FIBK US Equity☆

fibk-20251231

UNITED STATES SECURITIES AND EXCHANGE COMMISSION

Washington D.C. 20549

FORM 10-K

(Mark One)

☑Annual Report Pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934

For the fiscal year ended December 31, 2025

or

☐Transition Report Pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934

For the transition period from to .

Commission File Number: 001-34653

FIRST INTERSTATE BANCSYSTEM, INC.

(Exact name of registrant as specified in its charter)

(Address of principal executive offices) (zip code)

(406) 255-5311

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

Title of each class Trading Symbol(s) Name of exchange on which registered

Common stock, $0.00001 par value FIBK NASDAQ

Securities registered pursuant to Section 12(g) of the Act:

None

(Title of class)

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. þYeso No

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. o Yes þNo

Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. þYeso No

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). þYeso No

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company” and “emerging growth company” in Rule 12b-2 of the Exchange Act:

Large accelerated filer ☒ Accelerated filer ☐ Non-accelerated filer ☐

Smaller reporting company ☐ Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. o

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☑

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements o

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant's executive officers during the relevant recovery period pursuant to §240.10D-1(b). o

Indicate by check mark if the registrant is a shell company (as defined in Rule 12b-2 of the Act.) ☐ Yes þ No

The aggregate market value of voting and non-voting common equity held by non-affiliates, computed by reference to the price at which the common equity was last sold on the NASDAQ, as of the last business day of the registrant’s most recently completed second fiscal quarter was $2.6 billion.

As of January 31, 2026, there were 101,118,302 shares outstanding of the registrant’s Common stock.

Documents Incorporated by Reference

The registrant intends to file a definitive Proxy Statement on Schedule 14A with the SEC within 120 days after the end of its fiscal year ended December 31, 2025, in connection with its Annual Meeting of Shareholders scheduled to be held on May 27, 2026. The information required by Part III of this Form 10-K is incorporated by reference to such Proxy Statement.

FIRST INTERSTATE BANCSYSTEM, INC. AND SUBSIDIARIES

Index

Page Nos.

PART I

Item 1 Business 3

Item 1A Risk Factors 16

Item 1B Unresolved Staff Comments 35

Item 1C Cybersecurity 35

Item 2 Properties 37

Item 3 Legal Proceedings 37

Item 4 Mine Safety Disclosure 37

PART II

Item 6 Reserved 39

Item 7A Quantitative and Qualitative Disclosures About Market Risk 64

Item 8 Financial Statements and Supplementary Data 66

Item 9A Controls and Procedures 67

Item 9B Other Information 69

Item 9C Disclosure Regarding Foreign Jurisdictions that Prevent Inspections 69

PART III

Item 10 Directors, Executive Officers and Corporate Governance. 69

Item 11 Executive Compensation 69

Item 14 Principal Accountant Fees and Services 70

PART IV

Item 15 Exhibits and Financial Statement Schedules 70

Report of Independent Registered Public Accounting Firm 71

Consolidated Balance Sheets 74

Consolidated Statements of Income 75

Consolidated Statements of Comprehensive Income 76

Consolidated Statements of Stockholders' Equity 77

Consolidated Statements of Cash Flows 78

Notes to Consolidated Financial Statements 80

Table of Contents

PART I

Cautionary Note Regarding Forward-Looking Statements

When we refer to “we,” “our,” “us,” “First Interstate,” or the “Company” in this report, we mean First Interstate BancSystem, Inc. and our consolidated subsidiaries, including our wholly-owned subsidiary, First Interstate Bank, unless the context indicates that we refer only to the parent company, First Interstate BancSystem, Inc. When we refer to the “Bank” or “FIB” in this report, we mean only First Interstate Bank.

This report contains “forward-looking statements” within the meaning of Section 27A of the Securities Act of 1933, as amended, or the Securities Act, and Rule 175 promulgated thereunder, and Section 21E of the Securities Exchange Act of 1934, as amended, or the Exchange Act, and Rule 3b-6 promulgated thereunder, that involve inherent risks and uncertainties. Any statements about our plans, objectives, expectations, strategies, beliefs, or future performance, financial condition, results of operations, investment portfolio, market position, or events constitute forward-looking statements. Such statements are identified by words or phrases such as “believes,” “expects,” “anticipates,” “plans,” “trends,” “objectives,” “continues,” “projected,” as well as the negative forms of those words or similar expressions, or future or conditional verbs such as “will,” “would,” “should,” “could,” “might,” “may,” or similar expressions. Forward-looking statements involve known and unknown risks, uncertainties, assumptions, estimates and other important factors that could cause actual results to differ materially from any results, performance or events expressed or implied by such forward-looking statements. The factors included below under the caption “Summary Risk Factors” and described in further detail below under Item 1A Risk Factors of this report, among others, may cause actual results to differ materially from current expectations in the forward-looking statements, including those set forth in this report.

All forward-looking statements attributable to us or persons acting on our behalf are expressly qualified in their entirety by the cautionary statements set forth herein. Interested parties are urged to read in their entirety the referenced risk factors prior to making any investment decision with respect to the Company. Forward-looking statements speak only as of the date they are made and we do not undertake or assume any obligation to update publicly any of these statements to reflect actual results, new information, or future events, changes in assumptions or changes in other factors affecting forward-looking statements, except to the extent required by applicable laws. If we update one or more forward-looking statements, no inference should be drawn that we will make additional updates with respect to those or other forward-looking statements.

Summary Risk Factors

An investment in shares of our common stock involves a high degree of risk. If any of the factors enumerated below and described in more detail in the section entitled "Risk Factors" under Item 1A of this report occurs, our business, financial condition, liquidity, and results of operations could be materially and adversely affected. In that case, the market price for our common stock could decline, and you may lose some or all of your investment. Some of the most material risks relating to an investment in our common stock include the impact or effect on our Company and its operating results, or its investors, of:

Regulatory and Compliance Risks, including:

•new or changes in existing governmental regulations or in the way such regulations are interpreted or enforced;

•negative developments in the banking industry and increased regulatory scrutiny;

•tax legislative initiatives or assessments;

•more stringent capital requirements, to the extent they may become applicable to us;

•changes in accounting standards;

•any failure to comply with applicable laws and regulations, including, but not limited to, the Community Reinvestment Act ("CRA") and fair lending laws, the USA PATRIOT ACT, OFAC guidelines and requirements, the BSA, and the related FinCEN and FFIEC Guidelines and regulations (as each of such terms and acronyms is defined below); and

•federal deposit insurance assessment rate increases;

Credit Risks, including:

•lending risks and risks associated with loan portfolio concentrations;

•a decline in economic conditions that could reduce demand for our products and services and negatively impact the credit quality of loans;

•credit losses on loans exceeding estimates;

•potential effects on the U.S. economy resulting from the implementation of governmental policies, including tax regulations and changes to United States trade policies, including the imposition of tariffs and retaliatory tariffs and geopolitical uncertainty; and

•the soundness of other financial institutions;

1

Table of Contents

Liquidity Risks, including:

•the ability to meet cash flow needs and availability of financing sources for working capital and other needs;

•a loss of deposits or a change in product mix that increases the Company’s funding costs; and

•inability to access funding or to monetize liquid assets;

Market Risks, including:

•changes in interest rates; and

•interest rate effect on the value of our investment securities;

Operational Risks, including:

•cybersecurity risks, including business disruptions from denial-of-service attacks, network intrusions, business e-mail compromise, and other malicious behavior that could result in the disclosure of confidential information;

•privacy, information security, and data protection laws, rules, and regulations that affect or limit how we collect and use personal information or otherwise have an adverse effect on us;

•the potential impairment of our goodwill and other intangible assets;

•our reliance on third parties that provide key components of our business infrastructure;

•events that may tarnish our reputation;

•mainstream and social media contagion;

•the loss of the services of key members of our management team and directors;

•our ability to attract and retain qualified employees to operate our business;

•costs associated with repossessed properties, including potential environmental remediation;

•the effectiveness of our operational processes, policies and procedures, and internal control over financial reporting;

•our ability to implement technology-facilitated products and services or be successful in marketing these products and services to our clients; and

•the development and use of artificial intelligence ("AI");

Strategic Risks, including:

•risks related to acquisitions, mergers, strategic partnerships, divestitures, and other transactions;

•competition from new or existing financial institutions and non-banks;

•investing in technology; and

•incurrence of significant costs related to mergers and related integration activities;

Common Stock Risks, including:

•the volatility in the price and trading volume of our common stock;

•“anti-takeover” provisions in our certificate of incorporation and regulations, which may make it more difficult for a third party to acquire control of us even in circumstances that could be deemed beneficial to stockholders;

•changes in our dividend policy or our ability to pay dividends;

•the possibility that we may fail to realize the anticipated benefits of our stock repurchase program;

•our common stock not being an insured deposit;

•the potential dilutive effect of future equity issuances; and

•the subordination of our common stock to our existing and future indebtedness;

General Risk Factors, including:

•the effect of global conditions, earthquakes, volcanoes, tsunamis, floods, fires, drought, and other natural catastrophic events; and

•the impact of climate change and environmental sustainability matters.

The foregoing risk factors are not necessarily all of the factors that could cause our actual results, performance, or achievements to differ materially from expectations. Other unknown or unpredictable factors also could harm our results. Investors and other interested parties are encouraged to read the information included under the section captioned “Risk Factors” below in its entirety before making an investment decision about our securities.

2

Table of Contents

Item 1. Business

Our Company

We are a financial and bank holding company focused on community banking. Since our incorporation in Montana in 1971, we have grown both organically and through strategic acquisitions. As of February 20, 2026, we operated 290 banking offices, including branches and detached drive-up facilities, in communities across 12 states— Colorado, Idaho, Iowa, Minnesota, Missouri, Montana, Nebraska, North Dakota, Oregon, South Dakota, Washington, and Wyoming. Through our bank subsidiary, First Interstate Bank, we deliver a comprehensive range of banking products and services—including online and mobile banking—to individuals, businesses, government entities, and others throughout our market areas.

We are proud to provide financial services and products to clients that participate in a wide variety of industries, including:

•Agriculture •Healthcare •Professional services •Technology

•Construction •Hospitality •Real Estate Development •Tourism

•Education •Housing •Retail •Wholesale trade

•Governmental services

Our common stock is traded on the NASDAQ Global Select Market, or NASDAQ, under the symbol “FIBK.” Since our initial public offering, we have expanded our market reach through organic growth and strategic acquisitions, including our acquisitions of Mountain West Bank, United Bank, N.A., Flathead Bank of Bigfork, Bank of the Cascades, Inland Northwest Bank, Idaho Independent Bank, Community 1st Bank, and Great Western Bank. Our current strategy emphasizes disciplined organic growth by deepening and expanding full client relationships across deposits, lending and fee-based services. As of December 31, 2025, we had consolidated assets of $26.6 billion, deposits of $22.1 billion, loans held for investment of $15.2 billion, and total stockholders’ equity of $3.4 billion.

Our vision is to meet people where they are and help them reach where they want to be. Rooted in the principles of community banking, we build lasting relationships and make thoughtful decisions that serve our employees, clients, communities and shareholders.

Our long-term philosophy emphasizes providing high-quality financial products and services, delivering exceptional client service, influencing business leadership within our communities through professional and dedicated bankers, supporting our communities through financial contributions and socially responsible leadership, and cultivating a strong corporate culture.

Building on this foundation, we are executing a strategic plan intended to refocus capital investment, optimize our balance sheet and improve core profitability, while continuing to advance our business in a disciplined and prudent manner. This plan includes initiatives to enhance credit processes and risk culture, optimize our footprint and branch network, and emphasize disciplined, relationship-driven organic growth in our existing market areas. In furtherance of our strategic plan focused on organic growth and relationship banking, we are prioritizing investment into existing market areas where we have brand density and are well positioned to serve the needs of our customers. Accordingly, we are undertaking a comprehensive review of our branch network to optimize our physical footprint, including exiting markets that are not aligned with our strategic plan and reallocating capital, talent and resources to expand in markets where we have meaningful market share and attractive growth prospects. For example, in October 2025, we completed the divestiture of our banking operations in Arizona and Kansas and also announced the contemplated sale of 11 branches in Nebraska, which transaction is expected to close at the beginning of the second quarter of 2026. We opened one branch in Montana on February 2, 2026 and intend to close four branches in eastern Nebraska, one in Minnesota, and one in North Dakota at the end of February 2026.

We have further aligned select products and activities with our strategic plan, emphasizing relationship-based business and disciplined underwriting consistent with long-term performance. In 2025, we took deliberate actions to reduce or exit selected exposures, including the intentional runoff of certain non-relationship and transactional credits and the discontinuation or outsourcing of lending products. For example, we exited our indirect lending origination business in early 2025 and outsourced our consumer credit card portfolio in mid-2025, as further described in Part II, Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations.”

In addition, during the fourth quarter of 2025, we initiated a transformation of our banking organization, changing from a layered, regional and market structure to a flatter model. The redesign includes new State Presidents at the Bank, a majority of whom are from within the Bank, supplemented by select external hires, and a more streamlined chain of responsibility designed to speed up local decision-making and align the decision framework with our relationship-driven organic growth strategy. We expect this redesign to be nearly complete in the first quarter of 2026.

3

Table of Contents

Community Banking

We have one operating segment—community banking. The Company’s chief operating decision maker is its Chief Executive Officer who is charged with management of the Company and is responsible for the evaluation of operating performance and decision making about the allocation of resources to the operating segment. Community banking encompasses commercial, governmental, and consumer banking services provided through our Bank, which primarily include the acceptance of deposits, the extension of credit, mortgage loan origination and servicing, and wealth management, which includes trust, employee benefit, investment management, insurance, agency, and custodial services to individuals, businesses, and nonprofit organizations. Our philosophy emphasizes a local focus through a personalized service approach while also strengthening the communities in our market areas through community involvement, service activities, and philanthropy. We grant our banking offices significant authority in delivering products in response to local market considerations and client needs. This autonomy enables our banking offices to remain competitive by quickly responding to local market conditions and enhancing relationships with our clients in those markets. While our banking offices enjoy a level of flexibility, they remain accountable to company-wide standards and established limits on their authority and discretion. This combination of authority and accountability allows our banking offices to provide personalized service and localized community support while at the same time remaining focused on our overall financial vitality.

Lending Activities

We offer real estate, consumer, commercial, agricultural, and other loans to individuals, government entities, and businesses in our market areas. We have comprehensive credit policies that establish company-wide underwriting and documentation standards to manage the lending process and limit our risk. Each loan must meet minimum underwriting standards specified in our credit policies and procedures, with certain exceptions to those policies, which generally specify that loans:

(1)are made to borrowers who are generally located within or adjacent to our market footprint or own businesses and/or real estate within or adjacent to our footprint, with limited exceptions that may include participation loans and loans to national accounts;

(2)are made only for identified legal purposes;

(3)have specifically identified sources of repayment;

(4)mature within designated maximum maturity periods that coincide with repayment sources;

(5)are appropriately collateralized whenever possible;

(6)are supported by current credit information;

(7)do not exceed the Bank’s legal lending limit;

(8)include medium-term fixed interest rates or variable rates that are adjusted within designated time frames; and

(9)require compliance with laws and regulations including a flood zone and risk determination prior to closing.

In addition, our credit policies include lending limitations to minimize undue (or excessive) concentrations of credit in agricultural, commercial, real estate, or consumer loans. Furthermore, the criteria meeting our underwriting standards must be documented, with exceptions noted, as a part of the loan approval process.

While each loan must meet minimum underwriting standards, qualified bankers are granted levels of credit authority for approving and pricing loans to assure that banking offices are responsive to competitive issues and community needs in each market area. Credit authorization is established by individual role and assigned based on the credit experience, credit acumen and performance of each banker. Credit authorization is granted under the direction of our Chief Credit Officer and is reviewed on an ongoing basis. Loan requests over the authority of our bankers are approved by designated Credit Officers and, if necessary, by our new credit committee as further discussed below.

In 2025, we completed a comprehensive internal review and assessment of our credit risk management framework and credit policies that was initiated in late 2024. Among other things, we implemented a new credit review and approval process under which new and renewed loans and commitments above defined exposure thresholds are reviewed by a centralized credit committee comprised of senior credit and executive leadership. This committee-based process is designed to promote consistent application of our credit policies and enhance our risk culture for higher-exposure relationships, while still maintaining efficient approval procedures to ensure timely speed to market.

In addition, during 2025 we conducted a comprehensive review of our largest loan exposures, including detailed borrower-level assessments of these relationships. As part of this review, we enhanced our ongoing monitoring and action plans for higher-exposure relationships, including certain larger criticized credits, and pursued targeted paydowns and payoffs where appropriate. We believe these proactive steps, together with our disciplined underwriting standards on new production, position us well to continue supporting stable asset quality over time and in various economic scenarios.

4

Table of Contents

Deposit Products

We offer traditional depository products including checking, savings, and time deposits. Deposits at the Bank are insured by the Federal Deposit Insurance Corporation, or the FDIC, up to statutory limits. We also offer repurchase agreements primarily to commercial and municipal depositors. Under repurchase agreements, we sell investment securities held by the Bank to our clients under an agreement to repurchase the investment securities at a specified time or on demand. All outstanding repurchase agreements are due in one business day. Additionally, the Company is a member of the IntraFi Network, which enables us to offer our customers insurance coverage on interest-bearing demand, money market and certificate of deposit balances in excess of the FDIC insurance coverage limits.

Wealth Management

We provide a wide range of trust, employee benefit, investment management, insurance, agency, and custodial services to individuals, businesses, and nonprofit organizations. These services include the administration of estates and personal trusts, management of investment accounts for individuals, employee benefit plans and charitable foundations, and insurance planning.

Centralized Services

We have centralized certain operational activities to provide consistent service levels to our clients across the Bank, which helps us gain efficiency in management of those activities as well as ensure regulatory compliance. Centralized operational activities generally support our banking offices in the delivery of products and services to clients and include:

•marketing;

•credit review;

•loan servicing;

•credit card servicing;

•mortgage loan sales and servicing;

•loan collections; and

•other operational activities.

To reduce operating costs and capitalize on the technical capabilities of selected vendors, we also leverage third-party service providers to selectively outsource certain bank operations and services, such as certain data processing, loan servicing, credit card issuance, and deposit processing systems.

Additionally, specialized staff support services have been centralized to enable our branches to more efficiently serve their markets. These services include:

•credit risk management;

•finance;

•human resource management;

•internal audit;

•facilities management;

•technology;

•risk management;

•legal;

•compliance; and

•other support services.

5

Table of Contents

Market Area

The following table reflects our deposit market share and branch locations by state:

(1) Source: FDIC.gov-data as of June 30, 2025.

(2)As of December 31, 2025.

(3) The branches in Fargo, North Dakota and Marshall, Minnesota are expected to close at the end of February 2026.

(4) One branch in Billings, Montana opened in February 2026.

(5)Four Nebraska branches are expected to close at the end of February 2026. Eleven Nebraska branches are under agreement to be sold to Security First Bank, which transaction is currently anticipated to close at the beginning of the second quarter of 2026. The Company will have 29 branches remaining in Nebraska after completion of the pending sale and closures.

We operate in markets with a diverse employment base covering numerous industries and we believe our community bank approach to providing client service is a competitive advantage that strengthens the Company’s ability to effectively provide financial products and services to businesses and individuals in its markets.

Competition

There is significant competition among commercial banks in our market areas. We also compete with other providers of financial services that actively engage in providing various types of loans and other financial services to their clients, such as:

•savings and loan associations;

•credit unions;

•financial technology companies;

•internet banks;

•consumer finance companies;

•brokerage firms;

•mortgage banking companies;

•insurance companies;

•securities firms;

•mutual funds;

•government agencies; and

•major retailers.

To remain competitive in this congested industry, we continue to develop our omni-channel experience across our website, social media, and email, in addition to our offline channels, such as brick and mortar banking offices. Some of our competitors have greater resources and, as such, may have higher lending limits and may offer other services that we do not provide. We generally compete on the basis of service and responsiveness to client needs, available loan and deposit products, rates of interest charged on loans, rates of interest paid for deposits, and the availability and pricing of services such as trust, employee benefit, investment, and insurance services.

6

Table of Contents

Government Regulation and Supervision

We are subject to extensive government regulation and supervision under federal and state laws. Summaries of the material laws and regulations that are applicable to us are provided below. The descriptions that follow are not intended to summarize all laws and regulations applicable to us. Furthermore, the descriptions that follow do not purport to be complete and are qualified in their entirety by reference to the full provisions of those laws and regulations. In addition to laws and regulations, state and federal banking regulatory agencies may issue policy statements, interpretive letters, and similar written guidance that may impose additional regulatory obligations or otherwise affect the conduct of our business. Additionally, proposals to change laws and regulations are frequently introduced at both the federal and state levels. The likelihood and timing of any such changes and their impact on the Company cannot be determined with certainty.

Regulatory Authorities

As a public company with our securities listed for trading on the NASDAQ, we are subject to the disclosure and regulatory requirements of the Securities and Exchange Commission, or SEC, including under the Securities Act, the Exchange Act, and the rules and listing standards of the NASDAQ.

As a financial and bank holding company, we are subject to regulation under the Bank Holding Company Act of 1956, as amended, and to supervision, regulation, and regular examination by the Board of Governors of the Federal Reserve System (the “Federal Reserve”).

The Bank is subject to supervision and regular examination by its primary banking regulators, the Federal Reserve and the Montana Department of Administration, Division of Banking and Financial Institutions (the “Montana Division”). The Bank is also subject to supervision and examination by the Consumer Financial Protection Bureau (“CFPB”).

The Bank’s deposits are insured by the Deposit Insurance Fund (“DIF”) administered by the FDIC in the manner and to the extent provided by law. As such, the Bank is subject to the Federal Deposit Insurance Act (the “FDIA”) and FDIC regulations relating to deposit insurance and may also be subject to supervision and examination by the FDIC.

We are currently subject to the regulatory capital framework and guidelines reached by Basel III as adopted by the Federal Reserve. The Federal Reserve has risk-based capital adequacy guidelines intended to measure capital adequacy with regard to a banking organization’s balance sheet, including off-balance sheet exposures such as unused portions of loan commitments, letters of credit, and recourse arrangements.

The extensive regulation of the Bank limits both the activities in which the Bank may engage and the conduct of its permitted activities. Further, the laws and regulations impose reporting and information collection obligations on the Bank. The Bank incurs significant costs relating to compliance with various laws and regulations and the collection and retention of information. As the regulatory framework for bank holding companies and banks continues to evolve and become more complex, the cost of complying with regulatory requirements continues to increase.

Financial and Bank Holding Company

First Interstate is a bank holding company and has registered as a financial holding company under regulations issued by the Federal Reserve. As a financial holding company, we may engage in business activities that are determined by the Federal Reserve to be financial in nature or incidental to financial activities as well as all activities authorized generally to bank holding companies. We may continue to engage in authorized financial activities provided that we remain a financial holding company and are “well-capitalized” and “well-managed.” We do not currently engage in significant financial holding company business or activities not otherwise permitted generally for bank holding companies.

Under federal law, First Interstate is required to serve as a source of financial and managerial strength to the Bank, which may include providing financial assistance to the Bank if the Bank experiences financial distress. Under existing Federal Reserve source of strength policies, the Federal Reserve may require a bank holding company to make capital injections into a troubled subsidiary bank. The Federal Reserve may also determine that the bank holding company is engaging in unsafe and unsound practices if it fails to commit resources to a subsidiary bank.

We are required by the Bank Holding Company Act to obtain Federal Reserve approval prior to acquiring, directly or indirectly, ownership or control of voting shares of any bank, if, after such acquisition, we would own or control more than 5% of its voting stock. The Federal Reserve considers a number of factors in evaluating acquisitions, including the financial and managerial resources and future prospects of the parties, the convenience and needs of the communities served, and competitive factors. Under the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”), when considering an application, the Federal Reserve is also required to evaluate whether the transaction would result in more concentrated risks to the United States banking or financial system. Under federal law and regulations, a bank holding company may acquire banks in states other than its home state if, among other things, the bank holding company is both “well-capitalized” and “well-managed” both before and after the acquisition.

7

Table of Contents

Banks may also merge across state lines. With additional changes made to federal statutes under the Dodd-Frank Act, banks are also permitted to establish new interstate branches if a bank located in the target state could establish a new branch at the proposed location without regard to state laws limiting interstate de novo branching. A state can prohibit interstate mergers entirely or prohibit them if the continuing bank would control insured bank deposits in excess of a specified percentage of total insured bank deposits in the state. Under Montana law, a bank cannot acquire control of a bank located in Montana if, after the acquisition, the acquiring institution would control, in the aggregate, more than 30% of the total deposits of insured depository institutions located in Montana. As of June 30, 2025, based on publicly available information provided by the FDIC, we believe the Bank controlled approximately 16.6% of the total deposits of all insured depository institutions located in Montana. As such, the state limitation may limit our ability to directly or indirectly acquire additional banks located in Montana.

In order to assess the financial strength of the bank holding company, the Federal Reserve and the State of Montana may conduct periodic on-site and off-site inspections and credit reviews throughout the year. The federal banking agencies, including the Federal Reserve, may require additional information and reports from us. In addition, the Federal Reserve may examine, and require reports and information regarding, any entity that we control, including entities other than banks or entities engaged in financial activities. In certain circumstances, the Federal Reserve may require us to divest of non-bank entities or limit the activities of those entities even if the activities are otherwise permitted for bank holding companies under governing law.

Dividends and Restrictions on Transfers of Funds

Dividends from the Bank are the primary source of funds for the payment of our operating expenses and for the payment of dividends to our shareholders. Dividends are also limited by state and federal laws and regulations. We are also subject to various regulatory restrictions relating to capital distributions, including dividends, regulatory capital minimums, and the requirement to remain “well-capitalized” under the prompt corrective action regulations summarized below under the caption “Business – Government Regulation and Supervision – Capital Standards and Prompt Corrective Action.” In general, the Bank is limited to paying dividends that do not exceed the current year net profits together with retained earnings from the two preceding calendar years unless prior consent of the Federal Reserve is obtained. In addition, the Bank may not pay dividends in excess of the previous two years’ net earnings without providing notice to the Montana Division.

The capital buffer rules adopted by the federal banking regulators in accordance with the Basel Accords impose further limitations on the Bank’s ability to pay dividends. In general, the Bank’s ability to pay dividends is limited under the capital buffer rules unless the Bank’s common equity conservation buffer exceeds the minimum required capital ratio by 2.5% of risk-weighted assets.

A state or federal banking regulator may also impose, by regulatory order or agreement of the Bank, specific dividend limitations or prohibitions. The Bank is not, however, currently subject to a specific regulatory dividend limitation.

The Federal Reserve has issued a policy statement regarding the payment of dividends and the repurchase of common stock by bank holding companies. In general, the policy provides that dividends should be paid only out of current earnings and only if the prospective rate of earnings retention by the holding company appears consistent with the organization’s capital needs, asset quality, and overall financial condition. Regulatory guidance provides for prior regulatory consultation with respect to capital distributions in certain circumstances such as where the company’s net income for the past four quarters (net of previous capital distributions) is insufficient to fully fund the dividend or the company’s overall rate of earnings retention is inconsistent with the company’s capital needs and overall financial condition. The ability of a holding company to pay dividends may be restricted if a subsidiary bank becomes under-capitalized. The policy statement also states that a holding company should inform the Federal Reserve supervisory staff prior to redeeming or repurchasing common stock or perpetual preferred stock if the holding company is experiencing financial weaknesses or if the repurchase or redemption would result in a net reduction, as of the end of a quarter, in the amount of such equity instruments outstanding compared with the beginning of the quarter in which the redemption or repurchase occurred. These regulatory policies may affect our ability to pay dividends, repurchase shares of common stock, or otherwise engage in capital distributions. The Bank remains compliant with these policies and requirements.

Capital Standards and Prompt Corrective Action

Banks and bank holding companies are subject to various regulatory capital requirements administered by state and federal banking agencies, which involve quantitative measures of assets, liabilities, and certain off-balance sheet items calculated under regulatory accounting practices. Capital amounts and classifications are also subject to qualitative judgments by regulators about components, risk weighting, and other factors. The capital requirements are intended to ensure that banking organizations have adequate capital given the risk levels of assets and off-balance sheet financial instruments and are applied separately to the Bank and its parent holding company.

8

Table of Contents

Federal regulations require FDIC-insured depository institutions and bank holding companies to meet several minimum capital standards:

•a common equity Tier 1 capital to risk-based assets ratio of 4.5%;

•a Tier 1 capital to risk-based assets ratio of 6.0%;

•a total capital to risk-based assets ratio of 8.0%; and

•a 4.0% Tier 1 capital to total assets leverage ratio.

The existing capital requirements were effective January 1, 2015, and are based on recommendations of the Basel Committee on Banking Supervision and requirements of the Dodd-Frank Act.

For purposes of the regulatory capital requirements, common equity Tier 1 capital is generally defined as common stockholders’ equity and retained earnings and is reduced by substantially all of the regulatory deductions including items such as goodwill and other intangibles and certain deferred tax assets. Tier 1 capital is generally defined as common equity Tier 1 capital and additional Tier 1 capital. Additional Tier 1 capital includes certain noncumulative perpetual preferred stock and related surplus and minority interests in equity accounts of consolidated subsidiaries. Total capital includes Tier 1 capital (common equity Tier 1 capital plus additional Tier 1 capital) and Tier 2 capital. Tier 2 capital is composed of capital instruments and related surplus, meeting specified requirements, and may include cumulative preferred stock and long-term perpetual preferred stock, mandatory convertible securities, intermediate preferred stock, and subordinated debt. Also included in Tier 2 capital is the allowance for credit losses limited to a maximum of 1.25% of risk-weighted assets and, for institutions like us that have exercised an opt-out election regarding the treatment of Accumulated Other Comprehensive Income (“AOCI”), up to 45.0% of net unrealized gains on available-for-sale equity securities with readily determinable fair market values. Institutions that have not exercised the AOCI opt-out have AOCI incorporated into common equity Tier 1 capital (including unrealized gains and losses on available-for-sale-securities). Calculation of all types of regulatory capital is subject to deductions and adjustments specified in the regulations.

In determining the amount of risk-weighted assets for purposes of calculating risk-based capital ratios, all assets, including certain off-balance sheet assets (for example, recourse obligations, direct credit substitutes, residual interests), are multiplied by a risk weight factor assigned by the regulations based on the risks believed inherent in the type of asset.

Higher levels of capital are required for asset categories believed to present greater risk. For example, a risk weight of 0% is assigned to cash and United States government securities, a risk weight of 50% generally is assigned to prudently underwritten first lien one- to four-family residential mortgages, a risk weight of 100% is assigned to commercial and consumer loans, a risk weight of 150% is assigned to certain past due loans, and a risk weight of between 0% to 600% is assigned to permissible equity interests, depending on certain specified factors.

In addition to establishing the minimum regulatory capital requirements, the regulations limit capital distributions and certain discretionary bonus payments to management if the institution does not hold a “capital conservation buffer” consisting of 2.5% of common equity Tier 1 capital to risk-weighted assets above the amount necessary to meet its minimum risk-based capital requirements. In assessing an institution’s capital adequacy, the Federal Reserve takes into consideration not only these numeric factors, but qualitative factors as well and has the authority to establish higher capital requirements in individual cases where deemed necessary. The Federal Reserve has not established individual capital requirements applicable to us.

Federal law requires the federal banking agencies to take “prompt corrective action” in respect of depository institutions that do not meet minimum capital requirements. The law sets forth the following five capital tiers:

•“well capitalized;”

•“adequately capitalized;”

•“under-capitalized;”

•“significantly under-capitalized;” and

•“critically under-capitalized.”

A depository institution’s capital tier will depend upon how its capital levels compare with various relevant capital measures and certain other factors, as established by regulation. The relevant capital measures are the common equity tier 1 capital ratio, total capital ratio, the tier 1 capital ratio, and the leverage ratio.

A depository institution is generally prohibited from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the depository institution would thereafter be under-capitalized. Under-capitalized institutions may be subject to growth limitations and other restrictions and are required to submit a capital restoration plan. If a depository institution fails to submit an acceptable plan, it is treated as if it is “significantly under-capitalized.”

9

Table of Contents

“Significantly under-capitalized” depository institutions are subject to additional requirements and restrictions, such as orders to sell sufficient stock to become “adequately capitalized,” to reduce total assets, restrict interest rates paid, remove management and directors, and cease receipt of deposits from correspondent banks. “Critically under-capitalized” institutions are subject to the appointment of a receiver or conservator.

The capital stock of banks organized under Montana law, such as the Bank, may be subject to assessment upon the direction of the Montana Department of Administration under the Montana Bank Act. Under the Montana Bank Act, if the Department of Administration determines an impairment of a bank’s capital exists, it may notify the Bank’s Board of the impairment and require payment of an assessment on the bank stock. If the bank fails to do so, the Department of Administration may, among other things, take charge of the bank and proceed to liquidate the bank.

Restrictions on Transactions with Affiliates, Directors, and Officers

Under the Federal Reserve Act, the Bank may not lend funds or otherwise extend credit to its parent holding company or any other affiliate, except on specified types and amounts of collateral generally upon market terms and conditions. The Federal Reserve also has authority to define and limit the transactions between banks and their affiliates. The Federal Reserve’s Regulation W and relevant federal statutes and regulations, among other authorities, impose significant limitations on transactions in which the Bank may engage with us or with other affiliates, including per-affiliate and aggregate limits on affiliate transactions.

Federal Reserve Regulation O restricts loans to the Bank’s and its parent holding company’s insiders, which includes directors, certain officers, and principal shareholders and their respective related interests. All extensions of credit to the insiders and their related interests must be on the same terms as, and subject to the same loan underwriting requirements as, loans to persons who are not insiders. In addition, Regulation O imposes lending limits on loans to insiders and their related interests and imposes, in certain circumstances, requirements for prior approval of the loans by the Bank Board.

Safety and Soundness Standards and Other Supervisory and Enforcement Mechanisms

The federal banking agencies have adopted guidelines establishing standards for safety and soundness, asset quality and earnings, loan documentation, credit underwriting, interest rate risk exposure, internal controls, and audit systems. These standards are designed to identify potential concerns and ensure action is taken to address those concerns before they pose a risk to the DIF. If a federal banking agency determines that an institution fails to meet any of these standards, the agency may require the institution to submit an acceptable plan to achieve compliance with the standard. If the institution fails to submit an acceptable plan within the time allowed by the agency or fails in any material respect to implement an accepted plan, the agency must, by order, require the institution to correct the deficiency and may take other supervisory action.

Pursuant to the Dodd-Frank Act, federal banking regulators impose additional supervisory measures on banking organizations such as us when they exceed $10 billion in assets. These include enhanced risk management and corporate governance processes specified by the regulators.

The Federal Reserve has authority to bring an enforcement action against a bank or bank holding company and all “institution-affiliated parties” of a bank or bank holding company, including directors, officers, stockholders, and under certain circumstances, attorneys, appraisers, and accountants for the bank or holding company. Formal enforcement actions may include measures such as the issuance of a capital directive or cease and desist order for the removal of officers and/or directors or the appointment of a receiver or conservator. Civil money penalties cover a wide range of violations and actions, and can range up to $5,000 per day, unless a finding of knowing or reckless disregard is made, in which case penalties may be as high as $1 million per day. The FDIC also has the authority to terminate deposit insurance or recommend to the Federal Reserve that enforcement action be taken with respect to a particular bank. If such action is not taken, the FDIC has authority to take the action under specified circumstances. Montana law also provides the Montana Division with various enforcement mechanisms and, ultimately, authority to appoint a receiver or conservator for a Montana bank.

Deposit Insurance

The FDIC insures our client deposits through the DIF up to $250,000 per depositor. The amount of FDIC assessments paid by each DIF member institution is based on financial measures and supervisory ratings derived from a statistical model estimating the probability of failure within a three-year period, with banks deemed more risky paying higher assessments.

The FDIC was required by the Dodd-Frank Act to take actions necessary to cause the DIF to reach a reserve ratio of 1.35% of total estimated insured deposits by September 30, 2020. As of September 30, 2020, the FDIC had announced that the ratio was 1.30% due largely to consequences of the COVID-19 pandemic. The FDIC adopted a plan to restore the fund to the 1.35% ratio within eight years, but did not change its assessment schedule. On October 18, 2022, the FDIC finalized a rule that would increase initial base deposit insurance assessment rates by two basis points, beginning with the first quarterly assessment period of 2023 and in 2024 and 2025 the FDIC Board maintained the designated reserve ratio for the DIF at two basis points for 2025 and 2026, respectively.

10

Table of Contents

In addition, to recover costs associated with protecting uninsured depositors during the bank failures in the first half of 2023, in November 2023, the FDIC implemented a 13.4 basis point annual special assessment on uninsured deposits above $5 billion, to be collected during eight consecutive quarters beginning with the first quarter of 2024. The Company accrued $10.5 million in the fourth quarter of 2023 and an additional $1.5 million in the first quarter of 2024 for the special assessment. The special assessment is in addition to the assessment rates finalized as part of FDIC’s Amended Restoration Plan. In an update provided on December 16, 2025, the FDIC staff projects that the reserve ratio is on track to exceed the initial estimate ahead of the statutory deadline of September 30, 2028 and reduced the special assessment rate for the eighth collection quarter from 3.36 basis points to 2.97 basis points. This is intended to allow the FDIC to recover approximately the full amount of estimated losses as of September 30, 2025, while minimizing any amounts collected in excess of the estimated losses.

All FDIC-insured institutions are also required to pay assessments to the FDIC to fund interest payments on bonds issued by the Financing Corporation, or the FICO, an agency of the Federal government established to recapitalize the predecessor to the DIF. The assessment rate is applied to total average assets less tangible equity, as defined under the Dodd-Frank Act. The assessment rate schedule can change from time-to-time at the discretion of the FDIC, subject to certain limits. Under the current system, premiums are assessed quarterly.

Interchange Fees

Under the Durbin Amendment to the Dodd-Frank Act, also known as Regulation II, the Federal Reserve adopted rules establishing standards for assessing whether the interchange fees that may be charged with respect to certain electronic debit transactions are “reasonable and proportional” to the costs incurred by issuers for processing such transactions, which alters the competitive structure of the debit card payment processing industry and caps debit card interchange fees for banks with over $10 billion in assets. Interchange fees are charges that merchants pay to us and other card-issuing banks for processing electronic payment transactions. The Federal Reserve also has rules governing routing and exclusivity that require issuers to offer two unaffiliated networks for routing transactions on each debit or prepaid product.

On October 3, 2022, the Federal Reserve finalized a rule that amends Regulation II to specify, among other things, that debit card issuers should enable all debit card transactions, including card-not-present transactions such as online payments, to be processed on at least two unaffiliated payment card networks. The final rule became effective July 1, 2023. In October 2023, the Federal Reserve proposed revising Regulation II to lower the cap from its current rate of 21 cents and 0.05% of the transaction, plus a one-cent fraud-prevention adjustment, to 14.4 cents and 0.04% per transaction and a 1.3 cents fraud-prevention adjustment, which originally was to take effect on June 30, 2025. Due to active litigation involving the rule, it is not clear whether the Federal Reserve will finalize the October 2023 proposed rulemaking, and how, if at all, the Federal Reserve will enforce the rule. We are subject to the interchange fee cap and having at least two unaffiliated payment card networks because our assets exceed $10 billion.

Client Privacy and Other Consumer Protections

Federal and State laws impose client privacy requirements on any company engaged in financial activities, including us. Under these requirements, a financial company is required to protect the security and confidentiality of clients’ nonpublic personal information. In addition, for clients who obtain a financial product such as a loan for personal, family, or household purposes, a financial holding company is required to disclose its privacy policy to the client at the time the relationship is established and annually thereafter. The financial company must also disclose its policies concerning the sharing of the client’s nonpublic personal information with affiliates and third parties. Finally, a financial company is prohibited from disclosing an account number or similar item to a third party for use in telemarketing, direct mail marketing, or marketing through electronic mail.

The Bank is subject to a variety of federal and state laws, regulations, and reporting obligations aimed at protecting consumers and Bank clients. Failure to comply with these laws and regulations may, among other things, impair the collection of loans made in violation of the laws and regulations, provide borrowers or other clients certain rights and remedies, or result in the imposition of penalties on the Bank. Certain of these laws and regulations are described below.

The Equal Credit Opportunity Act generally prohibits discrimination in credit transactions on, among other things, the basis of race, color, religion, national origin, sex, marital status, or age and, in certain circumstances, limits the Bank’s ability to require co-obligors or guarantors as a condition of the extension of credit to an individual.

The Real Estate Settlement Procedures Act (“RESPA”) requires certain disclosures be provided to borrowers in real estate loan closings or other real estate settlements. In addition, RESPA limits or prohibits certain settlement practices, fee sharing, “kickbacks,” and similar practices that are considered to be abusive.

The Truth in Lending Act (“TILA”) requires disclosures to borrowers and other parties in consumer loans, including, among other things, disclosures relating to interest rates and other finance charges, payments and payment schedules, and annual percentage rates.

11

Table of Contents

The Fair Housing Act regulates, among other things, lending practices in residential housing and prohibits discrimination in housing-related lending activities on the basis of race, color, religion, national origin, sex, handicap, disability, or familial status.

The Home Mortgage Disclosure Act requires certain lenders and other firms engaged in the home mortgage industry to collect and report information relating to applicants, borrowers, and home mortgage lending activities in which they engage in their market areas or communities. The information is used for, among other purposes, evaluation of discrimination or other impermissible acts in home mortgage lending.

The Home Ownership and Equity Protection Act regulates terms and disclosures of certain closed-end home mortgage loans that are not purchase money loans and includes loans classified as “high-cost loans.”

The Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactions Act, generally limits lenders and other financial firms in their collection, use, or dissemination of client credit information, gives clients some access to, and control over, their credit information, and requires financial firms to establish policies and procedures intended to deter identity theft and related frauds.

The Fair Debt Collection Practices Act regulates actions that may be taken in the collection of consumer debts and provides consumers with certain rights of access to information related to collection actions.

The Electronic Fund Transfer Act regulates fees and other terms on electronic funds transactions.

The Dodd-Frank Wall Street Reform and Consumer Protection Act prohibits, among other things, lending practices to consumers that are unfair, deceptive, or abusive.

The CFPB has promulgated numerous regulations relating to consumer financial services-related topics, such as mortgage origination disclosures, mortgage servicing practices, and others. In addition, the CFPB continues to issue and reconsider significant regulations affecting consumer financial products and data access (including rules implementing Sections 1033 and 1071 of the Dodd-Frank Act), and certain of these rulemakings and compliance timelines have been subject to litigation, stays, or extensions, which may create uncertainty regarding the scope and timing of our compliance obligations and could require additional operational, technology, and compliance investments.

The CRA generally requires the federal banking agencies to evaluate the record of a financial institution in meeting the credit needs of its local communities, including low- and moderate-income neighborhoods. In addition to substantial penalties and corrective measures that may be assessed for a violation of fair lending laws, the federal banking agencies may take compliance with such laws and the CRA into account when evaluating applications for transactions such as mergers and for new branches. Federal banking agencies issued a final rule in October 2023 intended to modernize the CRA implementing regulations; however, the rule has been subject to litigation and has not taken effect and the agencies have proposed to rescind and replace it, and accordingly the applicable CRA regulatory framework and implementation timeline remain uncertain, which could increase our compliance costs and could affect our CRA ratings and our ability to open branches, complete acquisitions, or undertake other strategic transactions. In July 2025, the federal banking agencies issued a proposal to rescind the 2023 CRA rulemaking in favor of returning to a standard largely similar to the rules that were in effect in 1995. To date, the agencies have not issued a final rulemaking to implement the July 2025 proposal.

In connection with its assessment of CRA performance, the appropriate bank regulatory agency assigns a rating of “outstanding,” “satisfactory,” “needs to improve,” or “substantial noncompliance.” The Bank received a “satisfactory” rating on its most recently published CRA examination. Although the Bank’s policies and procedures are designed to achieve compliance with all fair lending and CRA requirements, instances of non-compliance are occasionally identified through normal operational activities. Management endeavors to respond proactively to any instances of non-compliance and to implement and update appropriate procedures to prevent instances of non-compliance and other violations from occurring.

USA PATRIOT Act

The USA PATRIOT Act of 2001 amended the Bank Secrecy Act of 1970 and the Money Laundering Control Act of 1986 and adopted additional measures requiring insured depository institutions, broker-dealers, and certain other financial institutions to have policies, procedures, and controls to detect, prevent, and report money laundering and terrorist financing. The laws and related regulations also provide for information sharing, subject to conditions, between federal law enforcement agencies and financial institutions, as well as among financial institutions, for counter-terrorism purposes. Federal banking regulators are required, when reviewing bank holding company acquisition or merger applications, to take into account the effectiveness of the anti-money laundering activities of the applicants.

12

Table of Contents

Office of Foreign Asset Control

The United States Treasury Office of Foreign Asset Control enforces economic and trade sanctions imposed by the United States on foreign persons and governments. Among other authorities, the Office of Foreign Asset Control, or OFAC, may require United States financial institutions to block or “freeze” assets of identified foreign persons or governments which come within the control of the financial institution. Financial institutions are required to adopt procedures for identification of new and existing deposit accounts and other relationships with persons or governments identified by OFAC and to timely report the accounts or relationships to OFAC.

Incentive Compensation

In May 2016, the Federal Reserve Board, other federal banking agencies, and the SEC jointly published a re-proposed rule-making designed to implement provisions of the Dodd-Frank Act prohibiting incentive compensation arrangements that would encourage inappropriate risk taking at a covered institution, which includes a bank or bank holding company with $1 billion or more of assets, such as us. The proposed rule (i) prohibits incentive-based compensation arrangements that encourage executive officers, employees, directors, or principal shareholders to expose the institution to inappropriate risks by providing excessive compensation (based on the standards for excessive compensation adopted pursuant to the FDIA) and (ii) prohibits incentive-based compensation arrangements for executive officers, employees, directors or principal shareholders that could lead to a material financial loss for the institution. The proposed rule requires covered institutions to establish policies and procedures for monitoring and evaluating their compensation practices. The comment period ended in July 2016 and a notice of proposed rulemaking was released in May 2024. Although final rules had not been adopted as of December 31, 2025, if these or other regulations are adopted in a form similar to the proposed rule-making, they could impose limitations on the manner in which we may structure compensation for our executives.

Cybersecurity

Federal regulators have issued two related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish lines of defense and ensure their risk management processes also address the risk posed by compromised client credentials, including security measures to reliably authenticate clients accessing internet-based services of the financial institution. The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption, and maintenance of the institution’s operations after a cyber-attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.

For additional discussion on cybersecurity, see Part I, Item 1C, “Cybersecurity” included herein.

Recent Executive Orders

Banking regulation and supervisory priorities may shift in response to political developments, including executive actions and changes in regulatory leadership. In 2025, federal actions affecting the financial services industry included changes relating to the use of “reputational risk” in supervision and the application of disparate-impact liability in connection with certain federal civil rights and fair lending laws. For example, on August 7, 2025, the President issued an executive order titled “Guaranteeing Fair Banking for All Americans,” which directs federal banking regulators, to the extent permitted by law, to remove the use of reputational risk or similar concepts from guidance documents, manuals and other materials within 180 days of the order. In addition, on April 23, 2025, the President issued an executive order titled “Restoring Equality of Opportunity and Meritocracy,” which directs federal agencies to deprioritize enforcement of statutes and regulations to the extent they include disparate-impact liability and to review certain pending matters under federal civil rights laws, including the Equal Credit Opportunity Act and the Fair Housing Act. The Bank continues to monitor these and other regulatory developments and remains committed to providing fair and competitive banking products and services in compliance with applicable laws and regulations.

13

Table of Contents

Human Capital

Culture is critically important to the Company’s success; our people are our number one priority. We approach our culture with an aspirational lens. It is not a stand-alone initiative or program—it is integrated in our systems, and our processes. Our principles guide how we make decisions, treat each other, and serve our clients.

Workforce

As of December 31, 2025, we employed 3,376 employees, with none represented by a collective bargaining agreement. This represents a decrease of 105 employees from December 31, 2024. As of December 31, 2025, approximately 67.2% of our workforce was female, 32.6% was male, and 0.2% have not declared. The executive team is comprised of 37.5% female and 62.5% male, and the Company’s senior leadership team was 32.4% female and 67.6% male.

Commitment to Community / Volunteerism

We are “all-in” when it comes to giving back—with time, money, and heart. We have a vested interest in the strength of our communities and strive to make them better places to live and work. Each year, the Company creates commitment to community plans for all our markets, which includes donating a portion of our net income before tax for charitable purposes. These plans help align strategies for philanthropy, volunteering and leadership, financial education outreach, community development, and sustainability.

We encourage employees to take active leadership roles within their communities to further demonstrate our principles and help us respond to the needs of the markets we serve. In 2025, the Company provided employees an opportunity to participate in a Bank-sponsored service project annually, marking the second Wednesday in September as our Commitment to Community Volunteer Day. We closed all offices in the afternoon on Volunteer Day so employees could lend a hand in their community, either as teams or as individuals. We have also implemented a Volunteer Time benefit, which allows employees to utilize up to eight work hours each year to participate in volunteer activities of their choosing.

Employee Engagement

Our employee engagement strategy prioritizes creating a work environment where every employee feels heard and valued. We measure our success by how effectively we address workplace needs and empower local leaders to activate meaningful progress.

To deepen our understanding of organizational dynamics, we conduct an annual census survey each fall and administer strategic pulse surveys throughout the year. These insights drive innovative solutions tailored to our employees’ needs.

Leaders across the organization are held accountable for fostering engagement through active participation, sharing team results, and creating actionable engagement plans. The aggregated results serve as a key indicator of the overall health of our workforce and are shared with the Company’s board of directors (the “Board”).

Compensation and Benefits

We strive to provide competitive wages, benefits, and programs that meet the varying needs of our workforce. We continually review our programs to ensure we remain competitive and take care of our employees.

Our compensation philosophy is designed to attract, retain, and motivate talent through fair, competitive, and performance-driven pay. We benchmark roles against market data to ensure competitiveness, maintain a clear job architecture for internal equity and career progression, and reward performance through merit increase and incentive programs.

The approach we take in our benefit offerings is a holistic one to address our employees’ total well-being, which includes aspects of their health, physical, mental/emotional, social, and financial needs.

We offer the following compensation and benefit programs as part of our total rewards package:

•Competitive Total Compensation

•Base salary

•Short-term Incentive Plan (for eligible employees)

•Long-term Incentive Plan (for eligible employees)

•Referral incentive programs

•Comprehensive Benefit Programs

•Medical, dental, and vision plans

•401(k) plan with a 100% match on the first 6% contributed

•Paid time off

•Health savings accounts with employer contribution

14

Table of Contents

•Flexible spending accounts

•Company paid childcare assistance program

•Student debt employer repayment program

•Additional Benefits: short-term disability; long-term disability; employee assistance program; free or discounted banking products and services; wellness program; and flexible work arrangements

Growth and Development

As part of our commitment to fostering a dynamic and competitive workforce, we have invested significant time and resources to develop and empower our talent. We made meaningful progress in our development programs centered on emotional intelligence, and manager effectiveness. These initiatives were further enhanced by role-specific training programs and on-demand learning opportunities, ensuring our employees are equipped with the skills necessary to excel in their roles.

Better Together

At First Interstate Bank we recognize that fostering an inclusive workplace contributes to innovation, enhances decision-making, and improves client experiences. Our commitment to inclusion is reflected not only within our Company but also in the communities where we live and work. We take pride in creating a workplace that values the unique skills and experiences our employees bring. We are committed to advocating for the rights and respect of all and actively participate in achieving this by setting an example of this leadership in the communities we call home.

To help ensure our educational and connection opportunities align with the needs of our employees, we have an employee Council that is comprised of 18 individuals across the footprint from various departments and with a range of tenure with the Company (2-26 years). The Council meets quarterly with smaller working groups convening as necessary to drive optional education opportunities, employee engagement, and communications that fit within our overall business strategy.

Our Employee Engagement survey allows us to track year over year progress, through the Culture of Inclusion Index questions, giving us insight into areas of strengths and opportunities for improvement, helping us continuously refine our approach to inclusion and workplace culture.

In conjunction with our Learning & Development team, we created Better Together, a voluntary learning opportunity to ensure employees understand what belonging means at First Interstate, how it can enhance our work with colleagues and clients, and how an inclusive culture strengthens team performance. Better Together is now the foundational learning opportunity for incoming employees and creates a common understanding among new and more tenured employees. Launched in the third quarter of 2024, 78% of our workforce has engaged with Better Together as of December 31, 2025.

We continued our Collective Learning Series, a monthly educational and community-building webinar that brings together employees to share experiences, perspectives, and learn more about our team and the communities we serve. Now in its third year, this series has experienced remarkable growth, with attendance climbing significantly year after year. Mental health remains one of our most sought-after topics, and we proudly recognized Men’s Mental Health Month in June 2025. In August 2025, our CEO partnered with Community Banking and Contact Center leadership for a standout event focused on creating inclusive environments for clients. Additional sessions explored critical themes such as Substance Abuse Prevention Month, generational diversity in the workplace, and Eating Disorder Awareness — each contributing to meaningful conversations and engagement across our organization.

We believe we are better together and are committed to moving forward while making an impact and difference for all communities and employees. We look forward to another year of providing voluntary resources and engagement opportunities that we believe bring value to our employees, serve our mission of helping people get to where they want to be, and support the communities where we live and work.

Website Access to SEC Filings

The Company’s electronic filings with the SEC, including Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and Proxy Statements, as well as amendments to these reports and statements filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act, are made available at no cost through our website at www.FIBK.com by clicking through the “Financials” tab found there and selecting “SEC Filings,” as soon as reasonably practicable after the Company files such material with, or furnishes such materials to, the SEC. The Company’s SEC filings are also available through the SEC’s website at www.sec.gov. In addition, we routinely post important information for investors on our website at www.FIBK.com. We use this website as a means of disclosing material information in compliance with our disclosure obligations under Regulation FD. Accordingly, investors should monitor our website, in addition to following our press releases, SEC filings, public conference calls, presentations and webcasts. Our website and the information contained therein or connected thereto is not intended to be incorporated by reference into this report and should not be considered a part of this report, and the referenced websites are not intended to act as active hyperlinks.

15

Table of Contents

Item 1A. Risk Factors

Like other financial institutions and bank holding companies, the success of our business is subject to a number of risks and uncertainties, many of which are outside of our control. The material risks and uncertainties of which we are currently aware are set forth below under headings that are provided for convenience and intended to organize the risks and uncertainties into related categories to improve readability for investors; no inference should be drawn, however, that the placement of a risk factor under a particular category means it is not applicable to another category of risks or that it may be more or less material than another risk factor. Regardless, if any of the events or circumstances described below actually occur, our business, financial condition, and results of operations could be harmed. These risks are not the only ones we may face. Other risks of which we are not aware, including those which relate to the banking and financial services industry in general and us in particular, or those which we do not currently believe are material, may harm our future business, financial condition, results of operations, and prospects. You should consider carefully the following important factors in evaluating us and our business before you make an investment decision about our securities.

Regulatory and Compliance Risks

New governmental regulations and/or changes in existing governmental regulations, or in the way such regulations are interpreted or enforced, could have a material adverse effect on the Company.

The Company is extensively regulated under federal and state banking laws and regulations that are intended primarily for the protection of clients, the DIF, and the banking system. Both the scope of the laws and regulations and the intensity of the supervision to which our business is subject have increased in recent years in response, we believe, to various factors including the 2008 financial crisis and 2023 banking crisis as well as technological and market changes. Regulatory enforcement and fines have also increased across the banking and financial services sector. Many of these changes have occurred as a result of the Dodd-Frank Act and its implementing regulations. The Company expects its business will remain subject to extensive regulation and supervision.

Regulations, along with the currently existing tax, accounting, securities, insurance, employment, monetary, and other laws and regulations, rules, standards, policies, and interpretations control the methods by which we conduct business, implement strategic initiatives and tax compliance, and govern financial reporting and disclosures. In addition, the Company is subject to changes in federal and state laws as well as changes in banking and credit regulations and governmental economic and monetary policies. Congress may enact legislation from time-to-time that affects the regulation of the financial services industry, and state legislatures may enact legislation from time-to-time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the application of existing regulations. In recent years, the CFPB has increased its scrutiny of fee-based business models and various fees on consumer financial products and services, including depositor, overdraft and late fee charges. More recently, CFPB leadership has publicly indicated potential shifts in supervisory and enforcement priorities, including an increased focus on conciliation, correction, and remediation efforts with supervised entities to resolve problems, and a focus on addressing actual fraud against consumers, where there are identifiable victims with material and measurable consumer damages; however, such priorities may change over time.

The CFPB has also focused on consumer data access, including through its final rule implementing Section 1033 of the Dodd-Frank Wall Street Reform and Consumer Protection Act, commonly referred to as the “open banking” rule to empower consumers and authorized third parties to access account data controlled by financial institutions. Open banking rulemaking has long been expected to have a significant impact on both financial institutions and third parties. The scope, timing, and compliance obligations associated with the open banking rule are subject to ongoing litigation, and the rule may be revised or replaced through further rulemaking, which could create regulatory uncertainty and require us to make additional operational, technology, and compliance investments. In fact, the CFPB has issued an advanced notice of proposed rulemaking soliciting public comment to reconsider the implementation of Section 1033 of the open banking rule. This signals a further shift in regulatory expectations for consumer-authorized data sharing, and further clouds the degree of compliance burden on covered entities. Decreases in federal supervisory activities in selected areas may result in a corresponding increase in state supervisory and enforcement activities in those or other areas. The degree and scope of state regulation remains to be seen.

16

Table of Contents

In addition, in June 2024, the U.S. Supreme Court reversed its longstanding approach under the Chevron doctrine, which provided for judicial deference to regulatory agencies. As a result of this decision, we cannot be sure whether there will be increased challenges to existing regulations with which we are required to comply or how lower courts will apply the decision in the context of regulatory schemes applicable to us, leading to increased regulatory uncertainty and potential changes in the way laws or regulations applicable to us are interpreted or enforced. With the advent of efforts by the current administration to enhance regulatory efficiency, including deregulation and tailoring of regulatory proposals, reducing agency budgets, and the restructure of federal agencies, there could be a significant impact on rulemaking, supervision, examination and enforcement priorities of the federal banking agencies, including agencies like the CFPB. In addition, future changes in the presidential administration or in makeup of the Senate and the House of Representatives may lead to new or changed laws and regulations applicable to us, and there may also be significant changes to the fiscal and monetary policies of the federal government and its agencies, including the Federal Reserve. Changes in leadership at the Federal Reserve, in connection with the scheduled end of the current Chair’s term in May 2026 or otherwise, could also result in shifts in interest rate policy, the Federal Reserve’s balance sheet management, or supervisory priorities.

Recent executive actions and related changes in federal and state supervisory priorities could increase regulatory uncertainty and adversely affect our business. For example, in 2025, the President issued executive orders addressing, among other things, (i) regulatory approaches to customer access to financial services and the use of “reputational risk” or similar concepts in supervision and (ii) the use of disparate-impact liability in connection with certain federal civil rights and fair lending laws. The scope and implementation of these executive orders (including any related changes in agency guidance, examination procedures, enforcement priorities, or supervisory expectations) are uncertain and may change over time. In addition, federal and state regulators and attorneys general may take differing approaches to supervision and enforcement, and heightened or divergent state-level scrutiny or enforcement activity could increase our compliance costs and operational burden. These developments could require us to modify policies, procedures, controls, and documentation practices, and could subject us to increased investigations, supervisory findings, enforcement actions, civil money penalties, litigation, and reputational harm, any of which could materially and adversely affect our business, financial condition, and results of operations.

Any of these changes or new legislation could increase our future compliance and other operating expenses and could have a material adverse effect on our business, financial condition, and results of operations.

Negative developments in the banking industry could result in increased regulatory scrutiny.

Events like the 2023 bank failures and the related negative media that involve adverse developments affecting financial institutions, transactional counterparties or other companies in the banking industry, or the development of concerns or rumors about these or similar events, have in the past and may in the future lead to erosion of confidence in the banking system, deposit volatility, liquidity issues, stock price volatility, and other adverse developments.

These developments can have and resulted in modifications to or additional laws and regulations governing banks and bank holding companies. These may include, an increase in capital requirements, modifications to regulatory requirements with respect to liquidity risk management, increased supervision over deposit concentrations, enhanced capital adequacy requirements, more stress testing and contingency planning requirements, implementation of other safe and sound banking practices, or other enhanced supervisory or enforcement activities. Other legislative initiatives could detrimentally impact our operations in the future. Regulatory bodies may enact new laws or promulgate new regulations or view matters or interpret laws and regulations differently than they have in the past, or commence investigations or inquiries into our business practices. Increased regulatory scrutiny, whether by virtue of new regulations (if any) or during routine examinations, could increase our cost of doing business and reduce our profitability. Among other things, there may be increased focus by both regulators and investors on deposit composition, the level of uninsured deposits, collateralized deposits, brokered deposits, unrealized losses in securities portfolios, liquidity, commercial real estate composition and concentration, and capital and general oversight and control of the foregoing.

Tax legislative initiatives or assessments could adversely affect our results of operations and financial condition.

We are subject to income and other taxes in the United States and in the various state and local jurisdictions where we operate. The laws and regulations related to tax matters are extremely complex and subject to varying interpretations. Although management believes our positions are reasonable, we are subject to audit by the Internal Revenue Service in the United States and by state and local tax authorities in all the jurisdictions in which we conduct business operations. While we believe we comply with all applicable tax laws, rules, and regulations in the relevant jurisdictions, the tax authorities may determine that we owe additional taxes or apply existing laws and regulations differently, which could result in a significant increase in liabilities for taxes and interest in excess of accrued liabilities and harm our business and financial condition.

17

Table of Contents

New tax legislative initiatives, including changes in the corporate tax rate, may be enacted, negatively impacting our effective tax rate at the federal and state level, and potentially adversely affecting our tax positions or tax liabilities. For example, the U.S. has implemented a 15% minimum tax on corporations and a 1% excise tax on certain share buybacks. We have adopted and completed material share repurchase programs over the past several years as a means by which to return value to shareholders, and the new excise tax may have a material and negative impact on our willingness to engage in such programs in the future or may materially increase our costs associated with engaging in any such programs to the extent we determine to engage in them in the future. In addition, unilateral or multi-jurisdictional actions by various tax authorities, including an increase in tax audit activity, could have an adverse impact on our tax liabilities. In any event, significant uncertainties exist with respect to the amount of our tax liabilities, including those arising from potential and already implemented changes in tax laws. These and other tax related items could increase our future tax expense, could change our future intentions regarding the use of our earnings, and could have a material adverse effect on our business, financial condition and results of operations.

We may be subject to more stringent capital requirements in the future, the impact of which could have a material risk to our operations.

Federal and state banking regulators possess broad powers to take supervisory actions as they deem appropriate. These supervisory actions may result in higher capital requirements, higher deposit insurance assessment rates, and limitations on the Company’s activities that could have a material adverse effect on its business and profitability. For example, federal banking agencies implemented “Basel III” regulatory capital reforms, which became effective in 2015 and were fully phased in as of January 2019, that substantially amended the regulatory risk-based capital rules applicable to us, as further described in Part I, Item 1. “Business” included herein.

While the current risk-based guidelines applicable to us and the Bank are based on the Basel III framework, regulators may, from time to time, implement changes to the regulatory capital adequacy and liquidity requirements applicable to us. For example, in September 2022, the federal banking regulators announced their intent to revise U.S. regulatory capital requirements to align with Basel IV requirements, more recently referred to as the Basel III “Endgame,” and in July 2023 issued a notice of proposed rulemaking for comment that would substantially revise the regulatory capital framework for banking organizations with total assets of $100 billion or more and their depository institutions subsidiaries and banking organizations with significant trading activity. Public review and comment commenced with no final rule being issued. In numerous speeches by the Federal Reserve’s Vice Chair for Supervision, the regulator has signaled a more focused method to and re-evaluation of the capital rules, which may result in a more institution-specific approach. The impact of Basel IV will depend upon the way it is implemented in the U.S. with respect to institutions like First Interstate and FIB, but to the extent its implementation or other more stringent capital requirements become applicable to us and our operations, our results of operations and profitability could be materially and adversely affected.

Changes in accounting standards could materially negatively impact our financial statements.

From time-to-time, the Financial Accounting Standards Board (“FASB”) and the SEC change the financial accounting and reporting standards that govern the preparation of our financial statements. These changes can materially impact how we record and report our financial condition and results of operations.

Any failure to comply with laws and regulations, including the Community Reinvestment Act (CRA) and fair lending laws, could lead to material penalties.

We are subject to regulation and supervision by the FDIC and Federal Reserve. We must comply with the CRA, the Equal Credit Opportunity Act, the Fair Housing Act, and other fair lending laws and regulations, as well as all other applicable laws and regulations that impose non-discriminatory lending and other requirements on financial institutions. A failure to comply with these laws and regulations could result in a wide variety of sanctions, including the required payment of damages and civil money penalties, injunctive relief, imposition of restrictions on mergers and acquisitions activity, and restrictions on expansion. In addition to actions by the U.S. Department of Justice and other federal agencies, including the Federal Reserve and CFPB, who are responsible for enforcing these laws, our compliance with fair lending laws could be challenged in private class action litigation. The costs of defending any such challenge and any adverse outcome arising from such a challenge could damage our reputation or could have a material adverse effect on our business, financial condition, or results of operations. Even absent formal enforcement, the costs of remediating compliance deficiencies, maintaining ongoing compliance, and defending against potential regulatory actions could divert management resources, reduce earnings, and negatively impact stockholder returns.

18

Table of Contents

We are subject to the USA PATRIOT Act, OFAC guidelines and requirements, the Bank Secrecy Act (“BSA”), and related Financial Crimes Enforcement Network (“FinCEN”) and Federal Financial Institutions Examination Council (“FFIEC”) Guidelines and regulations and any failure to comply with them could result in material implications that could harm our business.

We are routinely examined by our regulators for compliance with the USA PATRIOT Act, OFAC guidelines and requirements, the BSA, and related FinCEN and FFIEC Guidelines. Failure to maintain and implement adequate programs and fully comply with relevant laws or regulations could have serious legal, financial, and reputational consequences for us, including causing applicable bank regulatory authorities not to approve merger or acquisition transactions when regulatory approval is required, or to prohibit such transactions even if approval is not required. Regulatory authorities have imposed cease and desist orders and significant civil money penalties against institutions found to be violating these regulations. If any of the foregoing were to come to pass, our business, financial condition, or results of operations could be materially and adversely affected.

Federal deposit insurance assessment rates could increase further in the future.

The FDIC insures deposits at FDIC-insured financial institutions, including the Bank. The FDIC charges insured financial institutions assessment rates to maintain the DIF at a specific level. Historically, unfavorable economic conditions increased bank failures and these additional bank failures decreased the DIF balance. As further described in Item 1. Business - Government Regulation and Supervision – Deposit Insurance, extraordinary growth in insured deposits during the COVID-19 pandemic caused the ratio of the DIF to total insured deposits to fall below the current statutory minimum of 1.35%. To restore the DIF to its statutorily mandated minimums, the FDIC significantly increased deposit insurance assessment rates, including the Bank's assessment rates, and imposed special assessments as discussed above, resulting in increased expenses to the Bank.

The FDIC may further increase the assessment rates or impose additional special assessments in the future to restore the DIF to these statutory target levels. Any increase in the Bank's FDIC assessment rates could have an adverse effect on its business, financial condition and results of operations. FDIC insurance assessment rates could increase in the future in response to similar declining economic conditions.

Credit Risks

We may be subject to lending risks and risks associated with loan portfolio concentrations, which could adversely affect the Company.

We take on credit risk by virtue of making loans and extending loan commitments and letters of credit. Our credit standards, procedures, and policies may not prevent us from incurring substantial credit losses.

Our loans held for investment portfolio are concentrated in commercial real estate and commercial business loans. As of December 31, 2025, we had $10.5 billion of commercial loans, including $8.1 billion of commercial real estate loans, representing approximately 69.1% of our loans held for investment portfolio.

Commercial loans may involve greater risks than our other types of lending. Because payments on such loans are often dependent on the successful operation or development of the property or business involved, repayment of such loans can be more sensitive to adverse conditions in the real estate market or the general economy. Commercial loans typically are made based on borrowers’ ability to make repayment from the cash flow of their commercial venture. If the cash flow from business operations is reduced because of adverse conditions, the borrower’s ability to repay the loan may be impaired. Commercial loans are, on average, larger loans as compared to other loans with less readily marketable collateral. Given these factors, losses incurred on commercial real estate and commercial loans could have a material adverse impact on our business, financial condition, and results of operations. For example, in the fourth quarter of 2025, we recognized a charge-off of approximately $15.8 million relating to a commercial real estate loan that had become impaired as a result of adverse developments impacting the borrower’s business.

In addition, many of our borrowers operate in industries that are directly or indirectly impacted by changes in commodity prices, such as agriculture and livestock businesses, as well as businesses indirectly impacted by commodities prices, such as businesses that transport commodities or manufacture equipment used in production of commodities. Changes in commodity products prices depend on local, regional, and global events or conditions that affect supply and demand for the relevant commodity. For example, in 2025 we experienced increased credit stress in certain of our grain credit relationships as lower commodity prices and elevated input costs pressured borrower cash flows. If such conditions persist or recur, we could experience higher criticized or nonperforming loans and increased credit losses in these portfolios.

19

Table of Contents

Deterioration in economic conditions or in the real estate market could result in increased delinquencies and foreclosures and could have an adverse effect on the collateral value for many of these loans and on the repayment ability of many of our borrowers. Deterioration in economic conditions or in the real estate market could also reduce the number of loans we make to businesses in the construction and real estate industry, which could negatively impact our interest income and results of operations. For example, in 2025, we experienced slower lease-up in our commercial real estate multi-family portfolio, which contributed to an increase in criticized assets in the middle of 2025 before improving later in the year. More recently, we have experienced weaker than anticipated loan production, including muted demand for certain commercial real estate and construction lending and softer new construction activity in several of our markets. If these conditions persist or we are unable to generate sufficient new loan production to offset ongoing runoff, amortization and payoffs, our loan balances may decline. If economic conditions or the real estate market deteriorate, or if any of the foregoing trends persist or worsen, we could experience higher levels of criticized and nonperforming assets, increased net charge-offs and provisions for credit losses, and reduced profitability, any of which could have a material adverse effect on our business, financial condition and results of operations. Similarly, the occurrence of a natural or man-made disaster in our market areas could impair the value of the collateral we hold for real estate secured loans. Any factor or combination of factors identified above could negatively impact our business, financial condition, and results of operations.

A decline in economic conditions could reduce demand for our products and services and negatively impact the credit quality of loans, which could have an adverse effect on our results of operations.

Our clients are located predominantly in Colorado, Idaho, Iowa, Missouri, Montana, Nebraska, Oregon, South Dakota, Washington, and Wyoming. Unlike larger banks that are more geographically diversified, our profitability largely depends on the general economic conditions in these areas. Deterioration in economic conditions could result in the following consequences, any of which could have a material adverse effect on our business, financial condition, liquidity, and results of operations:

•demand for our products and services may decline;

•loan delinquencies, problem assets, and foreclosures may increase;

•increases in the provisions for credit losses and loans and lease charge-offs;

•decrease in net interest income derived from lending activities;

•collateral for loans, especially real estate, may decline in value;

•future borrowing power of our clients may be reduced;

•the value of our securities portfolio may decline;

•the net worth and liquidity of loan guarantors may decline, impairing their ability to honor commitments to us; and

•increases in our operating expenses associated with attending to the effects of the above noted consequences.

Volatility and uncertainty related to inflation and the effects of inflation, which may lead to increased costs for businesses and consumers and potentially contribute to poor business and economic conditions generally, may enhance or contribute to some of the risks discussed herein. For example, higher inflation, or volatility and uncertainty related to inflation, could reduce demand for our products, adversely affect the creditworthiness of the Company’s borrowers, increase our operating costs, or result in lower values for our investment securities and other interest-earning assets. Following a period of elevated inflation during 2022 and 2023, the Federal Reserve has stated that its objective is to return the rate of inflation to 2% and actions taken to pursue that objective, including changes in monetary policy and interest rates, could further affect economic activity, borrowing demand and our funding costs. To the extent inflationary pressures persist, monetary policy actions do not mitigate inflation, or economic conditions otherwise worsen, we could experience adverse effects on our business, financial condition, and results of operations. For additional discussion of the risks related to Federal Reserve action related to changes in interest rates, see “Changes in interest rates may have an adverse effect on demand for our products and services and on our profitability” under “Market Risks” below.

Deflationary pressures, while possibly lowering some of our operating costs, could also weaken economic activity and have a significant negative effect on our borrowers, especially our business borrowers, and the values of underlying collateral securing loans, which could negatively affect our business, financial condition, and results of operations.

Additionally, a significant decline in general economic conditions caused by the economic slowdown in Europe and the United States, the impact of trade negotiations, escalating tensions with China, economic conditions in China, including the global economic impacts of the Chinese economy, China’s regulation of commerce, escalating military tensions in Europe as a result of Russia’s military action in Ukraine, escalating military tensions in South America or other impacts related to the United States’ actions related to Venezuela, heightened geopolitical uncertainty involving Greenland, and the conflict in Israel and the surrounding regions, the outbreak of other international or domestic hostilities or other unrest, a default by the United States or other governments in repaying financial obligations, a shutdown of all or part of the United States government or other governments, the effects of pandemics or other health crises, acts of terrorism, climate-related events such as prolonged drought, unemployment, or other economic and geopolitical factors beyond our control, could further impact these local economic conditions and negatively affect our business and results of operations.

20

Table of Contents

If we experience credit losses on loans in excess of estimated amounts, our earnings could be adversely affected.

The risk of credit losses on loans varies with, among other things, general economic conditions, the composition of our loan portfolio, the creditworthiness of the borrower over the term of the loan, and, in the case of a collateralized loan, the value and marketability of the collateral for the loan. We maintain an allowance for credit losses based upon, among other things, historical experience, delinquency trends, economic conditions, and regular reviews of loan portfolio quality. Based upon such factors, management makes various assumptions and judgments about the ultimate collectability of our loan portfolio and provides an allowance for credit losses. These assumptions and judgments are complex and difficult to determine given the significant uncertainty surrounding future conditions in the general economy and banking industry. If management’s assumptions and judgments prove to be incorrect and the allowance for credit losses is inadequate, or if banking authorities or regulations require us to increase the allowance for credit losses, our net income may be adversely affected. As a result, an increase in credit losses could have a material adverse effect on our earnings, financial condition, and results of operations.

United States trade policies and other factors beyond the Company’s control, including the imposition of tariffs and retaliatory tariffs, may adversely impact our business, financial condition, and results of operations.

The U.S. government recently announced changes to its trade policies including increasing tariffs on imports, in some cases significantly, and potentially renegotiating or terminating existing trade agreements. The current tariff environment is dynamic and uncertain, as the U.S. government has announced widespread tariff reform, with the timing of the tariffs delayed in many cases. For example, in January 2026, the President announced (and later rescinded) additional tariffs on imports from certain European countries (including EU member states) in connection with public statements regarding Greenland, and such actions (and any retaliatory measures) could further increase trade uncertainty and market volatility. Changes to tariffs and other trade restrictions can be announced at any time with little or no notice. We cannot predict with certainty the future trade policy of the United States or other countries. These changes, including trade policies and tariffs affecting other countries, including China, countries comprising the European Union or Middle East, Canada, and Mexico, and retaliatory tariffs by such countries, could materially harm our business. Tariffs and retaliatory tariffs have been imposed, and additional tariffs and retaliatory tariffs are periodically discussed.

If maintained, announced tariffs and the potential escalation of trade disputes, a trade war or other governmental action related to tariffs or international trade agreements or policies, as well as potential epidemics or pandemics, have the potential to negatively impact our and/or our clients’ costs, demand for our clients’ products, and/or the U.S. economy or certain sectors thereof and, thus, adversely affect our business, financial condition, and results of operations. In addition, changes in U.S. trade policies could impact us by impacting the level of deposits (one of our primary lending sources) held by our clients, whether through a higher volume of withdrawals or through a lower volume of deposits.

The soundness of other financial institutions could adversely affect the Company.

Financial services companies are interrelated as a result of trading, clearing, counterparty, or other relationships. We have exposure to many different industries and counterparties. For example, we execute transactions with counterparties in the financial services industry, including brokers and dealers, commercial banks, investment banks, and other institutional clients. As a result, defaults by, or even rumors or questions about, one or more financial services companies or the financial services industry at times have led to market-wide liquidity problems and could lead to losses or defaults by us or by other institutions. Many of these transactions expose us to increased credit risk in the event of default of a counterparty or client.

Liquidity Risks

We are subject to liquidity risks which could impair our cash flows and adversely affect the Company.

Liquidity is the ability to meet current and future cash flow needs on a timely basis at a reasonable cost. Our liquidity is used to make loans and repay deposit liabilities as they become due or are demanded by clients. We rely on our ability to generate deposits and effectively manage the repayment and maturity schedules of our loans and investment securities, respectively, to provide adequate liquidity to fund our operations. While scheduled loan repayments are a relatively stable source of funds, they are subject to the ability of borrowers to repay the loans. The ability of borrowers to repay loans can be adversely affected by a number of factors, including changes in economic conditions, adverse trends or events affecting business industry groups, reductions in real estate values or markets, business closings or lay-offs, inclement weather, natural disasters, which could be exacerbated by potential climate change, and international instability.

21

Table of Contents

Additionally, deposit levels may be affected by several factors, including rates paid by competitors, general interest rate levels, regulatory capital requirements, returns available to clients on alternative investments or other cash management, payment, or store-of-value products (including stablecoin or other digital-asset-based products offered by non-bank providers) and general economic conditions. We may experience potential stresses on liquidity management. We may see deposit levels decrease as clients adjust to distressed economic conditions by using the funds that would otherwise be savings. Accordingly, we may be required from time to time to rely on secondary sources of liquidity to meet withdrawal demands or otherwise fund operations. We maintain a portfolio of investment securities that may be used as a secondary source of liquidity to the extent the securities are not pledged as collateral. Other potential sources of liquidity include the sale of loans, the utilization of available government and regulatory assistance programs, the ability to acquire brokered deposits, the issuance of additional collateralized borrowings such as Federal Home Loan Bank advances, the issuance of debt or equity securities, the sale of available-for-sale securities which may require the sale of securities in a loss position, securities sold under repurchase agreements, federal funds purchased, and borrowings through the Federal Reserve’s discount window. Without sufficient liquidity from these potential sources, we may not be able to meet the cash flow requirements of our depositors and borrowers.

Additionally, our access to funding sources in amounts adequate to finance our activities or on terms that are acceptable to us could be impaired by factors specific to us, the financial services industry, or the economy in general. Factors that could reduce our access to liquidity sources include a downturn in our local or national economies, unfavorable market conditions, difficult or illiquid credit markets, impairments on the value of the collateral we use to secure certain of our borrowings, or adverse regulatory actions against us. A failure to maintain adequate liquidity could have a material, adverse effect on our regulatory standing, business, financial condition, and results of operations.

Loss of deposits or a change in deposit mix could increase the Company’s funding costs and negatively affect the Company’s operations.

Deposits are a low cost and stable source of funding. We depend on checking and savings, negotiable order of withdrawal, money market deposit account balances, and other forms of client deposits as our primary source of funding. Deposit levels may be affected by several factors, including interest rates paid by competitors, general interest rate levels, returns available to customers on alternative investments and general economic conditions that affect savings levels and the amount of liquidity in the economy, including government stimulus efforts in response to economic crises. The availability of internet banking products has increased the mobility of client deposits. We compete with banks and other financial institutions for deposits. Funding costs may increase because the Company may lose deposits and replace them with more expensive sources of funding. Clients may shift their deposits into higher-cost products, or the Company may need to raise its interest rates to remain competitive in the marketplace. Higher funding costs reduce the Company’s net interest income and net income. We cannot be assured that unusual deposit withdrawal activity will not affect banks generally in the future or the Bank specifically.

Our liquidity could be impacted by an inability to access funding, by an unforeseen outflow of cash, or by the inability to monetize liquid assets.

Factors outside of the Company’s control, such as a general market disruption or an operational problem that affects third parties, could impair the Company’s ability to access short-term funding or create an unforeseen outflow of cash due to, among other factors, draws on unfunded commitments or deposit attrition. Such deposit attrition or withdrawals could be amplified by rapid electronic movement of funds to non-bank platforms, including digital-asset and stablecoin-based products offered by non-bank providers, which may increase the speed and severity of outflows and our liquidity needs. Large-scale withdrawals of deposits could require us to access short-term funding sources to meet immediate cash needs or pay significantly higher interest rates to obtain or maintain our deposits, which would have an adverse impact on our net interest income and net income. In addition, changes to the underwriting guidelines or lending policies may limit or restrict our ability to borrow, and therefore could have a significant adverse impact on our liquidity. In the event of future turmoil in the banking industry or other events, there is no guarantee that the U.S. government will invoke the systemic risk exception, create additional liquidity programs, or take any other action to stabilize the banking industry or provide liquidity. The Company’s inability to monetize liquid assets or to access short-term funding or capital markets could limit the Company’s ability to make new loans or meet existing lending commitments and could impact the Company’s liquidity and capitalization.

22

Table of Contents

Market Risks

Changes in interest rates may have an adverse effect on demand for our products and services and on our profitability.

Our earnings and cash flows are largely dependent on net interest income, which is the difference between interest income earned on interest-earning assets, such as loans and investment securities, and interest expense paid on interest-bearing liabilities, such as deposits and borrowed funds. The level of net interest income is primarily a function of the average balance of interest-earning assets, the average balance of interest-bearing liabilities, and the spread between the yield on such assets and the cost of such liabilities. The narrowing of interest rate spreads could adversely affect our earnings and financial condition. After materially tightening monetary policy in 2022 and 2023 in an effort to curb inflation, the Federal Reserve has more recently paused and begun reducing the target federal funds rate. The Federal Reserve decreased the federal funds rate by 100 basis points between September and December 2024 and decreased the federal funds rate by an additional 75 basis points in 2025. The Federal Reserve also indicated in December 2025 that there may be further interest rate decreases during 2026, although we cannot control or predict with certainty changes in interest rates. Regional and local economic conditions, competitive pressures, and the policies of regulatory authorities, including monetary policies of the Federal Reserve and the speed of their implementation, affect interest income and interest expense.

As of December 31, 2025, 41.1% of our loans were advanced to our clients on a variable or adjustable-rate basis. Any prolonged higher borrowing costs resulting from the increases by the Federal Reserve may cause financial hardship on our borrowers, reducing the ability of borrowers to repay their current loan obligations. As a result, any increases in interest rates could result in increased loan defaults, foreclosures, and charge-offs and could necessitate further increases to the allowance for credit losses, any of which could have a material adverse effect on our business, financial condition, or results of operations. In addition, a decrease in interest rates could negatively impact our margins and profitability and uncertainty about the timing and magnitude of future interest rate changes could reduce borrowing demand and, thus, the need for our lending services.

In a declining interest rate environment, our ability to benefit from lower short-term rates depends in significant part on how quickly and to what extent we can reduce the rates paid on interest-bearing deposits and other funding sources. Competition for deposits and client preferences for higher-yielding or longer-term products may limit our ability to lower deposit costs, or may cause a lag between reductions in market rates and reductions in our funding costs, particularly for time deposits and exception-priced relationships. In recent periods, we have experienced select customer movement into higher-yielding deposit products, and our ability to move interest-bearing deposit costs lower (with some lag, including in CDs and certain exception-priced relationships) will be a key factor affecting net interest income in a declining rate environment. If we are unable to decrease interest-bearing deposit costs at least in line with the repricing of our earning assets, or if competitive pressures require us to maintain above-market deposit rates or offer promotional products, our net interest margin and net interest income could be adversely affected.

Changes in monetary policy, including changes in interest rates, could influence not only the interest we receive on loans and securities and the amount of interest we pay on deposits and borrowings, but could also adversely affect (1) our ability to originate loans and obtain deposits, (2) the fair value of our financial assets and liabilities, including mortgage servicing rights, (3) our ability to realize gains on the sale of assets, and (4) the average duration of our mortgage-backed securities and collateralized mortgage obligations portfolios. For example, rising interest rates could adversely affect our mortgage banking business because higher interest rates could cause clients to apply for fewer mortgages. Similarly, rising interest rates would increase the required periodic payment for variable rate loans and may result in an increase in non-performing loans and may increase the cost of our deposits, which are a primary source of funding. Conversely, in a declining interest rate environment, we may experience compression of loan and securities yields, lower reinvestment rates on cash flows from our investment portfolio, faster repayments on mortgage and other fixed-rate loans and securities, and potential reductions in the value of certain interest rate risk management positions. Accordingly, any substantial, unexpected, or prolonged change in market interest rates could have a material, adverse effect on our cash flows, financial condition, and results of operations.

Changes in interest rates can also affect the slope of the yield curve. The impact from a decline in the current yield curve or a flatter or inverted yield curve could cause our net interest income and net interest margin to contract, which could have a material adverse effect on our net income and cash flows, as well as the value of our assets. An inverted yield curve or downward shift in interest rates may also adversely affect the yield on investment securities by increasing the prepayment risk on certain securities. A flattening or inversion of the yield curve or a negative interest rate environment in the United States could create downward pressure on our net interest margin.

23

Table of Contents

Changes in interest rates may have an adverse effect on the value of our investment securities.

Inflation and rapid increases in interest rates have led to a decline in the trading value of previously issued government securities with interest rates below current market interest rates. Any sale of investment securities that are held in an unrealized loss position by us for liquidity or other purposes will cause actual losses to be realized. There can be no assurance that there will not be additional bank failures or issues such as liquidity concerns in the broader financial services industry or in the U.S. financial system. Adverse financial market and economic conditions can exert downward pressure on stock prices, security prices, and credit availability for financial institutions without regard to their underlying financial strength.

Operational Risks

Our Company faces cybersecurity risks, including denial-of-service attacks, network intrusions, business e-mail compromise, and other malicious behavior that could result in the disclosure of confidential information, adversely affect our business or reputation, and create significant legal, operational, and financial exposure.

Our computer systems and network infrastructure and those of third-party service providers on which we are dependent, are subject to security risks and could be susceptible to cyber-attacks, such as denial-of-service attacks, hacking, malware, terrorist activities, and other cybersecurity incidents. Industry experts report increasing cyber-attacks against financial services institutions, and the cost of responding to cybersecurity incidents is higher for victims within the financial sector relative to other sectors. Financial services institutions have reported breaches in the security of their websites or other systems, some of which have involved sophisticated and targeted attacks intended to obtain unauthorized access to confidential information, destroy data, disable or degrade service, achieve illicit financial gain, or sabotage systems, often through the introduction of computer viruses, malware, ransomware, cyber-attacks, and other means. Denial-of-service attacks have been launched against several large financial services institutions, primarily resulting in inconvenience, but can also cause operational disruption. Ransomware and other types of cyber-attacks could be more disruptive and damaging. Hacking and identity theft risks arising from instances of data loss or compromise could also cause serious reputational harm to the Company and the Bank.

Our reliance on vendors subjects us to additional cybersecurity risks and vulnerabilities and other threats to our business operations, as vendor security incidents are common. For example, the hardware and software we purchase from suppliers and vendors to facilitate financial services and perform company operations are at risk of having embedded malware, viruses, and other methods intended to develop unauthorized access to confidential information. These types of attacks, known as “supply-chain attacks,” have become more prevalent and are creating additional risks through the solutions and tools upon which we rely. While we have a third-party risk management program to oversee our vendors and procurement, our ability to successfully mitigate these risks that occur in the hardware and software of these vendors is limited. Although we generally have agreements relating to cybersecurity and data privacy in place with our vendors, we cannot guarantee that such agreements will prevent a cyber-incident impacting our systems or information or enable us to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Additionally, the existence of cyber-attacks or security breaches at third-party vendors with access to our data may not be disclosed to us in a timely manner. To the extent we experience supply-chain attacks, our business and reputation could be materially adversely affected, and these third (or fourth) party security incidents could give rise to legal and regulatory risk for the Company and the Bank.

We also face more indirect technology, cybersecurity, and operational risks relating to the customers, clients, and other third parties with whom we do business or upon whom we rely to facilitate or enable our business activities, including, for example, financial counterparties, regulators, and providers of critical infrastructure such as internet access and electrical power. As a result of increasing consolidation, interdependence, and complexity of financial entities and technology systems, a technology failure, cyber-attack, or other information or security breach that significantly degrades, deletes, or compromises the systems or data of one or more of the entities within our operating ecosystem could have a material impact on us and on our customers. This consolidation, interconnectivity, and complexity within the financial services sector increases the risk of operational failure. Any third-party or fourth-party technology failure, cyber-attack, or other information or security breach, termination, or constraint within our ecosystem could, among other things, adversely affect our ability to effect transactions, service our clients, manage our exposure to risk, or expand our business.

24

Table of Contents

In addition, we provide our clients with the ability to bank remotely, including online, through their mobile devices, and over the telephone. The secure transmission of confidential information over the internet and other remote channels is a critical element of remote banking. Our network, or the network of third parties upon which we rely, could be vulnerable to unauthorized access, computer viruses, malware, phishing schemes, and other internal and external security breaches. We may be required to spend significant capital and other resources to protect against threats, or to alleviate problems caused by security breaches or malicious software. To the extent that our activities or the activities of our clients involve the storage and transmission of confidential information, security breaches and malware could expose us to claims, regulatory scrutiny, litigation, and other possible liabilities. Other possible points of intrusion or disruption not within the Company’s control include internet service providers, electronic mail portal providers, social media portals, distant-server (cloud) service providers, electronic data security providers, telecommunications companies, and smart phone manufacturers.

Despite efforts to evaluate threats to the security of our systems and data and to implement controls and policies and procedures designed to address the same, cyber threats are rapidly evolving, and we may not be able to anticipate or prevent all such attacks, nor may we be able to implement guaranteed preventive measures against such security breaches. The techniques used by cyber criminals change frequently, may be novel (for example, “zero-day” vulnerabilities), and/or may not be recognized until launched or later (for example, threat actor evading detection for some time), and can originate from a wide variety of sources, including external service providers. These risks may increase in the future as we continue to increase our mobile payment and other internet-based product offerings and expand our internal usage of web-based products and applications. Further, targeted social engineering attacks may be sophisticated and difficult to prevent and our employees, clients, or other users of our systems may be fraudulently induced to disclose sensitive information, allowing cyber criminals to gain access to our systems or data of our clients. Cyber-attacks also could include phishing attempts or e-mail fraud to cause payments or information to be transmitted to an unintended recipient and could include the use of AI and machine learning to launch more automated, targeted and coordinated attacks on targets.

In addition, some of our employees work remotely, including while traveling for business, which increases our cybersecurity risk, creates data accessibility concerns, and makes us more susceptible to security breaches or business disruptions. While we have implemented measures to secure remote access to our systems and to educate our users on the risks associated with working remotely, we cannot guarantee that unauthorized access will not occur through these remote channels.

A successful penetration or circumvention of system security could cause us serious negative consequences, including significant disruption of operations, misappropriation of confidential information, or damage to our computers or systems or to those of our clients and counterparties. A successful security breach or other cybersecurity incident involving our computer systems and network infrastructure, or those of the third-party service providers upon which we rely, could result in violations of applicable data privacy and data security/data breach and other laws and contractual requirements, financial loss to us or to our clients, loss of confidence in our security measures, significant litigation exposure, and harm to our reputation, all of which could have a material adverse effect on our business, financial condition, and results of operations.

Privacy, information security, and data protection laws, rules, and regulations could affect or limit how we collect and use personal information, increase our compliance and technology costs, create litigation and regulatory enforcement risks, and adversely affect our business opportunities.

We are subject to various and constantly evolving privacy, information security, and data protection laws and regulatory guidance, including without limitation: (i) certain limitations on our ability to share non-public personal information about our clients with non-affiliated third parties; (ii) requirements for certain disclosures to clients about our information collection, sharing, and security practices and that afford clients the right to “opt out” of any information sharing by us with non-affiliated third parties (with certain exceptions); and (iii) requirements that we develop, implement, and maintain a written information security program containing appropriate safeguards based on our size and complexity, the nature and scope of our activities, and the sensitivity of client information we process, as well as plans for responding to data security breaches. The number of compliance requirements facing financial institutions continues to increase year over year, as more and more states continue to update and add to their existing data security and data breach requirements and more and more states enact comprehensive data privacy laws. While we have developed policies and procedures and designed our privacy and cybersecurity risk management and governance programs to align with the various statutory and regulatory requirements to which we are subject, these requirements are constantly changing, and the financial services industry continues to face heightened regulatory scrutiny over data privacy and information security practices. Compliance with current or future privacy, data protection, and information security laws (including those regarding security breach notification) affecting client or employee data could result in higher compliance and technology costs and could restrict our ability to provide certain products and services, which could have a material adverse effect on our business, financial conditions, or results of operations. Our failure to comply with privacy, data protection, and information security laws could result in potentially significant regulatory or governmental investigations or actions, litigation, fines, sanctions, and damage to our reputation, which could have a material adverse effect on our business, financial condition, or results of operations.

25

Table of Contents

In addition, while we have taken steps to implement and maintain privacy policies that are accurate, comprehensive and compliant with applicable laws, regulations, rules and industry standards, we cannot ensure that our privacy policies and other statements regarding our data processing practices will be sufficient to protect us from claims, proceedings, liability or adverse publicity relating to privacy or cybersecurity. The publication of our privacy policies and other related documentation about our privacy and cybersecurity practices can subject us to potential legal claims or regulatory proceedings if they are found or alleged to be deceptive, unfair, or not representative of our actual practices. Additional risks could arise in connection with any failure or perceived failure by us, our service providers or other third parties with which we do business to provide adequate disclosure or transparency to our customers about the personal information collected from them and its use, to receive, document or honor the privacy preferences expressed by our customers, to protect personal information from unauthorized disclosure or to maintain proper training on privacy practices for all employees or third parties who have access to personal information in our possession or control.

Moreover, many U.S. and foreign laws and regulations, including those promulgated by the SEC, require companies to provide notice of cybersecurity incidents involving certain types of personal data or unauthorized access to, or interference with, our information systems to the public, certain individuals, the media, government authorities, or other third parties. Certain of these laws and regulations include notice or disclosure obligations contingent upon the result of complex analyses, including in some cases a determination of materiality. The nature of cybersecurity incidents can make it difficult to assess an incident’s overall impact quickly and comprehensively to our business, and we may make errors in our assessments. If we are unable to appropriately assess a cybersecurity incident in the context of required analyses, then we could face compliance risk under these laws and regulations, and we could be subject to lawsuits, regulatory fines or investigations, or other liabilities, any of which could adversely affect our business and operating results. Furthermore, cybersecurity incidents experienced by us, or by our customers or vendors, that lead to public disclosures may also lead to widespread negative publicity and increased government or regulatory scrutiny. Any compromise of our network or data, or any security incident experienced by a member of our supply chain, whether actual or perceived, could harm our reputation; erode customer confidence in our security measures; negatively affect our ability to attract new customers; or subject us to third-party lawsuits, regulatory fines or investigations, or other liability, any of which could adversely affect our business and operating results. Even the perception of inadequate security may damage our reputation and negatively impact our ability to win new customers and retain existing customers.

Additionally, we could be required under applicable data breach reporting laws and governing contracts to expend significant capital and other resources to investigate and address any actual or suspected cybersecurity incident or to implement measures to prevent further or additional incidents. To maintain business relationships, we may find it necessary or desirable to incur costs to provide remediation and incentives to customers or other business partners following an actual or suspected security incident. While we do maintain cyber liability insurance to mitigate the financial risks associated with security incidents that is reviewed annually, we cannot be sure that our existing cybersecurity insurance will continue to be available on acceptable terms, in sufficient amounts to cover any claims we submit, or at all. Further, we cannot be sure that insurers will not deny coverage as to any claim, and some security incidents may be outside the scope of our coverage, including in instances where they are considered force majeure events, or there are applicable sub-limits on our coverage. Security incidents may result in increased costs for cybersecurity insurance. One or more large, successful claims against us in excess of our available insurance coverage, or changes in our insurance policies, including premium increases or large deductible or co-insurance requirements, could have an adverse effect on our insurance coverage and on our business, operating results, and financial condition.

Our goodwill and other intangible assets may become impaired, which may adversely impact our results of operations and financial condition.

The excess purchase price over the fair value of net assets from acquisitions, or goodwill, is evaluated for impairment at least annually and on an interim basis if an event or circumstance indicates it is likely an impairment has occurred. In testing for impairment, the Company performs a qualitative assessment to determine whether it is more likely than not that the fair value of a reporting unit is in excess of its carrying value. If it is not more likely than not that the fair value of the reporting unit is in excess of the carrying value, the fair value of net assets is estimated based on analyses of our market value, discounted cash flows, and peer values. Consequently, the determination of goodwill is sensitive to market-based economics and other key assumptions. Variability in market conditions or in key assumptions could result in impairment of goodwill, which is recorded as a non-cash adjustment to income. An impairment of goodwill could have a material adverse effect on our financial condition and results of operations. As of December 31, 2025, we had goodwill of $1,100.9 million, or 31.9% of our total stockholders’ equity.

Identifiable intangible assets other than goodwill consist of core deposit intangibles and other intangible assets (primarily customer relationships). Adverse events or circumstances could impact the recoverability of these intangible assets including loss of core deposits, significant losses of customer accounts and/or balances, increased competition or adverse changes in the economy. To the extent these intangible assets are deemed unrecoverable, a non-cash impairment charge would be recorded which could have a material adverse effect on our results of operations.

26

Table of Contents

The Company relies on third parties to provide certain key components of its business infrastructure.

We are reliant upon certain external vendors to provide products and services necessary to maintain our day-to-day operations and we currently outsource, or may outsource in the future, many of our major systems, such as certain data processing, loan servicing, credit card issuance and servicing, and deposit processing systems. Through our contractual relationships, external vendors are subject to some of the same rules and regulations that are applicable to the Company and their compliance with regulatory requirements is our responsibility. While the Company has selected these external vendors and systems carefully and continues to manage and oversee these vendors, it does not control their operations. Failure of certain external vendors or systems to perform or provide services in accordance with contractual arrangements could be disruptive to our operations and limit our ability to provide certain products and services demanded by our clients. Because our information technology and telecommunications systems interface with and depend on third-party systems, we could experience disruptions if demand for such services exceeds capacity or such third-party systems fail or experience interruptions. If significant, sustained, or repeated, a system failure or disruption could compromise our ability to operate effectively, damage our reputation, result in a loss of client business, and/or subject us to additional regulatory scrutiny and possible financial liability. Any of the failures or disruptions mentioned above could negatively impact our financial condition, results of operations, and cash flows. Replacing these third-party vendors could also entail significant delay and expense.

Our use of third parties also extends to certain consumer credit products. Following the outsourcing of our consumer credit card portfolio in 2025, we rely on a third-party provider to support that product line. Even if the related loans are held by the provider rather than on our balance sheet, we may be exposed to reputational, legal, compliance and operational risks arising from that provider’s activities, including its marketing, servicing, collections, information security and data privacy practices. Any failure by a third-party provider to comply with applicable laws, regulations or contractual requirements, or to otherwise meet our expectations or those of our customers and regulators, could result in regulatory scrutiny, enforcement actions, litigation, customer dissatisfaction or other harm to our business.

Our reputation is very important to our ability to maintain, attract and retain client relationships and if our reputation were impaired, it could have an adverse effect on the Company.

Our clients expect us to deliver personalized financial services with the highest standards of performance, professionalism, compliance, and ethics. If our clients or others were to sue us,by class action or otherwise, claiming that we or third parties for whom they say we are responsible have failed to perform under a contract or failed to carry out a duty perceived to be owed to them,our reputation could be damaged, even if any such suit were to be determined to be frivolous. This risk may be heightened when we act as a fiduciary for our clients and may be further heightened during periods when credit, equity or other financial markets are experiencing deterioration in value or volatility, or when clients or investors are experiencing losses. Damage to our reputation from any of these circumstances could undermine retention of our current clients and our ability to attract potential clients while also impairing the confidence of our counterparties and vendors, the result of which could affect our ability to effect transactions. Maintaining our reputation depends, in part, on our ability to identify and promptly address issues that may arise such as potential conflicts of interest, anti-money laundering concerns, fair lending issues, client personal information and privacy issues, cybersecurity, employee, client and other third-party fraud, record-keeping matters, regulatory investigations, and any litigation that may arise from the failure or perceived failure of us to comply with applicable legal and regulatory requirements. To maintain our reputation, we also must prevent third parties from infringing on the “First Interstate Bank” brand and associated trademarks and our other intellectual property. Our reputation or prospects could be significantly damaged by adverse publicity or negative information regarding our Company, whether or not true, that may be posted on social media, reported in the news, or posted in other parts of the internet. Defending our reputation, trademarks, and other intellectual property, including through litigation, could result in costs that could have a material adverse effect on our business, financial condition, or results of operations. Furthermore, claims made or actions brought against us, whether founded or unfounded, may result in other lawsuits, injunctions, settlements, damages, fines or penalties, any of which could have a material adverse effect on our financial condition or results of operations or require changes to our business and damage our reputation. Even if we were to defend ourselves successfully in such an instance, litigation can be costly and time-consuming and distract our management, and public reports regarding claims made against us may cause damage to our reputation among existing and prospective clients or negatively impact the confidence of counterparties, rating agencies and stockholders, consequently affecting negatively our business, financial condition, or results of operations.

27

Table of Contents

The results of mainstream media and social media contagion and speculation could impact the banking system and have an adverse effect on us.

Dissemination of information by mainstream media and social media platforms is extensive and can occur at a rapid pace. Adverse conditions at financial institutions of significant size can negatively impact other financial institutions, despite the quality of leadership and decision making of the other financial institutions or their ability to effectively identify, measure, manage and control risk. Misinformed or inaccurate reporting regarding an incident or incidents at any financial institution can impact the broader banking industry, particularly given the speed and breadth of such reporting. Any adverse condition could be reported in a way to negatively affect the price of financial institution securities and could impact credit availability for certain issuers without regard to their underlying financial strength. This contagion risk can also occur when a perceived lack of trust in the banking system spreads throughout the industry based upon the results of a few poorly managed, or allegedly poorly managed, larger financial institutions.

We are dependent upon the services of our management team and directors and if the services of any of them were to become unavailable, it could have an adverse effect on the Company.

Our future success and profitability are substantially dependent upon the management skills of senior management and directors. The unanticipated loss or unavailability of key employees could harm our ability to operate our business or execute our business strategy. We face significant competition in the recruitment of highly motivated individuals who can deliver our Company’s vision and core principles, which has recently intensified as a result of changes in the labor market. Regulators have from time to time considered or proposed rules that could affect incentive compensation practices at banking organizations, which could increase costs and limit flexibility in attracting and retaining talent. We may not be successful in retaining key employees or finding and integrating suitable successors in the event of key employee loss or unavailability.

We may not be able to attract and retain qualified employees to operate our business effectively, which could have an adverse effect on our business.

There is substantial competition to attract and retain talented and diverse employees in our markets. It may be difficult for us to attract and retain qualified employees at all management and staffing levels. Failure to attract and retain employees and maintain adequate staffing of qualified personnel could adversely impact our operations and our ability to execute our business strategy. Furthermore, relatively low unemployment rates may lead to significant increases in labor costs such as salaries, wages, and employee benefits expenses as we compete for qualified and skilled employees, which could negatively impact our results of operations.

In addition, in order to continue to hire and retain highly qualified personnel, we will need to continue to manage remote working policies, which may add to the complexity and costs of our business operations. From time to time, we have experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications. Many of the companies with which we compete for experienced personnel have greater acceptance of remote or hybrid work environments, which may increase the competition for talent.

Costs associated with repossessed properties, including potential environmental remediation, may adversely impact our results of operations, cash flows, and financial condition.