HFWA US Equity☆

hfwa-20241231

Table ofContents

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, D.C. 20549

☒ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended December 31, 2024

or

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from __________ to __________

Commission File Number 000-29480

HERITAGE FINANCIAL CORPORATION

(Exact name of registrant as specified in its charter)

(Address of principal executive offices) (Zip Code)

(360) 943-1500

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Act:

Title of each class Trading Symbol(s) Name of each exchange on which registered

Common stock, no par value HFWA Nasdaq Stock Market LLC

Securities registered pursuant to Section 12(g) of the Act:

None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.

Yes ☒ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.

Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.

Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files).

Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, smaller reporting company, or an emerging growth company. See the definitions of "large accelerated filer", "accelerated filer", "smaller reporting company," and "emerging growth company" in Rule 12b-2 of the Exchange Act

Large accelerated filer ☐ Accelerated filer ☒

Non-accelerated filer ☐ Smaller reporting company ☐

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management's assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act).

Yes ☐ No ☒

The aggregate market value of the voting and non-voting common equity held by non-affiliates of the registrant as of June 30, 2024, based on the closing price of its common stock on such date, on the Nasdaq Global Select Market, of $18.03 per share, and 33,923,887 shares held by non-affiliates was $611,647,683. The registrant had 33,990,827 shares of common stock outstanding as of February 18, 2025.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the registrant’s definitive Proxy Statement for the 2025 Annual Meeting of Shareholders are incorporated by reference into Part III of this Annual Report on Form 10-K where indicated. The 2025 Proxy Statement will be filed with the U.S. Securities and Exchange Commission within 120 days after the end of the fiscal year to which this report relates.

Table ofContents

HERITAGE FINANCIAL CORPORATION AND SUBSIDIARIES

FORM 10-K

December 31, 2024

TABLE OF CONTENTS

Page

GLOSSARY OF ACRONYMS, ABBREVIATIONS AND TERMS 4

CAUTIONARY NOTE REGARDING FORWARD-LOOKING STATEMENTS 5

PART I

ITEM 1. BUSINESS 6

ITEM 1A. RISK FACTORS 19

ITEM 1B. UNRESOLVED STAFF COMMENTS 30

ITEM 1C CYBERSECURITY 30

ITEM 2. PROPERTIES 32

ITEM 3. LEGAL PROCEEDINGS 32

ITEM 4. MINE SAFETY DISCLOSURES 32

PART II

ITEM 6. [RESERVED] 33

OVERVIEW 34

RESULTS OF OPERATIONS 34

NET INTEREST INCOME AND MARGIN OVERVIEW 35

PROVISION FOR CREDIT LOSSES OVERVIEW 37

NONINTEREST INCOME OVERVIEW 38

NONINTEREST EXPENSE OVERVIEW 38

INCOME TAX EXPENSE OVERVIEW 39

FINANCIAL CONDITION OVERVIEW 39

INVESTMENT ACTIVITIES OVERVIEW 40

LOAN PORTFOLIO OVERVIEW 41

ALLOWANCE FOR CREDIT LOSSES ON LOANS OVERVIEW 44

DEPOSITS OVERVIEW 46

STOCKHOLDERS' EQUITY OVERVIEW 46

LIQUIDITY AND CAPITAL RESOURCES 47

CRITICAL ACCOUNTING ESTIMATES 48

ITEM 7A. QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK 49

ITEM 8. FINANCIAL STATEMENTS AND SUPPLEMENTARY DATA 52

REPORT OF INDEPENDENT REGISTERED PUBLIC ACCOUNTING FIRM (PCAOB ID: 173) 52

2

Table ofContents

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS 60

NOTE 2. INVESTMENT SECURITIES 68

NOTE 3. LOANS RECEIVABLE 71

NOTE 4. ALLOWANCE FOR CREDIT LOSSES ON LOANS 82

NOTE 5. PREMISES AND EQUIPMENT 84

NOTE 6. GOODWILL AND OTHER INTANGIBLE ASSETS 84

NOTE 7. DERIVATIVE FINANCIAL INSTRUMENTS 85

NOTE 8. DEPOSITS 85

NOTE 9. JUNIOR SUBORDINATED DEBENTURES 85

NOTE 10. OTHER BORROWINGS 86

NOTE 12. EMPLOYEE BENEFIT PLANS 87

NOTE 13. STOCKHOLDERS’ EQUITY 88

NOTE 14. FAIR VALUE MEASUREMENTS 89

NOTE 15. STOCK-BASED COMPENSATION 93

NOTE 16. INVESTMENTS IN TAX CREDIT STRUCTURES 94

NOTE 17. INCOME TAXES 95

NOTE 18. COMMITMENTS AND CONTINGENCIES 96

NOTE 19. REGULATORY CAPITAL REQUIREMENTS 97

NOTE 20. HERITAGE FINANCIAL CORPORATION (PARENT COMPANY ONLY) 98

NOTE 21. SEGMENT INFORMATION 99

ITEM 9A. CONTROLS AND PROCEDURES 101

ITEM 9B. OTHER INFORMATION 101

ITEM 9C. DISCLOSURE REGARDING FOREIGN JURISDICTIONS THAT PREVENT INSPECTIONS 101

PART III

ITEM 10. DIRECTORS, EXECUTIVE OFFICERS AND CORPORATE GOVERNANCE 101

ITEM 11. EXECUTIVE COMPENSATION 102

ITEM 14. PRINCIPAL ACCOUNTANT FEES AND SERVICES 102

PART IV

ITEM 15. EXHIBITS AND FINANCIAL STATEMENT SCHEDULES 102

3

Table ofContents

Glossary of Acronyms, Abbreviations, and Terms

The acronyms, abbreviations, and terms listed below are used in various sections of this Annual Report on Form 10-K. As used throughout this report, the terms "Heritage," “we,” “our,” “us” or the "Company" refer to Heritage Financial Corporation and its consolidated subsidiaries, unless the context otherwise requires.

ACL Allowance for Credit Losses

AOCI Accumulated Other Comprehensive Income (Loss), Net

ASC Accounting Standards Codification

ASU Accounting Standards Update

Bank Heritage Bank

BHCA Bank Holding Company Act

Board Heritage Financial Corporation Board of Directors

BOLI Bank Owned Life Insurance

BTFP Bank Term Funding Program

CECL Current Expected Credit Loss

CMO Collateralized Mortgage Obligation

CRA Community Reinvestment Act

CRE Commercial Real Estate

DEI Diversity, Equity, and Inclusion

Dodd-Frank Act Dodd–Frank Wall Street Reform and Consumer Protection Act

Equity Plan Heritage Financial Corporation 2023 Omnibus Equity Plan

Exchange Act Securities Exchange Act of 1934, as Amended

FASB Financial Accounting Standards Board

FDIC Federal Deposit Insurance Corporation

Federal Reserve Board of Governors of the Federal Reserve System

FHLB Federal Home Loan Bank

Fintech Financial Technology

FOMC Federal Open Market Committee within the Federal Reserve System

Form 10-K Company's Annual Report on Form 10-K

FRB Federal Reserve Bank

GAAP U.S. Generally Accepted Accounting Principles

LIHTC Low-Income Housing Tax Credit

MBS Mortgage-Backed Security

OFAC Office of Foreign Assets Control of the U.S. Department of the Treasury

OCC Office of the Comptroller of the Currency

PCAOB Public Company Accounting Oversight Board

Plan Heritage Financial Corporation 401(k) Profit Sharing Plan and Trust

Related Party Certain Directors, Executive Officers and Their Affiliates

ROU Right-of-Use

Salary Continuation Plan Salary Continuation Plan Agreement Master Plan Document

SBA Small Business Administration

SEC Securities and Exchange Commission

SM Special Mention

SOFR Secured Overnight Financing Rate

SOX Sarbanes-Oxley Act (15 U.S.C 7262(b)), as Amended

4

Table ofContents

SS Substandard

TDR Troubled Debt Restructured

USDA United States Department of Agriculture

CAUTIONARY NOTE REGARDING FORWARD-LOOKING STATEMENTS

This Form 10-K contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. Such statements often include words such as “believes,” “expects,” “anticipates,” “estimates,” “forecasts,” “intends,” “plans,” “targets,” “potentially,” “probably,” “projects,” “outlook” or similar expressions or future or conditional verbs such as “may,” “will,” “should,” “would” and “could,” as well as the negative of such words. Forward-looking statements are not historical facts but instead represent management’s current expectations and forecasts regarding future events, many of which are inherently uncertain and outside of our control. Actual results may differ, possibly materially, from those currently expected or projected in these forward-looking statements. These statements relate to our financial condition, results of operations, beliefs, plans, objectives, goals, expectations, assumptions and statements about future performance or business. The Company cautions readers not to place undue reliance on any forward-looking statements. Moreover, you should treat these statements as speaking only as of the date they are made and based only on information then actually known to the Company. The Company does not undertake and specifically disclaims any obligation to revise any forward-looking statements to reflect the occurrence of anticipated or unanticipated events or circumstances after the date of such statements whether as a result of new information, future events or otherwise. These forward-looking statements are subject to known and unknown risks and uncertainties. Factors that could cause our actual results to differ materially from those described in the forward-looking statements include, but are not limited to:

•potential adverse impacts to economic conditions nationally or in our local market areas, other markets where we have lending relationships, or other aspects of our business operations or financial markets including, without limitation, as a result of credit quality deterioration, pronounced and sustained reductions in real estate market values, employment levels and labor shortages, a potential recession or slowed economic growth;

•changes in the interest rate environment, which could adversely affect our revenues and expenses, the value of assets and obligations, and the availability and cost of capital and liquidity;

•the level and impact of inflation and the current and future monetary policies of the Federal Reserve in response thereto;

•legislative or regulatory changes that adversely affect our business, including changes in banking, securities, and tax law, in regulatory policies and principles, or the interpretation and prioritization of regulatory capital or other rules;

•effects on the U.S. economy resulting from the implementation of policies proposed by the new presidential administration, including tariffs, mass deportations and tax regulations;

•credit and interest rate risks associated with our business, customers, borrowings, repayment, investment, and deposit practices;

•fluctuations in deposits and deposit concentrations;

•liquidity issues, including our ability to borrow funds or raise additional capital, if necessary;

•fluctuations in the value of our investment securities;

•credit risks and risks from concentrations (by type of geographic area, collateral and industry) within our loan portfolio;

•disruptions, security breaches, insider fraud, cybersecurity incidents or other adverse events, failures or interruptions in, or attacks on, our information technology systems or on the third party vendors who perform critical processing functions for our business, including sophisticated attacks using artificial intelligence and similar tools;

•rapid technological change in the financial services industry;

•increased competition in the financial services industry from non-banks such as credit unions and Fintech companies, including digital asset service providers;

•our ability to adapt successfully to technological changes to compete effectively in the marketplace, including as a result of competition from other commercial banks, credit unions, securities brokerage firms, insurance companies, and Fintech companies;

•the credit risks of lending activities, including changes in the level and trend of loan delinquencies, write-offs and changes in our ACL on loans and provision for credit losses on loans that may be affected by deterioration in the housing and CRE markets, which may lead to increased losses and nonperforming assets in our loan portfolio, and may result in our ACL on loans no longer being adequate to cover actual losses, or require us to increase our ACL on loans;

•the impact of changing levels of inflation and the current and future monetary policies of the Federal Reserve in response thereto;

•the relative differences between short-term and long-term interest rates, deposit interest rates, our net interest margin and funding sources;

•the impact of repricing and competitors' pricing initiatives on loan and deposit products;

•fluctuations in the demand for loans;

•the effects of recent developments and events in the financial services industry, including the large-scale deposit withdrawals over a short period of time that resulted in prior bank failures;

•the extensive regulatory framework that applies to us;

•results of examinations by the bank regulators, including the possibility that any such regulatory authority may, among other things, initiate an enforcement action against the Company or the Bank which could require us to increase our ACL on loans, write down assets, change our regulatory capital position, affect our ability to borrow funds or maintain or increase deposits or

5

Table ofContents

impose additional requirements on us, any of which could affect our ability to continue our growth through mergers, acquisitions or similar transactions and adversely affect our liquidity and earnings;

•the quality and composition of our securities portfolio and the impact of any adverse changes with respect thereto, including market liquidity within the securities markets;

•the concentration of large deposits from certain customers, who have balances above current FDIC insurance limits;

•our ability to attract and retain deposits;

•the overall health of local and national real estate markets;

•the level of nonperforming assets on our balance sheet;

•effects of and potential changes to critical accounting policies and judgments, including the use of estimates in determining the fair value of certain of our assets, which estimates may prove to be incorrect and result in significant declines in valuation;

•the commencement, costs, effects and outcome of litigation and other legal proceedings and regulatory actions against us or to which we may become subject, including settlements and judgments;

•the effects of climate change, severe weather events, natural disasters, pandemics, epidemics and other public health crises, acts of war or terrorism, and other external events on our business and the businesses of our customers;

•the impact of bank failures or adverse developments at other banks and related negative publicity about the banking industry in general on investor and depositor sentiment regarding the stability and liquidity of banks;

•the composition of our executive management team and our ability to attract and retain key personnel;

•our ability to control operating costs and expenses;

•the effectiveness of our risk management framework;

•difficulties in reducing risk associated with our loans;

•staffing fluctuations in response to product demand or the implementation of corporate strategies that affect our workforce and potential associated charges;

•our ability to implement our business strategies and manage our growth;

•future goodwill impairment due to changes in our business, market conditions or other factors;

•our ability to successfully integrate any assets, liabilities, customers, systems and management personnel we may acquire into our operations and our ability to realize related revenue synergies and cost savings within expected time frames or at all, and any goodwill charges related thereto and costs or difficulties relating to integration matters, including but not limited to customer and employee retention, which might be greater than expected;

•risks related to acquiring assets in or entering markets in which we have not previously operated and may not be familiar;

•changes in consumer spending, borrowing and savings habits;

•our ability to pay dividends on our common stock;

•other economic, competitive, governmental, regulatory and technological factors affecting our operations, pricing, products and services;

•our success at managing the risks involved in the foregoing items; and

•other risks described elsewhere in this Form 10-K and in our other reports filed with or furnished to the SEC, which are available on our website at www.hf-wa.com and on the SEC's website at www.sec.gov.

PART I

ITEM 1. BUSINESS

Overview

Heritage Financial Corporation is a bank holding company that was incorporated in the State of Washington in August 1997. We are primarily engaged in the business of planning, directing, and coordinating the business activities of our wholly-owned subsidiary and single reportable segment, Heritage Bank.

Heritage Bank is headquartered in Olympia, Washington and conducts business from its 50 branch offices located throughout Washington State, the greater Portland, Oregon area, Eugene, Oregon and Boise, Idaho as of December 31, 2024. Heritage Bank also does business under the Whidbey Island Bank name on Whidbey Island, Washington. The deposits of the Bank are insured by the FDIC.

Our business consists primarily of commercial lending and deposit relationships with small and medium-sized businesses and their owners in our market areas and attracting deposits from the general public. We also make real estate construction and land development loans and consumer loans.

Business Strategy

We are committed to being the leading commercial community bank in the Pacific Northwest by continuously improving customer satisfaction, employee empowerment, community investment and shareholder value. Our commitment defines our relationships, sets expectations for our actions and directs decision-making in these four fundamental areas. We seek to achieve our business goals through the following strategies:

Expand geographically as opportunities present themselves.We are committed to continuing the controlled expansion of our franchise through strategic acquisitions designed to increase our market share and enhance franchise value. We believe that consolidation across the community bank landscape will continue to take place and further believe that, with our capital and liquidity positions, our approach to credit management, and our extensive acquisition experience, we are well-positioned to take advantage of acquisitions or other business opportunities in our market areas. In markets where we wish to enter or expand our business, we also periodically consider opening de novo branches, typically in conjunction with hiring commercial lending and

6

Table ofContents

deposit teams. In the past, we have successfully integrated acquired institutions and opened de novo branches. We continue to be disciplined and opportunistic as it pertains to future acquisitions and de novo branching, focusing on the Pacific Northwest markets we know and understand.

Focus on asset quality.A strong credit culture is a high priority for us. We have a well-developed credit approval structure that has enabled us to maintain a standard of asset quality that we believe has moderate and manageable risk while at the same time allowing us to achieve our lending objectives. We continue to focus on loan types and markets that we know well and where we have a historical record of success. We focus on loan relationships that are well-diversified in both size and industry types. With respect to commercial business lending, which is our predominant lending activity, we view ourselves as cash-flow lenders obtaining additional support from realistic collateral values, personal guarantees and other secondary sources of repayment. We have a problem loan resolution process that is focused on quick detection and implementing feasible solutions and subject our loans to periodic internal loan reviews.

Maintain a strong balance sheet.In addition to our focus on underwriting, we believe the strength of our balance sheet provides us with the flexibility to manage through a variety of scenarios including additional growth-related activities. As of December 31, 2024, our on-balance sheet liquidity position was $117.1 million in cash and cash equivalents and $1.47 billion in total investment securities. See also Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations — Liquidity and Capital Resources of this Form 10-K. As of December 31, 2024, the regulatory capital ratios of the Bank were in excess of the levels required for “well-capitalized” status, and our consolidated common equity tier 1 capital ratio, leverage ratio, Tier 1 capital ratio, and total capital ratio were 12.0%, 10.0%, 12.4% and 13.3%, respectively.

Focus on deposit growth.Our strategic focus is to continuously grow deposits with emphasis on total relationship banking with our business and retail customers. We continue to seek to increase our market share in the communities we serve by providing exceptional customer service, focusing on relationship development with local businesses and strategic branch expansion. Our primary focus is to maintain a high level of non-maturity deposits to internally fund our loan growth with a low reliance on maturity (certificate) deposits. At December 31, 2024, our non-maturity deposits were 82.8% of our total deposits. Our technology-based products, including online personal financial management, business cash management and business remote deposit products enable us to compete effectively with banks of all sizes. Our retail and commercial management teams are well-seasoned and have strong ties to the communities we serve with a strong focus on relationship building and customer service.

Emphasize business relationships with a focus on commercial lending. We continue to market primarily commercial business loans and the deposit balances that accompany these relationships. Our seasoned lending staff has extensive knowledge and experience, and can add value through a focused advisory role that we believe strengthens our customer relationships and develops loyalty. We currently have, and will seek to maintain, a diversified portfolio of lending relationships without significant concentrations in any industry.

Recruit and retain highly competent personnel to execute our strategies.Our compensation and staff development programs are aligned with our strategies to grow our loans and non-maturity deposits while maintaining our focus on asset quality. Our incentive systems are designed to achieve balanced, high quality asset growth while maintaining appropriate mechanisms to reduce or eliminate incentive payments when appropriate. Our equity compensation programs and retirement benefits are designed to build and encourage employee ownership at all levels of the Company and we align employee performance objectives with corporate growth strategies and shareholder value. We have a strong corporate culture, which is supported by our commitment to internal development and promotion from within as well as the retention of management and officers in key roles.

There have been no material changes to our business strategy during the years ended December 31, 2024 and 2023.

History

The Bank was established in 1927 as a federally-chartered mutual savings bank. In 1992, the Bank converted to a state-chartered mutual savings bank under the name "Heritage Savings Bank". Through the mutual holding company reorganization of the Bank and subsequent conversion of the mutual holding company, the Bank became a stock savings bank and a wholly-owned subsidiary of the Company effective August 1997. Effective September 1, 2004, Heritage Savings Bank switched its charter from a state-chartered savings bank to a state-chartered commercial bank and changed its legal name from "Heritage Savings Bank" to "Heritage Bank". The following table lists major acquisitions completed by the Company:

Acquisition June 1998 North Pacific Bancorporation North Pacific Bank $ 85

FDIC Assisted Purchase August 2010 n/a Cowlitz Bank 345

FDIC Assisted Purchase November 2010 n/a Pierce Commercial Bank 211

Acquisition January 2013 n/a Northwest Commercial Bank 65

Acquisition July 2013 Valley Community Bancshares, Inc. Valley Bank 237

Merger May 2014 Washington Banking Company Whidbey Island Bank 1,657

7

Table ofContents

Acquisition January 2018 Puget Sound Bancorp, Inc. Puget Sound Bank 571

Acquisition July 2018 Premier Commercial Bancorp Premier Community Bank 387

Description of Business

Retail Banking

We offer a full range of products and services to customers for personal and business banking needs designed to attract both short-term and long-term deposits. Deposits are our primary source of funds. Our personal and business banking customers have the option of selecting from a variety of account types. The major categories of deposit accounts that we offer are described below. These accounts, with the exception of noninterest demand accounts, generally earn interest at rates established by management based on competitive market factors and management’s desire to increase or decrease certain types or maturities of deposits.

Noninterest Demand Deposits. Deposits are noninterest bearing and may be charged service fees based on activity and balances.

Interest Bearing Demand Deposits.Deposits are interest bearing and may be charged service fees based on activity and balances. Interest bearing demand deposits pay interest, but require a higher minimum balance to avoid service charges.

Money Market Accounts.Depositspay an interest rate that is tiered depending on the balance maintained in the account. Minimum opening balances vary.

Savings Accounts.Deposits are interest bearing provided that a minimum balance is maintained to avoid service charges.

Certificate of Deposit Accounts.Deposits require a minimum deposit of $2,500 and have maturities ranging from three months to five years. Jumbo certificate of deposit accounts are offered in amounts of $100,000 or more for terms of seven days to one year.

Our personal checking accounts feature an array of benefits and options, including online banking, online statements, mobile banking with mobile deposit, VISA debit cards and access to more than 40,000 surcharge free Automated Teller Machines through the MoneyPass network.

We also offer investment advice through a Wealth Management department that provides objective advice from trusted advisers.

Lending Activities

Our lending activities are conducted through the Bank. While our focus is on commercial business lending, we also originate real estate construction and land development loans and consumer loans. Our loans are originated under policies that are reviewed and approved annually by our Board. In addition, we have established internal lending guidelines that are updated as needed. These policies and guidelines address underwriting standards, structure and rate considerations and compliance with laws, regulations and internal lending limits. We conduct post-approval reviews on selected loans and routinely perform internal loan reviews of our loan portfolio to confirm credit quality, proper documentation and compliance with laws and regulations. Loan repayments are considered one of the primary sources of funding for the Company.

Commercial Business Lending

At December 31, 2024, we had $3.76 billion, or 78.3% of our loans receivable, in commercial business loans. We offer different types of commercial business loans, including lines of credit, term equipment financing and term owner-occupied and non-owner occupied CRE loans. We also originate loans that are guaranteed by the U.S. SBA, for which the Bank is a “preferred lender,” the USDA and the Federal Agricultural Mortgage Corporation. Before extending credit to a business, we review and analyze the borrower’s management ability, financial history, including cash flow of the borrower and all guarantors, and anticipated liquidation value of the collateral. Emphasis is placed on having a comprehensive understanding of the borrower’s global cash flow and performing necessary financial due diligence.

We originate CRE loans within our primary market areas, with a focus on loans secured by owner-occupied properties. Our underwriting standards require that non-owner occupied and owner-occupied CRE loans not exceed 75% and 80%, respectively, of the lower of appraised value at origination or cost of the underlying collateral. Cash flow debt coverage covenant requirements typically range from 1.15 times to 1.25 times, depending on the type of property. Actual debt service coverage is usually higher than required covenant thresholds, as loan sizing requires sensitized coverage using an "underwriting" interest rate that is higher than the note rate.

CRE loans typically involve a greater degree of risk than residential real estate loans. Payments on loans secured by CRE properties are dependent on successful operation and management of the properties and repayment of these loans may be affected by adverse conditions in the real estate market or the broader economy. We seek to minimize these risks by determining the financial condition of the borrower and any tenants, the quality and value of the collateral and the strength of management of the property securing the loan. We also generally obtain personal guarantees from the owners of the collateral after a thorough review of personal financial statements. In addition, we reviewed over 65% of our CRE loan portfolio during the year ended December 31, 2024 for various performance related criteria and stress-test loans for potential changes in interest rates, occupancy and collateral values.

8

Table ofContents

The Company may enter into non-hedging interest rate swap contracts with commercial customers to accommodate their business needs. For additional information, see Note (7) Derivative Financial Instruments of the Notes to Consolidated Financial Statements included in Item 8. Financial Statements And Supplementary Data of this Form 10-K.

Real Estate Construction and Land Development

At December 31, 2024, we had $479.4 million, or 9.9% of our loans receivable, in real estate construction and land development loans, including residential construction loans and commercial and multifamily construction loans.

We originate residential construction loans to builders for the construction of pre-sold homes and speculative residential properties. Because of the higher risks present in the residential construction industry, our lending to builders is limited to those who have demonstrated a favorable record of performance and who are building in markets that our management understands. We further endeavor to limit our construction lending risk through adherence to strict underwriting guidelines and procedures. Speculative construction loans are short term in nature and have a variable rate of interest. We require builders to have tangible equity in each construction project, have prompt and thorough documentation of all draw requests and permit us to inspect the project prior to paying any draw requests.

Commercial and multifamily construction loans also have a higher risk because of the construction element and lease-up elements, if such properties are not pre-leased. As a result, this type of construction loan is made only to strong borrowers with sufficient equity into the project and additional resources they can draw on if needed. The Company performs due diligence to gain comfort that the experience of the general contractor is sufficient to finish the project on budget and on time. Project feasibility is also important and our lenders ensure the project is economically viable. Commercial and multifamily construction loans are monitored through cost reviews, regulatory-compliant appraisals, sufficient equity, engineering inspections and controlled disbursements.

Residential Real Estate Loans, Originations and Sales

At December 31, 2024, residential real estate loans totaled $403.0 million, or 8.4% of our loans receivable. The majority of our residential real estate loans are secured by single-family residences located in our primary market areas. Our underwriting standards require that residential real estate loans generally are owner-occupied and do not exceed 80% of the lower of appraised value at origination or cost of the underlying collateral. Terms typically range from 15 to 30 years. As part of our asset/liability management strategy, we have historically sold originated residential real estate loans in the secondary market with no recourse and servicing released. In January 2024, we ceased the origination of residential real estate loans. We have and may buy pools of mortgage loans or otherwise acquire mortgage loans from other originators.

Consumer

At December 31, 2024, we had $164.7 million, or 3.4% of our loans receivable, in consumer loans. We originate consumer loans and lines of credit that are both secured and unsecured.

For additional information, see Item 1A. Risk Factors—Credit Risks this Form 10-K.

Supervision and Regulation

General

FDIC-insured institutions, like the Bank, their holding companies and affiliates are extensively regulated under federal and state law. As a result, our growth and earnings performance may be affected not only by management decisions and general economic conditions, but also by the requirements of federal and state statutes and by the regulations and policies of various banking agencies, including the DFI, the Federal Reserve, the FDIC and the Consumer Financial Protection Bureau (“CFPB”). Furthermore, taxation laws administered by the Internal Revenue Service and state taxing authorities, accounting rules developed by the FASB and PCAOB, securities laws administered by the SEC and state securities authorities, and anti-money and sanctions laundering laws enforced by the U.S. Department of the Treasury (“Treasury”) have an impact on our business. The effect of these statutes, regulations, regulatory policies and accounting rules are significant to our operations and results.

Federal and state banking laws impose a comprehensive system of supervision, regulation and enforcement on the operations of FDIC-insured institutions, their holding companies and affiliates that is intended primarily for the protection of the FDIC-insured deposits and depositors of banks, rather than shareholders. These laws, and the regulations of the banking agencies issued under them, affect, among other things, the scope of our business, the kinds and amounts of investments that the Company and the Bank may make, required capital levels relative to assets, the nature and amount of collateral for loans, the establishment of branches, the ability of the Company or the Bank to merge, consolidate and acquire, dealings with our insiders and affiliates and the payment of dividends.

In reaction to the global financial crisis and particularly following the passage of the Dodd-Frank Act, we experienced heightened regulatory requirements and scrutiny. Although the reforms primarily targeted large banking organizations and systemically important financial institutions, their influence filtered down in varying degrees to community banks over time and caused our compliance and risk management processes, and the costs thereof, to increase. The Economic Growth Act eliminated questions about the applicability of certain Dodd-Frank Act reforms to community bank systems, including relieving them of any requirement to engage in mandatory stress tests, maintain a risk committee or comply with the Volcker Rule’s complicated prohibitions on proprietary trading and ownership of private funds. These reforms have been favorable to our operations. It is anticipated that the Trump Administration and the current U.S. Congress likely will not increase the regulatory burden on community banking organizations and may seek to reduce and streamline certain prudential and regulatory requirements

9

Table ofContents

applicable to community banking organizations at a federal level based on statements made by relevant congressional leaders and the acting leaders of certain federal banking agencies. At this time, however, it is not possible to predict with any certainty the actual impact that the Trump Administration may have on the banking industry or the operations of the Company or the Bank.

The supervisory framework for U.S. banking organizations subjects banks and bank holding companies to regular examination by their respective banking agencies, which results in examination reports and ratings that are not publicly available and that can impact the conduct and growth of their businesses. These examinations consider not only compliance with applicable laws and regulations, but also capital levels, asset quality and risk, management ability and performance, earnings, liquidity and various other factors. The banking agencies generally have broad discretion to impose restrictions and limitations on the operations of a regulated entity where the agencies determine, among other things, that such operations are unsafe or unsound, fail to comply with applicable law or are otherwise inconsistent with laws and regulations. The approach to supervision adopted by each banking agency may have significant impacts on the operations and results of the Company and the Bank, as well as the banking industry in general. Based on recent statements made by congressional leaders and the acting leaders of certain federal banking agencies, there may be changes in the supervisory processes and approach made by the Trump Administration banking agencies, but it is not possible at this time to predict the specific changes (or the timing of any such changes) that may be made.

The following is a summary of the material elements of the supervisory and regulatory framework applicable to the Company and the Bank. It does not describe all of the statutes, regulations and regulatory policies that apply, nor does it restate all of the requirements of those that are described. The descriptions are qualified in their entirety by reference to the particular statutory and regulatory provision.

The Role of Capital

Regulatory capital represents the net assets of a banking organization available to absorb losses. FDIC-insured institutions, such as banks, as well as their holding companies (i.e., banking organizations) are required to hold more capital than other businesses, which directly affects our earnings capabilities. Although capital has historically been one of the key measures of the financial health of both bank holding companies and banks, its role became fundamentally more important in the wake of the global financial crisis, as the banking regulators recognized that the amount and quality of capital held by banking organizations prior to that crisis was insufficient to absorb losses during periods of severe stress.

Capital Levels. Banking organizations have been required to hold minimum levels of capital based on guidelines established by the banking agencies since 1983. The minimums have been expressed in terms of ratios of “capital” divided by “total assets.” Beginning in 1989, the capital guidelines for U.S. banking organizations have been based upon international capital accords (known as “Basel” accords) adopted by the Basel Committee on Banking Supervision, a committee of central banks and bank supervisors that acts as the primary global standard-setter for prudential regulation, as implemented by the U.S. federal banking agencies on an interagency basis. These accords recognized that bank assets for the purpose of the capital ratio calculations needed to be risk weighted (the theory being that riskier assets should require more capital) and that off-balance sheet exposures needed to be factored in the calculations. Following the global financial crisis, the Group of Governors and Heads of Supervision, the oversight body of the Basel Committee on Banking Supervision, announced agreement on a strengthened set of capital requirements for banking organizations around the world, known as the Basel III accords, to address deficiencies recognized in connection with the global financial crisis.

The Basel III Rule. The U.S. federal bank regulatory agencies adopted the U.S. Basel III regulatory capital reforms, and, at the same time, effected changes required by the Dodd-Frank Act, in regulations that were effective (with certain phase-ins) in 2015 (the “Basel III Rule”). The Basel III Rule established capital standards for banking organizations that are meaningfully more stringent than those established previously and are still in effect today.

The Basel III Rule is applicable to all banking organizations that are subject to minimum capital requirements, including national banks, state banks and savings and loan associations, as well as to most bank and savings and loan holding companies. The Company and the Bank are each subject to the Basel III Rule.

Risk-Weighting Assets. Three of the required capital ratios imposed under the Basel III Rule, as discussed immediately below, are calculated using a denominator of total “risk-weighted” assets. In the calculation of so-called “risk weights,” which was introduced in the Basel I accord, bank assets were divided into four basic risk-weighted categories of 0%, 20%, 50%, and 100%. The Basel III accords required a more complex, detailed and calibrated assessment of risk in the calculation of risk weightings. Although it uses the same technique introduced by the Basel I accord in assigning assets to risk-weight categories, it significantly increases the number of categories and adds conditions to the assignment of certain risk weights. Risk weights were established as high as 250% for certain commercial real estate exposures, and higher for certain derivatives.

The assignment of risk weights is likely to continue to be under review by the federal banking agencies as they seek to implement certain remaining elements of the Basel III accords. In July 2023, the Biden Administration banking agencies proposed wide-ranging and significant changes to the Basel III Rules (the “Basel III Endgame Proposal”), which would have, among other requirements, imposed structural changes to the calculation of capital requirements and risk-weighted assets. The Basel III Endgame Proposal would have primarily impacted the capital requirements applicable to banking organizations with $100 billion or more in total assets, and as a general matter, would not have impacted the Company. The Basel III Endgame Proposal has not been, and is not expected to be, adopted in its proposed form. The Trump Administration banking agencies may change or issue their own version of this proposal.

Minimum Capital Ratios. The Basel III Rule also increased the required quantity and quality of capital. Not only did it increase most of the required minimum capital ratios in effect prior to January 1, 2015, but, in requiring that forms of capital be of higher quality to absorb loss, it introduced the concept of Common Equity Tier 1 Capital, which consists primarily of common stock, related surplus (net of Treasury stock), retained earnings, and Common Equity Tier 1 minority interests subject to certain

10

Table ofContents

regulatory adjustments. The Basel III Rule also changed the definition of capital by establishing more stringent criteria that instruments must meet to be considered Additional Tier 1 Capital (primarily non-cumulative perpetual preferred stock that meets certain requirements) and Tier 2 Capital (primarily other types of preferred stock and subordinated debt, subject to limitations). The Basel III Rule also constrained the inclusion of minority interests, mortgage-servicing assets, and deferred tax assets in capital and required deductions from Common Equity Tier 1 Capital if such assets exceeded a percentage of a banking organization’s Common Equity Tier 1 Capital.

The Basel III Rule requires banking organizations to maintain minimum capital ratios as follows:

•A ratio of Common Equity Tier 1 Capital equal to 4.5% of risk-weighted assets;

•A ratio of Tier 1 Capital equal to 6% of risk-weighted assets;

•A ratio of Total Capital (Tier 1 plus Tier 2) equal to 8% of risk-weighted assets; and

•A leverage ratio of Tier 1 Capital to total quarterly average assets equal to 4% in all circumstances.

In addition, banking organizations that want to make capital distributions (including for dividends and repurchases of stock) and pay discretionary bonuses to executive officers without restriction also must maintain 2.5% in Common Equity Tier 1 Capital attributable to a capital conservation buffer. The purpose of the conservation buffer is to ensure that banking institutions maintain a buffer of capital that can be used to absorb losses during periods of financial and economic stress. Factoring in the conservation buffer increases the minimum ratios depicted above to 7% for Common Equity Tier 1 Capital, 8.5% for Tier 1 Capital and 10.5% for Total Capital.

Well-Capitalized Requirements. The ratios described above are minimum standards in order for banking organizations to be considered “adequately capitalized.” Banking agencies uniformly encourage banking organizations to hold more capital and be “well-capitalized” and, to that end, federal law and regulations provide various incentives for banking organizations to maintain regulatory capital at levels in excess of minimum regulatory requirements. For example, a banking organization that is well-capitalized may: (i) qualify for exemptions from prior notice or application requirements otherwise applicable to certain types of activities; (ii) qualify for expedited processing of other required notices or applications; and (iii) accept, roll-over or renew brokered deposits. Higher capital levels also could be required if warranted by the particular circumstances or risk profiles of individual banking organizations. For example, the Federal Reserve’s capital guidelines contemplate that additional capital may be required to take adequate account of, among other things, interest rate risk, or the risks posed by concentrations of credit, nontraditional activities or securities trading activities. Further, any banking organization experiencing or anticipating significant growth would be expected to maintain capital ratios, including tangible capital positions (i.e., Tier 1 Capital less all intangible assets), well above the minimum levels.

Under the capital regulations of the Federal Reserve for the Company and the FDIC for the Bank, in order to be well capitalized, a banking organization, like the Company and the Bank, must maintain:

•A Common Equity Tier 1 Capital ratio to risk-weighted assets of 6.5% or more;

•A ratio of Tier 1 Capital to total risk-weighted assets of 8% or more;

•A ratio of Total Capital to total risk-weighted assets of 10% or more; and

•A leverage ratio of Tier 1 Capital to total adjusted average quarterly assets of 5% or greater.

It is possible under the Basel III Rule to be well-capitalized while remaining out of compliance with the capital conservation buffer discussed above.

As of December 31, 2024: (i) the Bank was not subject to a directive from the FDIC or the DFI to increase its capital and (ii) the Bank was well-capitalized, as defined by FDIC regulations. As of December 31, 2024, the Company had regulatory capital in excess of the Federal Reserve’s requirements and met the Basel III Rule requirements to be well-capitalized. As of December 31, 2024, we were also in compliance with the capital conservation buffer.

Prompt Corrective Action. The concept of a banking organization being “well-capitalized” is part of a regulatory enforcement regime that provides the federal banking agencies with broad power to take “prompt corrective action” to resolve the problems of depository institutions based on the capital level of each particular institution. The extent of the banking agencies’ powers depends on whether the institution in question is “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” or “critically undercapitalized,” in each case as defined by regulation. Depending upon the capital category to which a banking organization is assigned, the banking agencies’ corrective powers include: (i) requiring the institution to submit a capital restoration plan; (ii) limiting the institution’s asset growth and restricting its activities; (iii) requiring the institution to issue additional capital stock (including additional voting stock) or to sell itself; (iv) restricting transactions between the institution and its affiliates; (v) restricting the interest rate that the institution may pay on deposits; (vi) ordering a new election of directors of the institution; (vii) requiring that senior executive officers or directors be dismissed; (viii) prohibiting the institution from accepting deposits from correspondent banks; (ix) requiring the institution to divest certain subsidiaries; (x) prohibiting the payment of principal or interest on subordinated debt; and (xi) ultimately, appointing a receiver for the institution.

Community Bank Capital Simplification. Community banking organizations have long raised concerns with federal banking agencies about the regulatory burden, complexity, and costs associated with certain provisions of the Basel III Rule. In response, the U.S. Congress provided an “off-ramp” for institutions, like us, with total consolidated assets of less than $10 billion as part of the Economic Growth Act. Section 201 of the Economic Growth Act specifically instructed the federal banking regulators to establish a single “Community Bank Leverage Ratio” (“CBLR”) of between 8% and 10%. Under the final rule, a community banking organization is eligible to elect to comply with its capital requirements under the CBLR framework if it has: (i) less than

11

Table ofContents

$10 billion in total consolidated assets; (ii) limited amounts of certain assets and off-balance sheet exposures; and (iii) a CBLR greater than 9%. We may elect the CBLR framework at any time, but have not elected to use the CBLR framework as of December 31, 2024.

Supervision and Regulation of the Company

General. The Company, as the sole shareholder of the Bank, is a bank holding company. As a bank holding company, we are registered with, and subject to regulation, supervision and enforcement by, the Federal Reserve under the BHCA. We are legally obligated to act as a source of financial and managerial strength to the Bank and to commit resources to support the Bank in circumstances where we might not otherwise do so. Under the BHCA, we are subject to periodic examination by the Federal Reserve and are required to file with the Federal Reserve periodic reports of our operations and such additional information regarding us and the Bank as the Federal Reserve may require.

Acquisitions, Activities and Financial Holding Company Election. The primary purpose of a bank holding company is to control and manage banks. The BHCA generally requires the prior approval of the Federal Reserve for any merger involving a bank holding company or any acquisition by a bank holding company of another bank or bank holding company. Subject to certain conditions (including deposit concentration limits established by the BHCA), the Federal Reserve may allow a bank holding company to acquire banks located in any state of the United States. In approving interstate acquisitions, the Federal Reserve is required to give effect to applicable state law limitations on the aggregate amount of deposits that may be held by the acquiring bank holding company and its FDIC-insured institution affiliates in the state in which the target bank is located (provided that those limits do not discriminate against out-of-state institutions or their holding companies) and state laws that require that the target bank have been in existence for a minimum period of time (not to exceed five years) before being acquired by an out-of-state bank holding company. Furthermore, in accordance with the Dodd-Frank Act, bank holding companies must be well-capitalized and well-managed in order to effect interstate mergers or acquisitions. For a discussion of the capital requirements, see “–The Role of Capital” above.

The BHCA generally prohibits us from acquiring direct or indirect ownership or control of more than 5% of the voting shares of any company that is not a bank and from engaging in any business other than that of banking, managing and controlling banks or furnishing services to banks and their subsidiaries. This general prohibition is subject to a number of exceptions. The principal exception allows bank holding companies to engage in, and to own shares of companies engaged in, certain businesses found by the Federal Reserve prior to November 11, 1999 to be “so closely related to banking... as to be a proper incident thereto.” This authority permits us to engage in a variety of banking-related businesses, including the ownership and operation of a savings association, or any entity engaged in consumer finance, equipment leasing, the operation of a computer service bureau (including software development) and mortgage banking and brokerage services. The BHCA does not place territorial restrictions on the domestic activities of nonbank subsidiaries of bank holding companies. In addition to approval from the Federal Reserve, prior approval for acquisitions may be required from other agencies, such as the DFI or other agencies that regulate the target company of an acquisition.

Additionally, bank holding companies that meet certain eligibility requirements prescribed by the BHCA and elect to operate as financial holding companies may engage in, or own shares in companies engaged in, a wider range of nonbanking activities, including securities and insurance underwriting and sales, merchant banking and any other activity that the Federal Reserve, in consultation with the Secretary of the Treasury, determines by regulation or order is financial in nature or incidental to any such financial activity or that the Federal Reserve determines by order to be complementary to any such financial activity, as long as the activity does not pose a substantial risk to the safety or soundness of FDIC-insured institutions or the financial system generally. We have not currently elected to operate as a financial holding company.

Change in Control. Federal law also prohibits any person or company from acquiring “control” of an FDIC-insured depository institution or its holding company without prior notice to the appropriate federal bank regulator. “Control” is conclusively presumed to exist upon the acquisition of 25% or more of the outstanding voting securities of a bank or bank holding company, but may arise under certain circumstances between 10% and 24.99% ownership.

Capital Requirements. We are required to maintain consolidated capital in accordance with Federal Reserve capital adequacy requirements. For a discussion of capital requirements, see “–The Role of Capital” above.

Dividend Payments. Our ability to pay dividends to our shareholders may be affected by both general corporate law considerations and policies of the Federal Reserve applicable to bank holding companies. As a Washington corporation, we are subject to the limitations of Washington corporate law, which does not allow us to pay dividends if, after that payment, the Company would not be able to pay its liabilities as they become due in the usual course of business or its total assets would be less than its total liabilities.

As a general matter, the Federal Reserve has indicated that the board of directors of a bank holding company should eliminate, defer or significantly reduce dividends to shareholders if: (i) the company’s net income available to shareholders for the past four quarters, net of dividends previously paid during that period, is not sufficient to fully fund the dividends; (ii) the prospective rate of earnings retention is inconsistent with the company’s capital needs and overall current and prospective financial condition; or (iii) the company will not meet, or is in danger of not meeting, its minimum regulatory capital adequacy ratios. The Federal Reserve also possesses enforcement powers over bank holding companies and their nonbank subsidiaries to prevent or remedy actions that represent unsafe or unsound practices or violations of applicable statutes and regulations. Among these powers is the ability to proscribe the payment of dividends by banks and bank holding companies. In addition, under the Basel III Rule, banking organizations that want to pay unrestricted dividends must maintain 2.5% in Common Equity Tier 1 Capital attributable to the capital conservation buffer. See “–The Role of Capital” above.

12

Table ofContents

Incentive Compensation. There have been a number of developments in recent years focused on incentive compensation plans sponsored by bank holding companies and their subsidiary banks, reflecting recognition by the federal banking agencies and the U.S. Congress that flawed incentive compensation practices in the financial industry were one of many factors contributing to the global financial crisis. The result was interagency guidance on sound incentive compensation practices for banking organizations.

The interagency guidance recognized three core principles. Effective incentive plans should: (i) provide employees incentives that appropriately balance risk and reward; (ii) be compatible with effective controls and risk-management; and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors. Much of the guidance is directed at large banking organizations and, because of the size and complexity of their operations, the regulators expect those organizations to maintain systematic and formalized policies, procedures and systems for ensuring that the incentive compensation arrangements for all executive and non-executive employees covered by this guidance are identified and reviewed, and appropriately balance risks and rewards. Under the interagency guidance, smaller banking organizations, like us, that use incentive compensation arrangements are expected to implement less extensive, formalized and detailed policies, procedures and systems than those of the larger banks.

In May 2024, certain of the federal banking and other financial services agencies released a proposed rule regarding certain incentive-based compensation arrangements at certain financial institutions with at least $1 billion in assets, as required under Section 956 of the Dodd-Frank Act. This proposal was largely based on an earlier 2016 proposal. The Federal Reserve and the SEC, however, did not join this proposal, signaling potential interagency misalignment and raising doubts regarding the likelihood of the proposed rule being finalized in its current form. The FDIC has indicated that the agencies will continue to coordinate to reach consensus, but it is not yet clear whether this initiative will continue during the Trump Administration.

Monetary Policy. The monetary policy of the Federal Reserve has a significant effect on the operating results of bank holding companies and their subsidiaries. Among the tools available to the Federal Reserve to affect the money supply are open market transactions in U.S. government securities and changes in the discount rate on bank borrowings. These means are used in varying combinations to influence overall growth and distribution of bank loans, investments and deposits, and their use may affect interest rates charged on loans or paid on deposits, which may impact our business and the operations of the Company and the Bank.

Federal Securities Regulation. Our common stock is registered with the SEC under the Securities Act of 1933, as amended, and the Exchange Act. Consequently, we are subject to the information, proxy solicitation, insider trading and other restrictions and requirements of the SEC under the Exchange Act.

Corporate Governance. The Dodd-Frank Act addressed many investor protection, corporate governance and executive compensation matters that affect most U.S. publicly traded companies. It increased shareholder influence over boards of directors by requiring companies to give shareholders a nonbinding vote on executive compensation and so-called “golden parachute” payments, and authorizing the SEC to promulgate rules that would allow shareholders to nominate and solicit voters for their own candidates using a company’s proxy materials. The Dodd-Frank Act also directed the Federal Reserve, together with the federal banking and financial services agencies, to promulgate rules prohibiting excessive compensation paid to executives of bank holding companies, regardless of whether such companies are publicly traded. As discussed in the “Incentive Compensation” section above, the federal banking agencies and financial services agencies have proposed rules regarding incentive-based compensation arrangements for certain financial institutions, but no rule has been adopted at this time.

Supervision and Regulation of the Bank

General. The Bank is a Washington state-chartered bank. The deposit accounts of the Bank are insured by the FDIC’s Deposit Insurance Fund (“DIF”) to the maximum extent provided under federal law and FDIC regulations, currently $250,000 per insured depositor category. As a Washington state-chartered FDIC-insured bank, the Bank is subject to the examination, supervision, reporting and enforcement requirements of the DFI, the chartering authority for Washington banks, and the FDIC, designated by federal law as the primary federal regulator of insured state banks that, like the Bank, are not members of the Federal Reserve System (nonmember banks).

Deposit Insurance. As an FDIC-insured institution, the Bank is required to pay deposit insurance premium assessments to the FDIC. The FDIC has adopted a risk-based assessment system whereby FDIC-insured institutions pay insurance premiums at rates based on their risk classification. For institutions like the Bank that are not considered large and highly complex banking organizations, the risk-based assessment is based on examination ratings and financial ratios. The total base assessment rates, effective as of January 1, 2023, currently range from 2.5 basis points to 32 basis points. However, the maximum rate is 18 basis points for FDIC-insured institutions in the top two categories of examination composite ratings.

At least semi-annually, the FDIC updates its loss and income projections for the DIF and, if needed, increases or decreases the assessment rates, following notice and comment on proposed rulemaking. For this purpose, the reserve ratio is the DIF balance divided by estimated insured deposits. In response to the global financial crisis, the Dodd-Frank Act increased the minimum reserve ratio from 1.15% to 1.35% of the estimated amount of total insured deposits. In its October 2024 semiannual update, the FDIC stated that the reserve ratio likely will reach the statutory minimum by the September 30, 2028 deadline and that no adjustments to the base assessment rates are currently projected.

In addition, because the total cost of the failures of Silicon Valley Bank and Signature Bank to the DIF was approximately $24.1 billion, the FDIC adopted a special assessment for banking organizations having assets of $5 billion or more, at an annual rate of 13.4 basis points beginning with the first quarterly assessment period of 2024, and with an invoice payment date of June 28, 2024. The FDIC will continue to collect special assessments for an anticipated total of eight quarterly assessment periods. The special assessment amount for each FDIC-insured institution will be determined at a quarterly rate of 3.36 basis points,

13

Table ofContents

multiplied by an institution’s estimated uninsured deposits, reported for the quarter that ended December 31, 2022, adjusted to exclude the first $5 billion in estimated uninsured deposits of the institution (or of the banking organization as a whole for multi-bank holding companies, such as the Company). Although the Company and the Bank are subject to the FDIC’s special assessment as a banking organization with assets of $5 billion or more, the Company does not have to pay the special assessment based on its amount of uninsured deposits.

Supervisory Assessments. All Washington banks are required to pay supervisory assessments to the DFI to fund the operations of that agency as well as other examination fees. The amount of the assessment is calculated on the basis of the Bank’s total assets. During the year ended December 31, 2024, the Bank paid supervisory assessments to the DFI totaling approximately $0.2 million.

Capital Requirements. Banks are generally required to maintain capital levels in excess of other businesses. For a discussion of capital requirements, see “–The Role of Capital” above.

Liquidity Requirements. Liquidity is a measure of the ability and ease with which bank assets may be converted to meet financial obligations such as deposits or other funding sources. Banks are required to implement liquidity risk management frameworks that ensure they maintain sufficient liquidity, including a cushion of unencumbered, high quality liquid assets, to withstand a range of stress events. The level and speed of deposit outflows contributing to the failures of Silicon Valley Bank, Signature Bank and First Republic Bank in the first half of 2023 was unprecedented and contributed to acute liquidity and funding strain. These events have further underscored the importance of liquidity risk management and contingency funding planning by insured depository institutions like the Bank, as highlighted in a 2023 addendum to existing interagency guidance on funding and liquidity risk management.

The primary role of liquidity risk management is to: (i) prospectively assess the need for funds to meet obligations; and (ii) ensure the availability of cash or collateral to fulfill those needs at the appropriate time by coordinating the various sources of funds available to the institution under normal and stressed conditions. The Basel III Rule includes a liquidity framework that requires the largest insured institutions to measure their liquidity against specific liquidity tests. One test, referred to as the Liquidity Coverage Ratio is designed to ensure that the banking organization has an adequate stock of unencumbered high-quality liquid assets that can be converted easily and immediately in private markets into cash to meet liquidity needs for a 30-calendar day liquidity stress scenario. The other test, known as the Net Stable Funding Ratio, is designed to promote more medium- and long-term funding of the assets and activities of FDIC-insured institutions over a one-year horizon. These tests provide an incentive for banks and holding companies to increase their holdings in Treasury securities and other sovereign debt as a component of assets, increase the use of long-term debt as a funding source and rely on stable funding like core deposits (in lieu of brokered deposits).

Although these tests do not apply to the Bank, we continue to review our liquidity risk management policies in light of regulatory requirements and industry developments. For instance, in July 2024, the FDIC released a request for information on deposits, soliciting information on whether and to what extent certain types of deposits may behave differently from each other (particularly during periods of economic or financial stress), the results of which may impact liquidity monitoring and risk management requirements, including for FDIC-insured institutions like the Bank going forward.

Dividend Payments. The Bank pays dividends to the Company. Under the Washington Commercial Bank Act, Washington state-chartered banks may not declare or pay any dividend in an amount greater than its retained earnings, without approval from the DFI. Under the prompt corrective action requirements, the payment of dividends by any FDIC-insured institution is affected by the requirement to maintain adequate capital pursuant to applicable capital adequacy guidelines and regulations, and an FDIC-insured institution generally is prohibited from paying any dividends if, following payment thereof, the institution would be undercapitalized. As described above, the Bank exceeded its capital requirements under applicable guidelines as of December 31, 2024. Notwithstanding the availability of funds for dividends, however, the FDIC and the DFI may prohibit the payment of dividends by the Bank if either or both determine such payment would constitute an unsafe or unsound practice. In addition, under the Basel III Rule, banking organizations that want to pay unrestricted dividends must maintain 2.5% in Common Equity Tier 1 Capital attributable to the capital conservation buffer. See “–The Role of Capital” above.

State Bank Investments, Activities and Acquisitions. The Bank is permitted to make investments and engage in activities directly or through subsidiaries as authorized by Washington law. However, under federal law and FDIC regulations, FDIC-insured state banks are prohibited, subject to certain exceptions, from making or retaining equity investments of a type, or in an amount, that are not permissible for a national bank. Federal law and FDIC regulations also prohibit FDIC-insured state banks and their subsidiaries, subject to certain exceptions, from engaging as principal in any activity that is not permitted for a national bank unless the bank meets, and continues to meet, its minimum regulatory capital requirements and the FDIC determines that the activity would not pose a significant risk to the DIF. These restrictions have not had, and are not currently expected to have, a material impact on the operations of the Bank.

The Bank may be required to seek approval from the DFI, the FDIC and other banking or financial services agencies before engaging in certain acquisitions or mergers under applicable state and federal law. In 2024, each of the OCC and the FDIC separately released updated policy statements—and in the case of the OCC, a final rule—regarding how each banking agency reviews applications submitted pursuant to the Bank Merger Act based on statutory factors. The acting leader of the Trump Administration’s FDIC has indicated that the FDIC may seek to reverse the FDIC’s 2024 policy statement.

Insider Transactions. The Bank is subject to certain restrictions imposed by federal law on “covered transactions” between the Bank and its “affiliates.” The Company is an affiliate of the Bank for purposes of these restrictions, and covered transactions subject to the restrictions include extensions of credit to the Company, investments in the stock or other securities of the Company and the acceptance of the stock or other securities of the Company as collateral for loans made by the Bank. The

14

Table ofContents

Dodd-Frank Act enhanced the requirements for certain transactions with affiliates, including an expansion of the definition of “covered transactions” and an increase in the amount of time for which collateral requirements regarding covered transactions must be maintained.

Certain limitations and reporting requirements are also placed on extensions of credit by the Bank to its directors and officers, to directors and officers of the Company and its subsidiaries, to principal shareholders of the Company and to “related interests” of such directors, officers and principal shareholders under state and federal law. In addition, federal law and regulations may affect the terms on which any person who is a director or officer of the Company or the Bank, or a principal shareholder of the Company, may obtain credit from banks with which the Bank maintains a correspondent relationship.

Safety and Soundness Standards/Risk Management. The federal banking agencies have adopted operational and managerial standards to promote the safety and soundness of FDIC-insured institutions. The standards apply to internal controls, information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, compensation, fees and benefits, asset quality and earnings.

In general, the safety and soundness standards prescribe the goals to be achieved in each area, and each institution is responsible for establishing its own procedures to achieve those goals. While regulatory standards do not have the force of law, if an institution operates in an unsafe and unsound manner, the FDIC-insured institution’s primary federal banking agency may require the institution to submit a plan for achieving and maintaining compliance. If an FDIC-insured institution fails to submit an acceptable compliance plan, or fails in any material respect to implement a compliance plan that has been accepted by its primary federal banking agency, the agency is required to issue an order directing the institution to cure the deficiency. Until the deficiency cited in the regulator’s order is cured, the agency may restrict the FDIC-insured institution’s rate of growth, require the FDIC-insured institution to increase its capital, restrict the rates that the institution pays on deposits or require the institution to take any action that the agency deems appropriate under the circumstances. Noncompliance with safety and soundness may also constitute grounds for other enforcement action by the federal banking agencies, including cease and desist orders and civil money penalty assessments.

During the past decade, the banking agencies have increasingly emphasized the importance of sound risk management processes and strong internal controls when evaluating the activities of the FDIC-insured institutions they supervise. Properly managing risk has been identified as critical to the conduct of safe and sound banking activities and has become even more important as new technologies, product innovation, and the size and speed of financial transactions have changed the nature of banking markets. The agencies have identified a spectrum of risks facing a banking institution including, but not limited to, credit, market, liquidity, operational, legal and reputational risk. The Bank is expected to have active board and senior management oversight; adequate policies, procedures and limits; adequate risk measurement, monitoring and management information systems; and comprehensive internal controls. The federal banking agencies also have released specific risk management guidance on certain topics, including third-party relationships, in response to the proliferation of relationships between banking organizations and financial technology companies (although the guidance applies more broadly).

Privacy and Cybersecurity. The Bank is subject to many U.S. federal and state laws and regulations governing requirements for maintaining policies and procedures to protect non-public confidential information of its customers. These laws require the Bank to periodically disclose its privacy policies and practices relating to sharing such information and permit consumers to opt out of their ability to share information with unaffiliated third parties under certain circumstances. They also impact the Bank’s ability to share certain information with affiliates and non-affiliates for marketing and/or non-marketing purposes, or to contact customers with marketing offers. In addition, the Bank is required to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all businesses and geographic locations.

The Bank and the Company also are subject to a number of federal and state laws and regulations requiring notifications and disclosures regarding certain cybersecurity incidents. The Bank must also consider and address cybersecurity considerations as part of its risk management processes.

Branching Authority. Washington state-chartered banks, such as the Bank, have the authority under Washington Commercial Bank Act to establish branches anywhere in the State of Washington, subject to receipt of approval from the DFI and FDIC, as appropriate. The establishment of new interstate branches has historically been permitted only in those states the laws of which expressly authorize such expansion. The Dodd-Frank Act permits well-capitalized and well-managed banks to establish new interstate branches or the acquisition of individual branches of a bank in another state (rather than the acquisition of an out-of-state bank in its entirety) without impediments. Federal law permits state banks to merge with banks in other states subject to: (i) regulatory approval; (ii) federal and state deposit concentration limits; and (iii) state law limitations requiring the merging bank to have been in existence for a minimum period of time (not to exceed five years) prior to the merger.

Federal Home Loan Bank System. The Bank is a member of a FHLB, which serves as a central credit facility for its members. The FHLB is funded primarily from proceeds from the sale of obligations of the FHLB system. It makes loans to member banks in the form of FHLB advances. All advances from the FHLB are required to be fully collateralized as determined by the FHLB.

Community Reinvestment Act Requirements. The CRA requires the Bank to have a continuing and affirmative obligation in a safe and sound manner to help meet the credit needs of the entire community, including low- and moderate-income neighborhoods. The FDIC regularly assesses the Bank’s record of meeting the credit needs of its communities in dedicated examinations. The Bank’s CRA ratings derived from these examinations can have significant impacts on the activities in which the Bank and the Company may engage. For example, a low CRA rating may impact the review of applications for acquisitions by the Bank.

15

Table ofContents

On October 24, 2023, the federal banking agencies issued a final rule to strengthen and modernize the CRA regulations (the “CRA Rule”). Elements of the CRA Rule were originally intended to become effective on April 1, 2024 (while other elements had much later effective dates). However, the effective date of the CRA Rule was paused because of a preliminary injunction issued in connection with ongoing litigation claiming that the federal banking agencies exceeded their statutory authority in promulgating the CRA Rule. Despite this lawsuit, management of the Bank are continuing to assess the impact of the CRA Rule on the Bank’s CRA lending and investment activities in their respective markets.

The CRA Rule is designed to update how CRA activities qualify for consideration, where CRA activities are considered, and how CRA activities are evaluated. More specifically, the federal banking agencies described the goals of the CRA Rule as follows: (i) to expand access to credit, investment, and basic banking services in low- and moderate-income communities; (ii) to adapt to changes in the banking industry, including mobile and internet banking, by modernizing assessment areas while maintaining a focus on branch-based areas; (iii) to provide greater clarity, consistency, and transparency in the application of the regulations through the use of standardized metrics as part of CRA evaluation and clarifying eligible CRA activities focused on low- and moderate-income communities and underserved rural communities; (iv) to tailor CRA rules and data collection to bank size and business model; and (v) to maintain a unified approach among the regulators.

Anti-Money Laundering/Countering the Financing of Terrorism/Sanctions. The Bank Secrecy Act (“BSA”) is the common name for a series of laws and regulations enacted in the United States to combat money laundering and the financing of terrorism. They are designed to deny terrorists and criminals the ability to obtain access to the U.S. financial system and have significant implications for FDIC-insured institutions and other businesses involved in the transfer of money. The so-called Anti-Money Laundering / Countering the Financing of Terrorism (“AML/CFT”) regime under the BSA provides a foundation to promote financial transparency and deter and detect those who seek to misuse the U.S. financial system to launder criminal proceeds, finance terrorist acts, or move funds for other illicit purposes. The laws mandate financial services companies to have policies and procedures with respect to measures designed to address: (i) customer identification programs; (ii) money laundering; (iii) terrorist financing; (iv) identifying and reporting suspicious activities and currency transactions; (v) currency crimes; and (vi) cooperation between FDIC-insured institutions and law enforcement authorities. The Bank must also comply with stringent economic and trade sanctions regimes administered and enforced by the Office of Foreign Assets Control.

Concentrations in Commercial Real Estate. Concentration risk exists when FDIC-insured institutions deploy too many assets to any one industry or segment. A concentration in CRE is one example of regulatory concern. The interagency Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices guidance (“CRE Guidance”) provides supervisory criteria, including the following numerical indicators, to assist bank examiners in identifying banks with potentially significant commercial real estate loan concentrations that may warrant greater supervisory scrutiny: (i) CRE loans exceeding 300% of capital and increasing 50% or more in the preceding three years; or (ii) construction and land development loans exceeding 100% of capital. The CRE Guidance does not limit banks’ levels of CRE activities, but rather guides institutions in developing risk management practices and levels of capital that are commensurate with the level and nature of their CRE concentrations. On December 18, 2015, and again in recent years, the federal banking agencies have issued statements to reinforce prudent risk-management practices related to CRE lending, having observed substantial growth in many CRE asset and lending markets, increased competitive pressures, rising CRE concentrations in banks, and an easing of CRE underwriting standards. The federal banking agencies reminded FDIC-insured institutions to maintain underwriting discipline and exercise prudent risk-management practices to identify, measure, monitor, and manage the risks arising from CRE lending. In addition, FDIC-insured institutions must maintain capital commensurate with the level and nature of their CRE concentration risk. As of December 31, 2024, the Bank did not exceed these guidelines.

Consumer Financial Services. The historical structure of federal consumer protection regulation applicable to all providers of consumer financial products and services changed significantly on July 21, 2011, when the CFPB commenced operations to supervise and enforce consumer protection laws. The CFPB has broad rulemaking authority for a wide range of consumer protection laws that apply to all providers of consumer products and services, including the Bank, as well as the authority to prohibit “unfair, deceptive or abusive” acts and practices. The CFPB has examination and enforcement authority over providers with more than $10 billion in assets. FDIC-insured institutions with $10 billion or less in assets, like the Bank, continue to be examined by their applicable bank regulators.

Because abuses in connection with residential mortgages were a significant factor contributing to the global financial crisis, many initial rules issued by the CFPB, as required by the Dodd-Frank Act, addressed mortgage and mortgage-related products, their underwriting, origination, servicing and sales. The Dodd-Frank Act significantly expanded underwriting requirements applicable to loans secured by 1-4 family residential real property and augmented federal law combating predatory lending practices. In addition to numerous disclosure requirements, the Dodd Frank Act and the CFPB’s rules imposed new standards for mortgage loan originations on all lenders, including banks and savings associations, in an effort to strongly encourage lenders to verify a borrower’s ability to repay, while also establishing a presumption of compliance for certain “qualified mortgages.”

Over the last several years, the CFPB has taken an aggressive approach to the regulation (and supervision, where applicable) of providers of consumer financial products and services. For example, the CFPB has taken, or attempted to take, a proactive, multi-front approach to protect consumers from excessive overdraft and non-sufficient funds fees, including through proposed or final rules, interpretive opinions and enforcement actions. Given the increased number and expansive nature of its regulatory initiatives, the CFPB has been subject to lawsuits brought by the banking industry and other providers of consumer financial products and services. The CFPB’s approach may change under the Trump Administration, but it remains unclear exactly what changes will occur or how quickly. In addition, certain rules that the Biden Administration CFPB finalized may be subject to reversal by either the U.S. Congress or the new CFPB administration.

16

Table ofContents

The CFPB’s rules have not had a significant impact on the Bank’s operations, except for higher compliance costs. The Bank must also comply with certain state consumer protection laws and requirements in the states in which it operates.

Website Access to Company Reports

We post reports required to be filed with the SEC on our website, www.hf-wa.com, as soon as reasonably practicable after filing them. Copies of the required reports are available free of charge through our website.

Code of Ethics

We have adopted a Code of Ethics that applies to our directors, officers and employees, as well as those engaged by the Company, but who are not employees, such as contractors and those engaged through external agencies. We have posted a copy of our Code of Ethics at www.hf-wa.com in the section titled Overview: Governance Documents. In accordance with SEC rules, significant changes or waivers of the Code of Ethics will be posted on our website at www.hf-wa.com in the section titled Overview: Governance Documents.

Competition

We compete for loans and deposits with other commercial banks, credit unions and other providers of financial services, including finance companies, online-only banks, mutual funds, insurance companies, and, more recently, with Fintech companies that rely on technology to provide financial services. Many of our competitors have substantially greater resources than we do. Particularly in times of high or rising interest rates, we also face significant competition for investors’ funds from short-term money market securities and other corporate and government securities.

We compete for loans principally through the range and quality of the services we provide, interest rates and loan fees, and robust delivery channels for our products and services. We actively solicit deposit-related customers and compete for deposits by offering depositors high touch service on a variety of savings and checking accounts and cash management and other services.

Human Capital

Our Culture and Our People

The Company's success depends on the success of its people, and we are dedicated to fostering employee empowerment through robust human capital and talent management. Our strong culture, built upon a clear mission and values, unites employees at all levels of the Company towards a common goal, enabling them to reach their full potential.

Inclusive Workplace

We recognize and appreciate the importance of creating an environment where all employees feel valued, included, and empowered to do their best work. Recognizing the unique perspectives each employee brings, we value their contributions to making us the leading commercial community bank in the Pacific Northwest.

We focus on inclusion and belonging with a DEI Officer certified by the National Diversity Council (“NDC”) as well as a dedicated Diversity Council comprised of employees and members of management across different functional areas. Both our Chief Executive Officer and Chief Human Resources Officer serve as executive sponsors to this council.

Our executive management team and Board have undergone instructor-led, customized DEI training. In 2023, the NDC recognized our community outreach and corporate social responsibility efforts, rating us among the best companies for diversity.

The objectives of the Company's DEI plan include:

•Workforce Diversity: Recruit from a diverse, qualified group of potential applicants to secure a high-performing workforce drawn from all segments of the communities we serve.

•Workplace Inclusion: Promote a culture and develop long-term strategies that encourage collaboration, inclusion, flexibility and fairness to enable individuals to contribute to their full potential.

In 2023, our recruiting team achieved certification as “Diversity and Inclusion Recruiters” after completing the Advanced Internet Recruitment Strategies program. All hiring managers are assigned "Interviewing and Selection" training to address and mitigate unconscious bias in hiring decisions. This initiative has resulted in an enhanced diversity representation across the organization, with 43% of new hires in 2024 coming from underrepresented minority groups, compared to 37% in 2023.

Additionally, the Company continues to collaborate with an external consultant to provide inclusive leadership training to its managers. This training, offering insights into diversity, inclusion, and identity, has been incorporated into the mandatory curriculum for new managers. Additional "Lunch & Learn" sessions are open to all employees and members of management, encouraging ongoing discussions and skills development in these areas.

Demographics

As of December 31, 2024, the Company employed 733 full-time and 28 part-time employees across Washington, Oregon, and Idaho. The Company also had six employees who were working remotely in other states. No employees are represented by a collective bargaining agreement. During 2024, we hired 130 regular full-time and part-time employees. Voluntary workforce

17

Table ofContents

turnover (rolling 12-month attrition) was 14.9% for the period ended December 31, 2024, compared to 16.6% for the period ended December 31, 2023. At the end of 2024, our average overall tenure was 7.5 years and the average tenure of management was 9.7 years.

As of December 31, 2024, the Company’s individual contributors were 70.1% female and 29.9% male; managers were 72.3% female and 27.7% male; director-level employees (not members of the Board) were 54.2% female and 45.8% male; and executives were 22.2% female and 77.8% male, with the Company’s total workforce being 69.5% female and 30.5% male.

As of December 31, 2024, the Company’s individual contributors were 29.4% members of underrepresented minority groups and 70.6% white; managers were 23.5% members of underrepresented minority groups and 76.5% white; director-level employees (not members of the Board) were 8.3% members of underrepresented minority groups and 91.7% white; and executives were 100% white, with the Company’s total workforce being 27.1% members of underrepresented minority groups and 72.9% white.

Communication and Listening

The Company strives to maintain an environment of open communication, facilitating access to senior management through initiatives like quarterly virtual “All Banker Calls,” monthly updates for Company leaders and orientation sessions led by the Chief Executive Officer and the Chief Human Resources Officer for new hires. To further enhance our “listening culture,” we utilize a survey platform to allow employees to share feedback directly with leadership, including an annual employee engagement survey and periodic pulse surveys. Survey results, shared with employees, executive leadership and the Board, guide actions at both the corporate and departmental levels. In recognition of our commitment to employee engagement, the Company earned a spot among the top 100 Best Places to Work in Washington and Oregon by the Puget Sound and Portland Business Journals based on the 2024 employee engagement survey. The company received similar recognition in 2023.

Our commitment to open communication extends to providing employees with avenues for confidential and anonymous reporting. We offer a whistleblower hotline/website, enabling employees to report financial and workplace concerns to key leadership, including the Board Chair, Audit Committee Chair, Chief Executive Officer, Chief Operations Officer, Chief Risk Officer and Chief Human Resources Officer. Additionally, our Company intranet hosts an "Idea Bank," allowing employees to submit new ideas or recommendations directly to executive management.

Talent Development and Succession

Developing employees for future growth and professional development is a vital corporate activity crucial to our long-term success. The Company views its employees as our most important assets, which makes training and professional development a worthy investment. We offer an array of learning opportunities through virtual and in-house courses via “Heritage Bank University.” Additionally, we sponsor courses from external providers such as Blanchard, Risk Management Association, Archbright, Jennifer Brown Consulting, Washington Bankers Association, Oregon Bankers Association and the Pacific Coast Banking School.

We offer situational leadership training for leaders that focuses on communication and employee engagement and endorse coaching using the tools from this program. All employees are required to complete an extensive series of quarterly digital training courses focused on bank regulatory compliance, ethics, workplace safety, security, fraud awareness and prevention and other interpersonal or leadership topics. An interactive leadership roadmap is available to assist future leaders in their career development. For the past 10 years, Heritage Bank University has been recognized as a “Champion of Learning” by The Association for Talent Development for its commitment to employee learning.

In 2024, we launched two new Leadership Certificate Programs: The Leadership Essentials Certificate is designed for employees interested in developing their leadership skills and preparing for leadership and management in the future, while the Leadership in Action Certificate is for current supervisors and managers interested in deepening their applied leadership skills. Since the launch of these programs in April 2024, 33 Heritage Bankers have received their Leadership Certification through one of these programs.

The Company leverages an online succession planning tool to further identify next-generation leaders and establish development plans for these individuals. Over time, we expect this process to increase generational representation across all levels, including leadership positions. As of December 31, 2024, the Company’s generational representation consisted of 17% Baby Boomers (born 1945 to 1964), 37% Gen X-ers (born 1965 to 1980), 35% Millennials (born 1981 to 1996), and 10% Gen Z-ers (born 1997 to 2010). Management and the Board review leadership succession annually.

Recognition and appreciation

We host “Celebrate Great,” an active internal peer recognition platform enabling managers and employees to express appreciation and recognize their co-workers and teams. Throughout 2024, more than 3,700 e-cards were posted on Celebrate Great, with 32 individuals or teams receiving “Bravo” awards and 11 employees receiving “Standing Ovation” awards for their exceptional work. The Company celebrates employees achieving milestone anniversaries or upon retirement with a personalized yearbook and special gift.

Compensation, Benefits and Pay Equity

Offering competitive compensation and benefit programs is critical to attracting and retaining top talent in our highly competitive market areas. Employees are generally eligible for a base pay review at least once per year, as well as upon promotion or transfer. Our hiring practices prioritize pay transparency, with job postings disclosing the pay range minimum and maximum, as well as the applicable benefits package, and we do not request salary history from job applicants. We collaborate with a third party consultant periodically to evaluate hiring, promotion and other pay practices to ensure continued equity and fairness.

18

Table ofContents

Incentive plan goals and results are aligned with strategic Company objectives and are approved by the Compensation Committee of the Board. Further alignment is achieved by having similar corporate performance metrics cascade through most executive, management, and employee annual incentive plans.

Employees working a minimum of 20 hours per week are eligible for most benefit plans, including a 401(k) Plan with an employer matching contribution, medical, dental and vision insurance, life and long-term disability insurance, public transit passes, paid parking and paid time off. Further, full-time employees enjoy up to 11 paid holidays each year and receive an annual floating holiday to be used at their discretion. Employees also accrue up to 12 days of paid sick time per year for personal use or to care for a family member. Both full-time and part-time employees accrue vacation time ranging from two and five weeks, dependent on factors such as position and tenure.

Employee Wellness and Wellbeing

Our corporate culture places a strong emphasis on the wellbeing of our employees, recognizing its pivotal role in cultivating a vibrant and productive workforce. To support holistic wellbeing, we offer a range of resources.

Through our Employee Assistance Program, employees receive counseling and referral services to address challenges both at work and at home. This includes mental health counseling, financial planning, basic legal advice and dependent/elder care referrals, all at no cost to them or their household members. Additional wellness benefits are available through the Company's medical insurance plans. Moreover, enrolled members can take advantage of mental health apps, weight loss and fitness programs, smoking cessation programs and various online resources, all provided at no extra cost.

To alleviate workplace stress and burnout, the Company hosts a "no meetings week" at the start of each quarter. This dedicated time allows managers and employees to engage in purposeful planning, catch up on tasks, and reduce stress. By incorporating these breaks, employees can participate in strategic planning, creative thinking, and collaborative efforts without the constraints of scheduled meetings, ultimately contributing to a more innovative and healthier work environment.

Community Involvement

As a community bank, we are committed to supporting the communities where we operate, and we actively encourage and support our employees to do the same. In 2022, the Company implemented an annual volunteer event, during which the Bank closes for half a day, providing employees with a paid opportunity to volunteer in teams at various community organizations within our operating footprint. Our 2024 volunteer day event involved over 550 employees volunteering approximately 1,665 hours to more than 60 organizations in Washington, Oregon and Idaho. To further facilitate community involvement, employees receive a minimum of eight additional hours of paid time off each year specifically to use for volunteer activities of their choice.

The Bank also participated in a 2024 EcoChallenge, where 41 teams of employees engaged in friendly competition by undertaking environmentally sustainable actions and practices. Challenges involved activities such as reducing waste, conserving energy and adopting eco-friendly lifestyle habits. The collective efforts of the EcoChallenge resulted in 21,887 actions, contributing to a heightened awareness of environmental responsibility, fostering a sense of community engagement, and reinforcing a shared commitment to sustainability.

ITEM 1A. RISK FACTORS

Investing in the Company’s common stock involves a high degree of risk. The material risks and uncertainties that management believes affect the Company are described below. Before you decide to invest, you should carefully review and consider the risks described below, together with all other information included in this Form 10-K and other reports and documents the Company files with the SEC. Any of the following risks, as well as risks that the Company does not know or currently deems immaterial, could have a material adverse effect on the Company’s business, reputation, financial condition, results of operations and growth prospects.

Market and Interest Rate Risks

The Company’s business is subject to interest rate risk, and fluctuations in interest rates or monetary policy may adversely affect the Company’s business, financial condition, results of operations and growth prospects.

Fluctuations in interest rates may negatively affect the Company’s business and weaken demand for some of its products. The Company’s earnings and cash flows are primarily dependent on net interest income, which is the difference between the interest income that the Company earns on interest earning assets such as loans and investment securities, and the interest expense that the Company pays on interest-bearing liabilities such as deposits and borrowings. Changes in interest rates also affect the Company’s ability to fund operations with customer deposits and the fair value of securities in the Company’s investment portfolio. Any change in general market interest rates, including changes in federal fiscal and monetary policies, could have a material adverse effect on the Company’s business, financial condition, results of operations and growth prospects. The Company’s interest earning assets and interest-bearing liabilities may react in different degrees to changes in market interest rates. Interest rates on some types of assets and liabilities may fluctuate prior to changes in broader market interest rates, while rates on other types of assets and liabilities may lag behind. The result of these changes to rates may cause differing spreads on interest earning assets and interest-bearing liabilities.

The Company could also be prevented from altering the interest rates charged on loans or from maintaining the interest rates offered on deposits and money market savings accounts due to “price” competition from other banks and financial institutions with which the Company competes. The Company does not know what market rates will be throughout 2025, including the frequency and significance with which the target range for the federal funds rate may be changed in 2025. If the Company fails to

19

Table ofContents

offer interest at a sufficient level to keep its non-maturity interest-bearing deposits, core deposits may be reduced, which would require the Company to obtain funding in other ways or risk slowing future asset growth.

The Company could recognize additional losses on securities held in the Company’s securities portfolio, particularly if interest rates increase or economic and market conditions deteriorate.

Factors beyond the Company’s control can influence and cause potential adverse changes to the fair value of securities in the Company’s portfolio. These factors include, but are not limited to, changes in interest rates, rating agency downgrades or the Company’s own analysis of the value of the securities, defaults by the issuers or individual mortgagors with respect to the underlying securities and instability in the credit markets. The foregoing factors, as well as changing economic and market conditions or other factors, could cause write-downs and realized or unrealized losses in future periods and declines in other comprehensive income, which could have a material adverse effect on the Company’s business, financial condition, results of operations and growth prospects. The process for determining whether a write-down is required usually requires complex, subjective judgments, which could subsequently prove to have been wrong, about the future financial performance and liquidity of the issuer, the fair value of any collateral underlying the security and whether and the extent to which the principal and interest on the security will ultimately be paid in accordance with its payment terms. Decreases in the fair value of investment securities available for sale resulting from increases in interest rates could have an adverse effect on stockholders’ equity, specifically AOCI, which is increased or decreased by the amount of change in the estimated fair value of our securities available for sale, net of deferred income taxes. Increases in interest rates generally decrease the fair value of securities available for sale, adversely impacting stockholders’ equity. In recent periods, the company has realized losses on the sale of investment securities in connection with strategic balance sheet repositioning transactions. The Company could recognize impairment loss for any security that has declined in fair value below its amortized cost basis if management has the intent to sell the security, or if it is more likely than not that it will be required to sell the security before recovery of its amortized cost basis.

The Company cannot guarantee that its stock repurchase program will be fully implemented or that it will enhance long-term shareholder value.

On April 24, 2024, the Board approved the repurchase of up to 5% of the Company's outstanding common shares, or 1,734,492 shares. This stock repurchase program supersedes the previous stock repurchase program, authorized in March 2020, which allowed for the repurchase of up to 5% of the Company's outstanding common shares, or 1,799,054 shares. The number, timing and price of shares repurchased will depend on business and market conditions, regulatory requirements, availability of funds and other factors, including opportunities to deploy the Company's capital. The Company may, in its discretion, begin, suspend or terminate repurchases at any time prior to the stock repurchase program’s expiration, without any prior notice. Even if fully implemented, the stock repurchase program may not enhance long-term shareholder value.

Credit Risks

The Company’s business depends on its ability to manage credit risk.

The Company’s banking business requires it to manage credit risk; however, default risk may arise from events or circumstances that are difficult to detect, such as fraud, or difficult to predict, such as catastrophic events affecting certain industries. As a lender, the Company is exposed to the risk that its borrowers will be unable to repay their loans according to their terms, and that the collateral securing repayment of their loans, if any, may not be sufficient to ensure repayment. In addition, there are risks inherent in making any loan, including risks with respect to the period of time over which the loan may be repaid, proper loan underwriting, changes in economic and industry conditions and those inherent in dealing with specific borrowers, including the risk that a borrower may not provide information to the Company about its business in a timely manner, may present inaccurate or incomplete information to the Company or risks relating to the value of collateral.

To manage credit risk, the Company must maintain disciplined and prudent underwriting standards and ensure that the Company’s bankers follow those standards. The weakening of these standards for any reason, such as an attempt to attract higher yielding loans, a lack of discipline or diligence by the Company’s employees in underwriting and monitoring loans, the Company’s inability to adequately adapt policies and procedures to changes in economic or any other conditions affecting borrowers and the quality of the Company’s loan portfolio may result in loan defaults, foreclosures and charge-offs and may necessitate that the Company significantly increase its allowance for credit losses, each of which could adversely affect net income. As a result, the Company’s inability to successfully manage credit risk could have a material adverse effect on the Company’s business, financial condition, results of operations and growth prospects.

The Company’s high concentration of large loans to certain borrowers may increase the Company’s credit risk.

The Company has developed relationships with certain individuals and businesses that have resulted in a concentration of large loans to a small number of borrowers. As of December 31, 2024, the Company’s 10 largest borrowing relationships accounted for approximately 6.5% of the total loan portfolio. The Company has established an informal, internal limit on loans to one borrower, principal or guarantor, but the Company may, under certain circumstances, consider going above this internal limit in situations where management’s understanding of the industry, the borrower’s business and the credit quality of the borrower are commensurate with the increased size of the loan. Along with other risks inherent in these loans, such as the deterioration of the underlying businesses or property securing these loans, this high concentration of borrowers presents a risk to the Company’s lending operations. If any one of these borrowers becomes unable to repay its loan obligations as a result of business, economic or market conditions, the Company’s nonaccruing loans and provision for loan losses could increase significantly, which could have a material adverse effect on the Company’s business, financial condition, results of operations and growth prospects.

The Company’s allowance for credit losses may prove to be insufficient to absorb potential losses in its loan portfolio.

20

Table ofContents

Lending money is a substantial part of our business. Every loan carries a certain risk that it will not be repaid in accordance with its terms or that any underlying collateral will not be sufficient to assure repayment. This risk is affected by, among other things:

•the cash flow of the borrower, guarantors and/or the project being financed;

•the changes and uncertainties as to the future value of the collateral, in the case of a collateralized loan;

•the character and creditworthiness of a particular borrower or guarantor;

•changes in economic and industry conditions; and

•the duration of the loan.

The ACL on loans is a valuation account that is deducted from the amortized cost of loans receivable to present the net amount expected to be collected. Loans are charged-off through the ACL on loans when management believes the uncollectibility of a loan balance is considered probable. Subsequent recoveries, if any, are recorded to the ACL on loans. The Company records the changes in the ACL on loans through earnings as a "Provision for (reversal of) credit losses" on the Consolidated Statements of Income.

The determination of the appropriate level of ACL on loans inherently involves a high degree of subjectivity and requires us to make significant estimates of current credit risks and future trends, all of which may undergo material changes. If our estimates are incorrect, the ACL on loans may not be sufficient to cover expected losses in our loan portfolio, resulting in the need for increases in our ACL on loans through the provision for credit losses. Management also recognizes that significant new growth in loan segments and new loan products can result in loans segments comprised of unseasoned loans that may not perform in a historical or projected manner and will increase the risk that our ACL on loans may be insufficient to absorb losses without significant additional provisions.

Deterioration in economic conditions affecting borrowers, new information regarding existing loans, identification of additional problem loans and other factors, both within and outside of our control, may require an increase in the ACL on loans. If current conditions in the housing and real estate markets weaken, we expect we will experience increased delinquencies and credit losses. Bank regulatory agencies also periodically review our ACL on loans and may require an increase in the provision for credit losses or the recognition of further loan charge-offs, based on their judgments about information available to them at the time of their examination. In addition, if charge-offs in future periods exceed the ACL on loans, we will need additional provisions to increase the ACL on loans. Any increases in the allowance for credit losses will result in a decrease in net income and, most likely, capital, and may have a material negative effect on our financial condition and results of operations.

A decline in the business and economic conditions in the Company’s market areas could have a material adverse effect on the Company’s business, financial condition, results of operations and growth prospects.

The Company’s business activities and credit exposure, including real estate collateral for many of its loans, are concentrated in the states of Washington, Oregon and Idaho, although the Company also pursues business opportunities nationally. Adverse economic developments in our market areas, among other things, could affect the volume of loan originations, increase the level of nonperforming assets, increase the rate of foreclosure losses on loans, reduce the value of the Company’s loans and affect the Company’s business, financial condition, results of operations and growth prospects. Any regional or local economic downturn that affects the Company’s market areas or existing or prospective borrowers or property values in such areas may affect the Company and the Company’s profitability more significantly and more adversely than the Company’s competitors whose operations are less geographically concentrated.

Negative changes in the economy affecting real estate values and liquidity, as well as environmental factors, could impair the value of collateral securing the Company’s real estate loans and result in loan and other losses.

At December 31, 2024, approximately 79.1% of the Company’s total loan portfolio was comprised of loans with real estate as the primary component of collateral. The repayment of such loans is highly dependent on the ability of the borrowers to meet their loan repayment obligations to us, which can be adversely affected by economic downturns and other factors. The market value of real estate can fluctuate significantly in a short period of time as a result of interest rates and market conditions in the area in which the real estate is located and some of these values have been negatively affected by the recent rise in prevailing interest rates. Additionally, the repayment of commercial real estate loans generally is dependent, in large part, on sufficient income from the properties securing the loans to cover operating expenses and debt service. Adverse changes affecting real estate values, including decreases in office occupancy due to the shift to remote and hybrid working environments following the COVID-19 pandemic, could increase the credit risk associated with the Company’s loan portfolio, significantly impair the value of property pledged as collateral on loans and affect the Company’s ability to sell the collateral upon foreclosure without a loss or additional losses or the Company’s ability to sell those loans on the secondary market. If real estate values decline, it is also more likely that the Company would be required to increase the Company’s allowance for credit losses, which would have a material adverse effect on the Company’s business, financial condition, results of operations and growth prospects.

Many of the Company’s loans are to commercial borrowers, which have a higher degree of risk than other types of loans.

Commercial and industrial loans represented 17.5% of the Company’s total loan portfolio at December 31, 2024. These loans can be larger in size and involve greater risks than other types of lending. Because payments on such loans are often dependent on the successful operation of the business involved, repayment is often more sensitive than other types of loans to the general business climate and economy. A challenging business and economic environment generally, or in certain specific industries, may increase the Company’s risk related to commercial loans. Cumulative effects of inflation, labor shortages or employee turnover, supply chain constraints and the threat of new tariffs, mass deportations and changes in tax regulations implemented by the new Presidential administration may adversely affect commercial and industrial loans, especially if general economic conditions worsen. The Company’s commercial and industrial loans are primarily made based on the identified cash flow of the

21

Table ofContents

borrower and secondarily on the collateral underlying the loans. Most often, this collateral consists of accounts receivable, inventory and equipment. Inventory and equipment may depreciate over time, be difficult to appraise and fluctuate in value based on the success of the business and economic trends. If the cash flow from business operations is reduced, the borrower’s ability to repay the loan may be impaired. Due to the larger average size of each commercial loan as compared with other loans such as residential loans, as well as collateral that is generally less readily-marketable, losses recorded on a small number of commercial loans could have a material adverse effect on the Company’s business, financial condition, results of operations and growth prospects.

Nonperforming assets take significant time and resources to resolve and adversely affect the Company’s net interest income.

The Company’s nonperforming assets adversely affect net interest income in various ways. The Company does not record interest income on nonaccrual loans or foreclosed assets, thereby adversely affecting net income and returns on assets and equity. When the Company takes collateral in foreclosure and similar proceedings, the Company is required to mark the collateral to its then-fair market value, which may result in a loss. These nonperforming loans and foreclosed assets also increase the Company’s risk profile and the level of capital the Company’s regulators believe is appropriate for it to maintain in light of such risks. The resolution of nonperforming assets requires significant time commitments from management, which increase the Company’s loan administration costs and adversely affects its efficiency ratio and can be detrimental to the performance of their other responsibilities. If the Company experiences increases in nonperforming assets, net interest income may be negatively impacted and the Company’s loan administration costs could increase, each of which could have a material adverse effect on the Company’s business, financial condition, results of operations and growth prospects.

Liquidity and Funding Risks

Liquidity risks could affect the Company’s operations and jeopardize its business, financial condition, results of operations and growth prospects.

Liquidity is essential to the Company’s business. Generally, liquidity risk is the risk of being unable to fund obligations to creditors, including, in the case of financial institutions, obligations to depositors, as such obligations become due and/or fund the acquisition of assets, as they come due, and is inherent in the Company’s operations. An inability to raise funds through deposits, borrowings, the sale of loans or investment securities, and from other sources could have a substantial negative effect on our liquidity. The Company’s most important source of funds consists of customer deposits, which can decrease for a variety of reasons, including when customers perceive alternative investments, such as bonds, treasuries or stocks, as providing a better risk/return trade off. The Company’s future growth will largely depend on its ability to maintain and grow a strong deposit base.

Additionally, uninsured deposits have historically been viewed by the FDIC as less stable than insured deposits. According to statements made by the FDIC staff and the leadership of the federal banking agencies, customers with larger uninsured deposit account balances often are small- to mid-sized businesses that rely upon deposit funds for payment of operational expenses and, as a result, are more likely to closely monitor the financial condition and performance of their depository institutions. As a result, in the event of financial distress, uninsured depositors historically have been more likely to withdraw their deposits. If a significant portion of our deposits were to be withdrawn within a short period of time such that additional sources of funding would be required to meet withdrawal demands, the Company may be unable to obtain funding at favorable terms, which may have an adverse effect on our net interest margin. Moreover, obtaining adequate funding to meet our deposit obligations may be more challenging during periods of higher prevailing interest rates, such as the present period. Our ability to attract depositors during a time of actual or perceived distress or instability in the marketplace may be limited. Further, interest rates paid for borrowings generally exceed the interest rates paid on deposits. This spread may be exacerbated by higher prevailing interest rates. In addition, because our available for sale securities lose value when interest rates rise, after-tax proceeds resulting from the sale of such assets may be diminished during periods when interest rates are elevated. Under such circumstances, we may be required to access funding from sources such as the FRB’s discount window in order to manage our liquidity risk.

Other primary sources of funds consist of cash from operations, investment security maturities and sales and proceeds from the issuance and sale of the Company’s equity and debt securities to investors. Additional liquidity is provided by the ability to borrow from the FRB and the FHLB. The Company may also borrow from third party lenders from time to time. The Company’s access to funding sources in amounts adequate to finance or capitalize the Company’s activities or on terms that are acceptable to the Company could be impaired by factors that affect the Company directly or the financial services industry or economy in general, such as disruptions in the financial markets or negative views and expectations about the prospects for the financial services industry. Economic conditions and a loss of confidence in financial institutions may increase the Company’s cost of funding and limit access to certain customary sources of capital, including inter-bank borrowings and borrowings from the discount window of the FRB. Any decline in available funding could adversely impact the Company’s ability to continue to implement its strategic plan, including originating loans and investing in securities, or to fulfill obligations such as paying expenses, repaying borrowings or meeting deposit withdrawal demands, any of which could have a material adverse effect on the Company’s business, financial condition, results of operations and growth prospects.

The Company may not be able to maintain a strong core deposit base or other low cost funding sources.

The Company depends primarily on core deposits from its customers, which consist of noninterest demand deposits, interest bearing demand deposits, money market accounts, savings accounts and certificates of deposit as its primary source of funding for lending activities. The Company’s future growth will largely depend on its ability to maintain and grow this core deposit base. Deposit and account balances can decrease when customers perceive alternative investments, such as the stock market or real estate, as providing a better risk/return trade off. If customers move money out of bank deposit accounts and into investments (or

22

Table ofContents

similar deposit products at other institutions that may provide a higher rate of return), the Company could lose a relatively low-cost source of funds, increasing funding costs and reducing net interest income. The Company supplements its core deposit funding with non-core, short-term funding sources, including brokered deposits, FHLB advances and borrowings from the FRB. If the Company is unable to pledge sufficient qualifying collateral to secure funding from the FHLB, it may lose access to this source of liquidity. If the Company is unable to access any of these types of funding sources or if its costs related to them increases, its liquidity and ability to support demand for loans could be materially adversely affected.

The Company’s liquidity is largely dependent on dividends from the Bank.

The Company is a legal entity separate and distinct from the Bank. A substantial portion of the Company’s cash flow, including cash flow to pay principal and interest on the Company’s debt, comes from dividends the Company receives from the Bank. Federal and state laws and regulations limit the amount of dividends that the Bank may pay to the Company. In the event the Bank is unable to pay dividends to the Company, it may not be able to service its debt, which could have a material adverse effect on the Company’s business, financial condition, results of operations and growth prospects.

The Company may need to raise additional capital in the future, and failure to maintain sufficient capital would adversely affect its business, financial condition, results of operations, growth prospects and ability to maintain regulatory compliance with capital requirements.

The Company faces significant capital and other regulatory requirements as a financial institution. The Company may need to raise additional capital in the future to provide sufficient capital resources and liquidity to meet its commitments and business needs, including possible acquisition financing. In addition, the Company, on a consolidated basis, and the Bank, on a stand-alone basis, must meet certain regulatory capital requirements and maintain sufficient liquidity. Regulatory capital requirements could increase from current levels, which could require the Company to raise additional capital or contract the Company’s operations. The Company’s ability to raise additional capital depends on conditions in the capital markets, economic conditions and a number of other factors, including investor perceptions regarding the banking industry, market conditions, governmental activities, the Company’s credit ratings, its ability to maintain a listing on Nasdaq and its financial condition and performance. Accordingly, the Company cannot provide assurances that it will be able to raise additional capital if needed or on terms acceptable to the Company. If the Company fails to maintain capital to meet regulatory requirements, or is unable to raise capital to meet its business needs, its business, financial condition, results of operations and growth prospects would be materially and adversely affected.

The Company may be adversely affected by changes in the actual or perceived soundness or condition of other financial institutions.

Financial services institutions that deal with each other are interconnected as a result of trading, investment, liquidity management, clearing, counterparty, reputational and other relationships. Concerns about, or a default by, one institution could lead to significant liquidity problems and losses or defaults by other institutions, as the commercial and financial soundness of many financial institutions is closely related as a result of these credit, trading, clearing and other relationships. Even the perceived lack of creditworthiness of, or questions about, a counterparty may lead to market-wide liquidity problems and losses or defaults by various institutions. For example, certain community banks experienced deposit outflows following the bank failures in 2023. This systemic risk may adversely affect financial intermediaries with which the Company interacts on a daily basis or key funding providers such as the FHLB, any of which could have a material adverse effect on the Company’s access to liquidity or otherwise have a material adverse effect on its business, financial condition, results of operations and growth prospects.

Operational, Strategic and Reputational Risks

The Company may not be successful in implementing its organic growth strategy, which could have a material adverse effect on the Company’s business, financial condition, results of operations and growth prospects.

Part of the Company’s business strategy is to focus on organic growth, which includes leveraging the Company’s business lines across the Company’s entire customer base, enhancing brand awareness and building the Company’s infrastructure. The Company may not be successful in generating organic growth if as a result of numerous factors, including delays in introducing and implementing new products and services and other impediments resulting from regulatory oversight or lack of qualified personnel at the Company’s office locations. In addition, the success of the Company’s organic growth strategy will depend on maintaining sufficient regulatory capital levels, the Company’s ability to raise additional capital to implement its business plan and on favorable economic conditions in the Company’s primary market areas. Failure to adequately manage the risks associated with the Company’s anticipated organic growth could have a material adverse effect on the Company’s business, financial condition, results of operations and growth prospects.

In addition to the Company’s organic growth strategy, it intends to expand business by acquiring other banks and financial services companies, but may not be successful in doing so, either because of an inability to find suitable acquisition candidates, constrained capital resources or otherwise.

While a key element of the Company’s business strategy is to grow the Company’s banking franchise and increase the Company’s market share through organic growth, the Company has historically supplemented its organic growth through acquisitions of other financial institutions. The Company intends to continue to take advantage of opportunities to acquire other financial institutions, whether in whole or in part, however, the Company may not be able to identify suitable acquisition targets, or may not succeed in seizing such opportunities when they arise or in integrating any such companies within the Company’s existing business framework following acquisition. In addition, even if suitable targets are identified, the Company expects to compete for such businesses with other potential bidders, some of which may have greater financial resources than the

23

Table ofContents

Company, which may adversely affect the Company’s ability to make acquisitions at attractive prices. The Company’s ability to execute on acquisition opportunities may require the Company to raise additional capital and to increase the Company’s capital position to support the growth of the Company’s franchise. It will also depend on market conditions over which the Company has no control. Moreover, most acquisitions require the approval of the Company’s bank regulators, and the Company may not be able to obtain such approvals on acceptable terms, or at all. Acquiring other financial institutions involve risks commonly associated with acquisitions, including:

•potential exposure to unknown or contingent liabilities of the banks and businesses the Company acquires;

•exposure to potential asset and credit quality issues of the acquired bank or related business;

•difficulty and expense of integrating the operations, culture and personnel of banks and businesses the Company acquires, including higher than expected deposit attrition;

•potential disruption to the Company’s business;

•potential restrictions on the Company’s business resulting from the regulatory approval process;

•an inability to realize the expected revenue increases, costs savings, gains in market share or other anticipated benefits;

•potential diversion of the Company’s management’s time and attention; and

•the possible loss of key employees and customers of the banks and businesses the Company acquires.

The occurrence of fraudulent activity, breaches or failures of the Company’s information security controls or cybersecurity related incidents could have a material adverse effect on the Company’s business, financial condition, results of operations and growth prospects.

As a financial institution, the Company is susceptible to fraudulent activity, information security breaches and cybersecurity-related incidents that may be committed against the Company, its customers or third parties with whom it interacts, which may result in financial losses or increased costs to the Company or its customers, disclosure or misuse of the Company’s information or its customer information, misappropriation of assets, privacy breaches against the Company’s customers, litigation or damage to the Company’s reputation. Such fraudulent activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering and other dishonest acts. Information security breaches and cybersecurity-related incidents may include fraudulent or unauthorized access to systems used by the Company or its customers, denial or degradation of service attacks and malware or other cyber-attacks.

In recent periods, there continues to be a rise in electronic fraudulent activity, security breaches and cyber-attacks within the financial services industry, especially in the commercial banking sector, due to insider fraud or cyber criminals targeting commercial bank accounts and as a result of increasingly sophisticated methods of conducting cyber-attacks, including those employing artificial intelligence. Consistent with industry trends, the Company has also experienced an increase in attempted electronic fraudulent activity, security breaches and cybersecurity related incidents in recent periods. During 2024, the Company is not aware of having experienced any misappropriation, loss or other unauthorized disclosure of confidential or personally identifiable information having a material impact on the Company as a result of a direct cyber security breach or other act on the Bank; however, some of the Company’s customers and third party vendors may have been affected by such breaches, which could increase their risks of identity theft and other fraudulent activity that could involve customer accounts at the Bank.

Information pertaining to the Company and its customers is maintained, and transactions are executed, on networks and systems maintained by the Company and certain third party partners, such as the Company’s online banking, mobile banking, record-keeping or accounting systems. The secure maintenance and transmission of confidential information, as well as execution of transactions over these systems, are essential to protect the Company and the Company’s customers against fraud and security breaches and to maintain the confidence of the Company’s customers. Breaches of information security also may occur through intentional or unintentional acts by those having access to the Company’s systems or the confidential information of the Company’s customers, including employees. In addition, increases in criminal activity levels and sophistication, advances in computer capabilities, new discoveries, vulnerabilities in third party technologies (including browsers and operating systems) or other developments could result in a compromise or breach of the technology, processes and controls that the Company uses to prevent fraudulent transactions and to protect data about us, our customers and underlying transactions, as well as the technology used by our customers to access our systems. The Company’s third party partners’ inability to anticipate, or failure to adequately mitigate, breaches of security could result in a number of negative events, including losses to the Company or its customers, loss of business or customers, damage to the Company’s reputation, the incurrence of additional expenses, disruption to the Company’s business, additional regulatory scrutiny or penalties or the Company’s exposure to civil litigation and possible financial liability, any of which could have a material adverse effect on the Company’s business, financial condition, results of operations and growth prospects.

Issues with the use of artificial intelligence in our marketplace may result in reputational harm or liability, or could otherwise adversely affect the Company’s business.

Artificial intelligence, including generative artificial intelligence, is or may be enabled by or integrated into the Company’s products or those developed by its third party partners. As with many developing technologies, artificial intelligence presents risks and challenges that could affect its further development, adoption, and use, and therefore our business. Artificial intelligence algorithms may be flawed, for example datasets may contain biased information or otherwise be insufficient, and inappropriate or controversial data practices could impair the acceptance of artificial intelligence solutions and result in burdensome new regulations. If the analyses of those products incorporating artificial intelligence assist in producing for the Company or its third party partners are deficient, biased or inaccurate, the Company could be subject to competitive harm, potential legal liability and brand or reputational harm. The use of artificial intelligence may also present ethical issues. If the Company or its third party partners offer artificial intelligence enabled products that are controversial because of their purported or real impact on human rights, privacy, or other issues, the Company may experience competitive harm, potential legal liability and brand or reputational

24

Table ofContents

harm. In addition, the Company expects that governments will continue to assess and implement new laws and regulations concerning the use of artificial intelligence, which may affect or impair the usability or efficiency of products and services and those developed by the Company’s third party partners.

The Company depends on information technology and telecommunications systems, and any systems failures, interruptions or data breaches involving these systems could adversely affect the Company’s operations and financial condition.

The Company’s business is highly dependent on the successful and uninterrupted functioning of its information technology and telecommunications systems, third party servicers, accounting systems, mobile and online banking platforms and financial intermediaries. The risks resulting from use of these systems result from a variety of factors, both internal and external. The Company is vulnerable to the impact of failures of its systems to operate as needed or intended. Such failures could include those resulting from human error, unexpected transaction volumes, intentional attacks or overall design or performance issues.

The Company outsources to third parties many of its major systems, such as data processing and mobile and online banking. The failure of these systems, or the termination of a third party software license or service agreement on which any of these systems is based, could interrupt the Company’s operations. Because the Company’s information technology and telecommunications systems interface with and depend on third party systems, the Company could experience service denials if demand for such services exceeds capacity or such third party systems fail or experience interruptions. A system failure or service denial could result in a deterioration of the Company’s ability to process loans or gather deposits and provide customer service, compromise the Company’s ability to operate effectively, result in potential noncompliance with applicable laws or regulations, damage the Company’s reputation, result in a loss of customer business or subject the Company to additional regulatory scrutiny and possible financial liability, any of which could have a material adverse effect on its business, financial condition, results of operations and growth prospects. In addition, failures of third parties to comply with applicable laws and regulations, or fraud or misconduct on the part of employees of any of these third parties, could disrupt the Company’s operations or adversely affect its reputation.

It may be difficult for the Company to replace some of its third party vendors, particularly vendors providing the Company’s core banking and information services, in a timely manner if they are unwilling or unable to provide the Company with these services in the future for any reason and even if the Company is able to replace them, it may be at higher cost or result in the loss of customers. Any such events could have a material adverse effect on the Company’s business, financial condition, results of operations and growth prospects.

The Company has a continuing need for technological change, and may not have the resources to effectively implement new technologies or may experience operational challenges when implementing new technologies.

The financial services industry is undergoing rapid technological changes with frequent introductions of new technology-driven products and services. In addition to better serving customers, the effective use of technology increases efficiency and enables financial institutions to reduce costs. The Company’s future success will depend in part upon its, and its third party partners’, ability to address the needs of the Company’s customers by using technology to provide products and services that will satisfy customer demands for convenience as well as to create additional efficiencies in operations. The widespread adoption of new technologies, including mobile banking services, artificial intelligence, digital assets and payment systems, could require the Company in the future to make substantial expenditures to modify or adapt the Company’s existing products and services as it grows and develops new products to satisfy the Company’s customers’ expectations, remain competitive and comply with regulatory rules and guidance. The Company may experience operational challenges as it implements these new technology enhancements, which could result in the Company not fully realizing the anticipated benefits from such new technology or require the Company to incur significant costs to remedy any such challenges in a timely manner. Many of the Company’s larger competitors have substantially greater resources to invest in technological improvements. As a result, they may be able to offer additional or superior products to those that the Company will be able to offer, which would put the Company at a competitive disadvantage. Accordingly, a risk exists that the Company will not be able to effectively implement new technology-driven products and services or be successful in marketing such products and services to the Company’s customers.

In addition, the implementation of technological changes and upgrades to maintain current systems and integrate new ones may also cause service interruptions, transaction processing errors and system conversion delays and may cause the Company to fail to comply with applicable laws. The Company expects that new technologies and business processes applicable to the financial services industry will continue to emerge, and these new technologies and business processes may be better than those the Company currently uses. Because the pace of technological change is high and the Company’s industry is intensely competitive, it may not be able to sustain the Company’s investment in new technology as critical systems and applications become obsolete or as better ones become available. A failure to successfully keep pace with technological change affecting the financial services industry and failure to avoid interruptions, errors and delays could have a material adverse effect on the Company’s business, financial condition, results of operations and growth prospects.

The Company’s use of third party vendors and its other ongoing third party business relationships is subject to increasing regulatory requirements and attention.

The Company’s use of third party vendors for certain information systems is subject to increasingly demanding regulatory requirements and attention by the Company’s federal bank regulators. Recent regulations require the Company to enhance its due diligence, ongoing monitoring and control over the Company’s third party vendors and other ongoing third party business relationships. In certain cases, the Company may be required to renegotiate the Company’s agreements with these vendors to meet these enhanced requirements, which could increase costs. The Company expects that regulators will hold the Company responsible for deficiencies in oversight and control of its third party relationships and in the performance of the parties with

25

Table ofContents

which the Company has these relationships. As a result, if the Company’s regulators conclude that it has not exercised adequate oversight and control over the Company’s third party vendors or other ongoing third party business relationships or that such third parties have not performed appropriately, the Company could be subject to enforcement actions, including civil money penalties or other administrative or judicial penalties or fines, as well as requirements for customer remediation, any of which could have a material adverse effect on the Company’s business, financial condition, results of operations and growth prospects.

The Company is highly dependent on its management team and employees, and the loss of any of these individuals, or the inability to attract and retain qualified personnel, could harm the Company’s ability to implement its strategic plan and impair the Company’s relationships with customers.

The Company’s success is dependent, to a large degree, upon the continued service and skills of the Company’s executive management team and its employees. The loss of any of the members of the Company’s executive management team or any other key personnel, including successful individuals employed by banks or other businesses that the Company may acquire, to a new or existing competitor or otherwise, could have an adverse impact on the Company’s ability to retain valuable relationships and some of its customers could choose to use the services of a competitor instead of the Company’s services. As such, the Company needs to continue to attract and retain key personnel and to recruit qualified individuals who fit the Company’s culture to succeed existing key personnel and ensure the continued growth and successful operation of the Company’s business. Leadership changes may occur from time to time, and the Company cannot predict whether significant retirements or resignations will occur or whether the Company will be able to recruit additional qualified personnel.