FBK US Equity☆

fbk-20231231

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

______________________________________________________________

FORM 10-K

______________________________________________________________

(Mark One)

☒ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended December 31, 2023

OR

☐TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from ________ to ________

Commission File Number 001-37875

_____________________________________________________________

FB FINANCIAL CORPORATION

(Exact name of registrant as specified in its charter)

______________________________________________________________

(Address of principal executive offices) (Zip Code)

Registrant’s telephone number, including area code: (615) 564-1212

___________________________________________________________

Securities registered pursuant to Section 12(b) of the Act:

Title of each class Trading Symbol(s) Name of each exchange on which registered

Common Stock, Par Value $1.00 Per Share FBK New York Stock Exchange

Securities registered pursuant to Section 12(g) of the Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer as defined in Rule 405 of the Securities Act. Yes ☐ No ☒

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the Registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large accelerated filer ☒ Accelerated filer ☐

Non-accelerated filer ☐ Small reporting company ☐

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting

under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒

As of June 30, 2023, the last business day of the registrant's most recently completed second fiscal quarter, the aggregate market value of the registrant's common stock held by non-affiliates of the registrant was 987,421,710, based on the closing sale price of $28.05 per share as reported on the New York Stock Exchange.

The number of shares of registrant’s Common Stock outstanding as of February 13, 2024 was 46,858,267.

Portions of the registrant’s Definitive Proxy Statement relating to the registrant's 2024 Annual Meeting of Shareholders, which will be filed within 120 days after December 31, 2023, are incorporated by reference into Part III of this Annual Report on Form 10-K.

1

Table of Contents

Page

PART I.

Item 1. Business 5

Item 1A. Risk Factors 20

Item 1B. Unresolved Staff Comments 31

Item 1C. Cybersecurity 32

Item 2. Properties 33

Item 3. Legal Proceedings 33

Item 4. Mine Safety Disclosures 33

PART II.

Item 6. [RESERVED] 35

Item 7A. Quantitative and Qualitative Disclosures About Market Risk 76

Item 8. Financial Statements and Supplementary Data 80

Item 9A. Controls and Procedures 139

Item 9B. Other Information 139

Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections 140

PART III.

Item 10. Directors, Executive Officers and Corporate Governance 141

Item 11. Executive Compensation 141

Item 14. Principal Accounting Fees and Services 141

PART IV.

Item 15. Exhibits and Financial Statement Schedules 142

2

GLOSSARY OF ABBREVIATIONS AND ACRONYMS

As used in this Annual Report on Form 10-K for the years ended December 31, 2023, 2022, and 2021 (this "Report"), references to “we,” “our,” “us,” “FB Financial,” or “the Company” refer to FB Financial Corporation, a Tennessee corporation, and our wholly-owned banking subsidiary, FirstBank, a Tennessee state-chartered bank, unless otherwise indicated or the context otherwise requires. References to “Bank” or “FirstBank” refer to FirstBank, our wholly-owned banking subsidiary.

The acronyms and abbreviations identified below are used in the Notes to the consolidated financial statements as well as in the Management’s discussion and analysis of financial condition and results of operations. You may find it helpful to refer to this page as you read this Report.

ACL Allowance for credit losses FDIC Federal Deposit Insurance Corporation

ALCO Asset Liability Management Committee FHLB Federal Home Loan Bank

AMLA Anti-Money Laundering Act of 2020 FRA Federal Reserve Act,

ASC Accounting Standard Codification GDP Gross domestic product

ASU Accounting Standard Update GLBA Gramm-Leach-Bliley Act

Bank FirstBank, subsidiary bank GNMA Government National Mortgage Association

BSA Bank Secrecy Act HELOC Home equity line of credit

BTFP Bank Term Funding Program HFI Held for investment

CARES Coronavirus Aid, Relief, and Economic Security Act HFS Held for sale

CD Certificate of Deposit IRLC Interest rate lock commitment

CECL Current expected credit losses LIBOR London Interbank Offered Rate

CET1 Common Equity Tier 1 MBS Mortgage‐backed securities

CFPB Consumer Financial Protection Bureau MSA Metropolitan statistical areas

CIBCA Change in Bank Control Act MSR Mortgage servicing rights

CISO Chief Information Security Officer NIM Net interest margin

COVID-19 Coronavirus pandemic OFAC Office of Foreign Assets Control

CPR Conditional prepayment rate OREO Other real estate owned

CRA Community Reinvestment Act PCD Purchased credit deteriorated

CRE Commercial real estate PSU Performance-based restricted stock units

DIF Deposit Insurance Fund ROAA Return on average assets

DOJ Department of Justice RSU Restricted stock units

ERG Employee Resource Groups SEC U.S. Securities and Exchange Commission

ESPP Employee Stock Purchase Plan SOFR Secured overnight financing rate

EVE Economic value of equity TDFI Tennessee Department of Financial Institutions

FASB Financial Accounting Standards Board TDR Troubled debt restructuring

FDIA Federal Deposit Insurance Act U.S. United States of America

3

Cautionary note regarding forward-looking statements

This Annual Report contains certain forward-looking statements that are not historical in nature and may be considered forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These forward-looking statements include, without limitation, statements regarding the Company’s future plans, results, strategies, and expectations, including but not limited to expectations around changing economic markets. These statements can generally be identified by the use of the words and phrases “may,” “will,” “should,” “could,” “would,” “goal,” “plan,” “potential,” “estimate,” “project,” “believe,” “intend,” “anticipate,” “expect,” “target,” “aim,” “predict,” “continue,” “seek,” “forecasts” “likely,” “future,” “strategy” and other variations of such words and phrases and similar expressions. These forward-looking statements are not historical facts, and are based upon management's current expectations, estimates, and projections, many of which, by their nature, are inherently uncertain and beyond the Company’s control. The inclusion of these forward-looking statements should not be regarded as a representation by the Company or any other person that such expectations, estimates, and projections will be achieved. Accordingly, the Company cautions shareholders and investors that any such forward-looking statements are not guarantees of future performance and are subject to risks, assumptions, and uncertainties that are difficult to predict. Actual outcomes and results may prove to be materially different from the outcomes and results expressed or implied by the forward-looking statements.

A number of factors could cause actual results to differ materially from those contemplated by the forward-looking statements including, without limitation, (1) current and future economic conditions, including the effects of inflation, interest rate fluctuations, changes in the economy or global supply chain, supply-demand imbalances affecting local real estate prices, and high unemployment rates in the local or regional economies in which the Company operates and/or the US economy generally, (2) changes in government interest rate policies and its impact on the Company’s business, net interest margin, and mortgage operations, (3) any continuation of the recent turmoil in the banking industry, including the associated impact to the Company and other financial institutions of any regulatory changes or other mitigation efforts taken by government agencies in response, (4) increased competition for deposits, (5) the Company’s ability to effectively manage problem credits, (6) any deterioration in commercial real estate market fundamentals, (7) the Company’s ability to identify potential candidates for, consummate, and achieve synergies from, potential future acquisitions, (8) the Company’s ability to successfully execute its various business strategies, (9) changes in state and federal legislation, regulations or policies applicable to banks and other financial service providers, including legislative developments, (10) the effectiveness of the Company’s cybersecurity controls and procedures to prevent and mitigate attempted intrusions, (11) the Company's dependence on information technology systems of third-party service providers and the risk of systems failures, interruptions, or breaches of security, and (12) the impact of natural disasters, pandemics, and/or acts of war or terrorism, (13) events giving rise to international or regional political instability, including the broader impacts of such events on financial markets and/or global macroeconomic environments, and (14) general competitive, economic, political, and market conditions.

The foregoing factors should not be construed as exhaustive and should be read in conjunction with the sections entitled “Risk Factors” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations” included in this Annual Report; and in any of the Company’s subsequent Securities and Exchange Commission Filings. Many of these factors are beyond the Company’s ability to control or predict. If one or more events related to these or other risks or uncertainties materialize, or if the underlying assumptions prove to be incorrect, actual results may differ materially from the forward-looking statements. Accordingly, shareholders and investors should not place undue reliance on any such forward-looking statements. Any forward-looking statement speaks only as of the date of this Annual Report, and the Company undertakes no obligation to publicly update or review any forward-looking statement, whether as a result of new information, future developments or otherwise, except as required by law. New risks and uncertainties may emerge from time to time, and it is not possible for the Company to predict their occurrence or how they will affect the Company. The Company qualifies all forward-looking statements by these cautionary statements.

4

PART I

ITEM - 1. Business

In this Annual Report, the terms “we,” “our,” “ours,” “us,” “FB Financial,” and “the Company” refer to FB Financial Corporation, a Tennessee corporation, and our wholly-owned subsidiaries, including our state-chartered consolidated banking subsidiary, “FirstBank” or “the Bank,” unless the context indicates that we refer only to the parent company, FB Financial Corporation.

Overview

FB Financial Corporation is a bank holding company designated as a financial holding company. We are headquartered in Nashville, Tennessee. Our wholly-owned bank subsidiary is FirstBank which provides a comprehensive suite of commercial and consumer banking services to clients in select markets primarily in Tennessee, Kentucky, Alabama and North Georgia. As of December 31, 2023, our footprint included 81 full-service bank branches and several other limited service banking, ATM and mortgage loan production locations serving the Tennessee metropolitan markets of Nashville, Chattanooga (including North Georgia), Knoxville, Memphis, and Jackson in addition to the metropolitan markets of Birmingham, Florence and Huntsville, Alabama and Bowling Green, Kentucky. The Bank also operates in 17 community markets. Further, the Company also provides mortgage banking services utilizing its bank branch network and mortgage banking offices located throughout the southeastern United States. As of December 31, 2023, we had total assets of $12.60 billion, loans held for investment of $9.41 billion, total deposits of $10.55 billion, and total common shareholders’ equity of $1.45 billion.

Throughout our history, we have maintained a community banking approach of personalized relationship-based service, which is delivered locally through experienced bankers in each market. As we have grown, maintaining this relationship-based approach utilizing local, talented and experienced bankers in each market has been an integral component of our success. Our bankers utilize their local knowledge and relationships to deliver timely solutions to our clients. We empower these bankers by giving them local decision making authority supplemented by appropriate risk management. In our experience, business owners and operators prefer to deal with decision makers, and our banking model is built to place the decision maker as close to the client as possible. We have designed our operations, technology, and centralized risk oversight processes to specifically support our operating model. We deploy this operating model universally in each of our markets, regardless of size. We believe we have a competitive advantage in our markets versus both smaller community banks and larger regional and national banks. Our robust offering of products, services and capabilities differentiate us from community banks, and our significant local market knowledge, client service level and the speed with which we are able to make decisions and deliver our services to customers differentiate us from larger regional and national banks.

We seek to leverage our operating model by focusing on profitable growth opportunities across our footprint, both in high-growth metropolitan markets and in stable community markets. As a result, we are able to strategically deploy our capital across our markets to take advantage of those opportunities that we believe provide the greatest certainty of profitable growth and highest returns.

Our history

Originally chartered in 1906, we are one of the longest continually operating banks in Tennessee. While our deep community roots go back over 100 years, our growth trajectory changed in 1984 when an experienced banker and entrepreneur partnered to acquire Farmers State Bank with a focus on growing the Bank. In 1988, Farmers State Bank purchased the assets of First National Bank of Lexington, Tennessee and changed the name to FirstBank, forming the foundation of our current franchise. In 1990, James W. Ayers became FirstBank's sole shareholder and remained the sole shareholder until our initial public offering in September 2016. The Bank grew from a community bank with only $14 million in assets in 1984 to total assets of $12.60 billion at December 31, 2023.

From 1984 to 2001, we operated as a community bank growing organically and through small acquisitions in community markets in West Tennessee. In 2001, our strategy evolved from serving purely community markets to include a modest presence in metropolitan markets, expanding our reach and enhancing our growth. We entered Nashville and Memphis in 2001 by opening a branch in each of those markets. In 2004 and 2008, we opened our first branches in Knoxville and Chattanooga, respectively. Although we experienced some growth in each metropolitan market, those markets did not become a significant strategic focus until we implemented our current strategy in the Nashville metropolitan statistical area in 2012. The successful implementation of this strategy, along with strategic acquisitions, resulted in growing Nashville into our largest market with 44.7% of our total deposits as of June 30, 2023. Additionally, we expanded into the Huntsville, Alabama MSA in 2014 by opening a branch in Huntsville and loan production office in Florence, Alabama, which was converted to a full service branch in 2019. During 2020, we expanded into the Bowling Green, Kentucky MSA with our

5

acquisition of FNB Financial Corp. in addition to increasing our Nashville MSA market share through our acquisition of Franklin Financial Network, Inc. During 2021, we expanded our banking division into Central Alabama with hiring of additional experienced senior bankers in Birmingham. As a result of this evolution and focus on continuous organic growth, we operate a balanced business model that serves a diverse customer base in both metropolitan and community markets.

Our markets

Our market footprint is the southeastern United States, centered around Tennessee, and includes portions of Alabama, North Georgia and Kentucky.

Top Metropolitan Markets(2) Top Community Markets(2)

(1)Source: SNL Financial. Market data is as of June 30, 2023 and is presented on a pro forma basis for announced acquisitions since June 30, 2023.

(2)Source: Company data and S&P Global Market Intelligence

Market characteristics and mix.

Metropolitan markets. Our metropolitan markets are generally characterized by attractive demographics and strong economies and offer substantial opportunity for future growth.We compete in these markets with national and regional banks that currently have the largest market share positions and with community banks primarily focused only on a particular geographic area or business niche. We believe we are well positioned to grow our market penetration among our target clients of small to medium sized businesses as well as large corporate businesses and the consumer base working and living in these metropolitan markets. In our experience, such clients demand the product sophistication of a larger bank, but prefer the customer service, relationship focus and local connectivity of a community bank. We believe that our size, product suite and operating model offer us a competitive advantage in these markets versus our smaller competitors, many of which are focused only on specific counties or industries. Our operating model driven by local talent with strong community ties and local authority serves as a key competitive advantage over our larger competitors. We believe that, as a result, we are well positioned to leverage our existing franchise to expand our market share in our markets.

6

Community markets. Our community markets tend to be more stable throughout various economic cycles, with primarily retail and small business customer opportunities and more limited competition. We believe this leads to an attractive profitability profile and more granular loan and deposit portfolios. Our community markets are standalone markets and not suburbs of larger markets. We primarily compete in these markets with community banks that generally have less than $1 billion in total assets. Our strategy is to compete against these smaller community banks by providing a broader and more sophisticated set of products and capabilities while still maintaining our local service model. We believe these markets are being deemphasized by national and regional banks which provides us with opportunities to hire talented bankers and maintain or grow market share in these community markets.

Our core client profile across our footprint includes retail and wealth consumers, small businesses, and corporate clients and owners. We target business clients with substantial operating history. Our typical business client would keep business deposit accounts with us, and we would look to provide banking services to the owners and employees of the business as well. We also have an active consumer lending business that includes deposit products, mortgages, home equity lines and small consumer finance loans. We continuously strive to build deeper relationships by actively advising clients and offering products that meet their banking needs.

The following tables show our deposit market share ranking among banks in Tennessee as of June 30, 2023 (the most recent date that such information is publicly available). Of the 10 largest banks in the state based on total deposits, 6 are national or regional banks, which we believe provides us with significant opportunities to gain market share from these banks.

Top 10 banks in Tennessee:

1 First Horizon Corporation (TN) Memphis, TN 136 30.8 13.9

2 Pinnacle Financial Partners (TN) Nashville, TN 54 26.9 12.1

3 Regions Financial Corporation (AL) Birmingham, AL 198 23.0 10.4

4 Truist Financial Corporation (NC) Charlotte, NC 100 17.7 8.0

5 Bank of America Corporation (NC) Charlotte, NC 56 17.7 8.0

6 FB Financial Corporation (TN) Nashville, TN 72 9.5 4.3

7 U.S. Bancorp (MN) Minneapolis, MN 65 5.1 2.3

8 Wilson Bank Holding Company (TN) Lebanon, TN 30 4.2 1.9

9 Simmons First National Corporation (AR) Pine Bluff, AR 47 3.6 1.7

10 Fifth Third Bancorp (OH) Cincinnati, OH 41 3.2 1.5

Source: S&P Global Market Intelligence and Company reports as of June 30, 2023 adjusted for pending and completed acquisitions as of June 30, 2023.

Our business strategy

Our overall business strategy is comprised of the following core priorities.

Enhance market penetration in our markets. In recent years, we have successfully grown our franchise across our footprint by executing our community bank growth strategy. The strategy is centered on the following: recruiting the best bankers and empowering them with local authority; developing branch presence; building brand awareness and growing our business and consumer banking presence; and expanding our product offering and capabilities. These strategies coupled with our personalized, relationship-based client service have contributed significantly to our success. Additionally, we believe that our scale, resources and range of products provides us with a competitive advantage over the smaller community banks in our markets we operate. As a result of these competitive advantages and growth strategies, the Nashville MSA has become our largest market with approximately 44.7% of our deposits and 5.2% market share, based on pro forma deposits as of June 30, 2023. We intend to continue to efficiently increase our market penetration through organic growth and strategic acquisitions.

Based on market and competitive similarities, we believe our growth strategies are transferable to our other metropolitan markets and we have implemented these strategies in additional markets across our footprint. In Knoxville and Chattanooga, we have achieved top 10 deposit market shares through our acquisitions of Northwest Georgia Bank, the Clayton Banks, and the branches from Atlantic Capital Bank and continued organic growth in those markets. In the Memphis, Huntsville and Birmingham MSAs, our banking model has attracted strong leadership teams and we have experienced significant growth in both deposits and loans.

Pursue opportunistic and strategic acquisitions. We have completed 13 acquisitions in the past 25 years. We pursue acquisitions that enhance market penetration, possess strong core deposits, are accretive to earnings per share while minimizing tangible book value dilution, and meet our internal return targets. We believe that numerous small to mid-sized banks or branch networks will be available for acquisition throughout our footprint as well as in attractive contiguous

7

markets in the coming years due to industry trends, such as compliance and operational challenges, regulatory pressure, management succession issues and shareholder liquidity needs. In Tennessee alone, there are approximately 112 commercial banks with total assets of less than $5 billion, and in the selected neighboring states of Alabama, Georgia, Kentucky, North Carolina, South Carolina and Virginia, there are over 447 commercial banks with under $5 billion in assets.We believe that we are positioned as a natural consolidator because of our financial strength, reputation and operating model.

Improve efficiency by leveraging technology and scaling operations. We have invested significantly in our personnel, infrastructure and technology in recent years, which we believe has created a scalable platform that will support future growth across all of our markets. Our bankers and branches, especially in the metropolitan markets, continue to scale in size, and we believe there is capacity to grow our business without adding significantly to our branch network. Additionally, we have established a number of key partnerships with customers utilizing our banking-as-a-service capabilities, allowing us to provide banking services to an expanding customer base who expects enhanced technological options. We plan to continue to invest, as needed, in our technology and business infrastructure to support our future growth and increase operating efficiencies.

Develop niche banking and noninterest income opportunities. While our primary focus is on capturing opportunities in our core banking business, we have successfully seized opportunities to grow our noninterest income. Our mortgage platform is focused through a traditional retail delivery channel. Additionally, we have successfully expanded our fee-based business to include more robust treasury management, trust and investment services and capital markets revenue streams. We intend to continue emphasizing these business lines which we believe serve as customer acquisition channels and provide us with a range of cross-selling opportunities, while making our business stronger and more profitable.

Risk management

General

Our operating model demands a strong risk management culture built to address multiple areas of risk, including credit risk, interest rate risk, liquidity risk, price risk, compliance risk, information security/cyber risk, third-party risk, operational risk, strategic risk and reputational risk. Our risk management culture is supported by investments in the right people and technologies to protect our business. Our Board of Directors, through its Risk Committee, is ultimately responsible for overseeing risk management of the Company. We have a Chief Risk Officer who oversees risk management across our business. Our Board, Chief Executive Officer and Chief Risk Officer are supported by the heads of other functional areas at the Bank, including credit, legal, IT, audit, compliance, capital markets, loan review, information security and physical security. Our comprehensive risk management framework is designed to complement our core strategy of empowering our experienced, local bankers with local-decision making to better serve our clients.

Our credit policies support our goal of maintaining sound credit quality standards while achieving balance sheet growth, earnings growth, appropriate liquidity and other key objectives. We maintain a risk management infrastructure that includes local authority, centralized policymaking and a system of checks and balances. The fundamental principles of our credit policy and procedures are to maintain credit quality standards, which enhance our long-term value to our clients, associates, shareholders and communities. Our loan policies provide our bankers with a sufficient degree of flexibility to permit them to deliver responsive and effective lending solutions to our clients while maintaining appropriate credit quality. Furthermore, our bankers and associates are hired for the long-term and they are incented to focus on long-term credit quality. Since lending represents credit risk exposure, the Board of Directors and its duly appointed committees seek to ensure that the Bank maintains appropriate credit quality standards. We have established management oversight committees to administer the loan portfolio and monitor credit risk. These committees include our ACL Committee and Corporate Credit Risk Committee and they meet at least quarterly to review the lending activities.

Credit concentration

Diversification of risk is a key factor in prudent asset management. Our granular loan portfolio reflects a balanced mix of consumer and commercial clients across these markets that we think provides a natural hedge to industry and market cycles. In addition, risk from concentration is actively managed by management and reviewed by the Board of Directors of the Bank, and exposures relating to borrower, industry and commercial real estate categories are tracked and measured against policy limits. These limits are reviewed as part of our periodic review of the credit policy. Loan concentration levels are monitored by the Corporate Credit Risk Committee and reported to the Credit Risk Committee of the Board of Directors.

Loan approval process

The loan approval process at the Bank is characterized by local authority supported by a control environment that provides for prompt and thorough underwriting of loans. Our localized decision making is reinforced through a centralized review process supported by technology that monitors credits to ensure compliance with our credit policies. Our loan

8

approval method is based on a hierarchy of individual lending authorities for new credits and renewals granted to our individual bankers, market presidents, regional presidents, senior and regional credit officers, senior management and Credit Risk Committee of the Board of Directors. The Corporate Credit Risk Committee, along with senior management, establishes the maximum lending limits at each level and our senior management team sets individual authorities within these maximum limits to each individual based on demonstrated experience and expertise, and are periodically reviewed and updated. We believe that the ability to have individual loan authority up to specified levels based on experience and track record coupled with appropriate approval limits for our market presidents, regional presidents, senior and regional credit officers, senior management and Credit Risk Committee of the Board of Directors allows us to provide prompt and appropriate responses to our clients while still allowing for the appropriate level of oversight.

As a relationship-oriented lender, rather than transaction-oriented lender, a majority of our loans HFI are made to borrowers or relationships located or operating in our market area. This provides us with a better understanding of their business, creditworthiness and the economic conditions in their market and industry. Furthermore, our associates are held accountable for their decisions, which effectively aligns their incentives to reflect appropriate management of risk.

In considering loans, we follow the underwriting principles set forth in our credit policy with a primary focus on the following factors:

•A relationship with our clients that provides us with a thorough understanding of their financial condition and ability to repay the loan;

•verification that the primary and secondary sources of repayment are adequate in relation to the amount of the loan;

•adherence to appropriate loan to value guidelines for real estate secured loans;

•targeted levels of diversification for the loan portfolio, both as to type of borrower and type of collateral; and

•proper documentation of loans, including perfected liens on collateral.

As part of the approval process for any given loan, we seek to minimize risk in a variety of ways, including the following:

•analysis of the borrower's and/or guarantor's financial condition, cash flow, liquidity, and leverage;

•assessment of the project's operating history, operating projections, location and condition;

•review of appraisals, title commitment and environmental reports;

•consideration of the management's experience and financial strength of the principals of the borrower; and

•understanding economic trends and industry conditions.

The Corporate Credit Risk Committee reviews and approves any amendments to the credit policy, monitors loan portfolio trends and credit trends, and loan reviews. The Credit Risk Committee of the Board of Directors approves loan transactions that exceed management authorized thresholds as set forth in our credit policy. Loan pricing is established in conjunction with the loan approval process based on pricing guidelines for loans that are set by the Bank’s senior management. We believe that our loan approval process provides for thorough internal controls, underwriting, and decision making.

Lending limits

The Bank is limited in the amount it can loan in the aggregate to a single borrower or related borrowers by the amount of our regulatory capital. Tennessee’s legal lending limit is a safety and soundness measure intended to prevent one person or a relatively small and economically related group of persons from borrowing an unduly large amount of bank funds. It is also intended to safeguard a bank’s depositors by diversifying the risk of potential loan losses among a relatively large number of creditworthy borrowers engaged in various types of businesses. Generally, under Tennessee law, loans and extensions of credit to a borrower may not exceed 15% of our bank’s Tier 1 capital, plus an additional 10% of the bank’s Tier 1 capital, with approval of the bank’s board. Further, the Bank may elect to conform to similar standards applicable to national banks under federal law, in lieu of Tennessee law. Because the federal law and Tennessee state law standards are determined as a percentage of the Bank’s capital, these state and federal limits both increase or decrease as the Bank’s capital increases or decreases. Based upon the capitalization of the Bank at December 31, 2023, the Bank’s legal lending limits were approximately $205.6 million (15%) and $342.7 million (25%). The Bank may seek to sell participations in our larger loans to other financial institutions, which will allow us to manage the risk involved in these loans and to meet the lending needs of our clients requiring extensions of credit in excess of these limits.

In addition to these legally imposed lending limits, we also employ appropriate limits on our overall loan portfolio and requirements with respect to certain types of lending and individual lending relationships. For example, we have lending limits related to maximum borrower, industry and certain types of commercial real estate exposures.

9

Enterprise risk management

We maintain an enterprise risk management program that helps us to identify, manage, monitor and control potential risks that may affect us, including credit risk, interest rate risk, liquidity risk, price risk, compliance risk, operational risk, information security/cyber risk, third-party risk, strategic risk and reputational risk. Our operating model demands a strong risk culture built to address the multiple areas of risk we face, and our risk management strategy is supported by significant investments in the right people and technologies to protect the organization.

Our comprehensive risk management framework and risk identification is a continuous process and occurs at both the transaction level and the portfolio level. While our local bankers and associates support our day-to-day risk practices, management seeks to identify interdependencies and correlations across portfolios and lines of business that may amplify risk exposure through a thorough centralized review process. Risk measurement helps us to control and monitor risk levels and is based on the sophistication of the risk measurement tools used to reflect the complexity and levels of assumed risk. We monitor risks and ensure compliance with our risk policies by timely reviewing risk positions and exceptions. This monitoring process ensures that management’s decisions are implemented for all geographies, products and legal entities with overview by the appropriate committees.

We control risks through limits that are communicated through policies, standards, procedures and processes that define responsibility and authority. Such limits serve as a means to control exposures to the various risks associated with our activities, and are meaningful management tools that can be adjusted if conditions or risk tolerances change. In addition, we maintain a process to authorize exceptions or changes to risk limits when warranted. These risk management practices help to ensure effective reporting, compliance with all laws, rules and regulations, avoid damage to our reputation and related consequences, and attain our strategic goals while avoiding pitfalls and surprises along the way.

The Risk Committee of the Board of Directors approves policies that set operational standards and risk limits. Management is responsible for the implementation, integrity and maintenance of our risk management systems ensuring the directives are implemented and administered in compliance with the approved policy. Our Chief Risk Officer supervises the overall management of our risk management program, reports to the Chief Executive Officer and yet also retains independent access to the Risk Committee of the Board of Directors.

Credit risk management

Credit risk management is a key component of our risk management program. We employ consistent analysis and underwriting to examine credit information and prepare underwriting documentation. We monitor and approve exceptions to our credit policies as required, and we also track and address technical exceptions.

Each relationship manager has the primary responsibility for appropriately risk rating each loan that is made. In addition, our credit administration department is responsible for the ongoing monitoring of loan portfolio performance through the review of ongoing financial reports, credit quality reports, relationship manager reports, audit reviews and exception reporting and concentration analysis. This monitoring process also includes an ongoing review of loan risk ratings. Management and monitoring of our allowance for credit losses is performed by our ACL Committee.We have a Corporate Credit Risk Committee which monitors the integrity of our portfolio within the parameters of the credit policy. We utilize a risk grading system that enables management to differentiate individual loan quality and forecast future profitability and portfolio loss potential. The Credit Risk Committee of the Board of Directors has the authority to approve credit policies and risk limits.

We assign a credit risk rating at the time a commercial loan is made and adjust it as conditions warrant. Portfolio monitoring systems allow management to proactively assess risk and make decisions that will minimize the impact of negative developments. Successful credit management is achieved by lenders consistently meeting with clients and regularly reviewing their financial conditions. This enables both the recognition of future opportunities and potential weaknesses early.

The Board of Directors supports a strong loan review program and is committed to its effectiveness as part of the independent process of assessing our lending activities. We have communicated to our credit and lending staff that the identification of emerging problem loans begins with the lending personnel knowing their clients and supported by credit personnel, actively monitoring their client relationships. The loan review process is meant to augment this active management of client relationships and to provide an independent and broad-based look into our lending activities. We believe that our strong client relationships support our ability to identify potential deterioration of our credits at an early stage enabling us to address these issues early on to minimize potential losses.

We maintain a robust loan review function by utilizing an internal loan review team as well as third-party loan review firms. The results from internal and external loan reviews are reported to the Risk Committee of the Board of Directors to ensure independence and objectivity. The examinations performed by the loan review department are based on risk assessments of individual loan commitments within our loan portfolio over a period of time. At the conclusion of each review, the loan review department provides management with a report that summarizes the results of the review. At a minimum, the report

10

addresses risk rating accuracy, compliance with regulations and policies, loan documentation accuracy, the timely receipt of financial statements, and any additional material issues.

We monitor the levels of delinquenciesfor any negative or adverse trends. From time to time, we maymodify loans to extend the term or make other concessions to help a borrower with a deteriorating financial condition stay current on their loan and to avoid foreclosure. We generally do not forgive principal or interest on loans or modify the interest rates on loans to rates that are below market rates. We believe that we are well reserved for losses resulting from our non-performing assets.

Liquidity and interest rate risk management

Our liquidity planning framework is focused on robust forecasting and risk management to ensure predictable funding needs and availability. We strive to maintain the lowest cost of funding available while maintaining stable sources of liquidity. To achieve these objectives, we utilize a simple funding and capital structure consisting primarily of deposits and common equity. We remain continually focused on growing our noninterest-bearing and other low-cost core deposits while replacing higher cost funding sources, including wholesale time deposits and other borrowed debt, to fund our balance sheet growth. The following chart shows our overall funding structure as of December 31, 2023.

Funding structure as of December 31, 2023

In addition, we monitor our liquidity risk by adopting policies to define potential liquidity problems, reviewing and maintaining an updated contingency funding plan, testing our sources of funds availability at least annually and providing a prudent capital structure consistent with our credit standing and plans for strategic growth.

Our interest rate risk management system is overseen by the Risk Committee of our Board of Directors, who has the authority to approve acceptable rate risk levels. Our Board of Directors has established the Asset Liability Management Committee at the management level to ensure appropriate risk measurement by requiring:

•quarterly testing of interest rate risk exposure;

•proactive liquidity and interest rate risk identification and measurement; and

•quarterly risk presentations by senior management

Cybersecurity

For information on the Company's information security and related risks, refer to “Item 1C. Cybersecurity” and “Item A. Risk factors: Technology and operational risks.”

11

Competition

We conduct our core banking operations primarily in Tennessee, Alabama, North Georgia and Kentucky and compete in the commercial banking industry solely through our wholly-owned banking subsidiary, FirstBank. The banking industry is highly competitive, and we experience competition in our market areas from many other financial institutions. We compete with commercial banks, credit unions, savings institutions, mortgage banking firms, online mortgage lenders, online deposit banks, digital banking platforms, consumer finance companies, securities brokerage firms, insurance companies, money market funds and other mutual funds, as well as super-regional, national and international financial institutions that operate offices in our market areas and elsewhere. In addition, a number of out-of-state financial intermediaries have opened production offices, or otherwise solicit loans and deposits, in our market areas. Increased competition in our markets may result in the Bank experiencing reduced loans and deposits, as well as reduced net interest margin and profitability. Furthermore, our markets have grown increasingly competitive in recent years with a number of banks entering our markets, with a primary focus on the metropolitan markets. We believe this trend will continue as banks look to gain a foothold in these growing markets. This trend will result in greater competition primarily in our metropolitan markets. However, we firmly believe that our market position and client-focused operating model enhance our ability to attract and retain clients.

See “Our markets” in this section above for a further discussion of the markets we compete in and the competitive landscape in these markets.

Human capital

At the Company, we value our associates, because our associates are FirstBank. They do the work; they serve our communities, and they build relationships with our customers. As of December 31, 2023, the Company employed 1,591 full-time equivalent associates with an average tenure of 6 years of service.

Culture

We pride ourselves on our culture which cultivates the talents of our associates by helping them give more and get more out of their jobs than they thought possible. Our vision is to:

•Deliver trusted solutions to our customers;

•Provide a great place to work for our associates;

•Invest in our communities; and

•Provide superior long-term returns for our shareholders.

We also take pride in our values, which we aspire to live by every day:

•One Team, One Bank

•Do The Right Thing

•Commitment to Excellence

•Exist For the Customer

•Treat People With Respect

•Enjoy Life

Once again, in 2023 FirstBank has been named one of Middle Tennessee’s Top Workplaces by The Tennessean for the ninth year in a row. FirstBank meets high standards for a healthy workplace culture as ranked by its own employees. We have also been named as one of the Best Banks to Work For in America by American Banker Magazine, for each of the last four years.

Diversity, Equity and Inclusion

Providing a great place to work includes our commitment to diversity, equity, and inclusion. In 2020, we chartered an internal Diversity Council to begin work in 2021. The 12-member Council focuses on educating our associates on inclusion, encouraging them to see differences as opportunities to diversify our workforce, and increasing involvement in our diverse communities. In 2022, the Council was instrumental in providing Unconscious Bias Training to our leadership and adding additional DEI training to the all-associate curriculum.

The Diversity Counsel oversees our Associate Communities, also known as Employee Resource Groups or ERGs. Our Associate Communitieswere created to offer a sense of community and belonging to associates with a common affiliation along with allies (other associates who support, uplift, and stand up for underrepresented groups). These Associate Communities further enhance communication across business lines, geographies, and varying associate roles, to bolster DEI efforts and provide opportunities for professional development, networking, and community involvement. All Associate Communities priorities align with the Company’s values and are open to every associate.

12

In 2023, we established two Associate Communities, developing the leadership, structure, and goals for each of the groups

a.Black Professionals. This community group advocates for representation, social awareness and supporting opportunity for Black and African American associates.

b.Women Professionals. This community group focuses on the development and mentorship of women at FirstBank and in the community.

We continue to remain committed to hiring qualified diverse associates. In 2023, we increased the percentage of new hires from diverse groups over 25% from 2022.

Recruitment, talent development and retention

FirstBank has a highly regarded culture and has consistently won awards for being a great place to work.

We continued our Management-to-Leadership development sessions designed to provide knowledge and support for new and emerging managers to transition to a supervisory leadership role and graduated56 associates through the program. This program gives FirstBank associates the opportunity to gain experience, develop skills and explore career opportunities that are interesting to them right within our own organization.

During 2023, we redesigned and launched a new FirstBank external and internal career page which is hosted through our Applicant Tracking System. This allows us the option to highlight company culture, benefits, DEI initiatives and other company highlights to improve our ability to promote the company and attract talent. Utilizing the internal site resulted in 32% of jobs filled through internal mobility including 419 promotions.

With associates joining us from outside the organization, FirstBank has a 93% retention rate of first year hires.

Compensation and benefits

We are committed to attracting and retaining the best talent in our markets. We provide competitive compensation and benefits that meet the needs of our employees, including market-competitive pay, healthcare benefits, equity incentives, and an employee stock purchase plan. We also provide meaningful training and development opportunities designed to train our next generation of leaders and provide them opportunities for advancement within the Company.

Through our FirstBank Give More Program, we provide full-time associates 16 hours paid leave to volunteer in activities supporting community organizations. Our associates volunteered over 7,700 hours during 2023.

Through our partnership with our new medical carrier, we were able to keep medical premiums flat for the majority of our associates in a highly inflationary environment. The Company contributes on average over 71% of the total medical premium cost. Additionally, the Company continues to provide vision insurance at no cost for all associates.

As part of our commitment to associate well-being, we implemented our first ever wellness program and many of our associates earned an incentive for completing their health risk assessment and biometric screening.

Information technology systems

During the year ended December 31, 2023, the Company continued its expansion of process automation efforts and data management capabilities, focusing on enhancing utilization of data and automating manual processes. Additionally, the Company completed the modernization of the technical infrastructure to improve bandwidth and performance reliability of its computer communications network which allows our platform to handle the anticipated growth and expansion of our footprint. Other improvements throughout 2023 included enhancing capabilities around management reporting, credit risk data, asset liability management and lending systems, resulting in improved data governance and availability of data.

During 2023, the Company initiated a comprehensive data management program to enhance the utilization of data by improving confidence, availability and usability of data. The program aligns with the Company's strategic plan with a focus on financial, regulatory, credit and customer data. This program positions the bank to leverage bank data for more advanced data use cases.

Lastly, the Company continued the integration of embedded banking technology into the Company’s core infrastructure allowing several key innovation partners to onboard during 2023. The ongoing embedded banking technology development will allow the Company to continue to serve the needs of its evolving customers.

During 2024, we plan to focus on leveraging existing technical capabilities and investments while supporting the initiatives from the FirstBank Way, our forward-looking strategic improvement plan. The FirstBank Way initiatives will enable us to continually define our business model to be scalable, yet community banking focused as we continue to grow.

13

Supervision and regulation

The U.S. financial services and banking industries are highly regulated. The bank regulatory framework, involving the supervision, regulation, and examination of the Bank by bank regulatory agencies, is intended primarily for the protection of consumers, bank depositors and the Deposit Insurance Fund of the FDIC, rather than holders of our capital stock.

The following is a general summary of the material aspects of certain statutes and regulations applicable to the Company and the Bank. Federal and state banking laws and regulations affect virtually all of our operations. These summary descriptions are not complete, and you should refer to the full text of the statutes, regulations, and corresponding guidance for more information. The legal and regulatory regime is continually under review by legislatures, regulators and other governmental bodies, and changes regularly occur through the enactment or amendment of laws and regulations or through shifts in policy, implementation or enforcement. Statutes and regulations are subject to change, and additional statutes, regulations, and corresponding guidance may be adopted. We are unable to predict these future changes or the effects, if any, that these changes could have on our business, revenues, and financial results.

Regulation of the Company and the Bank

The Company is subject to regulation and supervision by multiple regulatory bodies. As a bank holding company, we are subject to ongoing regulation, supervision, and examination by the Federal Reserve under the Bank Holding Company Act of 1956, as amended. The Federal Reserve’s jurisdiction also extends to any company that is directly or indirectly controlled by the bank holding company. FB Financial has elected to be treated as a financial holding company, which allows us to engage in a broader range of activities than would otherwise be permissible for a bank holding company, including activities such as securities underwriting, insurance underwriting, and merchant banking. In addition, as discussed in more detail below, the Bank and any of our other subsidiaries that offer consumer financial products and services are subject to regulation and supervision by the CFPB. The Dodd-Frank Act also permits states to adopt consumer protection laws and regulations that may be more strict than those of the CFPB, and state attorneys general are permitted to enforce certain federal consumer financial protection law.

The Bank is a Tennessee state-chartered bank that is not a member of the Federal Reserve System, and is subject to ongoing regulation, supervision, and examination by the FDIC and the Bank's state banking regulator, the Tennessee Department of Financial Institutions. The TDFI and FDIC supervise and regulate all areas of the Bank’s operations including, without limitation, the making of loans, the issuance of securities, the conduct of the Bank’s corporate affairs, the satisfaction of capital adequacy requirements, the payment of dividends, and the establishment or closing of banking offices. The FDIC is the Bank’s primary federal regulatory agency, which regularly examines the Bank’s operations and financial condition and compliance with federal consumer protection laws. In addition, the Bank’s deposit accounts are insured by the FDIC to the maximum extent permitted by law, and the FDIC has certain enforcement powers over the Bank. Various Federal and State consumer laws and regulations apply to the Bank, including state consumer laws and regulations that also affect the operations of the Bank, including state usury laws, consumer credit and equal credit opportunity laws, and fair credit reporting. The Bank and certain of its subsidiaries are also prohibited from engaging in certain tying arrangements in connection with extensions of credit, leases or sales of property, or furnishing products or services.

The Company is also subject to the disclosure and regulatory requirements of the Securities Act and the Exchange Act, both as administered by the SEC. The Company’s common stock is listed on the New York Stock Exchange under the trading symbol “FBK” and, therefore, is subject to the rules of the NYSE for listed companies.

Bank holding company obligations to bank subsidiaries

As a bank holding company, the Company is required to act as a source of financial and managerial strength to its depository institution subsidiaries and to maintain resources adequate to support such subsidiaries. The Federal Reserve may require a bank holding company to make capital injections into a troubled subsidiary bank and may charge the bank holding company with engaging in unsafe and unsound practices for failure to commit resources to such a subsidiary bank. As a result, we could be required to commit resources to support the Bank in situations where additional investments in a bank may not otherwise be warranted. These situations include guaranteeing the compliance of an “undercapitalized” bank with its obligations under a capital restoration plan. As a result of these obligations, a bank holding company may be required to contribute additional capital to its subsidiaries in the form of capital notes or other instruments that qualify as capital under regulatory rules. Any such loan from a holding company to a subsidiary bank is likely to be unsecured and subordinated to the bank's depositors and perhaps to other creditors of the bank. If we were to enter bankruptcy or become subject to the orderly liquidation process established by the Dodd-Frank Act, any commitment by us to a federal bank regulatory agency to maintain the capital of the Bank would be assumed by the bankruptcy trustee or the FDIC, as appropriate, and entitled to a priority of payment.

14

Acquisitions

The Company is required by the BHCA to obtain the prior approval of the Federal Reserve to acquire substantially all the assets of a bank or to acquire direct or indirect ownership or control of more than 5% of any class of the voting shares of any bank, bank holding company, savings and loan holding company or savings association, or to increase any such non-majority ownership or control of any bank, bank holding company, savings and loan holding company or savings association, or to merge or consolidate with any bank holding company. If the Company is “well capitalized” and “well managed,” as defined under the BHCA and implementing regulations, we may purchase a bank located outside of Tennessee. However, restrictions may be placed on the acquisition of a bank that has only been in existence for a limited amount of time or will result in concentrations of deposits exceeding limits specified by statute. For example, Tennessee law currently prohibits a bank holding company from acquiring control of a Tennessee-based financial institution until the target financial institution has been in operation for at least three years.

Change of control

Federal law restricts the amount of voting stock of a bank holding company or a bank that a person may acquire without the prior approval of banking regulators. Under the Change in Bank Control Act and the regulations thereunder, an individual, company, or group must give advance notice to the Federal Reserve before acquiring control of any bank holding company, such as the Company, or before acquiring control of any FDIC-insured bank, such as the Bank. Acquisition of 25% or more of any class of voting securities constitutes control, and it is generally presumed for purposes of the CIBCA that the acquisition of 10% or more of any class of voting securities would constitute the acquisition of control. Also, under the CIBCA, the shareholdings of individuals and companies that are deemed to be “acting in concert”, whether or not pursuant to an express agreement, would be aggregated for purposes of determining whether such holders “control” a bank or bank holding company. Once notified, the Federal Reserve may approve or disapprove the acquisition. These and other laws make it more difficult to acquire the Company or the Bank than it might be to acquire control of another type of corporation.

Capital requirements

The Company and the Bank are required under federal law to maintain specified minimum levels of capital based on ratios of capital to total assets and to risk-weighted assets. The following minimum capital requirements are applicable to the Company and the Bank:

•a common equity Tier 1 risk-based capital ratio of 4.5%;

•a Tier 1 risk-based capital ratio of 6%;

•a total risk-based capital ratio of 8%;

•a leverage ratio of 4%; and

•a supplementary leverage ratio of 3%, resulting in a leverage ratio requirement of 7%

Banking regulators may determine, based on factors such as size, complexity, or level of risk that a covered banking organization must maintain capital levels above the minimum requirements.

Tier 1 Capital is defined to include two components: common equity Tier 1 Capital and additional Tier 1 Capital. The highest form of capital, Common Equity Tier 1 Capital, consists solely of common stock plus related surplus, retained earnings, accumulated other comprehensive income, and minority interests in the equity accounts of consolidated subsidiaries. In order to avoid restrictions on capital distributions or discretionary bonus payments to executives, a covered banking organization must maintain a capital conservation buffer on top of its minimum risk-based capital requirements. This buffer must consist solely of Tier 1 Common Equity, but the buffer applies to all three risk-based measurements (CET1 Capital, Tier 1 Capital and total capital). The capital conservation buffer consists of an additional amount of common equity equal to 2.5% of risk-weighted assets.

The U.S. Basel III Capital Rules also make important changes to the “prompt corrective action” framework. Federal law and regulations establish a capital-based regulatory scheme designed to promote early intervention for troubled banks and require the FDIC to choose the least expensive resolution of bank failures. The capital-based regulatory framework contains five categories of regulatory capital requirements, including “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” A well-capitalized insured depository institution is one (i) having a total risk-based capital ratio of 10% or greater, (ii) having a Tier 1 risk-based capital ratio of 8% or greater, (iii) having a CET1 capital ratio of 6.5% or greater, (iv) having a leverage capital ratio of 5% or greater and (v) that is not subject to any order or written directive to meet and maintain a specific capital level for any capital measure. An institution that fails to remain well-capitalized becomes subject to a series of restrictions that increase in severity as its capital condition weakens. Such restrictions may include a prohibition on capital distributions, restrictions on asset growth or restrictions on the ability to receive regulatory approval of applications.

15

As of December 31, 2023, the Bank had sufficient capital to qualify as “well capitalized” under the requirements contained in the applicable regulations, policies and directives pertaining to capital adequacy, and it is unaware of any material violation or alleged material violation of these regulations, policies or directives. Rapid growth, poor loan portfolio performance, or poor earnings performance, or a combination of these factors, could change the Bank’s capital position in a relatively short period of time, making additional capital infusions necessary.

Restrictions on dividends

The ability of the Company or the Bank to pay dividends, repurchase stock and make other capital distributions is limited by regulatory capital rules and other aspects of the regulatory framework. The Federal Reserve's policy regarding dividends is that a bank holding company should not declare or pay a cash dividend that would impose undue pressure on the capital of any bank subsidiary or would be funded only through borrowing or other arrangements that might adversely affect a bank holding company's financial position. As a general matter, the Federal Reserve has indicated that the board of directors of a bank holding company should consult with the Federal Reserve and eliminate, defer or significantly reduce the bank holding company's dividends if:

•its net income available to shareholders for the past four quarters, net of dividends previously paid during that period, is not sufficient to fully fund the dividends;

•its prospective rate of earnings retention is not consistent with its capital needs and overall current and prospective financial condition; or

•it will not meet, or is in danger of not meeting, its minimum regulatory capital adequacy ratios.

Should an insured depository institution controlled by a bank holding company be “significantly undercapitalized” under the applicable federal bank capital ratios, or if the bank subsidiary is “undercapitalized” and has failed to submit an acceptable capital restoration plan or has materially failed to implement such a plan, federal banking regulators (in the case of the Bank, the FDIC) may choose to require prior Federal Reserve approval for any capital distribution by the bank holding company.

Under Tennessee law, we are not permitted to pay cash dividends if, after giving effect to such payment, we would not be able to pay our debts as they become due in the usual course of business or our total assets would be less than the sum of our total liabilities plus any amounts needed to satisfy any preferential rights if we were dissolving.In deciding whether or not to declare a dividend of any particular size, our Board of Directors must consider our current and prospective capital, liquidity, and other needs.

Additionally, Tennessee law places restrictions on the declaration of dividends by state-chartered banks to their shareholders, including, but not limited to, that the board of directors of a Tennessee-chartered bank may only make a dividend from the surplus profits arising from the business of the bank, and may not declare dividends in any calendar year that exceeds the total of its retained net income of that year combined with its retained net income of the preceding two (2) years without the prior approval of the TDFI commissioner. Furthermore, the FDIC and the TDFI also have authority to prohibit the payment of dividends by a Tennessee bank when it determines such payment to be an unsafe and unsound banking practice.

Transactions with affiliates and insiders

The Bank is subject to regulations of the Federal Reserve Act, or FRA, and the Federal Reserve’s Regulation W, as made applicable to state nonmember banks by the FDIA. An affiliate of a bank is any company or entity that controls, is controlled by or is under common control with the Bank, and, in our case, includes, among others, the Company as well as our former Chairman, James W. Ayers and the companies he controls. Accordingly, transactions between the Bank and the Company or Mr. Ayers or any of his affiliates, will be subject to a number of restrictions, including restrictions relating to extensions of credit, contracts, leases and purchases or sale of assets. Such restrictions and limitations prevent the Company or other affiliates from borrowing from the Bank unless the loans are secured by specified collateral of designated amounts. Furthermore, such secured loans by the Bank to the Company or other affiliates are limited, individually, to 10% of the Bank’s capital and surplus, and such secured loans are limited in the aggregate to 20% of the Bank’s capital and surplus.

All such transactions must be on terms that are no less favorable to the Bank than those that would be available from nonaffiliated third-parties. Federal Reserve policies also forbid the payment by bank subsidiaries of management fees which are unreasonable in amount or exceed the fair market value of the services rendered or, if no market exists, actual costs plus a reasonable profit.

Loans to executive officers, directors or to any person who directly or indirectly, or acting through or in concert with one or more persons, owns, controls or has the power to vote more than 10% of any class of voting securities of a bank, which the Bank refers to as “10% Shareholders,” as well as other similar groups as defined by the FRA and corresponding

16

regulations, which are commonly referred to as Regulation O, are subject to regulatory requirements. Among other things, these loans must be made on terms substantially the same as those prevailing on transactions made to unaffiliated individuals and certain extensions of credit to those persons must first be approved in advance by a disinterested majority of the entire board of directors. Regulation O prohibits loans to any of those individuals where the aggregate amount exceeds an amount equal to 15% of an institution’s unimpaired capital and surplus plus an additional 10% of unimpaired capital and surplus in the case of loans that are fully secured by readily marketable collateral, or when the aggregate amount on all of the extensions of credit outstanding to all of these persons would exceed the Bank’s unimpaired capital and unimpaired surplus. Regulations also identify limited circumstances in which the Bank is permitted to extend credit to executive officers.

FDIC Insurance

The Bank’s deposits are insured by the Deposit Insurance Fund of the FDIC up to applicable legal limits. The FDIC charges deposit insurance assessments to FDIC-insured institutions, including the Bank, to fund and support the DIF.The rate of these deposit insurance assessments is based on, among other things, the risk characteristics of the Bank. The FDIC has the power to terminate the Bank’s deposit insurance if it determines the Bank is engaging in unsafe or unsound practices.Federal banking laws provide for the appointment of the FDIC as receiver in the event the Bank were to fail, such as in connection with undercapitalization, insolvency, unsafe or unsound conditions or other financial distress. In a receivership, the claims of the Bank’s depositors (and those of the FDIC as subrogee of the Bank) would have priority over other general unsecured claims against the Bank.

The FDIC imposes a risk-based deposit premium assessment system, which was amended pursuant to the Federal Deposit Insurance Reform Act of 2005. Under this system, the amount of FDIC assessments paid by an individual insured depository institution, like the Bank, is based on the level of perceived risk incurred in its activities. The Bank's deposit accounts are currently insured by the DIF, generally up to a maximum of $250,000 per separately insured depositor.The Bank pays deposit insurance assessments to the FDIC to be insured by the DIF.Under the current assessment system, the FDIC assigns an institution to a risk category based on the institution's most recent supervisory and capital evaluations, which are designed to measure risk. Under the FDIA, the FDIC may terminate a bank's deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order, agreement or condition imposed by the FDIC. Under the Dodd-Frank Act, the FDIC has adopted regulations that base deposit insurance assessments on total assets less capital rather than deposit liabilities and include off-balance sheet liabilities of institutions and their affiliates in risk-based assessments. After an institution's average assets exceed $10 billion over four quarters, the assessment rate increases compared to institutions at lower average asset levels. In addition, for large institutions, the FDIC uses a performance score and a loss-severity score that are used to calculate an initial assessment rate. In calculating these scores, the FDIC uses a bank's capital level and supervisory ratings and certain financial measures to assess an institution's ability to withstand asset-related stress and funding-related stress.The FDIC has the ability to make discretionary adjustments to the total score based upon significant risk factors that are not adequately captured in the calculations.

In October 2022, the FDIC adopted a final rule, applicable to all insured depository institutions, to increase base deposit insurance assessment rate schedules uniformly by 2 basis points beginning in the first quarterly assessment period of 2023. The FDIC has indicated that the new assessment rate schedules will remain in effect until the DIF reserve ratio meets or exceeds 2%.

In November 2023, the FDIC issued a final rule to implement a special assessment to recover losses to the DIF incurred as a result of the March 2023 bank failures and the FDIC's use of the systemic risk exception to cover certain deposits that were otherwise uninsured. The special assessment was based on estimated uninsured deposits as of December 31, 2022, excluding the first $5.0 billion, and will be assessed at a quarterly rate of 3.36 basis points, over eight quarterly assessment periods, beginning in the first quarter of 2024. As a result of this final rule, we accrued $1.8 million related to this assessment in the fourth quarter of 2023. This amount represents our current expectation of the full amount of the assessment based on our total uninsured deposits as of December 31, 2022. Under the final rule, the estimated loss pursuant to the systemic risk determination will be periodically adjusted, and the FDIC has retained the ability to cease collection early, extend the special assessment collection period and impose a final shortfall special assessment on a one-time basis. The extent to which any such additional future assessments will impact our future deposit insurance expense is currently uncertain.

Compensation and risk management

Under regulatory guidance applicable to banking organizations, incentive compensation policies must be consistent with safety and soundness principles. Under this guidance, financial institutions must review their compensation programs to ensure that they: (i) provide employees with incentives that appropriately balance risk and reward and that do not

17

encourage imprudent risk, (ii) are compatible with effective controls and risk management, and (iii) are supported by strong corporate governance, including active and effective oversight by the banking organization’s board of directors. Monitoring methods and processes used by a banking organization should be commensurate with the size and complexity of the organization and its use of incentive compensation.

We are also subject to other rules regarding our compensation practices, including the “say-on-pay” and say-on-golden-parachute” requirements of the Dodd-Frank Act and the requirement to have an independent compensation committee, and the requirement to adopt policies mandating the clawback of excess incentive-based compensation earned by a current or former executive officer during the three fiscal years preceding the date the listed company is required to prepare an accounting restatement. The Company’s current clawback policy is included in “Part IV- Item 15. Exhibits and Financial Statement Schedules- Exhibit 97” of this Report.

Community Reinvestment Act

The CRA and its corresponding regulations are intended to encourage banks to help meet the credit needs of their service areas, including low and moderate-income neighborhoods, consistent with safe and sound operations. These regulations provide for regulatory assessment of a bank’s record in meeting the credit needs of its service area. Federal banking agencies are required to make public a rating of a bank’s performance under the CRA. The federal banking agencies consider a bank’s CRA rating when a bank submits an application to establish banking centers, merge, or acquire the assets and assume the liabilities of another bank. In the case of a bank holding company, the CRA performance record of all banks involved in the merger or acquisition are reviewed in connection with the filing of an application to acquire ownership or control of shares or assets of a bank or to merge with any other financial holding company. An unsatisfactory record can substantially delay, block or impose conditions on the transaction. The Bank received a satisfactory rating on its most recent CRA assessment.

In October 2023, the federal banking regulators issued a joint rule that will substantially revise how an insured depository institution's CRA performance is evaluated. As such, we will continue to evaluate the impact of any changes to the regulations implementing the CRA and their impact to our financial condition, results of operations, and/or liquidity.

Anti-money laundering and economic sanctions

Federal anti-money laundering rules impose various requirements on financial institutions intended to prevent the use of the U.S. financial system to fund terrorist activities. These provisions include a requirement that financial institutions operating in the United States have anti-money laundering compliance programs, due diligence policies and controls to ensure the detection and reporting of money laundering. Such compliance programs supplement existing compliance requirements, also applicable to financial institutions, under the Bank Secrecy Act and the Office of Foreign Assets Control regulations. The Bank has established policies and procedures to ensure compliance with federal anti-money laundering laws and regulations.

Privacy and data security

The Bank is subject to regulations implementing the privacy protection provisions of GLBA. These regulations require the Bank to disclose its privacy policy, including identifying with whom it shares “nonpublic personal information,” to customers at the time of establishing the customer relationship and annually thereafter. The regulations also require the Bank to provide its customers with initial and annual notices that accurately reflect its privacy policies and practices. In addition, to the extent its sharing of such information is not covered by an exception, the Bank is required to provide its customers with the ability to “opt-out” of having the Bank share their nonpublic personal information with unaffiliated third-parties.

The Bank is subject to regulatory guidelines establishing standards for safeguarding customer information. The guidelines describe the federal bank regulatory agencies’ expectations for the creation, implementation and maintenance of an information security program, which would include administrative, technical and physical safeguards appropriate to the size and complexity of the institution and the nature and scope of its activities. The standards are intended to ensure the security and confidentiality of customer records and information, protect against any anticipated threats or hazards to the security or integrity of such records and protect against unauthorized access to or use of such records or information that could result in substantial harm or inconvenience to any customer. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third- parties in the provision of financial services.

The federal bank regulatory agencies place reporting requirements on banks and banking service providers that experience cybersecurity incidents. Under this rule, banks must report these incidents within 36 hours to their primary federal regulator. In addition, banks are required to inform customers of any computer security incidents lasting more than four hours.

18

Consumer laws and regulations

We are subject to a broad array of federal and state laws designed to protect consumers in connection with our lending activities, including the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Truth in Lending Act, the Truth in Savings Act, the Home Mortgage Disclosure Act, the Real Estate Settlement Procedures Act, the Electronic Funds Transfer Act, and, in some cases, their respective state law counterparts. The CFPB has broad regulatory, supervisory and enforcement authority over our offering and provision of consumer financial products and services under these laws.

We have established numerous controls and procedures designed to ensure that we fully comply with lending and other consumer protection laws, both federal and state, as they are currently interpreted (which interpretations are subject to change by the CFPB). In addition, our employees undergo at least annual training to ensure that they remain aware of consumer protection laws and the activities mandated, or prohibited, thereunder.

Mortgage regulation

In addition to the consumer laws and regulations above, the Dodd-Frank Act also imposes specific duties on mortgage lenders, including a duty to determine the borrower's ability to repay the loan, and imposed a requirement on mortgage securitizers to retain a minimum level of economic interest in securitized pools of certain mortgage types.

Interchange fees

The Dodd-Frank Act also included provisions (known as the “Durbin Amendment”), which restrict interchange fees to those which are “reasonable and proportionate” for certain debit card issuers and limits the ability of networks and issuers to restrict debit card transaction routing. In the final rules, interchange fees for debit card transactions were capped at $0.21 plus five basis points (plus $0.01 for fraud loss) in order to be eligible for a safe harbor such that the fee is conclusively determined to be reasonable and proportionate.

Regulatory enforcement authority

Federal and state banking laws grant substantial enforcement powers to federal and state regulators. This enforcement authority includes, among other things, the ability to assess civil money penalties, to issue consent or removal orders and to initiate injunctive actions against banking organizations and “institution-affiliated parties,” such as management, employees and agents. In general, these enforcement actions may be initiated for violations of laws, regulations and orders of regulatory authorities, or unsafe or unsound practices. Other actions or inactions, including filing false, misleading or untimely reports with regulatory authorities, may provide the basis for enforcement action. When issued by a banking regulator, consent and similar orders may, among other things, require affirmative action to correct any harm resulting from a violation or practice, including restitution, reimbursement, indemnifications or guarantees against loss. A bank may also be ordered to restrict its growth, dispose of certain assets, rescind agreements or contracts, or take other actions determined to be appropriate by the ordering regulatory agency.

Future legislative developments

Various legislative acts are from time to time introduced in Congress and the Tennessee legislature. This legislation may change banking statutes and the environment in which we operate in substantial and unpredictable ways. We cannot determine the ultimate effect that potential legislation, if enacted, or implementing regulations and interpretations with respect thereto, would have on our financial condition or results of operations.

Available Information

Our website address is www.firstbankonline.com. We file or furnish to the Securities Exchange and Commission Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, proxy statements and Annual Reports to shareholders, and from time to time, amendments to these documents and other documents called for by the SEC. The reports and other documents filed with or furnished to the SEC are available to investors on or through our website at https://investors.firstbankonline.com under the heading “Stock & Filings” and then under “SEC Filings.” These reports are available on our website free of charge as soon as reasonably practicable after we electronically file them with the SEC.

In addition to our website, the SEC maintains an internet site that contains our reports, proxy and information statements and other information we file electronically with the SEC at https://www.sec.gov.

19

ITEM 1A - Risk Factors

Our operations and financial results are subject to various risks and uncertainties, including, but not limited to, the material risks described below. Many of these risks are beyond our control although efforts are made to manage and mitigate those risks while simultaneously optimizing operational and financial results. The occurrence of any of the following risks, as well as risks of which we are currently unaware or currently deem immaterial, could materially and adversely affect our assets, business, cash flows, condition (financial or otherwise), liquidity, prospects, results of operations and the trading price of our common stock. It is impossible to predict or identify all such factors and, as a result, you should not consider the following factors to be a complete discussion of the risks, uncertainties and assumptions that could materially and adversely affect our assets, business, cash flows, condition (financial or otherwise), liquidity, prospects, results of operations and the trading price of our common stock.

In addition, certain statements in the following risk factors constitute forward-looking statements. Please refer to the section entitled “Cautionary note regarding forward-looking statements” included in this Annual Report.

CREDIT AND LOAN RISK

The majority of our assets are loans, which if not repaid would result in losses to the Bank.

Making any loan involves various risks, including risks inherent in dealing with individual borrowers, risks of nonpayment, risks resulting from uncertainties as to the future value of collateral and cash flows available to service debt, and risks resulting from changes in economic and market conditions. Our credit risk approval and monitoring procedures may fail to identify or reduce these credit risks, and they cannot completely eliminate all credit risks related to our loan portfolio. If the overall economic climate, including employment rates, real estate markets, interest rates and general economic growth, in the United States, generally, or our markets, specifically, experiences material disruption, our borrowers may experience difficulties in repaying their loans, the collateral we hold may decrease in value or become illiquid, and the levels of nonperforming loans, charge-offs and delinquencies could rise and require additional provisions for loan losses, which would cause our net income and return on equity to decrease.

We maintain an allowance for credit losses, which is a reserve established through a provision for credit losses charged to expense, which represents the portion of the loan's amortized cost basis that we do not expect to collect due to credit losses over the loan's life, considering past events, current conditions, and reasonable and supportable forecasts of future economic conditions considering macroeconomic forecasts. In addition, we record a reserve for unfunded commitments, considering the same items included in the allowance for credit losses with the addition of expected funding. Management’s determination of the appropriateness of the allowance and reserve for unfunded commitments is based on periodic evaluation of the loan portfolio, lending-related commitments and other relevant factors, including macroeconomic forecasts and historical loss rates. Deterioration in economic conditions affecting borrowers, new information regarding existing loans, identification of additional problem loans and other factors, both within and outside of our control, may require an increase in the allowance for credit losses and/or the reserve for unfunded commitments. The model is sensitive to changes in macroeconomic forecasts and incorporates management judgment. If we are required to materially increase our level of allowance for credit losses for any reason, such increase could adversely affect our business, financial condition and results of operations.

The application of the purchase method of accounting in our acquisitions (and any future acquisitions) also will affect our allowance for credit losses. We are required to determine whether purchased loans held for investment have experienced more-than-insignificant deterioration in credit quality since origination. Loans that have experienced this level of deterioration in credit quality are subject to special accounting at initial recognition. We initially measure the amortized cost of a purchase credit deteriorated loan by adding the acquisition date estimate of expected credit losses to the loan's purchase price (i.e. the “gross up” approach). If we have underestimated credit losses at recognition, we will incur additional expense in our provision for credit losses to maintain an appropriate level of allowance for credit losses on those loans.

In addition, bank regulators periodically review our allowance for credit losses and may require an increase in the provision for credit losses or the recognition of further loan charge-offs, based on judgments different than those of management. Furthermore, if charge-offs in future periods exceed the allowance for credit losses, we will need additional provisions to increase the allowance for credit losses. Any increases in the allowance for credit losses will result in a decrease in net income and capital and may have a material adverse effect on our business, financial condition and results of operations.

Because a significant portion of our loan portfolio is comprised of real estate loans, negative changes in the economy affecting real estate values and liquidity could impair the value of collateral securing our real estate loans and result in loan and other losses.

As of December 31, 2023, approximately 77% of our loan portfolio was comprised of loans with real estate as a primary or secondary component of collateral. This includes collateral consisting of income producing and residential construction

20

properties, which properties tend to be more sensitive to general economic conditions and downturns in real estate markets. As a result, adverse developments affecting real estate values in our market areas could increase the credit risk associated with our real estate loan portfolio. Adverse changes affecting real estate values and the liquidity of real estate in one or more of our markets could increase the credit risk associated with our loan portfolio and could result in losses that would adversely affect credit quality and our financial condition or results of operations. These adverse changes could significantly impair the value of property pledged as collateral to secure the loans and affect our ability to sell the collateral upon foreclosure without a loss or additional losses. If real estate values decline, it is also more likely that we would be required to increase our allowance for credit losses. Thus, declines in the value of real estate collateral could adversely affect our financial condition, results of operations or cash flows.

Weakness in residential real estate market prices, weakness in demand, or increases in building costs could result in a volatile environment including price reductions in home and land values adversely affecting the value of collateral securing some of the construction and development loans that we hold. Should we experience the return of adverse economic and real estate market conditions similar to those we experienced from 2008 through 2010 we may again experience increases in non-performing loans and other real estate owned, increased losses and expenses from the management and disposition of non-performing assets, increases in provision for credit losses, and increases in operating expenses as a result of the allocation of management time and resources to the collection and work out of loans, all of which would negatively impact our financial condition and results of operations.

We are subject to lending concentration risks.

Our exposure to commercial real estate (both owner-occupied and non-owner occupied), commercial and industrial, and construction loans expose us to greater credit risk than loans secured by other types of collateral because the collateral securing these loans is typically more difficult to liquidate. Additionally, these types of loans also often involve larger loan balances to a single borrower or groups of related borrowers. These higher credit risks are further heightened when the loans are concentrated in a small number of larger borrowers leading to relationship exposure. As of December 31, 2023, the following loan types accounted for the stated percentages of our loan portfolio: commercial real estate (both owner-occupied and non-owner occupied) - 34%; commercial and industrial - 18%; and construction - 15%.

Non-owner occupied commercial real estate loans may be affected to a greater extent than residential loans by adverse conditions in real estate markets or the economy because commercial real estate borrowers’ ability to repay their loans depends on successful development of their properties. These loans also involve greater risk because they generally are not fully amortizing over the loan period, and therefore have a balloon payment due at maturity. A borrower’s ability to make a balloon payment typically will depend on being able to either refinance the loan or sell the underlying property in a timely manner. In addition, banking regulators have been giving commercial real estate lending greater scrutiny, and may require banks with higher levels of commercial real estate loans to implement improved underwriting, internal controls, risk management policies and portfolio stress testing, as well as possibly higher levels of allowances for losses and capital levels as a result of commercial real estate lending growth and exposures.

Commercial and industrial loans and owner-occupied commercial real estate loans are typically based on the borrowers’ ability to repay the loans from the cash flow of their businesses. These loans may involve greater risk because the availability of funds to repay each loan depends substantially on the success of the business itself. In addition, the assets securing the loans depreciate over time, are difficult to appraise and liquidate, and fluctuate in value based on the success of the business.

Risk of loss on a construction loan depends largely upon whether our initial estimate of the property’s value at completion of construction or development equals or exceeds the cost of the property construction or development (including interest), the availability of permanent take-out financing and the builder’s ability to sell the property. During the construction or development phase, a number of factors can result in delays and cost overruns. If estimates of value are inaccurate or if actual construction costs exceed estimates, the value of the property securing the loan may be insufficient to ensure full repayment when completed through a permanent loan or by foreclosure on collateral.

Commercial real estate loans, commercial and industrial loans, and construction loans are more susceptible to a risk of loss during a downturn in the business cycle due to the vulnerability of these sectors during a downturn. Our underwriting, review and monitoring cannot eliminate all of the risks related to these loans. We also make both secured and unsecured loans to our commercial customers. Unsecured loans generally involve a higher degree of risk of loss than secured loans because, without collateral, repayment is wholly dependent upon the success of the borrowers’ businesses. Because of this lack of collateral, we are limited in our ability to collect on defaulted unsecured loans. Further, the collateral that secures our secured commercial and industrial loans typically includes inventory, accounts receivable and equipment, which usually have a value that is insufficient to satisfy the loan without a loss if the business does not succeed. Our loan concentration in these sectors and their higher credit risk could lead to increased losses on these loans, which could have a material adverse effect on our financial condition, results of operations or cash flows.

21

Our ability to grow our loan portfolio may be hampered.

Our ability to grow our loan portfolio could be limited by, among other reasons, economic conditions, competition in our markets, our ability to hire and train experienced or successful bankers, our ability to generate the deposits needed to grow loan assets, or the drain on liquidity and available deposits that the banking industry has experienced and may continue to experience.

MARKET AND INTEREST RATE RISK

Difficult or volatile market conditions in the national financial markets, the U.S. economy generally, or our markets in particular may adversely affect our lending activity or other businesses, as well as our financial condition.

Our business and financial performance are vulnerable to weak economic conditions in the financial markets and economic conditions generally and specifically in our markets, the principal market in which we conduct business. A deterioration in economic conditions in our primary market areas could result in increased loan delinquencies, foreclosures, and write-downs of asset values, lower demand for our products and services, reduced low cost or noninterest-bearing deposits, and intangible asset impairment. Additionally, difficult market conditions may lead to a deterioration in the value of the collateral for loans made by us, especially real estate, which could reduce our customers' ability to repay outstanding loans and reduce the value of assets associated with our existing loans. Additional issues surrounding weakening economic conditions and volatile markets that could adversely impact us include increased industry regulation and downward pressures on our stock price.

We conduct our banking operations primarily in Tennessee. As of December 31, 2023, approximately 72% of our loans and approximately 78% of our deposits were made to borrowers or received from depositors who live and/or primarily conduct business in Tennessee. Therefore, our success will depend in large part upon the general economic conditions in this area. This geographic concentration imposes risks from lack of geographic diversification, as adverse economic developments in Tennessee (including the Nashville MSA, our largest market), among other things, could affect the volume of loan originations, increase the level of nonperforming assets, increase the rate of foreclosure losses on loans, reduce the value of our loans and loan servicing portfolio, reduce the value of the collateral securing our loans and reduce the amount of our deposits.

Any regional or local economic downturn that affects Tennessee or existing or prospective borrowers, depositors or property values in this area may affect us and our profitability more significantly and more adversely than our competitors whose operations are less geographically concentrated.

Changes in interest rates could adversely affect our results of operations and financial condition.

Our earnings and financial condition are dependent to a large degree upon net interest income, which is the difference, or spread, between interest earned on loans, securities and other interest-earning assets and interest paid on deposits, borrowings and other interest-bearing liabilities. When market rates of interest change, the interest we receive on our assets and the interest we pay on our liabilities may fluctuate. This may cause decreases in our spread and may adversely affect our earnings and financial condition. Interest rates are highly sensitive to many factors including, without limitation: the rate of inflation; economic conditions; federal monetary policies; and stability of domestic and foreign markets.

Although we have implemented procedures, we believe will reduce the potential effects of changes in interest rates on our net interest income, these procedures may not always be successful. Accordingly, changes in levels of market interest rates could materially and adversely affect our net interest income and our net interest margin, asset quality, loan and lease origination volume, liquidity or overall profitability. Additionally, changes in interest rates can adversely affect the origination of mortgage loans held for sale and resulting mortgage banking revenues.

The performance of our investment securities portfolio is subject to fluctuation due to changes in interest rates and market conditions, including credit deterioration of the issuers of individual securities.

Changes in interest rates may negatively affect both the returns on and fair value of our investment securities. Interest rate volatility can reduce unrealized gains or increase unrealized losses in our portfolio. Interest rates are highly sensitive to many factors including monetary policies, domestic and international economic and political issues, and other factors beyond our control. Additionally, actual investment income and cash flows from investment securities that carry prepayment risk, such as mortgage-backed securities and callable securities, may materially differ from those anticipated at the time of investment or subsequently as a result of changes in interest rates and market conditions. These occurrences could materially and adversely affect our net interest income or our results of operations.

22

We may be materially and adversely affected by the creditworthiness and liquidity of other financial institutions.

Financial services institutions are interrelated as a result of trading, clearing, counterparty, or other relationships. We have exposure to many different industries and counterparties, and routinely execute transactions with counterparties in the financial services industry, including commercial banks, brokers and dealers, investment banks and other institutional customers. Many of these transactions expose us to credit risk in the event of a default by, or questions or concerns about the creditworthiness of a counterparty or client, or concerns about the financial services industry generally. In addition, our credit risk may be exacerbated when the collateral held by us cannot be realized upon or is liquidated at prices not sufficient to recover the full amount of the credit or derivative exposure due to us. Any such losses could have a material adverse effect on us.

LIQUIDITY RISK

A lack of liquidity could adversely affect our operations and jeopardize our business, financial condition or results of operations.

We rely on our ability to generate deposits and effectively manage the repayment and maturity schedules of our loans and investment securities to ensure that we have adequate liquidity to fund our operations. In addition to our traditional funding sources, we also may borrow funds from third-party lenders or issue equity or debt securities to investors. Our access to funding sources in amounts adequate to finance or capitalize our activities, or on terms that are acceptable to us, could be impaired by factors that affect us directly or the financial services industry or economy in general, such as disruptions in the financial markets or negative views and expectations about the prospects for the financial services industry. Any decline in available funding could adversely impact our ability to originate loans, invest in securities, meet our expenses, pay dividends to our shareholders, or to fulfill obligations such as repaying our borrowings or meeting deposit withdrawal demands, any of which could have a material adverse impact on our liquidity, business, financial condition or results of operations.

Failure to address the federal debt ceiling in a timely manner, downgrade of the U.S. credit rating, and uncertain credit and financial market conditions may affect the stability of securities issued or guaranteed by the federal government, which may adversely affect the valuation or liquidity of our investment securities portfolio and increase future borrowing costs.

As a result of uncertain political, credit and financial market conditions, including the potential consequences of the federal government defaulting on its obligations for a period of time due to federal debt ceiling limitations or other unresolved political issues, investments in financial instruments issued or guaranteed by the federal government pose credit default and liquidity risks. Downgrades to the U.S. credit rating could affect the stability of securities issued or guaranteed by the federal government and the valuation or liquidity of our portfolio of such investment securities, and could result in our counterparties requiring additional collateral for our borrowings. Further, unless and until U.S. political, credit and financial market conditions have been sufficiently resolved or stabilized, it may increase our future borrowing costs.

MORTGAGE BANKING RISK

Our mortgage revenue is cyclical and is sensitive to the level of interest rates, changes in economic conditions, decreased economic activity, and slowdowns in the housing market.

The success of our mortgage segment is dependent upon our ability to originate loans and sell them to investors. Loan production levels are sensitive to changes in the level of interest rates and changes in economic conditions. As the mortgage industry experienced in 2023, mortgage production, especially refinancing activity, declines when interest rates rise. Our mortgage origination volume could be materially and adversely affected by rising interest rates.

Because we sell a substantial portion of the mortgage loans we originate, the profitability of our mortgage banking business also depends in large part on our ability to aggregate a high volume of loans and sell them in the secondary market at a gain. If interest rates rise, we expect increasing industry-wide competitive pressures related to changing market conditions to reduce pricing margins and mortgage revenues generally. If our level of mortgage production declines, our continued profitability will depend upon our ability to further reduce our costs. If we are unable to do so, our continued profitability may be materially and adversely affected.

In 2023, we sold nearly all of the $1.20 billion of mortgage loans held for sale that we closed. When mortgage loans are sold, whether as whole loans or pursuant to a securitization, we are required to make customary representations and warranties to purchasers, guarantors and insurers about the mortgage loans and the manner in which they were originated. We may be required to repurchase or substitute mortgage loans, or indemnify buyers against losses, in the event we breach certain representations or warranties in connection with the sale of such loans. If repurchase and indemnity demands increase, such demands are valid claims and are in excess of our provision for potential losses, our liquidity, results of operations or financial condition may be materially and adversely affected.

23

The value of our mortgage servicing rights asset is subjective by nature and may be vulnerable to inaccuracies or other events outside our control.

The value of our mortgage servicing rights asset can fluctuate. Particularly, the asset could decrease in value if prepayment speeds, delinquency rates, or the cost to service increases or overall values decrease causing a lack of liquidity of MSRs in the market. Similarly, the value may decrease if interest rates decrease or change in a non-parallel manner or are otherwise volatile, all of which are mostly out of the Bank’s control. We must use estimates, assumptions and judgments when valuing this asset. An inaccurate valuation, or changes to the valuation due to factors outside of our control, could inhibit our ability to realize the full value of this asset. As a result, our balance sheet may not precisely represent the fair market value of this and other financial assets.

Our business model is materially dependent on U.S. government‐sponsored entities and government agencies, and any changes in these entities, their current roles or the leadership at such entities or their regulators could materially and adversely affect our business, financial condition, liquidity and results of operations.

Our ability to generate revenues through mortgage loan sales depends on programs administered by Government-Sponsored Enterprises, such as Fannie Mae and Freddie Mac, government agencies, including Ginnie Mae, and others that facilitate the issuance of mortgage‐backed securities in the secondary market. Presently, a significant portion of the newly originated loans that we originate directly with borrowers qualify under existing standards for inclusion in MBS issued by Fannie Mae or Freddie Mac or guaranteed by Ginnie Mae. A number of legislative proposals have been introduced in recent years that would wind down or phase out the GSEs. It is not possible to predict the scope and nature of the actions that the U.S. government will ultimately take with respect to the GSEs. Any changes in laws and regulations affecting the relationship between Fannie Mae and Freddie Mac and their regulators or the U.S. federal government, and any changes in leadership at these entities, could adversely affect our business and prospects. Any discontinuation of, or significant reduction in, the operation of Fannie Mae or Freddie Mac or any significant adverse change in their capital structure, financial condition, activity levels in the primary or secondary mortgage markets or in underwriting criteria could materially and adversely affect our business, financial condition, liquidity and results of operations.

Elimination of the traditional roles of Fannie Mae and Freddie Mac, or any changes to the nature or extent of the guarantees provided by Fannie Mae and Freddie Mac or the fees, terms and guidelines that govern our selling and servicing relationships with them, could also materially and adversely affect our ability to sell and securitize loans through our loan production segment, and the performance, liquidity and market value of our investments. Moreover, any changes to the nature of the GSEs or their guarantee obligations could redefine what constitutes an Agency MBS and could have broad adverse implications for the market and our business, financial condition, liquidity and results of operations.

Decreased residential mortgage origination volume and pricing decisions of competitors may adversely affect our profitability.

Our mortgage operation originates, sells and services residential mortgage loans. Changes in interest rates, housing prices, applicable government regulations and pricing decisions by our loan competitors may adversely affect demand for our residential mortgage loan products, the revenue realized on the sale of loans, the revenues received from servicing such loans for others and, ultimately, reduce our net income. New regulations, increased regulatory reviews, and/or changes in the structure of the secondary mortgage markets which we utilize to sell mortgage loans may increase costs and make it more difficult to operate a residential mortgage origination business. Our revenue from the mortgage banking business was $44.7 million in 2023. This revenue could significantly decline in future periods if interest rates were to rise and the other risks highlighted in this paragraph were realized, which may adversely affect our profitability.

We may incur costs, liabilities, fines and other sanctions if we fail to satisfy our mortgage loan servicing obligations.

We act as servicer for approximately $10.76 billion of mortgage loans owned by third-parties as of December 31, 2023. As a servicer for those loans, we have certain contractual obligations to third-parties. If we commit a material breach of our obligations as servicer, we may be subject to termination if the breach is not cured within a specified period of time following notice, causing us to lose servicing income. For certain investors and/or transactions, we may be contractually obligated to repurchase a mortgage loan or reimburse the investor for credit losses incurred on the loan as a remedy for origination errors with respect to the loan. If we have increased repurchase obligations because of claims that we did not satisfy our obligations as a servicer, or if we have increased loss severity on such repurchases, we may have a significant reduction to net servicing income within our mortgage banking noninterest income. In addition, we may be subject to fines and other sanctions imposed by federal or state regulators as a result of actual or perceived deficiencies in our foreclosure practices. Any of these actions may harm our reputation or negatively affect our residential lending or servicing business and, as a result, our profitability.

24

LEGAL, REGULATORY AND COMPLIANCE RISK

We are subject to significant government regulation and supervision.

The Company and the Bank are subject to extensive federal and state regulation and supervision by the FDIC, Tennessee Department of Financial Institution, the Federal Reserve Board, and the CFPB, among others, the primary focus of which is to protect customers, depositors, the deposit insurance fund and the safety and soundness of the banking system as a whole, and not shareholders. The quantity and scope of applicable federal and state regulations may place banks at a competitive disadvantage compared to less regulated competitors such as financial technology companies, finance companies, credit unions, mortgage banking companies and leasing companies. These laws and regulations apply to almost every aspect of our business, and affect our lending practices and procedures, capital structure, investment activities, deposit gathering activities, our services and products, risk management practices, dividend policy and growth, including through acquisitions.

Legislation and regulation with respect to our industry has increased in recent years, and we expect that supervision and regulation will continue to expand in scope and complexity. Changes to statutes, regulations or regulatory policies, including changes in interpretation or implementation of statutes, regulations or policies, or the issuance of new supervisory guidance, could affect us in substantial and unpredictable ways, and could subject us to additional costs, restrict our growth, limit the services and products we may offer or limit the pricing of banking services and products. In addition, establishing systems and processes to achieve compliance with laws and regulation increases our costs and could limit our ability to pursue business opportunities.

If we receive less than satisfactory results on regulatory examinations, we could be subject to damage to our reputation, significant fines and penalties, requirements to increase compliance and risk management activities and related costs and restriction on acquisitions, new locations, new lines of business, or continued growth. Future changes in federal and state banking could adversely affect our operating results and ability to continue to compete effectively. For example, the Dodd-Frank Act and related regulations, including the Home Mortgage Disclosure Act, subject us to additional restrictions, oversight and reporting obligations, which have significantly increased costs. And over the last several years, state and federal regulators have focused on enhanced risk management practices, mortgage law and regulation, compliance with the Bank Secrecy Act and anti-money laundering laws, data integrity and security, use of service providers, and fair lending and other consumer protection issues, which has increased our need to build additional processes and infrastructure. Government agencies charged with adopting and interpreting laws, rules and regulations, may do so in an unforeseen manner, including in ways that potentially expand the reach of the laws, rules or regulations more than initially contemplated or currently anticipated. We cannot predict the substance or impact of pending or future legislation or regulation, or the application thereof. Compliance with such current and potential regulation and scrutiny could significantly increase our costs, impede the efficiency of our internal business processes, require us to increase our regulatory capital and limit our ability to pursue business opportunities in an efficient manner. Our success depends on our ability to maintain compliance with both existing and new laws and regulations.

Applicable laws and regulations restrict both the ability of the Bank to pay dividends to us and our ability to pay dividends to our shareholders.

The Company and the Bank are subject to various regulatory restrictions relating to the payment of dividends. In addition, the Federal Reserve has the authority to prohibit bank holding companies from engaging in unsafe or unsound practices in conducting their business. These federal and state laws, regulations and policies are described in greater detail in “Business: Supervision and regulation: Regulation of the Company and the Bank: Restrictions on dividends” and generally consider previous results and net income, capital needs, asset quality, existence of enforcement or remediation proceedings, and overall financial condition in determining whether a dividend payment is appropriate. For the foreseeable future, the majority, if not all, of our revenue will be from any dividends paid to us by the Bank. Accordingly, our ability to pay dividends also depends on the ability of the Bank to pay dividends to us. Further, the present and future dividend policy of the Bank is subject to the discretion of the Board of Directors. We cannot guarantee that we or the Bank will be permitted by financial condition or applicable regulatory restrictions to pay dividends, that the Board of Directors will elect to pay dividends to us, or the timing or amount of any dividend actually paid. See “Item 5. Market for Registrant's Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities - Dividends.” If we do not pay dividends, market perceptions of our common stock may be adversely affected, which could in turn create downward pressure on our stock price.

As the parent company of the Bank, the Federal Reserve may require us to commit capital resources to support the Bank.

The Federal Reserve requires us to act as a source of strength to the Bank and to commit capital and financial resources to support the Bank. This support may be required at times when we might otherwise determine not to provide it. In addition, if we commit to a federal bank regulator that we will maintain the capital of the Bank, whether in response to the Federal Reserve’s invoking its source-of-strength authority or in response to other regulatory measures, that commitment

25

will be assumed by a bankruptcy trustee and, as a result, the Bank will be entitled to priority payment in respect of that commitment, ahead of our other creditors. Thus, any borrowing that must be done by us in order to support the Bank may adversely impact our cash flow, financial condition, results of operations or prospects.

Our financial condition may be affected negatively by the costs of litigation.

We may be involved from time to time in a variety of litigation, investigations or similar matters arising out of our business. From time to time, and particularly during periods of economic stress, customers may make claims or otherwise take legal action pertaining to performance of our responsibilities. These claims are often referred to as “lender liability” claims. Whether customer claims and legal action related to the performance of our responsibilities are founded or unfounded, if such claims and legal actions are not resolved in a favorable manner, they may result in significant financial liability and/or adversely affect our market perception, products and services, as well as potentially affecting customer demand for those products and services. In many cases, we may seek reimbursement from our insurance carriers to cover such costs and expenses. These claims, as well as supervisory and enforcement actions by our regulators could involve large monetary claims, capital directives, regulatory agreements and directives and significant defense costs. The outcome of any such cases or actions is uncertain. Substantial legal liability or significant regulatory action against us could have material adverse financial effects or cause significant reputational harm to us, which in turn could seriously harm our business prospects. Our insurance may not cover all claims that may be asserted against us, and any claims asserted against us, regardless of merit or eventual outcome, may harm our reputation. Should the ultimate judgments or settlements in any litigation or investigation significantly exceed our insurance coverage, they could have a material adverse effect on our business, financial condition or results of operations.

TECHNOLOGY AND OPERATIONAL RISKS

We rely on third-party vendors to provide services that are integral to the operation of our business.

We depend on a range of third-party service providers that are integral to the operation of our business. These vendors service our mortgage loan business, provide critical core systems' processing services, essential web hosting and other internet systems, and deposit processing services. If these service providers fail to perform servicing duties or perform those duties inadequately, we could experience a temporary interruption in our business, sustain credit losses on our loans and/or incur additional costs to obtain a replacement servicer. There can be no assurance that a replacement servicer could be retained in a timely manner or at a similar cost.

Being able to maintain these relationships on favorable terms is not guaranteed. In addition, some of our data processing services are provided by companies associated with our competitors. The loss of these vendor relationships could disrupt the services we provide to our customers and cause significant expenses to replace these services. Our operations could be significantly disrupted if third-party service providers experienced their own difficulties, or terminate their services. If an interruption were to continue for a significant period, our business' financial condition and operations could be adversely affected, perhaps materially. Assuming we were able to replace third-party service providers, it may be at a higher cost. For example, if we experienced issues with our mortgage servicing provider it could result in a range of critical issues including; servicing rights becoming terminated, repurchasing of mortgage loans, and/or reimbursements to investors.

Additionally, we utilize many vendors that provide services to support our operations, including the storage and processing of sensitive consumer and business customer data. A cyber security breach of a vendor's system may result in theft and/or unavailability of our data or disruption of business processes. We could be liable to our customers for losses arising from a breach of a vendor's data security system. We rely on outsourced service providers to implement and maintain prudent cyber security controls. We have procedures in place to assess a vendor's cyber security controls prior to establishing a contractual relationship and to periodically review assessments of those control systems. However, these procedures are not infallible, and a vendor's system can be breached despite the procedures we employ.

Our risk management framework may not be effective in mitigating risks and/or losses to us.

Our risk management framework is comprised of various processes, systems, and strategies, that are designed to manage the types of risk to which we are subject, including, among others, credit, price, liquidity, interest rate and compliance risks. Our framework also includes financial or other modeling methodologies that involve management assumptions and judgment. Our risk management framework may not be effective under all circumstances and may not adequately mitigate any risk or loss to us. If our framework is not effective, we could suffer unexpected losses and our business, financial condition, results of operations or prospects could be materially and adversely affected.

System failure or breaches of our network security, including cyber-attacks or data security breaches, could subject us to increased operating costs as well as litigation among other liabilities.

The computer systems and network infrastructure we, and our vendors, use may be vulnerable to physical theft, fire, power loss, telecommunications failure or a similar catastrophic event. Additionally, security breaches, denial of service attacks, viruses, ransomware, and other disruptive problems caused by cyber criminals. Any damage or failure that

26

causes breakdowns or disruptions in our client relationship management, general ledger, deposit, loan and other systems could damage our reputation, result in a loss of client business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on us.

Compromised computers, phishing and other disruptions could also jeopardize the security of information stored in and transmitted through our network infrastructure. A cybersecurity breach of our information systems could lead to fraudulent activity such as identity theft, losses on the part of our banking customers, additional security costs, negative publicity and damage to our reputation and brand. In addition, our customers could be subject to scams that may result in the release of sufficient information concerning themselves or their accounts to allow unauthorized access to their accounts or our systems (e.g., “phishing” and “smishing”). Claims for compensatory or other damages may be brought against us because of a breach of our systems or fraudulent activity. If we are unsuccessful in defending against such resulting claims, we may be forced to pay damages, which could materially and adversely affect our financial condition and results of operations.

Information security risks have generally increased in recent years in part because of the proliferation of new technologies, use of the internet and telecommunications technologies to conduct financial transactions, increase in remote working, and the increased sophistication and activities of organized crime, hackers, nation state supported organizations, terrorists, and other external parties. The methods used to obtain unauthorized access, disable or degrade service or sabotage systems change frequently and often are not recognized until launched against a target. We may be unable to anticipate these techniques or to implement adequate preventative measures. Further, computer viruses or malware could infiltrate our systems and disrupt our delivery of services making our applications unavailable. Although we utilize several preventative and detective security controls in our network, they may be ineffective in preventing computer viruses or malware that could damage our relationships with our merchant customers, cause a decrease in transactions by individual cardholders, or cause us to be in non-compliance with applicable network rules and regulations. In addition, a significant incident of fraud or an increase in fraud levels generally involving our products could result in reputational damage to us, which could reduce the use of our products and services. Such incidents of fraud could also lead to regulatory intervention, which could increase our compliance costs. Compliance with the various complex laws and regulations is costly and time consuming, and failure to comply could have a material adverse effect on our business. Additionally, increased regulatory requirements on our services may increase our costs, which could materially and adversely affect our business, financial condition and results of operations. Accordingly, account data breaches and related fraudulent activity could have a material adverse effect on our future growth prospects, business, financial condition and results of operations.

Our operations rely on the secure processing, transmission and storage of confidential information in our computer systems and networks. Although we believe we have robust information security procedures and controls, our encryption software, systems, vendors, and our customers’ devices themselves may become the target of cyber-attacks or information security breaches. Such events could result in the unauthorized release, gathering, monitoring, misuse, unavailability, loss, or destruction of our or our customers’ confidential, proprietary and other information, or otherwise disrupt our or our customers’ business operations. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities.

We are under continuous threat of loss due to organized cyber-attacks involving unauthorized access, computer hackers, computer viruses, malicious code, and other security problems and system disruptions as we continue to expand client capabilities to utilize internet and other remote channels to transact business. We have invested and intend to continue to devote significant resources to the security of our computer systems, but they may still be vulnerable to these threats. A user who circumvents security measures can misappropriate confidential or proprietary information, including information regarding us, our personnel and/or our clients, or cause interruptions or malfunctions in operations. The occurrence of any cyber-attack or information security breach could result in significant potential liabilities to customers and other third- parties, reputational damage, the disruption of our operations and regulatory concerns, all of which could materially and adversely affect our business, financial condition or results of operations. The harm to our business could be even greater if such an event occurs during a period of disproportionately heavy demand for our products or services or traffic on our systems or networks.

The financial services industry is undergoing rapid technological changes and we may not have the resources to implement new technology to stay current with these changes.

In addition to better serving customers, the effective use of technology increases efficiency and enables financial institutions to reduce costs. Our future success will depend, in part, upon our ability to address the technological needs of our customers that will satisfy client demands for convenience in addition to providing secure electronic environments. As we continue to grow and expand our market area, part of our growth strategy is to focus on expanding market share and product offerings through partnerships with financial technology companies that will supplement our existing offerings, such as blockchain-based products and/or financial solutions supported by artificial intelligence. These technological

27

advances are intended to allow us to acquire new customers and generate additional core deposits at a lower cost. Many of our larger competitors have substantially greater resources to invest, and have invested significantly more than us, in technological improvements. As a result, they may be able to offer additional or more convenient products compared to those that we will be able to provide, which would put us at a competitive disadvantage. Accordingly, we may not be able to effectively implement new technology-driven products and services or be successful in marketing such products and services to our customers, which could impair our growth and profitability.

The nature of technology-driven disruption to our industry is changing, in some cases seeking to displace traditional financial service providers rather than merely enhancing traditional services or their delivery.

Technological innovation has expanded the overall market for banking services while siphoning a portion of the revenues from those services away from banks and disrupting prior methods of delivering those services. Certain recent innovations, however, may tend to replace traditional banks as financial service providers rather than merely augment those services. Similarly, innovations based on blockchain technology eventually may be the foundation for enhancing transactional security and facilitating payments throughout the banking industry, but also eventually may reduce the need for banks as secure deposit-keepers and intermediaries.

To thrive as our industry continues to change, we may need to embrace technological evolution and innovations and redefine the customs of a traditional bank, while also maintaining our commitment to our community banking approach. As a result, this type of transition creates implementation risk.In this process, it is and will continue to be critical that we understand and appreciate our clients’ experiences interacting with us and our systems, including those clients who desire traditionally-delivered services provided through our community-banking model, those who seek and embrace the latest innovations, and those who want services to be convenient, personalized, and understandable.

We are subject to certain operational risks, including, but not limited to, client or employee fraud.

Employee errors and employee and client misconduct could subject us to financial losses or regulatory sanctions and seriously harm our reputation. Misconduct by our employees could include hiding unauthorized activities from us, improper or unauthorized activities on behalf of our customers or improper use of confidential information. It is not always possible to prevent employee errors and misconduct, and the precautions we take to prevent and detect this activity may not be effective in all cases. Employee errors could also subject us to financial claims for negligence. Check fraud perpetrated by others who are not employees or clients could also result in financial losses. We maintain a system of internal controls and insurance coverage to mitigate against these operational risks. If our internal controls fail to prevent or detect an occurrence, or if any resulting loss is not insured or exceeds applicable insurance limits, it could have a material adverse effect on our business, financial condition, or results of operations.

We rely heavily upon information supplied by third-parties, including information contained in credit applications, property appraisals, title information, equipment pricing and valuation and employment and income documentation, in deciding which loans we originate, as well as the terms of those loans. If any such data is misrepresented, either fraudulently or inadvertently, and the misrepresentation is not detected prior to asset funding, the value of the asset may be significantly lower than expected, or we may fund a loan that we would not have funded or on terms we would not have extended.

The impact of widespread health emergencies, catastrophic events, or natural disasters adversely affect our business, financial condition, liquidity, and results of operations.

A significant portion of our business is in the Southeast and includes areas which are susceptible to weather-related events such as tornadoes, floods, droughts, and fires. Recently, the COVID-19 pandemic negatively impacted global, national, and local economies, disrupted global supply chains, and created significant volatility and disruption in financial markets. Such events can disrupt our operations and negatively affect our business and the economies in which we operate. These events may also have a negative impact on the financial condition of our clients, which may decrease revenues from those clients and increase the credit risk associated with loans and other credit exposures to those clients.

In addition, geopolitical matters such as international trade disputes, political unrest, cyber-attacks or campaigns, and slow growth in the global economy, as well as acts of terrorism, war, and other violence could result in disruptions in the financial markets or the markets that we serve. These negative events could have a material adverse effect on our results of operations or financial condition and may affect our ability to access capital.

STRATEGIC AND OTHER BUSINESS RISKS

Our strategy of pursuing acquisitions exposes us to risk.

We intend to pursue a strategy that includes acquisition and consolidation opportunities within our core markets and beyond. The market for any such acquisition targets is highly competitive, which may adversely affect our ability to find acquisition candidates that fit our strategy and our standards. Acquisitions of financial institutions also involve operational risks and uncertainties, such as the time and expense associated with identifying and evaluating potential acquisition targets and negotiating terms or potential transactions, which could result in our attention being diverted from the

28

operation of our existing business. Also, all acquisitions are subject to various regulatory approvals, and if we were unable to obtain such approvals for any reason, it would impair our ability to consummate acquisitions.

We have a shareholder who owns a significant portion of our stock and that shareholders' interests in our business may be different than our other shareholders.

Mr. Ayers, the Company's former Chairman, currently owns approximately 23% of our common stock. Further, Mr. Ayers has the right under the shareholder's agreement, by and between the Company and Mr. Ayers and entered into in connection with the Company's initial public offering, to designate up to 20% of our directors and at least one member of the nominating and corporate governance and compensation committees of our board of directors for so long as permitted under applicable law. So long as Mr. Ayers continues to own a significant portion of our common stock, he will have the ability to influence the vote in any election of directors and will have the ability to significantly influence a vote regarding a transaction that requires shareholder approval regardless of whether others believe the transaction is in our best interests. In any of these matters, the interests of Mr. Ayers may differ from or conflict with the interests of our other shareholders. Moreover, this concentration of stock ownership may also adversely affect the trading price of our common stock to the extent investors perceive disadvantages in owning stock of a company with a significant shareholder.

We could be required to write down goodwill and other intangible assets.

At December 31, 2023, our goodwill and other identifiable intangible assets were $251.3 million. Under current accounting standards, if we determine goodwill or intangible assets are impaired because, for example, the acquired business does not meet projected revenue targets or credit losses are dramatically higher than anticipated, we are required to write down the carrying value of these assets. We conduct a review at least annually to determine whether goodwill is impaired. Our goodwill impairment evaluation indicated no impairment of goodwill for our reporting segments. We cannot provide assurance, however, that we will not be required to take an impairment charge in the future. Any impairment charge would have an adverse effect on our shareholders' equity and financial results and could cause a decline in our stock price.

GENERAL RISKS

We face strong competition from financial services companies and other companies that offer banking services.

We conduct our banking operations primarily in Tennessee, with our largest market being the Nashville MSA, which is a highly competitive banking market. Many of our competitors offer the same, or a wider variety of, banking services within our market areas, and we compete with them for the same customers. These competitors include banks with nationwide operations, regional banks and community banks. In many instances these national and regional banks have greater resources than we do, and the smaller community banks may have stronger ties in local markets than we do, which may put us at a competitive disadvantage. We also face competition from many other types of financial institutions, including thrift institutions, finance companies, brokerage firms, insurance companies, credit unions, mortgage banks and other internet-based companies offering financial services which enjoy fewer regulatory constraints and some may have lower cost structures. In addition, a number of out-of-state financial institutions have opened offices and solicit deposits in our market areas. Increased competition in our markets may result in reduced loans and deposits, as well as reduced net interest margin and profitability. If we are unable to attract and retain banking customers, we may be unable to continue to grow our loan and deposit portfolios, and our business, financial condition or results of operations may be adversely affected.

Further, a number of larger banks have recently entered the Nashville MSA, and we believe this trend will continue as banks look to gain a foothold in this growing market. This trend will likely result in greater competition in and may impair our ability to grow our share of our largest market.

Holders of our subordinated debentures have rights that are senior to those of our common shareholders.

We have supported a portion of our growth through the issuance of subordinated notes which are senior in rank to our shares of common stock. As a result, we must make payments on the subordinated notes before any dividends can be paid on our common stock and, in the event of our bankruptcy, dissolution or liquidation, the holders of the subordinated notes must be satisfied before any distributions can be made on our common stock.

New lines of business, products, product enhancements or services may subject us to additional risks.

From time to time, we may implement or acquire new lines of business or offer new products and product enhancements as well as new services within our existing lines of business. There are substantial risks and uncertainties associated with these efforts. In acquiring, developing or marketing new lines of business, products, product enhancements or services, we may invest significant time and resources, although there is no guarantee that these new lines of business, products, product enhancements or services will be successful or that we will realize their expected benefits. Further, initial timetables for the introduction and development of new lines of business, products, product enhancements or services may not be achieved, and price and profitability targets may not prove feasible. External factors, such as compliance with regulations, competitive alternatives and shifting market preferences, may also impact the ultimate implementation and

29

success of new lines of business or offerings of new products, product enhancements or services. Furthermore, any new line of business, product, product enhancement or service could have a significant impact on the effectiveness of our system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business or offerings of new products, product enhancements or services could have a material adverse effect on our business, financial condition or results of operation.

Consumers may decide not to use banks to complete their financial transactions.

Technology and other changes are allowing parties to complete, through alternative methods and delivery channels, financial transactions that historically have involved banks. For example, consumers can now maintain funds that would have historically been held as bank deposits in brokerage accounts, mutual funds with an Internet-only bank, or with virtually any bank in the country through online or mobile banking. Consumers can also complete transactions such as purchasing goods and services, paying bills and/or transferring funds directly without the assistance of banks by transacting through non-bank enterprises or through the use of emerging payment technologies such as cryptocurrencies. The process of eliminating banks as intermediaries could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits. The loss of these revenue streams and the lower-cost deposits as a source of funds could have an adverse effect on our financial condition, results of operations and liquidity.

We depend on the accuracy and completeness of information about customers.

In deciding whether to extend credit or enter certain transactions, we rely on information furnished by or on behalf of customers, including financial statements, credit reports, tax returns and other financial information. We may also rely on representations of those customers or other third-parties, such as independent auditors, as to the accuracy and completeness of that information. Reliance on inaccurate or misleading personal information, financial statements, credit reports, tax returns or other financial information, including information falsely provided because of identity theft, could have an adverse effect on our business, financial condition and results of operations.

Negative publicity could impact our reputation.

Reputational risk is inherent in our business. Negative public opinion could adversely affect our ability to keep and attract customers and could expose us to adverse legal and regulatory consequences. Negative public opinion could result from our actual, alleged, or perceived conduct related to employees or banking practices. Such negative public opinion could ultimately impact our earnings and stock price.

Recent volatility in the banking industry, and responsive measures to manage it, could have an adverse effect on our financial position or results of operations.

In recent months, several financial institutions have failed or required outside liquidity support. These events have created the risk of additional stress to other financial institutions and the banking industry generally as a result of increased lack of confidence in the financial sector. U.S. and international regulators have taken action in an effort to strengthen public confidence in the banking system, including the creation of a new Bank Term Funding Program and international coordination to enhance the provision of liquidity via the standing U.S. dollar liquidity swap line arrangements. There can be no assurance that these actions will stabilize the financial services industry and financial markets. While we currently do not anticipate liquidity constraints of the kind that caused certain other banks to fail or require external support, constraints on our liquidity could occur as a result of unanticipated deposit withdrawals because of market distress or our inability to access other sources of liquidity, including through the capital markets due to unforeseen market dislocations or interruptions. Moreover, some of our customers may become less willing to maintain deposits at our bank because of broader market concerns with the level of insurance available on those deposits. Our business and our financial condition and results of operations could be adversely affected by continued soundness concerns regarding financial institutions generally and our counterparties specifically and limitations resulting from further governmental action in an effort to stabilize or provide additional regulation of the financial system as well as the impact of excessive deposit withdrawals.