You should take into account that forward-looking statements speak only as of the date of this report. Given the described uncertainties and risks, we cannot guarantee our future performance or results of operations and you should not place undue reliance on forward-looking statements. We undertake no obligation to update or revise any forward-looking statements, whether as a result of new information, future events or otherwise, except as required under federal securities laws.

Columbia Bank’s diversified Treasury Management Programs are tailored to meet specific banking needs of each individual business. We combine technology with integrated operations and local expertise for safe, powerful, flexible solutions. Columbia’s clients, of all sizes, choose from a full range of transaction and Treasury Management tools to gain more control over their money. Treasury Management solutions include Business Online and Mobile Banking, Business Bill Pay, ACH collections and payments, Remote Deposit Capture and a variety of tools to protect against fraud and manage excess funds.

With regard to COVID-19, we had a phased, detailed and well-tested pandemic plan in place and began executing the first phase in the first quarter of 2020. This included moving employees capable of working from home to remote work and implementing social distancing and cleaning protocols that adhere to Center for Disease Control recommendations in all of our facilities, as well as complying with individual state restrictions. We have continued to follow that plan throughout 2021 and 2022 as new variants have emerged, escalating our response at predetermined trigger points.

The following discussion provides an overview of certain elements of the extensive regulatory framework applicable to the Company and Columbia State Bank, which operates under the name Columbia Bank in Washington, Oregon, Idaho and California. This regulatory framework is primarily designed for the protection of depositors, customers, federal deposit insurance funds and the banking system as a whole, rather than specifically for the protection of shareholders or non-depository creditors. Due to the breadth and growth of this regulatory framework, our costs of compliance continue to increase in order to monitor and satisfy these requirements.

To the extent that this section describes statutory and regulatory provisions, it is qualified by reference to those provisions. These statutes and regulations, as well as related policies, are subject to change by Congress, state legislatures and federal and state regulators. Changes in statutes, regulations or regulatory policies applicable to us, including the interpretation or implementation thereof, cannot be predicted, but may have a material effect on our business, financial condition, or results of operations. Our continued efforts to monitor and comply with new regulatory requirements and developments add to the complexity and cost of our business.

In July 2021, the Biden administration issued an executive order on competition, which included provisions relating to bank mergers. These provisions “encourage” the Department of Justice and the federal banking regulators to update guidelines on banking mergers and to provide more scrutiny of bank mergers. A number of large bank deals that were pending at the time of the executive order have not yet obtained approval, despite their being filed earlier in 2021. We are unable to predict what impact the executive order will have on the timing of or ability to obtain regulatory approvals of mergers, including our pending merger with Umpqua.future mergers.

The Patriot Act further augments and strengthens the requirements set forth in the BSA. The Patriot Act, in relevant part, (i) prohibits banks from providing correspondent accounts directly to foreign shell banks; (ii) imposes due diligence requirements on banks opening or holding accounts for foreign financial institutions or wealthy foreign individuals; (iii) requires financial institutions to establish an anti-money-laundering compliance program; and (iv) eliminates civil liability for persons who file suspicious activity reports. The Patriot Act also includes provisions providing the government with power to investigate terrorism, including expanded government access to bank account records.

Columbia Bank is also subject to regulation under the International Emergency Economic Powers Act and the Trading with the Enemy Act, as administered by the United States Treasury Department’s Office of Foreign Assets Control (“Sanctions Laws”). The Sanctions Laws are intended to restrict transactions with persons, companies, or foreign governments sanctions by U.S. authorities. An institution that fails to meet these standards may be subject to regulatory sanctions, including limitations on growth. Columbia Bank has established compliance programs designed to comply with the BSA, and the Patriot Act.Act and applicable Sanctions Laws.

Banks are also subject to certain restrictions imposed by the Federal Reserve Act on extensions of credit to executive officers, directors, principal shareholders or any related interests of such persons. Extensions of credit (i) must be made on substantially the same terms, including interest rates and collateral, and follow credit underwriting procedures that are at least as stringent as those prevailing at the time for comparable transactions with persons not related to the lending bank; and (ii) must not involve more than the normal risk of repayment or present other unfavorable features. Banks are also subject to certain lending limits and restrictions on overdrafts to insiders. A violation of these restrictions may result in the assessment of substantial civil monetary penalties, regulatory enforcement actions, and other regulatory sanctions. The Columbia Bank board has established controls to ensure compliance with regulatory expectations around affiliated transactions.

The Interstate Act together with the Dodd-Frank Act relaxed prior interstate branching restrictions under federal law by permitting, subject to regulatory approval, state and federally chartered commercial banks to establish branches in states where the laws permit banks chartered in such states to establish branches. The Interstate Act requires regulators to consult with community organizations before permitting an interstate institution to close a branch in a low-income area. Federal banking agency regulations prohibit banks from using their interstate branches primarily for deposit production and the federal banking agencies have implemented a loan-to-deposit ratio screen to ensure compliance with this prohibition.

Columbia is a legal entity separate and distinct from the Bank and its other subsidiaries. As a bank holding company, Columbia is subject to certain restrictions on its ability to pay dividends under applicable banking laws and regulations. Federal bank regulators are authorized to determine under certain circumstances relating to the financial condition of a bank holding company or a bank that the payment of dividends would be an unsafe or unsound practice and to prohibit payment thereof. In particular, federal bank regulators have stated that paying dividends that deplete a banking organization’s capital base to an inadequate level would be an unsafe and unsound banking practice and that banking organizations should generally pay dividends only out of current operating earnings. In addition, in the current financial and economic environment, the Federal Reserve has indicated that bank holding companies should carefully review their dividend policy and has discouraged payment ratios that are at maximum allowable levels unless both asset quality and capital are very strong. Federal Reserve policy also provides that a bank holding company should inform the Federal Reserve reasonably in advance of declaring or paying a dividend that exceeds earnings for the period for which the dividend is being paid or that could result in a material adverse change to the bank holding company’s capital structure. A significant portion of our income comes from dividends from the Bank, which is also the primary source of our liquidity. In addition to the restrictions discussed above, the Bank is subject to limitations under Washington law regarding the level of dividends that it may pay to the Company (if the proposed merger with Umpqua is completed, the Bank, following its merger with and into Umpqua Bank, will be subject to Oregon limitations instead). Washington law limits a bank’s ability to pay dividends that are greater than the bank’s retained earnings without approval of the applicable banking agency (under Oregon law, a bank may not pay dividends greater than the bank’s unreserved retained earnings, deducting therefrom, to the extent not already charged against earnings or reflected in a reserve, all bad debts, which are debts on which interest is past due and unpaid for at least six months, unless the debt is fully secured and in the process of collection; all other assets charged-off as required by Oregon bank regulators or a state or federal examiner; and all accrued expenses, interest and taxes of the institution).

The Federal Reserve monitors the capital adequacy of the Company on a consolidated basis, and the FDIC and the Washington Department of Financial Institutions’ Division of Banks monitor, and if the proposed merger with Umpqua is completed, the Oregon Department of Consumer and Business Services Division of Financial Regulation will monitor the capital adequacy of the Bank. The Capital Rules are based on the December 2010 final capital framework for strengthening international capital standards, known as Basel III, of the Basel Committee. As of December 31, 2021,2022, we and the Bank met all capital adequacy requirements under the Capital Rules, as described below.

The Capital Rules, among other things (i) include a capital measure called CET1, (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting specified requirements and (iii) define CET1 narrowly by requiring that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital.

Under the Capital Rules, the minimum capital ratios are (i) 4.5% CET1 to risk-weighted assets, (ii) 6% Tier 1 capital (that is, CET1 plus Additional Tier 1 capital) to risk-weighted assets and (iii) 8% total capital (that is, Tier 1 capital plus Tier 2 capital) to risk-weighted assets.

The Capital Rules also require an institution to establish a capital conservation buffer of CET1 in an amount above the minimum risk-based capital requirements for “adequately capitalized” institutions equal to 2.5% of total risk-weighted assets. Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the capital conservation buffer will face constraints on dividends, equity repurchases and compensation based on the amount of the shortfall and the institution’s “eligible retained income” (that is, the greater of (i) net income for the preceding four quarters, net of distributions and associated tax effects not reflected in net income and (ii) average net income over the preceding four quarters).

The Capital Rules provide for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, certain deferred tax assets and significant investments in non-consolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. The Capital Rules also generally preclude certain hybrid securities, such as trust preferred securities, from being counted as Tier 1 capital for most bank holding companies.

In addition, the Company and the Bank are subject to the final rule adopted by the Federal Reserve, OCC and FDIC in July 2019 relating to simplifications of the capital rules applicable to non-advanced approaches banking organizations. These rules became effective for the Company on April 1, 2020 and provide for simplified capital requirements relating to the threshold deductions for mortgage servicing assets, deferred tax assets arising from temporary differences that a banking organization could not realize through net operating loss carry backs, and investments in the capital of unconsolidated financial institutions, as well as the inclusion of minority interests in regulatory capital.

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms. The standards are commonly referred to as “Basel IV.” Among other things, these standards revise the Basel Committee’s standardized approach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain “unconditionally cancellable commitments,” such as home equity lines of credit) and providesprovide a new standardized approach for operational risk capital. Under theThe Basel framework contemplates that these standards will generally be effective on January 1, 2023, with an aggregate output floor phasing in through January 1, 2028. The federal bank regulators have not yet proposed rules implementing these standards. In July 2020, the Basel Committee finalized further revisions to the framework for credit valuation adjustment risk, which are intended to align that framework with the market risk framework. Under the current U.S. capital rules, operational risk capital requirements and a capital floor apply only to advanced approachapproaches institutions. The impact of Basel IV on the Company and the Bank will depend on the manner in which it is implemented by the federal bank regulators.

The Bank is also subject to the prompt corrective action regulations pursuant to Section 38 of the FDIA. See “Prompt Corrective Action Framework.”

The FDIA requires the federal bank regulators to take prompt corrective action in respect of depository institutions that fail to meet specified capital requirements. The FDIA establishes five capital categories (“well-capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” and “critically undercapitalized”), and the federal bank regulators are required to take certain mandatory supervisory actions, and are authorized to take other discretionary actions, with respect to institutions that are undercapitalized, significantly undercapitalized or critically undercapitalized. The severity of these mandatory and discretionary supervisory actions depends upon the capital category in which the institution is placed. Generally, subject to a narrow exception, the FDIA requires the regulator to appoint a receiver or conservator for an institution that is critically undercapitalized.

Under the rules currently in effect, the following table presents the requirements for an insured depository institution to be classified as well-capitalized or adequately capitalized:

As of December 31, 2021,2022, we and the Bank met the capital requirements to be well-capitalized with CET1 capital ratios of 13.01%12.87% and 13.06%12.93%, respectively, Tier 1 capital ratios of 13.01%12.87% and 13.06%12.93%, respectively, total capital ratios of 14.21%13.98% and 14.18%13.97%, respectively, and Tier 1 leverage ratios of 8.55%9.34% and 8.60%9.47%, respectively.

An institution that is categorized as undercapitalized, significantly undercapitalized or critically undercapitalized is required to submit an acceptable capital restoration plan to its appropriate federal bank regulator. Under the FDIA, in order for the capital restoration plan to be accepted by the appropriate federal banking agency, a bank holding company must guarantee that a subsidiary depository institution will comply with its capital restoration plan, subject to certain limitations. The bank holding company must also provide appropriate assurances of performance. The obligation of a controlling bank holding company under the FDIA to fund a capital restoration plan is limited to the lesser of 5% of an undercapitalized subsidiary’s assets or the amount required to meet regulatory capital requirements. An undercapitalized institution is also generally prohibited from increasing its average total assets, making acquisitions and capital distributions, establishing any branches or engaging in any new line of business, except in accordance with an accepted capital restoration plan or with the approval of the FDIC. Institutions that are undercapitalized or significantly undercapitalized and either fail to submit an acceptable capital restoration plan or fail to implement an approved capital restoration plan may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become adequately capitalized, requirements to reduce total assets and cessation of receipt of deposits from correspondent banks. Critically undercapitalized depository institutions failing to submit or implement an acceptable capital restoration plan are subject to appointment of a receiver or conservator.

The FDIA prohibits an insured depository institution from accepting brokered deposits or offering interest rates on any deposits significantly higher than the prevailing rate in the bank’s normal market area or nationally (depending upon where the deposits are solicited), unless it is well-capitalized or is adequately capitalized and receives a waiver from the FDIC. A depository institution that is adequately capitalized and accepts brokered deposits under a waiver from the FDIC may not pay an interest rate on any deposit in excess of 75 basis points over certain prevailing market rates.

The Federal Reserve conducts periodic inspections of bank holding companies. The supervisory objectives of the inspection program are to ascertain whether the financial strength of the bank holding company is being maintained on an ongoing basis and to determine the effects or consequences of transactions between a holding company or its non-banking subsidiaries and its subsidiary banks.

Banks are subject to periodic examinations by their primary regulators. Bank examinations have evolved from reliance on transaction testing in assessing a bank’s condition to a risk-focused approach. These examinations are extensive and cover the entire breadth of operations of the bank. Generally, FDIC safety and soundness examinations for a bank of our size are completed on an annual basis through the execution of a quarterly focal review process. The FDIC and state bank regulatory agencies complete these examinations on a combined schedule.

The CFPB has primary examination and enforcement authority over institutions with assets of $10 billion or more, including the Bank, with respect to various federal consumer protection laws, and we are subject to continued examination by the FDIC on certain consumer regulations. State authorities are also responsible for monitoring our compliance with all state consumer laws.

The frequency of consumer compliance and CRA examinations is linked to the size of the institution and its compliance and CRA ratings at its most recent examinations. However, the examination authority of the Federal Reserve and the FDIC allows them to examine supervised banks as frequently as deemed necessary based on the condition of the bank or as a result of certain triggering events.

Under the Gramm-Leach-Bliley Act of 1999, as amended, a financial institution may not disclose non-public personal information about a consumer to unaffiliated third-parties unless the institution satisfies various disclosure requirements and the consumer has not elected to opt out of the information sharing. The financial institution must provide its customers with a notice of its privacy policies and practices. The Federal Reserve, the FDIC, and other financial regulatory agencies issued regulations implementing notice requirements and restrictions on a financial institution's ability to disclose non-public personal information about consumers to unaffiliated third-parties.

In addition, privacy and data protection are areas of increasing state legislative focus, and several states have recently enacted consumer privacy laws that impose significant compliance obligations with respect to personal information. For example, the Company is subject to the CCPA and its implementing regulations. The CCPA gives consumers the right to request disclosure of information collected about them, and whether that information has been sold or shared with others, the right to request deletion of personal information (subject to certain exceptions), the right to opt out of the sale of the consumer’s personal information, and the right not to be discriminated against for exercising these rights. The CCPA contains several exemptions, including an exemption applicable to information that is collected, processed, sold or disclosed pursuant to the Gramm-Leach-Bliley Act of 1999, as amended. In November 2020, voters in the CPRA, a ballot measure that amends and supplements the CCPA by, among other things, expanding certain rights relating to personal information and its use, collection, and disclosure by covered businesses. The key provisions of the CPRA will becomebecame effective on January 1, 2023, with civil and administrative enforcement of the CPRA beginning July 1, 2023. Similar laws may in the future be adopted by other states where the Company does business. The Company has made and will make operational adjustments in accordance with the requirements of the CCPA and other state privacy laws. Furthermore, privacy and data protection areas are expected to receive further attention at the federal level. The potential effects of state or federal privacy and data protection laws on the Company’s business cannot be determined at this time, and will depend both on whether such laws are adopted by states in which the Company does business and/or at the federal level and the requirements imposed by any such laws.

The federal banking agencies have established certain expectations with respect to an institution's information security and cybersecurity programs, with an increasing focus on risk management, processes related to information technology and operational resiliency, and the use of third-partiesthird parties in the provision of financial services. In October 2016, the federal banking agencies jointly issued an advance notice of proposed rulemaking on enhanced cybersecurity risk-management and resilience standards that would address five categories of cyber standards which include (i) cyber risk governance, (ii) cyber risk management, (iii) internal dependency management, (iv) external dependency management, and (v) incident response, cyber resilience, and situational awareness. As proposed, these enhanced standards would apply only to depository institutions and depository institution holding companies with total consolidated assets of $50 billion or more; however, it is possible that if these enhanced standards are implemented, even if the $50 billion threshold is increased, the Federal Reserve will consider them in connection with the examination and supervision of banks below the $50 billion threshold. The federal banking agencies have not yet taken further action on these proposed standards. If we complete the pending merger with Umpqua, we will likely have greater than $50 billion in total consolidated assets.assets and, as a result, would be subject to these enhanced cybersecurity risk-management and resilience standards.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providingwith detailed requirements, with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. We expect this trend of state-level activity in those areascybersecurity regulation to continue, and are continually monitoring developments in the states in which the Company operates.

In February 2018, the SEC published interpretive guidance to assist public companies in preparing disclosures about cybersecurity risks and incidents. These SEC guidelines, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations. In addition, in March 2022, the SEC proposed new rules that would require reporting on Form 8-K of material cybersecurity incidents.

In November 2021, the U.S. federal bank regulatory agencies adopted a rule regarding notification requirements for banking organizations related to significant computer security incidents. Under the final rule, a bank holding company, such as the Company, and an FDIC-supervised insured depository institution, such as the Bank, are required to notify the Federal Reserve or FDIC, respectively, within 36 hours of incidents that have materially disrupted or degraded, or are reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector.

SOX addresses, among other things, corporate governance, auditing and accounting, enhanced and timely disclosure of corporate information, and penalties for non-compliance. Generally, SOX (i) requires CEOs and CFOs to certify the accuracy of periodic reports filed with the SEC; (ii) imposes specific and enhanced corporate disclosure requirements; (iii) accelerates the time frame for reporting of insider transactions and periodic disclosures by public companies; (iv) requires companies to adopt and disclose information about corporate governance practices, including whether or not they have adopted a code of ethics for senior financial officers and whether the audit committee includes at least one “audit committee financial expert;” and (v) requires the SEC, based on certain enumerated factors, to regularly and systematically review corporate filings.

The Bank’s deposits are insured under the FDIA up to the maximum applicable limits and are subject to deposit insurance assessments designed to tie what banks pay for deposit insurance to the risks they pose. Under the FDIC’s assessment system for determining payments to the DIF, large IDIs with more than $10 billion in assets are assessed under a complex “scorecard” methodology that seeks to capture both the probability that an individual large IDI will fail and the magnitude of the impact on the DIF if such a failure occurs. The assessment base of a large IDI is its total assets less tangible equity.

The Dodd-Frank Act prohibits banks and their affiliates from engaging in proprietary trading and investing in and sponsoring hedge funds and private equity funds. The statutory provision is commonly called the “Volcker Rule.” The Volcker Rule does not significantly impact the operations of the Company and the Bank, as we do not have any significant engagement in the businesses prohibited by the Volcker Rule.

Interchange fees, or “swipe” fees, are charges that merchants pay to us and other card-issuing banks for processing electronic payment transactions. Under applicable rules, the maximum permissible interchange fee is equal to no more than 21 cents plus 5 basis points of the transaction value for many types of debit interchange transactions. The Federal Reserve also adopted a rule to allow a debit card issuer to recover one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements required by the Federal Reserve. The Federal Reserve also has rules governing routing and exclusivity that require issuers to offer two unaffiliated networks for routing transactions on each debit or prepaid product.

The Dodd-Frank Act requires the federal bank regulators and the SEC to establish joint regulations or guidelines prohibiting incentive-based payment arrangements at specified regulated entities, including us and the Bank, having at least $1 billion in total assets that encourage inappropriate risks by providing an executive officer, employee, director or principal stockholder with excessive compensation, fees, or benefits or that could lead to material financial loss to the entity. In addition, these regulators must establish regulations or guidelines requiring enhanced disclosure to regulators of incentive-based compensation arrangements.

In June 2010, the Federal Reserve and FDIC issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that appropriately balance risk and financial results in a manner that does not encourage employees to expose their organizations to imprudent risk, (ii) be compatible with effective internal controls and risk management and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

During the second quarter of 2016, the U.S. financial regulators, including the Federal Reserve and the SEC, proposed revised rules on incentive-based payment arrangements at specified regulated entities having at least $1 billion in total assets, but these proposed rules have not been finalized.

The Federal Reserve will review, as part of the regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as us, that are not “large, complex banking organizations.” These reviews will be tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of the supervisory initiatives will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements or related risk management control or governance processes pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

Proposed legislation relating to the banking industry is introduced in almost every legislative session. Certain of such legislation could dramatically affect the regulation of the banking industry. We cannot predict if any such legislation will be adopted or if it is adopted how it would affect the business of Columbia Bank or the Company. Recent history has demonstrated that new legislation or changes to existing laws or regulations usually results in a greater compliance burden and therefore generally increases the cost of doing business.

Our earnings and growth are affected not only by general economic conditions, but also by the fiscal and monetary policies of the federal government, particularly the Federal Reserve. The Federal Reserve implements national monetary policy for such purposes as curbing inflation and combating recession, but its open market operations in U.S. government securities, control of the discount rate applicable to borrowings from the Federal Reserve, and establishment of reserve requirements against certain deposits influence the growth of bank loans, investments and deposits and also affect interest rates charged on loans or paid on deposits. The nature and impact of future changes in monetary policies and their impact on us cannot be predicted with certainty.

As a financial institution, our operations rely heavily on the secure processing, storage and transmission of confidential and other information on our computer systems and networks. Any failure, interruption or breach in security or operational integrity of these systems could result in failures or disruptions in our online banking system, customer relationship management, general ledger, deposit and loan servicing and other systems. The security and integrity of our systems could be threatened byare susceptible to a variety of interruptions or information security breaches, including those caused by computer hacking, cyber- attacks,cyberattacks, electronic fraudulent activity or attempted theft of financial assets. We mayare not be able to anticipate, detect, or implement effective preventative measures against all threats, particularly because the techniques used by cyber criminalscybercriminals change frequently, often are not recognized until launched and can be initiated from a variety of sources. We cannot assure you that we will be able to adequately address all such failures, interruptions or security breaches that may have a material adverse impact on our business, financial condition, results of operations and prospects. While we have certain protective policies and

Due to the complexity and interconnectedness of information technology systems, the process of enhancing our systems can itself create a risk of systems disruptions and security issues. Additionally, we face the risk of operational disruption, failure, termination or capacity constraints of any of the third parties that facilitate our business activities, including exchanges, clearing agents, clearing houses or other financial intermediaries. Such parties can also be the source of an attack on, or breach of, our operational systems. Failures, interruptions or security breaches in our information systems could damage our reputation, result in a loss of customer business, result in a violation of privacy or other laws, or expose us to civil litigation, regulatory fines or losses not covered by insurance, all of which could have a material adverse impact on our business, financial condition, results of operations and prospects. Further, as an investigation into a cyberattack is inherently unpredictable, it may take a significant amount of time for us to fully uncover the scope of and damage related to a cyberattack and develop an effective mitigation plan. During such time, damage related to a cyberattack may continue and communications to the public, customers, regulators, and other stakeholders may not be timely or accurate. Potential new regulations may require us to publicly disclose information about a cyberattack before the incident has been resolved or fully investigated.

The confidential information of our customers (including user names and passwords) can also be jeopardized from the compromise of customers’ personal electronic devices or as a result of a data security breach at an unrelated company. Losses due to unauthorized account activity could harm our reputation and may have a material adverse effect on our business, financial condition, results of operations and prospects.

In addition, unexpected contingent liabilities can arise from the businesses we acquire. Integration of an acquired business can be complex and costly, sometimes including combining relevant accounting and data processing systems, financial reporting and management and internal controls, as well as managing relevant relationships with employees, clients, suppliers and other business partners. Integration efforts could divert management attention and resources, which could adversely affect these systems, processes or controls and our operations or results.

Acquisitions may also result in business disruptions that cause us to lose customers or cause customers to remove their accounts from us and move their business to competing financial institutions. It is possible that the integration process related to acquisitions could result in the disruption of our ongoing businesses or inconsistencies in standards, controls, procedures and policies that could adversely affect our ability to maintain relationships with clients, customers, depositors and employees. The loss of key employees in connection with an acquisition could adversely affect our ability to successfully conduct our business.

We may engage in additional future acquisitions involving the issuance of additional common stock and/or cash. Any such acquisitions and related issuances of stock may have a dilutive effect on EPS, book value per share or the percentage ownership of current shareholders. The use of cash as consideration in any such acquisitions could impact our capital position and may require us to raise additional capital.

Furthermore, notwithstanding our prior acquisitions, we cannot provide any assurance as to the extent to which we can continue to grow through acquisitions as this will depend on the availability of prospective target opportunities at valuations we find attractive and other factors. Among other things, acquisitions by financial institutions are subject to approval by a variety of federal and state regulatory agencies. Regulatory approvals could be delayed, impeded, restrictively conditioned or denied due to existing or new regulatory issues we have, or may have, with regulatory agencies. In addition, the Northwest is experiencing intensified consolidation in the banking industry, and we face significant competition from numerous other financial services institutions for attractive acquisition candidates, and many of these competitors have greater financial resources than we do.

If the merger with Umpqua is not completed for any reason including as a result of Columbia shareholders or Umpqua shareholders failing to approve certain matters in connection with the merger at each company’s respective special meeting, there may be various adverse consequences and Columbia may experience negative reactions from the financial markets and from its customers and employees. For example, Columbia’s business may have been impacted adversely by the failure to pursue other beneficial opportunities due to the focus of management on the merger, without realizing any of the anticipated benefits of completing the merger.from which may not be realized. Additionally, if the merger agreement is terminated, the market price of Columbia’s common stock could decline to the extent that current market prices reflect a market assumption that the merger will be beneficial and will be completed. Columbia also could be subject to litigation related to any failure to complete the merger or to proceedings commenced against Columbia to perform its obligations under the merger agreement. If the merger agreement is terminated under certain circumstances, Columbia may be required to pay a termination fee of $145 million to Umpqua.

The success of the merger will depend, in part, on the ability to realize the anticipated cost savings from combining the businesses of Columbia and Umpqua. To realize the anticipated benefits and cost savings from the merger, Columbia and Umpqua must successfully integrate and combine their businesses in a manner that permits those cost savings to be realized without adversely affecting current revenues and future growth. If Columbia and Umpqua are not able to successfully achieve these objectives, the anticipated benefits of the merger may not be realized fully or at all or may take longer to realize than expected. In addition, the actual cost savings of the merger could be less than anticipated, and integration may result in additional and unforeseen expenses.

An inability to realize the full extent of the anticipated benefits of the merger and the other transactions contemplated by the merger agreement, as well as any delays encountered in the integration process, could have an adverse effect upon the revenues, levels of expenses and operating results of the combined company following the completion of the merger, which may adversely affect the value of the common stock of the combined company following the completion of the merger.

Columbia and Umpqua have operated and, until the completion of the merger, must continue to operate, independently. It is possible that the integration process could result in the loss of key employees, the disruption of each company’s ongoing businesses or inconsistencies in standards, controls, procedures and policies that adversely affect the companies’ ability to maintain relationships with clients, customers, depositors and employees or to achieve the anticipated benefits and cost savings of the merger. Integration efforts between the companies may also divert management attention and resources. These integration matters could have an adverse effect on Columbia during this transition period and for an undetermined period after completion of the merger on the combined company.

Furthermore, the board of directors and executive leadership of the combined company will consist of former directors and executive officers from each of Columbia and Umpqua. Combining the boards of directors and management teams of each company into a single board and a single management team could require the reconciliation of differing priorities and philosophies.

The success of the merger will depend in part on the combined company’s ability to retain the talent and dedication of key employees currently employed by Columbia and Umpqua. It is possible that these employees may decide not to remain with Columbia or Umpqua, as applicable, while the merger is pending or with the combined company after the merger is consummated. If Columbia and Umpqua are unable to retain key employees, including management, who are critical to the successful integration and future operations of the companies, Columbia and Umpqua could face disruptions in their operations, loss of existing customers, loss of key information, expertise or know-how and unanticipated additional recruitment costs. In addition, following the merger, if key employees terminate their employment, the combined company’s business activities may be adversely affected, and management’s attention may be diverted from successfully hiring suitable replacements, all of which may cause the combined company’s business to suffer. Columbia and Umpqua also may not be able to locate or retain suitable replacements for any key employees who leave either company.

Uncertainty about the effect of the merger on employees and customers may have an adverse effect on Columbia. These uncertainties may impair Columbia’s ability to attract, retain and motivate key personnel until the merger is completed, and could cause customers and others that deal with Columbia to seek to change existing business relationships with Columbia. In addition, subject to certain exceptions, Columbia has agreed to operate its business in the ordinary course in all material respects and to refrain from taking certain actions that may adversely affect its ability to consummate the transactions contemplated by the merger agreement on a timely basis without the consent of Umpqua. These restrictions may prevent Columbia from pursuing attractive business opportunities that may arise prior to the completion of the merger.

Columbia has incurred and expects to incur a number of non-recurring costs associated with the merger. These costs include legal, financial advisory, accounting, consulting and other advisory fees, retention, severance and employee benefit-related costs, public company filing fees and other regulatory fees, financial printing and other printing costs, closing, integration and other related costs. Some of these costs are payable by Columbia regardless of whether or not the merger is completed.

The merger agreement is subject to a number of conditions which must be fulfilled in order to complete the merger. Those conditions include, among other things: (i) approval by each of the Columbia shareholders and the Umpqua shareholders of certain matters relating to the merger at each company’s respective special meeting (which approvals were obtained on January 26, 2022); (ii) the receipt of required regulatory approvals, including the approval of the FRB and the FDIC;FDIC (which approvals were obtained on October 25, 2022 and January 5, 2023, respectively); and (iii) the absence of any order, injunction, decree or other legal restraint preventing the completion of the merger, the bank merger or any of the other transactions contemplated by the merger agreement or making the completion of the merger, the bank merger or any of the other transactions contemplated by the merger agreement illegal. Each party’s obligation to complete the merger is also subject to certain additional customary conditions, including (a) subject to applicable materiality standards, the accuracy of the representations and warranties of the other party set forth in the merger agreement, (b) the performance in all material respects by the other party of its obligations under the merger agreement and (c) the receipt by each party of an opinion from its counsel to the effect that the merger will qualify as a reorganization within the meaning of Section 368(a) of the Internal Revenue Code of 1986.

These conditions to the closing may not be fulfilled in a timely manner or at all, and, accordingly, the merger may not be completed. In addition, the parties can mutually decide to terminate the merger agreement at any time, before or after the requisite shareholder approvals, or Umpqua or Columbia may elect to terminate the merger agreement in certain other circumstances.

Management makes various assumptions and judgments about the collectability of acquired loans, including the creditworthiness of borrowers and the value of the real estate and other assets serving as collateral for the repayment of secured loans. If our assumptions are incorrect, significant earnings volatility can occur and credit loss provisions may be needed to respond to different economic conditions or adverse developments in the acquired loan portfolio. Any increase in future loan losses could have a material adverse impact on our business, financial condition, results of operations and prospects.

Accounting standards require that we account for acquisitions using the acquisition method of accounting. Under acquisition accounting, if the purchase price of an acquired company exceeds the fair value of its net assets, the excess is carried on the acquirer’s balance sheet as goodwill. In accordance with GAAP, our goodwill is evaluated for impairment on an annual basis or more frequently if events or circumstances indicate that a potential impairment exists. Such evaluation may be based on a variety of factors, including the quoted price of our common stock, market prices of common stock of other banking organizations, common stock trading multiples, DCF analysis and data from comparable acquisitions. Future evaluations of goodwill may result in impairment and ensuing write-downs, which could have a material adverse impact on our earnings and shareholders’ equity.

Our success depends in significant part on the skills of our management team and our ability to retain, recruit and motivate key officers and employees. We expect our future success to be driven in large part by the relationships maintained with our clients by our executives and other key employees. Leadership changes will occur from time to time, and we cannot predict whether significant resignations or other departures will occur or whether we will be able to recruit additional qualified personnel. Competition for senior executives and skilled personnel in the financial services and banking industry is intense, which means the cost of hiring, incentivizing and retaining skilled personnel may continue to increase. The increase in remote and hybrid work arrangements has also increased competition for skilled personnel, and our current or future approach to in-office or remote-work arrangements may not meet the needs or expectations of current or prospective employees or may not be perceived as favorable compared to arrangements offered by other companies, which could adversely affect our ability to attract and retain skilled and qualified personnel. We need to continue to attract and retain key personnel and to recruit qualified individuals to succeed existing key personnel to ensure the continued growth and successful operation of our business. The unexpected loss of any such employees, or the inability to recruit and retain qualified personnel in the future, could have a material adverse impact on our business, financial condition, results of operations and prospects. In addition, the scope and content of U.S. banking regulators' regulations and policies on incentive compensation, as well as changes to these regulations and policies, could adversely affect our ability to hire, retain and motivate our key employees.

The financial services industry is undergoing rapid technological changes with frequent introductions of new technology-driven products and services. The effective use of technology increases efficiency and enables financial institutions to better serve customers and to reduce costs. Many of our competitors have substantially greater resources to invest in technological improvements than we do. Our future success will depend, in part, upon our ability to address the needs of our clients by using technology to provide products and services that will satisfy client demands for convenience, as well as to create additional efficiencies in our operations. We may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers. In addition, the implementation of technological changes and upgrades to maintain current systems and integrate new ones may also cause service interruptions, transaction processing errors and system conversion delays and may cause us to fail to comply with applicable laws. There can be no assurance that we will be able to successfully manage the risks associated with our increased dependency on technology.

We are from time to time subject to claims and proceedings related to our operations. Claims and legal actions, including supervisory or enforcement actions by our regulators, or criminal proceedings by prosecutorial authorities, could involve large monetary claims, including civil money penalties or fines imposed by government authorities and significant defense costs. If the proposed merger with Umpqua is completed, the combined company will also be subject to the claims and proceedings related to Umpqua’s operations. To mitigate the cost of some of these claims, we maintain insurance coverage in amounts and with deductibles that we believe are appropriate for our operations. However, our insurance coverage does not cover any civil money penalties or fines imposed by government authorities and may not cover all other claims that might be brought against us or continue to be available to us at a reasonable cost. As a result, we may be exposed to substantial uninsured liabilities, which could adversely affect our business, prospects, results of operations and financial condition. Substantial legal liability or significant regulatory action against us could cause significant reputational harm to us and/or could have a material adverse impact on our business, financial condition, results of operations and prospects. Because we primarily serve individuals and businesses located in the Northwest, any negative impact resulting from reputational harm, including any impact on our ability to attract and retain customers and employees, likely would be greater than if our business were more geographically diverse.

We are exposed to many types of operational risks, including reputational risk, legal and compliance risk, the risk of fraud or theft by employees or outsiders, and unauthorized transactions by employees or operational errors, including clerical or record-keeping errors or those resulting from faulty or disabled computer or telecommunications systems. These risks have increased in light of work-from-home arrangements implemented in response to the COVID-19 pandemic.

Our reputation and businesses may be adversely affected by negative publicity or information regarding our businesses and personnel, whether or not accurate or true, that may be posted on social media or other Internet forums or published by news organizations. The speed and pervasiveness with which information can be disseminated through these channels, in particular social media, may magnify risks relating to negative publicity.

If personal, non-public, confidential or proprietary information of customers in our possession were to be mishandled or misused, we could suffer significant regulatory consequences, reputational damage and financial loss. Such mishandling or misuse could include, for example, if such information were erroneously provided to parties who are not permitted to have the information, either by fault of our systems, employees, or counterparties, or where such information is intercepted or otherwise inappropriately taken by third parties.

Because the nature of the financial services business involves a high volume of transactions, certain errors may be repeated or compounded before they are discovered and successfully rectified. Our necessary dependence upon automated systems to record and process transactions and our large transaction volume may further increase the risk that technical flaws or employee tampering or manipulation of those systems will result in losses that are difficult to detect. We are also subject to disruptions of our operating systems arising from events that are wholly or partially beyond our control (for example, computer viruses or electrical or telecommunications outages, natural disasters, disease pandemics or other damage to property or physical assets) that can give rise to disruption of service to customers and to financial loss or liability. We are further exposed to the risk that our external vendors may be unable to fulfill their contractual obligations (or will be subject to the same risk of fraud or operational errors by their respective employees as we are) and to the risk that weour (or our vendors’) business continuity and data security systems prove to be inadequate. The occurrence of any of these risks could result in a diminished ability of us to operate our business (for example, by requiring us to expend significant resources to correct the defect), as well as potential liability to clients, reputational damage and regulatory intervention, each of which could have a material adverse impact on our business, financial condition, results of operations and prospects.

We rely on third parties to provide services to us and our clients or otherwise act as partners in our business activities in a variety of ways, including through the provision of key components of our business infrastructure. We expect these third parties to perform services for us, fulfill their obligations to us, accurately inform us of relevant information, and conduct their activities in a manner that reflects positively on our brand and business. Although we manage exposure to such third-party risk through a variety of means, including the performance of due diligence and ongoing monitoring of vendor performance, there can be no assurance these efforts will be effective. Any failure of our business partners, service providers or other third parties to meet their commitments to us or to perform in accordance with our expectations could result in operational disruptions, increased expenditures, regulatory actions in which we may be held responsible for the actions of third parties, damage to our reputation and the loss of clients, which in turn could harm our business and operations, strategic growth objectives and financial performance. Because of the COVID-19 pandemic, many of our counterparties and third-party service providers have been, and may further be, affected by “stay-at-home” orders,the continuing shift to work-from-home or hybrid-work arrangements, market volatility and other factors that increase their risk of business disruption or that may otherwise affect their ability to perform under the terms of any agreements with us or provide essential services.

Our third-party partners may also rely on their own business partners and service providers in the ordinary course of their business. Although we seek to diversify our exposure to third-party partners in order to increase our resiliency, we are nevertheless exposed to the risk that a disruption or other information technology event at a common service provider to our vendors could impede their ability to provide products or services to us, which in turn could harm our business and operations, strategic growth objectives and financial performance.

Management regularly reviews and updates our internal control over financial reporting, disclosure controls and procedures, and corporate governance policies and procedures. We maintain controls and procedures to mitigate risks such as processing system failures or errors and customer or employee fraud, and we maintain insurance coverage for certain of these risks. Any system of controls and procedures, however well designed and operated, is based in part on certain assumptions and provides only reasonable, not absolute, assurances that the objectives of the system are met. Events could occur which are not prevented or detected by our internal controls, are not insured against, or are in excess of our insurance limits. Any failure or circumvention of our controls and procedures, or failure to comply with regulations related to controls and procedures, could have an adverse effect on our business, financial condition, results of operations and prospects.

While our loan portfolio is diversified across business sectors, it is concentrated in commercial real estate and commercial business loans. These types of loans generally are viewed as having more risk of default than residential real estate loans or certain other types of loans or investments. In fact, the FDIC has issued pronouncements alerting banks of its concern about heavy loan concentrations. Commercial real estate valuations can be significantly affected over relatively short periods of time by changes in business climate, economic conditions, interest rates, and, in many cases, the results of operations of businesses and other occupants of the real property. Emerging and evolving factors such as the shift to work-from-home or hybrid-work arrangements, changing consumer preferences (including online shopping), COVID-19-related restrictions and resulting changes in occupancy rates as a result of these and other trends can also impact such valuations over relatively short periods. Because our loan portfolio contains commercial real estate and commercial business loans with relatively large balances, the deterioration of one or a few of these loans may cause a significant increase in our nonperforming loans. An increase in nonperforming loans could result in a loss of earnings from these loans, an increase in the provision for loan losses, or an increase in loan charge-offs, any of which would have an adverse impact, which could be material, on our business, financial condition, results of operations and prospects.

As of December 31, 2021, 63%2022, 64% of our total gross loans were secured by real estate. Any renewed downturn in the economies or real estate values in the markets we serve could have a material adverse effect on both borrowers’ ability to repay their loans and the value of the real property securing such loans. Our ability to recover on defaulted loans would then be diminished, and we would be more likely to suffer losses on defaulted loans, any or all of which would have an adverse impact, which could be material, on our business, financial condition, results of operations and prospects.

We maintain an allowance for credit losses (for periods prior to January 1, 2020, referred to as the allowance for loan and lease losses) in an amount that we believe is adequate to provide for losses inherent in our loan portfolio. While we strive to carefully monitor credit quality and to identify loans that may become nonperforming, at any time there are loans in the portfolio that could result in losses but that have not been identified as nonperforming or potential problem loans. We cannot be sure that we will be able to identify deteriorating loans before they become nonperforming assets or that we will be able to limit losses on those loans that have been identified. Additionally, the process for determining the allowance requires different, subjective and complex judgments about the future impact from current economic conditions that might impair the ability of borrowers to repay their loans. As a result, future significant increases to the allowance may be necessary. Future increases to the allowance may be required based on changes in the composition of the loans comprising the portfolio, deteriorating values in underlying collateral (most of which consists of real estate) and changes in the financial condition of borrowers, such as may result from changes in economic conditions, or as a result of actual future events differing from assumptions used by management in determining the allowance.

Additionally, banking regulators, as an integral part of their supervisory function, periodically review our allowance. These regulatory agencies may require us to increase the allowance. Any increase in the allowance would have an adverse effect, which could be material, on our financial condition and results of operations.

Our nonperforming assets adversely affect our net income in various ways. We do not record interest income on nonaccrual loans, thereby adversely affecting our income. Moreover, nonaccrual loans increase our loan administration costs. Assets acquired by foreclosure or similar proceedings are recorded at fair value less estimated costs to sell. The valuation of these foreclosed assets is periodically updated and resulting losses, if any, are charged to earnings in the period in which they are identified. An increase in the level of nonperforming assets also increases our risk profile and may impact the capital levels our regulators believe is appropriate in light of such risks. We utilize various techniques such as loan sales, workouts, and restructurings to manage our problem assets. Decreases in the value of these problem assets, the underlying collateral, or in the borrowers’ performance or financial condition would have an adverse impact, which could be material, on our business, financial condition, results of operations and prospects. In addition, the resolution of nonperforming assets requires significant commitments of time from management and staff, which can be detrimental to performance of their other responsibilities. We may experience increases in nonperforming loans in the future.

Significant increases in market interest rates on loans, or the perception that an increase may occur, could adversely affect both our ability to originate new loans and our ability to grow. Conversely, decreases in interest rates could result in an acceleration of loan prepayments. An increase in market interest rates could also adversely affect the ability of our floating-rate borrowers to meet their higher payment obligations. If this occurred, it could cause an increase in nonperforming assets and charge offs,charge-offs, which could adversely affect our business.

LIBOR and certain other “benchmarks” are the subject of recent national, international and other regulatory guidance and proposals for reform. These reforms may cause such benchmarks to perform differently than in the past or have other consequences which cannot be predicted. On July 27, 2017, the United Kingdom’s Financial Conduct Authority, which regulates LIBOR, publicly announced that it intends to stop persuading or compelling banks to submit LIBOR rates after 2021. The United Kingdom’s Financial Conduct Authority and the benchmark administrator for the U.S. Dollar LIBOR have announced that the publication of the most commonly used U.S. Dollar LIBOR settings will cease to be provided or cease to be representative after June 30, 2023. The U.S. federal banking agencies had also issued guidance strongly encouraging banking organizations to cease usingIn March 2022, the U.S. Dollar Adjustable Interest Rate (LIBOR) Act (the “LIBOR Act”) was enacted, providing a uniform approach for replacing LIBOR as a reference interest rate in “new”new contracts as soon as practicable and in any event byso-called “tough legacy” contracts. Tough legacy contracts are contracts that do not include effective fallback provisions, for example, because they have no provisions for a replacement benchmark. Under the LIBOR Act, references to the most common tenors of LIBOR in these contracts will be replaced automatically to reference a SOFR-based benchmark interest rate identified in Federal Reserve regulations. In December 31, 2021.2022, the Federal Reserve issued final regulations identifying benchmark replacements, based on SOFR, for various types of contracts subject to the LIBOR Act. We may be adversely impacted by the changes involving LIBOR and other benchmark rates as a result of our business activities and our underlying operations, and interest rates on our loans, deposits, derivatives and other financial instruments tied to LIBOR rates, as well as the revenue and expenses associated with those financial instruments, may be adversely affected.

Regulators, industry groups and certain committees (e.g., the Alternative Reference Rates Committee) have, among other things, published recommended fallback language for LIBOR-linked financial instruments, identified recommended alternatives for certain LIBOR rates (e.g., the SOFR as the recommended alternative to U.S. Dollar LIBOR), and proposed implementations of the recommended alternatives in floating rate instruments. However, the introduction of, and adoption of, successor rates had been slow until late 2021. There continues to be substantial uncertainty as to the ultimate effects of LIBOR transition, including with respect to the acceptance and use of SOFR or other alternative benchmark rates. The characteristics of these new rates are not identical to the benchmarks they seek to replace, will not produce the exact economic equivalent as those benchmarks, and may perform differently in a variety of market conditions compared to those benchmarks. For example, during the COVID-19 pandemic period, there has been more volatility in relation to SOFR as compared to LIBOR. The SOFR markets have not yet developed into robust markets, which may present continuing risks as the June 30, 2023 LIBOR cessation date approaches. At this time, it is not possible to predict whether these recommendations and proposals will be broadly accepted, whether they will continue to evolve, and what the effect of their implementation may be on the markets for floating-rate financial instruments.

The operation of our business requires us to manage credit risk. As a lender, we are exposed to the risk that our borrowers will be unable to repay their loans according to their terms, and that the collateral securing repayment of their loans, if any, may not be sufficient to ensure repayment. In addition, there are risks inherent in making any loan, including risks with respect to the period of time over which the loan may be repaid, risks relating to proper loan underwriting, risks resulting from changes in economic and industry conditions and risks inherent in dealing with individual borrowers. In order to successfully manage credit risk, we must, among other things, maintain disciplined and prudent underwriting standards and ensure that our bankers follow those standards. The weakening of these standards for any reason, such as an attempt to attract higher yielding loans, a lack of discipline or diligence by our employees in underwriting and monitoring loans, the inability of our employees to adequately adapt policies and procedures to changes in economic or any other conditions affecting borrowers and the quality of our loan portfolio, may result in loan defaults, foreclosures and additional charge-offs and may necessitate that we increase our ACL, each of which could adversely affect our net income. As a result, our inability to successfully manage credit risk could have a material adverse effect on our business, financial condition, results of operations and prospects.

Our securities portfolio currently includes securities with unrecognized losses. As of December 31, 2021,2022, gross unrealized losses in our securities portfolio were $57.9$694.3 million. We may continue to observe declines in the fair market value of these securities. Securities issued by certain states and municipalities may come under scrutiny due to concerns about credit quality. Although management believes the credit quality of the Company’s state and municipal securities portfolio to be good, there can be no assurance that the credit quality of these securities will not decline in the future. We evaluate the securities portfolio for any securities with an associated credit loss each reporting period, as required by GAAP in the United States. There can be no assurance, however, that future evaluations of the securities portfolio will not require us to recognize credit losses with respect to these and other holdings. For example, it is possible that government-sponsored programs to allow mortgages to be refinanced to lower rates could materially adversely impact the yield on our portfolio of mortgage-backed securities, since a significant portion of our investment portfolio is composed of such securities.

Our capital ratios are significantly higher than regulatory minimums. We may lower our capital ratios through selective acquisitions that meet our disciplined criteria, share repurchase plans, organic loan growth, investment in securities, or a combination of all four. We continually evaluate opportunities to expand our business through strategic acquisitions. There can be no assurance that we will be able to negotiate future acquisitions on terms acceptable to us.

Conversely, there may be circumstances under which it would be prudent to consider alternatives for raising capital to take advantage of significant acquisition opportunities or in response to changing economic conditions. In addition, we may need to raise additional capital in the future to have sufficient capital resources and liquidity to meet our commitments and fund our business needs and future growth, particularly if the quality of our assets or earnings were to deteriorate significantly. We may not be able to raise additional capital when needed on terms acceptable to us or at all. Our ability to raise additional capital, if needed, will depend on, among other things, conditions in the capital markets at the time, which are outside our control, and our financial performance. Further, if we need to raise capital in the future, we may have to do so when many other financial institutions are also seeking to raise capital and would then have to compete with those institutions for investors. An inability to raise additional capital on acceptable terms when needed could have a material adverse effect on our business, financial condition, results of operations and prospects. In addition, any capital raising alternatives could dilute the holders of our outstanding common stock and may adversely affect the market price of our common stock.

We may need or want to raise additional capital in the future to provide us with sufficient capital resources and liquidity to meet our commitments and business needs, particularly if our asset quality or earnings were to deteriorate significantly. Our ability to raise additional capital will depend on, among other things, conditions in the capital markets at that time, which are outside of our control, and our financial performance. Economic conditions and any loss of confidence in financial institutions generally may increase our cost of funding and limit access to certain customary sources of capital.

There can be no assurance that capital will be available on acceptable terms or at all. Any occurrence that may limit our access to the capital markets, such as a decline in the confidence of equity or debt purchasers, or counterparties participating in capital markets, may adversely affect our capital costs and our ability to raise capital and, potentially, our liquidity. Also, if we need to raise capital in the future, we may have to do so when many other financial institutions are also seeking to raise capital and would have to compete with those institutions for investors. An inability to raise additional capital on acceptable terms when needed could have a materially adverse effect on our business, financial condition and results of operations.

We are subject to extensive regulation, supervision and examination by federal and state banking authorities. In addition, as a publicly-traded company, we are subject to regulation by the SEC. Any change in applicable regulations or federal, state or local legislation or in policies or interpretations or regulatory approaches to compliance and enforcement, income tax laws andor accounting principles could have a substantial impact on us and our operations. Changes in laws and regulations may also increase our expenses by imposing additional fees or taxes or restrictions on our operations. Additional legislation and regulations that could significantly affect our powers, authority and operations may be enacted or adopted in the future, which could have a material adverse effect on our business, financial condition, results of operations and prospects. Failure to appropriately comply with any such laws, regulations or principles could result in sanctions by regulatory agencies or damage to our reputation, all of which could adversely affect our business, financial condition or results of operations. For example, the Dodd-Frank Act was enacted in July 2010. Among other provisions, the legislation (i) created the CFPB with broad powers to regulate consumer financial products such as credit cards and mortgages, (ii) resulted in new capital requirements from federal banking agencies, (iii) placed new limits on electronic debit card interchange fees and (iv) required the SEC and national stock exchanges to adopt significant new corporate governance and executive compensation reforms, some of which have yet to be promulgated. The Dodd-Frank Act and regulations that have been adopted thereunder have increased the overall costs of regulatory compliance, and further regulatory developments whether related to Dodd-Frank or otherwise may lead to additional costs. In addition, the CFPB has broad rulemaking authority and is the principal federal regulatory agency responsible for the supervision and enforcement of a wide range of consumer protection laws for banks with greater than $10 billion in assets.

Further, regulators have significant discretion and authority to prevent or remedy unsafe or unsound practices or violations of laws or regulations by financial institutions and holding companies in the performance of their supervisory and enforcement duties. The exercise of regulatory authority may have an adverse impact, which could be material, on our business, financial condition, results of operations and prospects. Additionally, our business is affected significantly by the fiscal and monetary policies of the U.S. federal government and its agencies, including the Federal Reserve.

We cannot accurately predict the full effects of recent legislation or the various other governmental, regulatory, monetary and fiscal initiatives which have been and may be enacted on the financial markets, on the Company and on the Bank. The terms and costs of these activities, or any worsening of current financial market and economic conditions, could materially and adversely affect our business, financial condition and results of operations, as well as the trading price of our common stock.

From time to time, the FASB and the SEC change the financial accounting and reporting standards that govern the preparation of our financial statements. These changes can materially impact how we record and report our financial condition and results of operations.

Our business is directly impacted by factors such as economic, political and market conditions, broad trends in industry and finance, changes in government monetary and fiscal policies and inflation, foreign policy, and financial market volatility, all of which are beyond our control. Global economies continue to face significant challenges to achieving normalized economic growth rates and there are continuing concerns about the effects of the COVID-19 pandemic related to the level of U.S. government debt and fiscal actions that may be taken to address that debt. There can be no assurance that economic conditions will continue to improve, and these conditions could worsen.rates. Any renewed deterioration in the economies of the nation as a whole or in our markets would have an adverse effect, which could be material, on our business, financial condition, results of operations and prospects, and could also cause the market price of our stock to decline. If recessionary economic conditions or an economic downturn develop, they would likely have a negative financial impact across the financial services industry, including on us. If these conditions are more severe, the extent of the negative impact on our business and financial performance can increase and be more severe, including the adverse effects listed above and discussed throughout this “Risk Factors” section.

Commercial banking is a highly competitive business. We compete with other commercial banks, savings and loan associations, credit unions and finance, insurance and other non-depository companies operating in our market areas. We also experience competition, especially for deposits, from Internet-based banking institutions, which have grown rapidly in recent years. We are subject to substantial competition for loans and deposits from other financial institutions. Some of our competitors are not subject to the same degree of regulation and restriction as we are and/or have greater financial resources than we do. Some of our competitors may have liquidity issues, which could impact the pricing of deposits, loans and other financial products in our markets. Our inability to effectively compete in our market areas could have a material adverse impact on our business, financial condition, results of operations and prospects.

Concerns over the long-term impacts of climate change have led and will continue to lead to governmental efforts around the world to mitigate those impacts. Consumers and businesses are also changing their behavior and business preferences as a result of these concerns. New governmental regulations or guidance relating to climate change, as well as changes in consumers’ and businesses’ behaviors and business preferences, may affect whether and on what terms and conditions we will

A major catastrophe, such as an earthquake, tsunami, flood, fire or other natural disaster, including those caused or exacerbated by climate change, public health issues such as the COVID-19 or other pandemics, or other events beyond our control, could result in a prolonged interruption of our business. For example, our headquarters are located in Tacoma, Washington and we have operations throughout the Northwest, a geographical region that has been or may be affected by earthquakes, wildfires, tsunamis and flooding activity, and in Northern California, a geographical region that has been and continues to be affected by earthquakes and wildfires. Because we primarily serve individuals and businesses in the Northwest and Northern California, a natural disaster likely would have a greater impact on our business, operations and financial condition than if our business were more geographically diverse. The occurrence of any of these natural disasters could negatively impact our performance by disrupting our operations or the operations of our customers, which could have a material adverse effect on our financial condition, results of operations and cash flows.

Holders of our common stock are only entitled to receive such dividends as our board of directors declares out of funds legally available for such payments. Although we have historically declared cash dividends on our common stock, we are not required to do so and there may be circumstances under which we would eliminate our common stock dividend in the future. This could adversely affect the market price of our common stock.

We are a separate and distinct legal entity from the Bank, and we receive substantially all of our operating cash flows from dividends and other payments from the Bank. These dividends and payments are the principal source of funds to pay dividends on our capital stock and interest and principal on any debt we may have. Various federal and state laws and regulations limit the amount of dividends that the Bank may pay to us. Also, our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of the subsidiary’s creditors. In the event the Bank is unable to pay dividends to us, we may not be able to service debt, pay obligations or pay dividends on our common stock. The inability to receive dividends from the Bank could have a material adverse impact on our business, financial condition, results of operations and prospects.

Our articles of incorporation include certain provisions that could make it more difficult to acquire us by means of a tender offer, a proxy contest, merger or otherwise. These provisions include certain non-monetary factors that our board of directors may consider when evaluating a takeover offer, and a requirement that any “Business Combination” be approved by the affirmative vote of no less than 66 2/3% of the total shares attributable to persons other than a “Control Person.” These provisions may have the effect of lengthening the time required for a person to acquire control of us through a tender offer, proxy contest or otherwise, and may deter any potentially hostile offers or other efforts to obtain control of us. This could deprive our shareholders of opportunities to realize a premium for their Columbia common stock, even in circumstances where such action is favored by a majority of our shareholders.

The following table provides information as of December 31, 2021,2022, regarding securities issued and to be issued under our equity compensation plans that were in effect during 2021:2022:

The following graph shows a five-year comparison of the total return to shareholders of Columbia’s common stock, the NASDAQ Composite Index (which is a broad nationally recognized index of stock performance by companies listed on the Nasdaq Stock Market) and the KBW Regional Banking Index (comprised of 50 banks and bank holding companies headquartered throughout the country, including Columbia).

The definition of total return includes appreciation in market value of the stock as well as the actual cash and stock dividends paid to shareholders. The graph assumes that the value of the investment in Columbia’s common stock, the NASDAQ Composite and the KBW Regional Banking Index was $100 on December 31, 2016,2017, and that all dividends were reinvested.

The Company’s determination of its ACL is a critical accounting estimate. The allowance for credit losses under ASC 326 is an accounting estimate of expected losses over the contractual life of assets carried at amortized cost within the Company’s loan portfolio at the balance sheet date. The ASU requires a financial asset (or group of financial assets) measured at amortized cost to be presented at the net amount expected to be collected. The allowance for credit losses is a valuation account that is deducted from the amortized cost basis of the financial asset to present the net carrying value at the amount expected to be collected on the financial asset.

The quantitative allowance is calculated using a DCF approach with a probability of default methodology. The probability of default is an assumption derived from regression models which determine the relationship between historical defaults and certain economic variables. The Company determines a reasonable and supportable forecast and applies that forecast to the model to determine defaults over the forecast period. The forecast includes estimates for key economic variables. While there are several economic variables included, the ones most predominantly used in our models are unemployment rate, consumer price index, real gross domestic product and disposable personal income. Following the forecast period, the economic variables used to calculate the probability of default revert to a historical average. Other assumptions relevant to the discounted cash flow model to derive the quantitative allowance include the loss given default, which is the estimate of loss for a defaulted loan, and the discount rate applied to future cash flows. The model calculates the net present value of each loan using both the contractual and expected cash flows, respectively. The ACL is determined at the end of each quarter and is based on all relevant information and expectations at that time in accordance with GAAP and the ACL guidance. Future changes to the estimate are likely as new information becomes available regarding economic conditions, loan composition and identifiable risk factors. While quantifiable estimates are generated, management judgements regarding credit risks and the inherent imprecision with the models utilized support the overall ACL.

In addition to the quantitative portion of the allowance for credit losses, the Company also considers the effects of the following qualitative factors in its calculation of expected losses in the loan portfolio: