HFWA US Equity☆

hfwa-20231231

Table of Contents

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, D.C. 20549

☒ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended December 31, 2023

or

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from __________ to __________

Commission File Number 000-29480

HERITAGE FINANCIAL CORPORATION

(Exact name of registrant as specified in its charter)

(Address of principal executive offices) (Zip Code)

(360) 943-1500

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

Title of each class Trading Symbol(s) Name of each exchange on which registered

Common stock, no par value HFWA NASDAQ Stock Market LLC

Securities registered pursuant to Section 12(g) of the Act:

None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.

Yes ☒ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.

Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.

Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files).

Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, smaller reporting company, or an emerging growth company. See the definitions of "large accelerated filer", "accelerated filer", "smaller reporting company," and "emerging growth company" in Rule 12b-2 of the Exchange Act

Large accelerated filer ☐ Accelerated filer ☒

Non-accelerated filer ☐ Smaller reporting company ☐

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management's assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act).

Yes ☐ No ☒

The aggregate market value of the voting and non-voting common equity held by non-affiliates of the registrant as of June 30, 2023, based on the closing price of its common stock on such date, on the NASDAQ Global Select Market, of $16.17 per share, and 34,542,512 shares held by non-affiliates was $558,552,419. The registrant had 34,906,233 shares of common stock outstanding as of February 19, 2024.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the registrant’s definitive Proxy Statement for the 2024 Annual Meeting of Shareholders are incorporated by reference into Part III of this Annual Report on Form 10-K where indicated. The 2024 Proxy Statement will be filed with the U.S. Securities and Exchange Commission within 120 days after the end of the fiscal year to which this report relates.

Table of Contents

HERITAGE FINANCIAL CORPORATION AND SUBSIDIARIES

FORM 10-K

December 31, 2023

TABLE OF CONTENTS

Page

GLOSSARY OF ACRONYMS, ABBREVIATIONS AND TERMS 4

CAUTIONARY NOTE REGARDING FORWARD LOOKING STATEMENTS 5

PART I

ITEM 1. BUSINESS 6

ITEM 1A. RISK FACTORS 16

ITEM 1B. UNRESOLVED STAFF COMMENTS 25

ITEM 1C CYBERSECURITY 25

ITEM 2. PROPERTIES 26

ITEM 3. LEGAL PROCEEDINGS 26

ITEM 4. MINE SAFETY DISCLOSURES 26

PART II

ITEM 6. [RESERVED] 28

OVERVIEW 28

RESULTS OF OPERATIONS 28

NET INTEREST INCOME AND MARGIN OVERVIEW 29

PROVISION FOR CREDIT LOSSES OVERVIEW 31

NONINTEREST INCOME OVERVIEW 32

NONINTEREST EXPENSE OVERVIEW 32

INCOME TAX EXPENSE OVERVIEW 33

FINANCIAL CONDITION OVERVIEW 33

INVESTMENT ACTIVITIES OVERVIEW 34

LOAN PORTFOLIO OVERVIEW 35

ALLOWANCE FOR CREDIT LOSSES ON LOANS OVERVIEW 38

DEPOSITS OVERVIEW 39

STOCKHOLDERS' EQUITY OVERVIEW 40

LIQUIDITY AND CAPITAL RESOURCES 40

CRITICAL ACCOUNTING ESTIMATES 41

ITEM 7A. QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK 42

ITEM 8. FINANCIAL STATEMENTS AND SUPPLEMENTARY DATA 44

REPORT OF INDEPENDENT REGISTERED PUBLIC ACCOUNTING FIRM (PCAOB ID: 173) 44

2

Table of Contents

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS 52

NOTE 2. INVESTMENT SECURITIES 60

NOTE 3. LOANS RECEIVABLE 64

NOTE 4. ALLOWANCE FOR CREDIT LOSSES ON LOANS 73

NOTE 5. PREMISES AND EQUIPMENT 75

NOTE 6. GOODWILL AND OTHER INTANGIBLE ASSETS 75

NOTE 7. DERIVATIVE FINANCIAL INSTRUMENTS 76

NOTE 8. DEPOSITS 76

NOTE 9. JUNIOR SUBORDINATED DEBENTURES 76

NOTE 10. SECURITIES SOLD UNDER AGREEMENT TO REPURCHASE 77

NOTE 11. OTHER BORROWINGS 77

NOTE 13. EMPLOYEE BENEFIT PLANS 78

NOTE 14. STOCKHOLDERS’ EQUITY 79

NOTE 15. FAIR VALUE MEASUREMENTS 80

NOTE 16. STOCK-BASED COMPENSATION 84

NOTE 17. CASH RESTRICTION 85

NOTE 18. INCOME TAXES 85

NOTE 19. COMMITMENTS AND CONTINGENCIES 87

NOTE 20. REGULATORY CAPITAL REQUIREMENTS 88

NOTE 21. HERITAGE FINANCIAL CORPORATION (PARENT COMPANY ONLY) 88

ITEM 9A. CONTROLS AND PROCEDURES 90

ITEM 9B. OTHER INFORMATION 90

ITEM 9C. DISCLOSURE REGARDING FOREIGN JURISDICTIONS THAT PREVENT INSPECTIONS 90

PART III

ITEM 10. DIRECTORS, EXECUTIVE OFFICERS AND CORPORATE GOVERNANCE 90

ITEM 11. EXECUTIVE COMPENSATION 91

ITEM 14. PRINCIPAL ACCOUNTANT FEES AND SERVICES 91

PART IV

ITEM 15. EXHIBITS AND FINANCIAL STATEMENT SCHEDULES 91

SIGNATURES 93

3

Table of Contents

Glossary of Acronyms, Abbreviations, and Terms

The acronyms, abbreviations, and terms listed below are used in various sections of this Annual Report on Form 10-K. As used throughout this report, the terms “we,” “our,” or “us” refer to Heritage Financial Corporation and its consolidated subsidiaries, unless the context otherwise requires.

ACL Allowance for credit losses

AOCI Accumulated other comprehensive income (loss), net

ASC Accounting Standards Codification

ASU Accounting Standards Update

Bank Heritage Bank

BOLI Bank owned life insurance

BTFP Bank Term Funding Program

CECL Current Expected Credit Loss

CMO Collateralized Mortgage Obligation

Company Heritage Financial Corporation

CRE Commercial real estate

DEI Diversity, Equity, and Inclusion

Equity Plan Heritage Financial Corporation 2023 Omnibus Equity Plan

Exchange Act Securities Exchange Act of 1934, as amended

FASB Financial Accounting Standards Board

FDIC Federal Deposit Insurance Corporation

Federal Reserve Board of Governors of the Federal Reserve System

FRB Federal Reserve Bank of San Francisco

FHLB Federal Home Loan Bank of Des Moines

FOMC Federal Open Market Committee within the Federal Reserve System

Form 10-K Company's Annual Report on Form 10-K

GAAP U.S. Generally Accepted Accounting Principles

LIBOR London Interbank Offering Rate

LIHTC Low-Income Housing Tax Credit

NMTC New Market Tax Credit

MBS Mortgage-backed security

OCC Office of the Comptroller of the Currency

Plan Heritage Financial Corporation 401(k) Profit Sharing Plan and Trust

Related Party Certain directors, executive officers and their affiliates

ROU Right-of-Use

SBA Small Business Administration

SEC Securities and Exchange Commission

SM Special Mention

SOFR Secured Overnight Financing Rate

SS Substandard

TDR Troubled debt restructured

USDA United States Department of Agriculture

4

Table of Contents

CAUTIONARY NOTE REGARDING FORWARD LOOKING STATEMENTS

This Form 10-K may contain forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. Forward-looking statements are not statements of historical fact, are based on certain assumptions and often include the words “believes,” “expects,” “anticipates,” “estimates,” “forecasts,” “intends,” “plans,” “targets,” “potentially,” “probably,” “projects,” “outlook” or similar expressions or future or conditional verbs such as “may,” “will,” “should,” “would” and “could.” These statements relate to our financial condition, results of operations, beliefs, plans, objectives, goals, expectations, assumptions and statements about future performance or business. The Company cautions readers not to place undue reliance on any forward-looking statements. Moreover, you should treat these statements as speaking only as of the date they are made and based only on information then actually known to the Company. The Company does not undertake and specifically disclaims any obligation to revise any forward-looking statements to reflect the occurrence of anticipated or unanticipated events or circumstances after the date of such statements whether as a result of new information, future events or otherwise. These forward-looking statements are subject to known and unknown risks, uncertainties and other factors that could cause our actual results for future periods to differ materially from those expressed in any forward-looking statements by, or on behalf of, us, and could negatively affect the Company’s operating results and stock price performance. These risks include, but are not limited to:

•potential adverse impacts to economic conditions nationally or in our local market areas, other markets where the Company has lending relationships, or to other aspects of the Company’s business operations or financial markets, including, without limitation, as a result of employment levels, labor shortages and the effects of inflation, a potential recession or slowed economic growth;

•changes in the interest rate environment, including the past increases in the Federal Reserve benchmark rate and duration at which such increased interest rate levels are maintained, which could adversely affect our revenues and expenses, the value of assets and obligations, and the availability and cost of capital and liquidity;

•the credit risks of lending activities, including changes in the level and trend of loan delinquencies and write-offs and changes in our ACL on loans and provision for credit losses on loans that may be affected by deterioration in the housing and CRE markets, which may lead to increased losses and nonperforming assets in our loan portfolio, and may result in our ACL on loans no longer being adequate to cover actual losses, and require us to increase our ACL on loans;

•the impact of continuing elevated inflation and the current and future monetary policies of the Federal Reserve in response thereto;

•changes in the levels of general interest rates, and the relative differences between short-term and long-term interest rates, deposit interest rates, our net interest margin and funding sources;

•the impact of repricing and competitors' pricing initiatives on loan and deposit products;

•fluctuations in the demand for loans, the number of unsold homes and other properties and fluctuations in real estate values in our market areas;

•results of examinations of us by the bank regulators, including the possibility that any such regulatory authority may, among other things, initiate an enforcement action against the Company or our bank subsidiary which could require us to increase our ACL on loans, write-down assets, change our regulatory capital position, affect our ability to borrow funds or maintain or increase deposits, or impose additional requirements on us, any of which could affect our ability to continue our growth through mergers, acquisitions or similar transactions and adversely affect our liquidity and earnings;

•legislative or regulatory changes that adversely affect our business, including changes in banking, securities and tax law, in regulatory policies and principles, or the interpretation of regulatory capital or other rules;

•our ability to attract and retain deposits;

•liquidity issues, including our ability to borrow funds or raise additional capital, if necessary;

•our ability to control operating costs and expenses;

•effects of critical accounting policies and judgments, including the use of estimates in determining fair value of certain of our assets, which estimates may prove to be incorrect and result in significant declines in valuation;

•the effectiveness of our risk management framework;

•staffing fluctuations in response to product demand or the implementation of corporate strategies that affect our workforce and potential associated charges;

•our ability to keep pace with the rate of technological advances;

•disruptions, security breaches, or other adverse events, failures or interruptions in, or attacks on, our information technology systems or on the third-party vendors who perform several of our critical processing functions;

•our ability to retain key members of our senior management team;

•costs and effects of litigation, including settlements and judgments;

•our ability to implement our business strategies and manage our growth;

•our ability to successfully integrate any assets, liabilities, customers, systems, and management personnel we may acquire into our operations and our ability to realize related revenue synergies and cost savings within expected time frames or at all, and any goodwill charges related thereto and costs or difficulties relating to integration matters, including but not limited to customer and employee retention, which might be greater than expected;

•future goodwill impairment due to changes in our business, market conditions, or other factors;

•changes arising from acquiring assets or expanding into new geographic markets, products, or services;

•increased competitive pressures among financial service companies;

•changes in consumer spending, borrowing and savings habits;

•the availability of resources to address changes in laws, rules, or regulations or to respond to regulatory actions;

•our ability to pay dividends on our common stock;

•the quality and composition of our securities portfolio and the impact of any adverse changes in the securities markets, including on market liquidity;

•inability of key third-party providers to perform their obligations to us;

5

Table of Contents

•changes in accounting policies and practices, as may be adopted by the financial institution regulatory agencies or the FASB, including additional guidance and interpretation on accounting issues and details of the implementation of new accounting methods;

•the impact of bank failures or adverse developments at other banks and the related negative press about the banking industry in general on investor and depositor sentiment;

•the effects of climate change, severe weather events, natural disasters, pandemics, epidemics and other public health crises, acts of war or terrorism, and other external events on our business;

•other economic, competitive, governmental, regulatory, and technological factors affecting our operations, pricing, products and services; and

•other risks described elsewhere in this Form 10-K and in our other reports filed with or furnished to the SEC, which are available on our website at www.heritagebanknw.com and on the SEC's website at www.sec.gov.

PART I

ITEM 1. BUSINESS

Overview

Heritage Financial Corporation is a bank holding company that was incorporated in the State of Washington in August 1997. We are primarily engaged in the business of planning, directing, and coordinating the business activities of our wholly owned subsidiary and single reportable segment, Heritage Bank.

Heritage Bank is headquartered in Olympia, Washington and conducts business from its 50 branch offices located throughout Washington State, the greater Portland, Oregon area, Eugene, Oregon and Boise, Idaho as of December 31, 2023. The deposits of the Bank are insured by the FDIC.

Our business consists primarily of commercial lending and deposit relationships with small and medium-sized businesses and their owners in our market areas and attracting deposits from the general public. We also make real estate construction and land development loans, consumer loans and residential real estate loans for sale or investment purposes on residential properties located primarily in our market.

Business Strategy

We are committed to being the leading commercial community bank in the Pacific Northwest by continuously improving customer satisfaction, employee empowerment, community investment and shareholder value. Our commitment defines our relationships, sets expectations for our actions and directs decision-making in these four fundamental areas. We will seek to achieve our business goals through the following strategies:

Expand geographically as opportunities present themselves.We are committed to continuing the controlled expansion of our franchise through strategic acquisitions designed to increase our market share and enhance franchise value. We believe that consolidation across the community bank landscape will continue to take place and further believe that, with our capital and liquidity positions, our approach to credit management, and our extensive acquisition experience, we are well-positioned to take advantage of acquisitions or other business opportunities in our market areas. In markets where we wish to enter or expand our business, we will also consider opening de novo branches, typically in conjunction with hiring commercial lending and deposit teams. In the past, we have successfully integrated acquired institutions and opened de novo branches. We will continue to be disciplined and opportunistic as it pertains to future acquisitions and de novo branching, focusing on the Pacific Northwest markets we know and understand.

Focus on asset quality.A strong credit culture is a high priority for us. We have a well-developed credit approval structure that has enabled us to maintain a standard of asset quality that we believe has moderate and manageable risk while at the same time allowing us to achieve our lending objectives. We will continue to focus on loan types and markets that we know well and where we have a historical record of success. We focus on loan relationships that are well-diversified in both size and industry types. With respect to commercial business lending, which is our predominant lending activity, we view ourselves as cash-flow lenders obtaining additional support from realistic collateral values, personal guarantees and other secondary sources of repayment. We have a problem loan resolution process that is focused on quick detection and implementing feasible solutions and subject our loans to periodic internal loan reviews.

Maintain a strong balance sheet.In addition to our focus on underwriting, we believe the strength of our balance sheet provides us with the flexibility to manage through a variety of scenarios including additional growth-related activities. As of December 31, 2023, our liquidity position was $225.0 million in cash and cash equivalents and $1.87 billion in total investment securities. See also "Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations — Liquidity and Capital Resources" of this Form 10-K. As of December 31, 2023, the regulatory capital ratios of the Bank were in excess of the levels required for “well-capitalized” status, and our consolidated common equity tier 1 capital ratio, leverage ratio, Tier 1 capital ratio, and total capital ratio were 12.9%, 10.0%, 13.3% and 14.1%, respectively.

Focused deposit growth.Our strategic focus is to continuously grow deposits with emphasis on total relationship banking with our business and retail customers. We continue to seek to increase our market share in the communities we serve by providing exceptional customer service, focusing on relationship development with local businesses and strategic branch expansion. Our primary focus is to maintain a high level of non-maturity deposits to internally fund our loan growth with a low reliance on maturity (certificate) deposits. At December 31, 2023, our non-maturity deposits were 87.6% of our total deposits. Our technology-based products, including online personal financial management, business cash management and business remote deposit products enable us to compete effectively with banks of all sizes. Our retail and commercial management teams

6

Table of Contents

are well-seasoned and have strong ties to the communities we serve with a strong focus on relationship building and customer service.

Emphasize business relationships with a focus on commercial lending. We will continue to market primarily commercial business loans and the deposit balances that accompany these relationships. Our seasoned lending staff has extensive knowledge and can add value through a focused advisory role that we believe strengthens our customer relationships and develops loyalty. We currently have and will seek to maintain a diversified portfolio of lending relationships without significant concentrations in any industry.

Recruit and retain highly competent personnel to execute our strategies.Our compensation and staff development programs are aligned with our strategies to grow our loans and non-maturity deposits while maintaining our focus on asset quality. Our incentive systems are designed to achieve balanced, high quality asset growth while maintaining appropriate mechanisms to reduce or eliminate incentive payments when appropriate. Our equity compensation programs and retirement benefits are designed to build and encourage employee ownership at all levels of the Company and we align employee performance objectives with corporate growth strategies and shareholder value. We have a strong corporate culture, which is supported by our commitment to internal development and promotion from within as well as the retention of management and officers in key roles.

There have been no material changes to our business strategy during the years ended December 31, 2023 and 2022.

History

The Bank was established in 1927 as a federally-chartered mutual savings bank. In 1992, the Bank converted to a state-chartered mutual savings bank under the name Heritage Savings Bank. Through the mutual holding company reorganization of the Bank and the subsequent conversion of the mutual holding company, the Bank became a stock savings bank and a wholly-owned subsidiary of the Company effective August 1997. Effective September 1, 2004, Heritage Savings Bank switched its charter from a state-chartered savings bank to a state-chartered commercial bank and changed its legal name from Heritage Savings Bank to Heritage Bank. The following table lists major combinations completed by the Company:

Acquisition June 1998 North Pacific Bancorporation North Pacific Bank $ 85

FDIC Assisted Purchase August 2010 n/a Cowlitz Bank 345

FDIC Assisted Purchase November 2010 n/a Pierce Commercial Bank 211

Acquisition January 2013 n/a Northwest Commercial Bank 65

Acquisition July 2013 Valley Community Bancshares, Inc. Valley Bank 237

Merger May 2014 Washington Banking Company Whidbey Island Bank 1,657

Acquisition January 2018 Puget Sound Bancorp, Inc. Puget Sound Bank 571

Acquisition July 2018 Premier Commercial Bancorp Premier Community Bank 387

Description of Business

Retail Banking

We offer a full range of products and services to customers for personal and business banking needs designed to attract both short-term and long-term deposits. Deposits are our primary source of funds. Our personal and business banking customers have the option of selecting from a variety of accounts. The major categories of deposit accounts that we offer are described below. These accounts, with the exception of noninterest demand accounts, generally earn interest at rates established by management based on competitive market factors and management’s desire to increase or decrease certain types or maturities of deposits.

Noninterest Demand Deposits. Deposits are noninterest bearing and may be charged service fees based on activity and balances.

Interest Bearing Demand Deposits.Deposits are interest bearing and may be charged service fees based on activity and balances. Interest bearing demand deposits pay interest, but require a higher minimum balance to avoid service charges.

Money Market Accounts.Depositspay an interest rate that is tiered depending on the balance maintained in the account. Minimum opening balances vary.

Savings Accounts.Deposits are interest bearing provided that a minimum balance is maintained to avoid service charges.

Certificate of Deposit Accounts.Deposits require a minimum deposit of $2,500 and have maturities ranging from three months to five years. Jumbo certificate of deposit accounts are offered in amounts of $100,000 or more for terms of seven days to one year.

7

Table of Contents

Our personal checking accounts feature an array of benefits and options, including online banking, online statements, mobile banking with mobile deposit, VISA debit cards and access to more than 40,000 surcharge free Automated Teller Machines through the MoneyPass network.

We also offer investment advice through a Wealth Management department that provides objective advice from trusted advisers.

Lending Activities

Our lending activities are conducted through the Bank. While our focus is on commercial business lending, we also originate real estate construction and land development loans, residential real estate and consumer loans. Our loans are originated under policies that are reviewed and approved annually by our Board of Directors. In addition, we have established internal lending guidelines that are updated as needed. These policies and guidelines address underwriting standards, structure and rate considerations, and compliance with laws, regulations and internal lending limits. We conduct post-approval reviews on selected loans and routinely perform internal loan reviews of our loan portfolio to confirm credit quality, proper documentation and compliance with laws and regulations. Loan repayments are considered one of the primary sources of funding for the Company.

Commercial Business Lending

At December 31, 2023 we had $3.37 billion, or 77.8% of our loans receivable, in commercial business loans. We offer different types of commercial business loans, including lines of credit, term equipment financing and term owner-occupied and non-owner occupied commercial real estate loans. We also originate loans that are guaranteed by the U.S. SBA, for which the Bank is a “preferred lender,” the U.S. Department of Agriculture and the Federal Agricultural Mortgage Corporation. Before extending credit to a business, we review and analyze the borrower’s management ability, financial history, including cash flow of the borrower and all guarantors, and the liquidation value of the collateral. Emphasis is placed on having a comprehensive understanding of the borrower’s global cash flow and performing necessary financial due diligence.

We originate commercial real estate loans within our primary market areas with a preference for loans secured by owner-occupied properties. Our underwriting standards require that non-owner occupied and owner-occupied commercial real estate loans not exceed 75% and 80%, respectively, of the lower of appraised value at origination or cost of the underlying collateral. Cash flow debt coverage covenant requirements typically range from 1.15 times to 1.25 times, depending on the type of property. Actual debt service coverage is usually higher than required covenant thresholds, as loan sizing requires sensitized coverage using an "underwriting" interest rate that is higher than the note rate.

Commercial real estate loans typically involve a greater degree of risk than residential real estate loans. Payments on loans secured by commercial real estate properties are dependent on successful operation and management of the properties and repayment of these loans may be affected by adverse conditions in the real estate market or the economy. We seek to minimize these risks by determining the financial condition of the borrower and any tenants, the quality and value of the collateral, and the management of the property securing the loan. We also generally obtain personal guarantees from the owners of the collateral after a thorough review of personal financial statements. In addition, we reviewed over 70% of our commercial real estate loan portfolio during the year ended December 31, 2023 for various performance related criteria and stress-test loans for potential changes in interest rates, occupancy and collateral values.

The Company may enter into non-hedging interest rate swap contracts with commercial customers to accommodate their business needs. For additional information, see Note (7) Derivative Financial Instruments of the Notes to Consolidated Financial Statements included in Item 8. Financial Statements And Supplementary Data.

Residential Real Estate Loans, Originations and Sales

At December 31, 2023, residential real estate loans totaled $375.3 million, or 8.7% of our loans receivable. The majority of our residential real estate loans are secured by single-family residences located in our primary market areas. Our underwriting standards require that residential real estate loans generally are owner-occupied and do not exceed 80% of the lower of appraised value at origination or cost of the underlying collateral. Terms typically range from 15 to 30 years. As part of our asset/liability management strategy, we may also sell originated residential real estate loans in the secondary market with no recourse and servicing released. In January 2024, we ceased the origination of residential real estate loans for the purpose of sales on the secondary market.

Real Estate Construction and Land Development

At December 31, 2023, we had $414.4 million, or 9.5% of our loans receivable, in real estate construction and land development loans, including residential construction loans and commercial and multifamily construction loans.

We originate residential construction loans for the construction of single-family custom homes where the homeowner is the borrower. We also provide financing to builders for the construction of pre-sold homes and speculative residential property. Because of the higher risks present in the residential construction industry, our lending to builders is limited to those who have demonstrated a favorable record of performance and who are building in markets that management understands. We further endeavor to limit our construction lending risk through adherence to strict underwriting guidelines and procedures. Speculative construction loans are short term in nature and have a variable rate of interest. We require builders to have tangible equity in each construction project; have prompt and thorough documentation of all draw requests; and we inspect the project prior to paying any draw requests.

Commercial and multifamily construction loans also have a higher risk because of the construction element and lease-up, if not pre-leased. As a result, this type of construction loan is made only to strong borrowers with sufficient equity into the

8

Table of Contents

project and additional resources they can draw on if needed. The Company performs due diligence to gain comfort that the experience of the general contractor is sufficient to finish the project on budget and on time. Project feasibility is also important and our lenders ensure the project is economically viable. Commercial and multifamily construction loans are monitored through cost reviews, regulatory-compliant appraisals, sufficient equity, engineering inspections and controlled disbursements.

Consumer

At December 31, 2023, we had $171.4 million, or 4.0% of our loans receivable, in consumer loans. We originate consumer loans and lines of credit that are both secured and unsecured. During the three months ended March 31, 2020, we ceased indirect auto and recreational vehicle loan originations, which are classified as consumer loans within loans receivable. These indirect consumer loans are secured by new and used automobile and recreational vehicles and were originated indirectly by established and well-known dealers located in our market areas. In addition, the indirect loans purchased were made to only prime borrowers. At December 31, 2023, we had $32.3 million, or 0.7% of our loans receivable, in indirect consumer loans remaining which is a decrease of $30.5 million or 48.6% from $62.9 million as of December 31, 2022.

See also, Item 1A. Risk Factors—Risks Related to Our Lending Activities.

Supervision and Regulation

We are subject to extensive regulation, and supervision under federal law and the laws of Washington State, which are both primarily intended to protect depositors and the FDIC, and not shareholders. Additionally, the Consumer Financial Protection Bureau is responsible for the implementation of the federal financial consumer protection and fair lending laws and regulations and has authority to impose new requirements.

Any change in applicable laws, regulations, or regulatory policies may have a material effect on our business, operations, and prospects. We cannot predict the nature or the extent of the effects on our business and earnings that any fiscal or monetary policies or new Federal or State laws may have in the future.

The following is a summary discussion of certain laws and regulations applicable to the Company and the Bank which is qualified in its entirety by reference to the actual laws and regulations.

Heritage Financial Corporation

As a bank holding company registered with the Federal Reserve, we are subject to comprehensive regulation and supervision by the Federal Reserve under the Bank Holding Company Act of 1956, as amended, and the regulations of the Federal Reserve. This regulation and supervision is generally intended to ensure that we limit our activities to those allowed by law and that we operate in a safe and sound manner without endangering the financial health of the Bank. We are required to file annual and periodic reports with the Federal Reserve and provide additional information as the Federal Reserve may require. The Federal Reserve may examine us, and any of our subsidiaries, and assess us for the cost of such examination.

The Federal Reserve has extensive enforcement authority over bank holding companies, including, among other things, the ability to assess civil money penalties, to issue cease and desist or removal orders, or require that a holding company divest subsidiaries (including its bank subsidiary). In general, enforcement actions may be initiated for violations of laws and regulations and unsafe or unsound practices. The Federal Reserve may also order termination of non-banking activities by non-banking subsidiaries of bank holding companies, or divestiture of ownership and control of a non-banking subsidiary by a bank holding company. Some violations may also result in criminal penalties.

Federal Reserve policy provides that a bank holding company is required to serve as a source of financial and managerial strength to its subsidiary banks. A bank holding company’s failure to meet its obligation to serve as a source of strength by providing financial assistance to a subsidiary bank in financial distress is generally considered by the Federal Reserve to be an unsafe and unsound banking practice or a violation of the Federal Reserve’s regulations or both.

As a bank holding company, we are required to obtain the prior approval of the Federal Reserve to acquire all, or substantially all, of the assets of any other bank or bank holding company. Prior Federal Reserve approval is required for any bank holding company to acquire direct or indirect ownership or control of any voting securities of any bank or bank holding company if, after such acquisition, the acquiring bank holding company would, directly or indirectly, own or control more than 5% of any class of voting shares of the bank or bank holding company. In addition to the approval of the Federal Reserve, prior approval may for such acquisitions also be necessary from other agencies including the FDIC, DFI and agencies that regulate the target. In July 2021, President Biden issued an Executive Order on Promoting Competition in the American Economy. Among other initiatives, the Executive Order encouraged federal banking agencies to review their current merger oversight practices and adopt a plan for revitalization of such practices. There are many steps that must be taken by the agencies before any formal changes to the framework for evaluating bank mergers can be finalized and the prospects for such action are uncertain at this time.

Under the prompt corrective action provisions of the Federal Deposit Insurance Act, a bank holding company with an undercapitalized subsidiary bank must guarantee, within limitations, the capital restoration plan that is required to be implemented for its undercapitalized subsidiary bank. If an undercapitalized subsidiary bank fails to file an acceptable capital restoration plan or fails to implement an accepted plan, the Federal Reserve may, among other restrictions, prohibit the bank holding company or its undercapitalized subsidiary bank from paying any dividend or making any other form of capital distribution without the prior approval of the Federal Reserve. Federal Reserve policy also provides that a bank holding company may pay cash dividends only to the extent that the company’s net income for the past year is sufficient to cover both the cash dividend and a rate of earnings retention that is consistent with the company’s capital needs, asset quality and overall financial condition.

9

Table of Contents

Bank regulations also require bank holding companies and banks to maintain minimum capital ratios and a capital conservation buffer. For additional information, see “Capital Adequacy” below. In addition, under Washington corporate law, a company generally may not pay dividends if, after that payment, the company would not be able to pay its liabilities as they become due in the usual course of business or its total assets would be less than its total liabilities.

Any subsidiaries which we may control are considered “affiliates” of the Company within the meaning of the Federal Reserve Act, and transactions between affiliates are subject to numerous restrictions. With some exceptions, we and our subsidiaries are prohibited from tying the provision of various products or services, such as extensions of credit, to other products or services offered by us, or our affiliates.

The stock of the Company is registered with the SEC under the Exchange Act. As such, the Company is subject to the information, proxy solicitation, insider trading restrictions and other requirements of the SEC under the Exchange Act.

Heritage Bank

The Bank is a Washington state-chartered commercial bank, the deposits of which are insured by the FDIC, and is subject to regulation by the FDIC and the DFI.

Applicable Federal and State statutes and regulations which govern a bank’s operations relate to minimum capital requirements, required reserves against deposits, investments, loans, legal lending limits, mergers and consolidation, borrowings, issuance of securities, payment of dividends, establishment of branches, privacy, anti-money laundering and other aspects of its operations, among other things. The DFI and the FDIC also have authority to prohibit banks under their supervision from engaging in what they consider to be unsafe and unsound practices.

The Bank is required to file periodic reports with the FDIC and is subject to periodic examinations and evaluations by the FDIC and the DFI. Based upon these evaluations, the regulators may revalue the assets of an institution and require that it establish specific reserves to compensate for the differences between the determined value and the book value of such assets. These examinations must be conducted at least every 12 months.

The Bank pays dividends to the Company. The FDIC and the DFI also have the general authority to restrict capital distributions by the Bank, including dividends paid by the Bank to the Company. Such restrictions are generally tied to the Bank’s capital levels after giving effect to such distributions. Our long-term ability to pay dividends to our stockholders is based primarily upon the ability of the Bank to make capital distributions to the Company. So long as the Bank remains “well-capitalized” after each capital distribution, and operates in a safe and sound manner, it is management's belief that the banking regulators will continue to allow the Bank to distribute its earnings to the Company, although no assurance can be given in this regard.

Capital Adequacy

The Federal Reserve and FDIC have issued substantially similar risk-based and leverage capital regulations applicable to bank holding companies and banks, respectively. In addition, these regulatory agencies may from time to time require that a bank holding company or bank maintain capital above the minimum levels, based on its financial condition or actual or anticipated growth. These regulations implement the regulatory capital reforms required by the Dodd-Frank Act and the Basel III requirements, a comprehensive capital framework and rules for U.S. banking organizations approved by the Federal Reserve Board and the FDIC in 2013.

Under these capital regulations, the minimum capital ratios are: (1) a common equity Tier 1 capital ratio of 4.5% of risk-weighted assets; (2) a leverage ratio (the ratio of Tier 1 capital to average total adjusted assets) of 4.0%; (3) a Tier 1 capital ratio of 6.0% of risk-weighted assets; and (4) a total capital ratio of 8.0% of risk-weighted assets. Common equity Tier 1 generally consists of common stock; retained earnings; AOCI unless an institution elects to exclude AOCI from regulatory capital; and certain minority interests; all subject to applicable regulatory adjustments and deductions. Tier 1 capital generally consists of common equity Tier 1 and noncumulative perpetual preferred stock. Tier 2 capital generally consists of other preferred stock and subordinated debt meeting certain conditions plus an amount of the allowance for credit losses up to 1.25% of risk-weighted assets. Total capital is the sum of Tier 1 and Tier 2 capital.

The Economic Growth, Regulatory Relief and Consumer Protection Act (“EGRRCPA”), enacted in May 2018, required the federal banking agencies, including the FDIC, to establish for institutions with assets of less than $10 billion a “community bank leverage ratio” or “CBLR” of between 8 to 10%. Institutions with capital meeting or exceeding the ratio and otherwise complying with the specified requirements (including off-balance sheet exposures of 25% or less of total assets and trading assets and liabilities of 5% or less of total assets) and electing the alternative framework are considered to comply with the applicable regulatory capital requirements, including the risk-based requirements. The CBLR was established at 9% Tier 1 capital to total average assets, effective January 1, 2020. A qualifying institution may opt in and out of the community bank leverage ratio framework on its quarterly call report. An institution that temporarily ceases to meet any qualifying criteria is provided with a two-quarter grace period to again achieve compliance. Failure to meet the qualifying criteria within the grace period or maintain a leverage ratio of 8% or greater requires the institution to comply with the generally applicable capital requirements. The Bank has not elected to use the CBLR framework as of December 31, 2023.

In addition to the minimum common equity Tier 1, Tier 1, leverage ratio and total capital ratios, the Company and the Bank must maintain a capital conservation buffer consisting of additional common equity Tier 1 capital greater than 2.5% above the required minimum risk-based capital levels in order to avoid limitations on paying dividends, repurchasing shares, and paying discretionary bonuses. To be considered "well capitalized," a bank holding company must have, on a consolidated basis, a Tier 1 risk-based capital ratio of 6.0% or greater and a total risk-based capital ratio of 10.0% or greater and must not be subject to an individual order, directive or agreement under which the Federal Reserve requires it to maintain a specific capital level. To be considered “well capitalized,” a depository institution must have a common equity Tier 1 capital ratio of at least 6.5%, a leverage

10

Table of Contents

ratio of at least 5%, a Tier 1 risk-based capital ratio of at least 8%, a total risk-based capital ratio of at least 10% and not be subject to an individualized order, directive or agreement under which its primary federal banking regulator requires it to maintain a specific capital level.

The Company’s and the Bank's required and actual capital levels as of December 31, 2023 are listed in Note (20) Regulatory Capital Requirements of the Notes to Consolidated Financial Statements included in Item 8. Financial Statements And Supplementary Data.

Prompt Corrective Action

Federal statutes establish a supervisory framework for FDIC-insured institutions based on five capital categories: well capitalized, adequately capitalized, undercapitalized, significantly undercapitalized and critically undercapitalized. An institution’s category depends upon where its capital levels are in relation to relevant capital measures. The well capitalized category is described in the Capital Adequacy section above. An institution that is not well capitalized is subject to certain restrictions on brokered deposits, including restrictions on the rates it can offer on its deposits. To be considered adequately capitalized, an institution must have the minimum capital ratios described in the Capital Adequacy section above. Any institution which is neither well capitalized nor adequately capitalized is considered undercapitalized.

Undercapitalized institutions are subject to certain prompt corrective action requirements, regulatory controls and restrictions which become more extensive as an institution becomes more severely undercapitalized. Failure by a bank to comply with applicable capital requirements would result in progressively more severe restrictions on its activities and lead to enforcement actions, including, but not limited to, the issuance of a capital directive to ensure the maintenance of required capital levels and, ultimately, the appointment of the FDIC as receiver or conservator. Banking regulators will take prompt corrective action with respect to depository institutions that do not meet minimum capital requirements. Additionally, approval of any regulatory application filed for their review may be dependent on compliance with capital requirements.

As of December 31, 2023, the Company and the Bank met all minimum capital requirements and the most recent regulatory notifications categorized the Bank as well capitalized under the regulatory framework for prompt corrective action. See Note (20) Regulatory Capital Requirements of the Notes to Consolidated Financial Statements included in Item 8. Financial Statements And Supplementary Data.

Commercial Real Estate Transactions

The federal banking agencies have issued guidance on sound risk management practices for concentrations in commercial real estate lending. The particular focus is on exposure to commercial real estate loans that are dependent on the cash flow from the real estate held as collateral and that are likely to be sensitive to conditions in the commercial real estate market (as opposed to real estate collateral held as a secondary source of repayment or as an abundance of caution). The purpose of the guidance is not to limit a bank’s commercial real estate lending but to guide banks in developing risk management practices and maintaining capital levels commensurate with the level and nature of real estate concentrations. A bank that has experienced rapid growth in commercial real estate lending, has notable exposure to a specific type of commercial real estate loan, or is approaching or exceeding the following supervisory criteria may be identified for further supervisory analysis with respect to real estate concentration risk: total loans for construction, land development, and other land represent 100% or more of the bank’s total capital; or total commercial real estate loans (as defined in the guidance) greater than 300% of the Bank’s total capital and an increase in the bank’s commercial real estate portfolio of 50% or more during the prior 36 months.

The guidance provides that the strength of an institution’s lending and risk management practices with respect to such concentrations will be considered in supervisory guidance on evaluation of capital adequacy. As of December 31, 2023, the Bank’s aggregate recorded loan balances for construction, land development and land loans were 53% of regulatory capital. In addition, at December 31, 2023, the Bank’s loans on commercial real estate, as defined by the FDIC, were 271% of regulatory capital.

Deposit Insurance and Other FDIC Programs

The deposits of the Bank are insured up to $250,000 per separately insured category by the Deposit Insurance Fund, which is administered by the FDIC. The FDIC is an independent federal agency that insures the deposits, up to applicable limits, of depository institutions. As insurer of the Bank's deposits, the FDIC has supervisory and enforcement authority over the Bank and this insurance is backed by the full faith and credit of the United States government. As insurer, the FDIC imposes deposit insurance assessments and is authorized to conduct examinations of and to require reporting by institutions insured by the FDIC. It also may prohibit any FDIC-insured institution from engaging in any activity determined by regulation or order to pose a serious risk to the institution and the Deposit Insurance Fund. The FDIC also has the authority to initiate enforcement actions and may terminate the deposit insurance if it determines that an institution has engaged in unsafe or unsound practices or is in an unsafe or unsound condition.

Deposit insurance assessments are based on the average consolidated total assets less tangible equity capital of a financial institution. In addition, the Dodd-Frank Act set the minimum designated reserve ratio of the Deposit Insurance Fund at 1.35%, required the FDIC to set a target for the ratio each year, and eliminated the requirement that the FDIC pay dividends to insured depository institutions when the ratio exceeds certain thresholds. The FDIC set the target ratio at 2.0% and adopted a plan to achieve that target ratio. Currently, total base assessment rates range from 1.5 to 40 basis points on an annualized basis, subject to certain adjustments. Under current regulations, the ranges of assessment rates are scheduled to decrease as the ratio increases in increments above 2.0%. No institution may pay a dividend if it is in default on its deposit insurance assessment.

In October 2022, the FDIC finalized a rule that will increase the initial base deposit insurance assessment rates by 2 basis points, beginning with the first quarterly assessment period of 2023 (January 1, 2023 through March 31, 2023). The FDIC,

11

Table of Contents

as required under the Federal Deposit Insurance Act, established a plan in September 2020 to restore the Deposit Insurance Fund reserve ratio to meet or exceed the statutory minimum of 1.35 percent within eight years. This plan did not include an increase in the deposit insurance assessment rate. Based on the FDIC’s recent projections, however, the FDIC determined that the Deposit Insurance Fund reserve ratio is at risk of not reaching the statutory minimum by the statutory deadline of September 30, 2028 without increasing the deposit insurance assessment rates. The increased assessment would improve the likelihood that the Deposit Insurance Fund reserve ratio would reach the required minimum by the statutory deadline, consistent with the FDIC’s Amended Restoration Plan. The FDIC also concurrently maintained the Designated Reserve Ratio (“DDR”) for the Deposit Insurance Fund at 2 percent for 2023. The new assessment rate schedules will remain in effect unless and until the reserve ratio meets or exceeds 2 percent in order to support growth in the Deposit Insurance Fund in progressing toward the FDIC’s long-term goal of a 2 percent DRR. Progressively lower assessment rate schedules will take effect when the reserve ratio reaches 2 percent, and again when it reaches 2.5 percent. The revised assessment rate schedule will remain in effect unless and until the reserve ratio meets or exceeds 2 percent, absent further action by the FDIC.

In November 2023, the FDIC issued a Final Rule on Special Assessment Pursuant to Systemic Risk Determination to implement a special assessment to recover the loss to the Deposit Insurance Fund (DIF) associated with protecting uninsured depositors following the closures of Silicon Valley Bank and Signature Bank. The assessment base for the special assessment is equal to an insured depository institution’s (IDI’s) estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion. The Company did not have more than $5 billion in uninsured deposits as of December 31, 2022 and therefore is not subject to this special assessment.

Bank Secrecy Act / Anti-Money Laundering Laws

The Bank is subject to the Bank Secrecy Act and other anti-money laundering laws and regulations, including the USA PATRIOT Act of 2001. These laws and regulations require the Bank to implement policies, procedures, and controls to detect, prevent, and report money laundering and terrorist financing and to verify the identity of their customers. Violations of these requirements can result in substantial civil and criminal sanctions. In addition, provisions of the USA PATRIOT Act require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution's anti-money laundering activities when reviewing mergers and acquisitions.

Privacy Standards and Cybersecurity

The Bank is subject to federal regulations implementing the privacy protection provisions of the Gramm-Leach-Bliley Financial Services Modernization Act of 1999. These regulations require the Bank to disclose its privacy policy, including informing consumers of their information sharing practices and informing consumers of their rights to opt out of certain practices. In addition, on November 18, 2021, the federal banking agencies announced the adoption of a final rule providing for new notification requirements for banking organizations and their service providers for significant cybersecurity incidents. Specifically, the new rule requires a banking organization to notify its primary federal regulator as soon as possible, and no later than 36 hours after, the banking organization determines that a “computer-security incident” rising to the level of a “notification incident” has occurred. Notification is required for incidents that have materially affected or are reasonably likely to materially affect the viability of a banking organization’s operations, its ability to deliver banking products and services, or the stability of the financial sector. Service providers are required under the rule to notify affected banking organization customers as soon as possible when the provider determines that it has experienced a computer-security incident that has materially affected or is reasonably likely to materially affect the banking organization’s customers for four or more hours.

Further, on July 26, 2023, the SEC adopted final rules that require public companies to promptly disclose material cybersecurity incidents in a Current Report on Form 8-K (“Form 8-K”) and detailed information regarding their cybersecurity risk management and governance on an annual basis in an Annual Report on Form 10-K (Form 10-K”). Companies will be required to report on Form 8-K any cybersecurity incident they determine to be material within four business days of making that determination. See Item 1C. Cybersecurity for annual disclosures.

Other Regulatory Developments

Community Reinvestment Act. On October 24, 2023, the federal banking agencies, including the FDIC issued a final rule designed to strengthen and modernize regulations implementing the Community Reinvestment Act (CRA). The changes are designed to encourage banks to expand access to credit, investment and banking services in low and moderate income communities, adapt to changes in the banking industry including mobile and internet banking, provide greater clarity and consistency in the application of the CRA regulations and tailor CRA evaluations and data collection to bank size and type. The Bank cannot predict the impact the changes the new CRA rule will have on its operations at this time.

Website Access to Company Reports

We post publicly available reports required to be filed with the SEC on our website, www.hf-wa.com, as soon as reasonably practicable after filing such reports. The required reports are available free of charge through our website.

Code of Ethics

We have adopted a Code of Ethics that applies to our principal officers. We have posted the text of our Code of Ethics at www.hf-wa.com in the section titled Overview: Governance Documents. Any significant changes or waivers of the Code of Ethics will be publicly disclosed to shareholders.

Competition

We compete for loans and deposits with other commercial banks, credit unions, mortgage bankers, and other providers of financial services, including finance companies, online-only banks, mutual funds, insurance companies, and more recently

12

Table of Contents

with financial technology companies that rely on technology to provide financial services. Many of our competitors have substantially greater resources than we do. Particularly in times of high or rising interest rates, we also face significant competition for investors’ funds from short-term money market securities and other corporate and government securities.

We compete for loans principally through the range and quality of the services we provide, interest rates and loan fees, and robust delivery channels for our products and services. We actively solicit deposit-related clients and compete for deposits by offering depositors high touch service on a variety of savings accounts, checking accounts, cash management and other services.

Human Capital

Our Culture and Our People

The Company's success depends on the success of its people, and we are dedicated to fostering employee empowerment through robust human capital and talent management. Our strong culture, built upon a clear mission and values, unites employees at all levels of the Company towards a common goal, enabling them to reach their full potential.

Diversity, Equity, Inclusion (“DEI”)

We recognize and appreciate the importance of creating an environment where all employees feel valued, included, and empowered to do their best work. Recognizing the unique perspectives each employee brings, we value their contributions to making us the leading commercial community bank in the Pacific Northwest.

To advance DEI, we have a comprehensive plan, a DEI Officer certified by the National Diversity Council (“NDC”), and a dedicated Diversity Council. The Diversity Council, comprising diverse employees collaborating closely with senior leaders, ensures DEI initiatives align with our strategic goals. Both our Chief Executive Officer and Executive Vice President Chief Human Resources Officer serve as executive sponsors to the Diversity Council. The Diversity Council plays a crucial role in driving organizational change and prioritizing diversity, equity, and inclusion.

Our executive management team and Board of Directors have undergone instructor-led, customized DEI training. All employees receive ongoing diversity training. In 2023, the NDC recognized our community outreach and corporate social responsibility efforts, rating us among the best companies for diversity.

The objectives of the Company's DEI plan include:

•Workforce Diversity: Recruit from a diverse, qualified group of potential applicants to secure a high-performing workforce drawn from all segments of the communities we serve.

•Workplace Inclusion: Promote a culture that encourages collaboration, flexibility, and fairness to enable individuals to contribute to their full potential.

•Sustainability: Develop structures and strategies to equip leaders with the ability to manage diversity, be accountable, measure results, refine approaches on the basis of such data and foster a culture of inclusion.

In 2023, we strengthened the integration of DEI goals into our hiring practices. Our recruiting team achieved certification as “Diversity and Inclusion Recruiters” after completing the Advanced Internet Recruitment Strategies (“AIRS”) program. We also introduced "Interview and Selection" training during 2023 to address and mitigate unconscious bias in hiring decisions. This initiative resulted in an enhanced diversity representation across the organization, with 37% of new hires in 2023 coming from Underrepresented Minority Groups (“URG”), compared to 31% in 2022.

Additionally, the Company enlisted an external consultant in 2023 to provide inclusive leadership training to its managers. This training, offering insights into diversity, inclusion, and identity, has been incorporated into the mandatory curriculum for new managers. All employees receive quarterly "Inclusion Insights" training, and "Lunch & Learn" sessions are open to all, encouraging ongoing discussions on these crucial topics.

Demographics

As of December 31, 2023, the Company employed 764 full-time and 35 part-time employees across Washington, Oregon, and Idaho. The Company also had six employees who were working remotely in other states. No employees are represented by a collective bargaining agreement. During 2023, we hired 145 regular full-time and part-time employees. Voluntary workforce turnover (rolling 12-month attrition) was 16.6%, compared to 19.4% in 2022. Our average overall tenure was 7.1 years. The average tenure of management was 9.9 years.

The following tables illustrate workforce demographics by job group (Note: “Director” refers to director-level management positions within the organization, not the Board of Directors) as of December 31, 2023:

Organizational Level Female (%) Male (%)

13

Table of Contents

Organizational Level Underrepresented Groups (%) White (%)

Communication and Listening

The Company strives to maintain an environment of open communication, facilitating access to senior management through initiatives like quarterly virtual “All Banker Calls,” monthly updates for Company leaders, and orientation sessions led by the Chief Executive Officer and the President/COO for new hires. To further enhance our “listening culture,” we utilize a survey platform to allow employees to share feedback directly with leadership, including an annual employee engagement survey and periodic pulse surveys. Survey results, shared with employees, executive leadership and the Board, guide actions at both the corporate and departmental levels. In recognition of our commitment to employee engagement, the Company earned a spot among the top 100 Best Places to Work in Washington and Oregon by the Puget Sound and Portland Business Journals based on the 2023 employee engagement survey.

Our commitment to open communication extends to providing employees with avenues for confidential and anonymous reporting. We offer a whistleblower hotline/website, enabling employees to report financial and workplace concerns to key leadership, including the Board Chair, Audit Committee Chair, Chief Executive Officer, Chief Operations Officer, Chief Risk Officer and Chief Human Resources Officer. Additionally, our Company intranet hosts an "Idea Bank," allowing employees to submit new ideas or recommendations directly to executive management.

Talent Development and Succession

Developing employees for future growth and professional development is a vital corporate activity crucial to our long-term success. The Company views its employees as our most important assets, which makes training and professional development a worthy investment. We offer an array of learning opportunities through virtual and in-house courses via “Heritage Bank University.” Additionally, we sponsor courses from external providers such as Blanchard, Risk Management Association, Archbright, Jennifer Brown Consulting, Washington Bankers Association, Oregon Bankers Association, and the Pacific Coast Banking School.

We offer situational leadership training for leaders that focuses on communication and employee engagement and endorse coaching using the tools from this program. All employees are required to complete an extensive series of quarterly digital training courses focused on bank regulatory compliance, ethics, workplace safety, security, fraud awareness and prevention and other interpersonal or leadership topics. An interactive leadership roadmap is available to assist future leaders in their career development. Heritage Bank University has been recognized as a “Champion of Learning” by The Association for Talent Development for its commitment to employee learning.

In 2023, the Company launched an online succession planning tool to further identify next-generation leaders and establish development plans for these individuals. Over time, we expect this process to increase generational representation across all levels, including leadership positions. As of December 31, 2023, the Company’s generational representation consisted of 20% Baby Boomers, 39% Gen X-ers, 33% Millennials, and 8% Gen Z-ers. Management and the Board review leadership succession annually.

Recognition and appreciation

We host “Celebrate Great,” an active internal peer recognition platform enabling managers and employees to express appreciation and recognize their co-workers and teams. Throughout 2023, more than 6,000 e-cards were posted on Celebrate Great, with 44 individuals or teams receiving “Bravo” awards and seven employees receiving “Standing Ovation” awards for their exceptional work. The Company celebrates employees achieving milestone anniversaries or upon retirement with a personalized yearbook and special gift.

Compensation, Benefits and Pay Equity

Offering competitive compensation and benefit programs is critical to attracting and retaining top talent in our highly competitive market areas. Employees are generally eligible for a base pay review at least once a year or upon promotion or transfer. Our hiring practices prioritize pay transparency, with job postings disclosing the pay range minimum and maximum, as well as the benefits package, and we refrain from requesting salary history from job applicants. We collaborate with a third-party consultant annually to evaluate hiring, promotion, and other pay practices to ensure continued equity and fairness.

Incentive plan goals and results are aligned with strategic Company objectives and are approved by the Board Compensation Committee. Further alignment is achieved by having similar corporate performance metrics cascade through most executive, management, and employee annual incentive plans.

Employees working a minimum of 20 hours per week are eligible for most benefit plans, including a 401(k) Plan with an employer matching contribution, medical, dental and vision insurance, life and long-term disability insurance, public transit passes, paid parking, and paid time off. Further, full-time employees enjoy up to 11 paid holidays each year and receive an

14

Table of Contents

annual floating holiday to be used at their discretion. Employees also accrue up to 12 days of paid sick time per year for personal use or to care for a family member. Both full-time and part-time employees accrue vacation time ranging from two and five weeks, dependent on factors such as position and tenure.

Employee Wellness and Wellbeing

Our corporate culture places a strong emphasis on the wellbeing of our employees, recognizing its pivotal role in cultivating a vibrant and productive workforce. To support holistic wellbeing, we offer a range of resources.

Through our Employee Assistance Program, employees receive counseling and referral services to address challenges both at work and at home. This includes mental health counseling, financial planning, basic legal advice, and dependent/elder care referrals, all at no cost to them or their household members. Additional wellness benefits are available through the Company's medical insurance plans. Moreover, enrolled members can take advantage of mental health apps, weight loss and fitness programs, smoking cessation programs, and various online resources, all provided at no extra cost.

To alleviate workplace stress and burnout, the Company hosts a "no meetings week" at the start of each quarter. This dedicated time allows managers and employees to engage in purposeful planning, catch up on tasks, and reduce stress. By incorporating these breaks, employees can participate in strategic planning, creative thinking, and collaborative efforts without the constraints of scheduled meetings, ultimately contributing to a more innovative and healthier work environment.

Community Involvement

As a community bank, we are committed to supporting the communities where we operate, and we actively encourage and support our employees to do the same. In 2022, the Company implemented an annual volunteer event, during which the Bank closes for half a day, providing employees with a paid opportunity to volunteer in teams at various community organizations within our operating footprint. Our 2023 volunteer day event involved over 600 employees volunteering approximately 1,770 hours to more than 50 organizations in Washington, Oregon, and Idaho. To further facilitate community involvement, employees receive a minimum of eight additional hours of paid time off each year specifically to use for volunteer activities of their choice.

Heritage Bank also participated in a 2023 EcoChallenge, where 28 teams of employees engaged in friendly competition by undertaking environmentally sustainable actions and practices. Challenges involved activities such as reducing waste, conserving energy, and adopting eco-friendly lifestyle habits. The collective efforts of the EcoChallenge resulted in 9,673 actions, contributing to a heightened awareness of environmental responsibility, fostering a sense of community engagement, and reinforcing a shared commitment to sustainability.

Executive Officers

The following table sets forth information with respect to executive officers of the Company at December 31, 2023:

Name Age as ofDecember 31, 2023 Position Has Servedthe Company or Bank Since

The business experience of each executive officer is set forth below.

Jeffrey J. Deuel is the President and Chief Executive Officer of the Company and Chief Executive Officer of the Bank. Mr. Deuel was promoted to President and Chief Executive Officer of the Bank and President of the Company effective July 2018 and then promoted to President and Chief Executive Officer of the Company effective July 2019. Mr. Deuel was promoted to President and Chief Operating Officer of the Bank and Executive Vice President of the Company in September 2012. In November 2010, Mr. Deuel was named Executive Vice President and Chief Operating Officer of the Bank and Executive Vice President of the Company. Mr. Deuel joined the Bank in February 2010 as Executive Vice President. Prior to joining the Company and the Bank, Mr. Deuel held the position of Executive Vice President Commercial Operations with JPMorgan Chase, formerly Washington Mutual. Prior to joining Washington Mutual, Mr. Deuel was based in Philadelphia where he worked for Bank United, First Union Bank, CoreStates Bank, and First Pennsylvania Bank. During his career Mr. Deuel held a variety of leadership positions in commercial banking including lending, credit administration, portfolio management, retail, corporate strategies, and support services. He earned his Bachelor’s degree at Gettysburg College.

15

Table of Contents

Bryan D. McDonald is an Executive Vice President of the Company and the President and Chief Operating Officer of the Bank. Mr. McDonald joined the Bank as an Executive Vice President and Chief Lending Officer in connection with the Company’s acquisition of Washington Banking Company and its wholly owned banking subsidiary, Whidbey Island Bank, effective May 1, 2014. Mr. McDonald was promoted to Executive Vice President of the Company and Executive Vice President and Chief Operating Officer of the Bank effective July 1, 2018 and then promoted to President and Chief Operating Officer of the Bank effective July 1, 2021. Previously, Mr. McDonald held the position of President and Chief Executive Officer of Whidbey Island Bank from January 2012 to May 2014. He joined Whidbey Island Bank in 2006 as Commercial Banking Manager and was promoted to Chief Operating Officer in 2010. Mr. McDonald has extensive managerial experience in various sales, credit, operations, commercial banking and residential real estate areas. Before joining the team at Whidbey Island Bank, he was Snohomish and King County Business Group Manager where he was responsible for developing all aspects of Peoples Bank's commercial banking operation in King and Snohomish counties. Mr. McDonald is on the Washington Bankers Association Board and the American Bankers Association Government Relations Council. Mr. McDonald holds a Bachelor's degree in Management and a Master's degree in Business Administration from Washington State University. He is also a graduate of the Pacific Coast Banking School.

Donald J. Hinson serves as Executive Vice President and Chief Financial Officer of the Company and the Bank, positions he has held since September 2012. From 2007 to 2012, he was Senior Vice President and Chief Financial Officer of the Company and the Bank. Mr. Hinson joined the Company and the Bank in 2005 as Vice President and Controller. Prior to that, he served in the banking audit practice of local and national accounting firms of Knight, Vale and Gregory and RSM McGladrey from 1994 to 2005. Mr. Hinson holds a Bachelor's degree in Accounting from Central Washington University and a Bachelor's degree in Psychology from Western Washington University.

Tony W. Chalfant became Executive Vice President and Chief Credit Officer of the Company and the Bank in July 2020. Previously, Mr. Chalfant held the title of Senior Vice President and Deputy Chief Credit Officer of the Bank since July 2019. Prior to that, he served as a Regional Credit Officer since January 2018 when the Bank acquired Puget Sound Bank. Mr. Chalfant served as the Chief Credit Officer for Puget Sound Bank for 13 years. Prior to joining Puget Sound Bank, Mr. Chalfant held commercial lending and leadership positions with U.S. Bank for 11 years. Mr. Chalfant started his career with the U.S. Office of Comptroller of the Currency, working there for eight years. Mr. Chalfant obtained his Bachelor's degree in Finance and Economics from Washington State University and is a graduate of the Pacific Coast Banking School.

Matthew T. Ray is the Executive Vice President and Chief Lending Officer of the Bank. Mr. Ray joined the Bank in 2010 and was most recently promoted to his current position of Executive Vice President and Chief Lending Officer in January 2023. Previously, Mr. Ray held the title of Senior Vice President and Market President of the Bank from January 2018 to December 2022. Since joining the Bank, he has held leadership positions as the commercial banking team leader, regional manager and market president. In addition, he has led the consumer, mortgage, SBA and small business lending divisions. Mr. Ray has more than 25 years of experience in sales, credit, operations, commercial banking and residential real estate. He holds a Bachelor's degree in Business Administration-Finance from Northwestern College and is also a graduate of Pacific Coast Banking School. He currently serves on the Board of Directors for Chinook Enterprises.

ITEM 1A. RISK FACTORS

We assume and manage a certain degree of risk in order to conduct our business strategy. In addition to the risk factors described below, other risks and uncertainties not specifically mentioned, or that are currently known to, or deemed to be immaterial by management, also may materially and adversely affect our financial condition, results of operations and/or cash flows. Before making an investment decision, you should carefully consider the risks described below together with all of the other information included in this Form 10-K and our other filings with the SEC. If any of the circumstances described in the following risk factors actually occur to a significant degree, the value of our common stock could decline, and you could lose all or part of your investment. This Form 10-K is qualified in its entirety by these risk factors.

Risks Related to our Lending Activities

Repayment of our commercial business loans, consisting of commercial and industrial loans as well as owner-occupied and non-owner occupied commercial real estate loans, is often dependent on the cash flows of the borrower, which may be unpredictable, and the collateral securing these loans may fluctuate in value.

We offer a variety of commercial business loans across various industries such as real estate, healthcare, accommodation and food services, retail trade and construction. Our primary loan offerings comprise lines of credit, term equipment financing, and term real estate loans. Additionally, we facilitate loans guaranteed by the SBA, holding the designation of a “preferred lender” by the SBA. Commercial business lending involves distinct risks compared to residential real estate lending. Our commercial business loans are primarily made based on our assessment of the cash flow of the borrower and secondarily on the underlying collateral provided by the borrower. The unpredictability of a borrower's cash flow and the potential fluctuations in collateral values underscore the inherent risks in these loans. While our commercial business loans are often collateralized by equipment, inventory, accounts receivable or other business assets, the liquidation of collateral in the event of default is often an insufficient source of repayment because accounts receivable may be uncollectible and inventories may be obsolete or of limited use, among other things. Accordingly, the repayment of commercial business loans primarily relies on the borrower’s cash flow and creditworthiness, supplemented by the underlying collateral.

At December 31, 2023, our commercial business loans totaled $3.37 billion, or 77.8% of our total loan portfolio, of which $4.5 million, or 0.1% of commercial business loans were classified as nonaccrual. Within commercial business loans, agricultural

16

Table of Contents

loans totaled $65.7 million, or 1.5% of our total loan portfolio and 1.9% of our commercial business loans at December 31, 2023 of which $825,000, or 1.3% of agricultural loans were classified as nonaccrual loans.

Our portfolio encompasses owner and non-owner occupied commercial real estate loans, including multifamily residential real estate loans. These loans often involve higher principal amounts compared to other loan types, and their repayment may be contingent on factors beyond our or our borrowers' control.

We originate commercial real estate loans for individuals and businesses, which are secured by commercial properties. These loans typically involve higher principal amounts than other types of loans and repayment is dependent upon income generated, or expected to be generated, by the property securing the loan in amounts sufficient to cover operating expenses and debt service, which may be adversely affected by changes in the economy or local market conditions. For example, if the project's cash flow diminishes due to unobtained or unrenewed leases, the borrower’s capacity to repay the loan could be impaired. Additionally, many of these loans have adjustable rates and reprice periodically. A significant increase in rates could increase the payment amount and could impact the borrower’s ability to repay the loan.

Commercial real estate lending also exposes us to greater credit risk than loans secured by residential real estate. Typically, the collateral securing these loans is not as easily liquidated as residential properties. In addition, many of our commercial real estate loans are not fully amortizing and contain large balloon payments upon maturity. Such balloon payments may require the borrower to either sell or refinance the underlying property, potentially elevating the risk of default or non-payment. If we foreclose on a commercial real estate loan, our holding period for the collateral typically is longer compared to residential real estate loans due to fewer potential purchasers. Additionally, commercial real estate loans generally have relatively large balances to single borrowers or related groups of borrowers, magnifying the impact of any errors in judgment regarding their collectability. Consequently, resulting charge-offs per loan may be larger than those incurred with our residential or consumer loan portfolios.

As of December 31, 2023, our owner and non-owner occupied commercial real estate loans totaled $2.66 billion, or 61.2% of our total loan portfolio, of which $205,000 were classified as nonaccrual.

Our real estate construction and land development loans are based upon estimates of costs and net operating income and the related value associated with the completed project. These estimates may be inaccurate.

Construction lending involves additional risks when compared with permanent commercial and residential real estate lending because funds are advanced upon the collateral for the project based on an estimate of costs to produce a future project value at completion. Estimating construction costs, the project's market value upon completion, and the impact of regulatory changes on real property involve inherent uncertainties. Accurately evaluating the total funds required for a project and the resulting loan-to-value ratio upon completion is challenging. Unforeseen changes in demand or higher building costs may significantly deviate from initial estimates. This type of lending also typically involves large loan principal amounts and may be concentrated among a limited number of builders. A downturn in the housing or the real estate market could increase delinquencies, defaults and foreclosures, significantly impairing the value of our collateral and our ability to sell it upon foreclosure. Further, some borrowers have multiple loans outstanding with us, exposing us to higher risk if one credit relationship encounters adverse developments. .

Construction loans often involve the disbursement of funds with repayment substantially dependent on the success of the ultimate project and the ability of the borrower to sell or lease the property or obtain permanent take-out financing, rather than the ability of the borrower or guarantor to repay principal and interest. If our appraisal of the value of a completed project proves to be overstated, we may have inadequate security for the repayment of the loan upon completion of construction of the project and may incur a loss. Because construction loans require active monitoring of the building process, including cost comparisons and on-site inspections, these loans are more difficult and more costly to monitor. Increases in market rates of interest can significantly impact construction loans, escalating end-purchasers' borrowing costs and potentially hindering project financing or reducing overall demand for the project. Moreover, properties under construction are often difficult to sell and typically must be completed to be successfully sold, complicating the resolution of problematic construction loans. This may require us to advance additional funds and/or contract with another builder to complete construction and assume the market risk of selling the project at a future market price, which may or may not enable us to fully recover unpaid loan funds and associated construction and liquidation costs. In the case of speculative construction loans, there is added risk associated with identifying an end-tenant or end-purchaser for the finished project. Land development loans also pose additional risk because of the lack of income being produced by the property and potentially illiquid nature of the collateral. These risks can be significantly impacted by supply and demand conditions.

As of December 31, 2023, our real estate construction and land development loans totaled $414.4 million, or 9.5% of our total loan portfolio, of which $78.6 million, or 1.8% of our total loan portfolio, were residential construction and $335.8 million, or 7.7% of our total loan portfolio, were commercial and multifamily construction. All of these loans were performing in accordance with their repayment terms as of December 31, 2023.

Our ACL on loans may prove to be insufficient to absorb losses in our loan portfolio.

Lending money is a substantial part of our business. Every loan carries a certain risk that it will not be repaid in accordance with its terms or that any underlying collateral will not be sufficient to assure repayment. This risk is affected by, among other things:

•the cash flow of the borrower, guarantors and/or the project being financed;

•the changes and uncertainties as to the future value of the collateral, in the case of a collateralized loan;

•the character and creditworthiness of a particular borrower or guarantor;

17

Table of Contents

•changes in economic and industry conditions; and

•the duration of the loan.

The ACL on loans is a valuation account that is deducted from the amortized cost of loans receivable to present the net amount expected to be collected. Loans are charged-off through the ACL on loans when management believes the uncollectibility of a loan balance is considered probable. Subsequent recoveries, if any, are recorded to the ACL on loans. The Company records the changes in the ACL on loans through earnings as a "Provision for (reversal of) credit losses" on the Consolidated Statements of Income.

The determination of the appropriate level of ACL on loans inherently involves a high degree of subjectivity and requires us to make significant estimates of current credit risks and future trends, all of which may undergo material changes. If our estimates are incorrect, the ACL on loans may not be sufficient to cover expected losses in our loan portfolio, resulting in the need for increases in our ACL on loans through the provision for credit losses. Management also recognizes that significant new growth in loan segments and new loan products can result in loans segments comprised of unseasoned loans that may not perform in a historical or projected manner and will increase the risk that our ACL on loans may be insufficient to absorb losses without significant additional provisions.

Deterioration in economic conditions affecting borrowers, new information regarding existing loans, identification of additional problem loans and other factors, both within and outside of our control, may require an increase in the ACL on loans. If current conditions in the housing and real estate markets weaken, we expect we will experience increased delinquencies and credit losses. Bank regulatory agencies also periodically review our ACL on loans and may require an increase in the provision for credit losses or the recognition of further loan charge-offs, based on their judgments about information available to them at the time of their examination. In addition, if charge-offs in future periods exceed the ACL on loans, we will need additional provisions to increase the ACL on loans. Any increases in the allowance for credit losses will result in a decrease in net income and, most likely, capital, and may have a material negative effect on our financial condition and results of operations.

Risks Related to our Business Strategy

Our strategy of pursuing acquisitions and de novo branching exposes us to financial and operational risks that could adversely affect us.

As part of our business strategy, we seek to supplement our organic growth by acquiring other financial institutions or their businesses to achieve our strategic objectives and bolster earnings. However, this strategy entails several risks:

•Acquired banks or businesses might carry unforeseen asset quality issues or contingent liabilities. If these exceed our estimates, it could significantly impact our financial condition and operational results;

•There is a risk of higher-than-anticipated deposit attrition following an acquisition, potentially affecting our funding base;

•The acquisition process may divert our management's time and attention, impacting day-to-day operations and strategic initiatives;

•Acquired entities might have known or unknown regulatory compliance deficiencies, exposing us to associated risks;

•Market conditions can influence acquisition prices. Difficulty in making acceptable-priced acquisitions in specific markets could affect our growth strategy;

•The integration of systems, procedures, and personnel from acquired entities into our company is complex and time-consuming. It can disrupt the acquired business and its customer base, potentially leading to customer and employee losses if not managed effectively;

•Financing acquisitions using borrowed funds will increase our leverage and diminish our liquidity. Raising additional capital to finance acquisition could dilute existing shareholders’ interests;

•Sustaining our historical growth rate may be difficult due to market constraints and/or acquisition complexities. We have completed eight acquisitions from 2006 through 2018, which has enhanced our growth rate over the years;

•While our acquisitions and branching activities are expected to boost net income, they might also increase general and administrative expenses initially, potentially affecting our efficiency ratios. Successful integration is crucial for achieving expected efficiencies. If we are unsuccessful in our integration process, this may not occur, and our acquisitions or branching activities may not be accretive to earnings in the short or long-term;

•When acquisition costs exceed the fair value of the net assets acquired, goodwill is recorded. Any future impairment of goodwill could adversely affect our financial condition. See, the risk factor titled “We may experience future goodwill impairment, which could reduce our earnings” below; and

•Acquired loans are recorded at fair value, which may differ from their outstanding balance. Changes in yields and replacement of high-yielding loans can impact our net interest margins and interest income over time.

Our financial condition and results of operations could be negatively affected if we fail to execute our growth strategy or manage our growth effectively.

Our intention is to supplement our growth through selective acquisitions of financial institutions, including branch expansions, and other growth opportunities. However, there is no guarantee that we will identify suitable opportunities or effectively negotiate and finance these activities. Even if undertaken, the success of such undertakings cannot be assured.

Our growth initiatives may require us to recruit experienced personnel to assist in such initiatives, which will increase our compensation costs. In addition, the failure to identify and retain such personnel would place significant limitations on our ability to successfully execute our growth strategy. To the extent we expand our lending beyond our current market areas, we could also incur additional risk related to those new market areas. We may not be able to expand our market presence in our existing market areas or successfully enter new markets.

18

Table of Contents

Inability to execute our acquisition-focused growth plan might adversely affect various aspects of our business, including finances, operations, reputation, and growth prospects. While we believe in the strength of our executive management and internal systems to manage growth, there can be no assurance that suitable growth opportunities will be available or that we will successfully manage our growth.

Risks Related to Economic Conditions

The current economic condition in the market areas we serve may adversely impact our earnings and could increase the credit risk associated with our loan portfolio.

Substantially all of our loans are to businesses and individuals in the states of Washington, Oregon and Idaho. A return of recessionary conditions or adverse economic conditions in the primary market areas of the Pacific Northwest in which we operate could reduce our rate of growth, affect our customers' ability to repay loans and have a material adverse effect on our business, financial condition, and results of operations. General economic conditions, including inflation, unemployment and money supply fluctuations, also may adversely affect our profitability. Weakness in the global economy and global supply chain issues have adversely affected many businesses operating in our markets that are dependent upon international trade. Changes in agreements or relationships between the United States and other countries may also affect these businesses.

A deterioration in economic conditions in our market areas of the Pacific Northwest as a result of inflation, a recession, or other factors could result in the following consequences, any of which could have a materially adverse impact on our business, financial condition and results of operations:

•Loan delinquencies, problem assets and foreclosures may increase;

•We may increase our ACL on loans and provision for credit losses;

•The sale of foreclosed assets may be slow;

•Demand for our products and services may decline, possibly resulting in a decrease in our total loans;

•Collateral for loans made may decline further in value, exposing us to increased risk of loss on existing loans;

•The net worth and liquidity of loan guarantors may decline, impairing their ability to honor commitments to us; and

•The amount of our deposits may decrease and the composition of our deposits may be adversely affected.

A decline in local economic conditions may have a greater effect on our earnings and capital than on the earnings and capital of larger financial institutions whose real estate loans are geographically diverse. Many of the loans in our portfolio are secured by real estate. Deterioration in the real estate markets where collateral for a loan is located could negatively affect the borrower’s ability to repay the loan and the value of the collateral securing the loan. Real estate values are affected by various other factors, including changes in general or regional economic conditions, governmental rules or policies and natural disasters such as earthquakes and flooding. If we are required to liquidate a significant amount of collateral during a period of reduced real estate values, our financial condition and profitability could be adversely affected.

External economic factors, such as changes in monetary policy and inflation and deflation, may have an adverse effect on our business, financial condition and results of operations.

Our financial condition and results of operations are affected by credit policies of monetary authorities, particularly the Board of Governors of the Federal Reserve System, or the Federal Reserve. Actions by monetary and fiscal authorities, including the Federal Reserve, could lead to inflation, deflation, or other economic phenomena that could adversely affect our financial performance. Inflation has risen sharply since the end of 2021 and throughout 2022 at levels not seen for over 40 years. Inflationary pressures, while easing recently, remained elevated throughout the first half of 2023. Small to medium-sized businesses may be impacted more during periods of high inflation as they are not able to leverage economics of scale to mitigate cost pressures compared to larger businesses. Consequently, the ability of our business clients to repay their loans may deteriorate quickly, which would adversely impact our results of operations and financial condition. Furthermore, a prolonged period of inflation could cause wages and other costs to the Company to increase, which could adversely affect our results of operations and financial condition. Virtually all our assets and liabilities are monetary in nature. As a result, interest rates tend to have a more significant impact on our performance than general levels of inflation or deflation. Interest rates do not necessarily move in the same direction or by the same magnitude as the prices of goods and services.

Risks Related to Market and Interest Rate Changes

Fluctuating interest rates can adversely affect our profitability.

Our profitability is dependent primarily upon net interest income, which is the difference (or “spread”) between the interest earned on loans, investment securities and other interest earning assets and the interest paid on deposits, borrowings, and other interest bearing liabilities. Because of the differences in maturities and repricing characteristics of our interest earning assets and interest bearing liabilities, changes in interest rates do not produce equivalent changes in interest income earned on interest earning assets and interest paid on interest bearing liabilities.

We principally manage interest rate risk by managing our volume and mix of our earning assets and funding liabilities. Changes in monetary policy, including changes in interest rates, could influence not only the interest we receive on loans and investment securities and the amount of interest we pay on deposits and borrowings, but these changes could also affect (i) our ability to originate and/or sell loans and obtain deposits, (ii) the fair value of our financial assets and liabilities, which could negatively impact shareholders’ equity, and our ability to realize gains from the sale of such assets, (iii) our ability to obtain and retain deposits in competition with other available investment alternatives, (iv) the ability of our borrowers to repay adjustable or variable rate loans, and (v) the average duration of our investment securities portfolio and other interest earning assets. If the interest rates paid on deposits and other borrowings increase at a faster rate than the interest rates received on loans and other investments, our net interest income, and therefore earnings, could be adversely affected. Earnings could also be adversely

19

Table of Contents

affected if interest rates decrease as assets tend to reprice more quickly than liabilities. In a changing interest rate environment, we may not be able to manage this risk effectively. If we are unable to manage interest rate risk effectively, our business, financial condition and results of operations could be materially affected.

Interest rates are highly sensitive to many factors that are beyond our control, including general and forecasted economic conditions reflected in the rates offered along the yield curve and the FHLB's fixed-rate advance index, and policies of various governmental and regulatory agencies and, particularly the Federal Reserve. During the year ended December 31, 2023, in response to inflation, the FOMC of the Federal Reserve has increased the target range for the federal funds rate by 100 basis points to a range of 5.25% to 5.50% as of December 31, 2023 compared to a range of 0.00% to 0.25% at December 31, 2021 with the intention of controlling inflation without creating a recession. If the FOMC further increases the targeted federal funds rate, overall interest rates will likely rise, which may negatively impact both the housing market, by reducing refinancing activity and new home purchases, and the U.S. economy.

As is the case with many financial institutions, we have focused on growing core deposits—deposits with no or low interest rates and no specified maturity—which has been challenging over the past couple years. In a rising interest rate environment, retaining these deposits could result in higher funding costs. If the rates paid on deposits and other borrowings increase faster than the rates earned on loans and investments, our net interest income and earnings could be adversely affected. Conversely, if we do not adjust our deposit interest rates to remain competitive with other banks or alternative investment options, we might experience a decrease in deposits, potentially leading to either reduced earning assets or higher borrowings. Both scenarios could potentially cause a decline in earnings.

Changes in interest rates also affect the value of our available for sale investment securities portfolio. Generally, the fair value of fixed-rate investment securities fluctuates inversely with changes in interest rates. Unrealized gains and losses on investment securities available for sale are reported as a separate component of equity, net of tax. Decreases in the fair value of investment securities available for sale resulting from increases in interest rates could have an adverse effect on stockholders’ equity. Stockholders' equity, specifically AOCI, is increased or decreased by the amount of change in the estimated fair value of our securities available for sale, net of deferred income taxes. Increases in interest rates generally decrease the fair value of securities available for sale, which adversely impacts stockholders' equity. The Company could recognize an impairment loss for any security that has declined in fair value below its amortized cost basis if management has the intent to sell the security or if it is more likely than not it will be required to sell the security before recovery of its amortized cost basis.

Although management believes it has implemented effective asset and liability management strategies to reduce the potential effects of changes in interest rates on our results of operations, any substantial, unexpected or prolonged change in market interest rates could have a material adverse effect on our financial condition and results of operations. Also, our interest rate risk modeling techniques and assumptions likely may not fully predict or capture the impact of actual interest rate changes on our balance sheet. For further discussion of how changes in interest rates could impact us and additional information about our interest rate risk management, see Item 7A. Quantitative and Qualitative Disclosures About Market Risk.

Changes in the valuation of our investment securities portfolio could hurt our profits and reduce capital levels.

Factors beyond our control can significantly influence the fair value of investment securities in our portfolio and can cause potential adverse changes to the fair value of these investment securities, potentially reducing AOCI and/or earnings. These factors include, but are not limited to, rating agency actions in respect of the securities, defaults by, or other adverse events affecting the issuer or with respect to the underlying securities, and changes in market interest rates and continued instability in the capital markets. Our investment securities portfolio is evaluated for estimated credit losses and an ACL on investment securities, as appropriate, is recorded as a contra asset on the financial statement of condition and a provision for credit loss on investment securities through earnings. There can be no assurance that the declines in market value will not result in credit losses, which would lead to accounting charges that could have a material adverse effect on our net income and capital levels.

Risks Related to Laws and Regulations

Non-compliance with the USA PATRIOT Act, Bank Secrecy Act, or other laws and regulations could result in fines or sanctions and limit our ability to get regulatory approval of acquisitions.

The USA PATRIOT and Bank Secrecy Acts require financial institutions to develop programs to prevent financial institutions from being used for money laundering and terrorist activities. If such activities are detected, financial institutions are obligated to file suspicious activity reports with the U.S. Treasury’s Office of Financial Crimes Enforcement Network. These rules require financial institutions to establish procedures for identifying and verifying the identity of customers seeking to open new financial accounts. Failure to comply with these regulations could result in fines or sanctions and limit our ability to get regulatory approval of acquisitions. While we have developed policies and procedures designed to assist in compliance with these laws and regulations, no assurance can be given that these policies and procedures will be effective in preventing violations of these laws and regulations. Failure to maintain and implement adequate programs to combat money laundering and terrorist financing could also have serious reputational consequences for us and could have a material adverse effect on our business, financial condition, results of operations and growth prospects.

Monetary policies and regulations of the Federal Reserve could adversely affect our business, financial condition and results of operations.

In addition to being affected by general economic conditions, our earnings and growth are affected by the policies of the Federal Reserve. An important function of the Federal Reserve is to regulate the money supply and credit conditions. Among the instruments used by the Federal Reserve to implement these objectives are open market purchases and sales of U.S.

20

Table of Contents

government securities, adjustments of the discount rate and changes in banks’ reserve requirements against bank deposits. These instruments are used in varying combinations to influence overall economic growth and the distribution of credit, bank loans, investments and deposits. Their use also affects interest rates charged on loans or paid on deposits.

The monetary policies and regulations of the Federal Reserve have had a significant effect on the operating results of financial institutions in the past and are expected to continue to do so in the future. The effects of such policies upon our business, financial condition and results of operations cannot be predicted.

Climate change and related legislative and regulatory initiatives may materially affect the Company’s business and results of operations.

The potential effects of climate change are creating a heightened level of concern for the state of the environment. As a result, the global business community has increased its political and social awareness surrounding the issue, and the United States has entered into international agreements in an attempt to reduce global temperatures, such as reentering the Paris Agreement. Further, the U.S. Congress, state legislatures and federal and state regulatory agencies continue to propose initiatives to supplement the global effort to combat climate change. Similar and even more expansive initiatives are expected under the current administration, including potentially increasing supervisory expectations with respect to banks’ risk management practices, accounting for the effects of climate change in stress testing scenarios and systemic risk assessments, revising expectations for credit portfolio concentrations based on climate-related factors and encouraging investment by banks in climate-related initiatives and lending to communities disproportionately impacted by the effects of climate change.

The lack of empirical data surrounding the credit and other financial risks posed by climate change render it difficult, or even impossible, to predict how specifically climate change may impact our financial condition and results of operations; however, the physical effects of climate change may also directly impact us. Specifically, the occurrence of unpredictable and more frequent weather disasters may adversely impact the real property, and/or the value of the real property, securing the loans in our portfolios. Additionally, if insurance obtained by our borrowers is insufficient to cover any losses sustained to the collateral, or if insurance coverage is otherwise unavailable to our borrowers, the collateral securing our loans may be negatively impacted by climate change, natural disasters and related events, which could impact our financial condition and results of operations. Further, the effects of climate change may negatively impact regional and local economic activity, which could lead to an adverse effect on our customers and impact the communities in which we operate. Overall, climate change, its effects and the resulting unknown impact could have a material adverse effect on our financial condition and results of operations.

Risks Related to Cybersecurity, Third-Parties and Technology

We rely on third party services and products to provide key components of our technology and banking product business infrastructure.

We rely on third party services to provide products and services in support of day-to-day operations. Due to the nature of the outsourced services, some portions of our technology offerings, computing environments, architecture, and infrastructure, and banking operational processes are exposed to vendor service risks. Risks include failure to contractually perform, fraud, errors, delays, omissions, failure to comply with regulatory and/or or legal requirements; and failure to ensure security and availability and integrity of service and/or accuracy of the provided service. The bank’s regulatory agencies require financial institutions to ensure risks associated with outsourced providers and services are appropriately identified, assessed, controlled, and continuously monitored to ensure risk is appropriately managed. Disruptions or failures in the physical infrastructure or operating systems that support our business and customers, or cyber-attacks or security breaches of the networks, systems or devices that our customers use to access our products and services could result in: client attrition; regulatory fines, penalties or intervention; reputational damage; reimbursement or other compensation costs and/or additional compliance costs, any of which could materially adversely affect our results of operations or financial condition.

We are subject to certain risks in connection with our use of technology.

Our security measures may not be sufficient to mitigate the risk of a cyber-attack. Technology architecture, infrastructure, and information systems and platforms are essential to conduct our business. Systems to manage our customer relationships, our core operating systems, our general ledger,and virtually all other aspects of our business rely on the secure processing, storage, and transmission of confidential and private information in our computing environments. Although we take every protective measure and endeavor to ensure the security of our computing environments and the data within the environments, systems, software and networks may be vulnerable to breaches, fraudulent or unauthorized access, denial or degradation of service, misuse of information, viruses, malicious code and malware and/or ransomware cybercrime incidents. If one or more of these events occur, systems, software and/or network availability, and integrity could be compromised resulting in the loss of the Company’s and/or customers’ confidential and private information. In the event of a security incident, significant additional resources may be expended to modify our protective measures or to investigate and remediate vulnerabilities or other exposures and we may be subject to litigation and financial losses that are either not insured against or not fully covered through any insurance maintained by us.

Security breaches in our internet banking activities could further expose us to possible liability and damage our reputation. Increases in criminal activity levels and sophistication, advances in computer capabilities, new vulnerabilities in third-party technologies (including browsers and operating systems) or other developments could result in a compromise or breach of the technology, processes and/or controls that we use to prevent fraudulent transactions and to protect data about us, our clients and underlying transactions. Any compromise of our security could deter customers from using our internet banking services that involve the transmission of confidential information. Although we have developed and continue to invest in systems and processes that are designed to detect and prevent security breaches and cyber-attacks and periodically test our security, these precautions may not protect our systems from compromises or breaches of our security measures and could result in losses to us or our customers, our loss of business and/or customers, damage to our reputation, incurrence of additional expenses,

21

Table of Contents

disruption to our business, our inability to grow our online services or other businesses, additional regulatory scrutiny or penalties or our exposure to civil litigation and possible financial liability, any of which could have a material adverse effect on our business, financial condition and results of operations.

Our security measures may not protect us from system failures or interruptions. We have established policies and procedures to identify threats and vulnerabilities and prevent or limit the impact of system breaches, failures, and interruptions. In addition, we outsource certain aspects of our data processing and other operational functions to certain third-party providers. While the Company selects third-party vendors carefully, it does not control their actions. If our third-party providers encounter difficulties, including those resulting from breakdowns or other disruptions in communication services provided by a vendor, failure of a vendor to handle current or higher transaction volumes, cyber-attacks and security breaches or if we otherwise have difficulty in communicating with them, our ability to adequately process and account for transactions could be affected and to deliver products and services to our customers and otherwise conduct business operations could be adversely impacted. Replacing these third-party vendors could also entail significant delay and expense. Threats to information security also exist in the processing of customer information through various other vendors and their personnel. We cannot ensure that such breaches, failures or interruptions will not occur or, if they do occur, that they will be adequately addressed by us or the third parties on which we rely.

Further, while we believe we maintain adequate insurance to cover these risks, our insurance coverage may not cover all losses resulting from breaches, system failures or other disruptions. The occurrence of any systems failure or interruption could damage our reputation and result in a loss of customers and business, could subject us to additional regulatory scrutiny or could expose us to legal liability. Any of these occurrences could have a material adverse effect on our business, financial condition, and results of operations.

We are subject to certain risks in connection with our data management or aggregation.

We are reliant on our ability to manage data and our ability to aggregate data in an accurate and timely manner to ensure effective risk reporting and management. Our ability to manage data and aggregate data may be limited by the effectiveness of our policies, programs, processes, and practices that govern how data is acquired, validated, stored, protected and processed. While we continuously update our policies, programs, processes, and practices, many of our data management and aggregation processes are manual and subject to human error or system failure. Failure to manage data effectively and to aggregate data in an accurate and timely manner may limit our ability to manage current and emerging risks, as well as to manage changing business needs.

Our business may be adversely affected by an increasing prevalence of fraud and other financial crimes.

We are susceptible to fraudulent activity that may be committed against us or our customers which may result in financial losses or increased costs to us or our customers, disclosure or misuse of our information or our customer’s information, misappropriation of assets, privacy breaches against our customers, litigation or damage to our reputation. Such fraudulent activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering, and other dishonest acts. Nationally, reported incidents of fraud and other financial crimes have increased. We have also experienced losses due to apparent fraud and other financial crimes, although such losses have been relatively insignificant to date. While we have policies and procedures designed to prevent such losses, there can be no assurance that such losses will not occur.

The financial services market is undergoing rapid technological changes, and if we are unable to stay current with those changes, we may not be able to effectively compete.

The financial services industry is experiencing rapid technological changes with frequent introductions of new technology-driven products and services. Effective use of technology increases efficiency and enables financial institutions to better serve customers and to reduce costs. Many of our competitors have substantially greater resources to invest in technological improvements than we do. Our future success will depend, to some degree, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands for convenience, as well as create additional efficiencies in our operations. We may not be able to effectively implement new technology-driven products or services or be successful in marketing these products and services. Additionally, the implementation of technological changes and upgrades to maintain current systems and integrate new ones may cause service interruptions, transaction processing errors and system conversion delays and may cause us to fail to comply with applicable laws. There can be no assurance that we will be able to successfully manage the risks associated with increased dependency on technology.

Risks Related to Accounting Matters

New or changing tax, accounting, and regulatory rules and interpretations could significantly impact strategic initiatives, results of operations, cash flows, and financial condition.

The financial services industry is extensively regulated. Federal and state banking regulations are designed primarily to protect the deposit insurance funds and consumers, not to benefit our stockholders. These regulations, along with the currently existing tax, accounting, securities, insurance and monetary laws, regulations, rules, standards, policies and interpretations control the methods by which financial institutions conduct business, implement strategic initiatives and tax compliance and govern financial reporting and disclosures. These laws, regulations, rules, standards, policies and interpretations are constantly evolving and may change significantly over time. Any new regulations or legislation, change in existing regulation or oversight, whether a change in regulatory policy or a change in a regulator's interpretation of a law or regulation, could have a material impact on our operations, increase our costs of regulatory compliance and of doing business and adversely affect our profitability. Regulatory authorities also have extensive discretion in connection with their supervisory and enforcement activities, including the imposition of restrictions on the operation of an institution, the classification of assets by the institution and adequacy of an

22

Table of Contents

institution's ACL. These bank regulators also have the ability to impose conditions in the approval of merger and acquisition transactions.

We may experience goodwill impairment, which could reduce our earnings.

Accounting standards require that we use the purchase method of accounting for acquisitions and business combinations. Under purchase accounting, if the purchase price of an acquired company exceeds the fair value of its net assets, the excess is carried on the acquirer’s balance sheet as goodwill. In accordance with GAAP, we assess our goodwill for impairment annually, or more frequently if specific events suggest potential impairment. This evaluation incorporates various quantitative factors, such as the quoted price of our common stock, market prices of common stock of other banking organizations, common stock trading multiples, discounted cash flows and data from comparable acquisitions. Additionally, we may perform a qualitative assessment that considers macroeconomic conditions, industry and market conditions, cost or margin factors, and financial performance. Assessing the fair value of goodwill involves considerable judgment. If our judgment was incorrect, or if events or circumstances change, and an impairment of goodwill was deemed to exist, we would be required to write down our goodwill resulting in a charge against income, which could materially adversely affect our results of operations and financial condition. We performed our annual impairment assessment for goodwill as of December 31, 2023, and concluded there was no impairment.

The Company’s reported financial results depend on management’s selection of accounting methods and certain assumptions and estimates, which, if incorrect, could cause unexpected losses in the future.

The Company’s accounting policies and methods are fundamental to how the Company records and reports its financial condition and results of operations. The Company’s management must exercise judgment in selecting and applying many of these accounting policies and methods so they comply with generally accepted accounting principles and reflect management’s judgment regarding the most appropriate manner to report the Company’s financial condition and results of operations. In some cases, management must select the accounting policy or method to apply from two or more alternatives, any of which might be reasonable under the circumstances, yet might result in the Company’s reporting materially different results than would have been reported under a different alternative.

Certain accounting policies are critical to presenting the Company’s financial condition and results of operations. They require management to make difficult, subjective or complex judgments about matters that are uncertain. Materially different amounts could be reported under different conditions or using different assumptions or estimates. These critical accounting policies include the ACL on loans, investments and unfunded commitments, and goodwill. Because of the uncertainty of estimates involved in these matters, the Company may be required to do one or more of the following: significantly increase the ACL and/or sustain credit losses that are significantly higher than the reserve provided, or recognize significant losses on the impairment of goodwill. For more information, refer to “Critical Accounting Estimates” included in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations of this Form 10-K.

Other Risks Related to Our Business

Managing reputational risk is important to attracting and maintaining customers, investors and employees.

Threats to our reputation can come from many sources, including adverse sentiment about financial institutions generally, unethical practices, employee misconduct, failure to deliver minimum standards of service or quality, compliance deficiencies and questionable or fraudulent activities of our customers. We have policies and procedures in place to protect our reputation and promote ethical conduct, but these policies and procedures may not be fully effective. Negative publicity regarding our business, employees, or customers, with or without merit, may result in the loss of customers, investors and employees; costly litigation; a decline in revenues and increased governmental regulation.

Ineffective liquidity management could adversely affect our financial results and condition.

Liquidity is essential to our business. We rely on several sources to meet our potential liquidity demands. Our primary sources of liquidity are increases in deposit accounts, cash flows from loan payments and our securities portfolio. Borrowings also provide us with a source of funds to meet liquidity demands. An inability to raise funds through deposits, borrowings, the sale of loans or investment securities and other sources could have a substantial negative effect on our liquidity. We rely on customer deposits and borrowings from the FHLB and certain other wholesale funding sources to fund our operations. Deposit flows and the prepayment of loans and mortgage-related investment securities are strongly influenced by such external factors as the direction of interest rates, whether actual or perceived, and the competition for deposits and loans in the markets we serve. Further, changes to the FHLB's underwriting guidelines for wholesale borrowings or lending policies may limit or restrict our ability to borrow and could therefore have a significant adverse impact on our liquidity. Although we have historically been able to replace maturing deposits and borrowings if desired, we may not be able to replace such funds in the future if, among other things, our financial condition, the financial condition of the FHLB or market conditions change. Factors that could detrimentally impact our access to liquidity sources include a decrease in the level of our business activity as a result of a downturn in the markets in which our loans and deposits are concentrated, negative operating results, or adverse regulatory action against us. Our ability to borrow could also be impaired by factors that are not specific to us, such as a disruption in the financial markets or negative views and expectations about the prospects for the financial services industry or deterioration in credit markets. Any decline in available funding in amounts adequate to finance our activities or on terms which are acceptable could adversely impact our ability to originate loans, invest in securities, meet our expenses, or fulfill obligations such as repaying our borrowings or meeting deposit withdrawal demands, any of which could, in turn, have a material adverse effect on our business, financial condition and results of operations.

23

Table of Contents

Additionally, collateralized public funds are bank deposits of state and local municipalities. These deposits are required to be secured by certain investment grade securities to ensure repayment, which on the one hand tends to reduce our contingent liquidity risk by making these funds somewhat less credit sensitive, but on the other hand reduces standby liquidity by restricting the potential liquidity of the pledged collateral. Although these funds historically have been a relatively stable source of funds for us, availability depends on the individual municipality's fiscal policies and cash flow needs. See "Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations — Liquidity and Capital Resources" of this Form 10-K.

If our enterprise risk management framework is not effective at mitigating risk and loss to us, we could suffer unexpected losses and our results of operations could be materially adversely affected.

Our enterprise risk management framework seeks to achieve an appropriate balance between risk and return, which is critical to optimizing stockholder value. We have established processes and procedures intended to identify, measure, monitor, report, analyze and control the types of risk to which we are subject. These risks include liquidity risk; credit risk; market risk; interest rate risk; operational risk; information technology and cybersecurity risk; legal and compliance risk; and reputational risk, among others. We also maintain a compliance program to identify, measure, assess and report on our adherence to applicable laws, policies and procedures. While we assess and improve these programs on an ongoing basis, there can be no assurance that our risk management or compliance programs, along with other related controls, will effectively mitigate all risk and limit losses in our business. As with any risk management framework, there are inherent limitations to our risk management strategies as there may exist, or develop in the future, risks that we have not appropriately anticipated or identified. If our risk management framework proves ineffective, we could suffer unexpected losses and our business, financial condition and results of operations could be materially adversely affected.

We are dependent on key personnel and the loss of one or more of those key personnel may materially and adversely affect our prospects.

Competition for qualified employees and personnel in the banking industry is intense and there are a limited number of qualified persons with knowledge of, and experience in, the community banking industry where we conduct our business. The process of recruiting personnel with the combination of skills and attributes required to carry out our strategies is often lengthy. Our success depends to a significant degree upon our ability to attract and retain qualified management, loan origination, finance, administrative, marketing and technical personnel and upon the continued contributions of our management and personnel. In particular, our success has been and continues to be highly dependent upon the abilities of key executives, including our Chief Executive Officer, Jeffrey J. Deuel, and certain other employees. The loss of key personnel could adversely affect our ability to successfully conduct our business.

Increasing scrutiny and evolving expectations from customers, regulators, investors, and other stakeholders with respect to our environmental, social and governance practices may impose additional costs on us or expose us to new or additional risks.

Companies are facing increasing scrutiny from customers, regulators, investors, and other stakeholders related to their environmental, social and governance (“ESG”) practices and disclosure. Investor advocacy groups, investment funds and influential investors are also increasingly focused on these practices, especially as they relate to the environment, health and safety, diversity, labor conditions and human rights. Increased ESG related compliance costs could result in increases to our overall operational costs. Failure to adapt to or comply with regulatory requirements or investor or stakeholder expectations and standards could negatively impact our reputation, ability to do business with certain partners, and our stock price. New government regulations could also result in new or more stringent forms of ESG oversight and expanding mandatory and voluntary reporting, diligence, and disclosure.

Risk Related to Holding Our Common Stock

Our growth or future losses may require us to raise additional capital in the future, but that capital may not be available when it is needed or the cost of that capital may be very high; further, the resulting dilution of our equity may adversely affect the market price of our common stock.

We are required by federal and state regulatory authorities to maintain adequate levels of capital to support our operations. At some point, we may need to raise additional capital to support our growth or replenish future losses. Our ability to raise additional capital, if needed, will depend on conditions in the capital markets at that time, which are outside our control, and on our financial condition and performance. Accordingly, we cannot make assurances we will be able to raise additional capital, if needed, on terms that are acceptable to us or at all. If we cannot raise additional capital when needed, our ability to further expand our operations through internal growth and acquisitions could be materially impaired and our financial condition and liquidity could be materially and adversely affected.

In addition, any additional capital we obtain may dilute the interests of existing holders of our common stock. Further, if we are unable to raise additional capital when required by our bank regulators, we may be subject to adverse regulatory action.

We rely on dividends from the Bank for substantially all our revenue at the holding company level.

We are an entity separate and distinct from our subsidiary, the Bank, and derive substantially all our revenue at the holding company level in the form of dividends from that subsidiary. Accordingly, we are, and will be, dependent upon dividends from the Bank to pay the principal of and interest on our indebtedness, to satisfy our other cash needs and to pay dividends on our common stock. The Bank's ability to pay dividends is subject to its ability to earn net income and to meet certain regulatory requirements. In the event the Bank is unable to pay dividends to us, we may not be able to pay dividends on our common stock. Also, our right to participate in a distribution of assets upon a subsidiary's liquidation or reorganization is subject to the prior claims of the subsidiary's creditors.

24

Table of Contents

ITEM 1B. UNRESOLVED STAFF COMMENTS

The Company has no unresolved staff comments from the SEC as it relates to the Company's financial information as reported in the Form 10-K.

ITEM 1C. CYBERSECURITY

Risk Management and Strategy

Enterprise Risk Management and Technology Risk Management. Within the Company's Enterprise Risk Management program, Technology Risk Management plays a pivotal role in overseeing the organization's risk posture, specifically focusing on the assessment of information and cybersecurity risks. Evaluated risks are subject to rigorous controls, ensuring both design and operational effectiveness and adherence to regulatory requirements. In instances where a risk is identified as inadequately controlled, prompt remediation measures are implemented to reduce the risk to an acceptable level.

Identification of risks is a multifaceted process, encompassing diverse activities such as management self-disclosure, monitoring of regulatory and interagency authorities, engagement with professional and industry forums, internal and external audits, collaboration with third-party professional services, policy reviews and walkthroughs, adherence to best practice frameworks, leveraging subject matter expertise and industry experience, and maintaining a collaborative relationship with third-party service providers/vendors. The Technology Risk Management practice operates as a continuous model assessment, utilizing information gathered daily, weekly, monthly, and annually to provide insights into the state of controlled risk within the organization. Security testing and assurance activities may be outsourced to independent audit and security firms based on factors such as resource capacity, subject matter expertise, regulatory requirements, and the prevailing rate and condition of risk.

Daily operational activities are in place to ensure the achievement and implementation of security requirements, including the management of security architecture, monitoring for potential security events or incidents, and the reporting and response to detected threats in our technology environments. The Information and Cyber Security Policy and Program establish policies and standards required to be implemented in support of these practices and processes. Additionally, we maintain a compliant and comprehensive Security Incident Response Plan, incorporating accessible resources such as insurance providers, digital and cyber forensic experts, law enforcement, along with documentation of regulatory notification. Our practices are interdependent with service providers/vendors, and we collaborate appropriately with these partners on notification and investigation processes to ensure complete visibility into security risks and events.

As of the reporting period, the Company has not experienced any material cybersecurity events or incidents. Although third-party service providers have encountered cybersecurity events or incidents, these occurrences have not resulted in a material impact on our systems, computing environments, customers, or data.

Governance

Board Oversight: The Company’s Board of Directors ("Board") provides active oversight of cybersecurity threats in accordance with the Board-approved Information and Cyber Security Policy and Program. These policies and programs aim to achieve a controlled risk environment while meeting regulatory, legislative, and compliance requirements, including but not limited to the Gramm-Leach-Bliley Act (GLBA), Health Insurance Portability and Accountability Act (HIPAA), Information Technology Sarbanes-Oxley Act (IT SOX) Compliance, and Payment Card Industry Data Security Standard (PCI-DSS) Compliance.

Direct oversight of cybersecurity risks is delegated to the Board's Risk and Technology Committee. The Committee meets at least quarterly and receives reports detailing current risks, the maturity and functioning of associated processes and controls, and emerging or anticipated risks and threats. Additionally, the Risk and Technology Committee Chair provides a verbal summarized report to the full Board. All Committee reports are available to the full Board for review. In the event of critical matters arising between scheduled meetings, the Chief Risk Officer promptly notifies the Board and Risk and Technology Committee.

To further ensure independence and effectiveness, the Board has delegated authority for the conduct of the cybersecurity program, including the referenced reports, to the Technology Risk Management Director. This position fulfills the role and responsibilities of a Chief Information Security Officer and reports to the Chief Risk Officer who in turn reports independently to the Chair of the Board's Risk and Technology Committee. Additional layers of oversight are integrated into the program through the Director of Internal Audit, who conducts independent audits of critical information technology and cybersecurity activities. The results of these audits are reported to the Board's Audit and Finance Committee, providing an extra layer of assurance and accountability. The Director of Internal Audit reports independently to the Chair of the Board's Audit and Finance Committee.

Management's Role in Assessing and Managing Cybersecurity Risks. Management's role in assessing and managing material risks from cybersecurity threats is integral to the Company's governance framework. The Board-approved Information and Cyber Security Policy and Program outline specific roles and responsibilities delegated to management and the Enterprise Risk Management program, which includes Technology Risk Management.

The Technology Risk Management Director, a seasoned information and cyber security expert with significant experience in financial institutions, oversees Technology Risk Management. This expert conducts comprehensive assessments of cybersecurity risks inherent in the industry and the Company's business activities, evaluating controls implemented to address identified risks.

25

Table of Contents

The Technology Risk Management Director is responsible for maintaining the Company's information and cyber security risk management framework. This framework establishes standards and processes for the continuous assessment of material cybersecurity risks, covering identification, measurement, mitigation activities, monitoring, and reporting of the risk posture at any given time. Additionally, the Director ensures oversight and compliance with the Security Incident Response Plan, providing guidance during security incidents, whether within the Company or involving service provider/vendor engagements.

The Company’s information technology department, including a dedicated security operations group, plays a crucial role in implementing practices aligned with the Information and Cyber Security Policy and Program requirements. Responsibilities include the maintenance and monitoring of systems, network(s), and application access and error logs, identification of unauthorized access attempts, adherence to access controls standards, configuration management, and the implementation of controls to mitigate risks related to information availability, integrity, and confidentiality.

Business activities, products, and services are managed by experts in their respective fields, with employees receiving training to detect and prevent material cybersecurity threats. Business leaders are expected to understand specific threats within their areas of responsibility and adhere to established processes and standards to control such threats.

To facilitate a transparent and collaborative approach to managing cybersecurity risk, an executive management level committee has been established. Chaired by the Chief Risk Officer and administered by the Technology and Risk Management Director, the committee ensures continual awareness of the information and cybersecurity risk posture, emerging threats, known threat actors, and vulnerabilities. Its purpose is to foster a security culture within the Company through active participation in planning and managing threat and security risk activities.

All committee activities are reported to the Board's Risk and Technology Committee through committee minutes and formal activity reports provided by the Technology and Risk Management Director.

ITEM 2. PROPERTIES

The main office of the Company and the Bank is located in downtown Olympia, Washington. In addition, the Company has two administrative office locations in Tacoma and Burlington Washington and one, which is currently held for sale, in Lynnwood, Washington. The Bank's branch network at December 31, 2023 was comprised of 50 branches located throughout Washington, Oregon and Idaho. The Company leases 24 properties and owns 29 properties at December 31, 2023. In the opinion of management, all properties are adequately covered by insurance, are in good state of repair and are adequate to meet our present and immediately foreseeable needs.

ITEM 3. LEGAL PROCEEDINGS

Neither the Company nor the Bank, is a party to any material pending legal proceedings other than ordinary routine litigation incidental to our businesses.

ITEM 4. MINE SAFETY DISCLOSURES

Not applicable

PART II

ITEM 5. MARKET FOR THE REGISTRANT'S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES

Market Information

Our common stock is traded on the NASDAQ Global Select Market under the symbol HFWA.

Holders

At December 31, 2023, we had approximately 1,097 shareholders of record (not including the number of persons or entities holding stock in nominee or street name through various brokerage firms).

The Company has historically paid cash dividends to its common shareholders. On January 24, 2024, the Company’s Board of Directors declared a regular quarterly dividend of $0.23 per common share payable on February 22, 2024 to shareholders of record on February 8, 2024. Payments of future cash dividends, if any, will be at the discretion of our Board of Directors considering various factors, including our business, operating results and financial condition, capital requirements, current and anticipated cash needs, plans for expansion, any legal or contractual limitation on our ability to pay dividends and other relevant factors. No assurances can be given that any dividends will be paid or that, if paid, will not be reduced or eliminated in future periods. Dividends on common stock from the Company depend substantially upon receipt of dividends from the Bank, which is the Company’s predominant source of income. Management's projections show an expectation that cash dividends will continue for the foreseeable future.

26

Table of Contents

Purchases of Equity Securities by the Issuer and Affiliated Purchasers

The following table sets forth information about the Company’s purchases of its outstanding common stock during the quarter ended December 31, 2023:

(1) Of the common shares repurchased by the Company between October 1, 2023 and December 31, 2023, all shares represented the cancellation of stock to pay withholding taxes on vested restricted stock awards or units.

(2) On March 12, 2020 the Company's Board of Directors announced the repurchase of up to 5% of the Company's outstanding common shares, or 1,799,054 shares, under the twelfth stock repurchase plan. The repurchase program does not have a set expiration date and will expire upon repurchase of the full amount of authorized shares, unless terminated sooner by the Board of Directors. The repurchase program may be suspended or discontinued at any time by the Company’s Board of Directors.

Equity Compensation Plan Information.

The equity compensation plan information presented under subparagraph (d) in Part III, Item 12 of this Form 10-K is incorporated herein by reference.

Performance Graph

The following graph shows the five-year comparison of the total return to shareholders of the Company’s common stock as compared to the NASDAQ Composite Index and the S&P U.S. SmallCap Banks Index during the five-year period beginning December 31, 2018 and ending December 31, 2023. Total return includes appreciation or depreciation in market value of the Company’s common stock as well as actual cash and stock dividends paid to common shareholders. The NASDAQ Composite Index is a broad equity market index comprised of all domestic and international common stocks listed on the Nasdaq Stock Market. The S&P U.S. SmallCap Banks Index is comparative peer index comprised of banks and related holding companies within the same market capitalization range as the Company. The graph assumes the value of the investment in Company’s common stock and each index was $100 on December 31, 2018, and all dividends were reinvested.

.

Years Ended December 31,

*Information for the graph was provided by S&P Global Market Intelligence.

27

Table of Contents

ITEM 6. [RESERVED]

ITEM 7. MANAGEMENT'S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

The following is a discussion and analysis of our financial condition and results of operations and should be read in conjunction with our financial statements and notes thereto included in Item 8 of this report. In addition to historical information, this discussion contains forward‐looking statements that involve risks, uncertainties and assumptions that could cause actual results to differ materially from management’s expectations. Factors that could cause such differences are discussed in the sections entitled “Cautionary Note Regarding Forward Looking Statements” and “Risk Factors.” The Company assumes no obligation to update any of these forward‐looking statements.

Management’s discussion focuses on 2023 results compared to 2022. For a discussion of 2022 results compared to 2021, refer to “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in Part II, Item 7 of the Company’s Form 10-K for the fiscal year ended December 31, 2022, filed with the SEC on February 24, 2023.

Overview

Heritage Financial Corporation is a bank holding company which primarily engages in the business activities of our wholly-owned financial institution subsidiary, Heritage Bank. We provide financial services to our local communities with an ongoing strategic focus on our commercial banking relationships, market expansion and asset quality. The Company’s business activities generally are limited to passive investment activities and oversight of its investment in the Bank. Accordingly, the information set forth in this report relates primarily to the Bank’s operations.

Our business consists primarily of commercial lending and deposit relationships with small to medium sized businesses and their owners in our market areas and attracting deposits from the general public. We also originate real estate construction and land development loans, residential real estate loans and consumer loans, primarily in our markets.