Hawthorn Bancshares, Inc. HWBK US Equity☆

Item 1A. Risk Factors.

Risk Factors

We are identifying important risks and uncertainties that could affect the Company's results of operations, financial condition or business and that could cause them to differ materially from the Company's historical results of operations, financial condition or business, or those contemplated by forward-looking statements made herein or elsewhere, by, or on behalf of, the Company. Factors that could cause or contribute to such differences include, but are not limited to, those factors described below. The risk factors highlighted below are not necessarily the only ones that the Company faces.

Risks Relating to Our Business and Market

Because We Primarily Serve Central, West Central Missouri, and Eastern Kansas, a Decline in the Local Economic Conditions Could Lower the Company's Profitability. The profitability of the Company is dependent on the profitability of the Bank, which operates out of central and west-central Missouri, and extends into eastern Kansas as part of the Kansas City metro. The financial condition of the Bank is affected by slowing or recessionary economic conditions and business activity prevailing in the portions of Missouri and Kansas in which its operations are located. Although our customers' business and financial interests may extend well beyond our market areas, the financial conditions of both the Company and the Bank would be adversely affected by deterioration in the general economic and real estate climate in Missouri and Kansas.

An increase in unemployment, a decrease in profitability of regional businesses or real estate values, or an increase in interest rates are among the factors that could weaken the local economy. With a weaker local economy:

•customers may not want or need the products and services of the Bank;

•borrowers may be unable to repay their loans;

•the value of the collateral security of the Bank's loans to borrowers may decline;

•the number of loan delinquencies and foreclosures may increase; and

•the overall quality of the Bank's loan portfolio may decline.

Originating mortgage loans and consumer loans are a significant source of profits for the Bank. If individual customers in the local area do not want or need these loans, profits may decrease. Although the Bank could make other investments, the Bank may earn less revenue on these investments than on loans. Additionally, the Bank's losses on loans may increase if borrowers are unable to make payments on their loans.

Interest Rate Changes May Reduce the Profitability of the Company and the Bank. The primary source of earnings for the Bank is net interest income. To be profitable, the Bank has to earn more money in interest and fees on loans and other interest-earning assets than it pays as interest on deposits and other interest-bearing liabilities and as other expenses. If prevailing interest rates decrease, the amount of interest the Bank earns on loans and investment securities may decrease more rapidly than the amount of interest the Bank has to pay on deposits and other interest-bearing liabilities. This would result in a decrease in the profitability of the Company and the Bank.

Changes in the level or structure of interest rates also affect:

•the Bank's ability to originate loans;

•the value of the Bank's loan and securities portfolios;

•the Bank's ability to realize gains from the sale of loans and securities;

•the average life of the Bank's deposits; and

•the Bank's ability to obtain deposits.

Fluctuations in interest rates will ultimately affect both the level of income and expense recorded on a large portion of the Bank's assets and liabilities, and the fair value of all interest-earning assets, other than interest-earning assets that mature in the short term. In the fourth quarter of 2023, the Company repositioned its balance sheet by selling $83.7 million in book value of investment securities for an after-tax realized loss of $9.1 million. The Bank's interest rate

11

management strategy is designed to stabilize net interest income and preserve capital over a broad range of interest rate movements by matching the interest rate sensitivity of assets and liabilities. Although the Company believes that the Bank's current mix of loans, mortgage-backed securities, investment securities and deposits is reasonable, significant fluctuations in interest rates may have a negative effect on the profitability of the Bank.

Our Business Depends On Our Ability to Successfully Manage Credit Risk. The operation of our business requires us to manage credit risk. As a lender, the Bank is exposed to the risk that borrowers will be unable to repay their loans according to their terms, and that the collateral securing repayment of their loans, if any, may not be sufficient to ensure repayment. In addition, there are risks inherent in making any loan, including risks with respect to the period of time over which the loan may be repaid, risks relating to proper loan underwriting, risks resulting from changes in economic and industry conditions and risks inherent in dealing with individual borrowers. In order to successfully manage credit risk, we must, among other things, maintain disciplined and prudent underwriting standards and ensure that our loan officers follow those standards. The weakening of these standards for any reason, such as an attempt to attract higher yielding loans, a lack of discipline or diligence by our employees in underwriting and monitoring loans, the inability of our employees to adequately adapt policies and procedures to address changes in economic or other conditions affecting borrowers (such as the current recessionary environment and higher interest rates) and the quality of our loan portfolio, may result in loan defaults, foreclosures and additional charge-offs and may necessitate that we significantly increase our allowance for credit losses, each of which could adversely affect our net income. As a result, our inability to successfully manage credit risk could have a material adverse effect on our business, financial condition or results of operations.

The Company's Profitability Depends On the Bank's Asset Quality and Lending Risks. Success in the banking industry largely depends on the quality of loans and other assets. A significant source of risk for us arises from the possibility that losses will be sustained because borrowers, guarantors and related parties may fail to perform in accordance with the terms of their loans. The Bank's loan officers are actively encouraged to identify deteriorating loans. Loans are also monitored and categorized through an analysis of their payment status. The Bank's failure to timely and accurately monitor the quality of its loans and other assets could have a materially adverse effect on the operations and financial condition of the Company and the Bank. There is a degree of credit risk associated with any lending activity. The Bank attempts to minimize its credit risk through loan diversification. Although the Bank's loan portfolio is varied, with no undue concentration in any one industry, substantially all of the loans in the portfolio have been made to borrowers in central, west central, and southwest Missouri, and eastern Kansas as part of the Kansas City metro. Therefore, the loan portfolio is susceptible to factors affecting the central, west central, and southwest Missouri, and eastern Kansas and the level of non-performing assets is heavily dependent upon local conditions. There can be no assurance that the level of the Bank's non-performing assets will not increase above current levels. High levels of non-performing assets could have a materially adverse effect on the operations and financial condition of the Company and the Bank.

The Provision for Probable Credit Losses May Need to Be Increased. The Bank makes a provision for credit losses based upon management's estimate of probable losses in the loan portfolio and its consideration of prevailing economic and environmental conditions. The amount of future loan losses is susceptible to changes in economic, operating and other conditions, including changes in interest rates, which may be beyond the Company's control, and these losses may exceed current estimates. We cannot fully predict the amount or timing of losses or whether the loss allowance will be adequate in the future. The Bank may need to increase the provision for credit losses through additional provisions in the future if, among other things, the financial condition of any of its borrowers deteriorates, if its borrower fails to perform its obligations to it, or if real estate values decline. Furthermore, various regulatory agencies, as an integral part of their examination process, periodically review the Bank's loan portfolio, provision for credit losses, and real estate acquired by foreclosure. Such agencies may require the Bank to recognize additions to the provision for credit losses based on their judgments of information available to them at the time of the examination. Any additional provision for probable credit losses, whether required as a result of regulatory review or initiated by the Company itself, may materially alter the financial outlook of the Company and the Bank and may have a material adverse effect on the Company's financial condition and results of operations.

Adverse Market Conditions in the U.S. Economy and the Markets in Which We Operate Could Adversely Impact the Company's Business. Unfavorable or uncertain economic and market conditions, including slowing or recessionary economic conditions, reduced availability of commercial credit, and increasing unemployment may negatively impact the credit performance of commercial and consumer credit, resulting in additional write-downs. Concerns over the stability of the financial markets and the economy have resulted in decreased lending by financial institutions to their customers and to each other. This market turmoil and tightening of credit has led to increased commercial and consumer deficiencies, lack of customer confidence, increased market volatility and widespread reduction in general business

12

activity. Competition among depository institutions for deposits has increased significantly. Financial institutions have experienced decreased access to deposits or borrowings.

Smaller Commercial Borrowers May Have Fewer Financial Resources, Which May Impair Their Ability to Repay Loans. We provide lending to many small- to medium-sized customers, which frequently have fewer financial resources than larger entities (in terms of capital or borrowing capacity). Accordingly, these businesses may be more vulnerable to economic downturns, often need substantial additional capital to expand or compete, and may experience substantial volatility in operating results, any of which may impair the borrower's ability to repay a loan. If these or other borrowers are harmed by adverse business conditions in the markets in which we operate, it may result in an adverse effect to the business, financial condition and results of operations of the Company or the Bank.

The Soundness of Other Financial Institutions Could Adversely Affect Us. The Company's ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services institutions are interrelated as a result of trading, clearing, counterparty or other relationships. We have exposure to many different industries and counterparties, and we routinely execute transactions with counterparties in the financial industry, including brokers and dealers, commercial banks, investment banks, mutual and hedge funds, and other institutional clients. As a result, defaults by, or even rumors or questions about, one or more financial services institutions, or the financial services industry generally, have led to market-wide liquidity problems and could lead to losses or defaults by us or by other institutions. Many of these transactions expose us to credit risk in the event of default of a counterparty or client. In addition, the Company's credit risk may be exacerbated when the collateral held by us cannot be realized upon or is liquidated at prices not sufficient to recover the full amount of the loan or derivative exposure due us. There is no assurance that any such losses would not materially and adversely affect the Company's results of operations.

Bank failures, such as the failures of Silicon Valley Bank, Signature Bank and First Republic Bank in 2023, may cause a degree of panic and uncertainty in the investor community and among bank customers generally. Bank failures may also reduce customer confidence, affect sources of funding and liquidity, increase regulatory requirements and costs, adversely affect financial markets or have a negative reputational ramification for the banking industry, including the Company. The Company will monitor events concerning any future potential bank failures and volatility within the banking industry generally, together with any responsive measures taken by the banking regulators to mitigate or manage potential turmoil in the banking industry.

Liquidity Risk Could Impair Our Ability to Fund Operations and Meet Our Obligations as They Become Due, and Failure to Maintain Sufficient Liquidity Could Materially Adversely Affect Our Growth, Business, Profitability and Financial Condition. Liquidity is essential to our business. Liquidity risk is the potential that we will be unable to meet our obligations as they become due because of an inability to liquidate assets or obtain adequate funding at a reasonable cost, in a timely manner and without adverse conditions or consequences. We require sufficient liquidity to fund asset growth, meet customer loan requests, customer deposit maturities and withdrawals, payments on our debt obligations as they become due and other cash commitments under both normal operating conditions and other unpredictable circumstances, including events causing industry or general financial market stress. Liquidity risk can increase due to a number of factors, including an over-reliance on a particular source of funding or market-wide phenomena such as market dislocation and major disasters. Factors that could detrimentally impact access to liquidity sources include, but are not limited to, a decrease in the level of our business activity as a result of a slowdown in our market, adverse regulatory actions against us, or changes in the liquidity needs of our depositors. Market conditions or other events could also negatively affect the level or cost of funding, affecting our ongoing ability to accommodate liability maturities and deposit withdrawals, meet contractual obligations, and fund asset growth and new business transactions at a reasonable cost, in a timely manner, and without adverse consequences. Our inability to raise funds through deposits, borrowings, the sale of loans, other sources, and our ability to maintain sufficient deposits, could have a substantial negative effect on our business, and could result in the closure of the Bank. Our access to funding sources in amounts adequate to finance our activities or on acceptable terms could be impaired by factors that affect our organization specifically or the financial services industry or economy in general. Any substantial, unexpected, and/or prolonged change in the level or cost of liquidity could impair our ability to fund operations and meet our obligations as they become due and could have a material adverse effect on our business, financial condition and results of operations.

We rely on customer deposits, including brokered deposits, and to a lesser extent on advances from the FHLB and federal funds purchased to fund our operations. Although we have historically been able to replace customer deposit withdrawals, maturing deposits, and advances if desired, we may not be able to replace such funds in the future if our

13

financial condition, the financial condition of the FHLB or market conditions were to change. FHLB borrowings and other current sources of liquidity may not be available or, if available, sufficient to provide adequate funding for operations.

Deterioration in the Housing Market Could Cause Further Increases in Delinquencies and Non-Performing Assets, Including Loan Charge-Offs, and Depress the Company's Income and Growth. The volume of one-to-four family residential mortgages and home equity lines of credit may decrease during economic downturns as a result of, among other things, a decrease in real estate values, an increase in unemployment, a slowdown in housing price appreciation or increases in interest rates. These factors could reduce earnings and consequently the Company's financial condition because:

•borrowers may not be able to repay their loans;

•the value of the collateral securing loans may decline further;

•the quality of the Company's loan portfolio may decline further; and

•customers may not want or need the Company's products and services.

Any of these scenarios could cause an increase in delinquencies and non-performing assets, require us to charge-off a higher percentage of loans, increase substantially the provision for losses on loans, or make fewer loans, which would reduce income.

The FDIC's Changes in the Calculation of Deposit Insurance Premiums and Ability to Levy Special Assessments Could Increase the Company's Non-Interest Expense and May Reduce Its Profitability. The range of base assessment rates historically varies from 12 to 45 basis points depending on an institution's risk category, with newly added financial measures resulting in increased assessment rates for institutions heavily relying on brokered deposits to support rapid asset growth. However, the Dodd-Frank Act requires the FDIC to amend its regulations to redefine the assessment base used for calculating deposit insurance assessments. On February 9, 2011, the FDIC adopted a final rule that defines the assessment base as the average consolidated total assets during the assessment period minus the average tangible equity of the insured depository institution during the assessment period. The FDIC also imposed a new assessment rate scale (which was revised further in 2016). Under the new system, banks will generally pay assessments at a rate between 2.5 and 32 basis points per assets minus tangible equity, depending upon an institution's risk category (the final rule also includes progressively lower assessment rate schedules when the FDIC's reserve ratio reaches certain levels). The rulemaking changes the current assessment rate schedule so the schedule will result in the collection of assessment revenue that is approximately the same as generated under the current rate schedule and current assessment base. Nearly all banks with assets less than $10 billion will pay smaller deposit insurance assessments as a result of the new rule. The majority of the changes in the FDIC's final rule became effective on April 1, 2011. The FDIC has the statutory authority to impose special assessments on insured depository institutions in an amount, and for such purposes, as the FDIC may deem necessary. The FDIC issued a final rule in November 2023 to implement a special assessment to recover the significant losses incurred by the FDIC in connection with the 2023 bank failures (Silicon Valley Bank in California, Signature Bank in New York and First Republic Bank in California), but that special assessment did not apply to the Bank. The change in the calculation methodology for deposit insurance premiums and the possible emergency special assessments could increase non-interest expense and may adversely affect the Company's profitability.

We May Elect or Be Compelled To Seek Additional Capital In The Future, But That Capital May Not Be Available When Needed. We are required by regulatory authorities to maintain adequate levels of capital to support operations. In addition, we may elect to raise additional capital to support the growth of the Company's business or to finance acquisitions, if any, or we may elect to raise additional capital for other reasons. In that regard, a number of financial institutions have recently raised considerable amounts of capital as a result of a deterioration in their results of operations and financial condition arising from the turmoil in the mortgage loan market, deteriorating economic conditions, declines in real estate values and other factors. Should we elect or be required by regulatory authorities to raise additional capital, we may seek to do so through the issuance of, among other things, common stock or securities convertible into common stock, which could dilute your ownership interest in the Company. Although we remain "well-capitalized" and have not had a deterioration in liquidity, the future cost and availability of capital may be adversely affected by illiquid credit markets, economic conditions and a number of other factors, many of which are outside of the Company's control. Accordingly, we cannot assure you of the ability to raise additional capital if needed or on terms acceptable to us. If we cannot raise additional capital when needed or on terms acceptable to us, it may have a material adverse effect on the Company's financial condition and results of operations.

14

If We Are Unable to Successfully Compete for Customers in the Company's Market Area, the Company's Financial Condition and Results of Operations Could Be Adversely Affected. The Bank faces substantial competition in making loans, attracting deposits and providing other financial products and services. The Bank has numerous competitors for customers in its market area.

Such competition for loans comes principally from:

Competition for deposits comes principally from:

Many of these competitors have greater financial resources and name recognition, more locations, more advanced technology and more financial products to offer than the Bank. Competition from larger institutions may increase due to an acceleration of bank mergers and consolidations in Missouri and the rest of the nation. In addition, the Gramm-Leach-Bliley Act removes many of the remaining restrictions in federal banking law against cross-ownership between banks and other financial institutions, such as insurance companies and securities firms. The law will likely increase the number and financial strength of companies that compete directly with the Bank.

The profitability of the Bank depends on its continued ability to attract new customers and compete in its service areas. Increased competition in our markets from new competitors, as well as the expanding operations of existing competitors, may result in:

•interest rate changes to various types of accounts;

•a decrease in the amounts of the Bank's loans and deposits;

•reduced spreads between loan rates and deposit rates; and

•loan terms that are less favorable to the Bank.

Any of these results could have a material adverse impact on the Bank's market share of deposits and loans in the Bank's service areas. If the Bank is unable to successfully compete, its financial condition and results of operations will be adversely affected.

We May Experience Difficulties in Managing Growth and in Effectively Integrating Newly Acquired Companies. As part of the Company's general strategy, it may continue to acquire banks and businesses that it believes provide a strategic fit with its business. To the extent that the Company does grow, there can be no assurances that we will be able to adequately and profitably manage such growth. Acquiring other banks and businesses will involve risks commonly associated with acquisitions, including:

•potential exposure to liabilities of the banks and businesses acquired;

•difficulty and expense of integrating the operations and personnel of the banks and businesses acquired;

•difficulty and expense of instituting the necessary systems and procedures, including accounting and financial reporting systems, to manage the combined enterprises on a profitable basis;

•potential disruption to existing business and operations;

•potential diversion of the time and attention of management; and

•impairment of relationships with and the possible loss of key employees and customers of the banks and businesses acquired.

15

The success of the Company's internal growth strategy will depend primarily on the ability of the Bank to generate an increasing level of loans and deposits at acceptable risk levels and on acceptable terms without significant increases in non-interest expenses relative to revenues generated. There is no assurance that we will be successful in implementing the Company's internal growth strategy.

The Bank is a Community Bank and Our Ability to Maintain the Bank's Reputation is Critical to the Success of Our Business and the Failure to Do So Could Materially Adversely Affect Our Performance. The Bank is a community bank, and its reputation is one of the most valuable components of our business. As such, we strive to conduct our business in a manner that enhances our reputation. This is done, in part, by recruiting, hiring and retaining employees who share our core values of being an integral part of the communities we serve, delivering superior service to our customers and caring about our customers and associates. However, employee error or employee and customer misconduct could subject us to financial losses or regulatory sanctions and seriously harm our reputation. Misconduct by our employees could include hiding unauthorized activities from us, improper or unauthorized activities on behalf of our clients or improper use of confidential information. It is not always possible to prevent employee error or misconduct, and the precautions we take to prevent and detect this activity may not be effective in all cases. Because the nature of the financial services business involves a high volume of transactions, certain errors may be repeated or compounded before they are discovered and successfully rectified. If our reputation is negatively affected, by the actions of our employees or otherwise, our business and, therefore, our operating results could be materially adversely affected.

The Actual or Perceived Occurrence of Fraudulent Activity, Breaches or Failures of our Information Security Controls, or Cybersecurity Related Incidents Could Damage Our Reputation, Disrupt Our Business, Increase our Costs and Cause Losses. Financial institutions are inherently exposed to operational risk in the form of theft and other fraudulent activity by employees, clients and other third parties targeting us and our customers or data. Such activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering, and other dishonest acts. Information security breaches and cybersecurity-related incidents may include fraudulent or unauthorized access to systems used by us, our customers or third-party vendors, denial or degradation of service attacks, and malware or other cyber attacks. Although the Company devotes substantial resources to maintaining effective policies and internal controls to identify and prevent such incidents, given the increasing sophistication of possible perpetrators, the Company or the Bank may experience financial losses or reputational harm as a result of fraud. In addition, we may be required to make significant capital expenditures in order to modify and enhance our protective measures or to investigate and remediate fraudulent activity. Although we have not experienced any material business or reputational harm as a result of fraudulent activities in the past, the occurrence of fraudulent activity could damage our reputation, disrupt our business, increase our costs and cause losses in the future.

The Company's Success Largely Depends on the Efforts of its Executive Officers. The success of the Company and the Bank has been largely dependent on the efforts of Brent M. Giles, CEO and Director, Gregg Bexten, President and Director, and the other executive officers. These individuals are expected to continue to perform their services. However, the loss of the services of Mr. Giles or Mr. Bexten, or any of the other key executive officers could have a materially adverse effect on the Company and the Bank.

If We Fail to Maintain an Effective System of Internal Control Over Financial Reporting, We May Not Be Able to Accurately Report Our Financial Results or Prevent Fraud, and, as a Result, Investors and Depositors Could Lose Confidence in Our Financial Reporting, Which Could Adversely Affect Our Business, the Trading Price of Our Stock, and Our Ability to Attract Additional Deposits. We are required to include in our annual reports filed with the SEC a report from our management regarding internal control over financial reporting. As a result, we documented and evaluated our internal control over financial reporting in order to satisfy the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 and SEC rules and regulations, which require an annual management report on our internal control over financial reporting, including, among other matters, management's assessment of the effectiveness of internal control over financial reporting. Failure or circumvention of our system of internal control could have an adverse effect on our business, profitability, and financial condition, and could result in regulatory actions and loss of investor confidence. Additionally, if we fail to identify and correct any significant deficiencies or material weaknesses in the design or operating effectiveness of our internal control over financial reporting or fail to prevent fraud, current and potential stockholders and depositors could lose confidence in our financial reporting, which could adversely affect our business, financial condition and results of operations, the trading price of our stock and our ability to attract additional deposits.

Severe Weather, Natural Disasters, Pandemics, and Other External Events Could Significantly Impact Our Business. Severe weather, including tornadoes, droughts, hailstorms and other natural disasters, pandemics, or public health emergencies such as the outbreak of COVID-19, acts of war or terrorism and other adverse external events could

16

have a significant impact on our ability to conduct business. Such events could affect the stability of our deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue or cause us to incur additional expenses. Operations in our markets could be disrupted by both the evacuation of large portions of the population as well as damage or lack of access to our banking and operation facilities. Military and political conflicts, including the current military conflict between Russia and Ukraine, may increase volatility in commodity and energy prices, create supply chain issues and cause instability in financial markets, which may adversely affect us and our clients. Other severe weather or natural disasters, pandemics, acts of war or terrorism or other adverse external events may occur in the future. Although management has established business continuity plans and procedures, the occurrence of any such events could have a material adverse effect on our business, financial condition and results of operations.

Climate Change and Responses to Climate Change May Adversely Impact Our Business, Financial Condition and Results of Operations. Concerns over the long-term impacts of climate change have led and will continue to lead to governmental efforts to mitigate those impacts. Consumers and businesses are also changing their behavior and business preferences as a result of these concerns. New governmental regulations or guidance relating to climate change, as well as changes in consumers’ and businesses’ behaviors and business preferences, may cause us and our customers to experience cost increases, asset value reductions, operating process changes and delays in completion of projects. To the extent that climate change and responses to climate change negatively impact the businesses and financial condition of our customers, the credit risk associated with loans and other credit exposures to those customers may increase. In addition, weather events related to climate change could adversely affect our business and the businesses of our customers.

Public Health Threats or Outbreaks of Communicable Diseases May Adversely Affect the Company's Operations and Financial Results. The Company and the Bank may face risks related to public health threats or outbreaks of communicable diseases. A widespread healthcare crisis, such as an outbreak of a communicable disease could adversely affect the global economy and the Company's financial performance. For example, the COVID-19 pandemic destabilized the financial markets in which the Bank operates, and the effects of the pandemic continue to cause disruption in the global economies and financial markets, including the Bank's local markets. The Company and the Bank are dependent upon the willingness and ability of the Bank's customers to conduct banking and other financial transactions, which could be limited in the event of a disease outbreak or pandemic.

Risks Relating to Our Regulatory Environment

We May Be Adversely Affected by Changes in Laws and Regulations Affecting the Financial Services Industry. Banks and bank holding companies such as the Company are subject to regulation by both federal and state bank regulatory agencies. The regulations, which are designed to protect borrowers and promote certain social policies, include limitations on the operations of banks and bank holding companies, such as minimum capital requirements and restrictions on dividend payments. The regulatory authorities have extensive discretion in connection with their supervision and enforcement activities and their examination policies, including the imposition of restrictions on the operation of a bank, the classification of assets by an institution and requiring an increase in a bank's allowance for credit losses. These regulations are not necessarily designed to maximize the profitability of banking institutions.

As a financial holding company, we are subject to extensive regulation and supervision and undergo periodic examinations by our regulators, who have extensive discretion and authority to prevent or remedy unsafe or unsound practices or violations of law by banks and financial holding companies. Failure to comply with applicable laws, regulations or policies could result in sanctions by regulatory agencies, civil monetary penalties and/or damage to our reputation, which could have a material adverse effect on us. Although we have policies and procedures designed to mitigate the risk of any such violations, there can be no assurance that such violations will not occur.

Current or proposed regulatory or legislative changes to laws applicable to the financial industry may impact the profitability of our business activities and may change certain of our business practices, including our ability to offer new products, obtain financing, attract deposits, make loans and achieve satisfactory interest spreads, and could expose us to additional costs, including increased compliance costs. In addition, political developments, including the possible implementation of policies proposed by the new presidential administration, including tariffs, mass deportations and tax or financial regulations or the appointment of new personnel in regulatory agencies, add uncertainty to the implementation, scope and timing of regulatory reforms. These changes may also require us to invest significant management attention and resources to make any necessary changes to operations in order to comply and could therefore materially and adversely affect our business, financial condition and results of operations.

17

The Federal Reserve May Require the Company to Commit Capital Resources to Support the Bank. As a matter of policy, the Federal Reserve expects a bank holding company to act as a source of financial and managerial strength to its subsidiary banks. The Federal Reserve may charge the bank holding company with engaging in unsafe and unsound practices for failure to adequately commit resources to a subsidiary bank. Accordingly, we may be required to make capital injections into a troubled subsidiary bank, even if such contribution creates a detriment to the Company or its stockholders. If we do not have sufficient resources on hand to fund the capital injection, we may be required to borrow funds or raise capital. Any such loans are subordinate in right of payment to deposits and to certain indebtedness of the subsidiary bank. In the event of bankruptcy of the bank holding company, claims based upon any commitments to fund capital injections are entitled to a priority of payment over claims made by general unsecured creditors, including holders of indebtedness. Thus, any borrowing incurred by the Company to make required capital injections to the Bank are difficult and expensive, and will adversely impact our financial condition, results of operations and future prospects.

The Short-Term and Long-Term Impact of any Change to Regulatory Capital Requirementsis Uncertain. The Company and the Bank are subject to various regulatory capital requirements. The federal banking agencies have substantially amended the regulatory capital rules applicable to us and the Bank in the past and may do so again in the future. The amendments implement the Basel III Rules and changes required by the Dodd-Frank Act. The amended rules include new minimum risk-based capital and leverage ratios, which became effective in January 2015 (with certain phase-ins), and refined the definition of what constitutes "capital" for purposes of calculating those ratios.

The application of more stringent capital requirements to us and the Bank could, among other things, result in lower returns on invested capital, require the raising of additional capital, and result in regulatory actions if we were to be unable to comply with such requirements. Implementation of changes to asset risk weightings for risk based capital calculations, items included or deducted in calculating regulatory capital and/or additional capital conservation buffers could result in management modifying its business strategy and could further limit the Company's ability to make distributions, including paying out dividends or buying back shares.

Higher FDIC Deposit Insurance Premiums and Assessments Could Adversely Affect our Financial Condition. Our deposits are insured up to applicable limits by the DIF and are subject to deposit insurance assessments to maintain deposit insurance. As an FDIC-insured institution, we are required to pay quarterly deposit insurance premium assessments to the FDIC. Growth in insured deposits at FDIC-insured financial institutions in recent years caused the ratio of the DIF to total insured deposits to fall below the current statutory minimum, and the FDIC has approved an increase in the base assessment rates to increase the likelihood that the reserve ratio of the DIF reaches the statutory minimum level by the statutory deadline. Although we cannot predict what the insurance assessment rates will be in the future, either a deterioration in our risk-based capital ratios or further adjustments to the base assessment rates could have a material adverse impact on our business, financial condition, results of operations and cash flows.

Non-Compliance with the USA PATRIOT Act, Bank Secrecy Act, Real Estate Settlement Procedures Act, Truth-in-Lending Act, Community Reinvestment Act, Fair Lending Laws or Other Laws and Regulations Could Result in Fines or Sanctions, and Curtail Expansion Opportunities. Financial institutions are required under the USA PATRIOT and Bank Secrecy Acts to develop programs to prevent financial institutions from being used for money-laundering and terrorist activities. Financial institutions are also obligated to file suspicious activity reports with the U.S. Treasury Department's Office of Financial Crimes Enforcement Network if such activities are detected. These rules also require financial institutions to establish procedures for identifying and verifying the identity of customers seeking to open new financial accounts. Failure or the inability to comply with the USA PATRIOT Act and Bank Secrecy Act statutes and regulations could result in fines or penalties, curtailment of expansion opportunities, enforcement actions, intervention or sanctions by regulators and costly litigation or expensive additional controls and systems. During the last few years, several banking institutions have received large fines for non-compliance with these laws and regulations. In addition, the U.S. Government imposed and will continue to expand laws and regulations relating to residential and consumer lending activities that create significant new compliance burdens and financial risks.

Regulations Relating to Privacy, Cybersecurity, Information Security and Data Protection Could Increase Our Costs, Affect or Limit How We Collect and Use Personal Information and Adversely Affect Our Business Opportunities. We are subject to various privacy, information security and data protection laws, including requirements concerning security breach notification, and we could be negatively impacted by these laws. For example, our business is subject to the Gramm-Leach-Bliley Act which, among other things: (i) imposes certain limitations on our ability to share non-public personal information about our clients with non-affiliated third parties; (ii) requires that we provide certain disclosures to clients about our information collection, sharing and security practices and afford clients the right to “opt out” of any information sharing by us with non-affiliated third parties (with certain exceptions); and (iii) requires that we

18

develop, implement and maintain a written comprehensive information security program containing safeguards that are appropriate based on our size and complexity, the nature and scope of our activities and the sensitivity of client information we process, as well as plans for responding to data security breaches. Many state and federal banking regulators, states and foreign countries have also enacted data security breach notification requirements with varying levels of individual, consumer, regulatory or law enforcement notifications in certain circumstances in the event of a security breach. Moreover, legislators and regulators in the U.S. and other countries are increasingly adopting or revising privacy, information security and data protection laws that potentially could have a significant impact on our current and planned privacy, data protection and information security-related practices, our collection, use, sharing, retention and safeguarding of client or employee information, and some of our current or planned business activities. This could also increase our costs of compliance and business operations and could reduce income from certain business initiatives. This includes increased privacy-related enforcement activity at the federal level by the Federal Trade Commission, as well as at the state level.

Compliance with any current or future laws and regulations noted above (including those regarding security breach notification) could result in higher compliance costs and could restrict our ability to provide certain products and services, which could have a material adverse effect on our business, financial conditions or results of operations. Our failure to comply with any such laws could result in potentially significant regulatory or governmental investigations or actions, litigation, fines, sanctions and damage to our reputation, which could have a material adverse effect on our business, financial condition or results of operations.

The Company is subject to a number of federal and state laws and regulations requiring notifications and disclosures regarding certain cybersecurity incidents, which could be triggered as a result of incidents discussed above. In addition, the Company must consider and address cybersecurity considerations as part of its risk management processes. See Item 16. Cybersecurity for additional information.

We are Subject to Numerous Laws Designed to Protect Consumers, Including the Community Reinvestment Act and Fair Lending Laws, and Failure to Comply with These Laws Could Lead to a Wide Variety of Sanctions. The Community Reinvestment Act, the Equal Credit Opportunity Act, the Fair Housing Act and other fair lending laws and regulations impose nondiscriminatory lending requirements on financial institutions. The U.S. Department of Justice and other federal agencies are responsible for enforcing these laws and regulations. A successful regulatory challenge to an institution’s performance under the Community Reinvestment Act or fair lending laws and regulations could result in a wide variety of sanctions, including damages and civil money penalties, injunctive relief, restrictions on mergers and acquisitions activity, restrictions on expansion and restrictions on entering new business lines. Private parties may also have the ability to challenge an institution’s performance under fair lending laws in private class action litigation. Such actions could have a material adverse effect on our business, financial condition, results of operations and future prospects. We may be subject to liability for potential violations of predatory lending laws, which could adversely impact our results of operations, financial condition and business.

We Are Subject to a Number of Other Laws and Regulations, Which May Adversely Affect the Operation of Our Business and Increase Our Costs. We are extensively regulated under U.S. federal and state law, and are subject to a number of laws and regulations in addition to banking laws and regulations, including securities, insurance and tax laws and regulations. As a company whose stock is publicly traded, we are subject to various federal and state securities laws, including the Securities Act of 1933, as amended, the Exchange Act and the Sarbanes-Oxley Act of 2002, and we file periodic reports with the Securities and Exchange Commission. In addition, because our common stock is listed with The Nasdaq Stock Market LLC, we are subject to the listing rules of that exchange. The Company and its subsidiaries are subject to federal and state income taxes and Missouri franchise taxes, and are potentially subject to audits by the Internal Revenue Service and state income and franchise tax examinations by the Missouri Department of Revenue. Any failure by us to comply with any laws or regulations, any change in such laws or regulations or the position of any regulatory agency with respect thereto, or any adverse result in any regulatory investigation or examination, including any tax audit or examination, could adversely affect our business, financial condition and results of operations.

Technology and Vendor Risks

We Are Subject to Security and Operational Risks Relating to Our Use of Technology That Could Damage Our Reputation and Our Business. We rely heavily on communications and information systems to conduct our business. Furthermore, we have access to large amounts of confidential financial information and control substantial financial assets, including those belonging to our customers, to whom we offer remote access, and we regularly transfer substantial financial assets by electronic means. Our operations are dependent upon our ability to protect our computer equipment against damage from physical theft, fire, power loss, telecommunications failure or a similar catastrophic event,

19

as well as from security breaches, denial of service attacks, viruses, worms and other disruptive problems caused by hackers. Any failure, interruption or breach in security of our systems could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on our financial condition and results of operations. Although we intend to continue to implement security technology and establish operational procedures to prevent such damage, our security measures may not be successful.

In addition, advances in computer capabilities, new discoveries in the field of cryptography or other developments could result in a compromise or breach of the algorithms we and our third-party service providers use to encrypt and protect customer transaction data. A failure of such security measures could have a material adverse effect on our financial condition and results of operations. We also face the risk of operational disruption, failure, termination or capacity constraints caused by third parties that facilitate our business activities by providing technology such as software applications, as well as financial intermediaries. Such parties could also be the source of an attack on, or breach of, our operational systems, data or infrastructure.

We also face the potential risk of loss due to fraud, including commercial checking account fraud, automated teller machine (ATM) skimming and trapping, write-offs necessitated by debit card fraud, and other forms of online banking fraud, which are becoming more sophisticated and present new challenges as mobile banking increases, as well as employee fraud. Employee errors could also subject us to financial claims for negligence. We maintain a system of internal controls and insurance coverage to mitigate against operational risks, including data processing system failures and errors and customer or employee fraud. Should our internal controls fail to prevent or detect an occurrence, and if any resulting loss is not insured or exceeds applicable insurance limits, such failure could have a material adverse effect on our business, financial condition and results of operations.

The Operation of Our Business, Including Customer Interaction, is Increasingly Done Via Electronic Means, and This Has Increased Our Risks Related to Cybersecurity. We rely on the successful and uninterrupted functioning of our information technology and telecommunications systems to conduct our business. This includes internally developed systems, the systems of third-party service providers, and digital and mobile technologies. Any failure, interruption or breach in security of these systems could result in failures or disruptions in our customer relationship management, general ledger, deposit, loan and other systems, and could damage our reputation, result in loss of customer business, subject us to regulatory scrutiny, or expose us to civil litigation and possible financial liability. We are exposed to the risk of cyber-attacks in the normal course of business, which can result from deliberate attacks or unintentional events. We have observed an increased level of attention in the industry focused on cyber-attacks that include, but are not limited to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data, or causing operational disruption. Cyber-attacks may also be carried out in a manner that does not require gaining unauthorized access, such as by causing denial-of-service attacks on websites. Cyber-attacks may be carried out by third parties or insiders using techniques that range from highly sophisticated efforts to electronically circumvent network security or overwhelm websites to more traditional intelligence gathering and social engineering aimed at obtaining information necessary to gain access. The objectives of cyber-attacks vary widely and can include theft of financial assets, intellectual property, or other sensitive information, including the information belonging to our banking customers. Cyber-attacks may also be directed at disrupting our operations.

We may incur substantial costs and suffer other negative consequences if we fall victim to successful cyber-attacks. Such negative consequences could include remediation costs that may include liability for stolen assets or information and repairing system damage that may have been caused; increased cybersecurity protection costs that may include organizational changes, deploying additional personnel and protection technologies, training employees, and engaging third party experts and consultants; lost revenues resulting from unauthorized use of proprietary information or the failure to retain or attract customers following an attack; litigation; and reputational damage adversely affecting customer or investor confidence.

We Continually Encounter Technological Change, and We Cannot Predict How Changes in Technology May Affect Our Business. The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology driven by products and services, which include developments in:

20

The effective use of technology increases efficiency and enables financial institutions to better serve customers and to reduce costs. Our future success depends, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology driven products and services or be successful in marketing these products and services to our customers. Failure to successfully keep pace with technological change affecting the financial services industry could have a material adverse impact on our business and, in turn, our financial condition and results of operations.

We Rely On Others to Provide Key Components of Our Business Infrastructure. Third-party vendors provide key components of our business infrastructure such as internet connections, network access and core application processing. While we have selected these third party vendors carefully, we do not control their actions. If these third-party vendors experience financial, operational or technological difficulties, perform their services poorly or terminate their services, and we are unable to replace them with other service providers, our operations could be interrupted. Any problems caused by these third parties, including as a result of their not providing us their services for any reason or their performing their services poorly, could adversely affect our ability to deliver products and services to our customers or otherwise conduct our business efficiently and effectively. If a service interruption were to continue for a significant period of time, our business, financial condition and results of operations could be adversely affected, perhaps materially. Replacing these third party vendors could also entail significant delay and additional expense.

Risks Related to Our Common Stock

The Price of Our Common Stock Could Fluctuate Significantly, Which Could Make it Difficult for You to Resell Shares of Our Common Stock at Times or at Prices You Find Attractive. The stock market and, in particular, the market for financial institution stocks, has experienced significant volatility during the recent changes in economic and industry conditions. In some cases, the markets have produced downward pressure on stock prices for certain issuers without regard to those issuers' underlying financial strength. As a result, the trading volume in our common stock could fluctuate more than usual and cause significant price variations to occur. This could make it difficult for you to resell shares of our common stock at times or at prices you find attractive.

The trading price of the shares of our common stock will depend on many factors that could change from time to time and could be beyond our control. Among the factors that could affect our stock price are those identified under the heading "Forward-Looking Statements" in Item 7, Management's Discussion and Analysis of Financial Condition and Results of Operations, of this report and as follows:

•actual or anticipated quarterly fluctuations in our operating results and financial condition;

•changes in financial estimates or publication of research reports and recommendations by financial analysts or actions taken by rating agencies with respect to our common stock or those of other financial institutions;

•failure to meet analysts' revenue or earnings estimates;

•speculation in the press or investment community generally or relating to our reputation, our market area, our competitors or the financial services industry in general;

•strategic actions by us or our competitors, such as acquisitions, restructurings, dispositions or financings;

•actions by our current stockholders, including sales of common stock by existing stockholders and/or directors and executive officers;

•fluctuations in the stock price and operating results of our competitors;

•future sales of our equity, equity-related or debt securities;

•changes in the frequency or amount of dividends or share repurchases;

•proposed or adopted regulatory changes or developments;

•investigations, proceedings or litigation that involve or affect us;

•trading activities in our common stock, including short-selling;

•domestic and local economic factors unrelated to our performance; and

21

•general market conditions and, in particular, developments related to market conditions for the financial services industry.

A significant decline in our stock price could result in substantial losses for individual stockholders and could lead to costly and disruptive securities litigation.

The Trading Volume in Our Common Stock Has Been Low, and the Sale of a Substantial Number of Shares of Our Common Stock in the Public Market Could Depress the Price of Our Common Stock and Make it Difficult for You to Sell Your Shares. Our common stock is listed to trade on the Nasdaq Global Select Market, but is thinly traded. As a result, you may not be able to sell your shares of common stock on short notice. Additionally, thinly traded stock can be more volatile than stock trading in an active public market. The sale of a substantial number of shares of our common stock at one time could temporarily depress the market price of our common stock, making it difficult for you to sell your shares and impairing our ability to raise capital.

Our Common Stock is Not Insured by Any Governmental Entity. Our common stock is not a deposit account or other obligation of any bank and is not insured by the FDIC or any other governmental entity.

Additional Factors. Additional risks and uncertainties that may affect the future results of operations, financial condition or business of the Company and its banking subsidiary include, but are not limited to: (i) adverse publicity, news coverage by the media, or negative reports by brokerage firms, industry and financial analysts regarding the Bank or the Company; and (ii) changes in accounting policies and practices.

Item 1B. Unresolved Staff Comments.

None.

Item 1C. Cybersecurity.

We recognize the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. Our board of directors is actively involved in oversight of the Company’s risk management program, and cybersecurity represents an important component of the Company’s overall approach to enterprise risk management (“ERM”). The Company maintains a cybersecurity and information technology (“IT”) risk management program designed toprevent, detect and respond to information security threats, which are fully integrated into the Company’s ERM program.

Our cybersecurity and IT risk management program is based on recognized frameworks established by the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework, as well as the banking-specific framework from the Federal Financial Institution Examination Council’s (“FFIEC’s”) Cybersecurity Assessment Tool. The Company’s program is led by our Director of Information Technology and Information Security Officer, whose teams are responsible for leading short-term and long-term enterprise-wide cybersecurity strategy, policy, standards, monitoring, architecture and processes.Our Director of Information Technology and Information Security Officer has over fifteen years of experience in the field of cybersecurity and over a decade of experience leading cyber security oversight in the banking industry.

Governance

Although it is management's job to assess and manage our Company's exposure to risk, our board of directors oversees our Company's ERM, including cybersecurity and IT risks and threats, and establishes policies that govern the process. Our board conducts much of its risk oversight activities through our Audit Committee, which works closely with our Chief Risk Officer and Internal Audit Manager. The Audit Committee has primary management responsibility for oversight of operations, technology and operational risk, including information security, fraud, vendor, data protections and privacy, business continuity and cybersecurity risks. Our Audit Committee meets at least quarterly with our Chief Risk Officer, Internal Audit Manager and other members of management to assess, among other things, cyber threats or risks to align the Company for effective cybersecurity risk management and reporting. The Audit Committee receives quarterly reports from our Internal Audit Manager and Director of Information Technology and Information Security Officer on, among other things, the Company’s cyber risks and threats, the status of projects to strengthen the Company’s information security program, the emerging threat landscape and key metrics from cybersecurity systems and monitoring. Our Chief Risk Officer provides a presentation on ERM to the full board at least once annually. From time to time our Audit

22

Committee also receives updates between meetings from our Chief Risk Officer, Chief Executive Officer, Chief Financial Officer and other members of management relating to risk oversight matters.

Security event monitoring and detection

Our processes for assessing, identifying, and managing material risks from cybersecurity threats include using a wide-range of industry-leading security tools, regularly updating our technology roadmaps, and mandating cybersecurity awareness, business continuity and incident response training for all employees.

Recognizing the complexity and evolving nature of cybersecurity threats, we engage a range of outside experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our cybersecurity and IT risk management systems. Engaging outside vendors enables us to leverage specialized knowledge and insights, ensuring our cybersecurity and IT risk management strategies and processes remain sound. Our collaboration with these third-parties includes threat assessments, consultation on security enhancements and regular audits, the results of these threat assessments and audits are reported to the Audit Committee.Strong vendor management and monitoring controls are enforced and require, at a minimum, annual due diligence on critical vendors.

We have implemented a comprehensive Incident Response Program to provide guidance in the event of a cybersecurity incident for contacting authorities and informing key stakeholders to ensure that any non-routine events are properly escalated. The Company participates in cybersecurity incident response exercises to test pre-planned response actions from the Company’s plan and to facilitate group discussions regarding the effectiveness of the Company’s cybersecurity incident response strategies and tactics. We use a third-party SEIM to provide 24x7x365 monitoring of logs, administrator and user actions, network and security appliances, and endpoint agents. Our Director of Information Technology and Information Security Officer actively engages with key vendors, industry participants, as well as the FS-ISAC, InfraGard, InspireCIO and SANS Internet Storm Center cybersecurity collaboration organizations.

Incident materiality

The Incident Response Program is a component of the Company's Information Security policy and sets forth the severity categories and processes required to assess the impact of a cyber-related incident to the Company. The impact is categorized in one of five severity levels and is expressed in terms of financial loss, strategic objectives, customer, legal and regulatory, reputation, and service interruption. The incident response program includes timely notification of a material cybersecurity incident to the to the appropriate law enforcement, regulatory agencies, Board of Directors and other members of senior management.

Like other financial institutions, the Company experiences malicious cyber activity on an ongoing basis directed at its websites, computer systems, software, networks and users. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware, and denial of service attacks. The Company also experiences large volumes of phishing and other forms of social engineering attempted for the purpose of perpetrating fraud. While, to date, malicious cyber activity, cyberattacks and other information security breaches have not had a material adverse impact on the Company, risk to its systems remains significant. See Item 1A. entitled Technology Risk "A successful cyber attack or other computer system breach could significantly harm the Company, its reputation and its customers".

23

Item 2. Properties.

The Company does not own or lease any property. The Company's principal office is located at 132 East High Street, Jefferson City, Missouri 65101. The table below provides a list of the Bank's facilities.

910 West Buchanan Street, California, MO 2,270 Owned $ 578

100 Plaza Drive, Harrisonville, MO 4,000 Owned $ 825

132 East High Street, Jefferson City, MO 34,800 Owned $ 2,303

211 West Dunklin Street, Jefferson City, MO 2,500 Owned $ 1,576

800 Eastland Drive, Jefferson City, MO 4,100 Owned $ 615

300 S.W. Longview Blvd, Lee's Summit, MO 11,700 Owned $ 2,647

400 S.W. Longview Blvd, Lee's Summit, MO 3,043 Leased (3) $ 93

7300 College Boulevard, Overland Park, Kansas, Suite 165 3,344 Leased (4) N/A

___________________________

(1)The term of this lease began in February 2019 and ends in February 2029.

(2)The term of this lease began in September 2024 and ends in August 2034.

(3)The term of this lease began in July 2024 and ends in December 2026.

(4)The term of this lease began in November 2024 and ends in February 2025.

Management believes that the current condition of each of the Bank's facilities is adequate for its business and that such facilities are adequately covered by insurance.

Item 3. Legal Proceedings.

The information required by this Item is set forth in Note 19, Commitments and Contingencies, in the Company's consolidated financial statements, included under the caption "Consolidated Financial Statement" in the Company's 2024 Annual Report to Shareholders (included as Exhibit 13.1 hereto), incorporated herein by reference.

Item 4. Mine Safety Disclosures.

Not applicable

EXECUTIVE OFFICERS OF THE REGISTRANT

Executive officers of the Company are appointed by the board of directors and serve at the discretion of the board. The following table sets forth certain information with respect to all executive officers of the Company.

24

Name Age Position

Brent M. Giles 57 Chief Executive Officer and Director

Gregg A. Bexten 57 President and Director

Chris E. Hafner 58 Executive Vice President and Chief Financial Officer

The business experience of the executive officers of the Company for the last five years is as follows:

Brent M. Giles has served as a director and CEO of the Company and of the Bank since May 2023. Mr. Giles served as Chairman, President and Chief Executive Officer of Bank of Blue Valley from July 2021 until he joined the Company, and as President and Chief Executive Officer of Wisconsin Bank & Trust from May 2020 until July 2021. From September 2003 until May 2020, Mr. Giles served as Chairman and Chief Executive Officer of Liberty Bancorp, Inc. and Bank Liberty, where he took the company public. Bank Liberty has been recognized as a “best bank,” “best place to work,” and “strongest mid-size bank.” Prior to 2003, Mr. Giles had several commercial banking roles of increasing responsibility and spent 9 years as an FDIC examiner. Mr. Giles received his bachelor’s degree in banking and finance and his MBA both from the University of Missouri where he is still involved speaking to graduate banking classes.

Gregg A. Bexten has served as a director and president of the Company and of the Bank since May 2023. From 2014 until May 2023, he served as Regional President of our Central Region. From 2000 until 2014 he served as a commercial lender in our Central Region with titles of Senior Vice President and Vice President. Prior to joining the Bank, Mr. Bexten served as a commercial lender with another financial institution and as a Commissioned Bank Examiner for the Federal Reserve Bank of St. Louis. Mr. Bexten possesses considerable expertise in overseeing lending, various finance and regulatory compliance aspects of community banking, which he attained through over 30 years of service, first as a bank regulator and then as a dedicated, tenured employee of the Bank.

Chris E. Hafner has served as Chief Financial Officer of the Company and of the Bank since October 2023. Mr. Hafner served as an outside banking and business consultant to several entities from December 2022 until he joined the Company and the Bank. Mr. Hafner previously served as Chief Accounting Officer of CrossFirst Bank, the bank subsidiary of CrossFirst Bankshares, Inc., a Nasdaq-listed bank holding company, from February 2016 until November 2022. Prior to that, he served as Chief Financial Officer at Missouri Bank, a privately held bank, from June 2015 until January 2016, and as Chief Risk Officer at Missouri Bank from April 2012 until May 2015. Prior to joining Missouri Bank, he served as Chief Financial Officer at First National Bank of Kansas, a privately held bank, from August 2005 until December 2011 and, prior to that, he served as Assistant Controller at Commerce Bancshares, Inc., a Nasdaq-listed bank holding company, from June 2000 until July 2005. He served in various roles in the audit practice of Forvis Mazars, LLP (formerly BKD LLP) from July 1994 until June 2000. Chris received a Bachelor of Business Administration degree from Iowa State University. He has been previously licensed as a Certified Public Accountant.

Kathleen L. Bruegenhemke has served as a director of the Company and of the Bank since March 2017. She has served as Executive Vice President since May 2024. She served as Senior Vice President of the Company from 1997 until February 2024, as Secretary of the Company since 1997 and as Chief Risk Officer of the Company since June 2006. With the exception of six months (November 2023 - April 2024), Ms. Bruegenhemke has served as Chief Operations Officer of Hawthorn Bank since January 2017. From October 2014 until December 2016 she served as Columbia Market President for the Bank. She has served as Senior Vice President and Secretary of the Company since November 1997 and as Chief Risk Officer of the Company since June 2006. From January 1992 until November 1997, she served as Internal Auditor of the Bank (or of one of its constituent predecessors). Prior to joining the Bank, Ms. Bruegenhemke served as a Commissioned Bank Examiner for the FDIC. Ms. Bruegenhemke is a certified public accountant and possesses considerable expertise in overseeing various finance, regulatory compliance and risk management aspects of community banking, which she attained through over 30 years of service, first as a bank regulator and then as a dedicated employee of the Bank.

There is no arrangement or understanding between any executive officer and any other person pursuant to which such executive officer was selected as an officer.

PART II

25

Item 5. Market for Registrant's Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities.

Pursuant to General Instruction G(2) to Form 10-K, the information required by this Item, other than that referred to below, is incorporated herein by reference to the information under the caption "Market Price of and Dividends on Equity Securities and Related Matters" in the Company's 2024 Annual Report to Shareholders (included as Exhibit 13 hereto).

We refer you to Item 12 of this report under the caption "Securities Authorized For Issuance Under Equity Compensation Plans" for certain equity plan information.

The Company's Purchases of Equity Securities

The following table summarizes the purchases made by or on behalf of the Company or certain affiliated purchasers of shares of the Company's common stock during the quarter ended December 31, 2024:

(1) Represents shares of the Company's common stock withheld to satisfy tax withholding obligations upon the vesting of awards of restricted stock.

(2) There were no purchases made by or on behalf of the Company or any "affiliated purchaser" (as defined by applicable rules of the SEC) of shares the Company's common stock during the fourth quarter of the year ended December 31, 2024. Pursuant to the Company's 2019 Repurchase Plan, management is given discretion to determine the number and pricing of the shares to be purchased under the plan, as well as the timing of any such purchases. As of December 31, 2024, $3.9 million remains available for share repurchases pursuant to the plan.

Recent Issuance of Securities

None.

Item 6. [Reserved].

26

Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operation.

Pursuant to General Instruction G(2) to Form 10-K, the information required by this Item is incorporated herein by reference to the information under the caption "Management's Discussion and Analysis of Financial Condition and Results of Operations" in the Company's 2024 Annual Report to Shareholders (included as Exhibit 13 hereto).

Forward-Looking Statements

This report, including information included or incorporated by reference in this report, contains certain forward-looking statements with respect to the financial condition, results of operations, plans, objectives, strategy, future performance and business of the Company and its subsidiaries, including, without limitation:

•statements that are not historical in nature, and

•statements preceded by, followed by or that include the words "believes," "expects," "may," "will," "should," "could," "anticipates," "estimates," "intends" or similar expressions.

Forward-looking statements are not guarantees of future performance or results. They involve risks, uncertainties and assumptions. Actual results may differ materially from those contemplated by the forward-looking statements due to, among others, the following factors:

•competitive pressures among financial services companies may increase significantly,

•changes in the interest rate environment may reduce interest margins,

•general economic conditions, either nationally or in Missouri, may be less favorable than expected and may adversely affect the quality of the Company's loans and other assets,

•increases in non-performing assets in the Company's loan portfolios and adverse economic conditions may necessitate increases to the provisions for credit losses,

•costs or difficulties related to the integration of the business of the Company and its acquisition targets may be greater than expected,

•legislative, regulatory, or tax law changes may adversely affect the business in which the Company and its subsidiaries are engaged,

•credit and market risks relating to increasing inflation,

•economic or other disruptions caused by acts of terrorism, war or other conflicts, including the Russia-Ukraine conflict, and the Israel-Hamas conflict, natural disasters, such as hurricanes, wild fires, freezes, flooding and other man-made disasters, such as oil spills or power outages, health emergencies, epidemics or pandemics, climate changes or other catastrophic events,

•changes may occur in the securities markets,

•changes in the level and direction of loan delinquencies and write-offs and changes in estimates of the adequacy of the allowance for credit losses, and

•technological changes, including potential cyber-security incidents and other disruptions, or innovations to the financial services industry, including as a result of the increased telework environment.

We have described additional factors that could cause actual results to be materially different from those described in the forward-looking statements, which factors are identified in Item 1A of this report under the heading "Risk Factors." Other factors that we have not identified in this report could also have this effect. You are cautioned not to put undue reliance on any forward-looking statement, which speak only as of the date such statement is made. Except as otherwise required by law, we undertake no obligation to publicly update or revise any forward-looking statement to reflect events or circumstances after the date of this report or to reflect the occurrence of unanticipated events.

Item 7A. Quantitative and Qualitative Disclosures About Market Risk.

The Company's exposure to market risk is reviewed on a regular basis by our Bank's asset/liability committee and board of directors. Interest rate risk is the potential of economic losses due to future interest rate changes. These economic losses can be reflected as a loss of future net interest income and/or a loss of current fair market values. The objective is to

27

measure the effect on net interest income and to adjust the balance sheet to minimize the inherent risk while at the same time maximizing income. Management realizes certain risks are inherent and that the goal is to identify and minimize those risks.

Tools used by the Bank's management include modeling the effects on net interest income under different rate shock scenarios. At December 31, 2024, the Company's rate shock scenario models indicated that annual net interest income could change by as much as (2.75)% or (0.38)% should interest rates rise or fall, respectively, 200 basis points from their current level over a one-year period. These levels of interest rate risk are within limits set by the board in the Company's Funds Management, Investment Asset Liability Policy and management believes this is an acceptable level of interest rate risk. However, there are no assurances that the change will not be more or less than this estimate.

Pursuant to General Instruction G(2) to Form 10-K, the information required by this Item, other than that provided above, is incorporated herein by reference to the information under the caption "Management's Discussion and Analysis of Financial Condition and Results of Operations -- Quantitative and Qualitative Disclosures About Market Risk" in the Company's 2024 Annual Report to Shareholders (included as Exhibit 13 hereto).

Item 8. Financial Statements and Supplementary Data.

Pursuant to General Instruction G(2) to Form 10-K, the information required by this Item is incorporated herein by reference to the report of the independent registered public accounting firm and the information under the caption "Consolidated Financial Statements" in the Company's 2024 Annual Report to Shareholders (included as Exhibit 13 hereto).

Item 9. Changes in and Disagreements With Accountants on Accounting and Financial Disclosure.

None.

Item 9A. Controls and Procedures.

(a)Evaluation of Disclosure Controls and Procedures.

As of the end of the period covered by this annual report, the Company's management, including the Chief Executive Officer and Chief Financial Officer, evaluated the effectiveness of the Company's disclosure controls and procedures (as defined in Rule 13a-15(e) promulgated under the Exchange Act). Based on that evaluation, the Company's management, including the Chief Executive Officer and Chief Financial Officer, concluded that, as of December 31, 2024, the Company's disclosure controls and procedures were effective.

(b)Management's Report on Internal Control Over Financial Reporting.

The Company's management is responsible for establishing and maintaining adequate internal control over financial reporting, as such term is defined in Exchange Act Rule 13a-15(f). Under the supervision and with the participation of the Company's management, including the Company's principal executive officer and principal financial officer, we conducted an evaluation of the effectiveness of the Company's internal control over financial reporting, as of December 31, 2024, based on the framework set forth by the Committee of Sponsoring Organizations of the Treadway Commission in Internal Control-Integrated Framework (2013). Based upon its assessment, management has concluded that, as of December 31, 2024, the Company's internal control over financial reporting, is effective based on the criteria established in Internal Control-Integrated Framework (2013).

Management's assessment of the effectiveness of internal control over financial reporting, as of December 31, 2024, has been audited by Forvis Mazars, LLP, an independent registered public accounting firm, as stated in their report, which is included in this Annual Report on Form 10-K.

(c)Changes in Internal Control over Financial Reporting.

There has been no changes in the Company's internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) that occurred during the quarter ended December 31, 2024 that has materially affected, or is reasonably likely to materially affect, the Company's internal control over financial reporting.

28

Report of Independent Registered Public Accounting Firm

To the Shareholders, Board of Directors, and Audit Committee

Hawthorn Bancshares, Inc.:

Opinion on the Internal Control over Financial Reporting

We have audited Hawthorn Bancshares, Inc. and Subsidiaries’ (the “Company”) internal control over financial reporting as of December 31, 2024, based on criteria established in Internal Control – Integrated Framework: (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of December 31, 2024, based on criteria established in Internal Control – Integrated Framework: (2013) issued by COSO.

We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (“PCAOB”), the consolidated financial statementsof the Company as of December 31, 2024, and for the year then ended, and our report dated March 17, 2025, expressed an unqualified opinion on those consolidated financial statements.

Basis for Opinion

The Company’s management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management’s Annual Report on Internal Controls over Financial Reporting. Our responsibility is to express an opinion on the Company’s internal control over financial reporting based on our audit.

We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, and testing and evaluating the design and operating effectiveness of internal control based on the assessed risk. Our audit also included performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.

Definitions and Limitations of Internal Control over Financial Reporting

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of reliable financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate.

/s / Forvis Mazars, LLP

Kansas City, Missouri

29

Item 9B. Other Information.

During the three months ended December 31, 2024, no director or officer of the Company adopted or terminated a “Rule 10b5-1 trading arrangement” or “non-Rule 10b5-1 trading arrangement” as each term is defined in Item 408(a) of Regulation S-K.

Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections.

Not applicable.

PART III

Item 10. Directors, Executive Officers and Corporate Governance.

Pursuant to General Instruction G(3) to Form 10-K, the information required by this Item, other than that referred to below, is incorporated herein by reference to:

(i)the information under the caption "Item 1: Election of Directors--What is the structure of our board and how often are directors elected?" in the Company's definitive Proxy Statement for its 2025 Annual Meeting of Shareholders to be filed pursuant to Regulation 14A;

(ii)the information under the caption "Item 1: Election of Directors--Who are this year's nominees?" in the Company's definitive Proxy Statement for its 2025 Annual Meeting of Shareholders to be filed pursuant to Regulation 14A;

(iii)the information under the caption "Item 1: Election of Directors--What is the business experience of the nominees and of our continuing board members?" in the Company's definitive Proxy Statement for its 2025 Annual Meeting of Shareholders to be filed pursuant to Regulation 14A;

(iv)the information under the caption "Executive Officers of the Registrant" in Part I of this report;

(v)the information under the caption "Delinquent Section 16(a) Reports" in the Company's definitive Proxy Statement for its 2025 Annual Meeting of Shareholders to be filed pursuant to Regulation 14A;

(vi)the information under the caption "Corporate Governance and Board Matters--Consideration of Director Nominees" in the Company's definitive Proxy Statement for its 2025 Annual Meeting of Shareholders to be filed pursuant to Regulation 14A; and

(vii)the information under the caption "Corporate Governance and Board Matters--Committees of the Board--Audit Committee" in the Company's definitive Proxy Statement for its 2025 Annual Meeting of Shareholders to be filed pursuant to Regulation 14A.

Code of Ethics

The Company has adopted a Code of Business Conduct and Ethics for directors, officers and employees including, its principal executive officer, principal financial officer, principal accounting officer, controller and persons performing similar functions. This code of Business Conduct and Ethics is posted on the Company's internet website (www.hawthornbancshares.com) under the "Governance Documents" menu tab and is available for your examination. A copy of this Code will be furnished without charge upon written request to Corporate Secretary, Hawthorn Bancshares, Inc., 132 East High Street, Jefferson City, Missouri 65101. Any substantive amendment to, or waiver from, a provision of this code that applies to the Company's principal executive officer, principal financial officer, principal accounting officer, controller, or persons performing similar functions will be disclosed on the Company's internet website (www.hawthornbancshares.com) and, if required by the rules of the SEC or The Nasdaq Stock Market LLC, in reports the Company files with the SEC.

Insider Trading Policy

The Company has adopted an Insider Trading Policy governing the purchase, sale and other disposition of its securities by directors, officers and employees that is designed to promote compliance with insider trading laws, rules and regulations, and applicable listing standards of the The Nasdaq Stock Market LLC, as well as procedures designed to

30

further the foregoing purposes. In addition, the Insider Trading Policy requires the Company to comply with applicable laws and regulations relating to trading in its securities. A copy of the Company's Insider Trading Policy is filed with this Annual Report on Form 10-K as Exhibit 19.

Item 11. Executive Compensation.

Pursuant to General Instruction G(3) to Form 10-K, the information required by this Item is incorporated herein by reference to:

(i)the information under the caption "Executive Compensation and Related Matters" in the Company's definitive Proxy Statement for its 2025 Annual Meeting of Shareholders to be filed pursuant to Regulation 14A; and

(ii)the information under the caption "Corporate Governance and Board Matters--Director Compensation" in the Company's definitive Proxy Statement for its 2025 Annual Meeting of Shareholders to be filed pursuant to Regulation 14A.

Item 12. Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters.

Pursuant to General Instruction G(3) to Form 10-K, the information required by this Item, other than that presented below, is incorporated herein by reference to the information under the caption "Ownership of Common Stock" in the Company's definitive Proxy Statement for its 2025 Annual Meeting of Shareholders to be filed pursuant to Regulation 14A.

Securities Authorized For Issuance Under Equity Compensation Plans

Information pertaining to equity compensation plans is contained in "Part II - Item 8. Financial Statements and Supplementary Data - Note 13 - "Share-based Compensation - Equity-Based Compensation Plan." of the Company's 2024 Annual report and are incorporated herein by reference.

Item 13. Certain Relationships and Related Transactions, and Director Independence.

Pursuant to General Instruction G(3) to Form 10-K, the information required by this Item is incorporated herein by reference to:

(i)the information under the caption "Related Party Transactions" in the Company's definitive Proxy Statement for its 2025 Annual Meeting of Shareholders to be filed pursuant to Regulation 14A;

(ii)the information under the caption "Item 1: Election of Directors--What is the structure of our board and how often are directors elected?" in the Company's definitive Proxy Statement for its 2025 Annual Meeting of Shareholders to be filed pursuant to Regulation 14A; and

(iii)the information under the caption "Corporate Governance and Board Matters--Committees of the Board" in the Company's definitive Proxy Statement for its 2025 Annual Meeting of Shareholders to be filed pursuant to Regulation 14A.

Item 14. Principal Accountant Fees and Services.

Pursuant to General Instruction G(3) to Form 10-K, the information required by this Item is incorporated herein by reference to the information under the caption "Independent Registered Public Accounting Firm Fees and Services" in the Company's definitive Proxy Statement for its 2025 Annual Meeting of Shareholders to be filed pursuant to Regulation 14A.

PART IV

31

Item 15. Exhibits and, Financial Statement Schedules.

(a)Exhibits, Financial Statements and Financial Statement Schedules:

1.Financial Statements:

The following consolidated financial statements of the Company and reports of the Company's independent registered public accounting firm, included in the Company's 2024 Annual Report to Shareholders (included as Exhibit 13 hereto) under the caption "Consolidated Financial Statements", are incorporated herein by reference:

Report of Independent Registered Public Accounting Firm.

Auditor Name: Forvis Mazars, LLP

Auditor Location: Kansas City, MO

Auditor Firm ID: 686

Consolidated Balance Sheets as of December 31, 2024 and 2023.

Consolidated Statements of Income for the years ended December 31, 2024, 2023, and 2022.

Consolidated Statements of Comprehensive Income for the years ended December 31, 2024, 2023, and 2022.

Consolidated Statements of Stockholders' Equity for the years ended December 31, 2024, 2023, and 2022.

Consolidated Statements of Cash Flows for the years ended December 31, 2024, 2023, and 2022.

Notes to the Consolidated Financial Statements.

2.Financial Statement Schedules:

Financial statement schedules have been omitted because they either are not required or are not applicable or because equivalent information has been included in the financial statements, the notes thereto or elsewhere herein.

3.Exhibits:

Exhibit No. Description

32

Exhibit No. Description

23.1 Consent of Independent Registered Public Accounting Firm.

23.2 Consent of Independent Registered Public Accounting Firm.

101.SCH Inline XBRL Taxonomy Extension Schema Document.

33

Exhibit No. Description

101.CAL Inline XBRL Taxonomy Extension Calculation Linkbase Document.

101.DEF Inline XBRL Taxonomy Extension Definition Linkbase Document.

101.LAB Inline XBRL Taxonomy Extension Label Linkbase Document.

101.PRE Inline XBRL Taxonomy Extension Presentation Linkbase Document.

____________________________

*Management contracts or compensatory plans or arrangements required to be identified by Item 15(a).

(b)Exhibits.

See exhibits identified above under Item 15(a)3.

(c)Financial Statement Schedules.

See financial statement schedules identified above under Item 15(a)2, if any.

Item 16. Form 10-K Summary.

None.

34

SIGNATURES

Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized.

HAWTHORN BANCSHARES, INC.

Dated: March 17, 2025 By /s/ Brent M. Giles

Brent M. Giles, Chief Executive Officer (Principal Executive Officer)

KNOW ALL PERSONS BY THESE PRESENTS, that each person whose signature appears below constitutes and appoints Brent M. Giles and Chris E. Hafner, or either of them, his attorneys-in-fact, for such person in any and all capacities, to sign any amendments to this report and to file the same, with exhibits thereto, and other documents in connection therewith, with the Securities and Exchange Commission, hereby ratifying and confirming all that either of said attorneys-in-fact, or substitute or substitutes, may do or cause to be done by virtue hereof.

Pursuant to the requirements of the Securities Exchange Act of 1934, this report has been signed below by the following persons on behalf of the registrant and in the capacities and on the dates indicated.

35

Date Signature and Title

March 17, 2025 /s/ Brent M. Giles

March 17, 2025 /s/ Chris E. Hafner

Chris E. Hafner, Chief Financial Officer

(Principal Financial Officer and Principal Accounting Officer)

March 17, 2025 /s/ Gregg A. Bexten

Gregg A. Bexten, President, Director

March 17, 2025 /s/ Kathleen L. Bruegenhemke

Kathleen L. Bruegenhemke, Director

March 17, 2025 /s/ David T. Turner

David T. Turner, Chairman, Director

March 17, 2025 /s/ Frank E. Burkhead

Frank E. Burkhead, Director

March 17, 2025 /s/ Philip D. Freeman

Philip D. Freeman, Director

March 17, 2025 /s/ Kevin L. Riley

Kevin L. Riley, Director

March 17, 2025 /s/ Gus S. (Jack) Wetzel III

Gus S. (Jack) Wetzel III, Director

March 17, 2025 /s/ Shawna M. Hettinger

Shawna M. Hettinger, Director

March 17, 2025 /s/ Jonathan L. States

Jonathan L. States, Director

March 17, 2025 /s/ Douglas T. Eden

Douglas T. Eden, Director

March 17, 2025 /s/ Jonathan D. Holtaway

Jonathan D. Holtaway, Director

36