cfbk-20241231x10k
Me
UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
For the Fiscal Year ended December 31, 2024
or
For the transition period from __________ to______________
CF BANKSHARES INC.
(Exact name of registrant as specified in its charter)
(State or other jurisdiction of (IRS Employer
incorporation or organization) Identification No.)
4960 E. Dublin Granville Road, Suite #400, Columbus, Ohio 43081
(Address of Principal Executive Offices) (Zip Code)
(Registrant’s Telephone Number, Including Area Code)
Securities registered pursuant to Section 12(b) of the Act:
Common Stock, par value $.01 per share CFBK Nasdaq® Capital Market
(Title of Class) (Trading Symbol) (Name of Exchange on which Registered)
Securities registered pursuant to Section 12(g) of the Exchange Act: None
Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.
YES [ ] NO [X]
Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.
YES [ ] NO [X]
Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. YES [X] NO [ ]
Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (Section 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files).
YES [X] NO [ ]
1
Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.
Large Accelerated Filer [ ] Accelerated Filer [X]Non-accelerated Filer [ ] Smaller reporting company [X]
Emerging growth company [ ]
If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. [ ]
Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. [ ]
If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. [ ]
Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). [ ]
Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act).
YES [ ] NO [X]
The aggregate market value of the voting and non-voting common equity of the registrant held by non-affiliates as of June 30, 2024 was $119.8 million based upon the closing price as reported on the Nasdaq® Capital Market for that date. For this purpose, directors and executive officers of the registrant are considered affiliates.
As of March 10, 2025, there were 5,136,634 shares of the registrant’s (Voting) Common Stock outstanding and 1,260,700 shares of the registrant’s Non-Voting Common Stock outstanding.
DOCUMENTS INCORPORATED BY REFERENCE
Portions of the registrant’s Proxy Statement for the Annual Meeting of Stockholders to be held on June 4, 2025, are incorporated herein by reference into Part III of this Form 10-K.
2
INDEX
PART I
Item 1. Business 4
Item 1A. Risk Factors 24
Item 1B. Unresolved Staff Comments 35
Item 1C. Cybersecurity 35
Item 2. Properties 36
Item 3. Legal Proceedings 36
Item 4. Mine Safety Disclosures 37
PART II
Item 6. [Reserved] 37
Item 7A. Quantitative and Qualitative Disclosures About Market Risk 51
Item 8. Financial Statements and Supplementary Data 53
Item 9A. Controls and Procedures 104
Item 9B. Other Information 104
Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections 104
PART III
Item 10. Directors, Executive Officers and Corporate Governance 104
Item 11. Executive Compensation 105
Item 14. Principal Accountant Fees and Services 105
PART IV
Item 15. Exhibit and Financial Statement Schedules 106
3
Table of Contents
Forward-Looking Statements
Statements in this Annual Report on Form 10-K (this “Form 10-K”) and in our other communications that are not statements of historical fact are forward-looking statements which are made in good faith by us.Forward-looking statements include, but are not limited to: (1) projections of revenues, income or loss, earnings or loss per share of common stock, capital structure and other financial items; (2) plans and objectives of the management or Boards of Directors of CF Bankshares Inc. (the “Holding Company”) or CFBank, National Association (“CFBank”); (3) statements regarding future events, actions or economic performance; and (4) statements of assumptions underlying such statements. Words such as "estimate," "strategy," "may," "believe," "anticipate," "expect," "predict," "will," "intend," "plan," "targeted," and the negative of these terms, or similar expressions, are intended to identify forward-looking statements, but are not the exclusive means of identifying such statements. Various risks and uncertainties may cause actual results to differ materially from those indicated by our forward-looking statements, including, without limitation, those risks set forth in the section captioned “RISK FACTORS” in Part I, Item 1A of this Form 10-K.
Forward-looking statements are not guarantees of performance or results. A forward-looking statement may include a statement of the assumptions or bases underlying the forward-looking statement. We believe that we have chosen these assumptions or bases in good faith and that they are reasonable. We caution you, however, that assumptions or bases almost always vary from actual results, and the differences between assumptions or bases and actual results can be material. The forward-looking statements included in this Form 10-K speak only as of the date hereof. We undertake no obligation to publicly release revisions to any forward-looking statements to reflect events or circumstances after the date of such statements, except to the extent required by law.
PART I
Item 1. Business.
General
CF Bankshares Inc. (“Holding Company”) was organized as a Delaware corporation in September 1998 as the holding company for CFBank, in connection with CFBank’s conversion from a mutual to stock form of organization. CFBank was originally organized in 1892 and was formerly known as Central Federal Savings and Loan Association of Wellsville and more recently as Central Federal Bank. On December 1, 2016, CFBank converted from a federal savings institution to a national bank. Effective as of December 1, 2016 and in conjunction with the conversion of CFBank to a national bank, the Holding Company became a registered bank holding company and elected financial holding company status. Effective as of July 27, 2020, the Holding Company changed its name from Central Federal Corporation to CF Bankshares Inc. As a financial holding company, we are subject to regulation by the Board of Governors of the Federal Reserve System (the “FRB”). As used herein, the terms “we,” “us,” “our” and the “Company” refer to CF Bankshares Inc. and CFBank, unless the context indicates to the contrary.
The consolidated financial statements include the Holding Company and CFBank. Intercompany transactions and balances are eliminated in consolidation.
Central Federal Capital Trust I (the “Trust”), a wholly-owned subsidiary of the Holding Company, was formed in 2003 to raise additional funding for the Company through a pooled private offering of trust preferred securities. The Holding Company issued $5,155,000 of subordinated debentures to the Trust in exchange for ownership of all of the common stock of the Trust and the proceeds of the preferred securities sold by the Trust. The Holding Company is not considered the primary beneficiary of this trust (variable interest entity) and, therefore, the Trust is not consolidated in the Company’s financial statements, but rather the subordinated debentures are shown as a liability.
Currently, the Company does not transact material business other than through CFBank. At December 31, 2024, the Company’s assets totaled $2.1 billion and stockholders’ equity totaled $168.4 million.
CFBank is a nationally chartered boutique commercial bank operating primarily in five (5) major metro markets: Columbus, Cleveland, Cincinnati, and Akron, Ohio, and Indianapolis, Indiana. CFBank focuses on serving the financial needs of closely held businesses and entrepreneurs, by providing comprehensive Commercial, Retail, and Mortgage Lending services presence. In all regional markets, CFBank provides commercial loans and equipment leases, commercial and residential real estate loans and treasury management depository services, residential mortgage lending, and full-service commercial and retail banking services and products. CFBank seeks to differentiate itself from its competitors by providing individualized service coupled with direct customer access to decision-makers, and ease of doing business. We believe that CFBank matches the sophistication of much larger banks, without the bureaucracy. CFBank also offers its clients the convenience of online banking, mobile banking and remote deposit capabilities.
4
Table of Contents
Our revenues are derived principally from the generation of interest and fees on loans originated and noninterest income generated on the sale of loans. Our primary sources of funds are retail and business deposit accounts and certificates of deposit, brokered certificates of deposit and, to a lesser extent, principal and interest payments on loans and securities, Federal Home Loan Bank (“FHLB”) advances, other borrowings and proceeds from the sale of loans.
Most of our deposits and loans come from our market area. Our principal market area for deposits and loans includes the following counties in Ohio and Indiana: Franklin County, Ohio through our offices in Columbus, Ohio; Delaware County, Ohio through our Polaris office in Columbus, Ohio; Cuyahoga County, Ohio through our office in Orange Village, Ohio and our Ohio City office in Cleveland, Ohio; Summit County, Ohio through our office in Fairlawn, Ohio; Hamilton County, Ohio through our offices in Blue Ash, Ohio and our Red Bank office in Cincinnati, Ohio; and Marion County, Indiana through our office in Indianapolis. Because of CFBank’s concentration of business activities in Ohio, the Company’s financial condition and results of operations depend in large part upon economic conditions in Ohio.
Market Area and Competition
Our primary market areas are competitive markets for financial services and we face competition both in making loans and in attracting deposits. Direct competition comes from a number of financial institutions operating in our market area, many of which have a statewide or regional presence, and in some cases, a national presence. Many of these financial institutions are significantly larger and have greater financial resources than we do. Competition for loans and deposits comes from savings institutions, mortgage banking companies, commercial banks, credit unions, brokerage firms and insurance companies.
Lending Activities
Loan and Lease Portfolio Composition. Our loan and lease portfolio consists primarily of commercial, commercial real estate and multi-family mortgage loans, mortgage loans secured by single-family residences and, to a lesser degree, consumer loans. CFBank also finances a variety of commercial and residential construction projects. At December 31, 2024, gross loans receivable totaled $1.7 billion and increased approximately $28.5 million, or 1.7%, from $1.7 billion at December 31, 2023. Commercial, commercial real estate and multi-family mortgage loans, including related construction loans, totaled $1.2 billion in the aggregate and represented 69.1% of the gross loan portfolio at December 31, 2024, as compared to 68.4% of the gross loan portfolio at December 31, 2023. Commercial, commercial real estate and multi-family mortgage loan balances, including related construction loans, increased $32.9 million, or 2.8%, during 2024. Portfolio single-family residential mortgage loans, including related construction loans, totaled $494.2 million and represented 28.4% of total gross loans at year-end 2024, compared to 29.4% at year-end 2023. The remainder of our loan portfolio consists of consumer loans, which totaled $42.5 million, or 2.4% of gross loans receivable, at year-end 2024.
The types of loans originated are subject to federal and state laws and regulations. Interest rates charged on loans are affected by the demand for such loans, the supply of money available for lending purposes and the rates offered by competitors. In turn, these factors are affected by, among other things, economic conditions, fiscal policies of the federal government, monetary policies of the FRB and legislative tax policies.
Loan Maturity. The following table shows the remaining contractual maturity of CFBank’s loan portfolio at December 31, 2024. Demand loans and other loans having no stated schedule of repayments or no stated maturity are reported as due within one year. The table does not include potential prepayments or scheduled principal amortization.
(Dollars in thousands)
Amounts due:
After one year:
5
Table of Contents
The following table sets forth at December 31, 2024, the dollar amount of total loans and leases receivable contractually due after one year (December 31, 2025), and whether such loans have fixed interest rates or adjustable interest rates.
Fixed Adjustable Total
(Dollars in thousands)
Origination of Loans and Leases. Lending activities are conducted through our offices located in Franklin, Cuyahoga, Delaware, Summit, and Hamilton Counties, Ohio and in Marion County, Indiana. We originate commercial, commercial real estate, multi-family and single-family residential mortgage loans and also expanded into business financial services in the Columbus, Cleveland, Cincinnati and Akron, Ohio and Indianapolis, Indiana markets.
Commercial, commercial real estate and multi-family loans are originated with fixed, floating and adjustable-rate mortgage (“ARM”) interest rates. Fixed-rate loans are typically limited to terms of three to five years. CFBank has also utilized interest-rate swaps to economically protect the related fixed-rate loans from changes in value due to changes in interest rates but does not apply hedge accounting. See Note 17 in the accompanying Notes to Consolidated Financial Statements for additional information on interest-rate swaps.
CFBank participates in various loan programs offered by the Small Business Administration (the “SBA”), enabling us to provide our customers and small business owners in our markets with access to funding to support their businesses, as well as reduce credit risk associated with these loans. Individual loans include SBA guarantees of up to 90%.
Single-Family Mortgage Lending. A significant lending activity has been the origination of permanent conventional mortgage loans secured by single-family residences located within and outside of our primary market area. Loan originations are primarily obtained from our loan officers and their contacts within the local real estate industry and with existing or past customers and members of the local communities. We offer both fixed-rate and ARM loans with maturities generally up to 30 years, priced competitively with current market rates. We offer several ARM loan programs with terms of up to 30 years and, with the majority of the programs, interest rates adjust with a maximum initial adjustment limitation of up to 5%, subsequent adjustments of up to 2.0% per six month period and a 5.0% lifetime cap. The interest rate adjustments on ARM loans currently offered are indexed to a variety of established indices, primarily the Secured Overnight Financing Rate (“SOFR”) and these loans do not provide for initial deep discount interest rates. We do not originate option ARM loans or loans with negative amortization.
The volume and types of single-family ARM loan originations are affected by market factors such as the level of interest rates, consumer preferences, competition and the availability of funds. For several years, demand for single-family ARM loans was strong due to consumer preference for ARM loans as a result of the high interest rate environment. However, in the past year, demand for ARM loans has declined.
All single-family mortgage loans sold are underwritten according to Federal Home Loan Mortgage Corporation (Freddie Mac) or Federal National Mortgage Association (Fannie Mae) guidelines, or are underwritten to comply with additional guidelines as may be required by an individual investor. CFBank is a direct endorsed underwriter, a designation by the Department of Housing and Urban Development that allows us to offer loans insured by the Federal Housing Authority (“FHA”). CFBank is also approved by the Department of Veterans Affairs (“VA”) to originate and approve VA loans.
For the year ended December 31, 2024, single-family mortgage loans originated for sale totaled $47.6 million, an increase of $36.8 million, or 340.8%, compared to $10.8 million originated in 2023.
For the year ended December 31, 2024, portfolio single-family mortgage loans originated by CFBank totaled $25.4 million, or 1.5% of total loans. Our policy is to originate quality loans that are evaluated for risk based on the borrower’s ability to repay the loan. Collateral positions are established by obtaining independent appraisal opinions. Mortgage insurance is generally required when the loan-to-value (“LTV”) exceeds 80%. In conjunction with competitive product offerings in the market, and the lack of availability for mortgage insurance, jumbo loans and portfolio ARM loans exceeding 80% are often originated without mortgage insurance.
Portfolio single-family residential ARM loans totaled $99.1 million, or 21.3% of the single-family mortgage loan portfolio, at December 31, 2024. These loans generally pose credit risks not inherent in fixed-rate loans, primarily because as interest rates rise, the borrowers’ payments rise, increasing the potential for default. Periodic and lifetime caps on interest rate increases help to reduce the credit risks associated with ARM loans, but also limit the interest rate sensitivity of such loans.
6
Table of Contents
Commercial Real Estate and Multi-Family Residential Mortgage Lending. Origination of commercial real estate and multi-family residential mortgage loans continues to be a significant portion of CFBank’s lending activity. Commercial real estate and multi-family residential mortgage loan balances increased $46.7 million to $610.5 million at December 31, 2024. This represented an increase of 8.3% over the $563.8 million balance at December 31, 2023.
We originate commercial real estate loans that are secured by properties used for business purposes, such as manufacturing facilities, office buildings and retail facilities. We originate multi-family residential mortgage loans that are secured by apartment buildings, condominiums, and multi-family residential houses. Commercial real estate and multi-family residential mortgage loans are secured by properties generally located in our primary market area.
Underwriting policies provide that commercial real estate and multi-family residential mortgage loans may be made in amounts up to 85% of the lower of the appraised value or purchase price of the property. An independent appraisal of the property is required on all loans greater than or equal to $500,000. In underwriting commercial real estate and multi-family residential mortgage loans, we consider the appraised value and net operating income of the property, the debt service ratio and the property owner’s and/or guarantor’s financial strength, expertise and credit history. We offer both fixed and adjustable rate loans. Fixed-rate loans are generally limited to three to five years, at which time they convert to adjustable-rate loans. At times, CFBank accommodates loans to borrowers who desire fixed-rate loans for longer than three to five years. We have utilized interest-rate swaps to economically protect these fixed-rate loans from changes in value due to changes in interest rates, as appropriate. See Note 17 in the accompanying Notes to Consolidated Financial Statements for additional information on interest-rate swaps. Adjustable-rate loans are tied to various market indices and generally adjust monthly or annually. Payments on both fixed and adjustable rate loans are based on 15 to 30 year amortization periods.
Commercial real estate and multi-family residential mortgage loans are generally considered to involve a greater degree of risk than single-family residential mortgage loans. Because payments on loans secured by commercial real estate and multi-family residential properties are dependent on successful operation or management of the properties, repayment of commercial real estate and multi-family residential mortgage loans may be subject to a greater extent to adverse conditions in the real estate market or the economy. As with single-family residential mortgage loans, adjustable rate commercial real estate and multi-family residential mortgage loans generally pose credit risks not inherent in fixed-rate loans, primarily because as interest rates rise, the borrowers’ payments rise, increasing the potential for default. Additionally, adjustable rate commercial real estate and multi-family residential mortgage loans generally do not contain periodic and lifetime caps on interest rate changes. We seek to minimize the additional risk presented by adjustable rate commercial real estate and multi-family residential mortgage loans through underwriting criteria that require such loans to be qualified at origination with sufficient debt coverage ratios under increasing interest rate stress scenarios.
Commercial real estate and multi-family residential mortgage loans also have larger loan balances to single borrowers or groups of related borrowers compared to single-family residential mortgage loans. Some of our borrowers also have more than one commercial real estate or multi-family residential mortgage loan outstanding with us. Additionally, some loans may be collateralized by junior liens. Consequently, an adverse development involving one or more loans or credit relationships can expose us to significantly greater risk of loss compared to an adverse development involving a single-family residential mortgage loan. We seek to minimize and mitigate these risks through underwriting policies which require such loans to be qualified at origination on the basis of the property’s income and debt coverage ratio and the financial strength of the property owners and/or guarantors.
Commercial Lending. The origination of commercial loans continues to be a significant component of our lending activity. During 2024, commercial loan balances decreased by $21.1 million, or 4.8%, to $418.8 million at year-end 2024. Commercial loans are generally secured by business equipment, inventory, accounts receivable and other business assets. In underwriting commercial loans, we consider the net operating income of the borrower, the debt service ratio and the financial strength, expertise and credit history of the business owners and/or guarantors. We offer both fixed- and adjustable-rate commercial loans. Fixed-rate loans are typically limited to a maximum term of five years. Adjustable-rate loans are tied to various market indices and generally adjust monthly or annually.
Commercial loans are generally considered to involve a greater degree of risk than loans secured by real estate. Because payments on commercial loans are dependent on successful operation of the business enterprise, repayment of such loans may be subject to a greater extent to adverse conditions in the economy. We seek to mitigate these risks through underwriting policies which require such loans to be qualified at origination on the basis of the enterprise’s income and debt coverage ratio and the financial strength of the business owners and/or guarantors.
Adjustable-rate commercial loans generally pose credit risks not inherent in fixed-rate loans, primarily because as interest rates rise, the borrowers’ payments rise, increasing the potential for default. Additionally, adjustable-rate commercial loans generally do not contain periodic and lifetime caps on interest rate changes. We seek to minimize the additional risk presented by adjustable-rate commercial loans through underwriting criteria that require such loans to be qualified at origination with sufficient debt coverage ratios under increasing interest rate scenarios.
7
Table of Contents
Construction and Land Lending. During 2024, construction loans increased by $11.4 million, or 6.0%, to $202.2 million, as compared to the $190.7 million in the portfolio at year-end 2023. CFBank’s strong capital levels have allowed CFBank to take advantage of select market opportunities in this area within the risk tolerances we have identified.
Construction loans are made to finance the construction of residential and commercial properties generally located within our primary market area. Construction loans are fixed- or adjustable-rate loans which may convert to permanent loans with maturities of up to 30 years. Our policies provide that construction loans may be made in amounts generally up to 80% of the appraised value of the property, and an independent appraisal of the property is required. Loan proceeds are disbursed in increments as construction progresses and as inspections warrant and regular inspections are required to monitor the progress of construction. Land development loans generally do not exceed 75% of the actual cost or current appraised value of the property, whichever is less. Loans on raw land generally do not exceed 65% of the actual cost or current appraised value of the property, whichever is less.
Construction and land financing is considered to involve a higher degree of credit risk than long-term financing on improved, owner-occupied real estate. Risk of loss on a construction loan is dependent largely upon the accuracy of the initial estimate of the property’s value at completion of construction or development compared to the estimated cost (including interest) of construction. If the estimate of value proves to be inaccurate, we may be confronted with a project, when completed, having a value which is insufficient to assure full repayment. We attempt to reduce such risks on construction loans by requiring personal guarantees and reviewing current personal financial statements and tax returns, as well as other projects of the developer.
Consumer and Other Lending. The consumer loan portfolio generally consists of home equity lines of credit, home improvement loans, loans secured by deposits and purchased loans. At December 31, 2024, our consumer loan portfolio totaled $42.5 million, which was 2.4% of gross loans receivable. During 2024, our consumer loan portfolio increased $4.1 million, or 10.8%, over the year-end 2023 balance of $38.4 million.
Home equity lines of credit include those loans we originate for our portfolio and purchased loans. We offer a variable rate home equity line of credit product which we originate for our portfolio. The interest rate adjusts monthly at various margins above the prime rate of interest (“PRIME”) as disclosed in The Wall Street Journal. The margin is based on certain factors including the loan balance, value of collateral, election of auto-payment and the borrower’s FICO® score. The amount of the line is based on the borrower’s credit history, income and equity in the home. When combined with the balance of the prior mortgage liens, these lines generally may not exceed 89.9% of the appraised value of the property at the time of the loan commitment. The lines are secured by a subordinate lien on the underlying real estate and are, therefore, vulnerable to declines in property values in the geographic areas where the properties are located. Credit approval for home equity lines of credit requires income sufficient to repay principal and interest due, stability of employment, an established credit record and sufficient collateral.
Delinquencies and Classified Assets.Management and the Board of Directors monitors the status of all loans 30 days or more past due on a monthly basis through the analysis of past due statistics and trends for all loans. Procedures with respect to resolving delinquencies vary depending on the nature and type of the loan and period of delinquency. We make efforts, consistent with safety and soundness principles, to work with the borrower and develop action steps to have the loan brought current. If the loan is not brought current, it then becomes necessary to take additional legal actions including the repossession of collateral.
We maintain an internal credit rating system and loan review procedures specifically developed to monitor credit risk for commercial, commercial real estate and multi-family residential loans. Internal loan reviews for these loan types are performed at least annually, and more often for loans with higher credit risk. Loan officers maintain close contact with borrowers between reviews. Adjustments to loan risk ratings are based on the reviews and at any time information is received that may affect risk ratings. Additionally, an independent third party review of commercial, commercial real estate and multi-family residential loans is performed at least annually. Management uses the results of these reviews to help determine the effectiveness of the existing policies and procedures and to provide an independent assessment of our internal loan risk rating system.
Federal regulations and CFBank’s asset classification policy require use of an internal asset classification system as a means of reporting and monitoring assets. We have incorporated the regulatory asset classifications as a part of our credit monitoring and internal loan risk rating system. Loans are classified into risk categories based on relevant information about the ability of borrowers to service their debt, such as current financial information, historical payment experience, credit documentation, public information and current economic trends, among other factors. In accordance with regulations, problem loans are classified as special mention, substandard, doubtful or loss, and the classifications are subject to review by banking regulators. Loans designated as special mention are considered criticized assets. Loans designated as substandard, doubtful or loss are considered classified assets. Loans designated as special mention possess weaknesses that, if left uncorrected, may result in deterioration of the repayment prospects for the loan or of CFBank’s credit position at some future date. A loan is considered substandard if it is inadequately protected by the current net worth and paying capacity of the obligor or of the collateral pledged, if any. Loans so classified have a well-defined weakness or weaknesses that jeopardize the liquidation of the debt. They are characterized by the distinct possibility that there will be some loss if the deficiencies are not corrected. A loan considered doubtful has all of the weaknesses inherent in those classified substandard with the added characteristic that the weaknesses make collection or liquidation in full, on the basis of currently existing facts, condition
8
Table of Contents
and values, highly questionable and improbable. Loans designated as loss are considered uncollectible based on the borrower’s inability to make payments, and any value attached to collateral, if any, is based on liquidation value. Loans considered loss are generally uncollectible and have so little value that their continuance as assets is not warranted and are charged off, unless certain circumstances exist that could potentially warrant a specific reserve to be established.
See the section titled “Financial Condition - Allowance for credit losses on loans” in Management’s Discussion and Analysis of Financial Condition and Results of Operations in Item 7 of this Form 10-K and Notes 1 and 4 in the accompanying Notes to Consolidated Financial Statements for detailed information on criticized and classified loans as of December 31, 2024 and 2023.
Classified loans include all nonaccrual loans, which are discussed in further detail in the section below titled “Nonperforming Assets”. In addition to nonaccrual loans, classified loans include loans that were identified as substandard assets, were still accruing interest at December 31, 2024, but exhibit weaknesses that could lead to nonaccrual status in the future. At December 31, 2024, there were two classified loans still accruing interest.
Nonperforming Assets.
The $9.3 million increase in nonperforming loans in 2024 compared to 2023 was primarily driven by three commercial loans, totaling $11.3 million, one commercial equipment lease, totaling $85,000, and three single-family residential loans, totaling $1.1 million, becoming nonaccrual during the year ended December 31, 2024, partially offset by paydowns and approximately $3.5 million in charges-offs on loans that were in nonaccrual at December 31, 2023.
For the year ended December 31, 2024, the amount of additional interest income that would have been recognized on nonaccrual loans, if such loans had continued to perform in accordance with their contractual terms, was approximately $1.2 million. There was no interest income recognized on nonaccrual loans in 2024.
The Company adopted Accounting Standard Update (“ASU”) 2022-02 during the first quarter of 2023. This amendment eliminated the Trouble Debt Restructuring (“TDR”) recognition and measurement guidance and, instead, required that an entity evaluate (consistent with the accounting for other loan modifications) whether the modification represents a new loan or a continuation of an existing loan. The amendments also enhanced existing disclosure requirements and introduced new requirements related to certain modifications of receivables made to borrowers experiencing financial difficulty.
During the year ended December 31, 2024, the Company modified one commercial loan, with an amortized cost basis of $4.3 million at December 31, 2024, where the borrower was experiencing financial difficulty. The amortized cost basis of this loan represented 1% of commercial loans at December 31, 2024. The loan was modified to increase the interest rate by 75bps, extend the maturity date by six months, and allow for an amortization holiday and deferred interest options. The loan was not past due during the year ended December 31, 2024.
See the section titled “Financial Condition - Allowance for credit losses on loans” in Management’s Discussion and Analysis of Financial Condition and Results of Operations in Item 7 of this Form 10-K and Notes 1 and 4, in the accompanying Notes to Consolidated Financial Statements for additional information on nonperforming loans and modified loans as of December 31, 2024 and 2023.
For information on real estate owned (“REO”) and other foreclosed assets, see the section below titled “Foreclosed Assets.”
Allowance for Credit Losses on Loans and Leases (ACL - Loans). The ACL - Loans is a valuation account that is deducted from the amortized cost basis of loans and leases to present the net amount expected to be collected on loans and leases over the contractual term. Loans and leases are charged off against the allowance when the uncollectibility of the loan or lease is confirmed. Expected recoveries do not exceed the aggregate of amounts previously charged off and expected to be charged off. Adjustments to the ACL- Loans are reported in the income statement as a component of provision for credit loss. The Company has made the accounting policy election to exclude accrued interest receivable on loans and leases from the estimate of credit losses. The allowance and related disclosures for periods beginning after January 1, 2023 are presented under the current expected credit loss model (“CECL”), while the allowance and related disclosures for prior periods are reported under the allowance for loan losses (“ALLL”) incurred loss model.
See the section titled “Financial Condition - Allowance for credit losses on loans” in Management’s Discussion and Analysis of Financial Condition and Results of Operations in Item 7 of this Form 10-K for a detailed discussion of management’s methodology for determining the appropriate level of the ACL – Loans.
The ACL – Loans totaled $17.5 million at December 31, 2024, and increased $609,000, or 3.6%, from $16.9 million at December 31, 2023. The increase in the ACL - Loans is due to $6.1 million in loan provision expense, partially offset by a $5.5 million in net charge-offs during the year ended December 31, 2024. The ratio of the ACL - Loans to total loans was 1.00% at December 31, 2024, compared to 0.99% at December 31, 2023.
9
Table of Contents
We believe the ACL - Loans is adequate to absorb probable incurred credit losses in the loan portfolio as of December 31, 2024; however, future additions to the allowance may be necessary based on factors including, but not limited to, deterioration in client business performance, recessionary economic conditions, declines in borrowers’ cash flows and market conditions which result in lower real estate values. Additionally, various regulatory agencies, as an integral part of their examination process, periodically review the ACL - Loans. Such agencies may require additional provisions for loan losses based on judgments and estimates that differ from those used by management, or on information available at the time of their review. Management continues to diligently monitor credit quality in the existing portfolio and analyze potential loan opportunities carefully in order to manage credit risk. An increase in loan losses could occur if economic conditions and factors which affect credit quality, real estate values and general business conditions worsen or do not improve.
Impact of adoption ASC 326 - (409) -
Charge-offs:
Real estate loans:
Single-family - - -
Consumer loans:
Recoveries on loans previously charged off:
Recoveries
Real estate loans:
Consumer loans:
Other - 3 -
Commercial loans 91 85 -
ACL - Loans to total loans and leases 1.00% 0.99% 1.01%
Net charge-offs (recoveries) to ACL - Loans 31.35% 3.83% 1.45%
Net charge-offs (recoveries) to average loans and leases 0.32% 0.04% 0.02%
The impact of economic conditions on the housing market, collateral values, and businesses’ and consumers’ ability to pay may increase the level of charge-offs in the future. Additionally, our commercial, commercial real estate and multi-family residential loan portfolios may be detrimentally affected by adverse economic conditions. Declines in these portfolios could expose us to losses which could materially affect the Company’s earnings, capital and profitability.
10
Table of Contents
The following table sets forth the ACL - Loans in each of the categories listed at the dates indicated and the percentage of such amounts to total loans. Although the ACL - Loans may be allocated to specific loans or loan types, the entire ACL - Loans is available for any loan that, in management’s judgment, should be charged off.
At December 31,
(Dollars in thousands)
Real estate loans:
Consumer loans:
Foreclosed Assets
Assets acquired through or instead of loan foreclosure are initially recorded at fair value less costs to sell when acquired, establishing a new cost basis. If fair value declines subsequent to foreclosure, a valuation allowance is recorded through expense. Operating and maintenance costs after acquisition are expensed. There were no foreclosed assets at December 31, 2024 or December 31, 2023. See the section titled “Financial Condition - Foreclosed Assets” in Management’s Discussion and Analysis of Financial Condition and Results of Operations in Item 7 of this Form 10-K and Note 5 in the accompanying Notes to Consolidated Financial Statements for information regarding foreclosed assets at December 31, 2024. Foreclosure activities are closely tied with general economic conditions and the ability of our customers to continue to meet their loan payment obligations and, therefore, the level of foreclosed assets may increase in the future if, among other things, economic conditions in our market area decline.
Investment Activities
National banks have the authority to invest in various types of liquid assets, including U.S. Treasury obligations, securities of various federal agencies, certificates of deposit of insured banks and savings institutions, bankers’ acceptances and federal funds. Subject to various restrictions, national banks may also invest their assets in commercial paper, municipal bonds, investment-grade corporate debt securities and mutual funds whose assets conform to the investments that a national bank is otherwise authorized to make directly.
The investment policy established by the Board of Directors is designed to provide and maintain adequate liquidity, generate a favorable return on investment without incurring undue interest rate and credit risk, and compliment lending activities. The policy provides authority to invest in U.S. Treasury and federal entity/agency securities meeting the policy’s guidelines, mortgage-backed securities and collateralized mortgage obligations insured or guaranteed by the United States government and its entities/agencies, municipal and corporate bonds and other investment instruments.
At December 31, 2024, the securities available for sale portfolio totaled $8.7 million. At December 31, 2024, all U.S. Treasury securities in the securities portfolio were guaranteed by the U.S. government.
Equity securities, consisting of preferred stock in another financial institution, totaled $5.0 million at December 31, 2024 and December 31, 2023.
Management evaluates debt securities impairment at least on a quarterly basis, and more frequently when economic or market conditions warrant such an evaluation.See Notes 1 and 3 in the accompanying Notes to Consolidated Financial Statements for a detailed discussion of management’s evaluation of securities for impairment.
11
Table of Contents
The following table sets forth certain information regarding the amortized cost and fair value of securities at the dates indicated
At December 31,
Issued by U.S. government-sponsored entities and agencies:
Mortgage-backed securities - residential - - 4 4 17 17
The following table sets forth information regarding the amortized cost, weighted average yield and contractual maturity dates of debt securities as of December 31, 2024.
After One Year After Five Years
One Year or Less through Five Years through Ten Years After Ten Years Total
Weighted Weighted Weighted Weighted Weighted
Issued by U.S. government-sponsored entities and agencies:
(1)Interest yields are presented on a fully taxable equivalent basis using a 21 percent tax rate.
Sources of Funds
General. CFBank’s primary sources of funds are deposits, principal and interest payments on loans and securities, proceeds from sales of loans, borrowings, and funds generated from operations of CFBank. Contractual loan payments are a relatively stable source of funds, while deposit inflows and outflows and loan prepayments are significantly influenced by general market interest rates and economic conditions and competition. Borrowings may be used on a short-term basis for liquidity purposes or on a long-term basis to fund asset growth or manage interest rate risk in accordance with asset/liability management strategies.
The Holding Company, as a financial holding company, has more limited sources of liquidity than CFBank. In general, in addition to its existing liquid assets, sources of liquidity include funds raised in the securities markets through debt or equity offerings, dividends received from CFBank or the sale of assets.
Dividends from CFBank serve as a potential source of liquidity to the Holding Company to meet its obligations. Generally, CFBank may pay dividends to the Holding Company without prior regulatory approval as long as the dividend does not exceed the total of the current calendar year-to-date earnings plus any earnings from the previous two years not already paid out in dividends, and as long as CFBank remains well capitalized after the dividend payment. See Note 16, Regulatory Capital Matters, in the accompanying Notes to Consolidated Financial Statements for additional information.
The Holding Company’s available cash and cash equivalents totaled $1.0 million at December 31, 2024. Management believes that the Holding Company had adequate funds and liquidity sources at December 31, 2024 to meet its current and anticipated operating needs at this time. See the section titled “Liquidity and Capital Resources” in Management’s Discussion and Analysis of Financial Condition and Results of Operations in Item 7 of this Form 10-K for information regarding the Holding Company’s liquidity and regulatory matters.
Deposits. CFBank offers a variety of deposit accounts with a range of interest rates and terms including savings accounts, retail and business checking accounts, money market accounts and certificates of deposit. Management regularly evaluates the internal cost of funds, surveys rates offered by competitors, reviews cash flow requirements for lending and liquidity, and executes rate changes when necessary as part of its asset/liability management, profitability and liquidity objectives. Money market accounts represent the largest portion of our deposit portfolio and totaled 40.6% of average deposit balances in 2024. Certificate of deposit accounts represent the second largest portion of our deposit portfolio and totaled 38.5% of average deposit balances in 2024. The term of the certificates of deposit typically offered vary from six months to five years at rates established by management. Specific terms of an individual account vary according to the type of account, the minimum balance required, the time period funds must remain on deposit and the interest rate, among other factors.
12
Table of Contents
The flow of deposits is influenced significantly by general economic conditions, changes in money market rates, prevailing interest rates and competition. Deposits are obtained predominantly from the areas in which CFBank’s offices are located. We rely primarily on a willingness to pay market-competitive interest rates to attract and retain retail deposits, as well as customer service and relationships with customers.
At December 31, 2024, CFBank had $420.8 million in brokered deposits with maturity dates from January 2025 through March 2028. At December 31, 2024, cash, unpledged securities, and deposits in other financial institutions totaled $237.9 million.
CFBank is a participant in the Certificate of Deposit Account Registry Service® (CDARS) and Insured Cash Sweep (ICS) programs offered through IntraFi Network. IntraFi works with a network of banks to offer products that can provide FDIC insurance coverage in excess of $250,000 through these innovative products. Brokered deposits, including CDARS and ICS deposits that qualify as brokered, totaled $420.8 million at December 31, 2024, and decreased $19.6 million, or 4.4%, from $440.4 million at December 31, 2023. Customer balances in the CDARS reciprocal and ICS reciprocal programs, which do not qualify as brokered, totaled $271.7 million at December 31, 2024 and increased $33.9 million, or 14.3%, from $237.8 million at December 31, 2023.
As of December 31, 2024 and 2023, deposits exceeding the FDIC insured limit of $250,000 totaled $522.4 million and $509.7 million, respectively.
Certificate accounts in amounts of $250,000 or more totaled $464.0 million at December 31, 2024, maturing as follows:
Maturity Period Amount Weighted Average Rate
(Dollars in thousands)
The following table sets forth the distribution of average deposit account balances for the periods indicated and the weighted average interest rates on each category of deposits presented.
For The Year Ended December 31,
(Dollars in thousands)
Noninterest-bearing deposits:
See the sections titled “Financial Condition – Deposits” and “Liquidity and Capital Resources” in Management’s Discussion and Analysis of Financial Condition and Results of Operations in Item 7 of this Form 10-K for additional information regarding deposits.
Borrowings. As part of our operating strategy, FHLB advances are used as an alternative to retail and brokered deposits to fund our asset growth. The advances are collateralized primarily by single-family mortgage loans, multi-family mortgage loans, 1-4 family commercial real estate loans and home equity lines of credit loans, securities and cash, and secondarily by CFBank’s investment in the capital stock of the FHLB of Cincinnati. FHLB advances are made pursuant to several credit programs, each of which has its own interest rate and range of maturities. The maximum amount that the FHLB will advance to member institutions fluctuates from time to time in accordance with the policies of the FHLB. FHLB advances totaled $58.0 million at December 31, 2024. Based on the collateral pledged, CFBank was eligible to borrow up to a total of $244.6 million at year-end 2024.
13
Table of Contents
The Holding Company has a $35.0 million credit facility with a third-party bank. The credit facility was revolving until May 21, 2024, at which time the outstanding balance was converted to a 10-year term note on a graduated 10-year amortization. Borrowings on the credit facility bear interest at a fixed rate of 3.85% until May 21, 2026, and the interest rate then converts to a floating rate equal to PRIME with a floor of 3.75%. At December 31, 2024, the Company had an outstanding balance, net of unamortized debt issuance costs, of $34.7 million on the facility.
In addition to access to FHLB advances, CFBank has borrowing capacity available with the Federal Reserve Bank of Cleveland through the Borrower-in-Custody program. The borrowings are collateralized by commercial loans and commercial real estate loans. Based on the collateral pledged, CFBank was eligible to borrow up to a total of $127.4 million at year-end 2024. There were no outstanding borrowings from the Federal Reserve Bank at December 31, 2024.
At December 31, 2024 and 2023, CFBank had $65.0 million of availability in unused lines of credit with two commercial banks. There were no outstanding borrowings on these lines of credit at December 31, 2024 or December 31, 2023. If CFBank were to borrow on these lines of credit, interest would accrue daily at a variable rate based on the commercial bank’s cost of funds and current market returns.
See the section titled “Financial Condition - Subordinated Debentures” in Management’s Discussion and Analysis of Financial Condition and Results of Operations in Item 7 of this Form 10-K for information regarding subordinated debentures issued by the Company in 2003 and 2018.
The following table sets forth certain information regarding short-term borrowings at or for the periods ended on the dates indicated (Dollars in thousands)
For the Year ended December 31,
Short-term FHLB advances and other borrowings:
Average balance outstanding $ 214 $ 223 $ -
Maximum amount outstanding at any month-end during the period 26,000 - -
Balance outstanding at end of period - - -
Weighted average interest rate during the period 5.48% 4.91% -
Personnel
As of December 31, 2024, the Company had one part-time and 102 full-time employees.
Regulation and Supervision
Set forth below is a brief description of certain laws and regulations that apply to us. This description, as well as other descriptions of laws and regulations contained in this Form 10-K, is not complete and is qualified in its entirety by reference to the applicable laws and regulations. The laws and regulations applicable to the Company are continually under review by the United States Congress and state legislatures and federal and state regulatory agencies, and a change in statutes, regulations or regulatory policies applicable to the Company could have a material effect on the Company’s business.
Overview
The Holding Company and CFBank are subject to examination and comprehensive federal regulation and oversight by federal banking agencies. Such regulation and oversight is intended primarily for the protection of consumers, depositors, borrowers, the FDIC’s Deposit Insurance Fund (the “DIF”) and the banking system as a whole and not for the protection of shareholders. Applicable laws and regulations restrict permissible activities and investments and require actions to protect loan, deposit, brokerage, fiduciary and other customers, as well as the DIF. They also may restrict the Holding Company’s ability to repurchase its stock or to receive dividends from CFBank and impose capital adequacy and liquidity requirements.
As a financial holding company, the Holding Company is subject to regulation by the FRB under the Bank Holding Company Act of 1956, as amended (the “BHCA”) and to inspection, examination and supervision by the FRB. The Holding Company is also subject to the disclosure and regulatory requirements of the Securities Act of 1933, as amended (the “Securities Act”), and the Securities Exchange Act of 1934, as amended (the “Exchange Act”), as administered by the Securities and Exchange Commission (the “SEC”). The Holding Company’s common stock trades on the NASDAQ Capital Market under the symbol “CFBK”, which subjects the Holding Company to various requirements under the NASDAQ Marketplace Rules.
14
Table of Contents
CFBank, as a national banking association, is subject to regulation, supervision and examination primarily by the Office of the Comptroller of the Currency (the “OCC”). In addition, CFBank is subject to regulation and examination by the FDIC, which insures the deposits of CFBank to the maximum extent permitted by law, and certain other requirements established by the FDIC.
The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) established the Consumer Financial Protection Bureau (the “CFPB”), which regulates consumer financial products and services and certain financial services providers. The CFPB is authorized to prevent unfair, deceptive or abusive acts or practices and ensures consistent enforcement of laws so that consumers have access to fair, transparent and competitive markets for consumer financial products and services. Since its establishment, the CFPB has exercised extensively its rulemaking and interpretative authority.
Federal law provides federal banking regulators, including the OCC, the FRB and the FDIC, with substantial enforcement powers. The enforcement authority of the OCC and the FRB over national banks and their holding companies includes, among other things, the ability to assess civil money penalties, to issue cease and desist or removal orders and to initiate injunctive actions. In general, these enforcement actions may be initiated for violations of laws and regulations and unsafe and unsound practices. Other actions or inactions may also provide the basis for enforcement action.
Regulation of the Holding Company
General. As a financial holding company, the Holding Company’s activities are subject to extensive regulation by the FRB. The Holding Company is required to file reports with the FRB and such additional information as the FRB may require, and is subject to regular examinations by the FRB. The FRB also has extensive enforcement authority over financial holding companies, including, among other things, the ability to assess civil money penalties, issue cease and desist or removal orders, and require that a financial holding company divest subsidiaries (including a subsidiary bank). In general, the FRB may initiate enforcement actions for violations of laws and regulations and unsafe or unsound practices.
Source of Strength. A financial holding company is required by law and FRB policy to act as a source of financial strength to each subsidiary bank and to commit resources to support such subsidiary bank. The FRB may require a financial holding company to contribute additional capital to an undercapitalized subsidiary bank and may disapprove of the payment of dividends to shareholders if the FRB believes the payment of such dividends would be an unsafe or unsound practice.
Prior FRB Approval. The BHCA requires the prior approval of the FRB in any case where a financial holding company proposes to:
acquire direct or indirect ownership or control of more than 5% of the voting shares of any bank that is not already majority-owned by the financial holding company;
acquire all or substantially all of the assets of another bank or another financial or bank holding company; or
merge or consolidate with any other financial or bank holding company.
In April 2020, the FRB adopted a final rule to revise its regulations related to determinations of whether a company has the ability to exercise a controlling influence over another company for purposes of the BHCA. The final rule expands and codifies the presumptions for use in such determinations. By codifying the presumptions, the final rule provides greater transparency on the types of relationships that the FRB generally views as supporting a facts-and-circumstances determination that one company controls another company. The FRB’s final rule applies to questions of control under the BHCA, but does not extend to the Change in Bank Control Act.
Financial Holding Company Status. A qualifying bank holding company may elect to become a financial holding company and thereby affiliate with securities firms and insurance companies and engage in other activities that are financial in nature and not otherwise permissible for a bank holding company, if the holding company is “well managed” and “well capitalized” and each of its subsidiary banks is well capitalized under the Federal Deposit Insurance Corporation Act of 1991 prompt corrective action provisions, is well managed, and has at least a satisfactory rating under the Community Reinvestment Act (the “CRA”). The Holding Company became a financial holding company effective as of December 1, 2016.
No regulatory approval is required for a financial holding company to acquire a company, other than a bank or savings association, engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the FRB. The Financial Services Modernization Act defines “financial in nature” to include:
securities underwriting, dealing and market making;
sponsoring mutual funds and investment companies;
insurance underwriting and agency;
merchant banking; and
activities that the FRB has determined to be closely related to banking.
15
Table of Contents
A national bank also may engage, subject to limitations on investment, in activities that are financial in nature, other than insurance underwriting, insurance company portfolio investment, real estate development and real estate investment, through a financial subsidiary of the bank, if the bank is well capitalized and well managed and has at least a satisfactory CRA rating. If a financial holding company or a subsidiary bank fails to maintain all requirements for the holding company to maintain financial holding company status, material restrictions may be placed on the activities of the financial holding company and its subsidiaries and on the ability of the holding company to enter into certain transactions and obtain regulatory approvals for new activities and transactions. The financial holding company could also be required to divest of subsidiaries that engage in activities that are not permitted for bank holding companies that are not financial holding companies. If restrictions are imposed on the activities of a financial holding company, the existence of such restrictions may not be made publicly available pursuant to confidentiality regulations of the bank regulatory agencies.
Each subsidiary bank of a financial holding company is subject to certain restrictions on the maintenance of reserves against deposits, extensions of credit to the financial holding company or any of its subsidiaries, investments in the stock or other securities of the financial holding company or its subsidiaries and the taking of such stock or securities as collateral for loans to any borrower. Further, a financial holding company and its subsidiaries are prohibited from engaging in certain tying arrangements in connection with any extension of credit, lease or sale of property or furnishing of any services. Various consumer laws and regulations also affect the operations of these subsidiaries.
Economic Growth, Regulatory Relief and Consumer Protection Act
On May 25, 2018, the Economic Growth, Regulatory Relief and Consumer Protection Act (the "Regulatory Relief Act") was signed into law. The Regulatory Relief Act repealed or modified certain provisions of the Dodd-Frank Act and eased restrictions on all but the largest banks (those with consolidated assets in excess of $250 billion). Bank holding companies with consolidated assets of less than $100 billion, including the Company, are no longer subject to enhanced prudential standards. The Regulatory Relief Act also relieves bank holding companies and banks with consolidated assets of less than $100 billion, including the Company, from certain record-keeping, reporting and disclosure requirements. Certain other regulatory requirements applied only to banks with consolidated assets in excess of $50 billion and so did not apply to the Company even before the enactment of the Regulatory Relief Act.
Transactions with Affiliates, Directors, Executive Officers and Shareholders
Sections 23A and 23B of the Federal Reserve Act and FRB Regulation W generally:
limit the extent to which a bank or its subsidiaries may engage in “covered transactions” with any one affiliate;
limit the extent to which a bank or its subsidiaries may engage in “covered transactions” with all affiliates; and
require that all such transactions be on terms (including interest rates charged and collateral required) substantially the same, or at least as favorable to the bank or subsidiary, as those provided to a non-affiliate.
An affiliate of a bank is any company or entity which controls, is controlled by or is under common control with the bank. The term “covered transaction” includes the making of loans to an affiliate, the purchase of assets from an affiliate, the issuance of a guarantee on behalf of an affiliate, the purchase of securities issued by an affiliate and other similar types of transactions with an affiliate.
A bank’s authority to extend credit to executive officers, directors and greater than 10% shareholders, as well as entities such persons control, is subject to Sections 22(g) and 22(h) of the Federal Reserve Act and Regulation O promulgated thereunder by the FRB. Among other things, these loans must be made on terms (including interest rates charged and collateral required) substantially the same as those offered to unaffiliated individuals or be made as part of a benefit or compensation program and on terms widely available to employees, and must not involve a greater than normal risk of repayment. In addition, the amount of loans a bank may make to these persons is based, in part, on the bank’s capital position, and specified approval procedures must be followed in making loans which exceed specified amounts.
Regulation of CFBank
General. CFBank, as a national bank, is subject to regulation, periodic examination, enforcement authority and oversight by the OCC extending to all aspects of CFBank’s operations. OCC regulations govern permissible activities, capital requirements, dividend limitations, investments, loans and other matters. CFBank also is subject to regulation and examination by the FDIC, which insures the deposits of CFBank to the maximum extent permitted by law. Furthermore, CFBank is subject, as a member bank, to certain rules and regulations of the FRB, many of which restrict activities and prescribe documentation to protect consumers. In addition, the establishment of branches by CFBank is subject to prior approval of the OCC. The OCC has broad enforcement powers over national banks, including the power to impose fines and other civil and criminal penalties and to appoint a conservator or receiver if any of a number of conditions are met.
16
Table of Contents
The CFPB regulates consumer financial products and services provided by CFBank through interpretations designed to protect consumers.
Regulatory Capital. National banks are required to maintain a minimum level of regulatory capital. The OCC has adopted risked-based capital guidelines for national banks, which guidelines include both a definition of capital and a framework for calculating risk weighted assets by assigning assets and off-balance-sheet items to broad risk categories.
In July 2013, the United States banking regulators issued new capital rules applicable to smaller banking organizations which also implement certain of the provisions of the Dodd-Frank Act (the “Basel III Capital Rules”). Community banking organizations, including CFBank, began transitioning to the new rules on January 1, 2015. The new minimum capital requirements became effective on January 1, 2015, whereas a new capital conservation buffer and deductions from common equity capital phased in from January 1, 2016 through January 1, 2019, and most deductions from common equity tier 1 capital were phased in from January 1, 2015 through January 1, 2019.
The Basel III Capital Rules include (a) a minimum common equity tier 1 capital ratio of 4.5%, (b) a minimum Tier 1 capital ratio of 6.0%, (c) a minimum total capital ratio of 8.0%, and (d) a minimum leverage ratio of 4.0%.
Common equity for the common equity tier 1 capital ratio generally includes common stock (plus related surplus), retained earnings, accumulated other comprehensive income (unless an institution elects to exclude such income from regulatory capital), and limited amounts of minority interests in the form of common stock, subject to applicable regulatory adjustments and deductions.
Tier 1 capital generally includes common equity as defined for the common equity tier 1 capital ratio, plus certain non-cumulative preferred stock and related surplus, cumulative preferred stock and related surplus and trust preferred securities that have been grandfathered (but which are not permitted going forward), and limited amounts of minority interests in the form of additional Tier 1 capital instruments, less certain deductions.
Tier 2 capital, which can be included in the total capital ratio, generally consists of other preferred stock and subordinated debt meeting certain conditions plus limited amounts of the allowance for credit losses, subject to specified eligibility criteria, less applicable deductions.
The deductions from common equity tier 1 capital include goodwill and other intangibles, certain deferred tax assets, mortgage-servicing assets above certain levels, gains on sale in connection with a securitization, investments in a banking organization’s own capital instruments and investments in the capital of unconsolidated financial institutions (above certain levels).
Under the guidelines, capital is compared to the relative risk related to the balance sheet. To derive the risk included in the balance sheet, one of several risk weights is applied to different balance sheet and off-balance sheet assets, primarily based on the relative credit risk of the counterparty. The capital amounts and classification are also subject to qualitative judgments by the regulators about components, risk weightings and other factors.
The Basel III Capital Rules also place restrictions on the payment of capital distributions, including dividends, and certain discretionary bonus payments to executive officers if the banking organization does not hold a capital conservation buffer of greater than 2.5 percent composed of common equity tier 1 capital above its minimum risk-based capital requirements, or if its eligible retained income is negative in that quarter and its capital conservation buffer ratio was less than 2.5 percent at the beginning of the quarter.
In September 2019, the FRB, along with other federal bank regulatory agencies, issued a final rule, effective January 1, 2020, that gave community banks, including CFBank, the option to calculate a simple leverage ratio to measure capital adequacy if the community banks met certain requirements. Under the rule, a community bank is eligible to elect the Community Bank Leverage Ratio ("CBLR") framework if it had less than $10 billion in total consolidated assets, limited amounts of certain assets and off-balance sheet exposures, and a leverage ratio greater than 9.0%. Qualifying institutions that elected to use the CBLR framework (each, a “CBLR Bank”) and that maintain a leverage ratio of greater than 9.0% will be considered to have satisfied the risk-based and leverage capital requirements in the regulatory agencies' generally applicable capital rules and to have met the well-capitalized ratio requirements. No CBLR Bank was required to calculate or report risk-based capital, and each CBLR Bank could opt out of the framework at any time, without restriction, by reverting to the generally applicable risk-based capital rule. Pursuant to the Coronavirus Aid, Relief, and Economic Security Act of 2020, as amended (“CARES Act”), on August 26, 2020, the federal banking agencies adopted a final rule that temporarily lowered the CBLR threshold and provided a gradual transition back to the prior level. Specifically, the CBLR threshold was reduced to 8.0% for the remainder of 2020, increased to 8.5% for 2021, and returned to 9.0% on January 1, 2022. This final rule became effective on October 1, 2020. The Company does not utilize the CBLR in assessing capital adequacy and, instead, continues to follow existing capital rules.
In December 2018, the federal banking agencies issued a final rule to address regulatory capital treatment of credit loss allowances under the CECL model (accounting standard). The rule revises the federal banking agencies’ regulatory capital rules to identify which
17
Table of Contents
credit loss allowances under the CECL model are eligible for inclusion in regulatory capital and to provide banking organizations the option to phase in over three years the day-one adverse effects on regulatory capital that may result from the adoption of the CECL model.
The federal banking agencies have established a system of prompt corrective action to resolve certain of the problems of undercapitalized institutions. This system is based on five capital level categories for insured depository institutions: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” and “critically undercapitalized.”
The federal banking agencies may (or in some cases must) take certain supervisory actions depending upon a bank’s capital level. For example, the banking agencies must appoint a receiver or conservator for a bank within 90 days after the bank becomes “critically undercapitalized” unless the bank’s primary regulator determines, with the concurrence of the FDIC, that other action would better achieve regulatory purposes. Banking operations otherwise may be significantly affected depending on a bank’s capital category. For example, a bank that is not “well capitalized” generally is prohibited from accepting brokered deposits and offering interest rates on deposits higher than the prevailing rate in its market, and the holding company of any undercapitalized depository institution must guarantee, in part, specific aspects of the bank’s capital plan for the plan to be acceptable.
In order to be “well-capitalized”, a bank must have a common equity tier I capital ratio of at least 6.5%, a total risk-based capital of at least 10.0%, a Tier 1 risk-based capital ratio of at least 8.0% and a leverage ratio of at least 5.0%, and the bank must not be subject to any written agreement, order, capital directive or prompt corrective action directive to meet and maintain a specific capital level for any capital measure. The Company’s management believes that CFBank met the ratio requirements to be deemed “well-capitalized” according to the guidelines described above as of December 31, 2024.
The Holding Company currently qualifies under the FRB’s Small Bank Holding Company Policy Statement for exemption from the FRB’s consolidated risk-based capital and leverage rules at the holding company level. In April 2015, the FRB issued a final rule which increased the size limitation for qualifying bank holding companies under the Small Bank Holding Company Policy Statement from $500 million to $1 billion of total consolidated assets. In August 2018, the FRB issued an interim final rule, as required by the Regulatory Relief Act, to further increase the size limitation under the Small Bank Holding Company Policy Statement to $3 billion of total consolidated assets.
FDIC Regulation and Insurance of Accounts. CFBank’s deposits are insured up to the applicable limits by the FDIC, and such insurance is backed by the full faith and credit of the United States Government. The general deposit insurance limit is $250,000 per separately insured depositor. As insurer, the FDIC imposes deposit insurance premiums and is authorized to conduct examinations of and to require reporting by FDIC-insured institutions, to prohibit any insured institution from engaging in any activity the FDIC determines to pose a threat to the DIF, and to take enforcement actions against insured institutions. The FDIC may terminate insurance of deposits of any insured institution if the FDIC finds that the insured institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC or any other regulatory agency.
The FDIC assesses quarterly deposit insurance premiums on each insured institution based on risk characteristics of the insured institution and may also impose special assessments in emergency situations. The premiums fund the DIF. Pursuant to the Dodd-Frank Act, the FDIC has established 2.0% as the designated reserve ratio (“DRR”), which is the amount in the DIF as a percentage of all DIF insured deposits. In March 2016, the FDIC adopted final rules designed to meet the statutory minimum DRR of 1.35% by September 30, 2020, the deadline imposed by the Dodd-Frank Act. The Dodd-Frank Act requires the FDIC to offset the effect on insured institutions with assets of less than $10 billion of the increase in the statutory minimum DRR to 1.35% from the former statutory minimum of 1.15%. Although the FDIC's rules reduced assessment rates on all banks, they imposed a surcharge on banks with assets of $10 billion or more to be paid until the DRR reached 1.35%. The DRR met the statutory minimum of 1.35% on September 30, 2018. As a result, the previous surcharge imposed on banks with assets of $10 billion or more was lifted. In addition, preliminary assessment credits have been determined by the FDIC for banks with assets of less than $10 billion, which had previously contributed to the increase of the DRR to 1.35%. On June 30, 2019, the DRR reached 1.40%, and the FDIC applied credits for banks with assets of less than $10 billion ("small bank credits") beginning September 30, 2019. As of June 30, 2021, the DRR fell below the minimum DRR to 1.30%. As a result, the FDIC adopted a restoration plan requiring the restoration of the DRR to 1.35% within eight years (September 30, 2028). The FDIC rules further changed the method of determining risk-based assessment rates for established banks with less than $10 billion in assets to better ensure that banks taking on greater risks pay more for deposit insurance than banks that take on less risk. As of September 30, 2022, the DRR was 1.26%. Because the DRR remained below the statutory minimum, the FDIC adopted a final rule in October 2022 increasing the assessment rate from three basis points to five basis points beginning with the first quarterly assessment period of 2023. In the FDIC’s most recent semiannual update for the amended restoration plan in October 2024, the FDIC noted the reserve ratio increased 6 basis points from 1.15% as of December 31, 2023, to 1.21% as of June 30, 2024. The FDIC staff projected that the reserve ratio remains on track to reach the statutory minimum of 1.35% ahead of the deadline of September 30, 2028. As a result, the FDIC staff recommended no changes to the amended restoration plan and all scheduled assessment rates were maintained.
18
Table of Contents
Limitations on Dividends and Other Capital Distributions. Banking regulations impose various restrictions on distributions of capital, which include dividends, stock redemptions or repurchases, cash-out mergers and other transactions charged to the capital account.
Generally, for national banks such as CFBank, it is required that before and after the proposed distribution the institution remain well-capitalized. National banks may make capital distributions during any calendar year equal to the greater of 100% of net income for the year-to-date plus retained net income for the two preceding years. However, an institution deemed to be in need of more than normal supervision by the OCC may have its dividend authority restricted by the OCC. In addition, to the extent that a national bank has a negative accumulated deficit, any distributions or dividends by the bank are subject to prior non-objection by the OCC.
The ability of the Holding Company to pay dividends on its common stock is dependent upon the amount of cash and liquidity available at the Holding Company level, as well as the receipt of dividends and other distributions from CFBank to the extent necessary to fund such dividends. As of December 31, 2024, the Holding Company had a total of $1.0 million of cash at the Holding Company level.
The Holding Company also is subject to various legal and regulatory policies and requirements impacting the Holding Company’s ability to pay dividends on its stock. In addition, the Holding Company’s ability to pay dividends on its stock is conditioned upon the payment, on a current basis, of quarterly interest payments on the subordinated debentures underlying the Company’s trust preferred securities. Finally, under the terms of the Company’s fixed-to-floating rate subordinated debt, the Holding Company’s ability to pay dividends on its stock is conditioned upon the Holding Company continuing to make required principal and interest payments, and not incurring an event of default, with respect to the subordinated debt. See Note 16, Regulatory Capital Matters, in the accompanying Notes to Consolidated Financial Statements for additional information.
Federal income tax laws provided deductions, totaling $2.3 million, for the Company’s thrift bad debt reserves established before 1988. Accounting standards do not require a deferred tax liability to be recorded on this amount, which otherwise would total $473,000 at year-end 2024. However, if CFBank were wholly or partially liquidated or otherwise ceases to be a bank, or if tax laws were to change, this amount would have to be recaptured and a tax liability recorded. Additionally, any distributions in excess of CFBank’s current or accumulated earnings and profits would reduce amounts allocated to its bad debt reserve and create a tax liability for CFBank.
Federal Reserve System
The Federal Reserve Board requires all depository institutions to maintain reserves at specified levels against their transaction accounts, primarily checking accounts. In response to the COVID-19 pandemic, the Federal Reserve Board reduced reserve requirement ratios to 0% effective on March 26, 2020, to support lending to households and businesses. The reserve requirement ratio remained at 0% as of December 31, 2024.
Federal Home Loan Bank
The Federal Home Loan Banks (“FHLBs”) provide credit to their members in the form of advances. CFBank is a member of the FHLB of Cincinnati. As an FHLB member, CFBank must maintain an investment in the capital stock of the FHLB of Cincinnati.
Upon the origination or renewal of a loan or advance, each FHLB is required by law to obtain and maintain a security interest in certain types of collateral. Each FHLB is required to establish standards of community investment or service that its members must maintain for continued access to long-term advances from the FHLB. The standards take into account a member’s performance under the CRA and the member’s record of lending to first-time home buyers.
Community Reinvestment Act
The CRA requires CFBank’s primary federal regulatory agency, the OCC, to assess CFBank’s record in meeting the credit needs of the communities it serves. The OCC assigns one of four ratings: outstanding, satisfactory, needs to improve or substantial noncompliance. The rating assigned to a financial institution is considered in connection with various applications submitted by the financial institution or its holding company to its banking regulators, including applications to acquire another financial institution or to open or close a branch office. In addition, all subsidiary banks of a financial holding company must maintain a satisfactory or outstanding rating in order for the financial holding company to avoid limitations on its activities.
On October 24, 2023, the federal banking agencies, including the OCC, issued a final rule designed to strengthen and modernize the regulations implementing the CRA. The changes are designed to encourage banks to expand access to credit, investment and banking services in low- and moderate-income communities, adapt to changes in the banking industry, including mobile and internet banking, provide greater clarity and consistency in the application of the CRA regulations, and tailor CRA evaluations and data collection to bank size and type. The applicability date for the majority of the changes to the CRA regulations is January 1, 2026, and additional
19
Table of Contents
requirements will be applicable on January 1, 2027. The Company cannot predict the impact the changes to the CRA will have on its operations at this time.
In March 2023, CFBank’s primary federal regulator, the OCC, publicly released its CRA rating of “Needs to Improve” for CFBank as a result of the OCC’s regularly scheduled evaluation covering 2020 through 2022. The Company believes that the “Needs to Improve” rating was primarily attributable to CFBank’s legacy direct-to-consumer residential mortgage business. Beginning in 2021, CFBank strategically scaled down its residential mortgage business and exited the direct-to-consumer mortgage business in favor of lending in our regional markets. The Company believes that this change in our residential mortgage business and focus, together with changes in our branch network and other actions taken since 2021, have remediated these legacy issues. While CFBank’s CRA rating remains “Needs to Improve,” the Company is subject to additional requirements and conditions with respect to certain activities, including acquisitions of and mergers with other financial institutions and commencement of new activities. CFBank’s next CRA evaluation is expected to commence in 2026.
Consumer Protection Laws and Regulations
Banks are subject to regular examination to ensure compliance with federal consumer protection statutes and regulations, including, but not limited to, the following:
The Equal Credit Opportunity Act (prohibiting discrimination in any credit transaction on the basis of any of various criteria);
The Truth in Lending Act (requiring that credit terms are disclosed in a manner that permits a consumer to understand and compare credit terms more readily and knowledgeably);
The Fair Housing Act (making it unlawful for a lender to discriminate in its housing-related lending activities against any person on the basis of certain criteria);
The Home Mortgage Disclosure Act (requiring financial institutions to collect data that enables regulatory agencies to determine whether financial institutions are serving the housing credit needs of the communities in which they are located); and
The Real Estate Settlement Procedures Act (requiring that lenders provide borrowers with disclosures regarding the nature and cost of real estate settlements and prohibits abusive practices that increase borrowers’ costs).
The banking regulators also use their authority under the Federal Trade Commission Act to take supervisory or enforcement action with respect to unfair or deceptive acts or practices by banks that may not necessarily fall within the scope of a specific banking or consumer finance law.
Patriot Act and Anti-Money Laundering
In response to the terrorist events of September 11, 2001, the Uniting and Strengthening of America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (the “Patriot Act”) was signed into law in October 2001. The Patriot Act gives the United States government powers to address terrorist threats through enhanced domestic security measures, expanded surveillance powers, increased information sharing and broadened anti-money laundering requirements. Title III of the Patriot Act takes measures intended to encourage information sharing among bank regulatory agencies and law enforcement bodies. Further, certain provisions of Title III impose affirmative obligations on a broad range of financial institutions. Among other requirements, Title III and related regulations require regulated financial institutions to establish a program specifying procedures for obtaining identifying information from customers seeking to open new accounts and establish enhanced due diligence policies, procedures and controls designed to detect and report suspicious activity. CFBank has established policies and procedures that are believed to be compliant with the requirements of the Patriot Act.
The Anti-Money Laundering Act of 2020 (the “AMLA”), which amends the Bank Secrecy Act of 1970 (the “BSA”), was enacted in January 2021. The AMLA is intended to be a comprehensive reform and modernization to U.S. bank secrecy and anti-money laundering laws. Among other things, it codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the development of standards for evaluating technology and internal processes for BSA compliance; expands enforcement-related and investigation-related authority, including increasing available sanctions for certain BSA violations and instituting BSA whistleblower initiatives and protections.
Office of Foreign Assets Control Regulation
The U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”) administers and enforces economic and trade sanctions against targeted foreign countries and regimes, under authority of various laws, including designated foreign countries, nationals and others. OFAC publishes lists of specially designated targets and countries. CFBank is responsible for, among other things, blocking accounts of, and transactions with, such targets and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence. Failure to comply with these sanctions could have serious financial, legal and reputational consequences, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions
20
Table of Contents
when regulatory approval is required or to prohibit such transactions even if approval is not required. Regulatory authorities have imposed cease and desist orders and civil money penalties against institutions found to be violating these obligations.
Corporate Governance
As mandated by the Sarbanes-Oxley Act of 2002, the SEC has adopted rules and regulations governing, among other issues, corporate governance, auditing and accounting, executive compensation and enhanced and timely disclosure of corporate information. The Nasdaq Stock Market has also adopted corporate governance rules. The Board of Directors of the Company has taken a series of actions to strengthen and improve the Company’s already strong corporate governance practices in light of the rules of the SEC and Nasdaq. The Board of Directors has adopted charters for the Board’s various committees, including the Audit Committee, the Compensation Committee, and the Corporate Governance and Nominating Committee, as well as a Code of Ethics and Business Conduct governing the directors, officers and employees of the Company.
Executive and Incentive Compensation
The Dodd-Frank Act requires that the federal banking agencies, including the FRB and the OCC, issue a rule related to incentive-based compensation. No final rule implementing this provision of the Dodd-Frank Act has, as of the date of the filing of this Annual Report on Form 10-K, been adopted, but a proposed rule was published in 2016, and again in 2024, that expanded upon a prior proposed rule published in 2011. The proposed rule is intended to: (i) prohibit incentive-based payment arrangements that the banking agencies determine could encourage certain financial institutions to take inappropriate risks by providing excessive compensation or that could lead to material financial loss; (ii) require the board of directors of those financial institutions to take certain oversight actions related to incentive-based compensation; and (iii) require those financial institutions to disclose information concerning incentive-based compensation arrangements to the appropriate federal regulator. Although a final rule has not been issued, the Company has undertaken efforts to ensure that the Company’s incentive compensation plans do not encourage inappropriate risks, consistent with the principles identified above.
In June 2010, the FRB, the OCC and the FDIC issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization's incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization's ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management and (iii) be supported by strong corporate governance, including active and effective oversight by the organization's board of directors. These three principles are incorporated into the proposed joint compensation regulations under the Dodd-Frank Act, described above.
The FRB and the OCC review, as part of their respective regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as the Holding Company and CFBank, that are not “large, complex banking organizations.” These reviews are tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. Deficiencies will be incorporated into the organization's supervisory ratings, which can affect the organization's ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization's safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.
Pursuant to rules adopted by the stock exchanges and approved by the SEC in January 2013 under the Dodd-Frank Act, public company compensation committee members must meet heightened independence requirements and consider the independence of compensation consultants, legal counsel and other advisors to the compensation committee. A compensation committee must have the authority to hire advisors and to have the public company fund reasonable compensation of such advisors.
Following the adoption of additional listing requirements in 2023 to comply with the Dodd-Frank Act and rules adopted by the SEC in October 2022, public companies are now required to adopt and implement “clawback” policies for incentive compensation payments and to disclose the details of the procedures which allow recovery of incentive compensation that was paid on the basis of erroneous financial information necessitating a restatement due to material noncompliance with financial reporting requirements. This clawback policy is intended to apply to compensation paid within the three completed fiscal years immediately preceding the date the issuer is required to prepare a restatement and would cover all executives who received incentive awards. The Company adopted its Clawback policy effective November 29, 2023.
SEC regulations require public companies such as the Holding Company to provide various disclosures about executive compensation in annual reports and proxy statements and to present to their shareholders a non-binding vote on the approval of executive compensation.
21
Table of Contents
Financial Privacy Provisions
Federal and state regulations limit the ability of banks and other financial institutions to disclose non-public information about consumers to non-affiliated third parties. These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a non-affiliated third party. These regulations affect how consumer information is transmitted through diversified financial companies and conveyed to outside vendors.
CFBank is also subject to regulatory guidelines establishing standards for safeguarding customer information. These guidelines describe the federal bank regulatory agencies' expectations for the creation, implementation and maintenance of an information security program, which would include administrative, technical and physical safeguards appropriate to the size and complexity of the institution and the nature and scope of its activities. The standards set forth in the guidelines are intended to ensure the security and confidentiality of customer records and information, protect against any anticipated threats or hazards to the security or integrity of such records and protect against unauthorized access to or use of such records or information that could result in substantial harm or inconvenience to any customer.
Cybersecurity
In March 2015, federal regulators issued two related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish several lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing Internet-based services of the financial institution. The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the financial institution’s operations after a cyber attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the financial institution or its critical service providers fall victim to this type of cyber-attack. If CFBank fails to observe the regulatory guidance, it could be subject to various regulatory sanctions, including financial penalties.
In February 2018, the SEC published interpretive guidance to assist public companies in preparing disclosures about cybersecurity risks and incidents. These SEC guidelines, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations.
In November 2021, the OCC, the FRB and the FDIC issued a final rule, which became effective in May, 2022, requiring banking organizations that experience a computer-security incident to notify certain entities. A computer-security incident occurs when actual or potential harm to the confidentiality, integrity, or availability of an information system or the information occurs, or there is a violation or imminent threat of a violation to banking security policies and procedures. The affected bank must notify its respective federal regulator of the computer-security incident as soon as possible and no later than 36 hours after the bank determines a computer-security incident that rises to the level of a notification event has occurred. These notifications are intended to promote early awareness of threats to banking organizations and will help banks react to those threats before they manifest into larger incidents. This rule also requires bank service providers to notify their bank organization customers of a computer-security incident that has caused, or is reasonably likely to cause, a material service disruption or degradation.
Furthermore, the Cyber Incident Reporting for Critical Infrastructure Act, enacted in March 2022, will require, once administrative rules are adopted, certain covered entities, including those in the financial services industry, to report a covered cyber incident to the U.S. Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency (“CISA”) within 72 hours after it reasonably believes an incident has occurred. Separate reporting to CISA will also be required within 24 hours if a ransom payment is made as a result of a ransomware attack.
On July 26, 2023, the SEC adopted final rules that require public companies to promptly disclose material cybersecurity incidents in a Current Report on Form 8-K and detailed information regarding their cybersecurity risk management, strategy, and governance on an annual basis in an Annual Report on Form 10-K. Companies are required to report on Form 8-K any cybersecurity incident they determine to be material within four business days of making that determination. See Item 1C. “Cybersecurity” in Part I of this Form 10-K. These SEC rules, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations.
State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. The Company expects this trend of state-level activity in those areas to continue, and is continually monitoring developments in the states in which our customers are located.
In the ordinary course of business, the Company relies on electronic communications and information systems to conduct its operations and to store sensitive data. The Company employs significant resources, processes and technology to manage and maintain
22
Table of Contents
cybersecurity controls. The Company employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of the Company’s defensive measures, the threat from cyber attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. Although to date the Company has not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, the Company’s systems and those of its customers and third-party service providers are under constant threat and it is possible that the Company could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our customers.
Effect of Environmental Regulation
Compliance with federal, state and local provisions regulating the discharge of materials into the environment, or otherwise relating to the protection of the environment, has not had a material effect upon the capital expenditures, earnings or competitive position of the Company. In the opinion of management, the Company does not have exposure to material costs associated with compliance with environmental laws and regulations or material expenditures related to environmental hazardous waste mitigation or cleanup.
The Company believes its primary exposure to environmental risk is through the lending activities of CFBank. In cases where management believes environmental risk potentially exists, CFBank mitigates its environmental risk exposure by requiring environmental site assessments at the time of loan origination to confirm collateral quality as to commercial real estate parcels posing higher than normal potential for environmental impact, as determined by reference to present and past uses of the subject property and adjacent sites. In addition, environmental assessments are typically required prior to any foreclosure activity involving non-residential real estate collateral.
Federal and State Taxation
Federal Taxation General.We report income on a calendar year, consolidated basis using the accrual method of accounting, and we are subject to federal income taxation in the same manner as other corporations, with some exceptions discussed below. The following discussion of tax matters is intended only as a summary and does not purport to be a comprehensive description of the tax rules applicable to the Company and CFBank.
Our deferred tax assets are composed of U.S. net operating losses (“NOLs”), and other temporary book to tax differences. When determining the amount of deferred tax assets that are more-likely-than-not to be realized, and therefore recorded as a benefit, the Company conducts a regular assessment of all available information. This information includes, but is not limited to, taxable income in prior periods, projected future income and projected future reversals of deferred tax items. Based on these criteria, the Company determined as of December 31, 2024 that no valuation allowance was required against the net deferred tax asset.
In 2012, a recapitalization program through the sale of $22.5 million in common stock improved the capital levels of CFBank and provided working capital for the Holding Company. The result of the change in stock ownership associated with the stock offering, however, was that the Company incurred an ownership change within the guidelines of Section 382 of the Internal Revenue Code of 1986. At year-end 2023, the Company had net operating loss carryforwards of $21.9 million, which expire at various dates from 2024 to 2032. As a result of the ownership change, the Company's ability to utilize carryforwards that arose before the 2012 stock offering closed is limited to $163,000 per year. Due to this limitation, management determined it is more likely than not that $20.5 million of net operating loss carryforwards will expire unutilized. As required by accounting standards, the Company reduced the carrying value of deferred tax assets, and the corresponding valuation allowance, by the $7.0 million tax effect of this lost realizability.
Federal income tax laws provided additional deductions, totaling $2.3 million, for thrift bad debt reserves established before 1988. Accounting standards do not require a deferred tax liability to be recorded on this amount, which otherwise would have totaled $473,000 at year-end 2024. However, if CFBank were wholly or partially liquidated or otherwise ceases to be a bank, or if tax laws were to change, this amount would have to be recaptured and a tax liability recorded. Additionally, any distributions in excess of CFBank’s current or accumulated earnings and profits would reduce amounts allocated to its bad debt reserve and create a tax liability for CFBank. See Note 13 in the accompanying Notes to Consolidated Financial Statements for additional information.
Distributions. Under the Small Business Job Protection Act of 1996, if CFBank makes “non-dividend distributions” to the Company, such distributions will be considered to have been made from CFBank’s unrecaptured tax bad debt reserves (including the balance of its reserves as of December 31, 1987) to the extent thereof, and then from CFBank’s supplemental reserve for losses on loans, to the extent thereof, and an amount based on the amount distributed (but not in excess of the amount of such reserves) will be included in CFBank’s taxable income. Non-dividend distributions include distributions in excess of CFBank’s current and accumulated earnings and profits, as calculated for federal income tax purposes, distributions in redemption of stock, and distributions in partial or complete liquidation. Dividends paid out of CFBank’s current or accumulated earnings and profits will not be so included in CFBank’s taxable income.
23
Table of Contents
Ohio Taxation
The consolidated organization is subject to the Ohio Financial Institutions Tax (“Ohio FIT”). The Ohio FIT is a business privilege tax for financial institutions doing business or domiciled in the State of Ohio. The three-tier structure charges financial institutions based on total capital at the prior calendar year-end based on regulatory reporting requirements.
Indiana Taxation
The consolidated organization is subject to the Indiana Financial Institution Tax (“Indiana FIT”). The Indiana FIT is a franchise tax measured by a taxpayer's apportioned income imposed on corporations for the privilege of exercising their franchise or transacting the business of a financial institution in Indiana.
Delaware Taxation
As a Delaware corporation not earning income in Delaware, the Company is exempted from Delaware corporate income tax, but is required to file an annual report with and pay an annual franchise tax to the State of Delaware.
Available Information
Our website address is www.CF.Bank (this uniform resource locator, or URL, is an inactive textual reference only and is not intended to incorporate our website into this Form 10-K). We make available free of charge through our website our annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and any amendments to these reports as soon as reasonably practicable after we electronically file such reports with the SEC. These reports can be found on our website under the caption “Investor – SEC Filings.” Investors also can obtain copies of our filings from the SEC website at www.sec.gov.
Item 1A. Risk Factors.
The following are certain risk factors that could impact our business, financial condition and/or results of operations. Investing in our common stock involves risks, including those described below. These risk factors should be considered by prospective and current investors in our common stock when evaluating the disclosures contained in this Form 10-K and in other reports that we file with the SEC. These risk factors could cause actual results and conditions to differ materially from those projected in forward-looking statements. If any of the events described in the following risk factors actually occur, or if additional risks and uncertainties not presently known to us or that we believe are immaterial do materialize, then our business, financial condition and/or results of operations could be materially adversely impacted. In addition, the trading price of our common stock could decline due to any of the events described in these risk factors.
Economic, Market and Political Risks
Changes in economic and political conditions could adversely affect our earnings through declines in deposits, loan demand, the ability of our customers to repay loans and the value of the collateral securing our loans.
Our success depends to a significant extent upon local and national economic and political conditions, as well as governmental fiscal and monetary policies. Conditions such as inflation, recession, unemployment, changes in interest rates, fiscal and monetary policy, an increasing federal government budget deficit, the failure of the federal government to raise the federal debt ceiling and/or possible future U.S. government shutdowns over budget disagreements, slowing gross domestic product, tariffs, a U.S. withdrawal from or significant renegotiation of trade agreements, trade wars, and other factors beyond our control may adversely affect CFBank’s deposit levels and composition, the quality of investment securities available for purchase, demand for loans, the ability of CFBank’s borrowers to repay their loans, and the value of the collateral securing loans made by CFBank. The ongoing political turmoil and military conflict in Ukraine and the Middle East are likely to result in substantial changes in economic and political conditions for the U.S. and the remainder of the world. Disruptions in U.S. and global financial markets, and changes in oil production and supply in the Middle East and Russia, also affect the economy and stock prices in the U.S., which can affect our earnings and/or capital, as well as the ability of our customers to repay loans.
Because we have a significant amount of real estate loans, decreases in real estate values could adversely affect the value of property used as collateral and our ability to sell the collateral upon foreclosure. Adverse changes in the economy may also have a negative effect on the ability of our borrowers to make timely repayments of their loans, which would have an adverse impact on our earnings and cash flows. Moreover, our market activities are concentrated in the following counties: Franklin County through our office in Columbus, Ohio; Delaware County through our Polaris office in Columbus, Ohio; Cuyahoga County through our office in Orange Village, Ohio and our Ohio City office in Cleveland, Ohio; Hamilton County through our offices in Blue Ash, Ohio and our Red Bank office in Cincinnati, Ohio; Summit County through our office in Fairlawn, Ohio; and Marion County, Indiana through our office in Indianapolis. Our success depends on the general economic conditions of these areas, particularly given that a significant portion of our lending relates to real estate located in these regions. Therefore, adverse changes in the economic conditions in these areas could
24
Table of Contents
adversely impact our earnings and cash flows.
Changing interest rates may decrease our earnings and asset values.
Management is unable to accurately predict future market interest rates, which are affected by many factors, including, but not limited to inflation, recession, changes in employment levels, changes in the money supply and domestic and international disorder and instability in domestic and foreign financial markets. Changes in the interest rate environment may reduce our profits. Net interest income is a significant component of our net income, and consists of the difference, or spread, between interest income generated on interest-earning assets and interest expense incurred on interest-bearing liabilities. Net interest spreads are affected by the difference between the maturities and repricing characteristics of interest-earning assets and interest-bearing liabilities. Although certain interest-earning assets and interest-bearing liabilities may have similar maturities or periods to which they reprice, they may react in different degrees to changes in market interest rates. In addition, residential mortgage loan origination and refinancing volumes are affected by market interest rates on loans. Rising interest rates generally are associated with a lower volume of loan originations and refinancings, while falling interest rates are usually associated with higher loan originations and refinancings. Our ability to generate gains on sales of mortgage loans is significantly dependent on the level of originations. Cash flows are affected by changes in market interest rates. Generally, in rising interest rate environments, loan prepayment rates are likely to decline, and in falling interest rate environments, loan prepayment rates are likely to increase. A majority of our commercial, commercial real estate and multi-family residential real estate loans are adjustable rate loans and an increase in the general level of interest rates may adversely affect the ability of some borrowers to pay the interest on and principal of their obligations, especially borrowers with loans that have adjustable rates of interest. Changes in interest rates, prepayment speeds and other factors may also cause the value of our loans held for sale to change. Accordingly, changes in levels of market interest rates could materially and adversely affect our net interest spread, loan volume, asset quality, value of loans held for sale and cash flows, as well as the market value of our securities portfolio and overall profitability.
Interest rates are highly sensitive to many factors that are beyond our control. The Company’s management uses various measures to monitor interest rate risk and believes it has implemented effective asset and liability management strategies to reduce the potential adverse effects of changes in interest rates on the Company’s financial condition and results of operations. Management also periodically adjusts the mix of assets and liabilities to manage interest rate risk. However, any significant, unexpected, prolonged change in market interest rates could have a material adverse effect on our financial condition and results of operations.
Defaults by other financial institutions could adversely affect our business, earnings and financial condition.
Many financial institutions and their related operations are closely intertwined, and the soundness of such financial institutions may, to some degree, be interdependent. Several high-profile bank failures in 2023, including Silicon Valley Bank, Signature Bank and Silvergate Capital, resulted in some degree of public panic and caused widespread questions about potential concerns in the financial institutions industry, which in turn impacted stock market prices of financial institutions in general. These failed banks were engaged in activities, such as lending focused on tech startups and cryptocurrency, that are significantly different than the activities and risk profile of community banks such as the Company, and at this time it does not appear that these bank failures were connected to any systematic risks or problems in the financial institutions industry in general. Nevertheless, concerns about, or a default or threatened default by, other financial institutions could lead to significant market-wide liquidity problems and/or losses or defaults by other financial institutions.
Risks Related to Our Lending Activities
Our allowance for credit losses may not be adequate to absorb the expected, lifetime losses in our loan portfolio.
We maintain an allowance for credit losses that is believed to be a reasonable estimate of the expected losses based on management's quarterly analysis of our loan portfolio. The determination of the allowance for credit losses requires management to make various assumptions and judgments about the collectability of CFBank’s loans, including the creditworthiness of its borrowers and the value of the real estate and other assets serving as collateral for the repayment of loans. Additional information regarding our allowance for credit losses methodology and the sensitivity of the estimates can be found in the discussion of "CECL Implementation" included in Management’s Discussion and Analysis of Financial Condition and Results of Operations in Item 7 of this Form 10-K.
Our estimation of future credit losses is susceptible to changes in economic, operating and other conditions, including changes in regulations and interest rates, which may be beyond our control, and the losses may exceed current estimates. We cannot be assured of the amount or timing of losses, nor whether the allowance for credit losses will be adequate in the future.
If our assumptions prove to be incorrect, our allowance for credit losses may not be sufficient to cover the expected losses from our loan portfolio, resulting in the need for additions to the allowance for credit losses which could have a material adverse impact on our financial condition and results of operations. In addition, bank regulators periodically review our allowance for credit losses as part of their examination process and may require management to increase the allowance or recognize further loan charge-offs based on judgments different than those of management.
25
Table of Contents
On June 16, 2016, the Financial Accounting Standards Board (“FASB”) issued Accounting Standard Update (“ASU”) 2016-13 “Financial Instruments - Credit Losses”, which replaces the incurred loss model with an expected loss model, which is referred to as the current expected credit loss (“CECL”) model, which we adopted effective January 1, 2023. Under the CECL model, we are required to use historical information, current conditions and reasonable and supportable forecasts to estimate the expected credit losses. If the methodologies and assumptions that we use in the CECL model prove to be incorrect or inadequate, the allowance for credit losses may not be sufficient, resulting in the need for additional allowance for credit losses to be established, which could have a material adverse impact on our financial condition and results of operations. Additionally, the time horizon over which we are required to estimate future credit losses expanded under CECL, which could result in increased volatility in future provisions for credit losses. We may also experience a higher or more volatile provision for credit losses due to higher levels of nonperforming loans and net charge-offs if commercial and consumer customers are unable to make scheduled loan payments. The Company’s one-time cumulative effect adjustment to the allowance for credit losses upon adoption in the first quarter of 2023 was $49,000.
Our emphasis on commercial, commercial real estate and multi-family residential real estate lending may expose us to increased lending risks.
Because payments on commercial loans are dependent on successful operation of the borrowers’ business enterprises, repayment of such loans may be subject to a greater extent to adverse conditions in the economy. Because payments on loans secured by commercial real estate properties are dependent on successful operation or management of the properties, repayment of commercial real estate loans may be subject to a greater extent to adverse conditions in the real estate market or the economy. Commercial real estate and multi-family residential mortgage loans also have larger loan balances to single borrowers or groups of related borrowers compared to single-family residential mortgage loans. Some of our borrowers also have more than one commercial real estate or multi-family residential mortgage loan outstanding with us. Additionally, some loans may be collateralized by junior liens. Consequently, an adverse development involving one or more loans or credit relationships can expose us to significantly greater risk of loss compared to an adverse development involving a single-family residential mortgage loan.
Our adjustable-rate loans may expose us to increased lending risks.
While adjustable-rate loans better offset the adverse effects of an increase in interest rates as compared to fixed-rate loans, the increased payments required of adjustable-rate loan borrowers upon an interest rate adjustment in a rising interest rate environment could cause an increase in delinquencies and defaults. The marketability of the underlying property also may be adversely affected in a rising interest rate environment. In addition, although adjustable-rate loans help make our asset base more responsive to changes in interest rates, the extent of this interest sensitivity is limited by the annual and lifetime interest rate adjustment limits.
We may be required to repurchase loans we have sold or indemnify loan purchasers under the terms of the sale agreements, which could adversely affect our liquidity, results of operations and financial condition.
When we sell a mortgage loan, we may agree to repurchase or substitute a mortgage loan if we are later found to have breached any representation or warranty we made about the loan or if the borrower is later found to have committed fraud in connection with the origination of the loan. While we have underwriting policies and procedures designed to avoid breaches of representations and warranties as well as borrower fraud, there can be no assurance that no breach or fraud will ever occur. Required repurchases, substitutions or indemnifications could have an adverse effect on our liquidity, results of operations and financial condition.
We depend upon the accuracy and completeness of information about customers and counterparties.
In deciding whether to extend credit or enter into other transactions with customers and counterparties, we may rely on information provided to us by customers and counterparties, including financial statements and other financial information. We may also rely on representations of customers and counterparties as to the accuracy and completeness of that information and, with respect to financial statements, on reports of independent auditors. For example, in deciding whether to extend credit to a business, we may assume that the customer’s audited financial statements conform with GAAP and present fairly, in all material respects, the financial condition, results of operations and cash flows of the customer. We may also rely on the audit report covering those financial statements. Our financial condition, results of operations and cash flows could be negatively impacted to the extent that we rely on financial statements that do not comply with GAAP or on financial statements and other financial information that are materially misleading.
Our business and financial results are subject to risks associated with the creditworthiness of our customers and counterparties.
Credit risk is inherent in the financial services business and results from, among other things, extending credit to customers, purchasing securities, and entering into financial derivative transactions and certain guarantee contracts. Credit risk is one of our most significant risks, particularly given the high percentage of our assets represented directly or indirectly by loans, and the importance of lending to our overall business. We manage credit risk by assessing and monitoring the creditworthiness of our customers and counterparties and by diversifying our loan portfolio. Many factors impact credit risk.
26
Table of Contents
A borrower’s ability to repay a loan can be adversely affected by individual factors, such as business performance, job losses or health issues. A weak or deteriorating economy and changes in the United States or global markets also could adversely impact the ability of our borrowers to repay outstanding loans. Any decrease in our borrowers’ ability to repay loans would result in higher levels of nonperforming loans, net charge-offs, and provision for loan losses.
Despite maintaining a diversified loan portfolio, in the ordinary course of business, we may have concentrated credit exposure to a particular person or entity, industry, region or counterparty. Events adversely affecting specific customers, industries, regions or markets, a decrease in the credit quality of a customer base or an adverse change in the risk profile of a market, industry, or group of customers could adversely affect us.
Our credit risk may be exacerbated when collateral held by us to secure obligations to us cannot be realized upon or is liquidated at prices that are not sufficient to recover the full amount of the loan or derivative exposure due us.
If we experience higher levels of provision for loan losses in the future, our net income could be negatively affected.
Risks Related to Our Business Operations
We may not be able to effectively manage our growth.
We have experienced significant growth in the amount of our total loans in the past several years. Since January 1, 2016, our total net loans have grown by $1.4 billion, or 397.5%, and our total assets have grown by $1.6 billion, or 373.6%. Our continued growth may place significant demands on our operations and management, and our future operating results depend to a large extent on our ability to successfully manage our growth. We may not successfully implement improvements to, or integrate, our management information and control systems, procedures and processes in an efficient or timely manner and may discover deficiencies in existing systems and controls. In particular, our controls and procedures must be able to accommodate increases in our loan volume and our growth and expansion. If we are unable to manage our loan growth and/or expanded operations, we may experience compliance and operational problems, have to slow the pace of growth, or have to incur additional expenditures beyond current projections to support such growth, any one of which could materially and adversely affect us.
Future acquisitions or other expansion may adversely affect our financial condition and results of operations.
In the future, we may acquire other financial institutions or branches or assets of other financial institutions. We may also open new branches, enter into new lines of business, or offer new products or services. Any future acquisition or expansion of our business will involve a number of expenses and risks, which may include some or all of the following:
the time and expense associated with identifying and evaluating potential acquisitions or expansions;
the potential inaccuracy of estimates and judgments used to evaluate credit, operations, management and market risk with respect to target institutions;
the time and costs of evaluating new markets, hiring local management and opening new offices, and the delay between commencing these activities and the generation of profits from the expansion;
any financing required in connection with an acquisition or expansion;
the diversion of management’s attention to the negotiation of a transaction and the integration of the operations and personnel of the combining businesses;
entry into unfamiliar markets and the introduction of new products and services into our existing business;
the possible impairment of goodwill associated with an acquisition and possible adverse short-term effects on our results of operations; and
the risk of loss of key employees and customers.
We may incur substantial costs to expand, and we can give no assurance that such expansion will result in the levels of profits we expect. Neither can we assure that integration efforts for any future acquisitions will be successful. We may issue equity securities in connection with acquisitions, which could dilute the economic and voting interests of our existing stockholders.
We face strong competition from other financial institutions, financial services companies and other organizations offering services similar to those offered by us, which could result in our not being able to sustain or grow our loan and deposit businesses.
We conduct our business operations primarily in Franklin, Cuyahoga, Hamilton, and Summit, Counties, Ohio, and in Marion County, Indiana, and make loans generally throughout Ohio and Indiana. Increased competition within these markets may result in reduced loan originations and deposits. Ultimately, we may not be able to compete successfully against current and future competitors. Many competitors offer the types of loans and banking services that we offer. These competitors include other savings associations, community banks, regional banks and money center banks. We also face competition from many other types of financial institutions, including finance companies, brokerage firms, insurance companies, credit unions, mortgage banks, fintechs and other financial intermediaries. Our competitors with greater resources may have a marketplace advantage enabling them to maintain numerous
27
Table of Contents
banking locations and mount extensive promotional and advertising campaigns.
Additionally, financial intermediaries not subject to bank regulatory restrictions and banks and other financial institutions with larger capitalization have larger lending limits and are thereby able to serve the credit needs of larger clients. These institutions, particularly to the extent they are more diversified than we are, may be able to offer the same loan products and services that we offer at more competitive rates and prices. If we are unable to attract and retain banking clients, we may be unable to sustain current loan and deposit levels or increase our loan and deposit levels, and our business, financial condition and future prospects may be negatively affected.
We rely heavily on our management team and other key employees, and the unexpected loss of key employees may adversely affect our operations.
Our success depends, in large part, on our ability to attract, retain, develop and motivate management and key employees. Competition for key employees is ongoing and we may not be able to attract or retain the key employees that we want or need in order to successfully execute our business. Additionally, the unexpected loss of services of any key employee could have an adverse effect on our business and financial results.
We are exposed to operational risk.
Similar to any large organization, we are exposed to many types of operational risk, including those discussed in more detail elsewhere in this Item, such as reputational risk, legal and compliance risk, cybersecurity risk, the risk of fraud or theft by employees or outsiders, unauthorized transactions by employees or operational errors, including clerical or record-keeping errors or those resulting from faulty or disabled computer or telecommunications systems.
We may be subject to disruptions of our operating systems arising from events that are wholly or partially beyond our control, which may include, for example, computer viruses, cyber-attacks, spikes in transaction volume and/or customer activity, electrical or telecommunications outages, or natural disasters. We could be adversely affected by operating systems disruptions if new or upgraded business management systems are defective, not installed properly or not properly integrated into existing operating systems. Although we have programs in place related to business continuity, disaster recovery and information security to maintain the confidentiality, integrity and availability of our operating systems, business applications and customer information, such disruptions may give rise to interruptions in service to customers, loss of data privacy and loss or liability to us.
Any failure or interruption in our operating or information systems, or any security or data breach, could cause reputational damage, jeopardize the confidentiality of customer information, result in a loss of customer business, subject us to regulatory intervention or expose us to civil litigation and financial loss or liability, any of which could have a material adverse effect on us.
Negative public opinion can result from our actual or alleged conduct in any number of activities, including lending practices, corporate governance and acquisitions, social media and other marketing activities, the implementation of environmental, social and governance (ESG) practices, and from actions taken by governmental regulators and community organizations in response to any of the foregoing. Negative public opinion could adversely affect our ability to attract and keep customers, could expose us to potential litigation or regulatory action, and could have a material adverse effect on our stock price or result in heightened volatility of our stock price.
Given the volume of transactions we process, certain errors may be repeated or compounded before they are discovered and successfully rectified. Our necessary dependence upon automated systems to record and process our transaction volume may further increase the risk that technical system flaws or employee tampering or manipulation of those systems will result in losses that are difficult to detect, which may give rise to disruption of service to customers and to financial loss or liability. We are further exposed to the risk that our external vendors may be unable to fulfill their contractual obligations (or will be subject to the same risk of fraud or operational errors by their respective employees as we are) or that our (or our vendors’) consumer compliance, business continuity, and data security systems will prove to be inadequate.
Unauthorized disclosure of sensitive or confidential client information or breaches in security of our systems could severely harm our business.
As part of our financial institution business, we collect, process and store sensitive consumer data by utilizing computer systems and telecommunications networks operated by both us and third-party service providers. Our necessary dependence upon automated systems to record and process transactions poses the risk that technical system flaws, employee errors, tampering or manipulation of those systems, or attacks by third parties will result in losses and may be difficult to detect. We have security and backup and recovery systems in place, as well as a business continuity plan, to ensure the computer systems will not be inoperable, to the extent possible. The Company also routinely reviews documentation of such controls and backups related to third-party service providers. Our inability to use or access these information systems at critical points in time could unfavorably impact the timeliness and efficiency of our business operations. In recent years, some banks have experienced denial of service attacks in which individuals or
28
Table of Contents
organizations flood the bank's website with extraordinarily high volumes of traffic, with the goal and effect of disrupting the ability of the bank to process transactions. Other businesses have been victims of ransomware attacks in which the business becomes unable to access its own information and is presented with a demand to pay a ransom in order to once again have access to its information.
We could be adversely affected if one of our employees causes a significant operational break-down or failure, either as a result of human error or where an individual purposefully sabotages or fraudulently manipulates our operations or systems. We are further exposed to the risk that the third-party service providers may be unable to fulfill their contractual obligations (or will be subject to the same risks as faced by us). These disruptions may interfere with service to our customers, cause additional regulatory scrutiny and result in a financial loss or liability. We are also at risk of the impact of natural disasters, terrorism and international hostilities on our systems or for the effects of outages or other failures involving power or communications systems operated by others.
Misconduct by employees could include fraudulent, improper or unauthorized activities on behalf of clients or improper use of confidential information. We may not be able to prevent employee errors or misconduct, and the precautions we take to detect this type of activity might not be effective in all cases. Employee errors or misconduct could subject us to civil claims for negligence or regulatory enforcement actions, including fines and restrictions on our business.
In addition, there have been instances where financial institutions have been victims of fraudulent activity in which criminals pose as customers to initiate wire and automated clearinghouse transactions out of customer accounts. Although we have policies and procedures in place to verify the authenticity of our customers, we cannot assure that such policies and procedures will prevent all fraudulent transfers.
We have implemented security controls to prevent unauthorized access to our computer systems, and we require that our third-party service providers maintain similar controls. However, the Company’s management cannot be certain that these measures will be successful. A security breach of the computer systems and loss of confidential information, such as customer account numbers and related information, could result in a loss of customers’ confidence and, thus, loss of business. We could also lose revenue if competitors gain access to confidential information about our business operations and use it to compete with us. While we maintain specific "cyber" insurance coverage, which would apply in the event of various breach scenarios, the amount of coverage may not be adequate in any particular case. Furthermore, because cyber threat scenarios are inherently difficult to predict and can take many forms, some breaches may not be covered under our cyber insurance coverage.
Further, we may be impacted by data breaches at retailers and other third parties who participate in data interchanges with us and our customers that involve the theft of customer credit and debit card data, which may include the theft of our debit card personal identification numbers (PINs) and commercial card information used to make purchases at such retailers and other third parties. Such data breaches could result in us incurring significant expenses to reissue debit cards and cover losses, which could result in a material adverse effect on our results of operations.
There can be no assurance that we will not suffer such cyber-attacks or other information security breaches or attempted breaches, or incur resulting losses in the future. Our risk and exposure to these matters remains heightened because of, among other things, the evolving nature of these threats, and our plans to continue to implement internet and mobile banking capabilities to meet customer demand. As cyber and other data security threats continue to evolve, we may be required to expend significant additional resources to continue to modify and enhance its protective measures or to investigate and remediate any security vulnerabilities.
Our assets at risk for cyber-attacks include financial assets and non-public information belonging to customers. We use several third-party vendors who have access to our assets via electronic media. Certain cyber security risks arise due to this access, including cyber espionage, blackmail, ransom, and theft. As cyber and other data security threats continue to evolve, we may be required to expend significant additional resources to continue to modify and enhance our protective measures or to investigate and remediate any security vulnerabilities.
All of the types of cyber incidents discussed above could result in damage to our reputation, loss of customer business, costs of incentives to customers or business partners in order to maintain their relationships, litigation, increased regulatory scrutiny and potential enforcement actions, repairs of system damage, increased investments in cybersecurity (such as obtaining additional technology, making organizational changes, deploying additional personnel, training personnel and engaging consultants), increased insurance premiums, and loss of investor confidence and a reduction in the price of our common shares, all of which could result in financial loss and material adverse effects on our results of operations and financial condition
Our business could be adversely affected through third parties who perform significant operational services on our behalf.
The third parties performing operational services for the Company are subject to risks similar to those faced by the Company relating to cybersecurity, breakdowns or failures of their own systems, or misconduct of their employees. Like many other community banks, CFBank also relies, in significant part, on a single vendor for the systems which allow CFBank to provide banking services to CFBank’s customers, for which the systems are maintained on CFBank’s behalf by this single vendor.
29
Table of Contents
One or more of the third parties utilized by us may experience a cybersecurity event or operational disruption and, if any such event does occur, it may not be adequately addressed, either operationally or financially, by such third party. Further, the operations of our third-party vendors could fail or otherwise become delayed. Certain of these third parties may have limited indemnification obligations to us in the event of a cybersecurity event or operational disruption, or may not have the financial capacity to satisfy their indemnification obligations.
Financial or operational difficulties of a third party provider could also impair our operations if those difficulties interfere with such third party’s ability to serve the Company. If a critical third-party provider is unable to meet the needs of the Company in a timely manner, or if the services or products provided by such third party are terminated or otherwise delayed and if the Company is not able to develop alternative sources for these services and products quickly and cost-effectively, our business could be materially adversely effected.
Additionally, regulatory guidance adopted by federal banking regulators addressing how banks select, engage and manage their third-party relationships, affects the circumstances and conditions under which we work with third parties and the cost of managing such relationships.
Derivative transactions may expose us to unexpected risk and potential losses.
We are party to a number of derivative transactions. With regard to derivative transactions, we are dependent on the creditworthiness of the counterparties and are therefore susceptible to credit and operational risk in these situations. Derivative contracts and other transactions entered into with third parties are not always confirmed by the counterparties on a timely basis. While the transaction remains unconfirmed, we are subject to heightened credit and operational risk and, in the event of a default, we may find it more difficult to enforce the underlying contract. In addition, as new and more complex derivative products are created, covering a wider array of underlying credit and other instruments, disputes about the terms of the underlying contracts could arise, which could impair our ability to effectively manage our risk exposures from these products and subject us to increased costs. Any regulatory effort to create an exchange or trading platform for credit derivatives and other over-the-counter derivative contracts, or a market shift toward standardized derivatives, could reduce the risk associated with such transactions, but under certain circumstances could also limit our ability to develop derivatives that best suit our needs and those of our clients and adversely affect our profitability.
Legislative, Legal and Regulatory Risks
We operate in a highly regulated industry, and the laws and regulations that govern our operations, corporate governance, executive compensation and financial accounting, or reporting, including changes in, or failure to comply with the same, may adversely affect the Company.
The banking industry is highly regulated. We are subject to supervision, regulation and examination by various federal and state regulators, including the FRB, the SEC, the CFPB, the OCC, the FDIC, Financial Industry Regulatory Authority, Inc. (also known as FINRA), and various state regulatory agencies. The statutory and regulatory framework that governs the Company is generally designed to protect depositors and customers, the DIF, the U.S. banking and financial system, and financial markets as a whole and not to protect shareholders. These laws and regulations, among other matters, prescribe minimum capital requirements, impose limitations on our business activities (including foreclosure and collection practices), limit the dividends or distributions that we can pay, and impose certain specific accounting requirements that may be more restrictive and may result in greater or earlier charges to earnings or reductions in capital than would otherwise be required under generally accepted accounting principles in the United States of America. Compliance with laws and regulations can be difficult and costly, and changes to laws and regulations often impose additional compliance costs. Both the scope of the laws and regulations and the intensity of the supervision to which we are subject have increased in recent years in response to the perceived state of the financial services industry, as well as other factors such as technological and market changes. Such regulation and supervision may increase our costs and limit our ability to pursue business opportunities. Further, our failure to comply with these laws and regulations, even if the failure was inadvertent or reflects a difference in interpretation, could subject the Company to restrictions on business activities, fines, and other penalties, any of which could adversely affect results of operations, the capital base, and the price of our common shares. Further, any new laws, rules, or regulations could make compliance more difficult or expensive or otherwise adversely affect our business and financial condition.
Legislative or regulatory changes or actions could adversely impact our business.
Regulations affecting banks and financial services businesses are undergoing continuous change,and management cannot predict the effect of those changes. The impact of any changes to laws and regulations or other actions by regulatory agencies could adversely affect our business. Regulatory authorities have extensive discretion in connection with their supervisory and enforcement activities, including the ability to impose restrictions on the operation of an institution and the ability to determine the adequacy of an institution’s allowance for loan losses. Failure to comply with applicable laws, regulations and policies could result in sanctions being imposed by the regulatory agencies, including the imposition of civil money penalties, which could have a material adverse effect on our operations and financial condition. Even the reduction of regulatory restrictions could have an adverse effect on us if such
30
Table of Contents
lessening of restrictions increases competition within our industry or market areas.
We are subject to limitations and conditions on certain activities as a result of our “Needs to Improve” CRA rating.