Hawthorn Bancshares, Inc. HWBK US Equity☆

Item 1A. Risk Factors.

Risk Factors

We are identifying important risks and uncertainties that could affect the Company's results of operations, financial condition or business and that could cause them to differ materially from the Company's historical results of operations, financial condition or business, or those contemplated by forward-looking statements made herein or elsewhere, by, or on behalf of, the Company. Factors that could cause or contribute to such differences include, but are not limited to, those factors described below. The risk factors highlighted below are not necessarily the only ones that the Company faces.

Risks Relating to Our Business and Market

Because we primarily serve Central and West Central Missouri, as well as the Kansas City MSA, a decline in the local economic conditions could lower the Company's profitability.

The profitability of the Company is dependent on the profitability of the Bank, which operates out of central and west-central Missouri and extends into the Kansas City MSA. The financial condition of the Bank is affected by slowing or recessionary economic conditions and business activity prevailing in the portion of Missouri in which its operations are located. Although our customers' business and financial interests may extend well beyond our market areas, the financial conditions of both the Company and the Bank would be adversely affected by deterioration in the general economic and real estate climate in our markets.

An increase in unemployment, a decrease in profitability of regional businesses or real estate values, or an increase in interest rates are among the factors that could weaken the local economy. With a weaker local economy:

•customers may not want or need the products and services of the Bank;

•borrowers may be unable to repay their loans;

•the value of the collateral security of the Bank's loans to borrowers may decline;

•the number of loan delinquencies and foreclosures may increase; and

•the overall quality of the Bank's loan portfolio may decline.

Originating mortgage loans and consumer loans are a significant source of profits for the Bank. If individual customers in the local area do not want or need these loans, profits may decrease. Although the Bank could make other investments, the Bank may earn less revenue on these investments than on loans. Additionally, the Bank's losses on loans may increase if borrowers are unable to make payments on their loans.

Interest rate changes may reduce the profitability of the Company and the Bank.

The primary source of earnings for the Bank is net interest income. To be profitable, the Bank has to earn more money in interest and fees on loans and other interest-earning assets than it pays as interest on deposits and other interest-bearing liabilities and as other expenses. If prevailing interest rates decrease, the amount of interest the Bank earns on loans and investment securities may decrease more rapidly than the amount of interest the Bank has to pay on deposits and other interest-bearing liabilities. This would result in a decrease in the profitability of the Company and the Bank.

Changes in the level or structure of interest rates also affect:

•the Bank's ability to originate loans;

•the value of the Bank's loan and securities portfolios;

•the Bank's ability to realize gains from the sale of loans and securities;

•the average life of the Bank's deposits; and

•the Bank's ability to obtain deposits.

Fluctuations in interest rates will ultimately affect both the level of income and expense recorded on a large portion of the Bank's assets and liabilities, and the fair value of all interest-earning assets, other than interest-earning assets that mature in the short term. The Bank's interest rate management strategy is designed to stabilize net interest income and preserve capital over a broad range of interest rate movements by matching the interest rate sensitivity of assets and liabilities. Although the Company believes that the Bank's current mix of loans, mortgage-backed securities, investment securities and deposits is reasonable, significant fluctuations in interest rates may have a negative effect on the profitability of the Bank.

Our business depends on our ability to successfully manage credit risk.

10

The operation of our business requires us to manage credit risk. As a lender, the Bank is exposed to the risk that borrowers will be unable to repay their loans according to their terms, and that the collateral securing repayment of their loans, if any, may not be sufficient to ensure repayment. In addition, there are risks inherent in making any loan, including risks with respect to the period of time over which the loan may be repaid, risks relating to proper loan underwriting, risks resulting from changes in economic and industry conditions and risks inherent in dealing with individual borrowers. In order to successfully manage credit risk, we must, among other things, maintain disciplined and prudent underwriting standards and ensure that our loan officers follow those standards. The weakening of these standards for any reason, such as an attempt to attract higher yielding loans, a lack of discipline or diligence by our employees in underwriting and monitoring loans, the inability of our employees to adequately adapt policies and procedures to address changes in economic or other conditions affecting borrowers (such as the current inflationary environment and elevated interest rates) and the quality of our loan portfolio, may result in loan defaults, foreclosures and additional charge-offs and may necessitate that we significantly increase our allowance for credit losses, each of which could adversely affect our net income. As a result, our inability to successfully manage credit risk could have a material adverse effect on our business, financial condition or results of operations.

The Company's profitability depends on the Bank's asset quality and lending risks.

Success in the banking industry largely depends on the quality of loans and other assets. A significant source of risk for us arises from the possibility that losses will be sustained because borrowers, guarantors and related parties may fail to perform in accordance with the terms of their loans. The Bank's loan officers are actively encouraged to identify deteriorating loans. Loans are also monitored and categorized through an analysis of their payment status. The Bank's failure to timely and accurately monitor the quality of its loans and other assets could have a materially adverse effect on the operations and financial condition of the Company and the Bank. There is a degree of credit risk associated with any lending activity. The Bank attempts to minimize its credit risk through loan diversification. Although the Bank's loan portfolio is varied, with no undue concentration in any one industry, substantially all of the loans in the portfolio have been made to borrowers in central, west central, and southwest Missouri. Therefore, the loan portfolio is susceptible to factors affecting the central, west central, and southwest Missouri area, as well as the Kansas City MSA, and the level of non-performing assets is heavily dependent upon local conditions. There can be no assurance that the level of the Bank's non-performing assets will not increase above current levels. High levels of non-performing assets could have a materially adverse effect on the operations and financial condition of the Company and the Bank.

The provision for probable credit losses may need to be increased.

The Bank makes a provision for credit losses based upon management's estimate of probable losses in the loan portfolio and its consideration of prevailing economic and environmental conditions. The amount of future loan losses is susceptible to changes in economic, operating and other conditions, including changes in interest rates, which may be beyond the Company's control, and these losses may exceed current estimates. We cannot fully predict the amount or timing of losses or whether the loss allowance will be adequate in the future. The Bank may need to increase the provision for credit losses through additional provisions in the future if, among other things, the financial condition of any of its borrowers deteriorates, if its borrower fails to perform its obligations to it, or if real estate values decline. Furthermore, various regulatory agencies, as an integral part of their examination process, periodically review the Bank's loan portfolio, provision for credit losses, and real estate acquired by foreclosure. Such agencies may require the Bank to recognize additions to the provision for credit losses based on their judgments of information available to them at the time of the examination. Any additional provision for probable credit losses, whether required as a result of regulatory review or initiated by the Company itself, may materially alter the financial outlook of the Company and the Bank and may have a material adverse effect on the Company's financial condition and results of operations.

Adverse market conditions in the U.S. economy and the markets in which we operate could adversely impact the Company's business.

Unfavorable or uncertain economic and market conditions, including slowing or recessionary economic conditions, reduced availability of commercial credit, rising inflation, and increasing unemployment may negatively impact the credit performance of commercial and consumer credit, resulting in additional write-downs. Concerns over the stability of the financial markets and the economy may result in decreased lending by financial institutions to their customers and to each other. Market turmoil may lead to increased commercial and consumer deficiencies, lack of customer confidence, increased market volatility and widespread reduction in general business activity. Competition among depository institutions for deposits has increased significantly. Financial institutions may experience decreased access to deposits or borrowings due to unfavorable or uncertain economic and market conditions.

Emerging financial technologies such as digital assets, stablecoins, and distributed ledger systems may reduce the demand for traditional banking services and create new competitive pressures that adversely affect our business.

The rapid development and increasing regulatory acceptance of financial technologies such as digital assets (including cryptocurrencies and tokenized money), stablecoins and distributed ledger technologies ("DLT") could materially alter the

11

financial services sector. These technologies enable near-instantaneous value transfer, programmable money and peer-to-peer settlement mechanisms, many of which may operate outside the traditional banking system.

Large technology companies, fintech platforms and digital asset service providers are increasingly offering products that compete with core banking functions, such as payments, custody, lending and liquidity management. Many of the providers of these emerging financial technology providers are not subject to the same regulatory or capital constraints as depository institutions. The adoption of digital financial infrastructure by governments or central banks, such as central bank digital currencies ("CBDCs"), or by major corporate platforms could accelerate these shifts.

Our ability to compete with larger institutions or well-capitalized technology entrants in developing or integrating emerging financial technologies is limited by our size, risk profile and depository institution regulatory obligations. A failure to adapt to or participate in these emerging ecosystems—either directly or through strategic partnerships—could erode the Bank’s traditional banking functions, reduce the Bank’s share of customer deposits and fee income, and adversely affect the Company’s long-term growth prospects and financial condition.

Recent federal legislation, including the GENIUS Act enacted in July 2025, established new regulatory requirements for payment stablecoins issued by banking organizations and their subsidiaries. Compliance with these requirements involves maintaining adequate asset reserves, extensive reporting obligations, independent audits and increased supervisory oversight. The Company’s potential involvement in issuing or supporting payment stablecoins could expose us to regulatory compliance risks, increased operational costs and evolving legal uncertainties. Additionally, rapid changes in digital asset regulation or adverse regulatory interpretations could adversely affect our business strategies and prospects in this emerging market, which could materially impact our financial condition and results of operations.

Smaller commercial borrowers may have fewer financial resources, which may impair their ability to repay loans.

We provide lending to many small- and medium-sized businesses, which generally have fewer financial resources than larger entities (in terms of capital or borrowing capacity). Accordingly, these businesses may be more vulnerable to economic downturns, often need substantial additional capital to expand or compete, and may experience substantial volatility in operating results, any of which may impair the borrower's ability to repay a loan. If these or other borrowers are harmed by adverse business conditions in the markets in which we operate, it may result in an adverse effect to the business, financial condition and results of operations of the Company or the Bank.

The soundness of other financial institutions could adversely affect us.

The Company's ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services institutions are interrelated as a result of trading, clearing, counterparty or other relationships. We have exposure to many different industries and counterparties, and we routinely execute transactions with counterparties in the financial industry, including brokers and dealers, commercial banks, investment banks, mutual and hedge funds, and other institutional clients. As a result, defaults by, or even rumors or questions about, one or more financial services institutions, or the financial services industry generally, could lead to market-wide liquidity problems and could lead to losses or defaults by us or by other institutions. Many of these transactions expose us to credit risk in the event of default of a counterparty or client. In addition, the Company's credit risk may be exacerbated when the collateral held by us cannot be realized upon or is liquidated at prices not sufficient to recover the full amount of the loan or derivative exposure due us. There is no assurance that any such losses would not materially and adversely affect the Company's results of operations.

The bank failures of Silicon Valley Bank and First Republic Bank in California and Signature Bank in New York during 2023 caused a degree of panic and uncertainty in the investor community and among bank customers generally. Any future bank failures may reduce customer confidence, affect sources of funding and liquidity, increase regulatory requirements and costs, adversely affect financial markets and/or have a negative reputational ramification for the banking industry, including the Company.

Liquidity risk could impair our ability to fund operations and meet our obligations as they become due, and failure to maintain sufficient liquidity could materially adversely affect our growth, business, profitability and financial condition.

Liquidity is essential to our business. Liquidity risk is the potential that we will be unable to meet our obligations as they become due because of an inability to liquidate assets or obtain adequate funding at a reasonable cost, in a timely manner and without adverse conditions or consequences. We require sufficient liquidity to fund asset growth, meet customer loan requests, customer deposit maturities and withdrawals, payments on our debt obligations as they become due and other cash commitments under both normal operating conditions and other unpredictable circumstances, including events causing industry or general financial market stress. Liquidity risk can increase due to a number of factors, including an over-reliance on a particular source of

12

funding or market-wide phenomena such as market dislocation and major disasters. Factors that could detrimentally impact access to liquidity sources include, but are not limited to, a decrease in the level of our business activity as a result of a slowdown in our market, adverse regulatory actions against us, or changes in the liquidity needs of our depositors. Market conditions or other events could also negatively affect the level or cost of funding, affecting our ongoing ability to accommodate liability maturities and deposit withdrawals, meet contractual obligations, and fund asset growth and new business transactions at a reasonable cost, in a timely manner, and without adverse consequences. Our inability to raise funds through deposits, borrowings, the sale of loans, other sources, and our ability to maintain sufficient deposits, could have a substantial negative effect on our business, and could result in the closure of the Bank. Our access to funding sources in amounts adequate to finance our activities or on acceptable terms could be impaired by factors that affect our organization specifically or the financial services industry or economy in general. Any substantial, unexpected, and/or prolonged change in the level or cost of liquidity could impair our ability to fund operations and meet our obligations as they become due and could have a material adverse effect on our business, financial condition and results of operations.

We rely on customer deposits, including brokered deposits, and to a lesser extent on advances from the Federal Home Loan Bank ("FHLB") and federal funds purchased to fund our operations. Although we have historically been able to replace customer deposit withdrawals, maturing deposits, and advances if desired, we may not be able to replace such funds in the future if our financial condition, the financial condition of the FHLB or market conditions were to change. FHLB borrowings and other current sources of liquidity may not be available or, if available, sufficient to provide adequate funding for operations.

Deterioration in the housing market could cause further increases in delinquencies and non-performing assets, including loan charge-offs, and depress the Company's income and growth.

The volume of one-to-four family residential mortgages and home equity lines of credit may decrease during economic downturns as a result of, among other things, a decrease in real estate values, an increase in unemployment, a slowdown in housing price appreciation or increases in interest rates. These factors could reduce earnings and consequently the Company's financial condition because:

•borrowers may not be able to repay their loans;

•the value of the collateral securing loans may decline further;

•the quality of the Company's loan portfolio may decline further; and

•customers may not want or need the Company's products and services.

Any of these scenarios could cause an increase in delinquencies and non-performing assets, require us to charge-off a higher percentage of loans, increase substantially the provision for losses on loans, or make fewer loans, which would reduce income.

The FDIC's changes in the calculation of deposit insurance premiums and ability to levy special assessments could increase the Company's non-interest expense and may reduce its profitability.

Our deposits are insured up to applicable limits by the DIF and are subject to deposit insurance assessments to maintain deposit insurance. As an FDIC-insured institution, we are required to pay quarterly deposit insurance premium assessments to the FDIC. Growth in insured deposits at FDIC-insured financial institutions in recent years caused the ratio of the DIF to total insured deposits to fall below the current statutory minimum, and the FDIC has approved an increase in the base assessment rates to increase the likelihood that the reserve ratio of the DIF reaches the statutory minimum level by the statutory deadline.

The FDIC has the statutory authority to impose special assessments on insured depository institutions in an amount, and for such purposes, as the FDIC may deem necessary. The FDIC issued a final rule in November 2023 to implement a special assessment to recover the significant losses incurred by the FDIC in connection with the 2023 bank failures, but that special assessment did not apply to the Bank.

Although we cannot predict what the insurance assessment rates will be in the future, either a deterioration in our risk-based capital ratios or further adjustments to the base assessment rates could have a material adverse impact on our business, financial condition, results of operations and cash flows. The change in the calculation methodology for deposit insurance premiums and the possible emergency special assessments could increase non-interest expense and may adversely affect the Company's profitability.

We may elect or be compelled to seek additional capital in the future, but that capital may not be available when it is needed.

We are required by regulatory authorities to maintain adequate levels of capital to support operations. In addition, we may elect to raise additional capital to support the growth of the Company's business or to finance acquisitions, if any, or we may elect

13

to raise additional capital for other reasons. Should we elect or be required by regulatory authorities to raise additional capital, we may seek to do so through the issuance of, among other things, common stock or securities convertible into common stock, which could dilute your ownership interest in the Company. Although we remain "well-capitalized", the future cost and availability of capital may be adversely affected by illiquid credit markets, economic conditions and a number of other factors, many of which are outside of the Company's control. Accordingly, we cannot assure you of the ability to raise additional capital if needed or on terms acceptable to us. If we cannot raise additional capital when needed or on terms acceptable to us, it may have a material adverse effect on the Company's financial condition and results of operations.

If we are unable to successfully compete for customers in the Company's market area, the Company's financial condition and results of operations could be adversely affected.

The Bank faces substantial competition in making loans, attracting deposits and providing other financial products and services. The Bank has numerous competitors for customers in its market area. Such competition for loans comes principally from:

•other commercial banks;

•savings banks;

•savings and loan associations;

•mortgage banking companies;

•finance companies; and

•credit unions.

Competition for deposits comes principally from:

•other commercial banks;

•savings banks;

•savings and loan associations;

•credit unions;

•brokerage firms;

•insurance companies; and

•mutual funds, including money market mutual funds and corporate and government securities funds.

Many of these competitors have greater financial resources and name recognition, more locations, more advanced technology and more financial products to offer than the Bank. Competition from larger institutions may increase due to an acceleration of bank mergers and consolidations in Missouri and the rest of the nation. In addition, the Gramm-Leach-Bliley Act removes many of the remaining restrictions in federal banking law against cross-ownership between banks and other financial institutions, such as insurance companies and securities firms. The law will likely further increase the number and financial strength of companies that compete directly with the Bank. In addition, competition from emerging financial technology companies, including crypto currencies, stable coins and other digital assets, may also increase if current adoption and usage trends continue.

The profitability of the Bank depends on its continued ability to attract new customers and compete in its service areas. Increased competition in our markets from new competitors, as well as the expanding operations of existing competitors, may result in:

•interest rate changes to various types of accounts;

•a decrease in the amounts of the Bank's loans and deposits;

•reduced spreads between loan rates and deposit rates; and

•loan terms that are less favorable to the Bank.

Any of these results could have a material adverse impact on the Bank's market share of deposits and loans in the Bank's service areas. If the Bank is unable to successfully compete, its financial condition and results of operations will be adversely affected.

We face strong competition from financial service companies and other companies that offer banking and wealth management services, which could adversely affect our business.

Many competitors offer the same, or a wider variety of, banking and wealth management services within the Company’s market areas. These competitors include national banks, regional banks and other community banks. The Company also faces

14

competition from many other types of financial institutions, including savings and loan institutions, finance companies, brokerage firms, insurance companies, credit unions, mortgage banks and online lenders, and other financial intermediaries. In addition, a number of out-of-state financial intermediaries have entered the Company’s primary market areas. Also, as discussed above, technology and other changes have lowered barriers to entry and made it possible for non-banks, or financial technology companies, to offer products and services traditionally provided by banks. We may not be able to compete successfully against current and future competitors. If we are unable to attract and retain banking and wealth management customers, we may be unable to grow our loan and deposit portfolios or our wealth management commissions, which could adversely affect our business, results of operations and financial condition.

Our wealth management fees may decrease as a result of poor investment performance, in either relative or absolute terms, which could decrease our revenues and net earnings.

The Company’s wealth management business derives a significant amount of its revenues from investment management fees based on assets under management. The Company’s ability to maintain or increase assets under management is subject to a number of factors, including investors’ perception of the Company’s past performance, in either relative or absolute terms, general market and economic conditions, and competition from other investment management firms or substitutes. A decline in the fair value of the assets under management would decrease the Company’s trust and wealth management fee income.

Investment performance is one of the most important factors in retaining existing clients and competing for new wealth management clients. Poor investment performance could reduce the Company’s revenues and impede the growth of the Company’s wealth management business. For example, existing clients may withdraw funds from the Company’s wealth management business in favor of better performing products or firms; asset-based management fees could decline from a decrease in assets under management; the Company’s ability to attract funds from existing and new clients might diminish; and the Company’s portfolio managers may depart, to join a competitor or otherwise.

Even when market conditions are generally favorable, the Company’s investment performance may be adversely affected by the investment style of its portfolio managers and the particular investments that they make or recommend. Ultimately, the Company may not be able to compete successfully against current and future competitors. If the Company is unable to attract and retain banking and wealth management customers, it may be unable to grow its loan and deposit portfolios or its wealth management commissions, which could adversely affect its business, results of operations and financial condition.

We may experience difficulties in managing growth and in effectively integrating newly acquired companies.

As part of the Company's general strategy, it may continue to acquire banks and businesses that it believes provide a strategic fit with its business. To the extent that the Company does grow, there can be no assurances that we will be able to adequately and profitably manage such growth. Acquiring other banks and businesses will involve risks commonly associated with acquisitions, including:

•potential exposure to liabilities of the banks and businesses acquired;

•difficulty and expense of integrating the operations and personnel of the banks and businesses acquired;

•difficulty and expense of instituting the necessary systems and procedures, including accounting and financial reporting systems, to manage the combined enterprises on a profitable basis;

•potential disruption to existing business and operations;

•potential diversion of the time and attention of management; and

•impairment of relationships with and the possible loss of key employees and customers of the banks and businesses acquired.

The success of the Company's internal growth strategy will depend primarily on the ability of the Bank to generate an increasing level of loans and deposits at acceptable risk levels and on acceptable terms without significant increases in non-interest expenses relative to revenues generated. There is no assurance that we will be successful in implementing the Company's internal growth strategy.

The Bank is a community bank and our ability to maintain the Bank's reputation is critical to the success of our business and the failure to do so could materially adversely affect our performance.

The Bank is a community bank, and its reputation is one of the most valuable components of our business. As such, we strive to conduct our business in a manner that enhances our reputation. This is done, in part, by recruiting, hiring and retaining employees who share our core values of being an integral part of the communities we serve, delivering superior service to our customers and caring about our customers and associates. However, employee error or employee and customer misconduct could subject us to financial losses or regulatory sanctions and seriously harm our reputation. Misconduct by our employees could

15

include hiding unauthorized activities from us, improper or unauthorized activities on behalf of our clients or improper use of confidential information. It is not always possible to prevent employee error or misconduct, and the precautions we take to prevent and detect this activity may not be effective in all cases. Because the nature of the financial services business involves a high volume of transactions, certain errors may be repeated or compounded before they are discovered and successfully rectified. If our reputation is negatively affected, by the actions of our employees or otherwise, our business and, therefore, our operating results could be materially adversely affected.

Fraudulent activity could damage our reputation, disrupt our business, increase our costs and cause losses.

Financial institutions are inherently exposed to operational risk in the form of theft and other fraudulent activity by employees, clients and other third parties targeting us and our customers or data. Such activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering, and other dishonest acts. Information security breaches and cybersecurity-related incidents may include fraudulent or unauthorized access to systems used by us, our customers or third-party vendors, denial or degradation of service attacks, and malware or other cyberattacks. Although the Company devotes substantial resources to maintaining effective policies and internal controls to identify and prevent such incidents, given the increasing sophistication of possible perpetrators, the Company or the Bank may experience financial losses or reputational harm as a result of fraud. In addition, we may be required to make significant capital expenditures in order to modify and enhance our protective measures or to investigate and remediate fraudulent activity. Although we have not experienced any material business or reputational harm as a result of fraudulent activities in the past, the occurrence of fraudulent activity could damage our reputation, disrupt our business, increase our costs and cause losses in the future.

The Company's success largely depends on the efforts of its executive officers.

The success of the Company and the Bank has been largely dependent on the efforts of a limited number of executive officers and key employees. These individuals are expected to continue to perform their services. However, the loss of the services of any of these individuals could have a materially adverse effect on the Company and the Bank.

If we fail to maintain an effective system of internal control over financial reporting, we may not be able to accurately report our financial results or prevent fraud, and, as a result, investors and depositors could lose confidence in our financial reporting, which could adversely affect our business, the trading price of our stock, and our ability to attract additional deposits.

We are required to include in our annual reports filed with the SEC a report from our management regarding internal control over financial reporting. As a result, we documented and evaluated our internal control over financial reporting in order to satisfy the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 and SEC rules and regulations, which require an annual management report on our internal control over financial reporting, including, among other matters, management's assessment of the effectiveness of internal control over financial reporting. Failure or circumvention of our system of internal control could have an adverse effect on our business, profitability, and financial condition, and could result in regulatory actions and loss of investor confidence. Additionally, if we fail to identify and correct any significant deficiencies or material weaknesses in the design or operating effectiveness of our internal control over financial reporting or fail to prevent fraud, current and potential stockholders and depositors could lose confidence in our financial reporting, which could adversely affect our business, financial condition and results of operations, the trading price of our stock and our ability to attract additional deposits.

Severe weather, natural disasters, pandemics, and other external events could significantly impact our business.

Severe weather, including tornadoes, droughts, hailstorms and other natural disasters, pandemics, such as the outbreak of COVID-19, acts of war or terrorism and other adverse external events could have a significant impact on our ability to conduct business. Such events could affect the stability of our deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, result in loss of revenue or cause us to incur additional expenses. Operations in our markets could be disrupted by both the evacuation of large portions of the population as well as damage or lack of access to our banking and operation facilities. Geopolitical relations and events, including international trade relations and global military conflicts, may increase volatility in commodity and energy prices, create supply chain issues and cause instability in financial markets, which may adversely affect us and our clients. Although management has established business continuity plans and procedures, the occurrence of any such events could have a material adverse effect on our business, financial condition and results of operations.

Climate change and responses to climate change may adversely impact our business, financial condition and results of operations.

Concerns over the long-term impacts of climate change have led and may continue to lead to governmental efforts to mitigate those impacts. Consumers and businesses are also changing their behavior and business preferences as a result of these concerns. New governmental regulations or guidance relating to climate change, as well as changes in consumers' and businesses' behaviors

16

and business preferences, may cause us and our customers to experience cost increases, asset value reductions, operating process changes and delays in completion of projects. To the extent that climate change and responses to climate change negatively impact the businesses and financial condition of our customers, the credit risk associated with loans and other credit exposures to those customers may increase. In addition, weather events related to climate change could adversely affect our business and the businesses of our customers.

Risks Relating to Our Regulatory Environment

We may be adversely affected by changes in laws and regulations affecting the financial services industry.

Banks and bank holding companies such as the Company are subject to regulation by both federal and state bank regulatory agencies. The regulations, which are designed to protect bank customers and promote certain social policies, include limitations on the operations of banks and bank holding companies, such as minimum capital requirements and restrictions on dividend payments. The regulatory authorities have extensive discretion in connection with their supervision and enforcement activities and their examination policies, including the imposition of restrictions on the operation of a bank, the classification of assets by an institution and requiring an increase in a bank's allowance for credit losses. These regulations are not necessarily designed to maximize the profitability of banking institutions. Future changes in the banking laws and regulations and tax and accounting rules applicable to financial institutions could have a material adverse effect on the operations and financial condition of the Company and the Bank.

As a financial holding company, we are subject to extensive regulation and supervision and undergo periodic examinations by our regulators, who have extensive discretion and authority to prevent or remedy unsafe or unsound practices or violations of law by banks and financial holding companies. Failure to comply with applicable laws, regulations or policies could result in sanctions by regulatory agencies, civil monetary penalties and/or damage to our reputation, which could have a material adverse effect on us. Although we have policies and procedures designed to mitigate the risk of any such violations, there can be no assurance that such violations will not occur.

Current or proposed regulatory or legislative changes to laws applicable to the financial industry may impact the profitability of our business activities and may change certain of our business practices, including our ability to offer new products, obtain financing, attract deposits, make loans and achieve satisfactory interest spreads, and could expose us to additional costs, including increased compliance costs. In addition, political developments, including the possible implementation of policies proposed by the current presidential administration, including tariffs, mass deportations and tax or financial regulations or the appointment of new personnel in regulatory agencies, add uncertainty to the implementation, scope and timing of regulatory reforms. These changes may also require us to invest significant management attention and resources to make any necessary changes to operations in order to comply and could therefore materially and adversely affect our business, financial condition and results of operations.

The Federal Reserve may require the Company to commit capital resources to support the Bank.

As a matter of policy, the Federal Reserve expects a bank holding company to act as a source of financial and managerial strength to its subsidiary banks. The Federal Reserve may charge the bank holding company with engaging in unsafe and unsound practices for failure to adequately commit resources to a subsidiary bank. Accordingly, we may be required to make capital injections into a troubled subsidiary bank, even if such contribution creates a detriment to the Company or its stockholders. If we do not have sufficient resources on hand to fund the capital injection, we may be required to borrow funds or raise capital. Any such loans are subordinate in right of payment to deposits and to certain indebtedness of the subsidiary bank. In the event of bankruptcy of the bank holding company, claims based upon any commitments to fund capital injections are entitled to a priority of payment over claims made by general unsecured creditors, including holders of indebtedness. Thus, any borrowings incurred by the Company to make required capital injections to the Bank are difficult and expensive, and will adversely impact our financial condition, results of operations and future prospects.

The short-term and long-term impact of the changing regulatory capital requirements and new capital rules is uncertain.

The Company and the Bank are subject to various regulatory capital requirements. The federal banking agencies have substantially amended the regulatory capital rules applicable to us and the Bank in the past and may do so again in the future. The amendments implement the Basel III Rules and changes required by the Dodd-Frank Act. The amended rules include new minimum risk-based capital and leverage ratios, which became effective in January 2015 (with certain phase-ins), and refined the definition of what constitutes "capital" for purposes of calculating those ratios.

The application of more stringent capital requirements to us and the Bank could, among other things, result in lower returns on invested capital, require the raising of additional capital, and result in regulatory actions if we were to be unable to comply with such requirements. Implementation of changes to asset risk weightings for risk-based capital calculations, items

17

included or deducted in calculating regulatory capital and/or additional capital conservation buffers could result in management modifying its business strategy and could further limit the Company's ability to make distributions, including paying out dividends or buying back shares.

Non-compliance with the USA PATRIOT Act, Bank Secrecy Act, Real Estate Settlement Procedures Act, Truth-in-Lending Act, Community Reinvestment Act, Fair Lending Laws or other laws and regulations could result in fines or sanctions and curtail expansion opportunities.

Financial institutions are required under the USA PATRIOT and Bank Secrecy Acts to develop programs to prevent financial institutions from being used for money-laundering and terrorist activities. Financial institutions are also obligated to file suspicious activity reports with the U.S. Treasury Department's Office of Financial Crimes Enforcement Network if such activities are detected. These rules also require financial institutions to establish procedures for identifying and verifying the identity of customers seeking to open new financial accounts. Failure or the inability to comply with the USA PATRIOT Act and Bank Secrecy Act statutes and regulations could result in fines or penalties, curtailment of expansion opportunities, enforcement actions, intervention or sanctions by regulators and costly litigation or expensive additional controls and systems. During the last few years, several banking institutions have received large fines for non-compliance with these laws and regulations. In addition, the U.S. Government imposed and will continue to expand laws and regulations relating to residential and consumer lending activities that create significant new compliance burdens and financial risks.

Regulations relating to privacy, information security and data protection could increase our costs, affect or limit how we collect and use personal information and adversely affect our business opportunities.

We are subject to various privacy, information security and data protection laws, including requirements concerning security breach notification, and we could be negatively impacted by these laws. For example, our business is subject to the Gramm-Leach-Bliley Act which, among other things: (i) imposes certain limitations on our ability to share non-public personal information about our clients with non-affiliated third parties; (ii) requires that we provide certain disclosures to clients about our information collection, sharing and security practices and afford clients the right to "opt out" of any information sharing by us with non-affiliated third parties (with certain exceptions); and (iii) requires that we develop, implement and maintain a written comprehensive information security program containing safeguards that are appropriate based on our size and complexity, the nature and scope of our activities and the sensitivity of client information we process, as well as plans for responding to data security breaches. Many state and federal banking regulators, states and foreign countries have also enacted data security breach notification requirements with varying levels of individual, consumer, regulatory or law enforcement notifications in certain circumstances in the event of a security breach. Moreover, legislators and regulators in the U.S. and other countries are increasingly adopting or revising privacy, information security and data protection laws that potentially could have a significant impact on our current and planned privacy, data protection and information security-related practices, our collection, use, sharing, retention and safeguarding of client or employee information, and some of our current or planned business activities. This could also increase our costs of compliance and business operations and could reduce income from certain business initiatives. This includes increased privacy-related enforcement activity at the federal level by the Federal Trade Commission, as well as at the state level.

Compliance with any current or future laws and regulations noted above (including those regarding security breach notification) could result in higher compliance costs and could restrict our ability to provide certain products and services, which could have a material adverse effect on our business, financial conditions or results of operations. Our failure to comply with any such laws could result in potentially significant regulatory or governmental investigations or actions, litigation, fines, sanctions and damage to our reputation, which could have a material adverse effect on our business, financial condition or results of operations.

The Company is subject to a number of federal and state laws and regulations requiring notifications and disclosures regarding certain cybersecurity incidents, which could be triggered as a result of incidents discussed above. In addition, the Company must consider and address cybersecurity considerations as part of its risk management processes. See Item 1C. Cybersecurity for additional information.

We are subject to numerous laws designed to protect consumers, including the Community Reinvestment Act and fair lending laws, and failure to comply with these laws could lead to a wide variety of sanctions.

The Community Reinvestment Act, the Equal Credit Opportunity Act, the Fair Housing Act and other fair lending laws and regulations impose nondiscriminatory lending requirements on financial institutions. The U.S. Department of Justice and other federal agencies are responsible for enforcing these laws and regulations. A successful regulatory challenge to an institution's performance under the Community Reinvestment Act or fair lending laws and regulations could result in a wide variety of sanctions, including damages and civil money penalties, injunctive relief, restrictions on mergers and acquisitions activity,

18

restrictions on expansion and restrictions on entering new business lines. Private parties may also have the ability to challenge an institution's performance under fair lending laws in private class action litigation. Such actions could have a material adverse effect on our business, financial condition, results of operations and future prospects. We may be subject to liability for potential violations of predatory lending laws, which could adversely impact our results of operations, financial condition and business.

We are subject to a number of other laws and regulations, which may adversely affect the operation of our business and increase our costs.

We are extensively regulated under U.S. federal and state law and are subject to a number of laws and regulations in addition to banking laws and regulations, including securities, insurance and tax laws and regulations. As a company whose stock is publicly traded, we are subject to various federal and state securities laws, including the Securities Act of 1933, as amended, the Exchange Act and the Sarbanes-Oxley Act of 2002, and we file periodic reports with the Securities and Exchange Commission. In addition, because our common stock is listed with The Nasdaq Stock Market LLC, we are subject to the listing rules of that exchange. The Company and its subsidiaries are subject to federal and state income taxes and Missouri franchise taxes and are potentially subject to audits by the Internal Revenue Service and state income and franchise tax examinations by the Missouri Department of Revenue. Any failure by us to comply with any laws or regulations, any change in such laws or regulations or the position of any regulatory agency with respect thereto, or any adverse result in any regulatory investigation or examination, including any tax audit or examination, could adversely affect our business, financial condition and results of operations.

Technology and Vendor Risks

We are subject to security and operational risks relating to our use of technology that could damage our reputation and our business.

We rely heavily on communications and information systems to conduct our business. Furthermore, we have access to large amounts of confidential financial information and control substantial financial assets, including those belonging to our customers, to whom we offer remote access, and we regularly transfer substantial financial assets by electronic means. Our operations are dependent upon our ability to protect our computer equipment against damage from physical theft, fire, power loss, telecommunications failure or a similar catastrophic event, as well as from security breaches, denial of service attacks, viruses, worms and other disruptive problems caused by hackers. Any failure, interruption or breach in security of our systems could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on our financial condition and results of operations. Although we intend to continue to implement security technology and establish operational procedures to prevent such damage, our security measures may not be successful.

In addition, advances in computer capabilities, new discoveries in the field of cryptography or other developments could result in a compromise or breach of the algorithms we and our third-party service providers use to encrypt and protect customer transaction data. A failure of such security measures could have a material adverse effect on our financial condition and results of operations. We also face the risk of operational disruption, failure, termination or capacity constraints caused by third parties that facilitate our business activities by providing technology such as software applications, as well as financial intermediaries. Such parties could also be the source of an attack on, or breach of, our operational systems, data or infrastructure.

We also face the potential risk of loss due to fraud, including commercial checking account fraud, automated teller machine ("ATM") skimming and trapping, write-offs necessitated by debit card fraud, and other forms of online banking fraud, which are becoming more sophisticated and present new challenges as mobile banking increases, as well as employee fraud. Employee errors could also subject us to financial claims for negligence. We maintain a system of internal controls and insurance coverage to mitigate against operational risks, including data processing system failures and errors and customer or employee fraud. Should our internal controls fail to prevent or detect an occurrence, and if any resulting loss is not insured or exceeds applicable insurance limits, such failure could have a material adverse effect on our business, financial condition and results of operations.

The operation of our business, including customer interaction, is increasingly done via electronic means, and this has increased our risks related to cybersecurity.

We rely on the successful and uninterrupted functioning of our information technology and telecommunications systems to conduct our business. This includes internally developed systems, the systems of third-party service providers, and digital and mobile technologies. Any failure, interruption or breach in security of these systems could result in failures or disruptions in our customer relationship management, general ledger, deposit, loan and other systems, and could damage our reputation, result in loss of customer business, subject us to regulatory scrutiny, or expose us to civil litigation and possible financial liability. We are exposed to the risk of cyber-attacks in the normal course of business, which can result from deliberate attacks or unintentional events. We have observed an increased level of attention in the industry focused on cyber-attacks that include, but are not limited

19

to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data, or causing operational disruption. Cyber-attacks may also be carried out in a manner that does not require gaining unauthorized access, such as by causing denial-of-service attacks on websites. Cyber-attacks may be carried out by third parties or insiders using techniques that range from highly sophisticated efforts to electronically circumvent network security or overwhelm websites to more traditional intelligence gathering and social engineering aimed at obtaining information necessary to gain access. The objectives of cyber-attacks vary widely and can include theft of financial assets, intellectual property, or other sensitive information, including the information belonging to our banking customers. Cyber-attacks may also be directed at disrupting our operations.

We may incur substantial costs and suffer other negative consequences if we fall victim to successful cyber-attacks. Such negative consequences could include remediation costs that may include liability for stolen assets or information and repairing system damage that may have been caused; increased cybersecurity protection costs that may include organizational changes, deploying additional personnel and protection technologies, training employees, and engaging third party experts and consultants; lost revenues resulting from unauthorized use of proprietary information or the failure to retain or attract customers following an attack; litigation; and reputational damage adversely affecting customer or investor confidence.

We continually encounter technological change, and we cannot predict how changes in technology will affect our business.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology driven by products and services, which include developments in:

•telecommunications;

•data processing;

•automation;

•internet-based banking;

•telebanking; and

•debit cards and so-called "smart cards."

The effective use of technology increases efficiency and enables financial institutions to better serve customers and to reduce costs. Our future success depends, in part, upon our ability to address the needs of our customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology driven products and services or be successful in marketing these products and services to our customers. Failure to successfully keep pace with technological change affecting the financial services industry could have a material adverse impact on our business and, in turn, our financial condition and results of operations.

The development and use of artificial intelligence presents risks and challenges that may adversely impact our business.

The Company or its third-party (or fourth party) vendors, clients or counterparties may develop or incorporate artificial intelligence ("AI") technology in certain business processes, services, or products. The development and use of AI presents risks and challenges to the Company’s business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving, both in the U.S. and internationally, and includes regulatory schemes targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment, and other laws applicable to the use of AI. These evolving laws and regulations could require changes in the Company’s implementation of AI technology and increase the Company’s compliance costs and the risk of non-compliance. AI models, particularly generative AI models, may produce output or take action that is incorrect, that reflects biases included in the data on which they are trained, that results in the release of private, confidential, or proprietary information, that infringes on the intellectual property rights of others, or that is otherwise harmful. In addition, the complexity of many AI models makes it difficult to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output,eliminating bias, and complying with regulations that require documentation or explanation of the basis on which decisions are made. Further, the Company may rely on AI models developed by third parties, and, to that extent, would be dependent in part on the manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which the Company may have limited visibility. Any of these risks could expose the Company to liability or adverse legal or regulatory consequences and harm the Company’s reputation and the public perception of its business or the effectiveness of its security measures.

20

We rely on others to provide key components of our business infrastructure.

Third-party vendors provide key components of our business infrastructure such as internet connections, network access and core application processing. While we have selected these third-party vendors carefully, we do not control their actions. If these third-party vendors experience financial, operational or technological difficulties, perform their services poorly or terminate their services, and we are unable to replace them with other service providers, our operations could be interrupted. Any problems caused by these third parties, including as a result of their not providing us their services for any reason or their performing their services poorly, could adversely affect our ability to deliver products and services to our customers or otherwise conduct our business efficiently and effectively. If a service interruption were to continue for a significant period of time, our business, financial condition and results of operations could be adversely affected, perhaps materially. Replacing these third-party vendors could also entail significant delay and additional expenses.

Risks Related to Our Common Stock

The price of our common stock could fluctuate significantly, and this could make it difficult for you to resell shares of our common stock at times or at prices you find attractive.

The stock market and, in particular, the market for financial institution stocks, has experienced significant volatility during the recent changes in economic and industry conditions. In some cases, the markets have produced downward pressure on stock prices for certain issuers without regard to those issuers' underlying financial strength. As a result, the trading volume in our common stock could fluctuate more than usual and cause significant price variations to occur. This could make it difficult for you to resell shares of our common stock at times or at prices you find attractive.

The trading price of the shares of our common stock will depend on many factors that could change from time to time and could be beyond our control. Among the factors that could affect our stock price are those identified under the heading "Forward-Looking Statements" in Item 7, Management's Discussion and Analysis of Financial Condition and Results of Operations, of this report and as follows:

•actual or anticipated quarterly fluctuations in our operating results and financial condition;

•changes in financial estimates or publication of research reports and recommendations by financial analysts or actions taken by rating agencies with respect to our common stock or those of other financial institutions;

•failure to meet analysts' revenue or earnings estimates;

•speculation in the press or investment community generally or relating to our reputation, our market area, our competitors or the financial services industry in general;

•strategic actions by us or our competitors, such as acquisitions, restructurings, dispositions or financings;

•actions by our current stockholders, including sales of common stock by existing stockholders and/or directors and executive officers;

•fluctuations in the stock price and operating results of our competitors;

•future sales of our equity, equity-related or debt securities;

•changes in the frequency or amount of dividends or share repurchases;

•proposed or adopted regulatory changes or developments;

•investigations, proceedings or litigation that involve or affect us;

•trading activities in our common stock, including short-selling;

•domestic and local economic factors unrelated to our performance; and

•general market conditions and, in particular, developments related to market conditions for the financial services industry.

A significant decline in our stock price could result in substantial losses for individual stockholders and could lead to costly and disruptive securities litigation.

The trading volume in our common stock has been low, and the sale of a substantial number of shares of our common stock in the public market could depress the price of our common stock and make it difficult for you to sell your shares.

Our common stock is listed to trade on The Nasdaq Global Select Market but is thinly traded. As a result, you may not be able to sell your shares of common stock on short notice. Additionally, thinly traded stock can be more volatile than stock trading in an active public market. The sale of a substantial number of shares of our common stock at one time could temporarily depress the market price of our common stock, making it difficult for you to sell your shares and impairing our ability to raise capital.

21

Our common stock is not insured by any governmental entity.

Our common stock is not a deposit account or other obligation of any bank and is not insured by the FDIC or any other governmental entity.

Item 1B. Unresolved Staff Comments.

None.

Item 1C. Cybersecurity.

We recognize the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. Our board of directors is actively involved in oversight of the Company’s risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company maintains a cybersecurity and information technology ("IT") risk management program designed toprevent, detect and respond to information security threats, which is fully integrated into the Company’s ERM program.

Our cybersecurity and IT risk management program is based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, as well as the banking-specific framework from the Federal Financial Institution Examination Council’s ("FFIEC’s") Cybersecurity Assessment Tool. The Company’s program is led by our Director of Information Technology and Information Security Officer, whose teams are responsible for leading short-term and long-term enterprise-wide cybersecurity strategy, policy, standards, monitoring, architecture and processes.Our Director of Information Technology and Information Security Officer has over fifteen years of experience in the field of cybersecurity and over a decade of experience leading cybersecurity oversight in the banking industry.

Governance

Although it is management's job to assess and manage our Company's exposure to risk, our board of directors oversees our Company's ERM, including cybersecurity and IT risks and threats, and establishes policies that govern the process. Our board conducts much of its risk oversight activities through our Audit Committee, which works closely with our Chief Risk Officer and Internal Audit Manager.The Audit Committee has primary management responsibility for oversight of operations, technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and cybersecurity risks.Our Audit Committee meets at least quarterly with our Chief Risk Officer, Internal Audit Manager and other members of management to assess, among other things, cyber threats or risks to align the Company for effective cybersecurity risk management and reporting. The Audit Committee receives quarterly reports from our Internal Audit Manager and Director of Information Technology and Information Security Officer on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security program, the emerging threat landscape and key metrics from cybersecurity systems and monitoring. Our Chief Risk Officer provides a presentation on ERM to the full board at least once annually. From time to time our Audit Committee also receives updates between meetings from our Chief Risk Officer, Chief Executive Officer, Chief Financial Officer and other members of management relating to risk oversight matters.

Security event monitoring and detection

Our processes for assessing, identifying, and managing material risks from cybersecurity threats include using a wide range of industry-leading security tools, regularly updating our technology roadmaps, and mandating cybersecurity awareness, business continuity and incident response training for all employees.

Recognizing the complexity and evolving nature of cybersecurity threats, we engage a range of outside experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our cybersecurity and IT risk management systems. Engaging outside vendors enables us to leverage specialized knowledge and insights, ensuring our cybersecurity and IT risk management strategies and processes remain sound. Our collaboration with these third parties includes threat assessments, consultation on security enhancements and regular audits, the results of these threat assessments and audits are reported to the Audit Committee. Strong vendor management and monitoring controls are enforced and require, at a minimum, annual due diligence on critical vendors.

We have implemented a comprehensive Incident Response Program to provide guidance in the event of a cybersecurity incident for contacting authorities and informing key stakeholders to ensure that any non-routine events are properly escalated. The Company participates in cybersecurity incident response exercises to test pre-planned response actions from the Company's plan and to facilitate group discussions regarding the effectiveness of the Company’s cybersecurity incident response strategies

22

and tactics. We use a third-party security information and event management to provide 24x7x365 monitoring of logs, administrator and user actions, network and security appliances, and endpoint agents. Our Director of Information Technology and Information Security Officer actively engages with key vendors, industry participants, as well as other cybersecurity collaboration organizations.

Incident materiality

The Incident Response Program is a component of the Company's Information Security policy and sets forth the severity categories and processes required to assess the impact of a cyber-related incident to the Company. The impact is categorized in one of five severity levels and is expressed in terms of financial loss, strategic objectives, customer, legal and regulatory, reputation, and service interruption. The incident response program includes timely notification of a material cybersecurity incident to the to the appropriate law enforcement, regulatory agencies, Board of Directors and other members of senior management.

Like other financial institutions, the Company experiences malicious cyber activity on an ongoing basis directed at its websites, computer systems, software, networks and users. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware, and denial of service attacks. The Company also experiences large volumes of phishing and other forms of social engineering attempted for the purpose of perpetrating fraud. While, to date, malicious cyber activity, cyberattacks and other information security breaches have not had a material adverse impact on the Company, risk to its systems remains significant. See Item 1A. "Risk Factors" for additional information regarding information technology risks.

Item 2. Properties.

The Company does not own or lease any property. The Company's principal offices are located at 132 East High Street, Jefferson City, Missouri 65101. The table below provides a list of and information about the Bank's facilities as of December 31, 2025.

Location ApproximateSquare Footage Owned or Leased

910 West Buchanan Street, California, MO 2,270 Owned

1400 East Ohio Street, Clinton, MO 13,551 Owned

803 E. Walnut St, Columbia, MO 9,698 Leased (1)

1110 Club Village Drive, Columbia, MO 5,000 Owned

115 South 2nd Street, Drexel, MO 4,000 Owned

100 Plaza Drive, Harrisonville, MO 4,000 Owned

132 East High Street, Jefferson City, MO 34,800 Owned

211 West Dunklin Street, Jefferson City, MO 2,500 Owned

800 Eastland Drive, Jefferson City, MO 4,100 Owned

3701 West Truman Blvd, Jefferson City, MO 21,000 Owned

300 S.W. Longview Blvd, Lee's Summit, MO 11,700 Owned

335 Chestnut, Osceola, MO 1,580 Owned

321 West Battlefield, Springfield, MO 12,500 Owned

1891 Commercial Drive, Warsaw, MO 11,000 Owned

(1)The term of this lease expires in February 2029.

(2)The term of this lease expires in August 2034.

(3)The term of this lease expires in March 2032.

Management believes that the current condition of each of the Bank's facilities is adequate for its business and that such facilities are adequately covered by insurance. Refer to Note 9, "Leases" in the Company's consolidated financial statements, included under the caption "Consolidated Financial Statements" in the Company's 2025 Annual Report to Shareholders (included as Exhibit 13 hereto), incorporated herein by reference.

23

Item 3. Legal Proceedings.

The information required by this Item is set forth in Note 19, "Commitments and Contingencies", in the Company's consolidated financial statements, included under the caption "Notes to the Consolidated Financial Statements" in the Company's 2025 Annual Report to Shareholders (included as Exhibit 13 hereto), incorporated herein by reference.

Item 4. Mine Safety Disclosures.

Not applicable

EXECUTIVE OFFICERS OF THE REGISTRANT

Executive officers of the Company are appointed by the board of directors and serve at the discretion of the board. The following table sets forth certain information with respect to all executive officers of the Company.

Name Age Position

Brent M. Giles 58 Chief Executive Officer and Director

Gregg A. Bexten 58 President and Director

Chris E. Hafner 59 Executive Vice President and Chief Financial Officer

The business experience of the executive officers of the Company for the last five years is as follows:

Brent M. Giles has served as a director and CEO of the Company and of the Bank since May 2023. Mr. Giles served as Chairman, President and Chief Executive Officer of Bank of Blue Valley from July 2021 until he joined the Company, and as President and Chief Executive Officer of Wisconsin Bank & Trust from May 2020 until July 2021. From September 2003 until May 2020, Mr. Giles served as Chairman and Chief Executive Officer of Liberty Bancorp, Inc. and Bank Liberty, where he took the company public. Bank Liberty has been recognized as a "best bank," "best place to work," and "strongest mid-size bank." Prior to 2003, Mr. Giles had several commercial banking roles of increasing responsibility and spent 9 years as an FDIC examiner. Mr. Giles received his bachelor's degree in banking and finance and his MBA from the University of Missouri where he is still involved speaking to graduate banking classes.

Gregg A. Bexten has served as a director and president of the Company and of the Bank since May 2023. From 2014 until May 2023, he served as Regional President of our Central Region. From 1998 until 2014 he served as a commercial lender in our Central Region with titles of Senior Vice President and Vice President and as an Internal Auditor. Prior to joining the Bank, Mr. Bexten served as a commercial lender with another financial institution and as a Commissioned Bank Examiner for the Federal Reserve Bank of St. Louis. Mr. Bexten possesses considerable expertise in overseeing lending, various finance and regulatory compliance aspects of community banking, which he attained through over 30 years of service, first as a bank regulator and then as a dedicated, tenured employee of the Bank.

Chris E. Hafnerhas served as Chief Financial Officer of the Company and of the Bank since October 2023. Mr. Hafner served as an outside banking and business consultant to several entities from December 2022 until he joined the Company and the Bank. Mr. Hafner previously served as Chief Accounting Officer of CrossFirst Bank, the bank subsidiary of CrossFirst Bankshares, Inc., a Nasdaq-listed bank holding company, from February 2016 until November 2022. Prior to that, he served as Chief Financial Officer at Missouri Bank, a privately held bank, from June 2015 until January 2016, and as Chief Risk Officer at Missouri Bank from April 2012 until May 2015. Prior to joining Missouri Bank, he served as Chief Financial Officer at First National Bank of Kansas, a privately held bank, from August 2005 until December 2011 and, prior to that, he served as Assistant Controller at Commerce Bancshares, Inc., a Nasdaq-listed bank holding company, from June 2000 until July 2005. He served in various roles in the audit practice of Forvis Mazars, LLP (formerly BKD LLP) from July 1994 until June 2000. Chris received a Bachelor of Business Administration degree from Iowa State University. He has been previously licensed as a Certified Public Accountant.

Kathleen L. Bruegenhemkehas served as a director of the Company and of the Bank since March 2017. She has served as Executive Vice President of the Company since May 2024 and as Chief Risk Officer of the Company since June 2006. She served as Secretary of the Company from 1997 until 2025. From January 2017 until November 2023, she served as Chief Operating Officer of the Bank. From October 2014 until December 2016, she served as Columbia Market President for the Bank. From January 1992 until November 1997, she served as Internal Auditor of the Bank (or of one of its constituent predecessors). Prior to joining the Bank, Ms. Bruegenhemke served as a Commissioned Bank Examiner for the FDIC. Ms. Bruegenhemke is a certified

24

public accountant and possesses considerable expertise in overseeing various finance, regulatory compliance and risk management aspects of community banking, which she attained through over 30 years of service, first as a bank regulator and then as a dedicated employee of the Bank.

There is no arrangement or understanding between any executive officer and any other person pursuant to which such executive officer was selected as an officer.

25

PART II

Item 5. Market for Registrant's Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities.

Pursuant to General Instruction G(2) to Form 10-K, the information required by this Item, other than that referred to below, is incorporated herein by reference to the information under the caption "Market Price of and Dividends on Equity Securities and Related Matters" in the Company's 2025 Annual Report to Shareholders (included as Exhibit 13 hereto).

We refer you to Item 12 of this report under the caption "Securities Authorized For Issuance Under Equity Compensation Plans" for certain equity plan information.

The Company's Purchases of Equity Securities

The following table summarizes the purchases made by or on behalf of the Company or certain affiliated purchasers of shares of the Company's common stock during the three months ended December 31, 2025:

(1) On June 5, 2025, the Company announced that its Board of Directors approved a new common stock repurchase program under which the Company may repurchase up to $10.0 million of its common stock, which replaced the Company’s prior common stock repurchase program. Pursuant to the repurchase program, management is given discretion to determine the number and pricing of the shares to be repurchased, as well as the timing of any such repurchases. The timing and total amount of stock repurchases will depend on market and other conditions and may be made from time to time in open market purchases or privately negotiated transactions. The program has no termination date, may be suspended or discontinued at any time and does not obligate the Company to acquire any amount of common stock. As of December 31, 2025, $8.4 million remains available for share repurchases pursuant to the plan.

Recent Issuance of Securities

None.

Item 6. [Reserved].

Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operation.

Pursuant to General Instruction G(2) to Form 10-K, the information required by this Item is incorporated herein by reference to the information under the caption "Management's Discussion and Analysis of Financial Condition and Results of Operations" in the Company's 2025 Annual Report to Shareholders (included as Exhibit 13 hereto).

Forward-Looking Statements

This report, including information included or incorporated by reference in this report, contains certain forward-looking statements with respect to the financial condition, results of operations, plans, objectives, strategy, future performance and business of the Company and its subsidiaries, including, without limitation:

•statements that are not historical in nature, and

•statements preceded by, followed by or that include the words "believes," "expects," "may," "will," "should," "could," "anticipates," "estimates," "intends" or similar expressions.

26

Forward-looking statements are not guarantees of future performance or results. They involve risks, uncertainties and assumptions. Actual results may differ materially from those contemplated by the forward-looking statements due to, among others, the following factors:

•competitive pressures among financial services companies may increase significantly;

•changes in the interest rate environment may reduce interest margins;

•general economic conditions, either nationally or in the communities we serve, may be less favorable than expected and may adversely affect the quality of the Company's loans and other assets;

•increases in non-performing assets in the Company's loan portfolios and adverse economic conditions may necessitate increases to the provisions for credit losses;

•costs or difficulties related to the integration of the business of the Company and its acquisition targets may be greater than expected;

•legislative, regulatory, or tax law changes may adversely affect the business in which the Company and its subsidiaries are engaged;

•changes may occur in the securities markets;

•credit and market risks relating to increasing inflation;

•economic or other disruptions caused by acts of terrorism, war or other conflicts, changes in geopolitical conditions, natural disasters, such as hurricanes, wild fires, freezes, flooding and other man-made disasters, such as oil spills or power outages, health emergencies, epidemics or pandemics, climate changes or other catastrophic events;

•changes in the level and direction of loan delinquencies and write-offs and changes in estimates of the adequacy of the allowance for credit losses; and

•technological changes, including potential cybersecurity incidents and other disruptions, or innovations to the financial services industry.

We have described additional factors that could cause actual results to be materially different from those described in the forward-looking statements, which factors are identified in Item 1A of this report under the heading "Risk Factors." Other factors that we have not identified in this report could also have this effect. You are cautioned not to put undue reliance on any forward-looking statement, which speak only as of the date such statement is made. Except as otherwise required by law, we undertake no obligation to publicly update or revise any forward-looking statement to reflect events or circumstances after the date of this report or to reflect the occurrence of unanticipated events.

Item 7A. Quantitative and Qualitative Disclosures About Market Risk.

The Company's exposure to market risk is reviewed on a regular basis by our Bank's asset/liability committee and board of directors. Interest rate risk is the potential of economic losses due to future interest rate changes. These economic losses can be reflected as a loss of future net interest income and/or a loss of current fair market values. The objective is to measure the effect on net interest income and to adjust the balance sheet to minimize the inherent risk while at the same time maximizing income. Management realizes certain risks are inherent and that the goal is to identify and minimize those risks.

Tools used by the Bank's management include modeling the effects on net interest income under different rate shock scenarios. At December 31, 2025, the Company's rate shock scenario models indicated that annual net interest income could change by as much as (0.43)% or (1.58)% should interest rates rise or fall, respectively, 200 basis points from their current level over a one-year period. These levels of interest rate risk are within limits set by the board in the Company's Funds Management, Investment Asset Liability Policy and management believes this is an acceptable level of interest rate risk. However, there are no assurances that the change will not be more or less than this estimate.

Pursuant to General Instruction G(2) to Form 10-K, the information required by this Item, other than that provided above, is incorporated herein by reference to the information under the caption "Management's Discussion and Analysis of Financial Condition and Results of Operations -- Quantitative and Qualitative Disclosures About Market Risk" in the Company's 2025 Annual Report to Shareholders (included as Exhibit 13 hereto).

Item 8. Financial Statements and Supplementary Data.

Pursuant to General Instruction G(2) to Form 10-K, the information required by this Item is incorporated herein by reference to the report of the independent registered public accounting firm and the information under the caption "Consolidated Financial Statements" in the Company's 2025 Annual Report to Shareholders (included as Exhibit 13 hereto).

27

Item 9. Changes in and Disagreements With Accountants on Accounting and Financial Disclosure.

None.

Item 9A. Controls and Procedures.

(a)Evaluation of Disclosure Controls and Procedures.

As of the end of the period covered by this annual report, the Company's management, including the Chief Executive Officer and Chief Financial Officer, evaluated the effectiveness of the Company's disclosure controls and procedures (as defined in Rule 13a-15(e) promulgated under the Exchange Act). Based on that evaluation, the Company's management, including the Chief Executive Officer and Chief Financial Officer, concluded that, as of December 31, 2025, the Company's disclosure controls and procedures were effective.

(b)Management's Report on Internal Control Over Financial Reporting.

The Company's management is responsible for establishing and maintaining adequate internal control over financial reporting, as such term is defined in Exchange Act Rule 13a-15(f). Under the supervision and with the participation of the Company's management, including the Company's principal executive officer and principal financial officer, we conducted an evaluation of the effectiveness of the Company's internal control over financial reporting, as of December 31, 2025, based on the framework set forth by the Committee of Sponsoring Organizations of the Treadway Commission in Internal Control-Integrated Framework (2013). Based upon its assessment, management has concluded that, as of December 31, 2025, the Company's internal control over financial reporting, is effective based on the criteria established in Internal Control-Integrated Framework (2013).

Management's assessment of the effectiveness of internal control over financial reporting, as of December 31, 2025, has been audited by Forvis Mazars, LLP, an independent registered public accounting firm, as stated in their report, which is included in this Annual Report on Form 10-K.

(c)Changes in Internal Control over Financial Reporting.

There have been no changes in the Company's internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) that occurred during the quarter ended December 31, 2025 that has materially affected, or is reasonably likely to materially affect, the Company's internal control over financial reporting.

28

Report of Independent Registered Public Accounting Firm

To the Shareholders, Board of Directors, and Audit Committee

Hawthorn Bancshares, Inc.

Opinion on the Internal Control Over Financial Reporting

We have audited Hawthorn Bancshares, Inc. and Subsidiaries’ (the “Company”) internal control over financial reporting as of December 31, 2025, based on criteria established in Internal Control – Integrated Framework: (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of December 31, 2025, based on criteria established in Internal Control – Integrated Framework: (2013) issued by COSO.

We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (“PCAOB”), the consolidated financial statementsof the Company as of December 31, 2025 and 2024, and for each of the two years in the period ended December 31, 2025, and our report dated March 5, 2026 expressed an unqualified opinion on those financial statements.

Basis for Opinion

The Company’s management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management’s Annual Report on Internal Controls over Financial Reporting. Our responsibility is to express an opinion on the Company’s internal control over financial reporting based on our audit.

We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, and testing and evaluating the design and operating effectiveness of internal control based on the assessed risk. Our audit also included performing such other procedures as we considered necessary in the circumstances. We believe that our audits provide a reasonable basis for our opinion.

Definitions and Limitations of Internal Control Over Financial Reporting

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of reliable financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate.

/s / Forvis Mazars, LLP

Kansas City, Missouri

March 5, 2026

29

Item 9B. Other Information.

During the three months ended December 31, 2025, no director or officer of the Company adopted or terminated a “Rule 10b5-1 trading arrangement” or “non-Rule 10b5-1 trading arrangement” as each term is defined in Item 408(a) of Regulation S-K.

Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections.

None

PART III

Item 10. Directors, Executive Officers and Corporate Governance.

The information under the caption “Executive Officers of the Registrant” in Part I of this report is incorporated herein by reference. The Company’s definitive Proxy Statement for its 2026 Annual Meeting of Shareholders (the "Proxy Statement") will contain under the captions "Item 1: Election of Directors," "Delinquent Section 16(a) Reports" (if applicable), "Corporate Governance and Board Matters—Consideration of Director Nominees" and "Corporate Governance and Board Matters—Committees of the Board—Audit Committee" additional information required by Item 10 of this report, which information is incorporated herein by this reference.

Code of Ethics

The Company has adopted a Code of Business Conduct and Ethics for directors, officers and employees including its principal executive officer, principal financial officer, principal accounting officer, controller and persons performing similar functions. This code of Business Conduct and Ethics is posted on the Company's internet website (www.hawthornbancshares.com) under the "Governance Documents" menu tab and is available for your examination. A copy of this Code will be furnished without charge upon written request to Corporate Secretary, Hawthorn Bancshares, Inc., 132 East High Street, Jefferson City, Missouri 65101. Any substantive amendment to, or waiver from, a provision of this code that applies to the Company's principal executive officer, principal financial officer, principal accounting officer, controller, or persons performing similar functions will be disclosed on the Company's internet website (www.hawthornbancshares.com) and, if required by the rules of the SEC or The Nasdaq Stock Market LLC, in reports the Company files with the SEC.

Insider Trading Policy

The Company has adopted an Insider Trading Policy governing the purchase, sale and other disposition of its securities by directors, officers and employees that is reasonably designed to promote compliance with insider trading laws, rules and regulations, and applicable listing standards of The Nasdaq Stock Market LLC, as well as procedures designed to further the foregoing purposes. In addition, the Insider Trading Policy requires the Company to comply with applicable laws and regulations relating to trading in its securities. A copy of the Company's Insider Trading Policy is filed with this report as Exhibit 19.

Item 11. Executive Compensation.

The Proxy Statement will contain under the captions "Executive Compensation and Related Matters," "Corporate Governance and Board Matters—Director Compensation," and "Policies and Practices for Granting Certain Equity Awards" the information required by Item 11 of this report, which information is incorporated herein by reference.

Item 12. Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters.

The Proxy Statement will contain under the caption "Ownership of Common Stock" information required by Item 12 of this report, which information is incorporated herein by reference.

Securities Authorized For Issuance Under Equity Compensation Plans

Information pertaining to equity compensation plans is contained in "Part II - Item 8. Financial Statements and Supplementary Data - Note 12 "Stockholders' Equity and Accumulated Other Comprehensive Income (Loss) Equity-Based Compensation Plan"of the Company's 2025 Annual Report and are incorporated herein by reference.

Item 13. Certain Relationships and Related Transactions, and Director Independence.

The Proxy Statement will contain under the captions "Related Party Transactions," "Item 1: Election of Directors," and "Corporate Governance and Board Matters—Committees of the Board" the information required by Item 13 of this report, which information is incorporated herein by reference.

30

Item 14. Principal Accountant Fees and Services.

The Proxy Statement will contain under the caption "Independent Registered Public Accounting Firm Fees and Services" the information required by Item 14 of this report, which information is incorporated herein by reference.

PART IV

Item 15. Exhibits and Financial Statement Schedules.

(a)Exhibits, Financial Statements and Financial Statement Schedules:

1.Financial Statements:

The following consolidated financial statements of the Company and reports of the Company's independent registered public accounting firm, included in the Company's 2025 Annual Report to Shareholders (included as Exhibit 13 hereto) under the caption "Consolidated Financial Statements", are incorporated herein by reference:

Report of Independent Registered Public Accounting Firm.

Auditor Name: Forvis Mazars, LLP

Auditor Location: Kansas City, MO

Auditor Firm ID: 686

Consolidated Balance Sheets as of December 31, 2025 and 2024.

Consolidated Statements of Income for the years ended December 31, 2025, 2024, and 2023.

Consolidated Statements of Comprehensive Income for the years ended December 31, 2025, 2024, and 2023.

Consolidated Statements of Stockholders' Equity for the years ended December 31, 2025, 2024, and 2023.

Consolidated Statements of Cash Flows for the years ended December 31, 2025, 2024, and 2023.

Notes to the Consolidated Financial Statements.

2.Financial Statement Schedules:

Financial statement schedules have been omitted because they either are not required or are not applicable or because equivalent information has been included in the financial statements, the notes thereto or elsewhere herein.

3.Exhibits:

Exhibit No. Description

31

Exhibit No. Description

21 List of Subsidiaries.

23.1 Consent of Independent Registered Public Accounting Firm.

23.2 Consent of Independent Registered Public Accounting Firm.

101.SCH Inline XBRL Taxonomy Extension Schema Document.

101.CAL Inline XBRL Taxonomy Extension Calculation Linkbase Document.

101.DEF Inline XBRL Taxonomy Extension Definition Linkbase Document.

32

Exhibit No. Description

101.LAB Inline XBRL Taxonomy Extension Label Linkbase Document.

101.PRE Inline XBRL Taxonomy Extension Presentation Linkbase Document.

____________________________

(b)Exhibits.

See exhibits identified above under Item 15(a)3.

(c)Financial Statement Schedules.

See financial statement schedules identified above under Item 15(a)2, if any.

Item 16. Form 10-K Summary.

None

33

SIGNATURES

Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized.

HAWTHORN BANCSHARES, INC.

Dated: March 5, 2026 By /s/ Brent M. Giles

Brent M. Giles, Chief Executive Officer (Principal Executive Officer)

KNOW ALL PERSONS BY THESE PRESENTS, that each person whose signature appears below constitutes and appoints Brent M. Giles and Chris E. Hafner, or either of them, his attorneys-in-fact, for such person in any and all capacities, to sign any amendments to this report and to file the same, with exhibits thereto, and other documents in connection therewith, with the Securities and Exchange Commission, hereby ratifying and confirming all that either of said attorneys-in-fact, or substitute or substitutes, may do or cause to be done by virtue hereof.

Pursuant to the requirements of the Securities Exchange Act of 1934, this report has been signed below by the following persons on behalf of the registrant and in the capacities and on the dates indicated.

34

Date Signature and Title

March 5, 2026 /s/ Brent M. Giles

March 5, 2026 /s/ Chris E. Hafner

Chris E. Hafner, Chief Financial Officer

(Principal Financial Officer and Principal Accounting Officer)

March 5, 2026 /s/ Gregg A. Bexten

Gregg A. Bexten, President, Director

March 5, 2026 /s/ Kathleen L. Bruegenhemke

Kathleen L. Bruegenhemke, Director

March 5, 2026 /s/ David T. Turner

David T. Turner, Chairman, Director

March 5, 2026 /s/ Frank E. Burkhead

Frank E. Burkhead, Director

March 5, 2026 /s/ Philip D. Freeman

Philip D. Freeman, Director

March 5, 2026 /s/ Kevin L. Riley

Kevin L. Riley, Director

March 5, 2026 /s/ Gus S. (Jack) Wetzel III

Gus S. (Jack) Wetzel III, Director

March 5, 2026 /s/ Shawna M. Hettinger

Shawna M. Hettinger, Director

March 5, 2026 /s/ Jonathan L. States

Jonathan L. States, Director

March 5, 2026 /s/ Douglas T. Eden

Douglas T. Eden, Director

March 5, 2026 /s/ Jonathan D. Holtaway

Jonathan D. Holtaway, Director

35