Pursuant to the FDIA and the California Financial Code, California state chartered commercial banks may generally engage in any activity permissible for national banks. Therefore, the Bank may form subsidiaries to engage in the many so-called “closely related to banking” or “nonbanking” activities commonly conducted by Shareholders.national banks in operating subsidiaries or subsidiaries of bank holding companies. Further, pursuant to the GLB Act, California banks may conduct certain “financial” activities in a subsidiary to the same extent as a national bank, provided the bank is and remains “well-capitalized,” “well-managed” and in satisfactory compliance with the CRA. The Bank currently has no financial subsidiaries.

Source of Strength

Federal Reserve policy and federal law require bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. Under this requirement, Bancorp is expected to commit resources to support the Bank, including at times when Bancorp may not be in a financial position to provide such resources, and it may not be in Bancorp’s, or Bancorp’s stockholders’ or creditors’, best interests to do so. In addition, any capital loans Bancorp makes to the Bank are subordinate in right of payment to depositors and to certain other indebtedness of the Bank. In the event of Bancorp’s bankruptcy, any commitment by Bancorp to a federal bank regulatory agency to maintain the capital of the Bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Enforcement Authority

The Nominatingfederal and Governance Committee is responsibleCalifornia regulatory structure gives the bank regulatory agencies extensive discretion in connection with their supervisory and enforcement activities and examination policies, including policies with respect to the classification of assets and the establishment of adequate loan loss reserves for regulatory purposes. The regulatory agencies have adopted guidelines to assist in identifying and addressing potential safety and soundness concerns before an institution’s capital becomes impaired. The guidelines establish operational and managerial standards generally relating to: (i) internal controls, information systems, and internal audit systems; (ii) loan documentation; (iii) credit underwriting; (iv) interest-rate exposure; (v) asset growth and asset quality; (vi) loan concentration; and (vii) compensation, fees, and benefits. Further, the regulatory agencies have adopted safety and soundness guidelines for asset quality and for evaluating and monitoring earnings to ensure that earnings are sufficient for the process relatingmaintenance of adequate capital and reserves. If, as a result of an examination, the DFPI or the FDIC should determine that the financial condition, capital resources, asset quality, earnings prospects, management, liquidity, or other aspects of the Bank’s operations are unsatisfactory or that the Bank or its management is violating or has violated any law or regulation, the DFPI and the FDIC have residual authority to:

The Federal Reserve has similar enforcement authority over bank holding companies and commonly takes parallel action in conjunction with actions taken by a subsidiary bank’s regulators.

In the exercise of their supervisory and examination authority, the regulatory agencies have recently emphasized corporate governance, stress testing, enterprise risk management and other board responsibilities; anti-money laundering compliance and enhanced high-risk customer due diligence; vendor management; cyber security and fair lending and other consumer compliance obligations.

Deposit Insurance

The FDIC is an independent federal agency that insures deposits, up to director nominations, including identifying, reviewingprescribed statutory limits, of federally insured banks and selecting individuals whosavings institutions and safeguards the safety and soundness of the banking and savings industries. The FDIC insures our customer deposits through the DIF up to prescribed limits of $250,000 for each depositor pursuant to the Dodd-Frank Act. The amount of FDIC assessments paid by each DIF member institution is based on its relative risk of default as measured by regulatory capital ratios and other supervisory factors. The FDIC uses a performance score and a loss-severity score to calculate an initial assessment rate for the Bank. In calculating these scores, the FDIC uses the Bank’s capital level and regulatory supervisory ratings and certain financial measures to assess the Bank’s ability to withstand asset-related stress and funding-related stress. The FDIC also has the ability to make discretionary adjustments to the total score based upon significant risk factors that are not adequately captured in the calculations. In addition to ordinary assessments described above, the FDIC has the ability to impose special assessments in certain instances.

We are generally unable to control the amount of assessments that we are required to pay for FDIC insurance. If there are additional bank or financial institution failures or if the FDIC otherwise determines, we may be nominatedrequired to pay even higher FDIC assessments than the recently increased levels. These increases in FDIC insurance assessments may have a material and adverse effect on our earnings and could have a material adverse effect on the value of, or market for, electionour common stock.

Under the FDIA, the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC.

On October 18, 2022, the FDIC adopted a final rule that increased initial base deposit insurance assessment rates by 2 basis points, beginning with the first quarterly assessment period of 2023. Due to the Board. Pursuantdecline in the DIF reserve ratio below the statutory minimum of 1.35% as of June 30, 2020, caused by extraordinary growth in insured deposits during the first and second quarters of 2020, the FDIC established a Restoration Plan in September 2020 to its charter,restore the NominatingDIF reserve ratio to meet or exceed the statutory minimum of 1.35% within eight years. The Restoration Plan did not include an increase in the deposit insurance assessment rate. On June 21, 2022, however, the FDIC adopted an Amended Restoration Plan and Governance Committee considersnotice of proposed rulemaking to increase the deposit insurance assessment rates as it was otherwise at risk of not reaching the statutory minimum by the statutory deadline of September 30, 2028. The proposed rule was adopted as final without change.

Also, in the final rule adopted on October 18, 2022, the FDIC incorporated Accounting Standards Update (“ASU”) 2022-02, Financial Instruments - Credit Losses (Topic 326) Troubled Debt Restructurings and Vintage Disclosures in the risk-based deposit insurance assessment system applicable to all large and highly complex IDIs. In March 2022, the FASB issued ASU 2022-02, which eliminates accounting guidance for troubled debt restructurings (“TDRs”) and introduces new disclosures and enhances existing disclosures concerning certain loan refinancings and restructurings when a borrower is experiencing financial difficulty. The FDIC final rule amends the assessment regulations to include a new term, “modifications to borrowers experiencing financial difficulty,” in two financial measures—the underperforming assets ratio and the higher-risk assets ratio—used to determine deposit insurance assessments for large and highly complex IDIs. The final rule became effective on January 1, 2023, and was applicable to the first quarterly assessment period of 2023.

On November 16, 2023, the FDIC adopted a final rule on special assessment to recover the losses to the DIF from the protection of uninsured depositors following the closures of Silicon Valley Bank, Santa Clara, CA, and Signature Bank, New York, NY during March 2023. The assessment base for the special assessment is equal to an IDI’s estimated uninsured deposits, reported for the quarter that ended December 31, 2022, adjusted to exclude the first $5 billion in estimated uninsured deposits from the IDI, or for IDIs that are part of a holding company with one or more subsidiary IDIs, at the banking organization level. The FDIC will collect the special assessment at an annual rate of approximately 13.4 basis points, over eight quarterly assessment periods. The FDIC retains the ability to cease collection early, extend the special assessment collection period, and impose a final shortfall special assessment to collect the difference between actual losses and the amounts collected after the receiverships for Silicon Valley Bank and Signature Bank terminate. The final rule will be effective April 1, 2024, with the first collection for the special assessment reflected on the invoice for the first quarterly assessment period of 2024 with a payment date of June 28, 2024. Our deposits as of December 31, 2022 were below $5 billion and therefore the Bank is not subject to this special assessment.

Operations, Consumer and Privacy Compliance Laws

The Bank must comply with numerous federal and state anti-money laundering and consumer protection statutes and implementing regulations, including the USA Patriot Act, the Bank Secrecy Act, the Foreign Account Tax Compliance Act, the CRA, the Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactions Act, the Equal Credit Opportunity Act, the Truth in Lending Act, the Fair Housing Act, the Home Mortgage Disclosure Act, the Real Estate Settlement Procedures Act, the National Flood Insurance Act, the California Homeowner Bill of Rights and various criteria in its identification, reviewfederal and selection of potential director nominees,state privacy protection laws, including but not limited to the CCPA. The Bank and Bancorp are also subject to federal and state laws prohibiting unfair or fraudulent business practices, untrue or misleading advertising, and unfair competition. Some of these laws are further discussed below:

The Equal Credit Opportunity Act (“ECOA”) generally prohibits discrimination in any credit transaction, whether for consumer or business purposes, on the basis of race, color, religion, national origin, sex, marital status, age, receipt of income from public assistance programs, or good faith exercise of any rights under the Consumer Credit Protection Act.

The Truth in Lending Act (“TILA”) is designed to ensure that credit terms are disclosed in a meaningful way so that consumers may compare credit terms more readily and knowledgeably. As a result of the TILA, all creditors must use the same credit terminology to express rates and payments, including the annual percentage rate, the finance charge, the amount financed, the total of payments and the payment schedule, among other things.

The Fair Housing Act (“FH Act”) regulates many practices, including making it unlawful for any lender to discriminate in its housing-related lending activities against any person because of race, color, religion, national origin, sex, handicap or familial status. A number of lending practices have been found by the courts to be, or may be considered, illegal under the FH Act, including some that are not specifically mentioned in the FH Act itself.

The Home Mortgage Disclosure Act (“HMDA”) grew out of public concern over credit shortages in certain urban neighborhoods and provides public information that will help show whether financial institutions are serving the housing credit needs of the neighborhoods and communities in which they are located. The HMDA also includes a “fair lending” aspect that requires the collection and disclosure of data about applicant and borrower characteristics as a way of identifying possible discriminatory lending patterns and enforcing anti-discrimination statutes.

Finally, the Real Estate Settlement Procedures Act (“RESPA”) requires lenders to provide borrowers with disclosures regarding the nature and cost of real estate settlements. Also, RESPA prohibits certain abusive practices, such as kickbacks, and places limitations on the amount of escrow accounts. Penalties under the above laws may include fines, reimbursements and other civil money penalties.

Due to heightened regulatory concern related to compliance with the CRA, TILA, FH Act, ECOA, HMDA and RESPA generally, the Bank may incur additional compliance costs or be required to expend additional funds for investments in its local community.

The Federal Reserve and other bank regulatory agencies also have adopted guidelines for safeguarding confidential, personal customer information. These guidelines require financial institutions to create, implement and maintain a comprehensive written information security program designed to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazards to the security or integrity of such information and protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. Financial institutions are also required to implement policies and procedures regarding the disclosure of nonpublic personal information about consumers to non-affiliated third parties. In general, financial institutions must provide explanations to consumers on policies and procedures regarding the disclosure of such nonpublic personal information and, except as otherwise required by law, prohibits disclosing such information. The Bank has adopted a customer information security and privacy program to comply with such requirements.

Operations, consumer and privacy compliance laws and regulations also mandate certain disclosure and reporting requirements and regulate the manner in which financial institutions must deal with customers when taking deposits, making loans, collecting loans, and providing other services. Failure to comply with these laws and regulations can subject the Bank to lawsuits and penalties, including enforcement actions, injunctions, fines or criminal penalties, punitive damages to consumers, and the loss of certain contractual rights.

Federal Home Loan Bank System

The Bank is a member of the Federal Home Loan Bank (“FHLB”) of San Francisco. Among other benefits, each FHLB serves as a reserve or central bank for its members within its assigned region. Each FHLB is financed primarily from the sale of consolidated obligations of the FHLB system. Each FHLB makes available loans or advances to its members in compliance with the policies and procedures established by the board of directors of the individual FHLB. Each member of the FHLB of San Francisco is required to own stock in an amount equal to the greater of (i) a membership stock requirement, or (ii) an activity based stock requirement (based on a percentage of outstanding advances). There can be no assurance that the FHLB will pay dividends at the same rate it has paid in the past, or that it will pay any dividends in the future.

Impact of Monetary Policies

The earnings and growth of the Bank are largely dependent on its ability to maintain a favorable differential or spread between the yield on its interest-earning assets and the rates paid on its deposits and other interest-bearing liabilities. As a result, the Bank’s performance is influenced by general economic conditions, both domestic and foreign, the monetary and fiscal policies of the federal government, and the policies of the regulatory agencies. The Federal Reserve implements national monetary policies (with objectives such as seeking to curb inflation and combat recession) by its open-market operations in U.S. government securities, by adjusting the required level of reserves for financial institutions subject to its reserve requirements, and by varying the discount rate applicable to borrowings by banks from the Federal Reserve Banks. The actions of the Federal Reserve in these areas influence the growth of bank loans, investments and deposits, and also affect interest rates charged on loans and deposits. The nature and impact of any future changes in monetary policies cannot be predicted.

Securities and Corporate Governance

Bancorp is subject to the disclosure and regulatory requirements of the Securities Act and the Exchange Act, both as administered by the SEC. As a company listed on the NASDAQ Global Select Market, the Company is subject to NASDAQ listing standards for listed companies. Bancorp is also subject to the Sarbanes-Oxley Act, provisions of the Dodd-Frank Act, and other federal and state laws and regulations which address, among other issues, required executive certification of financial presentations, corporate governance requirements for board audit and compensation committees and their members, and disclosure of controls and procedures and internal control over financial reporting, auditing and accounting, executive compensation, and enhanced and timely disclosure of corporate information. NASDAQ has also adopted corporate governance rules, which are intended to allow stockholders and investors to more easily and efficiently monitor the performance of companies and their directors. Under the Sarbanes-Oxley Act, management and the Bancorp’s independent registered public accounting firm are required to assess the effectiveness of the Bancorp’s internal control over financial reporting. These assessments are included in Part II — Item 9A — “Controls and Procedures.”

Federal Banking Agency Compensation Guidelines

Guidelines adopted by the federal banking agencies pursuant to the FDIA prohibit excessive compensation as an unsafe and unsound practice and describe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal stockholder. The federal banking agencies have issued comprehensive guidance on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking.

The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors. In accordance with the Dodd-Frank Act, the federal banking agencies prohibit incentive-based compensation arrangements that encourage inappropriate risk taking by covered financial institutions (generally institutions, like us, that have over $1 billion in assets) and are deemed to be excessive, or that may lead to material losses.

The Federal Reserve will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Company, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness, and the organization is not taking prompt and effective measures to correct the deficiencies.

The scope and content of the U.S. banking regulators’ policies on executive compensation may continue to evolve in the near future. It cannot be determined at this time whether compliance with such policies will adversely affect the Company’s ability to hire, retain, and motivate its key employees.

Audit Requirements

The Bank is required to have an annual independent audit, alone or as a part of its bank holding company’s audit, and to prepare all financial statements in accordance with GAAP. The Bank and Bancorp are also each required to have an audit committee comprised entirely of independent directors. As required by NASDAQ, Bancorp has certified that its audit committee has adopted formal written charters and meets the requisite number of directors, independence, and other qualification standards.

Regulation of Non-Bank Subsidiaries

Non-bank subsidiaries are subject to additional or separate regulation and supervision by other state, federal and self-regulatory bodies. Additionally, any foreign-based subsidiaries would also be subject to foreign laws and regulations.

Future Legislation and Regulation

Congress may enact, modify or repeal legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact, modify or repeal legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of proposed legislation (or modification or repeal of existing legislation) could impact the regulatory structure under which the Company and the Bank operate and may significantly increase its costs, impede the efficiency of its internal business processes, require the Bank to increase its regulatory capital and modify its business strategy, and limit its ability to pursue business opportunities in an efficient manner. The Company’s business, financial condition, results of operations or prospects may be adversely affected, perhaps materially.

Federal and State Taxation

Bancorp and the Bank report their income on a consolidated basis using the accrual method of accounting and are subject to federal income taxation in the same manner as other corporations with some exceptions. The Company has not been audited by the Internal Revenue Service. For 2023, 2022 and 2021, the Company was subject to a maximum federal income tax rate of 21.00%, California state income tax rate of 10.84% and various state tax rates for other various state jurisdictions.

Item 1A. Risk Factors.

Risks Related to Interest Rates

Fluctuations in interest rates may reduce net interest income and otherwise negatively impact our financial condition and results of operations.

Shifts in short-term interest rates may reduce net interest income, which is the principal component of our earnings. Net interest income is the difference between the amounts received by us on our interest-earning assets and the interest paid by us on our interest-bearing liabilities. When interest rates rise, the rate of interest we receive on our assets, such as loans, rises more quickly than the rate of interest that we pay on our interest-bearing liabilities, such as deposits, which may cause our profits to increase. When interest rates decrease, the rate of interest we receive on our assets, such as loans, declines more quickly than the rate of interest that we pay on our interest-bearing liabilities, such as deposits, which may cause our profits to decrease. The impact on earnings is more adverse when the slope of the yield curve flattens, that is, when short-term interest rates increase more than long-term interest rates or when long-term interest rates decrease more than short-term interest rates.

Interest rate increases often result in larger payment requirements for our borrowers, which increases the potential for default. At the same time, the marketability of the underlying property may be adversely affected by any reduced demand resulting from higher interest rates. In a declining interest rate environment, there may be an increase in prepayments on loans as borrowers refinance their mortgages and other indebtedness at lower rates. At December 31, 2023, total loans held for investment were 80.2% of our earning assets and exhibited a positive 4% sensitivity to rising interest rates in a 100 basis point parallel shock.

Changes in interest rates also can affect the value of loans, securities and other assets. An increase in interest rates that adversely affects the ability of borrowers to pay the principal or interest on loans may lead to an increase in nonperforming assets and a reduction of income recognized, which could have a material adverse effect on our results of operations and cash flows. Further, when we place a loan on nonaccrual status, we reverse any accrued but unpaid interest receivable, which decreases interest income. Subsequently, we continue to have a cost to fund the loan, which is reflected as interest expense, without any interest income to offset the associated funding expense. Thus, an increase in the amount of nonperforming assets would have an adverse impact on net interest income.

Rising interest rates will result in a decline in the value of the fixed-rate debt securities we hold in our investment securities portfolio. The unrealized losses resulting from holding these securities would be recognized in accumulated other comprehensive income (loss) and reduce total shareholders’ equity. Unrealized losses do not negatively impact our regulatory capital ratios; however, tangible common equity and the associated ratios would be reduced. If debt securities in an unrealized loss position are sold, such losses become realized and will reduce our regulatory capital ratios.

If short-term interest rates remain constant but longer-term interest rates fall, we could experience net interest margin compression as our interest earning assets would continue to reprice downward while our interest-bearing liability rates could fail to decline in tandem. This would have a material adverse effect on our net interest income and our results of operations.

We could recognize losses on securities held in our securities portfolio, particularly if interest rates increase or economic and market conditions deteriorate.

As of December 31, 2023, the fair value of our securities portfolio was approximately $324.2 million. Factors beyond our control can significantly influence the fair value of securities in our portfolio and can cause potential adverse changes to the fair value of these securities. For example, fixed-rate securities acquired by us are generally subject to decreases in market value when interest rates rise. Additional factors include, but are not limited to, rating agency downgrades of the securities or our own analysis of the value of the security, defaults by the issuer or individual mortgagors with respect to the underlying securities, and continued instability in the credit markets. Any of the foregoing factors could cause other-than-temporary impairment in future periods and result in realized losses. The process for determining whether impairment is other-than-temporary usually requires difficult, subjective judgments about the future financial performance of the issuer and any collateral underlying the security in order to assess the probability of receiving all contractual principal and interest payments on the security. Because of changing economic and market conditions affecting interest rates, the financial condition of issuers of the securities and the performance of the underlying collateral, we may recognize realized and/or unrealized losses in future periods, which could have an adverse effect on our financial condition and results of operations.

Risks Related to Our Business

A decline in general business and economic conditions and any regulatory responses to such conditions could have a material adverse effect on our business, financial position, results of operations and growth prospects.

Our business and operations are sensitive to general business and economic conditions in the United States, generally, and particularly in the states of California, Nevada, Illinois, New Jersey, Hawaii and New York, and the Los Angeles, New York City, Chicago, Las Vegas and Honolulu metropolitan areas. Unfavorable or uncertain economic and market conditions could lead to credit quality concerns related to repayment ability and collateral protection as well as reduced demand for the products and services we offer. In the recent year there has been a gradual decline in the U.S. economy as evidenced by a decline in the housing market, higher unemployment and lower prices in the equities markets; however, economic growth has been uneven, and opinions vary on the strength and direction of the economy. Uncertainties also have arisen regarding the potential for a reversal or renegotiation of international trade agreements, as the current U.S. administration has with China, the European Union and the United Kingdom. In addition, concerns about the performance of international economies, especially in Europe and emerging markets, and economic conditions in Asia, particularly the economies of China and Taiwan, can impact the economy and financial markets in the U.S. If the national, regional and local economies experience worsening economic conditions, including high levels of unemployment, our growth and profitability could be constrained. Weak economic conditions are characterized by, among other indicators, deflation, elevated levels of unemployment, fluctuations in the debt and equity capital markets, increased delinquencies on mortgage, commercial and consumer loans, residential and commercial real estate price declines, lower home sales and commercial activity, and fluctuations in the commercial and Federal Housing Administration financing sector. All of these factors are generally detrimental to our business. Our business is significantly affected by monetary and other regulatory policies of the U.S. federal government, its agencies and government-sponsored entities. Changes in any of these policies are influenced by macroeconomic conditions and other factors that are beyond our control, are difficult to predict and could have a material adverse effect on our business, financial position, results of operations and growth prospects.

In the wake of actions by government authorities and other parties to mitigate health risks associated with the COVID-19 pandemic, and fiscal and monetary policy measures used to mitigate the adverse effects of the pandemic on individual households and businesses, a number of macroeconomic challenges emerged, including, without limitation, inflation, supply chain issues and labor market disruptions.

Ongoing elevated inflation poses risk to the economy overall, and could indirectly pose challenges to our clients and to our business. Elevated inflation can impact our business customers through loss of purchasing power for their customers, leading to lower sales. Rising inflation can also increase input and inventory costs for our customers, forcing them to raise their prices or lower their profitability. Supply chain disruption, also leading to inflation, can delay our customers’ shipping ability, or timing on receiving inputs for their production or inventory. Inflation can lead to higher wages for our business customers, increasing costs. All of these inflationary risks for our business customer base can be financially detrimental, leading to increased likelihood that the customer may default on a loan. In addition, sustained inflationary pressure has led the Federal Reserve’s Federal Open Market Committee to raise interest rates rapidly, which has increased our interest rate risk. To the extent such conditions exist or worsen, we could experience adverse effects on our business, financial condition, and results of operations.

Financial markets may be adversely affected by the current or anticipated impact of military conflict, other geopolitical risk, and trade tensions. Military conflicts include military actions between Russia and Ukraine, Israel and Hamas, overall tension and conflict in the Middle East, and terrorism. Geopolitical risk is generally rising, with shipping incidents in the Red Sea causing losses and disruption to commercial shipping routes. In addition, trade tensions between the U.S. and China, the two largest global economies, increases economic uncertainty.

While customer confidence in the banking system has improved considerably since the first half of 2023, risk related to disintermediation and uninsured deposits remain, and could continue to have a material effect on the Company’s operations and/or stock price.

Several high-profile bank failures in the first half of 2023 generated significant market volatility among publicly traded bank holding companies and, in particular, regional banks. The industry has stabilized since these failures and the customer confidence in the safety and soundness of smaller regional banks has improved considerably. Nevertheless, risks remain that customers may choose to invest in higher yielding and higher-rated short-term fixed income securities or maintain deposits with larger more systematically important financial institutions, all of which could materially and adversely impact our liquidity, loan funding capacity, net interest margin, capital, and results of operations. In addition, the banking operating environments and public trading prices of banking institutions can be highly correlated, in particular during times of stress, which could adversely impact the trading prices of our common stock and potentially, our results of operations. Separately, banking regulators have announced a more stringent supervisory posture after the bank failures.

Health crises have in the past, and could in the future, materially and adversely affect our business and our customers, counterparties, employees, and third-party service providers.

Pandemics, epidemics, or other health crises, including COVID-19, have had and could have repercussions that could impact household, business, economic, and market conditions. These events have caused and could in the future, cause us to implement measures to combat such health crises, including restrictions impacting individual, including our current and potential investors and customers, and the manner in which business continues to operate. Additionally, our operations may be impacted by the need to close certain offices and limit how customers conduct business through our branch network.

Pandemics, epidemics, or other health crises could impact our business, capital, liquidity, financial position, results of operations, and business prospects due to the potential effect on our customers, employees, and third-party service providers. In addition, health crises can lead to lingering impacts on economies and markets, for example, the unprecedented extent of economic stimulus during the COVID-19 pandemic that caused and/or exacerbated inflationary pressures.

We are subject to liquidity risk, which could adversely affect our financial condition and results of operations.

Effective liquidity management is essential for the operation of our business. Although we have implemented strategies to maintain sufficient and diverse sources of funding to accommodate planned, as well as unanticipated, changes in assets, liabilities, and off-balance sheet commitments under various economic conditions, an inability to raise funds through deposits, borrowings, the sales of investment securities and other sources could have a material adverse effect on our liquidity. Our access to funding sources in amounts adequate to finance our activities could be impaired by factors that affect us specifically or the financial services industry in general. Factors that could detrimentally impact our access to liquidity sources include a decrease in the level of our business activity due to a market disruption, a decrease in the borrowing capacity assigned to our pledged assets by our secured creditors, or adverse regulatory action against us. Deterioration in economic conditions and the loss of confidence in financial institutions may increase our cost of funding and limit our access to some of our customary sources of liquidity, including, but not limited to, inter-bank borrowings and borrowings from the Federal Reserve and FHLB. Our ability to acquire deposits or borrow, and the possibility of deposit outflows, could also be impaired by various stress environments and other factors that are not specific to us, including a severe disruption of the financial markets or negative views and expectations about the prospects for the financial services industry generally as a result of conditions faced by banking organizations in the domestic and international credit markets. Other factors, for example a cybersecurity breach that is specific to us, could also impair our ability to acquire or retain deposits.

Our business depends on our ability to attract and retain Asian-American immigrants as clients.

A significant portion of our business is based on successfully attracting and retaining Asian-American immigrants as clients for both our non-qualified residential mortgage loans and deposits. We may be limited in our ability to attract Asian-American clients to the extent the U.S. adopts restrictive domestic immigration laws. Changes to U.S. immigration policies that restrain the flow of immigrants may inhibit our ability to meet our goals and budgets for non-qualified SFR mortgage loans and deposits, which may adversely affect our net interest income and net income.

Risks Related to Our Loans

Because a significant portion of our loan portfolio is comprised of real estate loans, negative changes in the economy affecting real estate values and liquidity could impair the value of collateral securing our real estate loans and result in loan and other losses.

At December 31, 2023, approximately 93.6% of our loan portfolio was comprised of loans with real estate as a primary or secondary component of collateral. Adverse developments affecting real estate values in our market areas could increase the credit risk associated with our real estate loan portfolio. The market value of real estate can fluctuate significantly in a short period of time as a result of market conditions in the area in which the real estate is located. Adverse changes affecting real estate values and the liquidity of real estate in one or more of our markets could increase the credit risk associated with our loan portfolio, significantly impair the value of property pledged as collateral on loans and affect our ability to sell the collateral upon foreclosure without a loss or additional losses, which could result in losses that would adversely affect profitability. Such declines and losses would have a material adverse impact on our business, results of operations and growth prospects. In addition, if hazardous or toxic substances are found on properties pledged as collateral, the value of the real estate could be impaired. If we foreclose on and take title to such properties, we may be liable for remediation costs, as well as for personal injury and property damage. Environmental laws may require us to incur substantial expenses to address unknown liabilities and may materially reduce the affected property’s value or limit our ability to use or sell the affected property.

Many of our loans are to commercial borrowers, which have a higher degree of risk than other types of loans.

At December 31, 2023, we had $1.5 billion of commercial loans, consisting of $1.17 billion of CRE loans, $130.1 million of C&I loans for which real estate is not the primary source of collateral and $181.5 million of C&D loans. C&I loans represented 4.3% of our total loan portfolio at December 31, 2023. Commercial loans are often larger and involve greater risks than other types of lending. Because payments on such loans are often dependent on the successful operation or development of the property or business involved, repayment of such loans is often more sensitive than other types of loans to adverse conditions in the real estate market or the general business climate and economy. Accordingly, a downturn in the real estate market and a challenging business and economic environment may increase our risk related to commercial loans, particularly commercial real estate loans. Unlike residential mortgage loans, which generally are made on the basis of the borrowers’ ability to make repayment from their employment and other income and which are secured by real property whose value tends to be more easily ascertainable, commercial loans typically are made on the basis of the borrowers’ ability to make repayment from the cash flow of the commercial venture. Our C&I loans are primarily made based on the identified cash flow of the borrower and secondarily on the collateral underlying the loans. Most often, this collateral consists of accounts receivable, inventory and equipment. Inventory and equipment may depreciate over time, may be difficult to appraise and may fluctuate in value based on the success of the business. If the cash flow from business operations is reduced, the borrower’s ability to repay the loan may be impaired. Due to the larger average size of each commercial loan as compared with other loans such as residential loans, as well as collateral that is generally less readily-marketable, losses incurred on a small number of commercial loans could have a material adverse impact on our financial condition and results of operations.

We have a concentration in commercial real estate, which could cause our regulators to restrict our ability to grow.

As a part of their regulatory oversight, the federal regulators have issued the CRE Concentration Guidance on sound risk management practices with respect to a financial institution’s concentrations in commercial real estate lending activities. These guidelines were issued in response to the agencies’ concerns that rising CRE concentrations might expose institutions to unanticipated earnings and capital volatility in the event of adverse changes in the commercial real estate market. The CRE Concentration Guidance identifies certain concentration levels that, if exceeded, will expose the institution to additional supervisory analysis with regard to the institution’s CRE concentration risk. The CRE Concentration Guidance is designed to promote appropriate levels of capital and sound loan and risk management practices for institutions with a concentration of CRE loans. In general, the CRE Concentration Guidance establishes the following supervisory criteria as preliminary indications of possible CRE concentration risk: (1) the institution’s total construction, land development and other land loans represent 100% or more of total risk-based capital; or (2) total CRE loans as defined in the regulatory guidelines represent 300% or more of total risk-based capital, and the institution’s CRE loan portfolio has increased by 50% or more during the prior 36-month period. Pursuant to the CRE Concentration Guidelines, loans secured by owner occupied commercial real estate are not included for purposes of CRE Concentration calculation. We believe that the CRE Concentration Guidance is applicable to us. As of December 31, 2023, our CRE loans represented 183% of our Bank total risk-based capital, as compared to 215% and 251% as of December 31, 2022 and 2021, respectively. We actively work to manage our CRE concentration and we have discussed the CRE Concentration Guidance with the FDIC and believe that our underwriting policies, management information systems, independent credit administration process, and monitoring of real estate loan concentrations are currently sufficient to address the CRE Concentration Guidance. Nevertheless, the FDIC could become concerned about our CRE loan concentrations, and they could limit our ability to grow by restricting their approvals for the establishment or acquisition of branches, or approvals of mergers or other acquisition opportunities.

Our SFR loan product consists primarily of non-qualified SFR mortgage loans, which may be considered less liquid and more risky.

As of December 31, 2023, our SFRmortgage loan portfolio amounted to $1.49 billion or 49.1% of our held for investment loan portfolio. As of that date, 96.7% of our SFR mortgage loans consisted of non-qualified mortgage loans, which are considered to have a higher degree of risk and are less liquid than qualified mortgage loans. We offer two SFRmortgage products, a low loan-to-value, alternative document hybrid non-qualified SFRmortgage loan, or non-qualified SFRmortgage loan, and a qualified SFRmortgage loan. As of December 31, 2023, our non-qualified SFRmortgage loans had an average loan-to-value of 57.3% and an average FICO score of 763. As of December 31, 2023, 3.3% of our total SFRmortgage loan portfolio were loans originated to foreign nationals. The non-qualified single-family residential mortgage loans that we originate are designed to assist Asian-Americans who have recently immigrated to the United States and as such are willing to provide higher down payment amounts and pay higher interest rates and fees in return for reduced documentation requirements. Non-qualified SFRmortgage loans are considered less liquid than qualified SFRmortgage loans because such loans are not able to be securitized and can only be sold directly to other financial institutions. Such non-qualified loans may be considered more risky than qualified mortgage loans although we attempt to address this enhanced risk through our underwriting process, including requiring larger down payments and, in some cases, interest reserves.

We also have a concentration in our SFRsecondary sale market, as a substantial portion of our non-qualified mortgage loans have been historically sold to two banks; although, we are currently selling SFR mortgage loans to three banks. Although, we are taking steps to reduce our dependence on these banks by expanding the number of banks that we sell our non-qualified SFRmortgages to, we may not be successful expanding our sales market for our non-qualified mortgage loans. These loans also present pricing risk as rates change, and our sale premiums cannot be guaranteed. Further, the criteria for our loans to be purchased by other banks may change from time to time, which could result in a lower volume of corresponding loan originations.

Mortgage production historically, including refinancing activity, declines in rising interest rate environments such as the current environment in which we have experienced increasing rates over the last year.

We originated $11.4 million of SBA loans for the year ended December 31, 2023. We sold $4.1 million of the guaranteed portion of our SBA loans for the year ended December 31, 2023. Consequently, as of December 31, 2023, we held $52.1 million of SBA loans on our balance sheet, $47.4 million of which consisted of the non-guaranteed portion of SBA loans and $4.7 million or 8.9% consisted of the guaranteed portion of SBA loans. The non-guaranteed portion of SBA loans have a higher degree of credit risk and risk of loss as compared to the guaranteed portion of such loans. We attempt to limit this risk by generally requiring such loans to be collateralized and limiting the overall amount that can be held on our balance sheet to 75% of our total capital.

When we sell the guaranteed portion of SBA loans in the ordinary course of business, we are required to make certain representations and warranties to the purchaser about the SBA loan and the manner in which they were originated. Under these agreements, we may be required to repurchase the guaranteed portion of the SBA loan if we have breached any of these representations or warranties, in which case we may record a loss. In addition, if repurchase and indemnity demands increase on loans that we sell from our portfolios, our liquidity, results of operations and financial condition could be adversely affected. Further, we generally retain the non-guaranteed portions of the SBA loans that we originate and sell, and to the extent the borrowers of such loans experience financial difficulties, our financial condition and results of operations could be adversely impacted.

Curtailment of government guaranteed loan programs could affect a segment of our business.

A significant segment of our business consists of originating and periodically selling U.S. government guaranteed loans, in particular those guaranteed by the SBA. Presently, the SBA guarantees 75% of the principal amount of each qualifying SBA loan originated under the SBA’s 7(a) loan program. There is no assurance that the U.S. government will maintain the SBA 7(a) loan program or if it does, that such guaranteed portion will remain at its current level. In addition, from time to time, the government agencies that guarantee these loans reach their internal limits and cease to guarantee future loans. In addition, these agencies may change their rules for qualifying loans or Congress may adopt legislation that would have the effect of discontinuing or changing the loan guarantee programs. Non-governmental programs could replace government programs for some borrowers, but the terms might not be equally acceptable. Therefore, if these changes occur, the volume of loans to small business, industrial and agricultural borrowers of the types that now qualify for government guaranteed loans could decline. Also, the profitability associated with the sale of the guaranteed portion of these loans could decline as a result of market displacements due to increases in interest rates, and could cause the premiums realized on the sale of the guaranteed portions to decline from current levels. As the funding and sale of the guaranteed portion of SBA 7(a) loans is a major portion of our business and a significant portion of our noninterest income, any significant changes to the funding for the SBA 7(a) loan program may have an unfavorable impact on our prospects, future performance and results of operations.

Real estate construction loans are based upon estimates of costs and values associated with the complete project. These estimates may be inaccurate, and we may be exposed to significant losses on loans for these projects.

Real estate construction loans, including land development loans, comprised approximately 6.0% of our total loan portfolio as of December 31, 2023, and such lending involves additional risks because funds are advanced upon the security of the project, which is of uncertain value prior to its completion, and costs may exceed realizable values in declining real estate markets. Because of the uncertainties inherent in estimating construction costs and the realizable market value of the completed project and the effects of governmental regulation of real property, it is relatively difficult to evaluate accurately the total funds required to complete a project and the related loan-to-value ratio. As a result, construction loans often involve the disbursement of substantial funds with repayment dependent, in part, on the success of the ultimate project and the ability of the borrower to sell or lease the property, rather than the ability of the borrower or guarantor to repay principal and interest. If our appraisal of the value of the completed project proves to be overstated or market values or rental rates decline, we may have inadequate security for the repayment of the loan upon completion of construction of the project. If we are forced to foreclose on a project prior to or at completion due to a default, we may not be able to recover all of the unpaid balance of, and accrued interest on, the loan as well as related foreclosure and holding costs. In addition, we may be required to fund additional amounts to complete the project and may have to hold the property for an unspecified period of time while we attempt to dispose of it.

The risks inherent in construction lending may affect adversely our results of operations. Such risks include, among other things, the possibility that contractors may fail to complete, or complete on a timely basis, construction of the relevant properties; substantial cost overruns in excess of original estimates and financing; market deterioration during construction; and lack of permanent take-out financing. Loans secured by such properties also involve additional risk because they have no operating history. In these loans, loan funds are advanced upon the security of the project under construction (which is of uncertain value prior to completion of construction) and the estimated operating cash flow to be generated by the completed project. Such properties may not be sold or leased so as to generate the cash flow anticipated by the borrower. A general decline in real estate sales and prices across the United States or locally in the relevant real estate market, a decline in demand for residential real estate, economic weakness, higher interest rates, high rates of unemployment, and reduced availability of mortgage credit, are some of the factors that can adversely affect the borrowers’ ability to repay their obligations to us and the value of our security interest in collateral, and thereby adversely affect our results of operations and financial results.

Nonperforming assets take significant time to resolve and adversely affect our results of operations and financial condition, and could result in further losses in the future.

As of December 31, 2023, our nonperforming loans (which consist of nonaccrual loans and modified loans) totaled $31.6 million, or 1.04%, of our held for investment (HFI) loan portfolio, and our nonperforming assets totaled $31.6 million, or 0.79%, of total assets. In addition, we had $16.8 million in accruing loans that were 30-89 days delinquent as of December 31, 2023.

Our nonperforming assets (which consist of nonperforming loans and other real estate owned) adversely affect our net income in various ways. We do not record interest income on nonaccrual loans or OREO, thereby adversely affecting our net income and returns on assets and equity, increasing our loan administration costs and adversely affecting our efficiency ratio. When we take collateral in foreclosure and similar proceedings, we are required to mark the collateral to its then-fair market value, which may result in a loss. These nonperforming loans and other real estate owned also increase our risk profile and the level of capital our regulators believe is appropriate for us to maintain in light of such risks. The resolution of nonperforming assets requires significant time commitments from management and can be detrimental to the performance of their other responsibilities. If we experience increases in nonperforming loans and nonperforming assets, our net interest income may be negatively impacted and our loan administration costs could increase, each of which could have an adverse effect on our net income and related ratios, such as return on assets and equity.

Adverse conditions in Asia and elsewhere could adversely affect our business.

We are likely to feel the effects of adverse economic and political conditions in Asia, including the effects of rising inflation or slowing growth and volatility in the real estate and stock markets in China and other regions. U.S. and global economic policies, military tensions, and unfavorable global economic conditions may adversely impact the Asian economies. In addition, pandemics and other public health crises or concerns over the possibility of such crises could create economic and financial disruptions in the region. A significant deterioration of economic conditions in Asia could expose us to, among other things, economic and transfer risk, and we could experience an outflow of deposits by those of our customers with connections to Asia. Transfer risk may result when an entity is unable to obtain the foreign exchange needed to meet its obligations or to provide liquidity. This may adversely impact the recoverability of investments with, or loans made to, such entities. Adverse economic conditions in Asia, and in China or Taiwan in particular, may also negatively impact asset values and the profitability and liquidity of our customers who operate in this region.

The Bank is a California state chartered bank with operations in California, Hawaii, Illinois, New York, New Jersey, and Nevada. We have no overseas operations, including in China and the Far East.

Risks Related to Our Deposits

Our deposit portfolio includes significant concentrations and a large percentage of our deposits are attributable to a relatively small number of clients.

As a commercial bank, we provide services to a number of clients whose deposit levels vary considerably and have a significant amount of seasonality. At December 31, 2023, 148 clients maintained balances (aggregating all related accounts, including multiple business entities and personal funds of business owners) in excess of $2.0 million per client. This amounted to $844.4 million, or approximately 26.6%, of the Bank’s total deposits as of December 31, 2023. In addition, our ten largest depositor relationships accounted for approximately 7.8% of our deposits at December 31, 2023. Our largest depositor relationship accounted for approximately 1.4% of our deposits at December 31, 2023. These deposits can and do fluctuate substantially. The loss of any combination of these depositors, or a significant decline in the deposit balances due to ordinary course fluctuations related to these customers’ businesses, would adversely affect our liquidity and require us to raise deposit rates to attract new deposits, purchase federal funds or borrow funds on a short-term basis to replace such deposits. Depending on the interest rate environment and competitive factors, low cost deposits may need to be replaced with higher cost funding, resulting in a decrease in net interest income and net income. During 2023, noninterest-bearing deposits decreased by $259.1 million due to the Bank's customers pursuing higher rates offered by the Bank's time deposits, interest-bearing non-maturity deposits increased by $17.4 million, and time deposits increased by $438.8 million. While these events could have a material impact on the Bank’s results, the Bank expects, in the ordinary course of business, that these deposits will fluctuate and believes it is capable of mitigating this risk, as well as the risk of losing one of these depositors, through additional liquidity, and business generation in the future. However, should a significant number of these customers leave the Bank, it could have a material adverse impact on the Bank.

Risk Related to our Allowance for Credit Losses (“ACL”)

If we do not effectively manage our credit risk, we may experience increased levels of delinquencies, nonperforming loans and charge-offs, which could require increases in our provision for loan losses.

As of January 1, 2022, we adopted ASU 2016-13 (Topic 326), “Measurement of Credit Losses on Financial Instruments,” commonly referenced as the CECL model, which changes how we estimate credit losses and increased the required level of our ACL. There are risks inherent in making any loan, including risks inherent in dealing with individual borrowers, risks of nonpayment, risks resulting from uncertainties as to the future value of collateral and cash flows available to service debt and risks resulting from changes in economic and market conditions. We cannot guarantee that our credit underwriting and monitoring procedures will reduce these credit risks, and they cannot be expected to completely eliminate our credit risks. If the overall economic climate in the U.S., generally, or our market areas, specifically, declines, our borrowers may experience difficulties in repaying their loans, and the level of nonperforming loans, charge-offs and delinquencies could rise and require further increases in the provision for loan losses, which would cause our net income, return on equity and capital to decrease.

Our ACL may prove to be insufficient to absorb potential credit losses in our loan portfolio.

We establish our ACL and maintain it at a level that management considers adequate to absorb expected credit losses based on an analysis of our portfolio and market environment. The ACL represents our estimate of expected credit losses in the portfolio at each balance sheet date and is based upon relevant information available to us. The allowance contains provisions for expected credit losses that have been identified relating to specific borrowing relationships, as well as expected credit losses inherent in the loan portfolio and credit undertakings that are not specifically identified. Additions to the ACL, which are charged to earnings through the provision for credit losses, are determined based on a variety of factors, including an analysis of the loan portfolio, historical loss experience, reasonable and supportable forecasts and an evaluation of current economic conditions in our market areas. The actual amount of credit losses is affected by changes in economic, operating and other conditions within our markets, which may be beyond our control, and such losses may exceed current estimates.

We estimate credit losses using the CECL model, which incorporates the use of and is more reliant on reasonable and supportable forecasts of economic conditions, including, but not limited to: forecasts of GDP growth rates, levels of unemployment, vacancy rates, and changes in the value of commercial real estate properties. Because the CECL methodology is more dependent on future economic forecasts, assumptions, and models than the previous accounting standards, it may result in increases and add volatility to our ACL and future provisions for loan losses. The forecasts, assumptions, and models required by CECL are based upon third-party forecasts, subject to management’s review and adjustment in light of information currently available.

As of December 31, 2023, our ACL as a percentage of total loans was 1.38% and as a percentage of total nonperforming loans was 132.5%. Although management believes that the ACL is adequate to absorb losses on any existing loans that may become uncollectible, we may be required to take additional provisions for credit losses in the future to further supplement the ACL, either due to management’s decision to do so or because our banking regulators require us to do so. Our bank regulatory agencies will periodically review our ACL and the value attributed to nonaccrual loans or to real estate acquired through foreclosure and may require us to adjust our determination of the value for these items. These adjustments may adversely affect our business, financial condition and results of operations.

Risks Related to our Acquisition Strategy

Our strategy of pursuing growth via acquisitions exposes us to financial, execution and operational risks that could have a material adverse effect on our business, financial position, results of operations and growth prospects.

Since late 2010, we have been pursuing a strategy of leveraging our human and financial capital by acquiring other financial institutions in our target markets. We have completed several acquisitions in recent years and we may continue pursuing this strategy.

Our acquisition activities could require us to use a substantial amount of cash, other liquid assets, and/or incur debt. In addition, if goodwill recorded in connection with our potential future acquisitions were determined to be impaired, then we would be required to recognize a charge against our earnings, which could materially and adversely affect our results of operations during the period in which the impairment was recognized.

There are risks associated with an acquisition strategy, including the following:

In addition to the foregoing, we may face additional risks in acquisitions to the extent we acquire new lines of business or new products, or enter new geographic areas, in which we have little or no current experience, especially if we lose key employees of the acquired operations. Future acquisitions or business combinations also could cause us to incur debt or contingent liabilities or cause us to issue equity securities. These actions could negatively impact the ownership percentages of our existing shareholders, our financial condition and results of operations. In addition, we may not find candidates which meet our criteria for such transactions, and if we do find such a situation, our shareholders may not agree with the terms of such acquisition or business relationship.

In addition, our ability to grow may be limited if we cannot make acquisitions. We compete with other financial institutions with respect to proposed acquisitions. We cannot predict if or when we will be able to identify and attract acquisition candidates or make acquisitions on favorable terms.

We cannot assure you that we will be successful in overcoming these risks or any other problems encountered in connection with acquisitions. Our inability to overcome risks associated with acquisitions could have an adverse effect on our ability to successfully implement our acquisition growth strategy and grow our business and profitability.

If the goodwill that we recorded in connection with a business acquisition becomes impaired, it could require charges to earnings, which would have a negative impact on our financial condition and results of operations.

Goodwill represents the amount by which the cost of an acquisition exceeded the fair value of net assets we acquired in connection with the purchase. We review goodwill for impairment at least annually, or more frequently if events or changes in circumstances indicate that the carrying value of the asset might be impaired.

We determine impairment by comparing the implied fair value of the reporting unit goodwill with the carrying amount of that goodwill. If the carrying amount of the reporting unit goodwill exceeds the implied fair value of that goodwill, an impairment loss is recognized in an amount equal to that excess. Any such adjustments are reflected in our results of operations in the periods in which they become known. As of December 31, 2023, our goodwill totaled $71.5 million. We evaluated our goodwill and core deposit intangibles in the fourth quarter of 2022 and the third and fourth quarter of 2023. The impairment evaluation did not identify an impairment of goodwill or the core deposit intangibles in those quarters of 2022 and 2023. There can be no assurance that our future evaluations of goodwill will not result in findings of impairment and related write-downs, which may have a material adverse effect on our financial condition and results of operations.

We may not be able to continue growing our business, particularly if we cannot make acquisitions or increase loans and deposits through organic growth, either because of an inability to find suitable acquisition candidates, constrained capital resources or otherwise.

We have grown our consolidated assets from $300.5 million as of December 31, 2010 to $4.0 billion as of December 31, 2023, and our deposits from $236.4 million as of December 31, 2010 to $3.2 billion as of December 31, 2023. Some of this growth has resulted from several acquisitions that we have completed since 2010. While we intend to continue to grow our business through strategic acquisitions coupled with organic loan and deposit growth, we anticipate that much of our future growth will be dependent on our ability to successfully implement our acquisition growth strategy. A risk exists, however, that we will not be able to identify suitable additional candidates for acquisitions.

In addition, even if suitable targets are identified, we expect to compete for such businesses with other potential bidders, many of which may have greater financial resources than we have, which may adversely affect our ability to make acquisitions at attractive prices. Although we have historically been disciplined in pricing our acquisitions, there can be no assurance that the higher multiples being paid in bank acquisitions will not adversely impact our ability to execute acquisitions in the future or adversely affect the return we earn from such acquisitions.

Furthermore, many acquisitions we may wish to pursue would be subject to approvals by bank regulatory authorities, and we cannot predict whether any targeted acquisitions will receive the required regulatory approvals. Moreover, our ability to continue to grow successfully will depend to a significant extent on our capital resources. It also will depend, in part, upon our ability to attract deposits and lessen our dependence on larger deposit accounts, identify favorable loan and investment opportunities and on whether we can continue to fund growth while maintaining cost controls and asset quality, as well on other factors beyond our control, such as national, regional and local economic conditions and interest rate trends.

As we expand our business outside of California markets, we may encounter risks that could adversely affect us.

We primarily operate in California, New York, New Jersey and Illinois markets with a concentration of Asian-American individuals and businesses; however, one of our strategies is to expand beyond California into other domestic markets that have concentrations of Asian-American individuals and businesses. We also currently have operations in Las Vegas, Nevada and Honolulu, Hawaii, including operating a branch office, and would consider strategic opportunities for additional branch expansion. In the course of any expansion, we may encounter significant risks and uncertainties that could have a material adverse effect on our operations. These risks and uncertainties include increased expenses and operational difficulties arising from, among other things, our ability to attract sufficient business in new markets, to manage operations in noncontiguous market areas, to comply with all of the various local laws and regulations, and to anticipate events or differences in markets in which we have no current experience.

Other Risks Related to Our Business

If we fail to maintain effective internal control over financial reporting, or if we fail to remediate material weaknesses previously identified, we may not be able to report our financial results accurately and timely.

Our management is responsible for establishing and maintaining adequate internal control over financial reporting and for evaluating and reporting on that system of internal control. In the past, material weaknesses have been identified in our internal controls over financial reporting. A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our financial statements will not be prevented or detected on a timely basis. Following identification of the material weaknesses, we implemented a number of controls and procedures designed to improve our control environment, which we believe will be sufficient to remediate our previously identified material weakness.Our actions to maintain effective controls and remedy any weakness or deficiency may not be sufficient to result in an effective internal control environment and any future failure to maintain effective internal control over financial reporting could impair the reliability of our financial statements, which in turn could harm our business, impair investor confidence in the accuracy and completeness of our financial reports, impair our access to the capital markets, cause the price of our common stock to decline and subject us to increased regulatory scrutiny and/or penalties, and higher risk of shareholder litigation.

The Bank is operating under enhanced regulatory supervision that could materially and adversely affect our business.

As previously disclosed in the Company's Current Report on Form 8-K filed with the SEC on October 31, 2023, effective on October 25, 2023, the Bank entered into a Stipulation to the Issuance of a Consent Order with its bank regulatory agencies, the FDIC and DFPI, consenting to the issuance of a consent order (the “Consent Order”) relating to weaknesses in the Bank’s Anti-Money Laundering/Countering the Financing of Terrorism (“AML/CFT”) compliance program.

Under the terms of the Consent Order, the Bank is required to make certain enhancements and take certain actions, which include, but are not limited to: (i) enhancing personnel with oversight responsibilities with respect to the Bank’s AML/CFT compliance program, (ii) enhancing existing AML/CFT policies and practices, internal controls, customer due diligence, and training programs, and (iii) establishing an independent testing program to analyze and assess the Bank’s BSA Department. The Consent Order also requires the Bank to correct certain alleged violations of the AML/CFT compliance program, including internal controls, staffing and the timing of the filing of one suspicious activity report.

If the Bank fails to timely and satisfactorily comply with the Consent Order, the Bank may be required to incur additional expenses in order to comply with the Consent Order and may be subject to additional regulatory action, including civil money penalties against the Bank and its officers and directors or enforcement of the Consent Order through court proceedings. These additional expenses or regulatory actions, including penalties and legal expenses, could have a material and adverse effect on our business, results of operations, financial condition, cash flows and stock price.

We are exposed to risks related to fraud and cyber-attacks.

The Company is continuously enhancing and expanding our digital products and services to meet client and business needs with desired outcomes. These digital products and services often include storing, transmitting, and processing confidential client, employee, monetary, and business information. Due to the nature of this information, and the value it has for internal and external threat actors, we, and our third-party service providers, continue to be subject to cyber-attacks and fraud activity that attempts to gain unauthorized access, misuse information and information systems, steal information, disrupt or degrade information systems, spread malicious software, and other illegal activities.

We believe we have robust preventive, detective, and administrative safeguards and security controls to minimize the probability and magnitude of a material event. However, because the tactics and techniques used by threat actors to bypass safeguards and security controls change frequently, and often are not recognized until after an event has occurred, we may be unable to anticipate future tactics and techniques, or to implement adequate and timely protective measures.

Cybersecurity, and the continued development and enhancement of controls, processes, and practices designed to protect client information, systems, computers, software, data, and networks from attack, damage, or unauthorized access remain a priority for the Company. As cybersecurity threats continue to evolve, we may be required to expend additional resources to continue to enhance, modify, and refine our protective measures against these evolving threats.

To date, we have no knowledge of a successful cyber-attack or other material information security breach affecting our systems. However, our risk and exposure to these matters remains heightened because of, among other things, the evolving nature of these threats, the continuation of a remote work environment for our employees and service providers and our plans to continue to implement and expand digital banking services, expand operations, and use third-party information systems that includes cloud-based infrastructure, platforms, and software. Recent instances of attacks specifically targeting financial services businesses indicate that the risk to our systems remains significant. If we or a critical third party vendor were to experience a cyber-attack or information security breach, we could suffer damage to our reputation, productivity losses, response costs associated with investigation and resumption of services, and incur substantial additional expenses, including remediation expenses costs associated with client notification and credit monitoring services, increased insurance premiums, regulatory penalties and fines, and costs associated civil litigation, any of which could have a materially adverse effect on our business, financial condition, and results of operations.

In addition, the Company’s clients and vendors rely on technology and systems unmanaged by the Company, such as networking devices, server infrastructure, personal computers, smartphones, tablets, and other mobile devices, to contact and conduct business with the Company. If the devices of the Company’s clients or vendors become the target of a cyber-attack, or information security breach, it could result in unauthorized access to, misuse of, or loss of confidential client, employee, monetary, or business information. Threat actors using improperly obtained personal or financial information of consumers can attempt to obtain loans, lines of credit, or other financial products from the Company, or attempt to fraudulently persuade the Company’s employees, clients, or other users of the Company’s systems to disclose confidential information in order to gain improper access to the Company’s information and information systems.

We also face additional costs when our customers become the victims of cyber-attacks. For example, various retailers have reported that they have been the victims of a cyber-attack in which large amounts of their clients’ data, including debit and credit card information, is obtained. Our clients may be the victims of phishing scams, providing cyber criminals access to their accounts, or credit or debit card information. In these situations, we incur costs to replace compromised cards and address fraudulent transaction activity affecting our clients.

Both internal and external fraud and theft are risks. If confidential client, employee, monetary, or business information were to be mishandled or misused, we could suffer significant regulatory consequences, reputational damage, and financial loss. Such mishandling or misuse could include, for example, if such information were erroneously provided to parties who are not permitted to have the information, either by fault of our systems, employees, or counterparties, or if such information were to be intercepted or otherwise inappropriately taken by third parties, or if our own employees abused their access to financial systems to commit fraud against our clients and the Company. These activities can occur in connection with the origination of loans and lines of credit, ACH transactions, wire transactions, ATM transactions, and checking transactions, and result in financial losses as well as reputational damage.

Operational errors can include information system misconfiguration, clerical or record-keeping errors, or disruptions from faulty or disabled computer or telecommunications systems. Because the nature of the financial services business involves a high volume of transactions, certain errors may be repeated or compounded before they are discovered and successfully rectified. Because of the Company’s large transaction volume and its necessary dependence upon automated systems to record and process these transactions, there is a risk that technical flaws, tampering, or manipulation of those automated systems, arising from events wholly or partially beyond its control, may give rise to disruption of service to customers and to financial loss or liability. We are exposed to the risk that our business continuity and data security systems prove to be inadequate.

The occurrence of any of these risks could result in a diminished ability for us to operate our business, additional costs to correct defects, potential liability to clients, reputational intervention, any of which could adversely affect our business, financial condition and results of operations.

Liabilities from environmental regulations could materially and adversely affect our business and financial condition.

In the course of our business, we may foreclose and take title to real estate, and could be subject to environmental liabilities with respect to these properties. We may be held liable to a governmental entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination, or may be required to investigate or clear up hazardous or toxic substances, or chemical releases at a property. The costs associated with investigation or remediation activities could be substantial. In addition, as the owner or former owner of any contaminated site, we may be subject to common law claims by third parties based on damages, and costs resulting from environmental contamination emanating from the property. If we ever become subject to significant environmental liabilities, our business, financial condition, liquidity, and results of operations could be materially and adversely affected.

A natural or man-made disaster or recurring energy shortage in our geographic markets, especially in California, could harm our business.

We are based in California and at December 31, 2023, approximately 50.5% of the aggregate outstanding principal of our total loan portfolio was secured by real estate located in California or business in California. In addition, the computer systems that operate our Internet websites and some of their back-up systems are located in California. Historically, California has been vulnerable to natural disasters. Therefore, we are susceptible to the risks of natural disasters, such as earthquakes, wildfires, floods and mudslides. Certain of these natural disasters may be exacerbated by climate change. Natural or man-made disasters and recurring energy shortages could harm our operations directly through interference with communications, including the interruption or loss of our information technology structure and websites, which could prevent us from gathering deposits, originating loans and processing and controlling our flow of business, as well as through the destruction of facilities and our operational, financial and management information systems. A natural or man-made disaster or recurring power outages may also impair the value of our largest class of assets, our loan portfolio, which is comprised substantially of real estate loans. Uninsured or underinsured disasters may reduce borrowers’ ability to repay mortgage loans. Disasters may also reduce the value of the real estate securing our loans, impairing our ability to recover on defaulted loans through foreclosure and making it more likely that we would suffer losses on defaulted loans. California has also experienced energy shortages, which, if they recur, could impair the value of the real estate in those areas affected. Although we have implemented several back-up systems and protections (and maintain business interruption insurance), these measures may not protect us fully from the effects of a natural disaster. The occurrence of natural and man-made disasters or energy shortages in California could have a material adverse effect on our business prospects, financial condition and results of operations.

Climate change could have a material negative impact on the Company and clients.

The Company’s business, as well as the operations and activities of our clients, could be negatively impacted by climate change. Climate change presents both immediate and long-term risks to the Company and its clients, and these risks are expected to increase over time. Climate change presents multi-faceted risks, including: operational risk from the physical effects of climate events on the Company and its clients’ facilities and other assets; credit risk from borrowers with significant exposure to climate risk; transition risks associated with the transition to a less carbon- dependent economy; and reputational risk from stakeholder concerns about our practices related to climate change, the Company’s carbon footprint, and the Company’s business relationships with clients who operate in carbon-intensive industries.

Federal and state banking regulators and supervisory authorities, investors, and other stakeholders have increasingly viewed financial institutions as important in helping to address the risks related to climate change both directly and with respect to their clients, which may result in financial institutions coming under increased pressure regarding the disclosure and management of their climate risks and related lending and investment activities. Given that climate change could impose systemic risks upon the financial sector, either via disruptions in economic activity resulting from the physical impacts of climate change or changes in policies as the economy transitions to a less carbon-intensive environment, the Company may face regulatory risk of increasing focus on the Company’s resilience to climate-related risks, including in the context of stress testing for various climate stress scenarios. Ongoing legislative or regulatory uncertainties and changes regarding climate risk management and practices may result in higher regulatory, compliance, credit, and reputational risks and costs.

With the increased importance and focus on climate change, we are making efforts to enhance our governance of climate change-related risks and integrate climate considerations into our risk governance framework. Nonetheless, the risks associated with climate change are rapidly changing and evolving in an escalating fashion, making them difficult to assess due to limited data and other uncertainties. We could experience increased expenses resulting from strategic planning, litigation, and technology and market changes, and reputational harm as a result of negative public sentiment, regulatory scrutiny, and reduced investor and stakeholder confidence due to our response to climate change and our climate change strategy, which, in turn, could have a material negative impact on our business, results of operations, and financial condition.

We face strong competition from financial services companies and other companies that offer banking and mortgage banking services, which could harm our business.

Our operations consist of offering banking and mortgage banking services to generate both interest and noninterest income. Many of our competitors offer the same, or a wider variety of, banking and related financial services within our market areas. These competitors include national banks, regional banks and other community banks. We also face competition from many other types of financial institutions, including savings and loan institutions, finance companies, brokerage firms, insurance companies, credit unions, mortgage banks and other financial intermediaries. In addition, a number of out-of-state financial intermediaries have opened production offices or otherwise solicit deposits in our market areas. Additionally, we face growing competition from so-called “online businesses” with few or no physical locations, including online banks, lenders and consumer and commercial lending platforms, as well as automated retirement and investment service providers. Increased competition in our markets may result in reduced loans, deposits and commissions and brokers’ fees, as well as reduced net interest margin and profitability. Ultimately, we may not be able to compete successfully against current and future competitors. If we are unable to attract and retain banking and mortgage loan customers and expand our sales market for such loans, we may be unable to continue to grow our business, and our financial condition and results of operations may be adversely affected.

Legislative and regulatory actions taken now or in the future may increase our costs and impact our business, governance structure, financial condition or results of operations.

Our operations are subject to extensive regulation by federal, state and local governmental authorities and are subject to various laws and judicial and administrative decisions imposing requirements and restrictions on part or all of our operations. Federal and state banking regulators have significant discretion and authority to prevent or remedy unsafe or unsound practices or violations of laws or regulations by financial institutions and bank holding companies in the performance of their supervisory and enforcement duties. The exercise of regulatory authority may have a negative impact on our financial condition and results of operations. Additionally, in order to conduct certain activities, including acquisitions, we are required to obtain regulatory approval. There can be no assurance that any required approvals can be obtained, or obtained without conditions or on a timeframe acceptable to us.

In addition, other new proposals for legislation continue to be introduced in the U.S. Congress that could further substantially increase regulation of the bank and non-bank financial services industries and impose restrictions on the operations and general ability of firms within the industry to conduct business consistent with historical practices. Federal and state regulatory agencies also frequently adopt changes to their regulations or change the manner in which existing regulations are applied. Certain aspects of current or proposed regulatory or legislative changes to laws applicable to the financial industry, if enacted or adopted, may impact the profitability of our business activities, require more oversight or change certain of our business practices, including the ability to offer new products, obtain financing, attract deposits, make loans and achieve satisfactory interest spreads and could expose us to additional costs, including increased compliance costs. These changes also may require us to invest significant management attention and resources to make any necessary changes to operations to comply and could have an adverse effect on our business, financial condition and results of operations.

Our use of third party vendors and our other ongoing third party business relationships are subject to increasing regulatory requirements and attention.

We regularly use third party vendors as part of our business. We also have substantial ongoing business relationships with other third parties. These types of third party relationships are subject to increasingly demanding regulatory requirements and attention by our federal bank regulators. Recent regulation requires us to enhance our due diligence, ongoing monitoring and control over our third party vendors and other ongoing third party business relationships. In certain cases we may be required to renegotiate our agreements with these vendors to meet these enhanced requirements, which could increase our costs. We expect that our regulators will hold us responsible for deficiencies in our oversight and control of our third party relationships and in the performance of the parties with which we have these relationships. As a result, if our regulators conclude that we have not exercised adequate oversight and control over our third party vendors or other ongoing third party business relationships or that such third parties have not performed appropriately, we could be subject to enforcement actions, including civil money penalties or other administrative or judicial penalties or fines as well as requirements for customer remediation, any of which could have a material adverse effect our business, financial condition or results of operations.

Risks Related to an Investment in Our Common Stock

The price of our common stock may fluctuate significantly, and this may make it difficult for you to sell shares of common stock owned by you at times or at prices you find attractive.

The trading price of our common stock may fluctuate widely as a result of a number of factors, many of which are outside our control. In addition, the stock market is subject to fluctuations in the share prices and trading volumes that affect the market prices of the shares of many companies. These broad market fluctuations could adversely affect the market price of our common stock. Among the factors that could affect our stock price are: 

The stock market and, in particular, the market for financial institution stocks, has experienced significant volatility. As a result, the market price of our common stock may be volatile. In addition, the trading volume in our common stock may fluctuate more than usual and cause significant price variations to occur. The trading price of the shares of our common stock and the value of our other securities will depend on many factors, which may change from time to time, including, without limitation, our financial condition, performance, creditworthiness and prospects, future sales of our equity or equity related securities, and other factors identified above in “Forward-Looking Statements,” and in this Item 1A — “Risk Factors.” The capital and credit markets can experience volatility and disruption. Such volatility and disruption can reach unprecedented levels, resulting in downward pressure on stock prices and credit availability for certain issuers without regard to their underlying financial strength. A significant decline in our stock price could result in substantial losses for individual stockholders and could lead to costly and disruptive securities litigation.

Our dividend policy may change.

We have paid quarterly dividends since our initial public offering in the third quarter of 2017. We paid $0.51 per share in 2021, $0.56 per share in 2022 and $0.64 per share in 2023. We have no obligation to pay dividends and we may change our dividend policy at any time without notice to our shareholders. Holders of our common stock are only entitled to receive such cash dividends as our board of directors, in its discretion, may declare out of funds legally available for such payments. Furthermore, consistent with our strategic plans, growth initiatives, capital availability and requirements, projected liquidity needs, financial condition, and other factors, we have made, and will continue to make, capital management decisions and policies that could adversely impact the amount of dividends paid to our common shareholders.

We are a separate and distinct legal entity from our subsidiaries, including the Bank. We receive substantially all of our revenue from dividends from the Bank and RAM, which we use as the principal source of funds to pay our expenses. Various federal and/or state laws and regulations limit the amount of dividends that the Bank and certain of our non-bank subsidiaries may pay us. Such limits are also tied to the earnings of our subsidiaries. If the Bank does not receive regulatory approval or if our subsidiaries’ earnings are not sufficient to make dividend payments to us while maintaining adequate capital levels, our ability to pay our expenses and our business, financial condition or results of operations could be materially and adversely impacted.

Shares of certain shareholders may be sold into the public market in the near future. This could cause the market price of our common stock to decline.

We have outstanding options to purchase 397,903 shares of our common stock as of December 31, 2023 that may be exercised and sold (assuming all vesting requirements are met), and we have the ability to issue options exercisable for up to an additional 1,032,173 shares of common stock pursuant to our 2017 Omnibus Stock Incentive Plan. The sale of any of such shares could cause the market price of our stock to decline, and concerns that those sales may occur could cause the trading price of our common stock to decrease or to be lower than it might otherwise be.

Our business and financial results could be impacted materially by adverse results in legal proceedings.

Various aspects of our operations involve the risk of legal liability. We have been, and expect to continue to be, named or threatened to be named as defendants in legal proceedings arising from our business activities. We establish accruals for legal proceedings when information related to the loss contingencies represented by those proceedings indicates both that a loss is probable and that the amount of the loss can be reasonably estimated, but we do not have accruals for all legal proceedings where we face a risk of loss. In addition, amounts accrued may not represent the ultimate loss to us from those legal proceedings. Thus, our ultimate losses may be higher or lower, and possibly significantly so, than the amounts accrued for loss contingencies arising from legal proceedings, and these losses could have a material and adverse effect on our business, financial condition, results of operations and the value of our common stock. 

Future equity issuances could result in dilution, which could cause our common stock price to decline.

We are generally not restricted from issuing additional shares of our common stock, up to the 100 million shares of common stock and 100 million shares of preferred stock authorized in our articles of incorporation, which in each case could be increased by a vote of a majority of our shares. We may issue additional shares of our common stock in the future pursuant to current or future equity compensation plans, upon conversions of preferred stock or debt, upon exercise of warrants or in connection with future acquisitions or financings. If we choose to raise capital by selling shares of our common stock for any reason, the issuance would have a dilutive effect on the holders of our common stock and could have a material negative effect on the market price of our common stock.

Provisions in our charter documents and California law may have an anti-takeover effect, and there are substantial regulatory limitations on changes of control of bank holding companies.

Provisions of our charter documents and the California General Corporation Law (“CGCL”) could make it more difficult for a third party to acquire us, even if doing so would be perceived to be beneficial by our shareholders. Furthermore, with certain limited exceptions, federal regulations prohibit a person or company or a group of persons deemed to be “acting in concert” from, directly or indirectly, acquiring more than 10% (5% if the acquirer is a bank holding company) of any class of our voting stock or obtaining the ability to control in any manner the election of a majority of our directors or otherwise direct the management or policies of our company without prior notice or application to and the approval of the Federal Reserve. Accordingly, prospective investors need to be aware of and comply with these requirements, if applicable, in connection with any purchase of shares of our common stock. Moreover, the combination of these provisions effectively inhibits certain mergers or other business combinations, which, in turn, could adversely affect the market price of our common stock.

Item 1B. Unresolved Staff Comments.

None.

Item 1C. Cybersecurity.

Cybersecurity threats continue to evolve as the threat landscape evolves. The Bank continuously works to evolve its cybersecurity practices with the changing landscape. Significant resources are devoted to protecting and enhancing the security of networks, computer systems, data storage devices, and other systems and technology. The Bank’s security efforts and implemented controls are designed to protect against, among other things, cybersecurity attacks that can result in unauthorized access to confidential information, the destruction of data, disruptions to or degradations of service, the sabotaging of systems or other damage.

Third parties with which the Bank does business, that facilitate the Bank’s business activities, e.g., vendors, supply chain, exchanges, clearing houses, central depositories, and financial intermediaries are sources of cybersecurity risk to the Bank. Third-party incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber-attacks, including ransomware and supply-chain compromises could have a material adverse effect on the Bank, including in circumstances in which an affected third party is unable to deliver a product or service to the Bank or results in lost or compromised information of the Bank or its clients or customers.

Bank customers are also sources of cybersecurity risk to the Bank and its information assets, particularly when their activities and systems are beyond the Bank’s own security and control systems. The Bank provides information to its customers and other external parties concerning cybersecurity risks including opportunities to reduce cybersecurity risk.

The security program is commensurate with the size and complexity of the Bank. Risks from cybersecurity threats, including any previous cybersecurity events, have not materially affected the Bank or its business strategy, results of operations or financial condition.

Cybersecurity Risk Management

The Bank maintains an Information Security and Cybersecurity Program to support the management of cybersecurity risk as a component of the Bank’s Enterprise Risk Management (“ERM”) framework. The information security and cybersecurity program is designed to assess, identify, and manage risks from cybersecurity threats and leverages controls, best practices recommendations, and standards from the Federal Financial Institutions Examination Council (“FFIEC”) and the National institute of Standards and Technology (“NIST”) Cybersecurity Framework, and standards set by relevant legal and regulatory authorities. Our policies and procedures concerning cybersecurity matters include processes to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, detect intrusions into our systems, and respond to cybersecurity incidents.

The Chief Information Security Officer (“CISO”) reports to the Chief Information Officer (“CIO”) and Chief Risk Officer (“CRO”). The CISO leads the Information Security team, which is responsible for identifying and assessing information security and cybersecurity risks, and for implementing and maintaining controls to manage information security and cybersecurity threats. The CISO is responsible for the Bank’s Information Security and Cybersecurity Program, which is designed to prevent, detect and respond to cybersecurity threats and incidents in order to help safeguard the confidentiality, integrity and ethical values, experience, reputation, knowledgeavailability of Company affairs, businessthe Bank's information systems and information.

As part of the Information Security and Cybersecurity Program, the Bank conducts periodic employee training to educate employees on information and cybersecurity risks and to reinforce security management practices and compliance with the Bank's security policies and standards. The training is mandatory for all employees and is supplemented by testing initiatives, including periodic phishing tests.

Extensive technical controls are in place for identifying and managing cybersecurity risks and safeguarding our information systems and information. The Bank uses sophisticated industry-recognized monitoring and threat detection technologies that continuously monitor our information systems and provide threat detection alerts. The Bank’s strategy for assessing, identifying, and managing cybersecurity risks and for evaluating the effectiveness of its cybersecurity program includes periodic risk assessments and testing of our systems, processes and procedures through audits, penetration testing, vulnerability scans, tabletop exercises, and other related exercises.

The Bank has an incident response program designed to enable the Bank to respond to cybersecurity incidents, coordinate as appropriate with law enforcement and other government agencies, notify clients and customers, as applicable, and recover from such incidents. In addition, the Bank actively partners with appropriate government and law enforcement agencies and peer industry forums to participate in threat intelligence discussions and simulations to assist with understanding time commitmentthe full spectrum of cybersecurity risks and availabilityenhancing defenses and financial commitment. improving resiliency in the Bank’s operating environment.

The NominatingBank engages third parties on a regular basis to assess, test, audit or assist with the implementation of our risk management strategies, policies, and procedures to enhance our detection and management of cybersecurity risks, including, but not limited to: consultants who assist with assessing risks, assess of our systems alignment with NIST Cybersecurity Framework, FFIEC, penetration testing, tabletop exercises and other regulatory agency requirements.

The Bank maintains a process to evaluate and manage risks associated with third-party service providers. We conduct a full vendor due diligence review before engagement, review specific security measures in our contracts, and maintain continued monitoring during the engagement including yearly due diligence reviews.

Governance

The IT Committee seeksand Audit Committee are the principal board committees that oversees the Bank’s assessment and management of cybersecurity risk, including oversight of the implementation and maintenance of appropriate controls in support of the Bank’s Information Security and Cybersecurity Program. Both the IT and Audit Committees are comprised of professionals with risk management and information technology expertise to achievemanage any material risk from a well-rounded, diverse, knowledgeable and experienced Board. cybersecurity threat standpoint.

The Nominating and Governancemembership of the IT Committee considers nominees to serveincludes members of the executive management team as well as directors of the CompanyBank. The CIO and recommends such personsCISO actively participate in all IT Committee meetings. The CIO has over 20 years of work experience in the development, operation and management of Information Technology at financial institutions. The CISO has over 10 years of work experience in building and overseeing cybersecurity programs at financial institutions. Both CIO and CISO have extensive experience and qualifications in various technology and information security disciplines, including relevant experience at the Bank. Additionally, the Audit Committee has oversight of the management of cybersecurity risk via validation and review of IT and cybersecurity risk assessments and audits. The CISO provides reporting metrics on cybersecurity risks to the Board as well as director candidates recommended by shareholders pursuant to the guidelines set forth as an appendix to the NominatingIT Committee, which meets eight times a year. The IT and Governance Committee charter.