigate the effects of climate change. The federal banking agencies, including the OCC, have emphasized that climate-related risks are faced by banking organizations of all types and sizes and are in the process of enhancing supervisory expectations regarding banks’ risk management practices. In December 2021, the OCC published proposed principles for climate risk management by banking organizations with more than $100 billion in assets. The OCC also has appointed its first ever Climate Change Risk Officer and established an internal climate risk implementation committee in order to assist with these initiatives and to support the agency’s efforts to enhance its supervision of climate change risk management. Similar and even more expansive initiatives are expected, including potentially increasing supervisory expectations with respect to banks’ risk management practices, accounting for the effects of climate change in stress testing scenarios and systemic risk assessments, revising expectations for credit portfolio concentrations based on climate-related factors and encouraging investment by banks in climate-related initiatives and lending to communities disproportionately impacted by the effects of climate change. To the extent that these initiatives lead to the promulgation of new regulations or supervisory guidance applicable to the Company or the Bank, we would likely experience increased compliance costs and other compliance-related risks. The lack of empirical data surrounding the credit and other financial risks posed by climate change render it impossible to predict how specifically climate change may impact the Company’s financial condition and results of operations.

Risks Related to Strategic RisksPlanning

We intend to engage in acquisitions of other banking institutions from time to time. These acquisitions may not produce revenue or earnings enhancements or cost savings at levels, or within time frames, originally anticipated and may result in unforeseen integration difficulties.

We regularly evaluate opportunities to strengthen our current market position through acquisitions, subject to regulatory approval. Such transactions could, individually or in the aggregate, have a material effect on our operating results and financial condition, including short and long-term liquidity. Our acquisition activities could be material to our business. These activities could require us to use a substantial amount of cash or other liquid assets and/or incur debt. In addition, if goodwill recorded in connection with acquisitions were determined to be impaired, then we would be required to recognize a charge against our earnings, which could materially and adversely affect our results of operations during the period in which the impairment was recognized. Our acquisition activities could involve a number of additional risks, including the risks of:

Depending on the condition of any institutions or assets that are acquired, any acquisition may, at least in the near term, materially adversely affect our capital and earnings and, if not successfully integrated following the acquisition, may continue to have such effects.

Generally, any acquisition of target financial institutions, banking centers or other banking assets by us may require approval by, and cooperation from, a number of governmental regulatory agencies, possibly including the Federal Reserve and the FDIC, as well as state banking regulators. Such regulators could deny our application based on their regulatory criteria or other considerations, which could restrict our growth, or the regulatory approvals may not be granted on terms that are acceptable to us. For example, we could be required to sell banking centers as a condition to receiving regulatory approvals, and such a condition may not be acceptable to us or may reduce the benefit of any acquisition.

We cannot assure you that we will be successful in overcoming these risks or any other problems encountered in connection with pending or potential acquisitions. Our inability to overcome these risks could have an adverse effect on levels of reported net income, return on equity and return on assets and the ability to achieve our business strategy and maintain market value.

We may not be able to maintain consistent growth, earnings or profitability.

There can be no assurance that we will be able to continue to grow and to remain profitable in future periods, or, if profitable, that our overall earnings will remain consistent with our prior results of operations or increase in the future. Our growth in recent years has been driven by a number of factors, including strong growth in our indirect lending portfolio and demand in the commercial and real estate loan markets in certain of the communities that we serve. A downturn in economic conditions in our markets, heightened competition from other financial services providers, an inability to retain or grow our core deposit base, regulatory and legislative considerations, and failure to attract and retain high-performing talent, among other factors, could limit our ability to grow our assets or increase our profitability to the same extent as in recent periods. Sustainable growth requires that we manage our risks by following prudent loan underwriting standards, balancing loan and deposit growth without materially increasing interest rate risk or compressing our net interest margin, maintaining adequate capital, hiring and retaining qualified employees and successfully implementing our strategic initiatives. A failure to sustain our recent rate of growth or adequately manage the factors that have contributed to our growth or successfully enter new markets could have a material adverse effect on our earnings and profitability and, therefore on our business, consolidated financial condition, results of operations and cash flows.

General Risks

We cannot guarantee that we will pay dividends in the future.

Dividends from the Bank are Bancshares’ primary source of funds for the payment of dividends to its shareholders, and there are various legal and regulatory limits regarding the extent to which the Bank may pay dividends or otherwise supply funds to Bancshares. The ability of both the Bank and Bancshares to pay dividends will continue to be subject to and limited by the results of operations of the Bank and by certain legal and regulatory restrictions. Further, any lenders making loans to Bancshares or the Bank may impose financial covenants that may be more restrictive than the legal and regulatory requirements with respect to the payment of dividends. There can be no assurance as to whether or when Bancshares may pay dividends to its shareholders.

Extreme weather could cause a disruption in our operations, which could have an adverse impact on our profitability.profitability.

Some of our operations are located in areas near the Gulf of Mexico, a region that is susceptible to hurricanes and other forms of extreme weather. Such weather events could disrupt our operations and have a material adverse effect on our overall results of operations. Further, a hurricane, tornado or other extreme weather event in any of our market areas could adversely impact the ability of borrowers to timely repay their loans and may adversely impact the value of collateral that we hold.

Securities issued by us, including our common stock, are not insured.

Securities issued by us, including our common stock, are not savings or deposit accounts or other obligations of any bank and are not insured by the Deposit Insurance Fund maintained by the FDIC or by any other governmental agency or instrumentality, or any private insurer, and are subject to investment risk, including the possible loss of principal.

Future issuances of additional securities by us could result in dilution of your ownership.

We may decide from time to time to issue additional securities in order to raise capital, support growth or fund acquisitions. Further, we may issue stock options or other stock grants to retain and motivate employees. Such issuances of securities by us would dilute the respective ownership interests of our shareholders.

Our common stock price could be volatile, which could result in losses for individual shareholders.

The market price of our common stock may be subject to significant fluctuations in response to a variety of factors, including, but not limited to:

Due to these factors, you may not be able to sell your stock at or above the price you paid for it, which could result in substantial losses.

Our performance and results of operations depend in part on the soundness of other financial institutions.

Our ability to engage in routine investment and banking transactions, as well as the quality and value of our investments in equity securities and obligations of other financial institutions, could be adversely affected by the actions, financial condition and profitability of such other financial institutions with which we transact, including, without limitation, the FHLBA and our correspondent banks. Financial services institutions are interrelated as a result of shared credits, trading, clearing, counterparty and other relationships. As a result, defaults by, or even rumors or questions about, one or more financial institutions, or the financial services industry generally, could lead to market-wide liquidity problems and losses of depositor, creditor or counterparty confidence in certain institutions, and could lead to losses or defaults by other institutions. Any defaults by, or failures of, the institutions with whom we transact could adversely affect our debt and equity holdings in such other institutions, our participation interests in loans originated by other institutions, and our business, including our liquidity, consolidated financial condition and earnings.

Liquidity risks could affect our operations and jeopardize our financial condition.

Liquidity is essential to our business. An inability to raise funds through deposits, borrowings, the repayment or sale of loans and other sources could have a substantial negative effect on our liquidity. Our funding sources include federal funds, purchased securities sold under repurchase agreements, core and non-core deposits, and short- and long-term debt. We maintain a portfolio of securities that can be used as a source of liquidity. Other sources of liquidity are available should they be needed, such as through our acquisition of additional non-core deposits. Bancshares may be able, depending on market conditions, to issue and sell debt securities and preferred or common equity securities in public or private transactions. Our access to funding sources in amounts adequate to finance or capitalize our activities or on acceptable terms could be impaired by factors that affect us specifically or the financial

services industry or economy in general, such as further disruption in the financial markets, negative views and expectations about the prospects for the financial services industry, deterioration within the credit markets, or the financial condition, liquidity or profitability of the financial institutions with which we transact.

We depend on the services of our management team and board of directors, and the unexpected loss of key officers or directors may adversely affect our operations.

A departure of any of our executive officers, other key personnel or directors could adversely affect our operations. The community involvement of our executive officers and directors and our directors’ diverse and extensive business relationships are important to our success. A material change in the composition of our management team or board of directors could cause our business to suffer.

Item 1B. Unresolved Staff Comments.

None.

Item 1C. Cybersecurity.

We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. We employ a range of tools and services, providing multiple layers of security, to inform our professionals’ risk identification and assessment.

We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the Federal Financial Institutions Examination Council's (“FFIEC”), the National Institute of Standards and Technology (“NIST”), and other agencies providing guidance in this area, as well as by engaging experts to attempt to infiltrate our information systems, as such term is defined in Item 106(a) of Regulation S-K.

Our cybersecurity program includes controls designed to identify, protect against, detect, respond to and recover from cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K), and to provide for the availability of critical data and systems and to maintain regulatory compliance. These controls include the following activities:

None.We perform periodic internal and third-party assessments to test our cybersecurity controls and regularly evaluate our policies and procedures surrounding our handling and control of personal data and the systems we have in place to help protect us from cybersecurity or personal data breaches, and we perform periodic internal and third-party assessments to test our controls and to help us identify areas for continued focus, improvement, and/or compliance.

We have established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our Information Technology Steering Committee of the Board of Directors of the Bank at least quarterly. In addition, our incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence.

As a regulated financial institution, the Company is also subject to financial privacy laws and its cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see “Supervision and Regulation – Privacy of Customer Information and “– Cybersecurity” included in Part I. Item 1 – Business of this report.

Although the Company has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that the Company will not experience such an incident in the future. For additional information regarding the risk the Company faces from cybersecurity threats, please see the risk factors titled “We use information technology in our operations and offer online banking services to our customers, and unauthorized access to our customers’ confidential or proprietary information as a result of a cyber-attack or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers” and “We depend on outside third parties for the processing and handling of our records and data, which exposes us to additional risk for cybersecurity breaches and regulatory action.” included in Part I. Item 1A. – Risk Factors of this report.

Cybersecurity Governance

Cybersecurity is an important part of our enterprise risk management program and an area of increasing focus for our Board and management. Our Information Technology Steering Committee of the Board of Directors of the Bank, which then reports to the entire Board, is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the Information Technology Steering Committee receives an overview from management of our cybersecurity threat risk management process and strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Information Technology Steering Committee generally receives materials, including materials indicating current and emerging material cybersecurity threat risks and describing the Company’s ability to mitigate those risks, and discusses such matters with our Chief Information Officer, Information Security Officer, and other staff as needed.

Members of the Information Technology Steering Committee, and other members of the Board, are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management process. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.

Our cybersecurity risk management process, which is discussed in greater detail above, is led by our Chief Information Officer, Information Security Officer, Chief Risk Officer, and other staff as needed. Such individuals have collectively over 90 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and safeguarding corporate and customer information.

These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management process described above, including the operation of our incident response plan. As discussed above, these members of management report to the Information Technology Steering Committee about cybersecurity threat risks, among other cybersecurity related matters, at least quarterly. A summary report is provided to the full Board of Directors at least annually.

Item 2. Properties.

With the exception of its offices located in Knoxville and Powell, Tennessee, and Mobile, Alabama, which are leased, the Bank owns all of its offices, including its executive offices, without encumbrances. ALC owns a commercial building in Jackson, Alabama, which houses its Jackson branch office, and leases additional office space throughout Alabama and southeast Mississippi. Bancshares does not separately own any property, and to the extent that its activities require the use of physical office facilities, such activities are conducted at the offices of the Bank. We believe that our properties are sufficient for our operations at the current time.

Item 3. Legal Proceedings.

We are party to certain ordinary course litigation, and we intend to vigorously defend ourselves in all such litigation. In the opinion of management, based on a review and consultation with our legal counsel, the outcome of such ordinary course litigation should not have a material adverse effect on our consolidated financial statements or results of operation.

Item 4. Mine Safety Disclosures.

Not applicable.

PART II

Item 5. Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities.

Bancshares’ common stock is listed on the Nasdaq Capital Market under the symbol “FUSB.” Prior to our name change on October 11, 2016, our common stock was listed on the Nasdaq Capital Market under the symbol “USBI.” As of March 10, 2021,6, 2024, there were approximately 685634 record holders of Bancshares’ common stock (excluding any participants in any clearing agency and “street name” holders).

DuringBancshares declared total dividends of $0.20 per common share and $0.14 per common share during the years ended December 31, 20202023 and 2019, respectively, Bancshares declared total dividends of $0.12 and $0.09 per common share.2022, respectively. Bancshares expects to continue to pay comparable cash dividends in the future, subject to the results of operations of Bancshares and the Bank, legal and regulatory requirements and potential limitations imposed by financial covenants with third parties.

Share Repurchases

As noted See Note 14, "Shareholders' Equity," in the consolidated financial statements for additional information on dividend restrictions.

Share Repurchases

The following table below, there were nosets forth purchases made by or on behalf of Bancshares or any “affiliated purchaser,” as defined in Rule 10b-18(a)(3) of the Exchange Act, of shares of Bancshares’ common stock during the fourth quarter of 2020.2023.

Securities Authorized for Issuance under Equity Compensation Plans

Information regarding securities authorized for issuance under our equity compensation plans is incorporated by reference to Item 12 of this Annual Report on Form 10-K.

FIRST US BANCSHARES, INC.Item 6. Reserved

Item 7. MANAGEMENT’S DISCUSSION AND SUBSIDIARIESANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

SELECTED FINANCIAL DATA

Forward-Looking Statements

Statements containedYou should read the following discussion of our financial condition and results of operations in this Annual Report on Form 10-K that are not historical facts are forward-lookingconjunction with the “Selected Financial Data” and our financial statements (as defined inand the Private Securities Litigation Reform Act of 1995). In addition, First US Bancshares, Inc. (“Bancshares” and, together with its subsidiaries, the “Company”), through its senior management, from time to time makes forward-looking statements concerning its expected future operations and performance and other developments. The words “estimate,” “project,” “intend,” “anticipate,” “expect,” “believe,” “continues” and similar expressions are indicative of forward-looking statements. Such forward-looking statements are necessarily estimates reflecting the Company’s best judgment based on current information and involve a number of risks and uncertainties, and various factors could cause results to differ materially from those contemplated by such forward-looking statements. Such factors could include those identified from time to time in the Company’s Securities and Exchange Commission (“SEC”) filings and other public announcements, including the risk factors describedrelated notes included elsewhere in this Annual Report on Form 10-K for the year ended December 31, 20202023. This discussion and analysis contains forward-looking statements that involve risks, uncertainties and assumptions, and our actual results may differ materially from those anticipated in these forward-looking statements as a result of many factors, including but not limited to those discussed under Item 1A herein entitled “Risk Factors.” Specifically, with respect to statements relating to the sufficiencyFactors” and elsewhere in this Annual Report.

Selected Financial Data

The selected consolidated financial and other data of the allowance for loanCompany set forth below does not purport to be complete and lease losses, loan demand, cash flows, interest costs, growthshould be read in conjunction with, and earnings potential, expansion andis qualified in its entirety by, the Company’s positioning to handle the challenges presented by COVID-19, these factors include, but are not limited to, the rate of growth (or lack thereof) in the economy generally and in the Company’s service areas; market conditions and investment returns; changes in interest rates; the impact of the current COVID-19 pandemic on the Company’s business, the Company’s customers, the communities that the Company serves and the United States economy,more detailed information, including the impact of actions taken by governmental authorities to try to contain the virus or address the impact of the virus on the United States economy (including, without limitation, the Coronavirus Aid, Reliefconsolidated financial statements and Economic Security (CARES) Act and subsequent federal legislation) and the resulting effect on the Company’s operations, liquidity and capital position and on the financial condition of the Company’s borrowers and other customers; the pending discontinuation of LIBOR as an interest rate benchmark; the availability of quality loans in the Company’s service areas; the relative strength and weakness in the consumer and commercial credit sectors and in the real estate markets; collateral values; cybersecurity threats; and risks related to the Paycheck Protection Program. Forward-looking statements speak only as of the date they are made, and the Company undertakes no obligation to revise forward-looking statements to reflect circumstances or events that occur after the dates on which the forward-looking statements are made, except as required by law.notes, appearing elsewhere herein.