CVBF · Read the filing

10-K

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

Form 10-K

☒ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934.

For the fiscal year ended December 31, 2025

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934.

For the transition period from _______ to _______

Commission file number:000-10140

CVB FINANCIAL CORP.

(Exact name of registrant as specified in its charter)

(Address of Principal Executive Offices) (Zip Code)

Registrant’s telephone number, including area code: (909) 980-4030

Securities registered pursuant to Section 12(b) of the Act:

Title of Class Trading Symbol Name of Each Exchange on Which Registered

Common Stock, no par value CVBF NASDAQ Stock Market, LLC

Securities registered pursuant to Section 12(g) of the Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the Registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer”, “smaller reporting company” and “emerging growth company” in Rule 12b-2 of the Exchange Act. (Check one):

Large accelerated filer ☒ Accelerated filer ☐

Non-accelerated filer ☐ Smaller reporting company ☐

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☒

As of June 30, 2025, the aggregate market value of the common stock held by non-affiliates of the registrant was approximately $2.56 billion

Number of shares of common stock of the registrant outstanding as of February 20, 2026: 135,800,301

DOCUMENTS INCORPORATED BY REFERENCE PART OF

CVB FINANCIAL CORP.

2025 ANNUAL REPORT ON FORM 10-K

TABLE OF CONTENTS

PART I

ITEM 1. BUSINESS 3

ITEM 1A. RISK FACTORS 20

ITEM 1B. UNRESOLVED STAFF COMMENTS 39

ITEM 1C. CYBERSECURITY 39

ITEM 2. PROPERTIES 41

ITEM 3. LEGAL PROCEEDINGS 41

ITEM 4. MINE SAFETY DISCLOSURES 42

PART II

ITEM 6. RESERVED 44

CRITICAL ACCOUNTING POLICIES 44

OVERVIEW 46

ANALYSIS OF THE RESULTS OF OPERATIONS 48

ANALYSIS OF FINANCIAL CONDITION 57

RISK MANAGEMENT 73

ITEM 7A. QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK 82

ITEM 8. FINANCIAL STATEMENTS AND SUPPLEMENTARY DATA 83

ITEM 9A. CONTROLS AND PROCEDURES 83

ITEM 9B. OTHER INFORMATION 85

ITEM 9C. DISCLOSURE REGARDING FOREIGN JURISDICTIONS THAT PREVENT INSPECTIONS 85

PART III

ITEM 10. DIRECTORS, EXECUTIVE OFFICERS AND CORPORATE GOVERNANCE 86

ITEM 11. EXECUTIVE COMPENSATION 86

ITEM 14. PRINCIPAL ACCOUNTING FEES AND SERVICES 87

PART IV

ITEM 15. EXHIBITS AND FINANCIAL STATEMENT SCHEDULES 88

SIGNATURES 91

Forward-Looking Statements Safe Harbor

Certain statements set forth herein constitute forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. Words such as “will likely result”, “aims”, “anticipates”, “believes”, “could”, “estimates”, “expects”, “hopes”, “intends”, “may”, “plans”, “projects”, “seeks”, “should”, “will,” “strategy”, “possibility”, and variations of these words and similar expressions help to identify these forward-looking statements, which involve risks and uncertainties that could cause our actual results or performance to differ materially from those projected. These forward-looking statements are based on management’s current expectations and beliefs concerning future developments and their potential effects on the Company including, without limitation, plans, strategies and goals, and statements about the Company’s outlook regarding revenue and asset growth, financial performance and profitability, capital and liquidity levels, loan and deposit growth and retention, yields and returns, loan diversification and credit management, stockholder value creation, tax rates, and the impact of economic developments, and the impact of acquisitions we have made or may make. Such statements involve inherent risks and uncertainties, many of which are difficult to predict and are generally beyond the control of the Company, and there can be no assurance that future developments affecting the Company will be the same as those anticipated by management. The Company cautions readers that a number of important factors in addition to those set forth below could cause actual results to differ materially from those expressed in, or implied or projected by, such forward-looking statements.

General risks and uncertainties include, but are not limited to, the following: the strength of the United States economy in general and the strength of the local economies in which we conduct business; the effects of, and changes in, trade, monetary, and fiscal policies and laws, including interest rate policies of the Board of Governors of the Federal Reserve System; inflation/deflation, interest rate, market, and monetary fluctuations; the effect of acquisitions we have made or may make, including, without limitation, the failure to obtain the necessary regulatory approvals, the failure to achieve the expected revenue growth and/or expense savings from such acquisitions, and/or the failure to effectively integrate an acquisition target, customers and key personnel into our operations; the timely development of competitive new products and services and the acceptance of these products and services by new and existing customers; the impact of changes in financial services policies, laws, and regulations, including those concerning taxes, banking, securities and insurance, and the application thereof by regulatory bodies; the effectiveness of our risk management framework and quantitative models; changes in the levels of our nonperforming assets and charge-offs; the effect of changes in accounting policies and practices or accounting standards, as may be adopted from time-to-time by bank regulatory agencies, the United States (“U.S.”) Securities and Exchange Commission (“SEC”), the Public Company Accounting Oversight Board, the Financial Accounting Standards Board or other accounting standards setters; possible credit related impairments or declines in the fair value of loans and securities held by us, including impairments or declines caused by changes in the credit ratings of such securities or their issuers; possible impairment charges to goodwill, including any impairment that may result from increased volatility in our stock price; changes in consumer spending, borrowing, and savings habits; the effects of our lack of a diversified loan portfolio, including the risks of geographic, property type and industry concentrations; periodic fluctuations in commercial or residential real estate prices or values; our ability to attract and retain deposits or to access government or private lending facilities and other sources of liquidity; the possibility that we may reduce or discontinue the payments of dividends on our common stock; changes in the financial performance and/or condition of our borrowers; changes in the competitive environment among financial and bank holding companies and other financial service providers; technological changes in banking and financial services, geopolitical conditions, including acts or threats of terrorism, actions taken by the United States or other governments in response to acts or threats of terrorism, and/or military conflicts, which could impact business and economic conditions in the United States and abroad; catastrophic events or natural disasters, including earthquakes, drought, climate change or extreme weather events that may affect our assets, communications or computer services, customers, employees or third party vendors; public health crises and pandemics, and their effects on the economic and business environments in which we operate, including on our credit quality and business operations and employees, as well as the impact on general economic and financial market conditions; cybersecurity and fraud threats and the costs of defending against them, including the costs of compliance with potential legislation to combat money laundering, cybersecurity and fraud threats at a state, national, or global level; our ability to remain in compliance with federal and state laws and regulations involving customer and employee privacy; our ability to recruit and retain key executives, board members and other employees, and changes in employment laws and regulations; unanticipated regulatory or legal investigations and proceedings or outcomes; risks associated with our pending merger with Heritage Commerce Corp. (“Heritage”), including completing the transaction on the terms set forth in our definitive agreement with Heritage, difficulties and delays in integrating Heritage’s business, key personnel and customers into our business and operations, and achieving anticipated synergies, cost savings and other benefits from the transaction and our ability to manage the risks involved in the foregoing.

The Company does not undertake, and specifically disclaims any obligation, to update any forward-looking statements to reflect occurrences or unanticipated events or circumstances after the date of such statements, except as required by law. Any statements about future operating results, such as those concerning accretion and dilution to the Company’s earnings or shareholders, are for illustrative purposes only, are not forecasts, and actual results may differ.

PART I

ITEM 1.BUSINESS

CVB Financial Corp.

CVB Financial Corp. (referred to herein on an unconsolidated basis as “CVB” and on a consolidated basis as “we”, “our” or the “Company”) is a bank holding company incorporated in California on April 27, 1981 and registered with the Board of Governors of the Federal Reserve System (“Federal Reserve”) under the Bank Holding Company Act of 1956, as amended (the “BHCA”). The Company commenced business on December 30, 1981 when, pursuant to a reorganization, it acquired all of the voting stock of Chino Valley Bank. On March 29, 1996, Chino Valley Bank changed its name to Citizens Business Bank, and on December 15, 2025, Citizens Business Bank changed its name to Citizens Business Bank, National Association (“CBB” or the “Bank”). The Bank is our principal asset. The Company has one inactive subsidiary, Chino Valley Bancorp.

CVB’s principal business is to serve as a holding company for the Bank and for other banking or banking related subsidiaries, which the Company may establish or acquire. CVB has not engaged in any other material activities to date. As a legal entity separate and distinct from its subsidiaries, CVB’s principal source of funds is, and will continue to be, dividends paid by and other funds advanced from the Bank and capital raised directly by CVB. Legal limitations are imposed on the amount of dividends that may be paid and loans that may be made by the Bank to CVB. See “Item 1. Business — Regulation and Supervision — Dividends.” As of December 31, 2025, the Company had $15.63 billion in total consolidated assets, $8.62 billion in net loans, $12.07 billion in deposits, and $2.30 billion in shareholders’ equity.

The principal executive offices of CVB and the Bank are located at 701 North Haven Avenue, Suite 350, Ontario, California. Our phone number is (909) 980-4030.

Citizens Business Bank, National Association

The Bank commenced operations on August 9, 1974. Effective December 15, 2025, the Bank converted from a California-chartered bank to a national banking association chartered under the laws of the United States. The Bank is a member of the Federal Reserve System and of the Federal Home Loan Bank of San Francisco (“FHLB”), which is a member bank of the Federal Home Loan Bank System. The Bank’s deposit accounts are insured under the Federal Deposit Insurance Act up to maximum amount currently allowable under federal law. The Bank is currently subject to the examination and regulation by the Office of the Comptroller of the Currency (the “OCC”) and the Federal Deposit Insurance Corporation (“FDIC”).

At December 31, 2025, the Bank had $15.63 billion in assets, $8.62 billion in net loans, $12.13 billion in deposits, and $2.27 billion in total equity.

As of December 31, 2025, the Bank had 62 Banking Centers (“Centers”) and one loan production office located throughout California. We also have three trust offices located in Ontario, Newport Beach, and Pasadena. These offices serve as sales offices for the Bank’s wealth management, trust and investment products.

The Bank's goal is to be the premier financial services company operating throughout the state of California, servicing the comprehensive financial needs of successful small-and medium-sized businesses and their owners. Through our network of Centers, we emphasize personalized service combined with a wide array of banking and trust services for businesses, professionals and individuals located in the service areas of our Centers. Although we focus the marketing of our services to small-and medium-sized businesses, a wide range of banking, investment and trust services are made available to the markets we serve.

We offer a wide range of bank deposit instruments. These include checking, savings, money market and certificates of time deposit for both business and personal accounts, municipalities and districts, and specialized deposit products for title and escrow. We also serve as a federal tax depository for our business customers.

We provide a full complement of lending products, including commercial, agribusiness, consumer, SBA, real estate, and construction loans, as well as equipment and vehicle leasing. Commercial products include lines of credit and other working capital financing, accounts receivable lending and letters of credit. Agribusiness products are loans to finance the operating needs of wholesale dairy farm operations, cattle feeders, livestock raisers, and farmers. We provide bank qualified lease financing for municipal governments. Commercial real estate and construction loans are secured by a range of property types and include both owner-occupied and investor owned properties. We also offer borrowers the ability to enter into interest rate swaps. Financing products for consumers include automobile leasing and financing, lines of credit, credit cards, home mortgages, and home equity loans and lines of credit.

We also offer a wide range of specialized services designed for the needs of our commercial customers. These services include treasury management systems for monitoring and managing cash flow, a merchant card processing program, armored pick-up and delivery, payroll services, remote deposit capture, electronic funds transfers, domestic and international wires and automated clearinghouse, on-line account access, and international business activities including foreign exchange and letters of credit for international trade. We make available investment products offered by other providers to our customers, including mutual funds, a full array of fixed income vehicles and a program to diversify our customers’ funds in federally insured time certificates of deposit of other institutions.

In addition, we offer a wide range of financial services and trust services through our CitizensTrust division. These services include fiduciary services, mutual funds, annuities, 401(k) plans and individual investment accounts.

Pending Acquisition

On December 17, 2025, the Company entered into an Agreement and Plan of Merger (the “Merger Agreement”) with Heritage Commerce Corp. In accordance with the terms and conditions set forth in the Merger Agreement, Heritage will merge with and into the Company in an all-stock transaction, with the Company continuing as the surviving corporation. Promptly following the Merger, Heritage Bank of Commerce, a California banking corporation and wholly-owned subsidiary of Heritage will merge with and into CBB, with CBB continuing as the surviving bank (the “Bank Merger”).

Under the terms of the Merger Agreement, Heritage shareholders will receive 0.65 shares of the Company’s common stock for each share of Heritage common stock they own. Upon closing, CVB shareholders will own approximately 77% and Heritage shareholders will own approximately 23% of the combined company. The combined company will have approximately $22 billion in assets, more than 80 centers and offices, and a deeply rooted presence in the State of California’s key economic centers. The acquisition is presently expected to close in the second quarter of 2026, subject to satisfaction of regulatory approvals, Heritage and CVB shareholder approvals, and other customary closing conditions.

Business Segments

We are a community bank with one reportable operating segment. See Note 3 — Summary of Significant Accounting Policies — Business Segments of the notes to the consolidated financial statements.

Human Capital

We employed 1,079 associates as of December 31, 2025. This was a 1.0% decrease from 1,089 associates at December 31, 2024. Our Code of Personal and Business Conduct and Ethics (“Code”) addresses both business and social relationships that may present legal and ethical concerns and also sets forth a code of conduct to guide the members of the Board of Directors and associates. Our associates acknowledge annually they have read and understood their responsibility to conduct business in accordance with the highest ethical standards in order to merit and maintain the confidence and trust of our customers and the public in general.

The Company promotes Five Core Values that we believe provides a continuing commitment and direction to our business activities and our underlying culture. These core values are fundamental to the Company’s performance and strategy.

Our Five Core Values are:

1) Financial Strength;

2) Superior People;

3) Customer Focus;

4) Cost-Effective Operation; and

5) Having Fun.

The Company’s Citizens Experience Service Awards and Recognition Program recognizes associates who exemplifying our Five Core Values. In addition, the Company has a long held tradition of an annual awards program that recognizes outstanding job performance. Our 2025 annual awards ceremony recognized 38 associates, who stood out for their commitment to our high standards of performance.

The Company is committed to supporting the physical and financial wellness of our associates and their families. We offer a comprehensive set of health insurance and retirement benefits, as well as wellness programs and resources. As of December 2025, 72% of our associates were enrolled in our medical insurance plans and 81% of our associates participated in at least one wellness activity during 2025. In addition, the Company makes an annual 401(k) retirement contribution to all eligible associates, which includes a profit sharing component. In 2025, the combined Company 401(k) contribution was 5% of associate’s eligible salary and 92% of our associates made individual participant contributions to the 401(k) plan during 2025.

Recruiting, training and development, and retention of key associates is vital to the Company’s strategy and success. The Company promotes leadership and associate development through various programs, including succession planning, top talent program, and leadership essentials training. At December 31, 2025, we had 129 positions within the Company designated as “leadership” positions. This represents approximately 12% of our total associates. The average tenure at the Company among our leadership group at the end of 2025 was greater than 10 years. In 2025, turnover among our leadership group was 10% and during the year we promoted 3 associates and hired 3 new associates into our leadership group.

The Company’s Development and Engagement Program is designed to invest in the professional development of our associates and increase workplace engagement. We strive to reward talent, with a commitment to equal opportunity. Oversight is provided by the Company’s Engagement Committee, which is guided by our Five Core Values and various policies that support a framework which we use to create and strengthen our associate engagement and well-being, as well as sound procurement and business practices. The Engagement Committee is co-chaired by our Chief Operating Officer and Human Resources Director and includes our Chief Financial Officer, Chief Risk Officer, and General Counsel. The Company's Engagement Council was established to continue our commitment to associate engagement, as well as fostering, cultivating, and preserving a culture of diversity and inclusion. The Council is led by our Director of Human Resources and the Associate Engagement Manager, as well as an additional member of our Senior Leadership team. Members of the Council represent a cross section of our associates across numerous departments. The Council discusses ways to promote engagement among associates and serve as ambassadors when it comes to implementing our Core Values. We monitor diversity throughout our organization, including the percentage of our total associates who are female and racially or ethnically diverse. The following represents the Company’s diversity at December 31, 2025:

In addition, 33% of our Board of Directors are female or ethnically diverse.

The Board of Directors oversees executive compensation, as well as the Company’s compensation and benefit plans, through the Board’s Compensation Committee. The Management Compensation Compliance Committee, under the direction of the Compensation Committee, identifies, assesses, and manages exposure to and compliance with applicable compensation laws, regulations, and other related issues. In general, the Management Compensation Compliance Committee is responsible for ensuring that the Company has designed and implemented risk management processes that (1) evaluate the nature of inherent risks in compensation programs; (2) are consistent with the Company’s strategic plan; and (3) foster a culture of risk-awareness and risk-adjusted decision making throughout the Company. All of our associates are eligible for incentive compensation awards. In 2025, 95% of our associates earned an incentive bonus, which compares to 92% in 2024.

Competition

The banking and financial services business is highly competitive. The competitive environment faced by banks is a result primarily of changes in laws and regulations, changes in technology and product delivery systems, and the ongoing consolidation among insured financial institutions. We compete for loans, deposits, and customers with other commercial banks, savings and loan associations, savings banks, securities and brokerage companies, mortgage companies, insurance companies, finance companies, money market funds, credit unions, and other nonbank financial service providers, including online banks and “peer-to-peer” or “marketplace” payment processors, FinTech companies, lenders and other small business and consumer lenders. Many competitors are much larger in total assets and capitalization, have greater access to capital markets and/or offer a broader range of financial products and services. Additionally, some smaller competitors, including non-bank entities, may be more nimble and responsive to customer preferences or requirements.

Economic Conditions/Government Policies

Our profitability, like most financial institutions, is primarily dependent on interest rate spreads and noninterest income. In general, the difference between the interest rates paid by the Bank on interest-bearing liabilities, such as deposits and borrowings, and the interest rates received by the Bank on interest-earning assets, such as loans extended to customers and securities held in the investment portfolio, will comprise the major portion of our earnings. These rates are highly sensitive to many factors that are beyond our control, such as inflation, recession and unemployment, government fiscal and monetary and other policies, and the impact which future changes in domestic and foreign economic conditions might have on us cannot be predicted.

Opportunity for banks to earn fees and other noninterest income have also been limited by restrictions imposed by the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”) and other government regulations. As the following sections indicate, the impact of current and future changes in government laws and regulations on our ability to maintain current levels of fees and other noninterest income could be material and cannot be predicted.

Our business is also influenced by the monetary and fiscal policies of the federal government and the policies of regulatory agencies, particularly the Federal Reserve. The Federal Reserve implements national monetary policies (with objectives such as curbing inflation, increasing employment and combating recession) through its open-market operations in U.S. Government securities by buying and selling treasury and mortgage-backed securities, by adjusting the required level of reserves for depository institutions subject to its reserve requirements, and by varying the target federal funds and discount rates applicable to borrowings by depository institutions. The actions of the Federal Reserve in these areas influence the growth and performance of bank loans, investments, and deposits and also affect interest earned on interest-earning assets and paid on interest-bearing liabilities. Recent actions by the Federal Reserve have impacted deposits due to expansion and contraction of the money supply. Government fiscal and budgetary policies, including deficit spending, can also have a significant impact on the capital markets and interest rates. The nature and impact of any future changes in monetary and fiscal policies on us cannot be predicted.

Regulation and Supervision

General

The Company and the Bank are subject to significant regulation and restrictions under applicable federal and state laws and by various regulatory agencies. These regulations and restrictions are intended primarily for the protection of depositors and the Federal Deposit Insurance Corporation (“FDIC”) Deposit Insurance Fund (“DIF”) and secondarily for the stability of the U.S. banking system. The following discussion of statutes and regulations is a summary and does not purport to be complete nor does it address all applicable statutes and regulations. This discussion is qualified in its entirety by reference to the statutes and regulations referred to in this discussion. From time to time, federal and state legislation is enacted and implemented by regulations which may have the effect of materially increasing the cost of doing business, limiting or expanding permissible activities, or affecting the competitive balance between banks and other financial services providers. Following the Bank’s December 15, 2025 conversion from a California state depository institution to a national bank, the Bank’s primary federal regulator became the OCC.

We cannot predict whether or when other legislation or new regulations may be enacted, and if enacted, the effect that new legislation or any implemented regulations and supervisory policies would have on our financial condition and results of operations. Such developments may further alter the structure, regulation, and competitive relationship among financial institutions, may limit the types or pricing of the products and services we offer, and may subject us to increased regulation, disclosure, and reporting requirements. We also cannot predict whether or when regulatory requirements may be reduced or eliminated and the overall affect such reduction or elimination may have on the Company and the Bank.

Legislation and Regulatory Developments

Federal banking agencies have authority to issue regulations and guidelines to ensure safety and soundness of banks and the stability of the U.S. banking system. Changes in administration can influence regulatory priorities, including rulemaking, supervision, examination and enforcement. While future changes may occur, the scope and impact of such changes cannot currently be determined.

Capital Adequacy Requirements

Bank holding companies and banks are subject to similar regulatory capital requirements administered by the Federal Reserve and, in the case of national banks, the OCC. The risk-based capital guidelines for bank holding companies, and additionally for banks, require capital ratios that vary based on the perceived degree of risk associated with a banking organization’s operations, both for transactions reported on the balance sheet as assets, such as loans, and for those recorded as off-balance sheet items, such as loan commitments, letters of credit and recourse arrangements. The risk-based capital ratio is determined by classifying assets and certain off-balance sheet financial instruments into weighted categories, with higher levels of capital being required for those categories perceived as representing greater risks, and with the applicable ratios calculated by dividing qualifying capital by total risk-adjusted assets and off-balance sheet items. Capital amounts and classifications are also subject to qualitative judgments by regulators about components, risk weighting and other factors. Bank holding companies and banks engaged in significant trading activity may also be subject to the market risk capital guidelines and be required to incorporate additional market and interest rate risk components into their risk-based capital standards. Bank holding companies are also required to act as a source of financial strength to their subsidiary banks. Under this policy, the Company must commit resources to support the Bank even when the Company may not be in a financial position to provide it. The Federal Reserve monitors our capital adequacy on a consolidated basis, and the OCC primarily monitors the capital adequacy of our Bank.

Regulatory Capital and Risk-weighted Assets

The capital adequacy rules implement the Basel III international regulatory capital standards in the United States, as well as certain provisions of the Dodd-Frank Act. These quantitative calculations are minimums, and the Federal Reserve, OCC or FDIC may determine that a banking organization, based on its size, complexity or risk profile, must maintain a higher level of capital in order to operate in a safe and sound manner.

Under the Basel III Capital Rules, the Company’s and the Bank’s assets, exposures and certain off-balance sheet items are subject to risk weights used to determine the institutions’ risk-weighted assets. These risk-weighted assets are used to calculate the following minimum capital ratios for the Company and the Bank:

•

Tier 1 Leverage Ratio, equal to the ratio of Tier 1 capital to quarterly average assets (net of goodwill, certain other intangible assets and certain other deductions).

•

CET1 Risk-Based Capital Ratio, equal to the ratio of CET1 capital to risk-weighted assets. CET1 capital primarily includes common stockholders’ equity subject to certain regulatory adjustments and deductions, including with respect to goodwill, intangible assets and certain deferred tax assets. Because we are not an advanced approach banking organization, we were permitted to make a one-time permanent election to exclude accumulated other comprehensive income items from regulatory capital. We made this election in order to avoid significant variations in our levels of capital depending upon the impact of interest rate fluctuations on the fair value of our Bank’s available-for-sale securities portfolio.

•

Tier 1 Risk-Based Capital Ratio, equal to the ratio of Tier 1 capital to risk-weighted assets. Tier 1 capital is primarily comprised of CET1 capital, perpetual preferred stock and certain qualifying capital instruments.

•

Total Risk-Based Capital Ratio, equal to the ratio of total capital, including CET1 capital, Tier 1 capital and Tier 2 capital, to risk-weighted assets. Tier 2 capital primarily includes qualifying subordinated debt and qualifying allowance for credit losses. Tier 2 capital also includes, among other things, certain trust preferred securities.

The total minimum regulatory capital ratios and well-capitalized minimum ratios are reflected elsewhere in this document. For purposes of the Federal Reserve’s Regulation Y, including determining whether a bank holding company meets the requirements to be a financial holding company, bank holding companies, such as the Company, must maintain a Tier 1 Risk-Based Capital Ratio of 6.0% or greater and a Total Risk-Based Capital Ratio of 10.0% or greater.

Failure to be well-capitalized or to meet minimum capital requirements could result in certain mandatory and possible additional discretionary actions by regulators that, if undertaken, could have a material adverse effect on our operations or financial condition. Failure to be well-capitalized or to meet minimum capital requirements could also result in restrictions on the Company’s or the Bank’s ability to pay dividends or otherwise distribute capital or obtain regulatory approvals.

In addition to meeting the minimum capital requirements, under the Basel III Capital Rules, the Company and the Bank must also maintain the required Capital Conservation Buffer to avoid becoming subject to restrictions on capital distributions and certain discretionary bonus payments to management. The Capital Conservation Buffer is calculated as a ratio of CET1 capital to risk-weighted assets, and it effectively increases the required minimum risk-based capital ratios. The Capital Conservation Buffer is now at its fully phased-in level of 2.5%.

The Tier 1 Leverage Ratio is not impacted by the Capital Conservation Buffer, and a banking institution may be considered well-capitalized while remaining out of compliance with the Capital Conservation Buffer.

The table below summarizes the capital requirements that the Company and the Bank must satisfy to avoid limitations on capital distributions and certain discretionary bonus payments (i.e., the required minimum capital ratios plus the Capital Conservation Buffer):

Minimum Basel III RegulatoryCapital Ratio Plus CapitalConservation Buffer

CET1 risk-based capital ratio 7.0 %

Tier 1 risk-based capital ratio 8.5 %

Total risk-based capital ratio 10.5 %

As permitted by Basel III, the Company and the Bank have elected to opt-out of the requirement to include accumulated other comprehensive income in 2015. As of December 31, 2025 the Company and the Bank are well-capitalized for regulatory purposes. For a tabular presentation of the Company’s and Bank’s capital ratios as of December 31, 2025, see Note 16 — Regulatory Matters of the notes to the consolidated financial statements.

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms (the standards are commonly referred to as “Basel IV”). Among other things, these standards revise the Basel Committee’s standardized approach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain “unconditionally cancellable commitments,” such as unused credit card lines of credit) and provides a new standardized approach for operational risk capital. Under the Basel framework, as amended, these standards were effective on January 1, 2023, with an aggregate output floor phasing in through January 1, 2028. Under the current U.S. capital rules, operational risk capital requirements and a capital floor apply only to advanced approaches institutions, and not to the Company and the Bank.

In July, 2023, the FRB, OCC and FDIC proposed significant changes to the Basel III capital rules which replaces the advanced approaches risk-weighted assets framework with a new enhanced risk-based framework and requires banking organizations with generally more than $100 billion in assets to calculate their regulatory capital using more enhanced requirements applicable to even larger organizations. The impact of any changes to capital requirements and calculations and the implementation of Basel IV on us will depend on the manner in which it is implemented by the federal bank regulators with respect to smaller-sized institutions.

Prompt Corrective Action Provisions

The Federal Deposit Insurance Act requires the federal bank regulatory agencies to take “prompt corrective action” with respect to a depository institution if that institution does not meet certain capital adequacy standards, including requiring the prompt submission of an acceptable capital restoration plan. Depending on the bank’s capital ratios, the agencies’ regulations define five categories in which an insured depository institution will be placed: well-capitalized, adequately capitalized, undercapitalized, significantly undercapitalized, and critically undercapitalized. At each successive lower capital category, an insured bank is subject to more restrictions, including restrictions on the bank’s activities, operational practices or the ability to pay dividends or executive bonuses. Based upon its capital levels, a bank that is classified as well-capitalized, adequately capitalized, or undercapitalized may be treated as though it were in the next lower capital category if the appropriate federal banking agency, after notice and opportunity for hearing, determines that an unsafe or unsound condition, or an unsafe or unsound practice, warrants such treatment.

The prompt corrective action standards were changed to conform with the new capital rules. Under the new standards, in order to be considered well-capitalized, the bank will be required to meet the new common equity Tier 1 ratio of 6.5%, an increased Tier 1 ratio of 8% (increased from 6%), a total capital ratio of 10% (unchanged) and a leverage ratio of 5% (unchanged).

The federal banking agencies also may require banks and bank holding companies subject to enforcement actions to maintain capital ratios in excess of the minimum ratios otherwise required to be deemed well capitalized, in which case institutions may no longer be deemed to be well capitalized and may therefore be subject to certain restrictions such as obtaining new brokered deposits.

Volcker Rule

In December 2013, the federal bank regulatory agencies adopted final rules that implement a part of the Dodd-Frank Act commonly referred to as the “Volcker Rule.” Under these rules and subject to certain exceptions, banking entities are restricted from engaging in activities that are considered proprietary trading and from sponsoring or investing in certain entities, including hedge or private equity funds that are considered “covered funds.” These rules became effective on April 1, 2014, although certain provisions are subject to delayed effectiveness under rules promulgated by the FRB. In 2020, the OCC, Federal Reserve, FDIC, SEC, and Commodity Futures Trading Commission finalized further amendments to the Volcker Rule. The amendments include new exclusions from the Volcker Rule’s general prohibitions on banking entities investing in and sponsoring private equity funds, hedge funds, and certain other investment vehicles (collectively “covered funds”). The amendments in the final rule, which became effective on October 1, 2020, clarify and expand permissible banking activities and relationships under the Volcker Rule. The Company held small investment positions in three financial technology private equity funds at December 31, 2025, with aggregate potential commitments in such funds of approximately $5 million, which were subject to the final rule. While these rules may require us to conduct certain internal analysis and reporting to ensure continued compliance, they did not require any material changes in our operations or business.

Brokered Deposits

The FDIC limits the ability to accept brokered deposits to those insured depository institutions that are well capitalized. Institutions that are less than well capitalized cannot accept, renew or roll over any brokered deposit unless they have applied for and been granted a waiver by the FDIC. As of December 31, 2025, the Bank had $300 million of deposit liabilities categorized as brokered deposits.

Bank Holding Company Regulation

Bank holding companies and their subsidiaries are subject to significant regulation and restrictions by Federal and State laws and regulatory agencies, which may affect the cost of doing business, and may limit permissible activities and expansion or impact the competitive balance between banks and other financial services providers.

A wide range of requirements and restrictions are contained in both federal and state banking laws, which together with implementing regulatory authority:

•

Require periodic reports and such additional reports of information as the Federal Reserve may specify;

•

Require bank holding companies to meet or exceed increased levels of capital (See “Capital Adequacy Requirements”);

•

Require that bank holding companies serve as a source of financial and managerial strength to subsidiary banks and commit resources as necessary to support each subsidiary bank;

•

Limit dividends (or other distributions) payable to shareholders and restrict the ability of bank holding companies to obtain dividends or other distributions from their subsidiary banks. The Company’s ability to pay dividends is subject to legal and regulatory restrictions. Substantially all of CVB’s funds to pay dividends or to pay principal and interest on our debt obligations are derived from dividends paid by the Bank to CVB which are also subject to regulatory restrictions primarily from the OCC;

•

Require a bank holding company to terminate an activity or terminate control of or liquidate or divest certain subsidiaries, affiliates or investments if the Federal Reserve believes the activity or the control of the subsidiary or affiliate constitutes a significant risk to the financial safety, soundness or stability of any bank subsidiary;

•

Require the prior approval of senior executive officer or director changes and prohibit golden parachute payments, including change in control agreements, or new employment agreements with such payment terms, which are contingent upon termination if an institution is in “troubled condition”;

•

Regulate provisions of certain bank holding company debt, including the authority to impose interest ceilings and reserve requirements on such debt and require prior approval to purchase or redeem securities in certain situations;

•

Require prior approval for the acquisition of 5% or more of the voting stock of a bank or bank holding company by bank holding companies or other acquisitions and mergers with banks and consider certain competitive, management, financial, anti-money-laundering compliance, potential impact on U.S. financial stability or other factors in granting these approvals, in addition to similar California or other state banking agency approvals which may also be required; and

•

Require prior notice and/or prior approval of the acquisition of control of a bank or a bank holding company by a shareholder or individuals acting in concert with ownership or control of certain percentage thresholds of the voting stock being a presumption of control.

Change in Bank Control

Federal law and regulation set forth the types of transactions that require prior notice under the Change in Bank Control Act (“CIBCA”). Pursuant to CIBCA and Regulation Y, any person (acting directly or indirectly) that seeks to acquire control of a bank or its holding company must provide prior notice to the Federal Reserve. A “person” for this purpose includes an individual, bank, corporation, partnership, trust, association, joint venture, pool, syndicate, sole proprietorship, unincorporated organization, or any other form of entity. A person acquires “control” of a banking organization whenever the person acquires ownership, control, or the power to vote 25 percent or more of any class of voting securities of the institution. The applicable regulations also provide for certain other “rebuttable” presumptions of control.

In April 2020, the Federal Reserve adopted a final rule to revise its regulations related to determinations of whether a company has the ability to exercise a controlling influence over another company for purposes of the BHCA. The final rule expands and codifies the presumptions for use in such determinations. By codifying the presumptions, the final rule provides greater transparency on the types of relationships that the Federal Reserve generally views as supporting a facts-and-circumstances determination that one company controls another company. The Federal Reserve’s final rule applies to questions of control under the BHCA, but it does not extend to CIBCA or other applicable provisions of state or federal law.

Other Restrictions on the Company’s Activities

Subject to prior notice or Federal Reserve approval, bank holding companies may generally engage in, or acquire shares of companies engaged in activities determined by the Federal Reserve to be so closely related to banking or managing or controlling banks as to be a proper incident thereto. Bank holding companies which elect and retain “financial holding company” status pursuant to the Gramm-Leach-Bliley Act of 1999 (“GLBA”) may engage in these nonbanking activities and broader securities, insurance, merchant banking and other activities that are determined to be “financial in nature” or are incidental or complementary to activities that are financial in nature without prior Federal Reserve approval. Pursuant to GLBA and Dodd-Frank, in order to elect and retain financial holding company status, a bank holding company and all depository institution subsidiaries of a bank holding company must be considered well capitalized and well managed, and, except in limited circumstances, depository subsidiaries must be in satisfactory compliance with the Community Reinvestment Act (“CRA”), which requires banks to help meet the credit needs of the communities in which they operate. Failure to sustain compliance with these requirements or correct any non-compliance within a fixed time period could lead to divestiture of subsidiary banks or require all activities to conform to those permissible for a bank holding company. CVB has not elected financial holding company status and neither CVB nor the Bank has engaged in any activities determined by the Federal Reserve to be “financial in nature” or incidental or complementary to activities that are “financial in nature.”

Securities Exchange Act of 1934

CVB’s common stock is publicly held and listed on the NASDAQ Stock Market (“NASDAQ”), and CVB is subject to the periodic reporting, information, proxy solicitation, insider trading, corporate governance and other requirements and restrictions of the Securities Exchange Act of 1934 and the regulations of the Securities and Exchange Commission (“SEC”) promulgated thereunder as well as listing requirements of NASDAQ.

Sarbanes-Oxley Act

The Company is subject to the accounting oversight and corporate governance requirements of the Sarbanes-Oxley Act of 2002, including, among other things, required executive certification of financial presentations, requirements for board audit committees and their members, and disclosure of controls and procedures and internal control over financial reporting.

Bank Regulation

On December 15, 2025 the Bank converted from a California state-chartered bank to a national bank association, chartered under the laws of the United States and thereby is subject to the supervision, periodic examination, and regulation by the OCC and must additionally comply with certain applicable regulations of the FDIC and Federal Reserve. Specific federal and state laws and regulations which are applicable to banks regulate, among other things, the scope of their business, their investments, their reserves against deposits, the timing of the availability of deposited funds, their activities relating to dividends, investments, loans, the nature and amount of and collateral for certain loans, servicing and foreclosing on loans, borrowings, capital requirements, certain check-clearing activities, branching, and mergers and acquisitions. The Bank is subject to Federal Reserve Regulation O and Federal Reserve Act Sections 23A and 23B and Regulation W, which restrict or limit loans or extensions of credit to “insiders”, including officers, directors, and principal shareholders, and loans or extension of credit by banks to affiliates or purchases of assets from affiliates, including parent bank holding companies, except pursuant to certain exceptions and only on terms and conditions at least as favorable to those prevailing for comparable transactions with unaffiliated parties. Failure to comply with applicable bank regulations or adverse results from any examinations of the Bank could affect our costs of doing business, and may also limit or impede otherwise permissible activities and expansion activities by the Bank.

The Bank may form subsidiaries to engage in the many so-called “closely related to banking” or “nonbanking” activities in operating subsidiaries or in subsidiaries of bank holding companies and may conduct certain “financial” activities in a “financial subsidiary” as a national bank, provided the bank is and remains “well-capitalized,” “well-managed” and in satisfactory compliance with the CRA, and otherwise complies with the rules and regulations of the OCC. The Bank currently has no financial subsidiaries.

FDIC and OCC Enforcement Authority

The federal banking regulatory framework grants the FDIC and OCC broad discretion in connection with their supervisory and enforcement activities and examination policies, including policies with respect to the classification of assets and the establishment of appropriate loan loss reserves for regulatory purposes. The regulatory agencies have adopted guidelines to assist in identifying and addressing potential safety and soundness concerns before an institution’s capital becomes impaired. The guidelines establish operational and managerial standards generally relating to: (1) internal controls, information systems, and internal audit systems; (2) loan documentation; (3) credit underwriting; (4) interest-rate exposure; (5) asset growth and asset quality; and (6) compensation, fees, and benefits. Further, the regulatory agencies have adopted safety and soundness guidelines for asset quality and for evaluating and monitoring earnings to ensure that earnings are sufficient for the maintenance of adequate capital and reserves. If, as a result of an examination, the OCC or the FDIC should determine that the financial condition, capital resources, asset quality, earnings prospects, management, liquidity, or other aspects of the Bank’s operations are unsatisfactory or that the Bank or its management is violating or has violated any law or regulation, the OCC and the FDIC, and separately the FDIC as insurer of the Bank’s deposits, have residual authority to:

•

Require prompt affirmative action to correct any conditions resulting from any violation or practice;

•

Direct an increase in capital and the maintenance of higher specific minimum capital ratios, which could preclude the Bank from being deemed well-capitalized and restrict its ability to accept certain brokered deposits;

•

Restrict the Bank’s growth geographically, by products and services, or by mergers and acquisitions, including bidding in FDIC receiverships for failed banks;

•

Enter into or issue informal or formal enforcement actions, including required Board resolutions, matters requiring board attention, written agreements and consent or cease and desist orders or prompt corrective action orders to take corrective action and cease unsafe and unsound practices;

•

Require prior approval of senior executive officer or director changes; remove officers and directors and assess civil monetary penalties; and

•

Terminate FDIC insurance, revoke the Bank’s charter and/or take possession of and close and liquidate the Bank or appoint the FDIC as receiver.

Mergers and Acquisitions

In 2024, the OCC and FDIC issued policy statements which conveyed a heightened level of scrutiny for bank merger and acquisition activity. Following the election of President Trump, in May 2025 the FDIC rescinded its 2024 policy statement on bank merger review and instead reverted to prior guidance from 1998. Similarly, the OCC issued an interim final rule that rescinded its 2024 policy statement and reinstated regulatory provisions allowing for automatic expedited processing for certain eligible mergers and acquisitions. Subsequently, President Trump executed a resolution, which, among other things, prevents an agency from reissuing a substantially similar rule. Accordingly, with the FDIC and OCC reinstating pre-2024 policies, we believe applicants have a more predictable merger approval path for qualifying transactions. The FRB has not issued new merger and acquisition regulations or policy statements but has recently approved a number of larger acquisitions. The full impact of the election of President Trump on bank mergers and acquisition policy has yet to be fully determined.

In September, 2024, the Department of Justice (“DOJ”) announced that it withdrew its 1995 Bank Merger Guidelines and, instead, for purposes of evaluating the competitive impact of bank mergers, will rely on its 2023 Merger Guidelines which apply to all industries. For banks considering combinations where there may be even a remote possibility of antitrust concerns under the 2023 Merger Guidelines, the DOJ will review “market realities” in analyzing the competitive effects of a particular transaction. While branch deposit concentration may be one area of focus (i.e., traditional Herfindahl Hirschman Index (“HHI”) analysis for deposit concentration utilizing the 2023 Merger Guideline baselines), the DOJ will drill down into the products and services that a bank merger may affect prior to fully assessing the impact of a combination. This type of analysis may involve a more robust review of the competitive landscape (i.e., the impact of credit unions and other non-bank competitors), and a closer analysis of interest rates, types of mortgages and other loans offered, quality of service and convenience at branch locations, the types of customers served, and the unique needs in a particular bank market for bespoke financing.

Deposit Insurance

The FDIC is an independent federal agency that insures deposits, up to prescribed statutory limits, of federally insured banks and savings institutions and safeguards the safety and soundness of the banking and savings industries. The FDIC insures our customer deposits through the DIF up to prescribed limits for each depositor. The Dodd-Frank Act revised the FDIC’s DIF management authority by setting requirements for the Designated Reserve Ratio (the “DRR”, calculated as the DIF balance divided by estimated insured deposits) and redefining the assessment base, which is used to calculate banks’ quarterly assessments. The amount of FDIC assessments paid by each DIF member institution is based on its asset size and relative risk of default as measured by regulatory capital ratios and other supervisory factors. The FDIC may terminate a depository institution’s deposit insurance upon a finding that the institution’s financial condition is unsafe or unsound or that the institution has engaged in unsafe or unsound practices that pose a risk to the DIF or that may prejudice the interest of the bank’s depositors. The termination of deposit insurance for a bank would also result in the revocation of the bank’s charter by the OCC.

We are generally unable to control the amount of premiums that we are required to pay for FDIC insurance, which can be affected by the cost of bank failures to the FDIC, among other factors. The FDIC is an independent federal agency that insures deposits through the DIF up to prescribed statutory limits of federally insured banks and savings institutions and safeguards the safety and soundness of the banking and savings industries.

The FDIC has set the target DRR at 2.00%. In October 2022, in order to increase the likelihood that the reserve ratio would be restored to at least 1.35% by the statutory deadline of September 30, 2029, the FDIC increased the initial base deposit insurance assessment rate schedules uniformly by two (2) basis points. The FDIC will, at least semi-annually, update its income and loss projections for the DIF and, if necessary, propose rules to further increase assessment rates.

In addition, in November 2023, the FDIC approved a final rule to implement a special deposit insurance assessment (the “FDIC Special Assessment”) to recover losses to the DIF arising from the protection of uninsured depositors following the receiverships of failed institutions in the spring of 2023. The Company recognized special assessment expense of $9.2 million in the fourth quarter of 2023. In addition, the FDIC retained the ability to make further adjustments to the special assessment depending on subsequent adjustments to the DIF's estimated loss. During 2024, the FDIC revised its loss estimate and projected that the special assessment could be collected beyond its initial eight-quarter collection period. As a result, the Company recorded an additional FDIC Special Assessment charge of $1.6 million during 2024. On December 16, 2025, the FDIC approved a reduction in the special deposit insurance assessment for the eighth quarterly installment and reduced the rate from 3.36 basis points to 2.97 basis points. The Company recorded a reduction of $133,000 of the special assessment expense in 2025.

Any future increases in FDIC insurance premiums may have a material and adverse effect on our earnings and could have a material adverse effect on the value of, or market for, our common stock.

Dividends and Stock Repurchases

It is the Federal Reserve’s policy that bank holding companies should generally pay dividends on common stock only out of net income available over prior four quarters (net of dividends previously paid during such period), and only if prospective earnings retention is consistent with the organization’s expected future capital needs and financial condition. It is also the Federal Reserve’s policy that bank holding companies should not maintain dividend levels that undermine their ability to be a source of strength to its banking subsidiaries. The Federal Reserve also discourages dividend payment ratios that are at maximum allowable levels unless both asset quality and capital are very strong. In addition, a bank holding company may be unable to pay dividends on its common stock if it fails to maintain an adequate capital conservation buffer under current capital rules. There can be no assurance regarding the payment and the amount of dividends that the Company will pay to its shareholders in the future or that the Company will continue to pay dividends to its shareholders at all.

The Federal Reserve also maintains a policy that redemptions of instruments included in regulatory capital and repurchases of common stock from investors be consistent with an organization’s current and prospective capital needs. We consult with the Federal Reserve regarding our plans for common stock repurchases. A bank holding company may be required to give the Federal Reserve prior written notice before purchasing or redeeming its equity securities if the gross consideration for the purchase or redemption, when aggregated with the net consideration paid by the bank holding company for all such purchases or redemptions during the preceding 12 months, is equal to 10.00% or more of the bank holding company’s consolidated net worth. The Federal Reserve may disapprove such a purchase or redemption if it determines that the proposal would constitute an unsafe or unsound practice or would violate any law, regulation, Federal Reserve order, or any condition imposed by or written agreement with the Federal Reserve. However, this prior notice requirement does not apply to any bank holding company that meets certain “well-capitalized” and “well-managed” standards and is not the subject of any unresolved supervisory issues.

The Bank is a legal entity that is separate and distinct from its holding company. CVB relies on dividends received from the Bank for use in the operation of the Company and the ability of CVB to pay dividends to shareholders. Future cash dividends by the Bank will also depend upon management’s assessment of future capital requirements, contractual restrictions, and other factors. Current capital rules may restrict dividends by the Bank if the additional capital conservation buffer is not achieved. See “Capital Adequacy Requirements”.

A national bank may not declare any cash dividend in an amount greater than the sum of current period net income and retained earnings. In addition, a national bank also must obtain prior approval from the OCC to pay a cash dividend if the dividend would exceed the sum of current period net income and retained earnings from the past two years, after deducting the following transactions during that period: (i) any dividends previously declared, (ii) extraordinary transfers required by the OCC, and (iii) payments made for the retirement of preferred stock.

A depository institution may not pay any dividend if payment would cause the institution to become “undercapitalized” or if it already is “undercapitalized.” The OCC may prevent the payment of a dividend if it determines that the payment would be an unsafe and unsound banking practice.

Compensation

Under regulatory guidance applicable to all banking organizations, incentive compensation policies must be consistent with safety and soundness principles. Under this guidance, financial institutions must review their compensation programs to ensure that they: (i) provide employees with incentives that appropriately balance risk and reward and that do not encourage imprudent risk, (ii) are compatible with effective controls and risk management, and (iii) are supported by strong corporate governance, including active and effective oversight by the banking organization’s board of directors. Monitoring methods and processes used by a banking organization should be commensurate with the size and complexity of the organization and its use of incentive compensation. During 2016, as required by the Dodd-Frank Act, the federal bank regulatory agencies and the SEC proposed revised rules on incentive-based payment arrangements at specified regulated entities having at least $1 billion of total assets (including the Company and Bank).

In October 2022, the SEC adopted final rules implementing the incentive-based compensation recovery (clawback) provisions of the Dodd-Frank Act. In response to the final rules, the Nasdaq Stock Market implemented new clawback listing standards which are applicable to the Company. The Company has adopted a Nasdaq compliant clawback policy which is included as an exhibit with this Annual Report on Form 10-K.

Cybersecurity and Data Breaches

Federal regulators have issued multiple statements regarding cybersecurity and that financial institutions need to design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. In addition, a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations in the event of a cyber-attack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or one of its critical service providers fall victim to a cyber-attack. Effective May 1, 2022, banking organizations are required to notify their primary banking regulator within 36 hours of determining that a “computer-security incident” has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, a number of states, notably including California where we conduct substantially all our banking business, have adopted laws and/or regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many such states have also implemented or modified their data breach notification and data privacy requirements, including California and New York. We expect this trend of state-level activity in those areas to continue, and we continue to monitor relevant legislative and regulatory developments in California and other states in which our customers are located or in which we conduct business.

In the ordinary course of business, we rely on electronic communications and information systems, as well as certain third-party service providers’ electronic communication and information systems, to conduct our operations and to store sensitive data. We employ a layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. We also seek to evaluate and monitor the cybersecurity policies and practices of key third-party service providers which utilize electronic and information systems that interface with our Bank’s systems, in the manner and to the extent required by applicable banking laws and regulations. Notwithstanding the strength of our defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our customers and third-party service providers are under constant threat, and it is possible that we or they could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our customers. In addition, to the extent we experience any data breaches, we may become subject to governmental fines or enforcement actions and reputation risk as well as potential liability arising out of governmental or private litigation. See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity and data breaches.

Operations and Consumer Compliance Laws

The Bank must comply with numerous federal and state anti-money laundering and consumer protection statutes and implementing regulations, including the USA PATRIOT Act of 2001, the Bank Secrecy Act, the Foreign Account Tax Compliance Act, the CRA, the California Consumer Privacy Act, the California Privacy Rights Act, the Fair Debt Collection Practices Act, the Fair Credit Reporting Act, the Equal Credit Opportunity Act, the Truth in Lending Act, the Fair Housing Act, the Home Mortgage Disclosure Act, the Real Estate Settlement Procedures Act, the National Flood Insurance Act, the California Homeowner Bill of Rights and various federal and state privacy protection laws, including the Telephone Consumer Protection Act and the CAN-SPAM Act. Noncompliance with any of these laws could subject the Bank to compliance enforcement actions as well as lawsuits and could also result in administrative penalties, including, fines and reimbursements. The Bank and the Company are also subject to federal and state laws prohibiting unfair or fraudulent business practices, untrue or misleading advertising and unfair competition.

These laws and regulations mandate certain disclosure and reporting requirements and regulate the manner in which financial institutions must deal with customers when taking deposits, making loans, servicing, collecting and foreclosure of loans, and providing other services. Failure to comply with these laws and regulations can subject the Bank and the Company to various penalties, including but not limited to enforcement actions, injunctions, fines or criminal penalties, punitive damages to consumers, and the loss of certain contractual rights.

The Anti-Money Laundering Act of 2020 (“AMLA”), which amends the Bank Secrecy Act of 1970 (“BSA”), was enacted in January 2021. The AMLA is intended to be a comprehensive reform and modernization to U.S. bank secrecy and anti-money laundering laws. Among other things, it codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the development of standards for evaluating technology and internal processes for BSA compliance; expands enforcement and investigation-related authority, including increasing available sanctions for certain BSA violations and instituting BSA whistleblower incentives and protections.

The CRA specifically directs the federal bank regulatory agencies, in examining insured depository institutions, to assess their record of helping to meet the credit needs of the entire communities in which the financial institution operates, including low and moderate income communities, consistent with safe and sound banking practices. The CRA further requires the agencies to take a financial institution’s record of meeting its community credit needs into account when evaluating applications for, among other things, domestic branches, consummating mergers or acquisitions or holding company formations. On October 24, 2023, the OCC, FDIC, and FRB issued a final rule intended to modernize and strengthen regulations implementing the CRA. For banks with total assets in excess of $2 billion, which includes the Bank, the Bank’s CRA evaluation will be based on four tests: (i) retail lending; (ii) retail services and products (including digital delivery systems for banks with more than $10 billion in assets or banks which request consideration of such systems); (iii) community development (“CD”) financing; and (iv) CD services. Weighting of each test is applied to those banks (such as the bank) when regulators are evaluating CRA performance based on multiple tests. Alternatively, banks (including the Bank) have the option to be evaluated based on a regulator-approved strategic CRA plan. In addition, banks with total assets in excess of $2 billion are subject to revised and more comprehensive CRA-related data collection, reporting and maintenance requirements. Regulators will downgrade an institution’s CRA rating in the case of illegal or discriminatory credit practices. The Bank received an overall “Satisfactory” rating in its most recent FDIC CRA performance evaluation, which measures how financial institutions support their communities in the areas of lending, investment and service tests. The Bank received a “High Satisfactory” rating for both the lending and the investment tests and an “Outstanding” rating for the service test.

The final CRA rule was intended to take effect on April 1, 2024 with staggered compliance dates, including compliance with the new tests, data collection requirements, and with the requirement to define retail lending assessment areas. The final CRA rule is currently subject to a preliminary injunction that stays its effective and implementation dates. On July 16, 2025, the OCC, the FDIC and the FRB issued a joint notice of proposed rulemaking to rescind the final CRA rule and reinstate the CRA framework that existed prior to the issuance of the final CRA rule.

The Dodd-Frank Act provided for the creation of the Consumer Financial Protection Bureau (“CFPB”) as an independent entity within the Federal Reserve with broad rulemaking, supervisory and enforcement authority over consumer financial products and services, including deposit products, residential mortgages, home-equity loans and credit cards. The CFPB’s functions include investigating consumer complaints, conducting market research, rulemaking, and enforcing rules related to consumer financial products and services. CFPB regulations and guidance apply to all covered persons and banks with $10 billion or more in assets, such as the Bank. Accordingly, the Bank is subject to CFPB supervision, including examination by the CFPB. The administration of President Trump has significantly limit the enforcement and rule-making authority of the CFPB, though the exact ongoing scope of such limitations cannot yet be fully determined.

The CFPB previously finalized a number of significant rules which impact nearly every aspect of the lifecycle of a residential mortgage loan. These rules implement the Dodd-Frank Act amendments to the Equal Credit Opportunity Act, the Truth in Lending Act and the Real Estate Settlement Procedures Act. Among other things, the rules adopted by the CFPB require covered persons including banks making residential mortgage loans to: (i) develop and implement procedures to ensure compliance with an “ability-to-repay” test and identify whether a loan meets a new definition for a “qualified mortgage”, in which case a rebuttable presumption exists that the creditor extending the loan has satisfied the ability-to-repay test; (ii) implement new or revised disclosures, policies and procedures for originating and servicing mortgages including, but not limited to, pre-loan counseling, early intervention with delinquent borrowers and specific loss mitigation procedures for loans secured by a borrower’s principal residence; (iii) comply with additional restrictions on mortgage loan originator hiring and compensation; (iv) comply with new disclosure requirements and standards for appraisals and certain financial products; and (v) maintain escrow accounts for higher-priced mortgage loans for a longer period of time.

The review of products and practices to prevent unfair, deceptive or abusive acts or practices (“UDAAP”) is a continuing focus of the CFPB, and of banking regulators more broadly. The ultimate impact of this heightened scrutiny is uncertain but could result in changes to pricing, practices, products and procedures. It could also result in increased costs related to regulatory oversight, supervision and examination, additional remediation efforts and possible penalties. In addition, the Dodd-Frank Act provides the CFPB with broad supervisory, examination and enforcement authority over various consumer financial products and services, including the ability to require reimbursements and other payments to customers for alleged violations of UDAAP and other legal requirements and to impose significant penalties, as well as injunctive relief that prohibits lenders from engaging in allegedly unlawful practices. The CFPB also has the authority to obtain cease and desist orders providing for affirmative relief or monetary penalties. The Dodd-Frank Act does not prevent states from adopting stricter consumer protection standards. CFPB and state regulation of financial products and potential enforcement actions could adversely affect the Bank’s business, financial condition or results of operations.

The federal bank regulators have adopted rules limiting the ability of banks and other financial institutions to disclose non-public information about consumers to unaffiliated third parties. These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a nonaffiliated third party. These regulations affect how consumer information is transmitted through diversified financial companies and conveyed to outside vendors. In addition, consumers may also prevent disclosure of certain information among affiliated companies that is assembled or used to determine eligibility for a product or service, such as that shown on consumer credit reports and asset and income information from applications. Consumers also have the option to direct banks and other financial institutions not to share information about transactions and experiences with affiliated companies for the purpose of marketing products or services.

In California, consumer privacy rights have been further bolstered by the enactment of the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”). The CCPA and CPRA create new consumer rights, impose additional obligations on businesses that collect personal information from California consumers, and create a new enforcement agency called the California Privacy Protection Agency. In particular, The CCPA and CPRA introduces four new consumer rights, including (1) the right to correction, meaning that users can request to have their personal information corrected; (2) the right to opt-out of automated decision making, meaning that California residents can say ‘no’ to their personal information being used in profiling for behavioral advertisement online; (3) the right to know about automated decision making; and (4) the right to limit use of sensitive personal information. These two statutes also significantly expand the types of consumer data subject to privacy restrictions and increase the potential penalties for any violations.

Under the Durbin Amendment to the Dodd-Frank Act, the Federal Reserve adopted rules establishing standards for assessing whether the interchange fees that may be charged with respect to certain electronic debit transactions are “reasonable and proportional” to the costs incurred by issuers for processing such transactions.

Interchange fees, or “swipe” fees, are charges that merchants pay to us and other card-issuing banks for processing electronic payment transactions. Under the final rules, the maximum permissible interchange fee is equal to no more than 21 cents plus 5 basis points of the transaction value for many types of debit interchange transactions. In October 2023, the Federal Reserve issued a proposal under which the maximum permissible interchange fee for an electronic debit transaction would be the sum of 14.4 cents per transaction and 4 basis points multiplied by the value of the transaction. Furthermore, the fraud-prevention adjustment would increase from a maximum of 1 cent to 1.3 cents per debit card transaction. The proposal would adopt an approach for future adjustments to the interchange fee cap, which would occur every other year based on issuer cost data gathered by the Federal Reserve from large debit card issuers. The comment period for this proposal ended in May 2024. The proposed rule has yet to be finalized. The extent to which any such proposed changes in permissible interchange fees will impact our future revenues is currently uncertain.

The Federal Reserve also adopted a rule to allow a debit card issuer to recover one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements required by the Federal Reserve. The Federal Reserve also has rules governing routing and exclusivity that require issuers to offer two unaffiliated networks for routing transactions on each debit or prepaid product.

Commercial Real Estate Concentration Limits

In December 2006, the federal banking regulators issued guidance entitled “Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices” to address increased concentrations in commercial real estate, or “CRE”, loans. In addition, in December 2015, the federal bank agencies issued additional guidance entitled “Statement on Prudent Risk Management for Commercial Real Estate Lending.” Together, these guidelines describe the criteria the agencies will use as indicators to identify institutions potentially exposed to CRE concentration risk. An institution that has (i) experienced rapid growth in CRE lending, (ii) notable exposure to a specific type of CRE, (iii) total reported loans for construction, land development, and other land representing 100% or more of the institution’s capital, or (iv) total CRE loans (which excludes owner-occupied CRE loans) representing 300% or more of the institution’s capital, and the outstanding balance of the institutions CRE portfolio has increased by 50% or more in the prior 36 months, may be identified for further supervisory analysis of the level and nature of its CRE concentration risk. As of December 31, 2025, the Bank’s CRE loan concentration based on total outstanding loans is 237% of risk-based capital.

Office of Foreign Assets Control Regulation

The U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”), administers and enforces economic and trade sanctions against targeted foreign countries and regimes, under authority of various laws, including designated foreign countries, nationals and others. OFAC publishes lists of specially designated targets and countries. We are responsible for, among other things, blocking accounts of, and transactions with, such targets and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence. Failure to comply with these sanctions could have serious financial, legal and reputational consequences, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required or to prohibit such transactions even if approval is not required. Regulatory authorities have imposed cease and desist orders and civil money penalties against institutions found to be violating these obligations.

Changes in the Federal, State, or Local Tax Laws

We are subject to changes in federal and applicable state tax laws and regulations that may impact our effective tax rates. Changes in these tax laws may be retroactive to previous periods and as a result could negatively impact our current and future financial performance. For example, the Tax Cuts and Jobs Act of 2017 resulted in a reduction of our federal tax rate from a minimum of 35% in 2017 to 21% in 2018, which had a favorable impact on our earnings. Conversely, this legislation also enacted limitations on certain deductions, including the deduction of FDIC deposit insurance premiums, which partially offset the expected increase in net earnings from the lower tax rate. The One Big Beautiful Bill Act (“OBBBA”) was signed and enacted into law on July 4, 2025. Except for certain provisions, this is effective for tax years beginning on or after January 1, 2025. Changes from OBBBA include modifications to allow for immediate expensing of certain business investments and provides certain permanent extensions of key business tax breaks originally enacted under the 2017 Tax Cuts and Job Act.

On August 16, 2022, the Inflation Reduction Act of 2022 (the “IRA”) was enacted into law. The IRA imposes a non-deductible 1% excise tax on the aggregate fair market value of stock repurchased by certain public companies, including the Company, occurring after December 31, 2022.

The foregoing description of the impact of changes in federal and applicable state tax laws on us should be read in conjunction with Note 9 — Income Taxes of the notes to consolidated financial statements for more information.

Future Legislation and Regulation

Congress may enact, modify or repeal legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact, modify or repeal legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although enactment of proposed legislation (or modification or repeal of existing legislation) could impact the regulatory structure under which the Company and Bank operate and may significantly increase our costs, impede the efficiency of our internal business processes, require the Bank to increase its regulatory capital and modify its business strategy, and limit its ability to pursue business opportunities in an efficient manner. The Company’s business, financial condition, results of operations or prospects may be adversely affected, perhaps materially.

Available Information

We file reports with the SEC including our proxy statements, annual reports on Form 10-K, quarterly reports on Form 10-Q and current reports on Form 8-K. The SEC maintains a website that contains these reports, proxy and information statements and other information. The address of the site is http://www.sec.gov. The Company also maintains an Internet website at http://www.cbbank.com. We make available, free of charge through our website, our Proxy Statement, Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, and Current Reports on Form 8-K, and any amendments thereto, as soon as reasonably practicable after we file such reports with the SEC. None of the information contained in or hyperlinked from our website is incorporated into this Form 10-K.

Executive Officers of the Company

The following sets forth certain information regarding our executive officers, their positions and their ages.

Executive Officers:

Name Position Age

Yamynn DeAngelis Executive Vice President and Chief Risk Officer 69

Mr. Brager was appointed Chief Executive Officer of the Company and the Bank on March 16, 2020. Effective November 19, 2021, Mr. Brager was also named President of the Company and the Bank. Mr. Brager also serves on the Board of Directors of the Company and the Bank. Mr. Bragerassumed the position of Executive Vice President and Sales Division Manager of the Bank on November 22, 2010. From 2007 to 2010, he served as Senior Vice President and Regional Manager of the Central Valley Region for the Bank. From 2003 to 2007, he served as Senior Vice President and Manager of the Fresno Business Financial Center for the Bank. From 1997 to 2003, Mr. Brager held management positions with Westamerica Bank.

Mr. Nicholson was appointed Chief Financial Officer of the Company and Executive Vice President and Chief Financial Officer of the Bank on May 4, 2016. Previously, Mr. Nicholson served as Executive Vice President and Chief Financial Officer of Pacific Premier Bank and its holding company, Pacific Premier Bancorp Inc. from June of 2015 to May of 2016. From 2008 to 2014, Mr. Nicholson was Chief Financial Officer of 1st Enterprise Bank and from 2005 to 2008, he was the Chief Financial Officer of Mellon First Business Bank.

Mr. Farnsworth was appointed Executive Vice President and Chief Credit Officer of the Bank on July 18, 2016. Prior to his appointment, Mr. Farnsworth was Executive Vice President, Global Risk Management, and National CRE Risk Executive at BBVA Compass. Previously, Mr. Farnsworth held senior credit management positions with US Bank and AmSouth.

Mr. Harvey was appointedExecutive Vice President and Chief Operating Officer of the Bank on February 23, 2022. He previously assumed the position of Executive Vice President and Chief Operations Officer of the Bank on December 31, 2009. From 2008 to 2009 he served as Executive Vice President and Commercial and Treasury Services Manager at Bank of the West. From 2000 to 2008, he served as Senior Vice President and Operations Manager at Bank of the West.

Mr. Wohl was initially appointed Executive Vice President and General Counsel of the Company and the Bank on October 11, 2011, and he rejoined the Company and the Bank in the same position on July 10, 2017 after a one-year hiatus at another financial institution. Prior to his initial appointment in 2011, Mr. Wohl served in senior business and legal roles at Indymac Bank, the law firm of Morrison & Foerster, and the U.S. Department of State.

Ms. DeAngelis assumed the position of Executive Vice President and Chief Risk Officer of the Bank on January 5, 2009. From 2006 to 2008, she served as Executive Vice President and Service Division Manager for the Bank. From 1995 to 2005, she served as Senior Vice President and Division Service Manager for the Bank.

ITEM 1A. RISK FACTORS

In the course of conducting our business operations, we are exposed to a variety of risks. Some of these risks are inherent in the financial services industry and others are more specific to our own business. Together with the other information on the risks we face and our management of risk contained in this Annual Report, the following presents the most significant risks of which we are currently aware that may affect us. Events or circumstances arising from one or more of these risks could adversely affect our business, financial condition, operating results and prospects and the value and price of our common stock could decline. The risks identified below are not intended to be a comprehensive list of all risks we face, and additional risks that we may currently view as not material may also impair our business operations, financial condition and operating results.

Risk Factors Summary

Credit Risks

•

Our allowance for credit losses may not be sufficient to cover actual losses.

•

We may be required to make additional provisions for credit losses and charge-off additional loans in the future, which could adversely affect our results of operations.

•

Our dairy & livestock and agribusiness lending presents unique credit risks.

•

Our loan portfolio is predominantly secured by real estate in California and thus we have a higher degree of credit risk from a downturn in our real estate markets.

•

Our commercial real estate loan portfolio exposes us to risks that may be greater than the risks related to our other loans.

•

We are exposed to risk of environmental liabilities with respect to properties to which we take title.

Liquidity and Interest Rate Risks

•

Liquidity risk could impair our ability to fund operations and jeopardize our financial condition.

•

Negative developments affecting the banking industry could adversely impact our liquidity.

•

The actions and commercial soundness of other financial institutions could affect our ability to engage in routine funding transactions.

•

We may not be able to maintain a strong core deposit base or other low-cost funding sources.

•

Our business is subject to interest rate risk and variations in interest rates may negatively affect our financial performance.

•

Elevated interest rates have decreased the market value of the Company’s available for sale and held-to-maturity securities and loan portfolios, and the Company would realize losses if it were required to sell such securities or loans to meet liquidity needs.

•

Hedging against interest rate exposure may adversely affect our earnings.

Operational Risks

•

We face risks related to our operational, technological and organizational infrastructure.

•

The development and use of AI presents risks and challenges that may adversely impact our business.

•

Failure to manage our growth may adversely affect our performance.

•

Risks Relating to our Pending Merger with Heritage

•

Failure to complete the proposed merger with Heritage

•

Combining with Heritage may be more difficult, costly or time-consuming than expected, and the Company may fail to realize the anticipated benefits of the merger.

•

The combined company may be unable to retain the Company’s and/or Heritage’s personnel successfully after the merger is completed.

•

The Company will be subject to business uncertainties and contractual restrictions while the merger with Heritage is pending.

•

The Company has incurred and is expected to incur substantial costs related to the merger and integration.

•

The merger agreement between the Company and Heritage may be terminated in accordance with its terms and the merger may not be completed.

•

Regulatory approvals may not be received, may take longer than expected or may impose conditions that are not presently anticipated or that could have an adverse effect on the Company following the merger.

•

Our assumptions regarding the fair value of assets acquired could be inaccurate, which could materially and adversely affect our business, financial condition, results of operations, and future prospects.

•

The future results of the Company following the completion of the mergers may suffer if the Company does not effectively manage its expanded business and operations.

•

Issuance of shares of the Company’s common stock in connection with the merger may adversely affect the market price of such common stock.

•

The occurrence of fraudulent activity, breaches or failures of our information security controls or cybersecurity-related incidents to either our information systems or information systems provided by third party vendors could have a material adverse effect on our business, financial condition and results of operations.

•

Our business is exposed to the risk of changes in technology.

•

Our controls and procedures could fail or be circumvented.

•

Failure to maintain effective internal control over financial reporting or disclosure controls and procedures could adversely affect our ability to report our financial condition and results of operations accurately and on a timely basis.

•

We rely on communications, information, operating and financial control systems technology from third-party service providers, and we may suffer an interruption in those systems.

•

We are dependent on key personnel and the loss of one or more of those key personnel may materially and adversely affect our prospects.

•

If our enterprise risk management framework is not effective at mitigating risk and loss to us, we could suffer unexpected losses and our results of operations could be materially adversely affected.

•

Changes in stock market prices could reduce fee income from our brokerage, asset management and investment advisory businesses.

•

Our accounting estimates and risk management processes rely on analytical and forecasting models.

•

Our decisions regarding the fair value of assets acquired could be different than initially estimated, which could materially and adversely affect our business, financial condition, results of operations, and future prospects.

•

If the goodwill that we recorded in connection with business acquisitions becomes impaired, it could require charges to earnings, which would have a negative impact on our financial condition and results of operations.

Strategic and External Risks

•

Changes in economic, market and political conditions can adversely affect our liquidity, results of operations and financial condition.

•

Our earnings are significantly affected by the fiscal and monetary policies of the federal government and its agencies.

•

Future legislation, regulatory reform or policy changes could have a material effect on our business and results of operations.

•

We face strong competition from financial services companies and other companies that offer banking services.

•

Consumers may decide not to use banks to complete their financial transactions.

•

Potential downgrades of U.S. government securities or the securities of U.S. government-sponsored entities by one or more of the credit ratings agencies could have a material adverse effect on our operations, earnings, and financial condition.

•

Climate change and climate change regulation could have a material adverse effect on us and our customers.

•

Public Health Risks

Legal, Regulatory, Compliance and Reputational Risks

•

We are subject to extensive government regulation that could limit or restrict our activities, which, in turn, may hamper our ability to increase our assets and earnings.

•

Any enhanced regulatory examination scrutiny or new regulatory requirements arising from recent events in the banking industry could increase the Company’s expenses and affect the Company’s operations and acquisition opportunities.

•

We face a risk of noncompliance and enforcement action with the Bank Secrecy Act and other anti-money laundering statutes and regulations.

•

The impact of current capital rules may materially affect our operations.

•

Increasing scrutiny and evolving expectations from regulators, customers, investors, and other stakeholders with respect to our environmental, social and governance practices may impose additional costs on us or expose us to new or additional risks.

•

Managing reputational risk is important to attracting and maintaining customers, investors and employees.

•

We depend on the accuracy and completeness of information provided by customers and counterparties.

•

We are subject to legal and litigation risk which could adversely affect us.

Risks Associated with our Common Stock

•

The price of our common stock may be volatile or may decline.

•

An investment in our common stock is not an insured deposit.

•

Our common stock is subordinate to our existing and future indebtedness and preferred stock.

•

Anti-takeover provisions and federal law may limit the ability of another party to acquire us, which could cause our stock price to decline.

•

We could reduce or discontinue the payment of dividends on our common stock.

Other Risks

•

We may face other risks.

Credit Risks

Our allowance for credit losses may not be sufficient to cover actual losses.

A significant source of risk arises from the possibility that we could sustain losses because borrowers, guarantors, and related parties may fail to perform in accordance with the terms of their loans and leases. The underwriting and credit monitoring policies and procedures that we have adopted to address this risk may not prevent unexpected losses that could have a material adverse effect on our business, financial condition, results of operations and cash flows. We maintain an allowance for credit losses to provide for loan and lease defaults and non-performance. While we believe that our allowance for credit losses is appropriate to cover currently expected losses, we cannot assure you that we will not increase the allowance for credit losses in the future or that our regulators or outside auditors will not require us to increase this allowance.

We may be required to make additional provisions for credit losses and charge-off additional loans in the future, which could adversely affect our results of operations.

For the year ended December 31, 2025, we recorded a $3.5 million recapture of credit losses. During 2025, we experienced charge-offs of $0.6 million and recoveries of $1.2 million, resulting in net recoveries of $0.5 million. We have a significant amount of real estate loans, therefore, decreases in real estate values could adversely affect the value of property used as collateral for our loans. As of December 31, 2025, we had $6.57 billion in commercial real estate loans, $281.8 million in single-family residential mortgages, and $37.8 million in construction loans. Low interest rates through the pandemic caused real estate values in general to increase materially due to low cost of funding with inflationary upward pressures on cash flow. Capitalization Rates used to determine commercial real estate values have increased due to overall cost of capital causing some downward pressure on real estate values. Additionally, changes in longer term commercial real estate usage and occupancy patterns, particularly in the office and retail segments, have negatively impacted the valuations of affected properties, depending on geographic location and other factors. These issues could affect the ability of our loan customers to refinance or service their debts, including those customers whose loans are secured by commercial or residential real estate. This, in turn, could result in loan charge-offs and provisions for credit losses in the future, which could have a material adverse effect on our financial condition, net income and capital.

Our dairy & livestock and agribusiness lending presents unique credit risks.

As of December 31, 2025, approximately 5.0% of our total gross loan portfolio was comprised of dairy & livestock and agribusiness loans. As of December 31, 2025, we had $431.6 million in dairy & livestock and agribusiness loans, including $386.1 million in dairy & livestock loans and $45.5 million in agribusiness loans. Repayment of dairy & livestock and agribusiness loans depends primarily on the successful raising and feeding of livestock or planting and harvesting of crops and marketing the harvested commodity (including milk production). Collateral securing these loans may be illiquid. In addition, the limited purpose of some agricultural-related collateral affects credit risk because such collateral may have limited or no other uses to support values when loan repayment problems emerge. Our dairy & livestock and agribusiness lending staff have specific technical expertise that we depend on to mitigate our lending risks for these loans and we may have difficulty retaining or replacing such individuals. Many external factors can impact our dairy and agricultural borrowers’ ability to repay their loans, including the effects of inflation, adverse weather conditions, water issues, commodity price volatility (i.e. milk prices), diseases (including bird flu), land values, production costs, changing government regulations and subsidy programs, changing tax treatment, technological changes, labor market shortages/increased wages, and changes in consumers’ preferences, over which our borrowers may have no control. These factors, as well as recent volatility in certain commodity prices, including milk prices, could adversely impact the ability of those to whom we have made dairy & livestock and agribusiness loans to perform under the terms of their borrowing arrangements with us, which in turn could result in credit losses and adversely affect our business, financial condition and results of operations.

Our loan portfolio is predominantly secured by real estate in California and thus we have a higher degree of credit risk from a downturn in our real estate markets.

A renewed downturn in our real estate markets could hurt our business because most of our loans are secured by real estate. Real estate values and real estate markets are generally affected by changes in national, regional or local economic conditions, fluctuations in interest rates and the availability of loans to potential purchasers, changes in tax laws and other governmental statutes, regulations and policies, and acts of nature, such as earthquakes, prolonged drought, pandemics, wildfires and other disasters particular to California. The vast majority of our real estate collateral is located in the state of California. If real estate values, including values of land held for development, should again start to decline, the value of real estate collateral securing our loans could be significantly reduced. Our ability to recover on defaulted loans by foreclosing and selling the real estate collateral would then be diminished and we would be more likely to suffer losses on any such defaulted loans. Commercial real estate loans typically involve large balances to single borrowers or a group of related borrowers. Since payments on these loans are often dependent on the successful operation or management of the properties, as well as the business and financial condition of the borrower(s), repayment of such loans may be subject to adverse conditions in the real estate market, adverse economic conditions or changes in applicable government regulations.

Additional risks associated with our real estate construction loan portfolio include failure of developers and/or contractors to complete construction on a timely basis or at all, market deterioration during construction, cost overruns and failure to sell or lease the properties underlying the construction loans so as to generate the cash flow anticipated by our borrower.

A decline in the economy may cause declines in real estate values and increases in unemployment, which may result in higher than expected loan delinquencies or problem assets, a decline in demand for our products and services, or a lack of growth or decrease in deposits, which may cause us to incur losses, adversely affect our capital or hurt our business.

Our commercial real estate loan portfolio exposes us to risks that may be greater than the risks related to our other loans.

Federal banking regulators are examining commercial real estate lending activity with heightened scrutiny and may require banks with higher levels of commercial real estate loans to implement more stringent underwriting, internal controls, risk management policies and portfolio stress testing, as well as possibly higher levels of allowances for losses and capital levels as a result of commercial real estate lending growth and exposures. Because a significant portion of our loan portfolio is comprised of commercial real estate loans, the banking regulators may require us to maintain higher levels of capital than we would otherwise be expected to maintain or may impose limits on our ability to make additional commercial real estate loans, which could limit our ability to leverage our capital and have a material adverse effect on our business, financial condition, results of operations and prospects.

We are exposed to risk of environmental liabilities with respect to properties to which we take title.

In the course of our business, we may foreclose and take title to real estate, and we could be subject to environmental liabilities with respect to these properties. While we will take steps to mitigate this risk, we may be held liable to a governmental entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination, or we may be required to investigate or clean-up hazardous or toxic substances, or chemical releases at one or more properties. The costs associated with investigation or remediation activities could be substantial. In addition, while there are certain statutory protections afforded lenders who take title to property through foreclosure on a loan, if we are the owner or former owner of a contaminated site, we may be subject to common law claims by third parties based on damages and costs resulting from environmental contamination emanating from the property. If we become subject to significant environmental liabilities, our business, financial condition, results of operations and prospects could be adversely affected.

Liquidity and Interest Rate Risks

Liquidity risk could impair our ability to fund operations and jeopardize our financial condition.

Liquidity is essential to our banking business. An inability to raise funds through deposits, borrowings, the sale of investment securities, loans and other sources could have a material adverse effect on our liquidity. Our access to funding sources in amounts adequate to finance our activities could be impaired by factors that affect us specifically or the banking or broader financial services industry in general. Factors that could detrimentally impact our access to liquidity sources include a decrease in the level of our business activity due to a market downturn or adverse regulatory action against us. Our ability to acquire deposits or borrow could also be impaired by factors that are not specific to us, such as the effects of inflation,

rising or falling interest rates, a severe disruption of the financial markets or negative views and expectations about the prospects for the banking or financial services industry as a whole. Many if not all of these same factors could also significantly raise the cost of deposits to our Company and/or to the banking industry in general. This in turn could negatively affect our ability to attract deposits generally and the amount of interest we pay on our interest-bearing liabilities, which could have an adverse impact on our interest rate spread and profitability.

Negative developments affecting the banking industry could adversely impact our liquidity.

High-profile bank failures in 2023 generated significant market volatility among publicly traded bank holding companies and, in particular, regional community banks like the Bank. These market developments negatively impacted customer confidence in the safety and soundness of smaller regional and community banks. As a result, customers may choose to maintain deposits with larger more systemically important financial institutions, restrict the amount of deposits they place with a given financial institution, or invest in higher yielding and higher-rated short-term fixed income securities, all of which could materially adversely impact the Bank’s liquidity, loan funding capacity, net interest margin, capital and results of operations. While the Bank currently has access to substantial borrowing capacity from the Federal Reserve Bank, the Federal Home Loan Bank and credit facilities established with larger banks, there can be no assurance that customer confidence in regional banks and the banking system more broadly has been fully restored or that potential liquidity concerns will recede or that such access to alternative sources of liquidity will continue unimpaired.

The actions and commercial soundness of other financial institutions could affect our ability to engage in routine funding transactions.

Financial service institutions are interconnected as a result of trading, clearing, counterparty or other relationships. We have exposure to different industries and counterparties, and we typically execute transactions with various counterparties in the financial industry, including brokers and dealers, commercial banks, investment banks, mutual funds, and other institutional clients. Defaults by financial services institutions, even rumors or questions about one or more financial institutions or the financial services industry in general, could lead to market wide liquidity problems and further, could lead to losses or defaults by the Company or other institutions. Many of these transactions expose us to credit risk in the event of default of the applicable counterparty or client. In addition, our credit risk may increase when the collateral held by us cannot be realized upon or is liquidated at prices not sufficient to recover the full amount of the loan or derivative exposure due to us. Any such losses could materially and adversely affect our consolidated financial statements.

We may not be able to maintain a strong core deposit base or other low-cost funding sources.

We depend on checking, savings and money market deposit account balances and other forms of customer deposits as our primary source of funding for our lending activities. Future growth in our banking business will largely depend on our ability to maintain and grow a strong and low-cost deposit base. There is no assurance that we will be able to grow and maintain our deposit base. Deposit balances can decrease when customers perceive alternative investments, such as higher yielding money market funds, the stock market, bond market or real estate, as providing a better risk/return tradeoff. If customers move money out of bank deposits and into investments (or similar deposit products at other institutions that may provide a higher rate of return), we could lose a relatively low cost source of funds, increasing our funding costs and reducing our net interest income and net income. Additionally, any such loss of funds could result in lower loan originations, which could adversely impact our growth strategy.

Our business is subject to interest rate risk and variations in interest rates may negatively affect our financial performance.

A substantial portion of our income is derived from the differential or “spread” between the interest earned on loans, securities and other interest-earning assets, and the interest paid on deposits, borrowings and other interest-bearing liabilities. Because of the differences in the maturities and repricing characteristics of our interest-earning assets and interest-bearing liabilities, changes in interest rates do not produce equivalent changes in interest income earned on interest-earning assets and interest paid on interest-bearing liabilities. At December 31, 2025, our balance sheet was positioned with a modest asset sensitive bias over both a one and two-year horizon, assuming no balance sheet growth, and as a result, our net interest margin tends to expand in a rising interest rate environment and to decrease in a declining interest rate environment. Accordingly, fluctuations in interest rates could adversely affect our interest rate spread and, in turn, our profitability. Loan origination volumes may also be affected by changes in market interest rates. In addition, in rising interest rate environments, loan repayment rates may decline and in falling interest rate environments, loan repayment rates may increase. Rising interest rates may also cause a decline in principal payments, while a decline in interest rates may accelerate principal payments for a significant portion of our investment securities. In a rising interest rate environment, we may need to accelerate the pace of

rate increases on our deposit accounts as compared to the pace of future increases in short-term market rates and our customers could move their deposits with us to money market funds or institutions that pay higher interest rates on deposits accounts. Accordingly, changes in levels of market interest rates could materially and adversely affect our net interest spread, asset quality, levels of deposits, as well as our loan origination and prepayment volume.

As a result of inflationary pressures that resulted in rapid increases in interest rates initiated by the Federal Reserve during 2022-2023, the fair values of previously purchased fixed income securities have declined significantly. At December 31, 2025, the total carrying value of our securities portfolio was $4.95 billion, of which $2.68 billion was available-for-sale and $2.27 billion was held-to-maturity. The aggregate pre-tax net unrealized loss in our available-for-sale (“AFS”) securities was $307.8 million at December 31, 2025. Based on estimated fair values, the aggregate pre-tax net unrealized loss in our held-to-maturity (“HTM”) securities was approximately $344.9 million at December 31, 2025. In addition, the fair value of many of our loans, which have interest rates that are fixed until maturity or reset on a future date, has been negatively impacted by the increases in interest rates from the time these loans were originated.

While the Company does not currently intend to sell these securities or loans, if the Company were required to sell such securities or loans to meet liquidity needs, it could incur significant losses, which could impair the Company’s capital, financial condition, and results of operations, thereby negatively impacting our profitability. While the Company has taken actions to maximize its funding sources, there is no guarantee that such actions and the Company's borrowing facilities will be successful or sufficient in the event of sudden liquidity needs.

Hedging against interest rate exposure may adversely affect our earnings.

On occasion we have employed various financial risk methodologies that limit, or “hedge,” the adverse effects of rising or decreasing interest rates on our loan portfolios, investment securities, and short-term liabilities. We also engage in hedging strategies with respect to arrangements where our customers swap floating interest rate obligations for fixed interest rate obligations, or vice versa. Our hedging activity varies based on the level and volatility of interest rates and other changing market conditions. There are no perfect hedging strategies, and interest rate hedging may fail to protect us from loss. Moreover, hedging activities could result in losses if the event against which we hedge does not occur. Additionally, interest rate hedging could fail to protect us or adversely affect us because, among other things:

•

Available interest rate hedging may not correspond directly with the interest rate risk for which protection is sought;

•

The duration of the hedge may not match the duration of the related asset or liability;

•

The party owing money in the hedging transaction may default on its obligation to pay;

•

The credit quality of the party owing money on the hedge may be downgraded to such an extent that it impairs our ability to sell or assign our side of the hedging transaction;

•

The value of derivatives used for hedging may be adjusted from time to time in accordance with accounting rules to reflect changes in fair value; and/or

•

Downward adjustments, or “mark-to-market” losses, would reduce our stockholders’ equity.

Operational Risks

We face risks related to our operational, technological and organizational infrastructure.

Our ability to grow and compete, including to develop and deliver new products that meet the needs of our existing customers and attract new ones, is dependent on our ability to build or acquire the necessary operational and technological infrastructure and to manage the cost of that infrastructure as we expand or contract. Our ability to run our business in compliance with applicable laws and regulations is also dependent on that infrastructure. Operational risk can manifest itself in many ways, such as errors related to failed or inadequate processes, faulty or disabled computer systems, fraud by employees or outside persons and exposure to external events, and we are dependent on our operational infrastructure to help manage these risks. In addition, we are heavily dependent on the strength and capability of our technology systems, which we use both to interface with our customers and to manage our internal financial records and other systems. Any shortcomings in our technology systems subjects us to risk of misconduct by our employees that may go undetected.

A number of our most critical technology systems and applications are provided or managed by outside vendors or service providers. Any failure by such vendors or service providers to properly design, manage or secure these technology

systems and applications, or the occurrence of external events affecting the functionality of such technology systems and applications, could in turn result in significant disruptions and exposure to potential losses in connection with our operations and to us and our customers.

We are subject to extensive laws and regulations at the federal and state levels regarding the protection and security of our customers’ and employees’ personal information and data, including the federal Gramm-Leach-Bliley Act, the federal Health Insurance Portability and Accountability Act, and the California Consumer Privacy Act and California Privacy Rights Act. These laws and regulations require us to safeguard sensitive customer data and employee medical records and health-related information, and such laws and regulations closely regulate how businesses such as our Bank may collect, use and retain specified types of customer and employee information. If we fail or are unable to comply with such laws and regulations, we could incur significant legal liability, governmental investigations and penalties, and reputational damage.

We monitor our operational and technological capabilities and make modifications and improvements when we believe it will be cost effective to do so. We may build and maintain these capabilities ourselves, or we may outsource some of these functions to third parties. If we experience difficulties, fail to comply with banking or information security regulations or to keep up with increasingly sophisticated technologies, our operations could be interrupted. If an interruption were to continue for a significant period of time, our business, financial condition and results of operations could be adversely affected, perhaps materially. Even if we are able to replace them, it may be at a higher cost to us, which could materially adversely affect our business, financial condition and results of operations.

The development and use of AI presents risks and challenges that may adversely impact our business.

We, or our third party vendors, clients or counterparties may develop or incorporate Artificial Intelligence (AI) technology in certain business processes, services, or products including deploying AI in the areas of fraud detection and prevention, cybersecurity, credit risk and underwriting, regulatory compliance, process automation, data analysis, and customer marketing and product customization. We have adopted an AI Policy that establishes a governance framework for developing, deploying, and managing AI and Generative AI (GenAI) solutions and initiatives, including those involving vendors. We may rely on AI models developed by third parties, and, to that extent, would be dependent in part on the manner in which those third parties develop and train their models. AI models, particularly generative AI models, may produce output or take action that is incorrect, include unauthorized material in the training data for their models, result in the release of private, confidential, or proprietary information, reflect biases included in the data on which they are trained, infringe on the intellectual property rights of others, or are otherwise harmful. Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures. In addition, the complexity of many AI models makes it challenging to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output, eliminating bias, and complying with regulations that require documentation or explanation of the basis on which decisions are made. In addition to our use of AI technologies, we are exposed to risks arising from the use of AI technologies by bad actors to commit fraud and misappropriate funds and to facilitate cyberattacks.

The legal and regulatory environment relating to AI is uncertain and rapidly evolving, both in the U.S. and internationally, and includes regulatory schemes targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment, and other laws applicable to the use of AI. These evolving laws and regulations could require changes in our implementation of AI technology and increase our compliance costs and the risk of non-compliance.

Failure to manage our growth may adversely affect our performance.

Our financial performance and profitability depend on our ability to manage past and possible future growth. Past and future acquisitions and our continued organic growth may present operating, integration, regulatory, management and other issues that could have a material adverse effect on our business, financial condition, results of operations and cash flows.

Acquisitions are and have been a key element of our growth strategy. Certain events may arise after our acquisition of a financial institution or business, or we may learn of certain facts, events or circumstances after the completion of an acquisition, that may affect our financial condition or performance or subject us to risk of loss. These events include, but are not limited to: our success in integrating the operations, retaining key employees and customers, achieving anticipated synergies, meeting expectations and otherwise realizing the anticipated benefits of the acquisition; litigation resulting from circumstances occurring at the acquired entity prior to the date of acquisition or in connection with the acquisition itself; loan downgrades and credit loss provisions resulting from underwriting of certain acquired loans determined not to meet our credit

standards; personnel changes that cause instability within a department; delays in implementing new policies or procedures or the failure to apply new policies or procedures; and other events relating to the performance of our business. In addition, if we determine that the value of an acquired business had decreased and that the related goodwill was impaired, an impairment of goodwill charge to earnings would be recognized. Acquisitions involve inherent uncertainty and we cannot determine all potential events, facts and circumstances that could result in loss or increased costs or give assurances that our due diligence or mitigation efforts will be sufficient to protect against any such loss or increased costs.

Furthermore, failure to realize the expected revenue increases, cost savings, increases in geographic or product presence, and/or other projected benefits from an acquisition could have a material adverse effect on our business, financial condition and results of operations.

As of the date of this report, our proposed merger with Heritage is pending completion. Risks specifically associated with this pending merger can be found below under the heading “Risks Relating to our Pending Merger with Heritage.” The merger may not have the anticipated positive results, including results relating to: correctly assessing the asset quality of the assets being acquired; the total cost of integration including management attention and resources; the time required to complete the integration successfully; the amount of longer-term cost savings; being able to profitably deploy funds acquired in an acquisition; or the overall performance of the combined entity.

Risks Relating to our Pending Merger with Heritage

Failure to complete the proposed merger with Heritage

If the merger with Heritage is not completed for any reason there may be various adverse consequences and the Company may experience negative reactions from the financial markets and from its customers and employees. For example, the Company’s business may have been impacted adversely by the failure to pursue other beneficial opportunities due to the focus of management on the merger, the benefits from which may not be realized. Additionally, if the merger agreement is terminated, the market price of the Company’s common stock could decline to the extent that current market prices reflect a market assumption that the merger will be beneficial and will be completed. The Company also could be subject to litigation related to any failure to complete the merger or to proceedings commenced against the Company to perform its obligations under the merger agreement. If the merger agreement is terminated under certain circumstances. The Company may be required to pay a termination fee of $32.45 million to Heritage.

Combining with Heritage may be more difficult, costly or time-consuming than expected, and the Company may fail to realize the anticipated benefits of the merger.

The success of the merger will depend, in part, on the ability to realize the anticipated cost savings from combining the businesses of the Company and Heritage. To realize the anticipated benefits and cost savings from the merger, the Company and Heritage must successfully integrate and combine their businesses in a manner that permits those cost savings to be realized without adversely affecting current revenues and future growth. If the Company and Heritage are not able to successfully achieve these objectives, the anticipated benefits of the merger may not be realized fully or at all or may take longer to realize than expected. In addition, the actual cost savings of the merger could be less than anticipated, and integration may result in additional and unforeseen expenses.

An inability to realize the full extent of the anticipated benefits of the merger and the other transactions contemplated by the merger agreement, as well as any delays encountered in the integration process, could have an adverse effect upon the revenues, levels of expenses and operating results of the combined company following the completion of the merger, which may adversely affect the value of the common stock of the combined company following the completion of the merger.

The Company and Heritage have operated and, until the completion of the merger, must continue to operate, independently. It is possible that the integration process could result in the loss of key employees, the disruption of each company’s ongoing businesses or inconsistencies in standards, controls, procedures and policies that adversely affect the companies’ ability to maintain relationships with clients, customers, depositors and employees or to achieve the anticipated benefits and cost savings of the merger. Integration efforts between the companies may also divert management attention and resources. These integration matters could have an adverse effect to the Company during this transition period and for an undetermined period after completion of the merger on the combined company.

Furthermore, the board of directors and executive leadership of the combined company will consist of former directors and executive officers from each company. Combining the boards of directors and management teams of each company into a single board and a single management team could require the reconciliation of differing priorities and philosophies.

The combined company may be unable to retain the Company/s and/or Heritage’s personnel successfully after the merger is completed.

The success of the merger will depend in part on the combined company’s ability to retain the talent and dedication of key employees currently employed by the Company or Heritage. It is possible that these employees may decide not to remain with the Company or Heritage, as applicable, while the merger is pending or with the combined company after the merger is consummated. If the Company and Heritage are unable to retain key employees, including management, who are critical to the successful integration and future operations of the companies, the Company and Heritage could face disruptions in their operations, loss of existing customers, loss of key information, expertise or know-how and unanticipated additional recruitment costs. In addition, following the merger, if key employees terminate their employment, the combined company’s business activities may be adversely affected, and management’s attention may be diverted from successfully hiring suitable replacements, all of which may cause the combined company’s business to suffer. The Company and Heritage also may not be able to locate or retain suitable replacements for any key employees who leave either company.

The Company will be subject to business uncertainties and contractual restrictions while the merger with Heritage is pending.

Uncertainty about the effect of the merger on employees and customers may have an adverse effect to the Company. These uncertainties may impair the Company’s ability to attract, retain and motivate key personnel until the merger is completed, and could cause customers and others that deal with the Company to seek to change existing business relationships with the Company. In addition, subject to certain exceptions, the Company has agreed to operate its business in the ordinary course in all material respects and to refrain from taking certain actions that may adversely affect its ability to consummate the transactions contemplated by the merger agreement on a timely basis without the consent of Heritage. These restrictions may prevent the Company from pursuing attractive business opportunities that may arise prior to the completion of the merger.

The Company has incurred and is expected to incur substantial costs related to the merger and integration.

The Company has incurred and expects to incur a number of non-recurring costs associated with the merger. These costs include financial advisory, legal, accounting, consulting and other advisory fees, retention, severance and employee benefit-related costs, public company filing fees and other regulatory fees, financial printing and other printing costs, closing, integration and other related costs. Some of these costs are payable by the Company regardless of whether or not the merger is completed.

The merger agreement between the Company and Heritage may be terminated in accordance with its terms and the merger may not be completed.

The merger agreement is subject to a number of conditions which must be fulfilled in order to complete the merger. Those conditions include, among other things: (i) approval by each of the Company and Heritage shareholders of certain matters relating to the merger at each company’s respective special meeting, (ii) the receipt of required regulatory approvals from OCC as well as the approval of the FRB and (iii) the absence of any order, injunction, decree or other legal restraint preventing the completion of the merger, the bank merger or any of the other transactions contemplated by the merger agreement or making the completion of the merger, the bank merger or any of the other transactions contemplated by the merger agreement illegal.

Each party’s obligation to complete the merger is also subject to certain additional customary conditions, including (a) subject to applicable materiality standards, the accuracy of the representations and warranties of the other party set forth in the merger agreement, (b) the performance in all material respects by the other party of its obligations under the merger agreement and (c) the receipt by each party of an opinion from its counsel to the effect that the merger will qualify as a reorganization within the meaning of Section 368(a) of the Internal Revenue Code of 1986.

These conditions to the closing may not be fulfilled in a timely manner or at all, and, accordingly, the merger may not be completed. In addition, the parties can mutually decide to terminate the merger agreement at any time, before or after the requisite shareholder approvals, or Heritage or the Company may elect to terminate the merger agreement in certain other circumstances.

Before the merger may be completed, various approvals, consents and non-objections must be obtained from the Federal Reserve, the OCC and other regulatory authorities without the imposition of any materially burdensome regulatory condition. In determining whether to grant these approvals, the regulators consider a variety of factors, including the

regulatory standing of each party. These approvals could be delayed or not obtained at all, including due to any or all of the following: an adverse development in either party’s regulatory standing; governmental, political, community or supervisory inquiries or opposition; or changes in legislation, regulatory policy or the political environment, including changes in the leadership of regulatory agencies. Any approvals that are granted may impose terms, conditions, limitations, obligations or costs, or place restrictions on the conduct of the surviving corporation’s business or require changes to the terms of the transactions contemplated by the merger agreement. There can be no assurance that regulators will not impose any such conditions, limitations, obligations or restrictions, or that any such conditions, limitations, obligations or restrictions will not have the effect of delaying the completion of the merger, imposing additional material costs on or materially limiting the revenues of the surviving corporation following the merger, or otherwise reducing the anticipated benefits of the merger. In addition, there can be no assurance that any such conditions, limitations, obligations or restrictions will not result in the delay or abandonment of the merger. Completion of the merger is also conditioned on the absence of certain orders, injunctions or decrees by any governmental entity that would prohibit or make illegal the completion of the merger. Although the parties have agreed to use their commercially reasonable efforts to obtain the required regulatory approvals, neither the Companynor Heritage is required under the merger agreement to agree to any condition or restriction that would reasonably be expected to result in a materially burdensome regulatory condition.

Management makes various assumptions and judgments about the collectability of acquired loans, including the credit worthiness of borrowers and the value of the real estate and other assets serving as collateral for the repayment of secured loans. If our assumptions are incorrect, significant earnings volatility can occur and credit loss provisions may be needed to respond to different economic conditions or adverse developments in the acquired loan portfolio. Any increase in future loan losses could have a material adverse impact on our business, financial condition, results of operations and prospects.

The future results of the Company following the completion of the mergers may suffer if the Company does not effectively manage its expanded business and operations.

Following the mergers, the size of the business of the Company will increase beyond the current size of either the Company’s or Heritage’s current business. The Company’s future success will depend, in part, upon its ability to manage this expanded business size, which may pose challenges for management, including challenges related to the management and monitoring of new operations and associated increased costs and complexity. The Company may also face increased scrutiny from governmental entities as a result of the increased size of its business and geographic footprint. There can be no assurances that the Company will be successful or that it will realize the expected operating efficiencies, revenue enhancement or other benefits currently anticipated from the merger.

Issuance of shares of the Company’s common stock in connection with the merger may adversely affect the market price of such common stock.

In connection with the payment of the merger consideration, the Company has stated that it expects to issue approximately 40.6 million shares of the Company’s common stock to Heritage shareholders. The issuance of these new shares of the Company’s common stock may result in fluctuations in the market price of such common stock, including a stock price decrease.

As a financial institution, we are susceptible to fraudulent activity, information security breaches and other cybersecurity-related incidents and attacks that may be committed against us, our customers or key vendors and business partners, which in turn may result in financial losses or increased costs to us, our customers, or our key vendors and business partners, disclosure or misuse of our information or our customer information, theft or misappropriation of assets (including bank or customer funds), privacy breaches against us or our customers, litigation, regulatory enforcement actions, and damage to our reputation. The U.S. government has warned financial institutions of the potential increase in the frequency and severity of malicious cyber-attacks and other activities involving critical infrastructure, specifically including the financial sector, and has encouraged the banking sector to enhance cyber-defenses, and these risks have increased in connection with the current conflicts involving Ukraine and Russia in Europe and Israel, Hamas and Iran in the Middle East. While CBB has taken measures to protect its own and customer funds and confidential information against cyber-attacks, as well as other malicious activities, there can be no assurance that such measures will be successful in thwarting such attacks and activities.

Information pertaining to us and our clients is maintained, and transactions are executed, such as our online banking or core systems on the networks and systems of ours, our clients and certain of our third party providers. The secure maintenance and transmission of confidential information, as well as execution of transactions over these systems, are essential to protect us and our clients against fraud and security breaches and to maintain our clients’ confidence. In addition, increases in criminal activity levels and sophistication, advances in computer capabilities, new discoveries, vulnerabilities in third-party technologies (including browsers and operating systems) or other developments could result in a compromise or breach of the technology, processes and controls that we use to prevent fraudulent transactions and to protect data about us, our clients and underlying transactions, as well as the technology used by our clients to access our systems. Although we continue to invest in systems and processes that are designed to detect and prevent security breaches and cyber-attacks and periodically test our security, our inability to anticipate, or failure to adequately mitigate, breaches of security could result in, among other things, losses to us or our clients; our loss of business and/or clients; damage to our reputation; the incurrence of additional expenses; disruption to our business; our inability to grow our online services or other businesses; additional regulatory scrutiny or penalties; or our exposure to civil litigation and possible financial liability — any of which could have a material adverse effect on our business, financial condition and results of operations.

More generally, continued publicized information concerning security and cyber-related problems could inhibit the use or growth of electronic or web-based applications or solutions as a means of conducting commercial transactions for us and other financial institutions. Such publicity may also cause damage to our reputation as a financial institution. As a result, our business, financial condition and results of operations could be adversely affected.

Our business is exposed to the risk of changes in technology.

The rapid pace of technology changes and the impact of such changes on financial services generally and on our Company specifically could impact our cost structure and our competitive position with our customers. Such developments include the rapid movement by customers and some competitor financial institutions to web-based services, mobile banking and cloud computing. Our failure or inability to anticipate, plan for or implement technology change could adversely affect our competitive position, financial condition and profitability. In addition, recent regulatory changes proposed by the CFPB regarding the electronic portability of customer banking and other financial information could significantly impact our costs and our ability to protect and secure such information.

Our controls and procedures could fail or be circumvented.

Management regularly reviews and updates our internal controls, disclosure controls and procedures and corporate governance policies and procedures. Any system of controls, however well designed and operated, is based in part on certain assumptions and on the conduct of individuals, and can provide only reasonable, but not absolute, assurances of the effectiveness of these systems and controls, and that the objectives of these controls have been met. Any failure or circumvention of our controls and procedures, and any failure to comply with regulations related to controls and procedures could adversely affect our business, results of operations and financial condition.

A failure to maintain effective internal control over financial reporting or disclosure controls and procedures could adversely affect our ability to report our financial results accurately and on a timely basis, which could result in a loss of investor confidence in our financial reporting or adversely affect our access to sources of liquidity. Furthermore, because of the inherent limitations of any system of internal control over financial reporting, including the possibility of human error, the

circumvention or overriding of controls and fraud, even effective internal controls may not prevent or detect all misstatements.

We rely on communications, information, operating and financial control systems technology from third-party service providers, and we may suffer an interruption in those systems.

We rely heavily on third-party service providers for much of our communications, information, operating and financial control systems technology, including our internet banking services and data processing systems. Any failure or interruption of these services or systems or breaches in the security of these systems could result in failures or interruptions to serve our customers, including deposit, servicing and/or loan origination systems. The occurrence of any failures or interruptions may require us to identify alternative sources of such services, which may result in increased costs or other consequences that in turn could have an adverse effect on our business, including damage to the Bank’s reputation.

We are dependent on key personnel and the loss of one or more of those key personnel may materially and adversely affect our prospects.

CVBF US Equity

CVBF · 10-K · period ended 2025-12-31

ITEM 1.BUSINESS

ITEM 1A. RISK FACTORS

CVBF US Equity☆

CVBF · 10-K · period ended 2025-12-31

ITEM 1.BUSINESS

ITEM 1A. RISK FACTORS

CVBF US Equity